Gladex Agent Logs

 **Operation**:
 0. Reviewer verdict gate (above) — refuses with exit 5 before touching anything
+0b. Dev-sync gate (above) — refuses with exit 6 before touching anything
 1. Checks git status at `/data/repo`
 2. rsyncs **each** promoted tree into prod (`app/src/php` → `src/php`,
    `examples/workflows` → `examples/workflows`, both `--delete`)
 3. Runs `composer install --no-dev --optimize-autoloader` if composer.json exists

← Edit repo/tools/REGISTRY.md
Index: repo/tools/REGISTRY.md
===================================================================
--- repo/tools/REGISTRY.md
+++ repo/tools/REGISTRY.md
@@ -255,24 +255,30 @@
 6. Verifies `/healthz` endpoint returns 200 OK
 
 **Test hooks** (env, for the hermetic suite):
 - `GLADEX_REPO_DIR` (default `/data/repo`)
+- `GLADEX_DEV_ROOT` (default `/opt/startup/dev`)
 - `GLADEX_PROD_ROOT` (default `/opt/startup/prod`)
 
-**Dependencies**: git, rsync, composer (optional), systemctl, healthcheck tool, python3
+**Dependencies**: git, rsync, composer (optional), systemctl, healthcheck tool, source-sync-check, python3
 
 **Tests**:
-- `tests/test_promote_gate.sh` → **43 assertions**, hermetic sandbox, **3 mutations**
+- `tests/test_promote_gate.sh` → **63 assertions**, hermetic sandbox, **4 mutations**
   all caught (gate result ignored; any verdict accepted; freshness scope narrowed back
-  to `app/src/php` only — proving the widened scope is pinned). Also asserts
-  `examples/workflows` is rsync-planned and that this tool and `source-sync-check`
-  cover the same tree set. Every invocation uses `--dry-run`, so the suite can never
-  restart the live prod service.
+  to `app/src/php` only — proving the widened scope is pinned; **dev-sync gate result
+  ignored** — proving exit 6 is load-bearing). Also asserts `examples/workflows` is
+  rsync-planned, that this tool and `source-sync-check` cover the same tree set, gate
+  ordering (a stale verdict reports 5, not 6), and that `--force` bypasses both gates.
+  The sandbox ships a `dev/` tree in sync with `repo/` plus the real
+  `source-sync-check`, so the dev-sync gate is exercised for real. Every invocation
+  uses `--dry-run`, so the suite can never restart the live prod service.
 - Live: `promote-dev-to-prod --dry-run` → exit 5 while `reviewer-to-main/` is empty
-  (the expected fail-closed state); exit 0 only after a fresh APPROVE lands.
+  (the expected fail-closed state); `--force --dry-run` → `DEV-SYNC OK`; a probe file
+  dropped into `/opt/startup/dev/src/php/` → `DEV-SYNC REFUSED (exit 6)` naming the file
+  (probe removed, `source-sync-check --env dev` back to exit 0).
 
 **Status**: Built ✅ (verdict gate implemented 2026-09-24; promoted-tree set widened to
-every tree the envs serve 2026-09-24)
+every tree the envs serve 2026-09-24; dev-sync gate added 2026-09-24)
 
 ---
 
 ## ip-drift-check

> build · mimo-v2.6-flash-free
Now append the progress log entry:
$ cd /data/repo && grep -n 'next-candidate queued' agent-logs/PROGRESS.md | tail -3
(no output)
$ cd /data/repo && tail -5 agent-logs/PROGRESS.md; echo "=== HEAD of PROGRESS (structure) ==="; head -20 agent-logs/PROGRESS.md; echo "=== date ==="; date -u +%Y-%m-%dT%H:%M:%SZ
first (even though `source-sync-check` already computes exactly that drift).
  Either invoke `source-sync-check` pre-promote and refuse on dev≠repo, or
  rename to `promote-repo-to-prod` so the contract is honest. Minor cosmetic
  seen in the same run: on a gate refusal, stderr ("Promotion aborted…")
  prints *before* stdout ("Starting promotion…") due to stream buffering.
=== HEAD of PROGRESS (structure) ===
# Agent Progress Log (Condensed)

