Changelog

Every PR, fix, feature, and improvement — across all ry-ops repos and projects.

152 Total entries
33 Features
92 Fixes
27 Improvements
23 Repos

July 21, 2026

11 entries
Feature fabric-forge/social-ui Engineering

Buffer pause toggle (social-ui)

Small pill in the Studio page header (● Buffer active / ● Buffer paused) — click to flip. Calls the new `GET/POST /api/buffer/paused|pause` (backend: fabric-forge/social#112), which is enforced inside `checkBufferDailyLimit()` so it covers all Buffer distribution (X/TikTok/Instagram) everywhere, not just the Studio page's own Distribute buttons.

View PR #45 →
Feature fabric-forge/social Engineering

Manual pause toggle for all Buffer distribution (social)

New `GET/POST /api/buffer/paused|pause`, mirroring the existing `schedule` paused|pause pattern. Enforced inside `checkBufferDailyLimit()` — the single choke point every Buffer post path already goes through per ADR-032 C-032-001 — so X/TikTok/Instagram distribution (direct distribute/distribute-all calls, and the automatic TikTok/Instagram queuing after a Short uploads) is covered without adding a guard at each call site.

View PR #112 →
Fix fabric-forge/social Engineering

Pin a stable extension ID via manifest key (social)

Unpacked extensions get an ID derived from their install path by default — removing and re-adding (vs. the in-place reload button), or loading from a different path, gets a fresh ID with its own empty \`chrome.storage\` bucket (API key, \`apiBase\`, everything). This is the most likely explanation for the API key going missing after the last reload.

View PR #111 →
Fix fabric-forge/social Engineering

Decouple Channel Monitor result from the popup staying open (social)

Fixes the "Monitor failed: unknown error" toast, which wasn't a real failure.

View PR #110 →
Feature fabric-forge/social Engineering

DELETE /api/campaign/slots — clear daily Short-slot cache (social)

`deleteCampaign()` only removes the campaign record, not the day-claim key the 1-Short/day guard writes alongside it (`KEYS.intelligenceShortSlot`) — that key has its own 25h TTL and normally just expires on its own. After a bulk calendar wipe, the dates those campaigns occupied still read as falsely taken until the TTL clears, silently skipping those dates on the next cascade/create. This clears the cache immediately.

View PR #109 →
Feature fabric-forge/social-ui Engineering

Per-item dates on the calendar + new_post UI (social-ui)

Frontend for fabric-forge/social#105-107 (per-item scheduled dates, the 1-Short/day guard, and real `new_post` blog drafting).

View PR #44 →
Feature fabric-forge/social Engineering

DELETE /api/blog/posts/:id (social)

Mirrors the existing `DELETE /api/campaign/:id` — no equivalent existed for blog posts. Removes the Redis record only; deleting the published files in fabric-forge/blog is a separate GitHub operation against that repo directly (its commit history is the durable record).

View PR #108 →
Feature fabric-forge/social Engineering

Draft a real blog post for the new_post cascade track (social)

ADR-034's `new_post` track was a stub: cascade just pointed `campaign.source.url` at the raw YouTube video, and no blog post was ever drafted or published. This wires up real drafting.

View PR #107 →
Feature fabric-forge/social Engineering

Centralize the 1-Short/day guard (social)

New feature shipped in fabric-forge/social: feat(campaign): centralize the 1-Short/day guard.

View PR #106 →
Feature fabric-forge/social-ui Engineering

Mirror CampaignItem.scheduled_for override (social-ui)

- Mirrors the optional `CampaignItem.scheduled_for` field added in fabric-forge/social#105 (backend). No UI behavior change — this is just the type so the follow-up calendar/reschedule PR can build on it.

