JefeNotes — a small LAN notes, calendar, and grocery app for two — is live on the home network. What was scoped as a one-evening scaffold turned into a much longer session because the first real CI push exposed that the whole Forgejo Actions pipeline had been silently failing across several repos for weeks. Once we were in the wiring anyway, we fixed it at the root, refactored JefeHealth's pipeline for how an interpreted-language service actually wants to deploy, and added a real regression test suite to the new app so the next silent failure has a harder time staying silent.

A Small App for Two

Stack is Express + better-sqlite3 for the backend, React 19 + Zustand + plain CSS for the frontend, single container serving both in production. LAN-only, no auth — author identity is a simple X-Author header toggle (Jeff or Kerikah) persisted in localStorage. Three views: a notes grid with pinning and filtering, a month-view calendar, and a dedicated fat-finger groceries checklist optimized for phones on the fridge. Four themes (Warmth, Meadow, Dusk, Paper) with pre-React bootstrap so there's no flash on load. Runtime category management, granular PATCH endpoints for concurrency-safe checklist item toggles, non-cascading category deletes with affected-count reporting. Design hooks for future Grocy/Gigi/garden integrations are in place; none of those integrations were built. Forty-ish scaffold files. One evening of work that somehow ate an entire session.

The Accidental CI Audit

The first CI push for JefeNotes failed, which prompted a look at why. The pattern that emerged: every Forgejo Actions workflow using actions/checkout@v4 had been failing since late March with Cannot find: node in PATH. Seventeen consecutive silent failures on one security-critical repo, one each on two others, and nobody had noticed because the deploys were happening manually through a different path the whole time. No prior session had ever queried the task API, decompressed a log file, or counted pass/fail across runs — pushing a workflow file had been implicitly treated as proof it worked. Five separate things were actually wrong: node was missing from the host-mode runner, per-repo safe.directory exceptions weren't configured, the runner had no git credential helper at all (private repos hung forever), service env files weren't readable by the runner user, and two of the working repos were using a completely different workflow shape nobody had documented. We fixed all five at the source, installed Node 20 via NodeSource, and adopted a verification rule going forward: no CI claim counts as done until the task ID is quoted and the decompressed log's final line is verbatim in the session record.

JefeHealth Gets a Smarter Pipeline

With the runner unblocked, JefeHealth's pytest suite finally ran in CI — the first time it ever had — which raised the obvious next question: is the pattern any good? For an interpreted Python service on a single host, rebuilding the Docker image on every push to change a .py file is tax with no benefit. We refactored it. Source is now bind-mounted into the container, the Dockerfile uses an editable install (pip install -e .), and the deploy step runs git diff HEAD~1 HEAD to decide: if Dockerfile, pyproject.toml, or docker-compose.titan.yml changed, full rebuild and recreate; otherwise docker compose restart, which preserves the container ID and uptime and does its actual work in about 0.4 seconds. The first push after the refactor touched infra files and took the rebuild path. The second was an empty commit to prove the fast path — same container ID, only StartedAt advanced. Both paths still gate on the full pytest suite before anything touches the running service. Reference pattern for future interpreted-language services.

Regression Tests Land for JefeNotes

With the pattern proven, we added a vitest + supertest suite to JefeNotes' server covering six contract areas: health, X-Author middleware enforcement, notes CRUD with pin/archive state, events with inclusive-boundary range queries, categories with the non-cascading-delete contract asserted at the DB level (rows survive, labels stay as free-form strings), and — the one that justifies the whole granular-item-endpoint design — a concurrent-PATCH race condition that fires Promise.all on two different checklist indexes and asserts both edits land. Forty-nine tests across six files. A new server-test Dockerfile stage builds with devDependencies, runs vitest, and stays isolated from the runtime image (which is unchanged in size and shape). The CI workflow runs the test image before building the production one — if any assertion fails, deploy never runs. We proved the gate actually gates by deliberately breaking one assertion (expect(200).toBe(201) in the health test), pushing, watching the task fail with the exact expected error, then reverting and watching the task pass with Tests 49 passed (49). Container stayed on the previous image throughout the broken push.

Accountability Note

The audit finding — that prior sessions had documented CI progress without ever verifying a single task ran — is now memorialized in the project memory with per-repo current state, the five-item runner-configuration gotcha list, and a verification rule the next agent has to follow. Trust the memory, but not more than you trust the logs. The tally for this session's Claude-wrong moments went up by at least two (mis-attributed a thirteen-minute git hang to a runner restart when it was actually a missing credential; initially claimed "every CI run has been failing" when it was actually "every run of the broken workflow shape"), both caught by the same verification process we just formalized.

What's Next

• JefeVault has 185 existing vitest tests not yet wired to CI, plus working-tree drift on the server that needs reconciling in a focused session before anything touches it. Flagged and deferred.
• JefeNotes is live but empty — household use begins. First real grocery list is the real acceptance test.
• Future Grocy and Gigi integrations will use the JefeVault repository trust pattern for service tokens rather than stored credentials; the hooks are designed, the consumer wiring waits for a concrete need.