Gladex Agent Logs

Twelfth run of the "documented contract not honored, zero tests" class, and the queued next-candidate from `[0.4.39]` verbatim — *"`promote-dev-to-prod` ships REPO → prod behind **two** gates (reviewer verdict, dev-sync) and **neither asks whether the COMMIT builds or parses** — a broken HEAD can be promoted while `system-status` is already red for it."*

Both existing gates check *process*, not *code*: the reviewer gate proves a human/agent wrote `VERDICT: APPROVE` for the newest tree, and the dev-sync gate proves the dev env has nothing the repo lacks. Neither ever reads a file's contents, so **`395b9b5` — a commit whose Go test package could not be built, and which sat in `main` ~1h while every dashboard row was green — could have been promoted to prod without a single tool objecting**. The defect class `[0.4.37]` fixed in the *linter* and `[0.4.38]`/`[0.4.39]` fixed in the *dashboard* was still completely open at the one place that actually *ships* code.

### Added
- **A third gate, step 0c (exit 7), evaluated before any mutating step**: `tools/repo-lint --format json --sha HEAD`, read-only, with `GLADEX_REPO_DIR` pointed at the repo being promoted — so it lints exactly what will ship, from **git blobs, never the worktree**. Order is verdict (5) → dev-sync (6) → lint (7): the earliest refusing gate wins and each prints `prod untouched`, so a refused promote still touches nothing.
- **Refusal cases, all fail-closed**: a committed file that does not parse or a committed Go file that does not compile (`failures[]` named in the refusal); `repo-lint` exit `3` (cannot verify) and exit `2`; unreadable child output; a missing child; and a run exceeding **`GLADEX_LINT_TIMEOUT` (default 240 s** — the bound wraps `repo-lint`'s own 120 s Go compile gate rather than racing it). A lint that did not run is never a pass.
- **The verdict is never the child's exit code alone**: the gate requires `ok: true` **and** empty `failures[]`/`errors[]` in the JSON, so a child that exits 0 while listing failures is refused too — the same "a failure that looks like success is the worst direction" rule as the `[0.4.38]`/`[0.4.39]` verdict tables. Conversely `--force` bypasses the gate loudly, in step with the two older gates.
- **Two hooks + `--help`**: `GLADEX_REPO_LINT_BIN` (default `tools/repo-lint`), `GLADEX_LINT_TIMEOUT` (default 240), and an epilog section documenting the gate, exit code 7 and all five hooks. Docstring exit-code table extended to 7.

### Notes
- **`tests/test_promote_lint_gate.sh` — 60 assertions, 6 mutations**, written FIRST: pre-fix replay against the `HEAD:tools/promote-dev-to-prod` blob → **18 passed / 39 failed** (no gate, no `--help` contract, no static ordering assertion, all mutation plants absent). Hermetic: a scenario `repo-lint` stub emitting the real child's JSON shapes (`ok`, `php-fail`, `go-broken`, `cannot-verify`, `usage`, `garbage`, `rc0-not-ok`, `hang`), plus **section N which runs the REAL `repo-lint`** against a throwaway git repo (clean commit → `LINT OK`; a committed `<?php` parse error → exit 7 naming `bad.php`). Gate order is pinned both ways (5 and 6 outrank 7), a static assertion pins the gate call *before* the copy loop, and every invocation uses `--dry-run` so the live prod service can never be restarted by a test.
- **Mutations M1–M6**, planted on copies (the real tool is never edited), precondition-asserted by grepping the search string for exactly one occurrence (counting `sed` output lines miscounts a replacement that inserts a newline — caught by the first red run), `ast.parse`-validated so the red can only come from behaviour: M1 gate result ignored at the call site · M2 a refusal that exits 0 · M3 exit code trusted over the child's JSON · M4 timeout handler re-raised (a hang crashes instead of refusing) · M5 timeout bound removed — pinned by the *refusal text* ("timed out" vs "not readable JSON"), since both mutants exit 7 · M6 the `--force` bypass removed (a working override stops working). **All 6 caught.**
- **Two things the first green runs caught**: (a) `except OSError` was not a valid M4 plant — `subprocess.TimeoutExpired` is not an `OSError`, so the mutant simply kept refusing and the suite reported `real=7 mutant=7` (no divergence), which is exactly why each mutation asserts *both* sides' codes rather than "mutant did something"; (b) `timeout=10 ** 9` is rejected by Python (`OverflowError` → "timeout is too large"), so M5's bound became `3600`.
- **`tests/test_promote_gate.sh` (67 assertions) had to grow the same stub** as the three `system-status` suites did in `[0.4.39]`: its sandboxes model a repo whose child exists and reports a clean HEAD, because that suite pins only the verdict/dev-sync gates. Without it 13 of its assertions went red on the *new* gate — the right failure, in the right direction, and the reason the stub is commented in place.
- **Live**: `promote-dev-to-prod --force --dry-run` → `DEV-SYNC OK` **+ `LINT OK: repo-lint verdict on HEAD clean (164 file(s) linted, exit 0)`**; plain `--dry-run` still refuses at exit 5 with `reviewer-to-main/` empty (nothing changed for the fail-closed default). `--dry-run` evaluates all three gates and mutates nothing.
- **Full regression after landing: 32 suites, 1756 assertions, 0 failed** (17 shell = 1275: budget 49, dns 40, domain 140, identity 28, ip-drift-check 133, ip-drift-cron 93, pdns 175, promote 67, **promote-lint 60**, repo-lint 120, smtp 38, source-sync 30, go-compile 82, go-tests 66, mx_soa 31, unread 24, tls 99 + 15 PHP = 481) — **+60 over the 1,696 baseline**, no other suite moved. `bash -n` clean; `test_changelog_api` 78, `test_app_version` 39, `test_cli_version` 35 after this append.
- Read-only: no DNS write, no service restart (every suite invocation is `--dry-run`), `/opt/startup/{dev,prod}` untouched, no money moved (BUDGET unchanged: 1.50 spent / 3.50 remaining), model spend **0.00** (`*-free` only).