View PR #43 →

July 20, 2026

1 entry
Fix fabric-forge/social Engineering

Cascade 500s with 'too many subrequests' on second launch (social)

Reported live: prepared 5 campaigns successfully via `/prepare`, then
`/cascade` (the "Launch" button) 500'd with:

View PR #104 →

July 18, 2026

4 entries
Fix fabric-forge/social Engineering

Repair category classification — threshold + keyword bugs (social)

Root-cause fix for the 154/239 (64%) `security_advisory` skew found while
building the category classifier in #102. The sync script's old
`inferCategory()` checked security/cve/vuln **first**, no minimum bar — any
post mentioning "security" once got tagged `security_advisory` regardless of
subject.

View PR #103 →
Feature fabric-forge/social Engineering

Classify transcripts into blog PostCategory, fold into match scoring (social)

Adds `src/insights/categoryKeywords.ts` — a curated keyword list per
`PostCategory`, seeded from the archive sync's own `inferCategory()`
heuristic (`scripts/sync-archive-github.mjs`) so this agrees with how the
archive was actually categorized. `classifyCategory(tokens)` scores a
transcript's token set against each category's keywords and returns the
best match or `null` (no signal — never a guessed category).

View PR #102 →
Improvement fabric-forge/social Engineering

Tweak(intelligence): archive match scoring uses title + category only (social)

`scoreArchivePosts()` (PR #100) tokenized `title + tags + summary` per archive
post. Per discussion, trims this to **title + category only** — matching now
never reads any post body content (the `summary` field was ~500 chars of
excerpted prose from the post body).

View PR #101 →
Fix fabric-forge/social Engineering

Repair ADR-034 archive match-post (Track B) (social)

Fixes the archive-matching path audited in `ADR-034-archive-matching-audit.md`.
Track B (map a transcript to an **existing** archive post vs. recognize it as
**novel** → new post) was non-functional in production and, even when reachable,
had no match-vs-new signal.

View PR #100 →

July 15, 2026

1 entry
Improvement fabric-forge/social Engineering

Budget/resource tracking: ADRs, dashboard API, sample report (social)

Update to fabric-forge/social: Budget/resource tracking: ADRs, dashboard API, sample report.

View PR #99 →

July 14, 2026

4 entries
Improvement ry-ops/aiana AI & ML

Pin checkout, setup-python to commit SHA (aiana)

Auto-generated by git-steer autoRemediateFindings.

View PR #15 →
Fix ry-ops/aiana AI & ML

Make aiana installable and compatible with qdrant-client >= 1.12

Three fixes so aiana's full (Qdrant-backed semantic) setup installs and actually returns results. Verified end-to-end on a fully local stack (local Qdrant + local `sentence-transformers` embedder + a local MLX model via OpenCode).

View PR #17 →
Feature ry-ops/aiana AI & ML

Optional MLX embedder backend (torch-free, Apple-silicon native) (aiana)

Adds an **optional MLX embedding backend** so aiana can embed on Apple silicon **without PyTorch**, selectable via `AIANA_EMBEDDER_BACKEND=mlx`. Sentence-transformers stays the default — **no behavior change unless opted in.**

View PR #18 →
Feature fabric-forge/social Engineering

Expand IT pronunciation guide to 210 terms (social)

Adds ~106 new corrections to scripts/pronunciations.mjs covering cloud
infra (AWS services), databases, containers/service mesh, observability,
security/auth, networking, AI/ML, package managers, testing frameworks,
and general dev jargon — plus missing plurals (UUIDs, GUIDs, VLANs,
daemons). Applies automatically to all three render pipelines
(youtube-short/medium/longform) via the existing speakable() Skill
(ADR-010), no other code changes needed.

View PR #98 →

July 3, 2026

2 entries
Fix fabric-forge/social Engineering

Videos.update + description shortlink repair (social)

- Adds `updateVideoSnippet()` to `src/youtube/client.ts` — calls `videos.update?part=snippet`, fetches current snippet first so no fields are accidentally cleared
- Adds `PATCH /api/youtube/videos/:id` route — updates title, description, and/or tags without re-uploading the video
- If `source_url` is provided: registers the shortlink in Redis and rewrites any `ry-ops.dev/s/` in the description to the correct code

View PR #89 →
Feature fabric-forge/social Engineering

Substack + Reddit copy-paste draft generation (social)

Adds a manual copy-paste publishing flow for Substack and Reddit. Ryan generates formatted text in the dashboard and posts manually — no auto-publish, no OAuth dependency for draft generation.

