diff --git a/build-progress.txt b/build-progress.txt
index 538f30f6..b285648c 100644
--- a/build-progress.txt
+++ b/build-progress.txt
@@ -10786,3 +10786,9 @@ Blockers: full make test Cargo passed but broad web Vitest still has unrelated u
 Status: QA PASS. Fresh controller recovery accepted for Network/Forks and ready for main merge.
 Evidence: make doctor healthy; make check passed; DB-backed package_detail_contract 4/4, projects_list_contract 1/1, and repository_network_contract 1/1 passed against localhost:55433; focused Network/Forks/API docs Vitest passed 9/9; focused system-Chrome repository-network Playwright passed setup + flow 2/2 in 21.0s.
 Fixes accepted: package settings camelCase serde IDs, project copy FOR UPDATE OF projects + workflow_key clone + org membership/base-role guard, corrected projects default-open expectation, repository_network_contract rate-limit identity isolation, and repository-network E2E now uses shared auth plus container-backed psql fallback instead of host psql.
+
+2026-05-24 - gist-001 QA/fix lane
+- QA remains blocked (qa_pass=false). Fixed gist update revision query, list pagination placeholders, and secret gist URL-accessible read semantics.
+- Added DB-backed api_gists_contract covering create/list/view/edit/revisions/embed, secret unlisted/direct URL behavior, cross-user edit denial, JSON error shapes, and escaped embeds; focused run passed with TEST_DATABASE_URL loaded.
+- make check passed; focused GistEditor Vitest passed. Full make test reached and passed gist contract but stopped on unrelated projects_list_contract URL expectation.
+- Blocker for qa_pass: /gist/<id>.git clone endpoint/materialized gist git storage is not implemented; focused authenticated Playwright/a11y for gist flow still missing.
diff --git a/crates/api/src/domain/gists.rs b/crates/api/src/domain/gists.rs
index ff68078e..88729440 100644
--- a/crates/api/src/domain/gists.rs
+++ b/crates/api/src/domain/gists.rs
@@ -181,11 +181,21 @@ pub async fn list_gists(
     }
     let total = count_query.fetch_one(pool).await?.get::<i64, _>("total");
 
+    let limit_param = if actor_user_id.is_some() {
+        if query.username.is_some() {
+            3
+        } else {
+            2
+        }
+    } else if query.username.is_some() {
+        2
+    } else {
+        1
+    };
+    let offset_param = limit_param + 1;
     let list_sql = format!(
-        "SELECT g.id FROM gists g JOIN users u ON u.id = g.owner_id {where_sql} ORDER BY g.updated_at DESC LIMIT $limit OFFSET $offset"
-    )
-    .replace("$limit", &(if actor_user_id.is_some() { if query.username.is_some() { 3 } else { 2 } } else if query.username.is_some() { 2 } else { 1 }).to_string())
-    .replace("$offset", &(if actor_user_id.is_some() { if query.username.is_some() { 4 } else { 3 } } else if query.username.is_some() { 3 } else { 2 }).to_string());
+        "SELECT g.id FROM gists g JOIN users u ON u.id = g.owner_id {where_sql} ORDER BY g.updated_at DESC LIMIT ${limit_param} OFFSET ${offset_param}"
+    );
     let mut list_query = sqlx::query(&list_sql);
     if let Some(actor) = actor_user_id {
         list_query = list_query.bind(actor);
@@ -248,12 +258,14 @@ pub async fn update_gist(
         return Err(GistError::Forbidden);
     }
     let files = validate_files(input.files)?;
-    sqlx::query("UPDATE gists SET description = $1, is_public = $2 WHERE id = $3")
-        .bind(trim_optional(input.description))
-        .bind(input.is_public.unwrap_or(true))
-        .bind(gist_id)
-        .execute(pool)
-        .await?;
+    sqlx::query(
+        "UPDATE gists SET description = $1, is_public = COALESCE($2, is_public) WHERE id = $3",
+    )
+    .bind(trim_optional(input.description))
+    .bind(input.is_public)
+    .bind(gist_id)
+    .execute(pool)
+    .await?;
     replace_files(pool, gist_id, &files).await?;
     let version = sqlx::query("SELECT coalesce(max(version), 0)::bigint + 1 AS version FROM gist_revisions WHERE gist_id = $1")
         .bind(gist_id)
@@ -271,9 +283,7 @@ pub async fn get_gist(
     app_url: &url::Url,
 ) -> Result<GistDetail, GistError> {
     let summary = gist_summary(pool, gist_id, app_url).await?;
-    if !summary.is_public && Some(summary.owner.id) != actor_user_id {
-        return Err(GistError::NotFound);
-    }
+    // Secret gists are intentionally URL-accessible and unlisted, not auth-gated.