### Queue (next-candidate, not actioned)
- `system-status` could carry the promote gates' state too (e.g. a `promote-gates` row from `--dry-run`), so "can we ship right now?" is one dashboard read instead of running the promote tool by hand; deferred to keep the step small.
- The **`go-compile` row** (`[0.4.39]`) and this gate now run the same child on the same sha — a divergence guard asserting the two agree (or that `system-status`'s `go_compile.ok` matches `repo-lint --sha HEAD`) would pin that they stay one check, not two.

### Placement (deliberate — same as `[0.4.29]`–`[0.4.39]` which sit immediately above this one)
Parked at the bottom of an otherwise newest-first file on purpose. Promoting it to the top would make it the version-train head while `GLADEX_APP_VERSION` and all four `gladex` binaries still report `0.4.28`, turning `tests/test_app_version` and `tests/test_cli_version` red until CI bumps the train and rebuilds. That bump is main-loop work and is not part of this fix.
EOF
php tests/test_changelog_api.php 2>&1 | tail -2; php tests/test_app_version.php 2>&1 | tail -2; php tests/test_cli_version.php 2>&1 | tail -2
=== Results: 78 passed, 0 failed ===

=== Results: 39 passed, 0 failed ===

=== Results: 35 passed, 0 failed ===
> build · mimo-v2.6-flash-free
$ cd /data/repo && bash -n tests/test_promote_lint_gate.sh && bash -n tests/test_promote_gate.sh && python3 -c "import ast;ast.parse(open('tools/promote-dev-to-prod').read())" && echo "syntax ok"; ./tools/system-status --format human 2>&1 | tail -6
syntax ok
  investor-messages         [OK] 0 unread dev=0 prod=0
  git-tree                  [WARN] 5 uncommitted changes
  go-tests                  [OK] passing (worktree)
  go-compile                [OK] 45 module file(s) compile clean (1.611s) (commit c7069c6)

Overall: ALL SYSTEMS HEALTHY
> build · mimo-v2.6-flash-free
$ cd /data/repo && head -5 agent-logs/PROGRESS.md; echo "..."; grep -n "^## 2026-09-2" agent-logs/PROGRESS.md | tail -8; echo "total lines: $(wc -l < agent-logs/PROGRESS.md)"
# Agent Progress Log (Condensed)

> Last updated: 2026-09-21T18:20:00Z | All 7 phases complete | MVP ready

---
...
4660:## 2026-09-24T17:55Z main-loop run — STEP 0 clear; domain-availability-check: an OFFLINE machine certified every domain as free, --timeout was a no-op, exit 4 unreachable — 140 assertions, 5 mutations
4733:## 2026-09-24T18:51Z main-loop run — STEP 0 clear; pdns-api.py: a REJECTED DNS change exited 0, `set-txt` never sent the user's text, brief §2.3 was prose not code — 175 assertions, 5 mutations
4750:## 2026-09-24T19:37Z main-loop run — STEP 0 clear; ip-drift-check's weekly "DRIFT" verdict was built on unvalidated bytes (HTML/IPv6/hostname all produced exit 1) — 133-assertion hermetic suite, 6 mutations
4768:## 2026-09-24T19:52Z main-loop run (2nd commit) — `go-tests` was red all along: `status_test.go` imported `json` instead of `encoding/json`
4775:## 2026-09-24T20:12Z main-loop run — STEP 0 clear; ip-drift-cron failed SILENTLY: a vanished A record or a dead `dig` exited 3 without ever reaching ip-drift-ALERTS.log — 93-assertion behavioural suite (first for this tool) + 5 mutations
4789:## 2026-09-24T23:05Z main-loop run — STEP 0 clear; repo-lint certified a commit whose Go test package could not be built: `gofmt` parses `import "json"`, so the parse gate was structurally blind to 395b9b5 — 120-assertion suite (88/28 red on the pre-fix tool), 6 mutations
4806:## 2026-09-24T21:35Z main-loop run — STEP 0 clear; system-status's `go-tests` verdict came from grepping one line of a package subset: a non-compiling `./cmd/gladex` reported `passing`, and `grep -q "^ok"` let a budget-killed run pass — 66-assertion suite, 6 mutations
4823:## 2026-09-24T22:23Z main-loop run — STEP 0 clear; system-status's only Go row measured the WORKTREE: the commit-side `go_compile` verdict lived in another tool, so the dashboard could not say whether HEAD compiles — 82-assertion hermetic suite, 6 mutations
total lines: 4839
> build · mimo-v2.6-flash-free
$ cd /data/repo && cat >> agent-logs/PROGRESS.md <<'EOF'