> Last updated: 2026-09-21T18:20:00Z | All 7 phases complete | MVP ready

---

## Phase 0 — Bootstrap (2026-09-20)

| Milestone | Commit | Notes |
|-----------|--------|-------|
| STRUCTURE.md documented | e90fb9e | Machine-readable filestructure, naming conventions |
| domain-availability-check tool | — | RDAP/whois/DNS, JSONL output, --help, exit codes |
| budget-show tool | ca4ee23 | Parses BUDGET.md, --format json\|human |
| dns-verify tool | d6ec8f6 | dig-based, JSONL, --server, --timeout |
| healthcheck tool | 41c7b1d | Checks dev/prod /healthz, --format json\|human |
| promote-dev-to-prod tool | f28307f | Git checkout, build, restart, verify |
| ip-drift-check tool | 8686479 | Compares public IP vs DNS A record |
| ip-drift-cron | de40b13 | Weekly Sunday 03:00 UTC, detect+alert only (never writes DNS since 2026-09-23) |
| system-status tool | 5070b3e | 14-check system health overview |
| version-check tool | 15a50fa | Verifies dev/prod version parity |
=== date ===
2026-09-24T11:59:32Z
> build · mimo-v2.6-flash-free
Appending a new dated section (per the standing rule against editing old blocks):
$ cat >> /data/repo/agent-logs/PROGRESS.md <<'EOF'

---

## Run 2026-09-24T12:00Z — promote: dev-sync gate (exit 6) closes the repo→prod gap

**STEP 0 (investor reply) — DONE FIRST, nothing owed:**
- `sqlite3 messages.db` unread `investor_to_agent`: **0 rows** (dev; prod likewise 0).
- `INBOX.md`: every `## …` entry already carries `~~HANDLED <ts>~~`.
- Therefore no `agent_to_investor` rows were due this run — no unanswered investor.

**One small verifiable step:** closed the queued "next-candidate" from the previous run —
`promote-dev-to-prod` is named dev→prod but actually ships **repo → prod**, so any change
living only in the dev env would be **silently dropped** by a promotion.

- **New gate (step 0b, still before every mutating step)**: runs
  `tools/source-sync-check --env dev --format json` and refuses with **exit 6** on any
  drift, or when the check itself cannot run (checker missing / timeout / missing base
  dir) — **fail closed**. Delegates to the existing comparator instead of reimplementing
  it, so there is one source of truth and test P (tree-set parity) covers both.
- Refusal message names up to 5 offending files, explains *why* (`REPO -> prod`, work
  would be dropped), and points at `tools/source-sync-check --env dev` for the full list.
- `--force` bypasses **both** gates, loudly, on stderr.
- New exit code **6**, new test hook **`GLADEX_DEV_ROOT`** (default `/opt/startup/dev`),
  documented in `--help`, `REGISTRY.md`, `STRUCTURE.md`.

**Verified:**
- `tests/test_promote_gate.sh` → **63 assertions, 0 failed** (was 43).
  New sections R–W: dev-in-sync passes; dev-only file → exit 6 naming it; missing dev
  tree → exit 6 ("cannot verify"); `--force` bypasses loudly; **gate ordering** (stale
  verdict reports 5, not 6); plus a **4th mutation** — dev-sync result ignored → `6|0`
  divergence caught, proving exit 6 is load-bearing rather than decorative.
  The sandbox now ships a `dev/` tree in sync with `repo/` and the real
  `source-sync-check`, so the gate is exercised for real, not stubbed.
- **Live, read-only**: `--force --dry-run` → `DEV-SYNC OK … nothing in dev would be
  dropped`; probe file dropped into `/opt/startup/dev/src/php/` → `DEV-SYNC REFUSED
  (exit 6)` naming `__drift_probe.php`; probe removed, `source-sync-check --env dev`
  back to **exit 0**. Plain `--dry-run` still exits **5** (mailbox empty — correct
  fail-closed state, unchanged).
- **Full suite green**: 5/6 shell + 14/14 PHP. The 1 failure
  (`test_identity_wrapper.sh` → `case4 temp capture cleaned by trap`) is **pre-existing
  and unrelated** — reproduced identically with this run's changes `git stash`ed; it
  touches no file this run edited. Queued for a separate run.
- **Health**: model spend **0.00** (`*-free` only), no money spent, no DNS write, no
  secret read, no paid API key touched. Prod service never restarted (all invocations
  `--dry-run`).

**Docs**: `tools/REGISTRY.md` (exit 6, dev-sync gate section, op step 0b, hooks, test
counts), `STRUCTURE.md` workflow step 5b.