     let comments = gist_comments(pool, gist_id, app_url).await?;
     let is_starred = match actor_user_id {
         Some(actor) => sqlx::query("SELECT EXISTS (SELECT 1 FROM gist_stars WHERE gist_id = $1 AND user_id = $2) AS starred")
diff --git a/crates/api/tests/api_gists_contract.rs b/crates/api/tests/api_gists_contract.rs
new file mode 100644
index 00000000..274d9d87
--- /dev/null
+++ b/crates/api/tests/api_gists_contract.rs
@@ -0,0 +1,294 @@
+use axum::{
+    body::{to_bytes, Body},
+    http::{header, HeaderMap, Method, Request, StatusCode},
+};
+use chrono::{Duration, Utc};
+use opengithub_api::{
+    auth::session,
+    config::{AppConfig, AuthConfig},
+    domain::identity::{upsert_session, upsert_user_by_email, User},
+};
+use serde_json::{json, Value};
+use sqlx::PgPool;
+use tower::ServiceExt;
+use url::Url;
+use uuid::Uuid;
+
+static MIGRATOR: sqlx::migrate::Migrator = sqlx::migrate!("./migrations");
+
+async fn database_pool() -> Option<PgPool> {
+    let database_url = std::env::var("TEST_DATABASE_URL")
+        .or_else(|_| std::env::var("DATABASE_URL"))
+        .ok()
+        .filter(|value| !value.trim().is_empty())?;
+    let pool = match opengithub_api::db::test_pool_options()
+        .connect(&database_url)
+        .await
+    {
+        Ok(pool) => pool,
+        Err(error) => {
+            eprintln!("skipping gist contract; database connect failed: {error}");
+            return None;
+        }
+    };
+    if let Err(error) = MIGRATOR.run(&pool).await {
+        eprintln!("skipping gist contract; migrations failed: {error}");
+        return None;
+    }
+    Some(pool)
+}
+
+fn app_config() -> AppConfig {
+    AppConfig {
+        app_url: Url::parse("http://localhost:3015").expect("app URL"),
+        api_url: Url::parse("http://localhost:3016").expect("api URL"),
+        auth: Some(AuthConfig {
+            google_client_id: "google-client-id.apps.googleusercontent.com".to_owned(),
+            google_client_secret: "google-client-secret".to_owned(),
+            session_secret: "test-session-secret-with-enough-entropy".to_owned(),
+        }),
+        session_cookie_name: "__Host-session".to_owned(),
+        session_cookie_secure: false,
+    }
+}
+
+async fn create_user(pool: &PgPool, label: &str) -> User {
+    let unique = format!("{}{}", label.replace('-', ""), Uuid::new_v4().simple());
+    let user = upsert_user_by_email(
+        pool,
+        &format!("{unique}@opengithub.local"),
+        Some(&unique),
+        None,
+    )
+    .await
+    .expect("user should upsert");
+    sqlx::query("UPDATE users SET username = $1 WHERE id = $2")
+        .bind(&unique)
+        .bind(user.id)
+        .execute(pool)
+        .await
+        .expect("username should update");
+    user
+}
+
+async fn cookie_header(pool: &PgPool, config: &AppConfig, user: &User) -> String {
+    let session_id = Uuid::new_v4().to_string();
+    let expires_at = Utc::now() + Duration::hours(1);
+    upsert_session(
+        pool,
+        &session_id,
+        Some(user.id),
+        json!({"provider":"google"}),
+        expires_at,
+    )
+    .await
+    .expect("session should persist");
+    let set_cookie = session::set_cookie_header(config, &session_id, expires_at)
+        .expect("signed cookie should be created");
+    let cookie_value = session::cookie_value_from_set_cookie(&set_cookie).expect("cookie value");
+    format!("{}={cookie_value}", config.session_cookie_name)
+}
+
+async fn json_request(
+    app: axum::Router,
+    method: Method,
+    uri: &str,
+    cookie: Option<&str>,
+    body: Option<Value>,
+) -> (StatusCode, HeaderMap, Value) {
+    let mut builder = Request::builder().method(method).uri(uri);
+    if let Some(cookie) = cookie {
+        builder = builder.header(header::COOKIE, cookie);
+    }
+    let request_body = if let Some(body) = body {
+        builder = builder.header(header::CONTENT_TYPE, "application/json");
+        Body::from(body.to_string())
+    } else {
+        Body::empty()
+    };
+    let response = app
+        .oneshot(builder.body(request_body).expect("request"))
+        .await
+        .expect("response");
+    let status = response.status();
+    let headers = response.headers().clone();
+    let bytes = to_bytes(response.into_body(), usize::MAX)
