[abla86]

Confirmed production blockers

• Render logs show the service exits because SESSION_SECRET is missing.
• The production host default was 127.0.0.1, which is not reachable by Render's public port scanner.
• A second global API-key gate blocked the browser even after login: the frontend sends signed Bearer sessions, not X-API-Key.
• The API's fallback paths fabricated successful deployment verification and successful PR creation when the backend was unavailable.

Fixes

• Bind to 0.0.0.0 by default in production while keeping localhost binding for development.
• Use the existing signed session token as the single production API authentication mechanism. Keep health/login public, block remote registration, and require a valid Bearer session for other API routes.
• Send the signed session from the frontend's protected Sentinel calls.
• Return unreachable/success: false when verification or PR creation did not actually happen.
• Expand the production smoke test to exercise the production host binding, seeded test account, login, unauthenticated rejection and authenticated /me access.

Required Render environment

Set SESSION_SECRET (at least 32 random characters) and CODE_SENTINEL_DEMO_USERS_JSON with the owner account. No API key is exposed to the browser.

[abla86]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-01T13:00:06.292406Z	43e6bc3	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: 43e6bc3005

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".