**NEEDS-INVESTOR (unchanged, still open)**: (a) **A/B/C public-gating decision** (msg
**#57**, still unopened) — investor surface remains world-reachable via Apache `:443`
ProxyPass; recommend **A**, or A+B; no config change until the call. (b) **SOA MNAME
placeholder** — provider panel only, surfaces each run as the `SOA:gladex.de` warning.

**Next-candidate queued, not actioned**: the stderr/stdout ordering cosmetic from the
previous run (gate refusal prints "Promotion aborted…" before "Starting promotion…"
due to stream buffering) — trivial `flush=True` fix, deliberately left for a later run
so this run stays one verifiable step.
EOF
echo "appended"; tail -3 /data/repo/agent-logs/PROGRESS.md
appended
previous run (gate refusal prints "Promotion aborted…" before "Starting promotion…"
due to stream buffering) — trivial `flush=True` fix, deliberately left for a later run
so this run stays one verifiable step.
> build · mimo-v2.6-flash-free
Now commit this step:
$ cd /data/repo && cat BUDGET.md
month: 2026-09
allowance: 5.00
spent: 1.50 (gladex.de — investor-approved 2026-09-20, purchase pending at registrar)
remaining: 3.50
log:
  - 2026-09-20: init, no domains ordered yet
  - 2026-09-20: investor APPROVED gladex.de (1.50/mo). Awaiting registrar purchase + DNS creds.
rules: .de 1.50/mo, .com/.org/.net 2.50/mo. No rollover. All purchases through investor.
$ cd /data/repo && bash tests/test_promote_gate.sh 2>&1 | tail -4 && git add -A && git commit -q -m "feat: add dev-sync gate to promote-dev-to-prod — refuse exit 6 while dev tree differs from repo, so repo->prod promotion can no longer silently drop dev-only work" && git log --oneline -1 && git push origin main 2>&1 | tail -3
===============================
promote-dev-to-prod gate suite: 63 passed, 0 failed
===============================
48b166e feat: add dev-sync gate to promote-dev-to-prod — refuse exit 6 while dev tree differs from repo, so repo->prod promotion can no longer silently drop dev-only work
To git://git.gladex.de/gladex.git
   09c6dc1..48b166e  main -> main
> build · mimo-v2.6-flash-free
Committed `48b166e` and pushed to origin/main.

## This run

**STEP 0 — investor reply (done first):** Queried `messages.db`: **0 unread** `investor_to_agent` rows (dev and prod). Read `INBOX.md`: every `## …` entry already carries `~~HANDLED <ts>~~`. Nothing was owed, so no reply rows were due — recorded as such in PROGRESS.md rather than skipped silently.

**One verifiable step:** closed the queued next-candidate — `promote-dev-to-prod` is named dev→prod but actually ships **repo → prod**, so a change living only in the dev env would be silently dropped.

- **New step-0b gate**, before any mutating action: runs `source-sync-check --env dev` and refuses with **exit 6** on drift — or when the check itself can't run (checker missing, timeout, missing base dir) → **fail closed**.
- Delegates to the existing comparator rather than reimplementing it, so tree-set parity (test P) automatically covers both.
- Refusal names up to 5 files, explains *why* it would be lost, and gives the command for the full list.
- `--force` bypasses both gates, loudly; new `GLADEX_DEV_ROOT` test hook; exit 6 documented in `--help`, `REGISTRY.md`, `STRUCTURE.md`.

**Verification:**
| Check | Result |
|---|---|
| `tests/test_promote_gate.sh` | **63 passed, 0 failed** (was 43) |
| New mutation (gate result ignored) | `6\|0` divergence caught |
| Live `--force --dry-run` | `DEV-SYNC OK` |
| Live probe file in dev env | `DEV-SYNC REFUSED (exit 6)` naming it; probe removed, back to exit 0 |
| Full suite | 5/6 shell + 14/14 PHP |
| Model spend | **0.00** (`*-free` only), no money, no DNS write, no secret read |

**One caveat worth flagging:** `tests/test_identity_wrapper.sh` (`case4 temp capture cleaned by trap`) fails — I reproduced it identically with this run's changes `git stash`ed, so it's pre-existing and touches no file I edited. It's queued for a separate run rather than bundled here.

**Still open (needs you):** msg **#57** — the A/B/C public-gating decision for the investor surface, unopened. Also the SOA MNAME placeholder, which is provider-panel-only.
exit=0

Select another run log from the list above. Only files matching run-YYYYMMDD-HHMMSS-N.log are readable.