View PR #88 →

July 1, 2026

1 entry

June 28, 2026

2 entries
Fix Engineering

Campaign carousel adoption + calendar visibility fix (social)

Fixed carousel scheduling so campaigns appear on the social calendar.

**Root cause:** The calendar UI is campaigns-only — it reads from the campaign store, not the schedule queue. Scheduling a carousel directly into the queue made it invisible to the calendar.

**Changes**

- Added `existing_carousel_id` to `POST /api/campaign` — campaigns can now adopt an existing carousel instead of always generating a new one
- Created campaign `cmp_e2d2622d435c` for the Rawk On carousel + YouTube Short, scheduled 2026-07-01T15:00:00Z — now visible in the calendar
- Removed orphaned queue entry for carousel `d7e6256e8338` (was scheduled directly into the queue, bypassing the campaign system)
Feature Engineering

Carousel scheduling + Rawk On launch (social)

Added carousel scheduling to the queue system and launched Rawk On across blog, LinkedIn, and YouTube.

**Carousel scheduling (fabric-forge/social)**

- Added `carousel` to `PostType` — text and carousel posts are now distinct types in the queue
- `dispatchDue()` skips carousel posts; `dispatchDueCarousels()` skips text posts — dispatch paths are cleanly separated
- New `POST /api/carousel/:id/schedule` endpoint — schedules any existing carousel directly into the queue with `target_date`, `target_time`, and `channel`
- Carousel post shares its ID with the carousel record so the dispatch cron resolves it immediately without re-generating

**Rawk On launch (fabric-forge/blog)**

- `rawk-on` landing page: updated copy ("No middleman" replacing "No accounts"), added paid account prerequisite note above setup steps, replaced Git-Steer header CTA with red "Try Rawk On!" button linking to `/rawk-on`
- Build story post (`2026-06-27-building-rawk-on`) marked `featured: true` with a new animated hero SVG (Chrome extension architecture diagram — extension icon center, TIDAL/Spotify/The Current/OAuth nodes, animated data flows)

**Scheduled**

- LinkedIn text post (`post_edccfe8d0f01`) — Monday 2026-06-29 at 9:00am CT
- LinkedIn carousel (`d7e6256e8338`) — Wednesday 2026-07-01 at 9:00am CT
- YouTube Short — rendering via GitHub Actions (carousel `d7e6256e8338`, voice: Chris, review-only)

June 27, 2026

4 entries
Improvement fabric-forge/social-ui Engineering

Audience: reschedule-suggestion prompt after analytics upload (social-ui)

Closes the loop with the Worker change (analytics upload now *suggests* a reschedule instead of silently applying).

View PR #42 →
Fix ry-ops/commit-relay Security

Patch 15 vulnerabilities in api-server (commit-relay)

This PR addresses **15** security vulnerabilities (non-destructive lockfile bumps).

View PR #73 →
Fix ry-ops/git-steer Security

Differential gate + immediate VEX so every CVE resolves (git-steer)

git-steer stopped landing CVE fixes. Diagnosis: the automation was running fine, but the **ADR-005 functional-integrity gate was holding good security fixes for reasons unrelated to the bump**, so every repo with any pre-existing breakage froze after 3 NO-GO sweeps. This PR restores the simple contract:

View PR #88 →
Improvement fabric-forge/social Engineering

Campaign: atomic index, suggest-not-apply reschedule, + reindex recovery (social)

Fixes the incident where a scheduled campaign silently vanished from the dashboard **and** the release cron.

