agent-platform/docs/current_status.md

Current Status — agent-platform

Date: 2026-07-06 Repository: https://forgejo.media-on.de/Leopoldadmin/agent-platform Local path: /a0/usr/workdir/agent-platform/ Branch: main Commit: 347ccb0 ("fix: C3 case-insensitive Bearer prefix + S1 MCP asyncio.Lock (closes 2 xfail)") Visibility: public (verified, no secrets in tree) App version (api.py): 0.3.0

---

1. Release phase

Phase: Release Handoff (Gate 7 of 7: intake → requirements → architecture → UI (n/a) → implementation → test → deployment → release). Cadence: 3rd release_auditor call this project (matches the 3-block release-auditor rule). Decision (this audit): HOLD — see RELEASE_NOTES.md § "Promote decision".

Gate	Result
intake	PASS (PLAN.md §1–§9 present, problem + outcome stated)
requirements	PASS_WITH_NOTES (B-IDs and C-IDs in code + tests, but no standalone requirements.md)
architecture	PASS (PLAN.md §2–§6, 2-container compose, MCP via /mcp path)
UI design	N/A (server-side HTMX UI, no separate design phase)
implementation	PASS_WITH_NOTES (matches architecture; residual C/D/M/X issues tracked)
test	PASS (pytest: 19 passed, 2 xpassed — see test_report.md in docs/)
deployment	PASS (Coolify staging healthy, compose + Traefik labels durable)
release	PASS_WITH_NOTES (RELEASE_NOTES.md, rollback plan, secrets handling)

2. Deploy status

Env	Status	URL
Staging (Coolify)	healthy (200, mcp_server reachable, 1 agent)	https://staging.agent-platform.media-on.de
Production	NOT DEPLOYED — pending HOLD resolution	n/a

Coolify identifiers:

• Project UUID: xht8vwszdqrk9biytxzsopu6
• Resource UUID: n27nquozfhcgbph182ivbht3

Last known good image tag: 4847d3eb05ab324273d80c4594956b1a79483fe9.

3. Live state (last verified during this audit)

• /health → 200, mcp_server: "reachable", agents: 1, llm_model: deepseek/deepseek-v4-flash.
• /api/agents (Bearer w6M…0W0) → 200, one agent (example, source=code, 6 allowed_tools).
• Both containers (agent-platform, mcp-tools) healthy in Coolify.
• Caveat 1: LLM_API_KEY empty in Coolify env → /api/chat/* returns 500 until set. /health, CRUD, UI all work.
• Caveat 2: Master AUTH_TOKEN is currently the staging one — must be rotated before production (see RELEASE_NOTES.md § "Production checklist").

4. Next action (single, unambiguous)

1. Promoter (human): resolve HOLD blockers in RELEASE_NOTES.md:
   • Set LLM_API_KEY in Coolify env (any LLM provider).
   • Decide whether to land SSRF hardening (S2) + auth-event audit (S5) before promotion, or accept the residual risk in writing.
   • Rotate AUTH_TOKEN for production.
2. Release auditor: re-run this audit after the two patches above (small, ≤ S-effort each).
3. Deploy agent: clone compose to a new production Coolify resource, swap FQDN, bind production AUTH_TOKEN + LLM_API_KEY, redeploy.
4. No further code changes to agent_platform/ unless HOLD blockers resolve into code.

5. Open block-level context

• 3 blocks completed this project (per 3-block release-auditor rule).
• Audit + reviewer block-compaction calls do NOT count toward the 3-task limit.
• Pending: next_steps left implicit via RELEASE_NOTES.md § "Production checklist"; will be added to next_step DB once HOLD is cleared.