Next moves: off-box incident writer + SLO windows, platform-fault-aware CI, post-merge verifier, actionable inbox, /guarantees, and the one-box reliability list #5502

Why

Second wave of docs/AUDIT-2026-08-19-PLATFORM-AND-20-MOVES.md — the moves that answer the two loudest GitHub failures of 2026 (outages nobody could see coming; a merge queue that silently reverted code) plus the rest of the one-box reliability list. 11 commits.

Moves

• #1 Reliability as the product — POST /api/heartbeat/report (token-gated, timing-safe, never fails open) so the GitHub heartbeat writes incidents from outside the box; /status shows 24h / 30d / 90d uptime + days-since-incident and states its method. Owner: set HEARTBEAT_REPORT_TOKEN on the box + as a GitHub repo secret.
• #2 Platform-fault-aware CI — src/lib/ci-outcome.ts; merge gate says "CI did not complete — interrupted by a platform restart — not your code" instead of "CI failed"; run pill grey ⟳; DORA excludes infra runs from the denominator.
• #3 Merge-safety — post-merge verifier on all four merge paths (pr-merge, gated/MCP/v2, merge-queue, web merge button incl. squash): base ref, previous-tip ancestry, head ancestry (or squash parent), merge-tree --write-tree equality, objects present → audit_log merge.verified/verification_failed, PR comment + admin page on failure; /:owner/:repo/merges/verify page + recompute.
• #4 AI off switch — verified every automated trigger honours per-repo Automation settings; pinned by a coverage test.
• #7 Actionable inbox — default "Needs you" filter, bell badge counts actionable unread only, Mentions pill actually filters by kind (it returned every unread row).
• #13 /guarantees — seven code-enforced guarantees each pinned by guarantees.test.ts (no ads in anything we write into your repo, AI off switch, no training, plain git, self-host free, status computed not painted, preview labelled), three policy commitments labelled as policy. Footer link.

Reliability list

Deploy: build → migrate on the new image → switch (build/migration failure aborts before anything is replaced; new build_failed / migration_aborted owner notifications); real started/finished events posted to /admin/deploys from the script; /admin/ops dead GitHub-dispatch buttons replaced by the truth. Push body cap 256 MiB + server ceiling. Workflow-runner claim RETURNING-checked. Paging webhook on every spine alert (ntfy headers), spike cooldown persisted. dep:tls probe. Neon fetch bounded (8s) + 5-failure breaker. Restore drill verifies the repos tarball (fsck + count) from the offsite copy. Remediation re-verify was reading probes by array index (broken by any insertion) — now by name.

Tests

Full suite on the branch: 4850 pass / 5 fail / 133 skip — the 5 are the pre-existing failures on main (claude-config, close-keywords-apply, json-in-script, suppression-quality ×2). ~200 new tests across 14 files. bun run typecheck clean.

🤖 Generated with Claude Code