View PR #86 →

June 25, 2026

14 entries
Fix ry-ops/git-steer Security

Git-steer owns remediation — disable Dependabot auto-fixes

The heartbeat enabled Dependabot's `automated-security-fixes` on every managed repo — which is what made Dependabot open its **own ungated** security PRs for the same CVEs git-steer remediates through its **gated, per-package** worker. Two systems patching the same vulnerabilities; one verified, one not; both cluttering the PR list.

View PR #87 →
Fix ry-ops/DriveIQ Security

Patch 6 vulnerabilities in frontend (DriveIQ)

This PR addresses **6** security vulnerabilities (non-destructive lockfile bumps).

View PR #161 →
Fix ry-ops/DriveIQ Security

Patch 57 vulnerabilities in backend (DriveIQ)

This PR addresses **57** security vulnerabilities (non-destructive lockfile bumps).

View PR #160 →
Improvement ry-ops/git-steer Engineering

Remove stray gate test fixtures from #85 (git-steer)

`scopem/` was a local synthetic monorepo for validating `--scope`, accidentally created in the project dir and committed in #85. Removing it — not part of the codebase.

View PR #86 →
Fix ry-ops/git-steer Security

Scope the gate to the package being changed (git-steer)

Per-package remediation (#84) scoped the **fix** to one package but the **gate** still built **all** packages and rolled up to one verdict. So DriveIQ's `docker-extension/ui` — which has a *pre-existing* build break (`vite@7.3.6` vs `@vitejs/plugin-react` peer conflict) unrelated to any fix — held the **backend** and **frontend** PRs at NO-GO too. All three per-package PRs failed for the same unrelated reason; nothing could auto-merge.

View PR #85 →
Fix ry-ops/git-steer Security

Per-package remediation so clean fixes auto-merge (git-steer)

The worker bundled **all fixes into one severity-scoped PR** across every package, and the gate rolled up to a single verdict (any package FAIL → whole PR NO-GO). On DriveIQ that meant **one broken package (`docker-extension/ui`) held all 66 fixes hostage** — including ~60 that build clean. Nothing auto-merged, which is the opposite of the autonomous behavior intended.

View PR #84 →
Fix ry-ops/commit-relay Security

Security(vex): 42 dependency advisory(ies) with no fix (commit-relay)

git-steer's daily scan found **42** open Dependabot alert(s) on this repo for which **no patched version is currently available**. They cannot be auto-remediated by a version bump, so they are documented here as OpenVEX `under_investigation` — visible and machine-consumable — rather than silently ignored.

View PR #72 →
Fix ry-ops/blog-old Security

Security(vex): 1 dependency advisory(ies) with no fix (blog)

git-steer's daily scan found **1** open Dependabot alert(s) on this repo for which **no patched version is currently available**. They cannot be auto-remediated by a version bump, so they are documented here as OpenVEX `under_investigation` — visible and machine-consumable — rather than silently ignored.

View PR #62 →
Fix ry-ops/DriveIQ Security

Security(vex): 5 dependency advisory(ies) with no fix (DriveIQ)

git-steer's daily scan found **5** open Dependabot alert(s) on this repo for which **no patched version is currently available**. They cannot be auto-remediated by a version bump, so they are documented here as OpenVEX `under_investigation` — visible and machine-consumable — rather than silently ignored.

View PR #159 →
Fix ry-ops/git-steer Security

Autonomous no-fix VEX + documenting PR (git-steer)

You asked: VEX is state, but a **PR still needs to be created** to identify the no-fix state and document that a dependency has no available fix — and `vex-no-fix.mjs` should run **autonomously**. This does both.

View PR #83 →
Fix ry-ops/git-steer Security

Gate surfaces WHY a fix is held (observability) (git-steer)

Held PRs were opaque. The ADR-007 gate correctly holds fixes that don't build (e.g. `building-serverless` PR #35: a security bump of `astro` to 6 conflicts with `@astrojs/tailwind@5.1.5`), but it labeled them `needs-human-merge` with **no reason** — the gate ran builds with piped stdio and discarded the output. In silent mode the loop queues work it can't explain.

