Model-provider portability, the nav/dashboard/security fixes, and a readiness gate that can't pass by skipping #5564

Accumulated work on feat/model-provider-portability. The newest commit is the one worth reviewing closely.

Readiness + onboarding checks (181f2e6)

The readiness script reported two states, so the run that checked the least looked exactly like the run that checked the most. privacy and authz-matrix — the two gates that actually catch a private repo leaking — recorded ok: true when their inputs were absent, and the summary then said "all hard gates passed".

Three changes:

Gates are tri-state. pass / fail / unverified. A gate that could not run is never scored as either of the other two, blocks READY on its own terms, and names the input that would settle it. Exit codes separate the two ways of not being ready, because they have different owners — 1 is a defect in the product, 3 is a missing input in whoever invoked the gate. Collapsing them is how "we ran the checks" came to mean "we ran whichever checks the environment permitted".

New onboarding hard gate. The getting-started page is a list of promises and nothing checked that any of them led anywhere. Its CTAs are read from source rather than listed literally, for the same reason repoScopedGetRoutes is — a literal list is a list nobody extends on the day they add step six. 404 and 5xx fail; a 302 to login passes, because the route exists and is doing its job. Currently 8 destinations, all resolving.

Playwright is a lazy import, so --no-browser stops requiring the dependency it exists to avoid. That is what kept this gate off the machine that should run it every deploy: the CI runner executes inside the app container, which ships no browser. .gluecron/workflows/deploy.yml now runs it against the build it just confirmed live — until now that job proved the right bytes shipped and nothing more, which a deploy serving 500s on every page would also have passed. Exit 3 there prints the coverage gap and passes, deliberately: buildRunnerEnv strips credentials from the runner by design, and failing a deploy over a gap we created on purpose trains everyone to ignore a red deploy.

Against production right now: 4/8 hard gates verified passing, 4 unverified (2 need --private-repo/--public-repo, 2 need Chromium). Previously that same run reported "all hard gates passed".

New: bun run readiness, bun run readiness:full, bun run first-run.

12 new tests pin the verdict arithmetic and the source-derived extraction — both regexes over source files, which degrade quietly, and an empty match list is a gate that probes nothing while reporting a clean run.

Still open after this

• The PAGES and AUTH_ONLY lists in the gate are still hand-maintained literals — the exact drift the rest of the file is built to avoid.
• scripts/first-run-journey.mjs (the 10-step brand-new-human journey) still runs only when someone remembers. It is the best asset in the repo and nothing invokes it.
• The three continuous synthetic journeys cover read paths only. No write path — repo create, push, PR, merge — is continuously exercised.

🤖 Generated with Claude Code

https://claude.ai/code/session_01YByzT4xu2Sq6RRqQiGh5Nd