[Fri Sep 25 01:05:33 2026] 127.0.0.1:33462 Accepted
[Fri Sep 25 01:05:33 2026] 127.0.0.1:33462 Closing
[Fri Sep 25 01:07:29 2026] 127.0.0.1:42732 Accepted
[Fri Sep 25 01:07:29 2026] 127.0.0.1:42732 Closing
[Fri Sep 25 01:07:29 2026] 127.0.0.1:42748 Accepted
[Fri Sep 25 01:07:30 2026] 127.0.0.1:42748 Closing
[Fri Sep 25 01:07:30 2026] 127.0.0.1:42750 Accepted
[Fri Sep 25 01:07:30 2026] 127.0.0.1:42750 Closing
[Fri Sep 25 01:07:30 2026] 127.0.0.1:42756 Accepted
[Fri Sep 25 01:07:30 2026] 127.0.0.1:42756 Closing
[Fri Sep 25 01:07:30 2026] 127.0.0.1:42762 Accepted
[Fri Sep 25 01:07:30 2026] 127.0.0.1:42762 Closing
[Fri Sep 25 01:07:30 2026] 127.0.0.1:42770 Accepted
[Fri Sep 25 01:07:30 2026] 127.0.0.1:42770 Closing
[Fri Sep 25 01:07:30 2026] 127.0.0.1:42780 Accepted
[Fri Sep 25 01:07:30 2026] 127.0.0.1:42780 Closing
[Fri Sep 25 01:09:05 2026] 127.0.0.1:43758 Accepted
[Fri Sep 25 01:09:05 2026] 127.0.0.1:43758 Closing
[Fri Sep 25 01:29:04 2026] 127.0.0.1:52792 Accepted
[Fri Sep 25 01:29:04 2026] 127.0.0.1:52792 Closing
[Fri Sep 25 01:29:05 2026] 127.0.0.1:33658 Accepted
[Fri Sep 25 01:29:05 2026] 127.0.0.1:33658 Closing
[Fri Sep 25 01:29:05 2026] 127.0.0.1:33674 Accepted
[Fri Sep 25 01:29:05 2026] 127.0.0.1:33674 Closing
[Fri Sep 25 01:34:56 2026] 127.0.0.1:49482 Accepted
[Fri Sep 25 01:34:56 2026] 127.0.0.1:49482 Closing
[Fri Sep 25 01:34:56 2026] 127.0.0.1:49488 Accepted
[Fri Sep 25 01:34:56 2026] 127.0.0.1:49488 Closing
[Fri Sep 25 01:34:56 2026] 127.0.0.1:49494 Accepted
[Fri Sep 25 01:34:56 2026] 127.0.0.1:49494 Closing
[Fri Sep 25 01:34:56 2026] 127.0.0.1:49504 Accepted
[Fri Sep 25 01:34:56 2026] 127.0.0.1:49504 Closing
[Fri Sep 25 01:34:56 2026] 127.0.0.1:49508 Accepted
[Fri Sep 25 01:34:56 2026] 127.0.0.1:49508 Closing
[Fri Sep 25 01:34:56 2026] 127.0.0.1:49522 Accepted
[Fri Sep 25 01:34:56 2026] 127.0.0.1:49522 Closing
[Fri Sep 25 01:34:56 2026] 127.0.0.1:49536 Accepted
[Fri Sep 25 01:34:57 2026] 127.0.0.1:49536 Closing
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60400 Accepted
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60400 Closing
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60408 Accepted
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60408 Closing
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60422 Accepted
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60422 Closing
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60428 Accepted
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60428 Closing
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60442 Accepted
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60442 Closing
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60446 Accepted
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60446 Closing
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60462 Accepted
[Fri Sep 25 01:37:40 2026] 127.0.0.1:60462 Closing
[Fri Sep 25 01:42:50 2026] 127.0.0.1:37798 Accepted
[Fri Sep 25 01:42:50 2026] 127.0.0.1:37798 Closing
[Fri Sep 25 01:42:50 2026] 127.0.0.1:37802 Accepted
[Fri Sep 25 01:42:50 2026] 127.0.0.1:37802 Closing
[Fri Sep 25 01:42:51 2026] 127.0.0.1:37814 Accepted
[Fri Sep 25 01:42:51 2026] 127.0.0.1:37814 Closing
[Fri Sep 25 01:42:51 2026] 127.0.0.1:37818 Accepted