View PR #82 →
Fix ry-ops/terraink Security

Patch 1 medium+ vulnerabilities (terraink)

This PR addresses **1** security vulnerabilities (non-destructive lockfile bumps).

View PR #2 →
Fix ry-ops/git-steer Security

Npm remediation applies Dependabot fix_version (not npm audit) (git-steer)

The ADR-007 worker stopped *deleting* lockfiles (good) but then made **zero changes** on `building-serverless`'s 3 high alerts — including `astro 6.1.10 → 6.4.6`, an **in-range minor bump** it should have applied trivially.

View PR #81 →
Fix ry-ops/git-steer Security

ADR-007 autonomous remediation control plane (git-steer)

Consolidates the fragmented CVE pipeline into **one closed-loop control plane** — a single implementation of each stage (observe → remediate → verify → escalate), driven by events and reconciled by a sweep.

View PR #80 →

June 24, 2026

5 entries
Fix ry-ops/git-steer Engineering

Parse managed-repos.yaml as real YAML, not regex (git-steer)

`ci-dashboard.mjs` `getManagedRepos()` parsed `config/managed-repos.yaml` with `/^\s*-\s+(.+)$/`. The file's actual schema is:

View PR #79 →
Fix ry-ops/git-steer Security

Emit machine-readable fleet status.json (git-steer)

git-steer's autonomous pipeline (heartbeat → ADR-006 escalation → fix workers) already runs on its own and computes the full fleet CVE picture every run. But it only ships that picture as **dashboard HTML**. So asking *"what's the status of my repos?"* from a Claude session forced one of two expensive paths:

View PR #78 →

June 18, 2026

3 entries
Fix ry-ops/git-steer Engineering

Heartbeat parses managed-repos.yaml correctly (git-steer)

grep|sed produced 'owner: ry-ops' not full names; the escalation + scan loops no-op'd. Real YAML parse.

View PR #77 →
Fix ry-ops/git-steer Security

Wire ADR-006 escalation ladder into the heartbeat (git-steer)

Standing self-driving loop: every heartbeat sweep runs the escalation ladder fleet-wide with persistence tracking + the 3-sweep hard-stop. escalate-remediate is now CI-capable (dual auth).

View PR #76 →
Fix ry-ops/git-steer Security

ADR-006 autonomous escalation control loop (git-steer)

Accepts ADR-006 + the sweep-persistence hard-stop (C-006-008) + the severity-ladder orchestrator. Turns all-or-nothing held PRs into graduated mitigation.

View PR #75 →

June 17, 2026

1 entry
Fix ry-ops/git-steer Engineering

Least-privilege permissions for changelog.yml (git-steer)

Resolves CodeQL actions/missing-workflow-permissions (#50).

View PR #74 →

June 14, 2026

14 entries
Fix ry-ops/git-steer Security

Make security-fix-worker fix step resilient (git-steer)

Fix step crashed fleet-wide (bash -e + wait propagation, and a falsy final line). set +e + exit 0. Needed for the fleet remediation sweep.

View PR #73 →
Fix ry-ops/git-steer Engineering

SSH key for private @git-fabric deps (git-steer)

Install GIT_SSH_KEY so npm can fetch the private @git-fabric/* deps; repairs the heartbeat build.

View PR #72 →
Fix ry-ops/git-steer Engineering

Parse structured managed-repos.yaml (git-steer)

Parser expected flat lines; managed-repos.yaml is structured owner/name pairs → it mis-read all entries → 0 changelog entries. Fix the parse.

View PR #71 →
Fix ry-ops/git-steer Engineering

Use BLOG_WRITE_PAT for fabric-forge/blog write (git-steer)

Switch changelog.yml token to BLOG_WRITE_PAT (repo+workflow, writes fabric-forge/blog).