+        .await
+        .expect("body");
+    let value = serde_json::from_slice(&bytes)
+        .unwrap_or_else(|_| json!({"raw": String::from_utf8_lossy(&bytes)}));
+    (status, headers, value)
+}
+
+async fn raw_request(app: axum::Router, uri: &str) -> (StatusCode, HeaderMap, String) {
+    let response = app
+        .oneshot(
+            Request::builder()
+                .method(Method::GET)
+                .uri(uri)
+                .body(Body::empty())
+                .expect("request"),
+        )
+        .await
+        .expect("response");
+    let status = response.status();
+    let headers = response.headers().clone();
+    let bytes = to_bytes(response.into_body(), usize::MAX)
+        .await
+        .expect("body");
+    (
+        status,
+        headers,
+        String::from_utf8_lossy(&bytes).into_owned(),
+    )
+}
+
+fn assert_json(headers: &HeaderMap) {
+    assert!(headers
+        .get(header::CONTENT_TYPE)
+        .and_then(|v| v.to_str().ok())
+        .is_some_and(|v| v.starts_with("application/json")));
+}
+
+#[tokio::test]
+async fn gist_contract_covers_visibility_edit_revisions_embed_and_errors() {
+    let Some(pool) = database_pool().await else {
+        eprintln!("skipping gist contract; set TEST_DATABASE_URL");
+        return;
+    };
+    let config = app_config();
+    let owner = create_user(&pool, "gistowner").await;
+    let outsider = create_user(&pool, "gistoutsider").await;
+    let owner_cookie = cookie_header(&pool, &config, &owner).await;
+    let outsider_cookie = cookie_header(&pool, &config, &outsider).await;
+    let app = opengithub_api::build_app_with_config(Some(pool.clone()), config);
+
+    let payload = json!({
+        "description": "Secret <script>alert(1)</script> gist",
+        "isPublic": false,
+        "files": [
+            {"filename":"main.ts", "content":"export const answer = 42;"},
+            {"filename":"notes.md", "content":"# Notes\n"}
+        ]
+    });
+    let (status, headers, created) = json_request(
+        app.clone(),
+        Method::POST,
+        "/api/gists",
+        Some(&owner_cookie),
+        Some(payload),
+    )
+    .await;
+    assert_eq!(status, StatusCode::CREATED);
+    assert_json(&headers);
+    assert_eq!(created["isPublic"], false);
+    assert_eq!(created["files"].as_array().unwrap().len(), 2);
+    assert_eq!(created["files"][0]["language"], "TypeScript");
+    let gist_id = created["id"].as_str().expect("gist id");
+
+    let (status, _, mine) = json_request(
+        app.clone(),
+        Method::GET,
+        "/api/gists?scope=mine",
+        Some(&owner_cookie),
+        None,
+    )
+    .await;
+    assert_eq!(status, StatusCode::OK);
+    assert!(mine["items"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .any(|item| item["id"].as_str() == Some(gist_id)));
+
+    let (status, _, public_list) =
+        json_request(app.clone(), Method::GET, "/api/gists/public", None, None).await;
+    assert_eq!(status, StatusCode::OK);
+    assert!(
+        !public_list["items"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .any(|item| item["id"].as_str() == Some(gist_id)),
+        "secret gist must be unlisted"
+    );
+
+    let (status, _, anonymous_view) = json_request(
+        app.clone(),
+        Method::GET,
+        &format!("/api/gists/{gist_id}"),
+        None,
+        None,
+    )
+    .await;
+    assert_eq!(
+        status,
+        StatusCode::OK,
+        "secret gist URL should be accessible without auth"
+    );
+    assert_eq!(anonymous_view["viewer"]["authenticated"], false);
+    assert_eq!(anonymous_view["viewer"]["canEdit"], false);
+
+    let (status, _, forbidden) = json_request(
+        app.clone(),
+        Method::PATCH,
+        &format!("/api/gists/{gist_id}"),
+        Some(&outsider_cookie),
+        Some(json!({"description":"pwned", "files":[{"filename":"x.txt","content":"x"}]})),
+    )
+    .await;
+    assert_eq!(status, StatusCode::FORBIDDEN);
+    assert_eq!(forbidden["error"]["code"], "forbidden");
+    assert!(!forbidden.to_string().contains("stack"));
+
+    let (status, _, updated) = json_request(app.clone(), Method::PATCH, &format!("/api/gists/{gist_id}"), Some(&owner_cookie), Some(json!({"description":"Public now", "isPublic": true, "files":[{"filename":"main.ts","content":"export const answer = 43;"}]}))).await;