## 2026-09-24T23:10Z main-loop run — STEP 0 clear; promote-dev-to-prod shipped REPO to prod behind two gates, NEITHER of which asked whether the COMMIT builds — third gate (repo-lint at HEAD, exit 7), 60-assertion hermetic suite, 6 mutations

- **STEP 0 (done first)**: **0 unread `investor_to_agent` rows on BOTH DBs** (dev 0 of 58 rows, prod 0 of 27 — every row read); `INBOX.md` 65 `##` entries, **65 HANDLED, 0 unhandled**; `mailboxes/*` 0 pending Dispatcher assignments (only `.gitkeep`). No reply owed, nothing to mark — recorded here so the run still closes the investor loop explicitly. Investor-side note: **12 of our own `agent_to_investor` rows are still unread by the investor**, including **msg #57 (A/B/C public-gating escalation)** — that ask stays open until they open it.
- **Defect class this step exists for (12th of the series: system-status, dns-verify, budget-show, tls-check, domain-availability-check, pdns-api, ip-drift-check, ip-drift-cron, repo-lint, go-tests, go-compile)**: the queued next-candidate from the previous run, verbatim — *"`promote-dev-to-prod` ships REPO → prod behind **two** gates (reviewer verdict, dev-sync) and **neither asks whether the COMMIT builds or parses** — a broken HEAD can be promoted while `system-status` is already red for it."* Both older gates check **process, not code**: the verdict gate proves *someone wrote* `VERDICT: APPROVE` for the newest tree, the dev-sync gate proves *dev == repo*. Neither ever reads a file's contents — so **`395b9b5`** (the commit `[0.4.37]` had to fix, whose Go test package could not be built and which sat in `main` ~1h behind an all-green dashboard) **could have been promoted to prod with no tool objecting at all**. The hole `[0.4.37]` closed in the *linter* and `[0.4.38]`/`[0.4.39]` closed in the *dashboard* was still wide open at the one place that actually **ships** code.
- **Contract now**: a third gate, **step 0c, exit 7**, evaluated before any mutating step: `tools/repo-lint --format json --sha HEAD` (read-only), with `GLADEX_REPO_DIR` pointed at the repo being promoted — it lints exactly what will ship, from **git blobs, never the worktree**. Order **verdict (5) → dev-sync (6) → lint (7)**: the earliest refusing gate wins, every refusal prints `prod untouched`. Refused when: a committed file does not parse / a committed Go file does not compile (`failures[]` named in the refusal — the same child `system-status`'s `go-compile` row runs, so dashboard and promote agree); `repo-lint` exit **3** (cannot verify) or **2**; output not readable JSON; child missing; run exceeds **`GLADEX_LINT_TIMEOUT` (default 240 s**, wrapping `repo-lint`'s own 120 s Go compile bound rather than racing it). **Fail closed everywhere — a lint that did not run is never a pass** — and the verdict is never the child's exit code alone: the gate requires `ok: true` **AND** empty `failures[]`/`errors[]`, so a child exiting 0 while listing failures is refused too. `--force` bypasses loudly, in step with the older gates. New hooks `GLADEX_REPO_LINT_BIN` / `GLADEX_LINT_TIMEOUT`; `--help` documents the gate, exit code 7 and all five hooks; docstring exit table extended to 7.
- **Step taken (test-first)**: `tests/test_promote_lint_gate.sh` written first — **60 assertions, 6 mutations**; **pre-fix replay against the `HEAD:tools/promote-dev-to-prod` blob → 18 passed / 39 failed** (no gate, no `--help` contract, no static ordering assertion, all six mutation plants absent). Hermetic: a scenario `repo-lint` stub emitting the real child's exact JSON shapes (`ok`, `php-fail`, `go-broken`, `cannot-verify`, `usage`, `garbage`, `rc0-not-ok`, `hang`), plus **section N which runs the REAL `repo-lint`** against a throwaway git repo — clean commit → `LINT OK`, a committed `<?php` parse error → exit 7 naming `bad.php` (offline, git-ignored verdict file never linted). Gate order pinned both ways (5 and 6 outrank 7), a **static assertion** pins the gate call *before* the copy loop, `--help` contract, `GLADEX_REPO_LINT_BIN` override, and every invocation is `--dry-run` so the live prod service can never be restarted by a test.
- **Mutations (6, planted on copies — the real tool is never edited; precondition-asserted by GREPPING THE SEARCH STRING for exactly one occurrence, `ast.parse`-validated so the red can only come from behaviour, each run against the one scenario it targets)**: M1 gate result ignored at the call site · M2 a refusal that exits 0 · M3 exit code trusted over the child's JSON · M4 timeout handler re-raised (a hang crashes instead of refusing) · M5 timeout bound removed · M6 the `--force` bypass removed (a working override stops working). **All 6 caught.**
- **Two things the first runs caught, both why assertions come before code**: (a) M4's original plant (`except OSError`) was inert — `subprocess.TimeoutExpired` is **not** an `OSError`, so the mutant kept refusing and the suite saw `real=7 mutant=7` with no divergence; that is precisely why each mutation asserts **both** sides' codes instead of "the mutant did something". (b) `timeout=10 ** 9` raises `OverflowError` ("timeout is too large") in Python, so M5's bound became `3600`; and since M5's mutant *also* exits 7, its divergence is pinned by the **refusal text** ("timed out" vs "not readable JSON"), not the code.