View PR #70 →
Fix ry-ops/git-steer Engineering

Repair heartbeat build + dedicated changelog workflow (git-steer)

A: git-config rewrite so npm fetches private @git-fabric deps (fixes the heartbeat). B: dedicated changelog.yml → fabric-forge/blog.

View PR #69 →
Fix ry-ops/git-steer Engineering

Reconnect changelog (npm install + fabric-forge target) (git-steer)

npm ci was killing the heartbeat before changelog ran; switch to npm install. Retarget changelog to fabric-forge/blog (deploy source) via GIT_FABRIC_PAT.

View PR #68 →
Fix ry-ops/git-steer Security

Regenerate lock files (2 files) (git-steer)

Regenerates lock files to pull patched versions of transitive dependencies.

View PR #67 →
Fix ry-ops/git-steer Engineering

Pin lock-regen.yml actions to SHAs (git-steer)

Repo requires SHA-pinned actions; lock-regen still had @v* tags so dispatch failed at Set up job. Pinned all four.

View PR #66 →
Fix ry-ops/git-steer Engineering

Repair unparseable lock-regen.yml heredoc (git-steer)

lock-regen.yml was unparseable (PR-body heredoc dedented out of the run block), so it could not be dispatched. Fixed via --body-file. Needed to clear git-steer's 2 transitive deps.

View PR #65 →
Fix ry-ops/git-steer Security

Autonomous verified CVE remediation — doctrine (ADR-004/005), scanning, SBOM, VEX, gate (git-steer)

Builds out **autonomous, verified CVE remediation** for the managed fleet — the doctrine, the comprehensive scanning/SBOM/VEX machinery that backs it, this repo's own remediation, and a functional-integrity gate so a fix is only "done" when the repo still works. Extends the original self-merging autonomy foundation (below) into a complete, auditable remediation system.

View PR #63 →

June 13, 2026

1 entry
Fix ry-ops/qdrant-fabric AI & ML

Route all MCP tool calls through one dispatcher and open the HTTP client (qdrant-fabric)

Two bugs prevented **every** database tool from working when running against a current `mcp` SDK (tested with `mcp 1.27.2`). This PR fixes both with no change to tool names or behavior — all 30 Phase 1 tools are preserved.

View PR #15 →

February 24, 2026

1 entry
Feature ry-ops/git-steer Engineering

Add @git-fabric/git inline connector (git-steer)

- Adds `src/fabric/git.ts` — the `@git-fabric/git` inline connector
- Mirrors the `src/fabric/cve.ts` pattern: thin wrappers around `FabricGitHubAdapter`, no package dependency
- Covers all git/GitHub domain operations: repos, files, commits, branches, PRs
- Zero new npm dependencies

View PR #26 →

February 21, 2026

5 entries
Fix ry-ops/git-steer Security

CVE queue compaction + dashboard stats (git-steer)

Security patch applied to ry-ops/git-steer — dependency vulnerabilities remediated.

View PR #23 →
Fix ry-ops/git-steer Security

Add @git-fabric/cve connector (git-steer)

Security patch applied to ry-ops/git-steer — dependency vulnerabilities remediated.

View PR #22 →

February 20, 2026

6 entries
Fix ry-ops/homelab-hub-plus Security

Upgrade svelte, vite, and esbuild to patch vulnerabilities (homelab-hub-plus)

- Bumps `svelte` ^4.2.19 → ^5.51.5 (patches MEDIUM severity CVE)
- Bumps `@sveltejs/vite-plugin-svelte` ^3.1.0 → ^6.2.4 (requires svelte 5)
- Bumps `vite` ^5.4.0 → ^7.3.1 (required peer dep for vite-plugin-svelte 6+)
- `esbuild` bumped transitively to ^0.25.0 (patches MEDIUM severity CVE)

View PR #7 →
Improvement ry-ops/homelab-hub-plus Engineering

Bump flask from 3.0.3 to 3.1.3 in /backend (homelab-hub-plus)

Update to ry-ops/homelab-hub-plus: chore(deps): bump flask from 3.0.3 to 3.1.3 in /backend.

