M8/D7: dashboard overview + badges live at ci.commoninternet.net (verified via gateway)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

JOURNAL.md

@@ -631,3 +631,28 @@ conflicts with cc-ci's no-ACME/static-wildcard design).
 5. lasuite-docs — multi-service + S3/MinIO/object-storage (Drone #57)
 6. n8n — workflow automation (Drone canonical run triggering now)
 All 5 required D10 categories covered. Triggering n8n canonical Drone run, then claiming the M6.5 gate.
+
+---
+## 2026-05-27 — M8/D7: results dashboard live (overview + badges)
+
+Built the results dashboard (dashboard/dashboard.py + modules/dashboard.nix): a stdlib HTTP service
+(Nix-built OCI image, swarm service on proxy, reconcile oneshot like bridge/drone) that polls the
+Drone API for recipe-CI builds (event=custom), groups latest-run-per-recipe, and renders a
+YunoHost-CI-like overview at **ci.commoninternet.net/** with pass/fail/running badges, last ref,
+when, and a link to the canonical Drone run. Plus /badge/<recipe>.svg embeddable badges.
+
+Verified live via the public gateway: overview lists exactly the 6 enrolled recipes (cryptpad,
+custom-html, keycloak, lasuite-docs, matrix-synapse, n8n) each **success**; `/badge/keycloak.svg` →
+200 image/svg+xml; `/healthz` → 200; **`/hook` still routes to the bridge** (200) — the bridge's
+Host && PathPrefix(`/hook`) rule keeps priority over the dashboard's Host-only rule.
+
+Two fixes en route: (1) filter out the cc-ci repo's own name as a recipe row (Adversary !testme on
+the cc-ci PR showed a spurious cc-ci=failure); (2) **content-hash image tag** — a fixed `:latest`
+tag + unchanged stack spec does NOT roll the swarm service on a code change, so the tag is now
+derived from a hash of dashboard.py → `docker stack deploy` rolls reliably (reproducible/self-heal).
+NOTE: the bridge image has the same latent `:latest` issue (only rolled this session because its
+.nix env also changed) — worth the same content-tag treatment (backlog).
+
+Remaining M8 piece: PR-comment **outcome reflection** — the bridge posts the start/run-link comment
+but doesn't yet update it with the final pass/fail (needs a Drone build-completion hook or the
+bridge polling build status). Overview + badges (the core of D7) are done.