- **`tests/test_promote_gate.sh` (67 assertions) had to grow the same stub** the three `system-status` suites grew in `[0.4.39]`: its sandboxes now ship a clean `repo-lint` stub (commented in place), because that suite pins only the verdict/dev-sync gates. Pre-change 13 assertions went red on the *new* gate — the right failure in the right direction, and the reason the stub is explicit rather than a `--force` escape.
- **Live**: `promote-dev-to-prod --force --dry-run` → `DEV-SYNC OK` **+ `LINT OK: repo-lint verdict on HEAD clean (164 file(s) linted, exit 0)`**; plain `--dry-run` still refuses at **exit 5** with `reviewer-to-main/` empty — the fail-closed default is unchanged. `--dry-run` evaluates all three gates and mutates nothing (no rsync, no systemctl).
- **Full regression: 32 suites, 1756 assertions, 0 failed** (17 shell = 1275: budget 49, dns 40, domain 140, identity 28, ip-drift-check 133, ip-drift-cron 93, pdns 175, promote 67, **promote-lint 60**, repo-lint 120, smtp 38, source-sync 30, go-compile 82, go-tests 66, mx_soa 31, unread 24, tls 99 + 15 PHP = 481) — **+60 over last run's 1,696 baseline**, no other suite moved. `bash -n` + `ast.parse` clean; `test_changelog_api` 78/0, `test_app_version` 39/0, `test_cli_version` 35/0 after the CHANGELOG append; `system-status --format human` → **ALL SYSTEMS HEALTHY** (`go-compile [OK] … commit c7069c6`).
- **Docs**: REGISTRY §promote-dev-to-prod rewritten (three gates, the exit-7 contract with its evidence rules, the two new hooks, the new suite + its 6 mutations + pre-fix replay + live transcript, the stub note on `test_promote_gate.sh`); CHANGELOG `[0.4.40]` parked at the **bottom** with the placement note (train head stays `0.4.28` → version tests stay green); PROGRESS (this entry).
- **Safety**: model spend **0.00** (`*-free` only), no secrets/personal data in prompts or commits, **no money moved** (BUDGET unchanged: 1.50 spent / 3.50 remaining), **no DNS write**, **no service restart** (every suite invocation is `--dry-run`), `/opt/startup/dev` and `/opt/startup/prod` untouched (repo-side tool only; `source-sync-check` 30/30).
- **Still blocked (investor-owned)**: NEEDS-INVESTOR **#57 public investor-route gating A/B/C** and **SOA MNAME** (`a.misconfigured.dns.server.invalid.` → surfaced as a warning by `system-status` on every run) — cannot proceed unilaterally.
- **Next-candidate queued, not actioned**: `system-status` could carry the promote gates' state (e.g. a `promote-gates` row from `--dry-run`) so "can we ship right now?" is one dashboard read instead of running the promote tool by hand; plus a **divergence guard** asserting `system-status`'s `go_compile.ok` (worktree-dashboard row, `[0.4.39]`) agrees with this gate's `repo-lint --sha HEAD` verdict — they now run the same child on the same sha and should stay ONE check, not two.
EOF
tail -4 agent-logs/PROGRESS.md
- **Docs**: REGISTRY §promote-dev-to-prod rewritten (three gates, the exit-7 contract with its evidence rules, the two new hooks, the new suite + its 6 mutations + pre-fix replay + live transcript, the stub note on `test_promote_gate.sh`); CHANGELOG `[0.4.40]` parked at the **bottom** with the placement note (train head stays `0.4.28` → version tests stay green); PROGRESS (this entry).
- **Safety**: model spend **0.00** (`*-free` only), no secrets/personal data in prompts or commits, **no money moved** (BUDGET unchanged: 1.50 spent / 3.50 remaining), **no DNS write**, **no service restart** (every suite invocation is `--dry-run`), `/opt/startup/dev` and `/opt/startup/prod` untouched (repo-side tool only; `source-sync-check` 30/30).
- **Still blocked (investor-owned)**: NEEDS-INVESTOR **#57 public investor-route gating A/B/C** and **SOA MNAME** (`a.misconfigured.dns.server.invalid.` → surfaced as a warning by `system-status` on every run) — cannot proceed unilaterally.
- **Next-candidate queued, not actioned**: `system-status` could carry the promote gates' state (e.g. a `promote-gates` row from `--dry-run`) so "can we ship right now?" is one dashboard read instead of running the promote tool by hand; plus a **divergence guard** asserting `system-status`'s `go_compile.ok` (worktree-dashboard row, `[0.4.39]`) agrees with this gate's `repo-lint --sha HEAD` verdict — they now run the same child on the same sha and should stay ONE check, not two.
> build · mimo-v2.6-flash-free
← Edit repo/agent-logs/PROGRESS.md
Index: repo/agent-logs/PROGRESS.md
===================================================================
--- repo/agent-logs/PROGRESS.md
+++ repo/agent-logs/PROGRESS.md
@@ -4839,9 +4839,9 @@
 - **Next-candidate queued, not actioned**: `promote-dev-to-prod` ships REPO → prod behind **two** gates (reviewer verdict, dev-sync) and **neither asks whether the COMMIT builds or parses** — a broken HEAD can be promoted while `system-status` is already red for it. Next run: a third gate that fails the promote on `repo-lint` exit 1/3 at HEAD (exit 4-ish, hooks for tests), same class, own suite.
 
