==> Wait for production to serve this commit
$ SHA=$(git rev-parse HEAD)
echo "verifying deploy of $SHA"
for i in $(seq 1 36); do
  LIVE=$(wget -qO- --timeout=10 https://gluecron.com/api/version 2>/dev/null | sed -n 's/.*"shaFull":"\([a-f0-9]*\)".*/\1/p' || true)
  if [ "$LIVE" = "$SHA" ]; then
    echo "deploy verified: production serves $SHA (after ~$((i * 10))s)"
    exit 0
  fi
  if [ -n "$LIVE" ]; then
    git fetch --quiet origin 2>/dev/null || true
    if git cat-file -e "${LIVE}^{commit}" 2>/dev/null && git merge-base --is-ancestor "$SHA" "$LIVE" 2>/dev/null; then
      echo "deploy verified: production serves $LIVE, which CONTAINS $SHA"
      echo "(superseded by a newer deploy - this commit shipped)"
      exit 0
    fi
  fi
  echo "attempt $i/36 — production serves ${LIVE:-unknown}, waiting..."
  sleep 10
done
echo "DEPLOY NOT VERIFIED after 6 minutes."
echo "Production serves ${LIVE:-unknown}, which is neither $SHA nor a descendant of it."
echo "The gluecron-update timer may be stuck."
echo "On the host: systemctl list-timers 'gluecron-*' && journalctl -u gluecron-update"
exit 1
verifying deploy of 2d003696a3ace66a1737686a0aa9b4787d1ff099
deploy verified: production serves 2d003696a3ace66a1737686a0aa9b4787d1ff099 (after ~10s)

[exit 0 in 296ms]

==> Readiness gates against the live build
$ set +e
bun scripts/production-readiness.mjs --base https://gluecron.com --no-browser
CODE=$?
set -e
if [ "$CODE" = "1" ]; then
  echo "READINESS FAILED — a hard gate broke on the build now serving production."
  exit 1
fi
if [ "$CODE" = "3" ]; then
  echo "Readiness INCONCLUSIVE — every gate this runner can execute passed;"
  echo "the browser and credentialed gates need 'bun run readiness:full' from a workstation."
  exit 0
fi
if [ "$CODE" != "0" ]; then
  echo "READINESS CRASHED (exit $CODE)"
  exit 1
fi
[readiness] target: https://gluecron.com

GATE          KIND   RESULT      DETAIL
--------------------------------------------------------------------------------------------------------------
provenance    HARD   PASS        sha=2d00369 builtAt=2026-09-01T18:41:06.167Z
api-json      HARD   PASS        unknown /api/* path returned 404 as application/json
privacy       HARD   UNVERIFIED  no --private-repo owner/name given — anonymous disclosure of a private repo was NOT tested
authz-matrix  HARD   UNVERIFIED  needs --private-repo AND --public-repo — the gate that catches leaks across every repo-scoped route did not run
auth-gate     HARD   PASS        98 guarded paths correctly gated (98 derived from source)
onboarding    HARD   PASS        8 onboarding destinations all resolve
render        HARD   UNVERIFIED  ran with --no-browser — needs a working Chromium for the full verdict
overflow      HARD   UNVERIFIED  ran with --no-browser — needs a working Chromium for the full verdict
images        soft   UNVERIFIED  ran with --no-browser — needs a working Chromium for the full verdict
headings      soft   UNVERIFIED  ran with --no-browser — needs a working Chromium for the full verdict
perf          soft   UNVERIFIED  ran with --no-browser — needs a working Chromium for the full verdict

[readiness] HARD 4/8 verified passing · 4 unverified · soft warnings: 0
Readiness INCONCLUSIVE — every gate this runner can execute passed;
the browser and credentialed gates need 'bun run readiness:full' from a workstation.

[stderr]

[readiness] COVERAGE GAP — 4 hard gate(s) never ran:
  - privacy: no --private-repo owner/name given — anonymous disclosure of a private repo was NOT tested
  - authz-matrix: needs --private-repo AND --public-repo — the gate that catches leaks across every repo-scoped route did not run
  - render: ran with --no-browser — needs a working Chromium for the full verdict
  - overflow: ran with --no-browser — needs a working Chromium for the full verdict

[exit 0 in 1152ms]