# Current Status — agent-platform

**Date**: 2026-07-06
**Repository**: https://forgejo.media-on.de/Leopoldadmin/agent-platform
**Local path**: `/a0/usr/workdir/agent-platform/`
**Branch**: `main`
**Commit**: `347ccb0` ("fix: C3 case-insensitive Bearer prefix + S1 MCP asyncio.Lock (closes 2 xfail)")
**Visibility**: public (verified, no secrets in tree)
**App version** (`api.py`): `0.3.0`

---

## 1. Release phase

**Phase**: Release Handoff (Gate 7 of 7: intake → requirements → architecture → UI (n/a) → implementation → test → deployment → release).
**Cadence**: 3rd `release_auditor` call this project (matches the 3-block release-auditor rule).
**Decision (this audit)**: **HOLD** — see `RELEASE_NOTES.md` § "Promote decision".

| Gate | Result |
|---|---|
| intake | PASS (PLAN.md §1–§9 present, problem + outcome stated) |
| requirements | PASS_WITH_NOTES (B-IDs and C-IDs in code + tests, but no standalone `requirements.md`) |
| architecture | PASS (PLAN.md §2–§6, 2-container compose, MCP via `/mcp` path) |
| UI design | N/A (server-side HTMX UI, no separate design phase) |
| implementation | PASS_WITH_NOTES (matches architecture; residual C/D/M/X issues tracked) |
| test | PASS (`pytest`: 19 passed, 2 xpassed — see `test_report.md` in `docs/`) |
| deployment | PASS (Coolify staging healthy, compose + Traefik labels durable) |
| release | PASS_WITH_NOTES (`RELEASE_NOTES.md`, rollback plan, secrets handling) |

## 2. Deploy status

| Env | Status | URL |
|---|---|---|
| **Staging (Coolify)** | healthy (200, mcp_server reachable, 1 agent) | https://staging.agent-platform.media-on.de |
| Production | **NOT DEPLOYED** — pending HOLD resolution | n/a |

Coolify identifiers:
- Project UUID: `xht8vwszdqrk9biytxzsopu6`
- Resource UUID: `n27nquozfhcgbph182ivbht3`

Last known good image tag: `4847d3eb05ab324273d80c4594956b1a79483fe9`.

## 3. Live state (last verified during this audit)

- `/health` → 200, `mcp_server: "reachable"`, `agents: 1`, `llm_model: deepseek/deepseek-v4-flash`.
- `/api/agents` (Bearer `w6M…0W0`) → 200, one agent (`example`, source=code, 6 allowed_tools).
- Both containers (`agent-platform`, `mcp-tools`) healthy in `Coolify`.
- **Caveat 1**: `LLM_API_KEY` empty in Coolify env → `/api/chat/*` returns 500 until set. `/health`, CRUD, UI all work.
- **Caveat 2**: Master `AUTH_TOKEN` is currently the staging one — must be **rotated** before production (see `RELEASE_NOTES.md` § "Production checklist").

## 4. Next action (single, unambiguous)

1. **Promoter (human)**: resolve HOLD blockers in `RELEASE_NOTES.md`:
   - Set `LLM_API_KEY` in Coolify env (any LLM provider).
   - Decide whether to land SSRF hardening (S2) + auth-event audit (S5) before promotion, or accept the residual risk in writing.
   - Rotate `AUTH_TOKEN` for production.
2. **Release auditor**: re-run this audit after the two patches above (small, ≤ S-effort each).
3. **Deploy agent**: clone compose to a new production Coolify resource, swap `FQDN`, bind production `AUTH_TOKEN` + `LLM_API_KEY`, redeploy.
4. **No further code changes** to `agent_platform/` unless HOLD blockers resolve into code.

## 5. Open block-level context

- 3 blocks completed this project (per 3-block release-auditor rule).
- Audit + reviewer block-compaction calls do NOT count toward the 3-task limit.
- Pending: next_steps left implicit via `RELEASE_NOTES.md` § "Production checklist"; will be added to `next_step` DB once HOLD is cleared.