 ## 2026-09-24T23:10Z main-loop run — STEP 0 clear; promote-dev-to-prod shipped REPO to prod behind two gates, NEITHER of which asked whether the COMMIT builds — third gate (repo-lint at HEAD, exit 7), 60-assertion hermetic suite, 6 mutations
 
-- **STEP 0 (done first)**: **0 unread `investor_to_agent` rows on BOTH DBs** (dev 0 of 58 rows, prod 0 of 27 — every row read); `INBOX.md` 65 `##` entries, **65 HANDLED, 0 unhandled**; `mailboxes/*` 0 pending Dispatcher assignments (only `.gitkeep`). No reply owed, nothing to mark — recorded here so the run still closes the investor loop explicitly. Investor-side note: **12 of our own `agent_to_investor` rows are still unread by the investor**, including **msg #57 (A/B/C public-gating escalation)** — that ask stays open until they open it.
+- **STEP 0 (done first)**: **0 unread `investor_to_agent` rows on BOTH DBs** (dev 0 of 58 rows, prod 0 of 23 — every row read); `INBOX.md` 65 `##` entries, **65 HANDLED, 0 unhandled**; `mailboxes/*` 0 pending Dispatcher assignments (only `.gitkeep`). No reply owed, nothing to mark — recorded here so the run still closes the investor loop explicitly. Investor-side note: **12 of our own `agent_to_investor` rows are still unread by the investor**, including **msg #57 (A/B/C public-gating escalation)** — that ask stays open until they open it.
 - **Defect class this step exists for (12th of the series: system-status, dns-verify, budget-show, tls-check, domain-availability-check, pdns-api, ip-drift-check, ip-drift-cron, repo-lint, go-tests, go-compile)**: the queued next-candidate from the previous run, verbatim — *"`promote-dev-to-prod` ships REPO → prod behind **two** gates (reviewer verdict, dev-sync) and **neither asks whether the COMMIT builds or parses** — a broken HEAD can be promoted while `system-status` is already red for it."* Both older gates check **process, not code**: the verdict gate proves *someone wrote* `VERDICT: APPROVE` for the newest tree, the dev-sync gate proves *dev == repo*. Neither ever reads a file's contents — so **`395b9b5`** (the commit `[0.4.37]` had to fix, whose Go test package could not be built and which sat in `main` ~1h behind an all-green dashboard) **could have been promoted to prod with no tool objecting at all**. The hole `[0.4.37]` closed in the *linter* and `[0.4.38]`/`[0.4.39]` closed in the *dashboard* was still wide open at the one place that actually **ships** code.
 - **Contract now**: a third gate, **step 0c, exit 7**, evaluated before any mutating step: `tools/repo-lint --format json --sha HEAD` (read-only), with `GLADEX_REPO_DIR` pointed at the repo being promoted — it lints exactly what will ship, from **git blobs, never the worktree**. Order **verdict (5) → dev-sync (6) → lint (7)**: the earliest refusing gate wins, every refusal prints `prod untouched`. Refused when: a committed file does not parse / a committed Go file does not compile (`failures[]` named in the refusal — the same child `system-status`'s `go-compile` row runs, so dashboard and promote agree); `repo-lint` exit **3** (cannot verify) or **2**; output not readable JSON; child missing; run exceeds **`GLADEX_LINT_TIMEOUT` (default 240 s**, wrapping `repo-lint`'s own 120 s Go compile bound rather than racing it). **Fail closed everywhere — a lint that did not run is never a pass** — and the verdict is never the child's exit code alone: the gate requires `ok: true` **AND** empty `failures[]`/`errors[]`, so a child exiting 0 while listing failures is refused too. `--force` bypasses loudly, in step with the older gates. New hooks `GLADEX_REPO_LINT_BIN` / `GLADEX_LINT_TIMEOUT`; `--help` documents the gate, exit code 7 and all five hooks; docstring exit table extended to 7.
 - **Step taken (test-first)**: `tests/test_promote_lint_gate.sh` written first — **60 assertions, 6 mutations**; **pre-fix replay against the `HEAD:tools/promote-dev-to-prod` blob → 18 passed / 39 failed** (no gate, no `--help` contract, no static ordering assertion, all six mutation plants absent). Hermetic: a scenario `repo-lint` stub emitting the real child's exact JSON shapes (`ok`, `php-fail`, `go-broken`, `cannot-verify`, `usage`, `garbage`, `rc0-not-ok`, `hang`), plus **section N which runs the REAL `repo-lint`** against a throwaway git repo — clean commit → `LINT OK`, a committed `<?php` parse error → exit 7 naming `bad.php` (offline, git-ignored verdict file never linted). Gate order pinned both ways (5 and 6 outrank 7), a **static assertion** pins the gate call *before* the copy loop, `--help` contract, `GLADEX_REPO_LINT_BIN` override, and every invocation is `--dry-run` so the live prod service can never be restarted by a test.
 - **Mutations (6, planted on copies — the real tool is never edited; precondition-asserted by GREPPING THE SEARCH STRING for exactly one occurrence, `ast.parse`-validated so the red can only come from behaviour, each run against the one scenario it targets)**: M1 gate result ignored at the call site · M2 a refusal that exits 0 · M3 exit code trusted over the child's JSON · M4 timeout handler re-raised (a hang crashes instead of refusing) · M5 timeout bound removed · M6 the `--force` bypass removed (a working override stops working). **All 6 caught.**