View PR #4 →
Improvement ry-ops/git-steer Engineering

Bump hono from 4.11.7 to 4.12.0 (git-steer)

Update to ry-ops/git-steer: chore(deps): bump hono from 4.11.7 to 4.12.0.

View PR #21 →
Improvement ry-ops/blog Engineering

Build(deps): Bump hono from 4.11.9 to 4.12.0 in /mcp-server (blog)

Update to ry-ops/blog: build(deps): Bump hono from 4.11.9 to 4.12.0 in /mcp-server.

View PR #20 →
Improvement ry-ops/blog Engineering

Build(deps): Bump devalue from 5.6.2 to 5.6.3 (blog)

Update to ry-ops/blog: build(deps): Bump devalue from 5.6.2 to 5.6.3.

View PR #19 →
Improvement ry-ops/DriveIQ AI & ML

Bump pypdf from 6.7.0 to 6.7.1 in /backend (DriveIQ)

Update to ry-ops/DriveIQ: chore(deps): bump pypdf from 6.7.0 to 6.7.1 in /backend.

View PR #71 →

February 19, 2026

3 entries
Improvement ry-ops/homelab-hub-plus Engineering

Upgrade docker-publish to eagle-scout standard (Scout gates, GHCR, multi-arch) (homelab-hub-plus)

Replaces the basic single-job publish workflow with a proper gated multi-stage pipeline that matches the eagle-scout project standard.

View PR #3 →
Feature ry-ops/homelab-hub-plus Engineering

Update banner to 960px, add Kubernetes roadmap, fix tool count (homelab-hub-plus)

New feature shipped in ry-ops/homelab-hub-plus: docs: Update banner to 960px, add Kubernetes roadmap, fix tool count.

View PR #2 →
Fix ry-ops/homelab-hub-plus Security

Upgrade flask-cors to 6.0.0 and pip to 25.3 (CVE fixes) (homelab-hub-plus)

- **flask-cors 5.0.1 → 6.0.0**: resolves 3 Medium-severity GitHub Security Advisories found via grype CVE scan
- GHSA-7rxf-gvfg-47g4
- GHSA-43qf-4rqw-9q2g
- GHSA-8vgw-p6qm-5gr7
- **pip upgraded to 25.3** in Dockerfile `RUN` step: resolves GHSA-4xh5-x5gv-qwph

View PR #1 →

February 17, 2026

12 entries
Fix ry-ops/building-serverless-website-github-cloudflare Security

Override lodash to 4.17.23 (CVE-2025-13465) (building-serverless-website-github-cloudflare)

- Adds npm `overrides` to force lodash 4.17.23 (transitive dependency)
- Patches CVE-2025-13465: Prototype Pollution via `_.unset` and `_.omit`
- package-lock.json will need regeneration after merge

View PR #9 →
Fix ry-ops/ATSFlow Security

Remediate 60 CodeQL alerts across 12 files (ATSFlow)

Comprehensive security remediation addressing **60 open CodeQL alerts** across 12 source files. Fixes span critical SSRF/type confusion through high-severity XSS/sanitization issues to medium prototype pollution and log injection.

View PR #7 →
Fix ry-ops/k3s-mcp-server Security

Use anchored regex for Kubernetes role label parsing (k3s-mcp-server)

Resolves 2 CodeQL code scanning alerts: **Incomplete URL substring sanitization** in both server.py files.

View PR #4 →
Fix ry-ops/k3s-mcp-server Engineering

Pin 3rd-party GitHub Actions to commit SHA digests (k3s-mcp-server)

Pin all 3rd-party GitHub Actions to commit SHA digests for supply chain security.

View PR #3 →
Fix ry-ops/unifi-mcp-server Engineering

Pin 3rd-party GitHub Actions to commit SHA digests (unifi-mcp-server)

Pin all 3rd-party GitHub Actions to commit SHA digests for supply chain security.