+    assert_eq!(status, StatusCode::OK);
+    assert_eq!(updated["isPublic"], true);
+
+    let (status, _, revisions) = json_request(
+        app.clone(),
+        Method::GET,
+        &format!("/api/gists/{gist_id}/revisions"),
+        None,
+        None,
+    )
+    .await;
+    assert_eq!(status, StatusCode::OK);
+    assert_eq!(revisions["revisions"].as_array().unwrap().len(), 2);
+
+    let (status, headers, embed) =
+        raw_request(app.clone(), &format!("/api/gists/{gist_id}/embed.js")).await;
+    assert_eq!(status, StatusCode::OK);
+    assert!(headers
+        .get(header::CONTENT_TYPE)
+        .and_then(|v| v.to_str().ok())
+        .unwrap()
+        .starts_with("application/javascript"));
+    assert!(embed.contains("opengithub-gist"));
+    assert!(
+        !embed.contains("<script>alert"),
+        "embed must escape gist metadata"
+    );
+
+    let (status, _, unauth_create) = json_request(
+        app.clone(),
+        Method::POST,
+        "/api/gists",
+        None,
+        Some(json!({"files":[{"filename":"x.txt","content":"x"}]})),
+    )
+    .await;
+    assert_eq!(status, StatusCode::UNAUTHORIZED);
+    assert_eq!(unauth_create["error"]["code"], "not_authenticated");
+
+    let (status, _, invalid) = json_request(
+        app,
+        Method::POST,
+        "/api/gists",
+        Some(&owner_cookie),
+        Some(json!({"files":[]})),
+    )
+    .await;
+    assert_eq!(status, StatusCode::UNPROCESSABLE_ENTITY);
+    assert_eq!(invalid["error"]["code"], "validation_failed");
+}
diff --git a/prd.json b/prd.json
index 779e6340..2e05d96a 100644
--- a/prd.json
+++ b/prd.json
@@ -2312,7 +2312,8 @@
       "markdown-001",
       "highlight-001"
     ],
-    "build_pass": true
+    "build_pass": true,
+    "qa_pass": false
   },
   {
     "id": "ai-001",
diff --git a/qa-hints.json b/qa-hints.json
index 91907b17..2bfaa1c0 100644
--- a/qa-hints.json
+++ b/qa-hints.json
@@ -8050,19 +8050,16 @@
   {
     "feature_id": "gist-001",
     "tests_written": [
-      "Added Rust-owned gist schema for gists, files, comments, stars, forks, and revisions",
-      "Added Axum REST endpoints for list/create/read/update/revisions/star/unstar/fork/embed",
-      "Added Editorial /gist, /gist/new, /gist/<id>, /gist/<id>/edit, and /gist/<id>/revisions pages",
-      "Added profile public gists widget and API docs coverage",
-      "Focused Vitest coverage for multi-file GistEditor behavior and API docs",
-      "Browser smoke covered gist list -> new -> create -> detail -> star -> edit -> revisions with no dead links or horizontal overflow"
-    ],
-    "needs_deeper_qa": [
-      "Run DB-backed gist contract against a migrated Postgres; local TEST_DATABASE_URL remains unavailable in this environment",
-      "Verify real git clone over https://opengithub.namuh.co/gist/<id>.git once gist bare-repository materialization is wired to production storage",
-      "Probe secret gist unlisted behavior through search, public profile widgets, anonymous direct URL, and owner sessions",
-      "Validate embed script rendering inside a third-party page and CSP-heavy host page",
-      "Exercise comment moderation and comment creation if QA treats full gist comments parity as required beyond the read surface"
+      "DB-backed Rust gist API contract for create/list/view/edit/revisions/embed visibility and error shapes",
+      "Focused Vitest coverage for multi-file GistEditor behavior and secret visibility",
+      "Implementation fixes for secret direct URL access, owner list pagination, and update revision creation"
+    ],
+    "needs_deeper_qa": [
+      "Implement and verify real smart-HTTP git clone for /gist/<id>.git backed by gist git storage; current clone URL is not enough for qa_pass",
+      "Add authenticated Playwright E2E for create multi-file gist, public/secret list behavior, edit, revisions, Star/Fork affordances, and embed snippet",
+      "Probe global search/profile widgets to prove secret gists are unlisted while direct URLs remain accessible",
+      "Run axe/manual a11y on /gist/new, /gist/<id>, /gist/<id>/edit, and /gist/<id>/revisions after E2E exists",
+      "Resolve or isolate unrelated projects_list_contract failure before claiming full make test green"