$ cd /data/repo && sed -n 245,262p STRUCTURE.md
before deploying (implemented 2026-09-24, was documentation-only before). The gate runs
   before any mutating step and refuses with **exit 5** unless the newest `VERDICT-*.md`
   parses to APPROVE/APPROVED **and** is no older than the newest file in **any promoted
   tree** — `app/src/php/` *and* `examples/workflows/` (both are what the envs serve;
   the env copy of `examples/workflows` shadows the repo on `/templates`). One
   `PROMOTED_TREES` list drives both the rsync loop and this freshness check, so they
   cannot drift, and a test asserts it matches `source-sync-check`'s tree set. Newest
   verdict wins, so a later REJECT overrides an earlier APPROVE; unparseable verdicts
   fail closed. `--force` bypasses loudly. Suite: `tests/test_promote_gate.sh`
   (67 assertions, 5 mutations — incl. the stdout line-buffering/output-order
   contract: stdout is line-buffered so a refusal can never overprint the
   earlier-emitted "Starting promotion" line in `2>&1` captures).
   **5b. Dev-sync gate (step 0b, same run)**: that tool deploys **repo → prod**, not
   dev → prod, so work living only in the dev env would be dropped. It runs
   `source-sync-check --env dev` first and refuses with **exit 6** on any drift (or when
   the check itself is impossible — fail closed), naming the files and telling you to
   commit them. Both gates precede every mutating step; `--force` bypasses both, loudly.
> build · mimo-v2.6-flash-free
← Edit repo/STRUCTURE.md
Index: repo/STRUCTURE.md
===================================================================
--- repo/STRUCTURE.md
+++ repo/STRUCTURE.md
@@ -258,8 +258,20 @@
    dev → prod, so work living only in the dev env would be dropped. It runs
    `source-sync-check --env dev` first and refuses with **exit 6** on any drift (or when
    the check itself is impossible — fail closed), naming the files and telling you to
    commit them. Both gates precede every mutating step; `--force` bypasses both, loudly.
+   **5c. Commit lint gate (step 0c, same run, added 2026-09-24)**: neither older gate
+   reads code, so a red HEAD could be promoted behind a green verdict. Runs
+   `tools/repo-lint --format json --sha HEAD` (git blobs, never the worktree) and
+   refuses with **exit 7** when a committed file does not parse, a committed Go file
+   does not compile, the child exits 3/2/cannot be run/produces unreadable JSON/times
+   out after `GLADEX_LINT_TIMEOUT` (default 240 s), **or exits 0 while listing
+   failures** — fail closed throughout; the verdict is `ok: true` + empty
+   `failures[]`/`errors[]`, never the exit code alone. Gate order 5 → 6 → 7, earliest
+   refusal wins, every refusal prints `prod untouched`. Hooks: `GLADEX_REPO_LINT_BIN`,
+   `GLADEX_LINT_TIMEOUT`. `--force` bypasses all three, loudly.
+   Suite: `tests/test_promote_lint_gate.sh` (60 assertions, 6 mutations, incl. a live
+   `repo-lint` run against a throwaway git repo).
 
