[theycallmeswift]

Glitch Invaders now names the sentry vault service. When SENTRY_AUTH_TOKEN is set and the package's sentry.json holds real values, the page reports the three failures to the DSN. The page server then reads Sentry's record of each one from the Sentry API (issue and stack trace, breadcrumbs, or trace spans), so the token never reaches the page. Without both, the game runs in demo mode as before. Closes #25.

• The page sends errors as event envelopes and the boss stall as a boss-spawn transaction with one span per load. It uses no SDK, so script-src 'self' stays, and connect-src adds only the DSN's ingest origin. In live mode the start card and the HUD badge say so.
• The page asks the server for evidence at GET /api/sentry-evidence?bug=…&id=<32 hex>.
  • The route answers only loopback-host, same-origin requests, checked by Origin and Sec-Fetch-Site, with validated ids.
  • Concurrent requests for one report share a single lookup.
  • Each lookup's requests and waits abort at a 15 s deadline.
  • If Sentry refuses the report, is down, or is slow to index it, that incident shows simulated evidence with a note saying why (a SIMULATED · SENTRY UNAVAILABLE badge).
  • The live boss boot_state pills are labelled "Local game state, not from Sentry".
• The token goes only to https://sentry.io, an HTTPS subdomain of it, or a loopback stand-in in tests, whatever sentry.json's optional apiUrl says.
• One demo output changed. The simulated weapon stack frame GameLoop.frame now reads app.mjs:111 instead of :94, because the live wiring moved the this.engine.update( call it points at, and the existing source-line test keeps the two in sync. Everything else in demo mode is unchanged: the runtime config ({ attemptId }), the CSP string, the badge, the start card, the console copy, the markers, the done_when lines, and the setup output.
• A sentry.json with real values but a malformed one fails setup and names the field. A file that is absent or still holds placeholders means demo mode.

Decide

• Human step: create the Sentry project. MLH needs to create it and fill in challenges/glitch-invaders/sentry.json: dsn (Project Settings → Client Keys), org, and project slugs. Mint a token with the event:read, project:read, and org:read scopes and add it to each event vault as service sentry, bearer, token SENTRY_AUTH_TOKEN, host sentry.io. Recommend: land this PR with placeholders, then fill in the values for an event only after the live playthrough below.
• Human step: standalone Pi playthrough. This session has no Gemini key, so the guide skill's flow has not been exercised, including its new mode prop and badge wording. Recommend: a human runs the README's "Run without boothstrap" flow once in demo mode, and once in live mode with the real token. During the live run, record how long transactions take to appear in dataset=spans, and whether span.description, span.duration and precise.start_ts are the right fields. Then adjust the 15 s deadline or the spans query if the boss routinely falls back.
• Event vaults now need a sentry service. With sentry in vault_services, a station whose event vault lacks that service lists the challenge as unavailable, on every boothstrap version. Recommend: add the sentry service to each event vault that selects this challenge before this PR merges, because merging otherwise takes the challenge offline at those events.

Ready gate

Step	Evidence
Tests and lint	On Linux, Node 26.12, at 698345f: npm run verify reports ok for all 4 packages; npm test runs 258 tests, 258 passing; npm run lint reports 0 issues. No network and no credentials needed.	✅
Red run	Making setup write the token into the runtime config turns the token never appears in a response, a page asset, the workspace, or hook output red; reverting turns it green. The shield frame fix is covered by the source-line test, which checks resolveShieldHit at shield.mjs:17.	✅
Sibling sweep	Searched createProgress(, MODE, mode=demo, demo-only, issues/519, connect-src, Demo mode:, game.resource.load. Updated shared/progress.mjs (modes demo and live), the start card, the guide skill's mode prop, and the README. The static mode=demo line in index.html is rewritten when the page starts.	✅
Docs and specs	Package README.md has a "Live Sentry mode" section covering: the event vault service, the token scopes, boothstrap compatibility, boothstrap dev's token requirement, and the apiUrl host rule. Also updated: intro.md, skills/start-challenge/SKILL.md, and sentry.json's $comment. The root README index entry is still accurate. docs/ needs no changes.	✅
Standalone run	Run: setup and cleanup standalone (no BOOTHSTRAP_ variables) from a copied package, with the game played in Chromium to the weapon jam in demo, live and Sentry-outage modes. Live used a local Sentry API stand-in and a stubbed DSN ingest. Not run: a standalone Pi playthrough of the guide skill, because this session has no Gemini key. That run is listed in Decide.	⚠️
Editorial pass	A separate reviewer reread the diff against the issue and docs/style/, and this round addressed every item of the review on f80cdd9.	✅
Skipped tests	None.	✅
Secrets, permissions	Adds the sentry vault service. The token is read only by server/serve.mjs from SENTRY_AUTH_TOKEN, held in a private field of the API client, and sent only to Sentry hosts or loopback. The token test fetches every file under game/ and shared/, /runtime-config.json, /api/progress, and the evidence route: success, bad query, and an outage whose stand-in echoes the Authorization header. It also checks every workspace file and the setup and cleanup output. The page server's own stdio is discarded by setup, so it has no log. The root @mlhacks/boothstrap pin is unchanged.	✅

[theycallmeswift]

Independent review of f80cdd9 against #25: CHANGES NEEDED. No code defect blocks it; the findings are nits (inline, plus the three below), which this repo's owner wants addressed before hand-off, and one Ready gate row that needs honest marking.

Not inline, since the lines are outside the diff:

• Ready gate, Standalone run row: it is marked ✅ but says no standalone Pi playthrough was done. The template asks for that run, and #25 lists the standalone skill flow as a done criterion; the SKILL change (the mode prop, new badge wording) has not been exercised. Mark the row ⚠️ and name the run as a human step in Decide, as #23 did, since this session has no Gemini key.
• game/src/ui/overlays.mjs:97: in live mode the start card still says "Demo mode: the diagnostics are realistic simulations." Pass the mode to the start card and show live-mode copy when the page has a reporter.
• Ready gate, Secrets row: "a test checks every response, page asset, workspace file, and hook output" overstates it. The test fetches seven URLs and checks setup output, not cleanup output or the other game assets. Say exactly what it checks, or widen the test to match (the inline note on the test suggests both).

Verified: merge with main is clean; npm run verify, npm test (245 passing), and npm run lint all pass on the merged tree with no network and no credentials; CI run 39071443555 is green.

---

Generated by Claude Code

[theycallmeswift]

The three review-body items are addressed in 698345f and the updated PR body:

• Standalone run row: now ⚠️. It says what was and wasn't run, and the Pi playthrough is listed as a human step in Decide.
• Start card: in live mode it now says "Live mode: the failures are reported to Sentry, and the console shows its record." Demo copy is unchanged.
• Secrets row: now states exactly what the token test checks. The test was also widened to every game/ and shared/ file and to the cleanup output.

---

Generated by Claude Code