     ]
   },
   {
diff --git a/qa-report-summary.json b/qa-report-summary.json
index 38a50f82..2ed651d1 100644
--- a/qa-report-summary.json
+++ b/qa-report-summary.json
@@ -3754,9 +3754,50 @@
       "description": "Gists \u2014 single-file or multi-file snippets at /gist/<id> with their own git hist",
       "category": "feature",
       "qa_pass": false,
-      "attempts": 0,
+      "attempts": 1,
       "exhausted": false,
-      "sub_phases": {}
+      "sub_phases": {
+        "functional": {
+          "status": "partial",
+          "notes": "GistEditor multi-file UI unit test passed and API create/edit/revisions flowed in DB-backed contract. Required focused browser E2E for authenticated create/edit/revisions was not added/run before blocker; existing auth setup is anonymous-only."
+        },
+        "api_contract": {
+          "status": "partial",
+          "endpoints_tested": [
+            "POST /api/gists",
+            "GET /api/gists?scope=mine",
+            "GET /api/gists/public",
+            "GET /api/gists/{id}",
+            "PATCH /api/gists/{id}",
+            "GET /api/gists/{id}/revisions",
+            "GET /api/gists/{id}/embed.js"
+          ],
+          "notes": "Focused DB-backed contract passed and verifies standard JSON errors/no stack traces. Blocking gap remains git clone endpoint /gist/{id}.git."
+        },
+        "security": {
+          "status": "partial",
+          "checks": [
+            "secret_unlisted_public_list",
+            "secret_direct_url_access",
+            "cross_user_edit_forbidden",
+            "anonymous_create_401",
+            "embed_html_escape",
+            "no_stack_trace_in_forbidden"
+          ],
+          "notes": "Focused contract covers main secret gist and cross-user edit semantics. Search exclusion and full browser/session probes remain unverified."
+        },
+        "accessibility": {
+          "status": "partial",
+          "violations": [],
+          "notes": "Touched editor uses labels/fieldset/buttons and existing component test covers controls. Axe/browser a11y scan was not run because feature remains blocked on missing clone endpoint and focused E2E gap."
+        }
+      },
+      "overall_status": "blocked",
+      "blockers": [
+        "Missing real git clone endpoint/materialization for git clone https://opengithub.namuh.co/gist/<id>.git",
+        "No focused authenticated Playwright E2E proving create multi-file gist, secret unlisted URL access, edit, revisions, and embed affordances",
+        "Full make test currently red on unrelated projects_list_contract expected URL mismatch after gist tests pass"
+      ]
     },
     {
       "feature_id": "ai-001",
diff --git a/qa-report.json b/qa-report.json
index 3430d8e2..983c6e25 100644
--- a/qa-report.json
+++ b/qa-report.json
@@ -6898,5 +6898,97 @@
       "ralph/screenshots/build/settings-005-final-secrets-mobile.jpg",
       "ralph/screenshots/build/settings-005-final-secrets-forbidden.jpg"
     ]
+  },
+  {
+    "feature_id": "gist-001",
+    "attempt": 1,
+    "status": "blocked",
+    "description": "Gists \u2014 single-file or multi-file snippets at /gist/<id> with own git history, public/secret visibility, fork/star, embeds, and revisions.",
+    "category": "feature",
+    "qa_pass": false,
+    "attempts": 1,
+    "exhausted": false,
+    "timestamp": "2026-05-24T03:12:00-07:00",
+    "tested_steps": [
+      "make doctor passed after restarting test Postgres to restore host port :55433.",
+      "Inspected gist API/domain/UI/profile widget implementation and existing GistEditor test coverage.",
+      "Added DB-backed Rust API contract for create/list/view/edit/revisions/embed visibility and error shapes; focused run passed 1/1 with TEST_DATABASE_URL loaded.",
+      "Added/fixed implementation defects found by contract: gist update compile break, list pagination parameter replacement, and secret gist direct URL access semantics.",
+      "make check passed (Cargo check, Web typecheck, Clippy, Biome).",
+      "Focused Vitest GistEditor multi-file/secret visibility test passed 1/1.",
+      "Full make test was attempted with .env.test loaded; gist contract passed, but suite stopped on pre-existing unrelated projects_list_contract assertion mismatch."