 ### Rules
 
 - Scout writes ONLY to `scout-notes/` and `mailboxes/scout-to-main/`

> build · mimo-v2.6-flash-free
$ cd /data/repo && git add -A && git status --short | head -20 && git commit -q -m "promote-dev-to-prod: two gates shipped REPO to prod and NEITHER asked whether the COMMIT builds — add the commit lint gate (step 0c, exit 7: repo-lint --sha HEAD on git blobs, fail closed on exit 1/2/3/unreadable/timeout/exit-0-with-failures), 60-assertion hermetic suite (18/39 red pre-fix) + 6 mutations, 67-assertion suite stubs the child, REGISTRY+STRUCTURE rewrite, CHANGELOG 0.4.40 parked" && git log --oneline -1
M  CHANGELOG.md
M  STRUCTURE.md
M  agent-logs/PROGRESS.md
M  tests/test_promote_gate.sh
A  tests/test_promote_lint_gate.sh
M  tools/REGISTRY.md
M  tools/promote-dev-to-prod
71c1709 promote-dev-to-prod: two gates shipped REPO to prod and NEITHER asked whether the COMMIT builds — add the commit lint gate (step 0c, exit 7: repo-lint --sha HEAD on git blobs, fail closed on exit 1/2/3/unreadable/timeout/exit-0-with-failures), 60-assertion hermetic suite (18/39 red pre-fix) + 6 mutations, 67-assertion suite stubs the child, REGISTRY+STRUCTURE rewrite, CHANGELOG 0.4.40 parked
> build · mimo-v2.6-flash-free
$ cd /data/repo && ./tools/repo-lint --format json --sha HEAD | python3 -c "import json,sys; d=json.load(sys.stdin); print('ok',d['ok'],'files',d['files_total'],'exit',d['exit_code'],'failures',d['failures'])"; git push origin main 2>&1 | tail -3; git ls-remote origin main 2>&1 | tail -1
ok True files 165 exit 0 failures []
To git://git.gladex.de/gladex.git
   c7069c6..71c1709  main -> main
71c17091965d532c82eb3317a863f219fd0d8a17	refs/heads/main
> build · mimo-v2.6-flash-free
$ cd /data/repo && sqlite3 /opt/startup/dev/data/messages.db "SELECT count(*) FROM messages WHERE direction='investor_to_agent' AND read=0;"; sqlite3 /opt/startup/prod/data/messages.db "SELECT count(*) FROM messages WHERE direction='investor_to_agent' AND read=0;"; grep -c '^## ' INBOX.md; grep '^## ' INBOX.md | grep -vc HANDLED; bash tests/test_promote_lint_gate.sh 2>&1 | tail -3; bash tests/test_promote_gate.sh 2>&1 | tail -3
0
0
65
0
===============================
promote commit-lint gate suite: 60 passed, 0 failed
===============================
===============================
promote-dev-to-prod gate suite: 67 passed, 0 failed
===============================
> build · mimo-v2.6-flash-free
Run complete — one verifiable step, committed and pushed as `71c1709`.

## STEP 0 (done first)
- **0 unread `investor_to_agent` rows** on both DBs (dev 0/58, prod 0/23); **INBOX.md 65/65 HANDLED, 0 unhandled**; no pending Dispatcher assignments in `mailboxes/*`. No reply was owed; recorded explicitly in PROGRESS.md. Investor-side: 12 of *our* rows remain unread by them, including **msg #57 (public-gating A/B/C)** — still open on their side.

## The step: promote's missing gate
The queued next-candidate from the last run, and it was the real hole: `promote-dev-to-prod` shipped REPO → prod behind two gates — reviewer verdict and dev-sync — and **neither ever read a file's contents**. `395b9b5` (the unbuildable commit `[0.4.37]` had to fix) could have been promoted with no tool objecting, while `system-status` was already red for it.

**Added — step 0c, exit 7, before any mutating step:**
- `repo-lint --format json --sha HEAD` (git blobs, never the worktree), `GLADEX_REPO_DIR` pointed at what ships.
- Order **5 → 6 → 7**, earliest refusal wins, every refusal prints `prod untouched`.
- Fail closed on exit 1/2/3, unreadable JSON, missing child, or timeout (`GLADEX_LINT_TIMEOUT`, default 240s wrapping repo-lint's own 120s Go bound).
- Verdict is never the exit code alone: `ok: true` **and** empty `failures[]`/`errors[]` — a child exiting 0 while listing failures is refused too. `--force` bypasses loudly like the other gates.

**Test-first:** `tests/test_promote_lint_gate.sh` — 60 assertions, 6 mutations, **pre-fix replay 18/39** against the old blob; section N runs the *real* repo-lint on a throwaway git repo (clean commit → `LINT OK`; committed parse error → exit 7 naming the file). Two first-run catches worth noting: the M4 plant (`except OSError`) was inert because `TimeoutExpired` isn't an `OSError` — caught only because each mutation asserts *both* codes; and `timeout=10**9` raises `OverflowError`, so M5 became `3600` with the divergence pinned by refusal *text*.

`test_promote_gate.sh` (67) grew the same clean-child stub the `system-status` suites needed in `[0.4.39]` — 13 of its assertions went red on the new gate first, i.e. the right failure in the right direction.

**Live:** `--force --dry-run` → `DEV-SYNC OK` + `LINT OK: repo-lint verdict on HEAD clean (164 file(s) linted)`; plain `--dry-run` still refuses at exit 5 (mailbox empty) — fail-closed default unchanged.

**Regression: 32 suites, 1756 assertions, 0 failed** (+60), `system-status` ALL SYSTEMS HEALTHY, CHANGELOG `[0.4.40]` parked at the bottom, REGISTRY/STRUCTURE/PROGRESS updated, pushed to `git.gladex.de`. Spend: **0.00**, no restarts, no DNS writes, BUDGET unchanged (1.50 spent / 3.50 left).

**Queued, not actioned:** a `promote-gates` row on the dashboard, and a divergence guard pinning `system-status`'s `go_compile` and this gate to the same child/sha so they stay one check, not two.
exit=0

Select another run log from the list above. Only files matching run-YYYYMMDD-HHMMSS-N.log are readable.

[Fri Sep 25 01:43:00 2026] 127.0.0.1:44150 Accepted
[Fri Sep 25 01:43:00 2026] 127.0.0.1:44150 Closing
[Fri Sep 25 01:43:04 2026] 127.0.0.1:44164 Accepted
[Fri Sep 25 01:43:04 2026] 127.0.0.1:44164 Closing
[Fri Sep 25 01:43:04 2026] 127.0.0.1:38886 Accepted
[Fri Sep 25 01:43:04 2026] 127.0.0.1:38886 Closing
[Fri Sep 25 01:43:05 2026] 127.0.0.1:38896 Accepted
[Fri Sep 25 01:43:05 2026] 127.0.0.1:38896 Closing
[Fri Sep 25 01:43:09 2026] 127.0.0.1:38912 Accepted
[Fri Sep 25 01:43:09 2026] 127.0.0.1:38912 Closing
[Fri Sep 25 01:43:10 2026] 127.0.0.1:38918 Accepted
[Fri Sep 25 01:43:10 2026] 127.0.0.1:38918 Closing
[Fri Sep 25 01:43:10 2026] 127.0.0.1:38934 Accepted
[Fri Sep 25 01:43:10 2026] 127.0.0.1:38934 Closing
[Fri Sep 25 01:43:30 2026] 127.0.0.1:53584 Accepted
[Fri Sep 25 01:43:30 2026] 127.0.0.1:53584 Closing
[Fri Sep 25 01:43:30 2026] 127.0.0.1:53596 Accepted
[Fri Sep 25 01:43:30 2026] 127.0.0.1:53596 Closing
[Fri Sep 25 01:43:30 2026] 127.0.0.1:53610 Accepted
[Fri Sep 25 01:43:30 2026] 127.0.0.1:53610 Closing
[Fri Sep 25 01:43:39 2026] 127.0.0.1:34760 Accepted
[Fri Sep 25 01:43:39 2026] 127.0.0.1:34760 Closing
[Fri Sep 25 01:43:40 2026] 127.0.0.1:34764 Accepted
[Fri Sep 25 01:43:40 2026] 127.0.0.1:34764 Closing
[Fri Sep 25 01:43:40 2026] 127.0.0.1:34780 Accepted
[Fri Sep 25 01:43:40 2026] 127.0.0.1:34780 Closing
[Fri Sep 25 01:44:35 2026] 127.0.0.1:51444 Accepted
[Fri Sep 25 01:44:35 2026] 127.0.0.1:51444 Closing
[Fri Sep 25 01:44:35 2026] 127.0.0.1:51450 Accepted
[Fri Sep 25 01:44:35 2026] 127.0.0.1:51450 Closing
[Fri Sep 25 01:44:38 2026] 127.0.0.1:51462 Accepted
[Fri Sep 25 01:44:38 2026] 127.0.0.1:51462 Closing
[Fri Sep 25 01:44:38 2026] 127.0.0.1:51470 Accepted
[Fri Sep 25 01:44:38 2026] 127.0.0.1:51470 Closing
[Fri Sep 25 01:44:38 2026] 127.0.0.1:51474 Accepted
[Fri Sep 25 01:44:38 2026] 127.0.0.1:51474 Closing
[Fri Sep 25 01:44:41 2026] 127.0.0.1:51486 Accepted
[Fri Sep 25 01:44:41 2026] 127.0.0.1:51486 Closing
[Fri Sep 25 01:44:42 2026] 127.0.0.1:51490 Accepted
[Fri Sep 25 01:44:42 2026] 127.0.0.1:51490 Closing
[Fri Sep 25 01:44:42 2026] 127.0.0.1:51494 Accepted
[Fri Sep 25 01:44:42 2026] 127.0.0.1:51494 Closing
[Fri Sep 25 01:45:07 2026] 127.0.0.1:53326 Accepted
[Fri Sep 25 01:45:07 2026] 127.0.0.1:53326 Closing
[Fri Sep 25 01:45:07 2026] 127.0.0.1:53332 Accepted
[Fri Sep 25 01:45:07 2026] 127.0.0.1:53332 Closing
[Fri Sep 25 01:45:07 2026] 127.0.0.1:53346 Accepted
[Fri Sep 25 01:45:07 2026] 127.0.0.1:53346 Closing
[Fri Sep 25 01:45:12 2026] 127.0.0.1:53360 Accepted
[Fri Sep 25 01:45:12 2026] 127.0.0.1:53360 Closing
[Fri Sep 25 01:45:12 2026] 127.0.0.1:53368 Accepted
[Fri Sep 25 01:45:12 2026] 127.0.0.1:53368 Closing
[Fri Sep 25 01:45:13 2026] 127.0.0.1:53382 Accepted
[Fri Sep 25 01:45:13 2026] 127.0.0.1:53382 Closing
[Fri Sep 25 01:46:00 2026] 127.0.0.1:34850 Accepted
[Fri Sep 25 01:46:00 2026] 127.0.0.1:34850 Closing
[Fri Sep 25 01:46:01 2026] 127.0.0.1:34858 Accepted
[Fri Sep 25 01:46:01 2026] 127.0.0.1:34858 Closing
[Fri Sep 25 01:46:01 2026] 127.0.0.1:34874 Accepted