+    ],
+    "bugs_found": [
+      {
+        "severity": "major",
+        "description": "Secret gists were treated as not found for anonymous/non-owner direct URL reads, contrary to URL-accessible/unlisted spec.",
+        "file": "crates/api/src/domain/gists.rs"
+      },
+      {
+        "severity": "major",
+        "description": "Gist list SQL replaced LIMIT/OFFSET placeholders with literals, causing owner mine lists to report total rows while returning empty pages.",
+        "file": "crates/api/src/domain/gists.rs"
+      },
+      {
+        "severity": "major",
+        "description": "Gist update path had a duplicate fetch_one call that would break cargo check/clippy on the update/revision flow.",
+        "file": "crates/api/src/domain/gists.rs"
+      },
+      {
+        "severity": "critical",
+        "description": "Required gist git clone endpoint /gist/<id>.git is not implemented as a smart-HTTP gist-backed repository; clone URL is displayed but not backed by a route/materialized bare repo.",
+        "file": "crates/api/src/routes/git.rs"
+      }
+    ],
+    "fix_description": "Fixed gist update revision query, preserved visibility on partial updates, made secret gist reads/revisions/embed URL-accessible while keeping edits owner-only, corrected list pagination SQL parameters, and added DB-backed gist API/security contract coverage.",
+    "sub_phases": {
+      "functional": {
+        "status": "partial",
+        "notes": "GistEditor multi-file UI unit test passed and API create/edit/revisions flowed in DB-backed contract. Required focused browser E2E for authenticated create/edit/revisions was not added/run before blocker; existing auth setup is anonymous-only."
+      },
+      "api_contract": {
+        "status": "partial",
+        "endpoints_tested": [
+          "POST /api/gists",
+          "GET /api/gists?scope=mine",
+          "GET /api/gists/public",
+          "GET /api/gists/{id}",
+          "PATCH /api/gists/{id}",
+          "GET /api/gists/{id}/revisions",
+          "GET /api/gists/{id}/embed.js"
+        ],
+        "notes": "Focused DB-backed contract passed and verifies standard JSON errors/no stack traces. Blocking gap remains git clone endpoint /gist/{id}.git."
+      },
+      "security": {
+        "status": "partial",
+        "checks": [
+          "secret_unlisted_public_list",
+          "secret_direct_url_access",
+          "cross_user_edit_forbidden",
+          "anonymous_create_401",
+          "embed_html_escape",
+          "no_stack_trace_in_forbidden"
+        ],
+        "notes": "Focused contract covers main secret gist and cross-user edit semantics. Search exclusion and full browser/session probes remain unverified."
+      },
+      "accessibility": {
+        "status": "partial",
+        "violations": [],
+        "notes": "Touched editor uses labels/fieldset/buttons and existing component test covers controls. Axe/browser a11y scan was not run because feature remains blocked on missing clone endpoint and focused E2E gap."
+      }
+    },
+    "overall_status": "blocked",
+    "blockers": [
+      "Missing real git clone endpoint/materialization for git clone https://opengithub.namuh.co/gist/<id>.git",
+      "No focused authenticated Playwright E2E proving create multi-file gist, secret unlisted URL access, edit, revisions, and embed affordances",
+      "Full make test currently red on unrelated projects_list_contract expected URL mismatch after gist tests pass"
+    ],
+    "gates": [
+      "make doctor: pass after db restart",
+      "make check: pass",
+      "api_gists_contract: pass 1/1 DB-backed",
+      "web GistEditor Vitest: pass 1/1",
+      "make test: blocked/red by unrelated projects_list_contract after gist contract passed"
+    ]
   }
 ]