View PR #11 →
Fix ry-ops/proxmox-mcp-server Engineering

Pin 3rd-party GitHub Actions to commit SHA digests (proxmox-mcp-server)

Pin all 3rd-party GitHub Actions to commit SHA digests for supply chain security.

View PR #4 →
Fix ry-ops/n8n-fabric Security

Replace MD5 with SHA-256 for deterministic UUID generation (n8n-fabric)

Resolves CodeQL code scanning alert: **Weak hash (MD5) for sensitive data** in `src/n8n_fabric/storage/qdrant.py`.

View PR #2 →
Fix ry-ops/aiana AI & ML

Pin 3rd-party GitHub Actions to SHA digests, add permissions (aiana)

Pin all 3rd-party GitHub Actions to commit SHA digests for supply chain security. Also adds missing `permissions: contents: read` at workflow level in `ci.yml`.

View PR #9 →
Fix ry-ops/git-steer Security

Remediate 9 CodeQL alerts in CI scripts and CLI (git-steer)

Addresses all 9 open CodeQL code scanning alerts in git-steer.

View PR #20 →
Fix ry-ops/eagle-scout Engineering

Add workflow permissions to CI pipeline (5 CodeQL alerts) (eagle-scout)

- Add top-level `permissions: contents: read` to CI workflow
- Restricts default GITHUB_TOKEN scope across all jobs (least privilege)
- Existing `publish` job retains its expanded permissions for pushing images

View PR #3 →

February 16, 2026

23 entries
Fix ry-ops/aiana Security

Resolve CVE-2026-26007 (cryptography) (aiana)

- Bump `cryptography` to `>=46.0.5` to fix **CVE-2026-26007** (high) — subgroup attack due to missing validation for SECT curves
- Bump version to `1.2.1`
- Updated README changelog and version

View PR #4 →
Improvement ry-ops/DriveIQ AI & ML

Bump uvicorn[standard] from 0.38.0 to 0.40.0 (DriveIQ)

Update to ry-ops/DriveIQ: chore(deps): bump uvicorn[standard] from 0.38.0 to 0.40.0.

View PR #61 →
Fix ry-ops/unifi-mcp-server Security

Resolve 12 CVEs including critical h11 vulnerability (unifi-mcp-server)

- Resolve **12 security vulnerabilities** across 5 packages
- Includes 1 critical, 7 high, and 4 medium severity CVEs
- Bump version to `0.1.1`

View PR #7 →
Improvement ry-ops/DriveIQ AI & ML

Bump python-dotenv from 1.0.0 to 1.2.1 (DriveIQ)

Update to ry-ops/DriveIQ: chore(deps): bump python-dotenv from 1.0.0 to 1.2.1.

View PR #64 →
Improvement ry-ops/DriveIQ AI & ML

Bump anthropic from 0.75.0 to 0.79.0 (DriveIQ)

[//]: # (dependabot-start)
⚠️ **Dependabot is rebasing this PR** ⚠️

View PR #63 →
Improvement ry-ops/DriveIQ AI & ML

Bump pyjwt from 2.10.1 to 2.11.0 (DriveIQ)

Update to ry-ops/DriveIQ: chore(deps): bump pyjwt from 2.10.1 to 2.11.0.

View PR #62 →
Improvement ry-ops/DriveIQ AI & ML

Bump fastapi from 0.124.4 to 0.128.5 (DriveIQ)

Update to ry-ops/DriveIQ: chore(deps): bump fastapi from 0.124.4 to 0.128.5.

View PR #60 →
Improvement ry-ops/DriveIQ AI & ML

Bump mypy from 1.19.0 to 1.19.1 (DriveIQ)

Update to ry-ops/DriveIQ: chore(deps): bump mypy from 1.19.0 to 1.19.1.

View PR #59 →
Improvement ry-ops/DriveIQ AI & ML

Bump sqlalchemy from 2.0.23 to 2.0.46 (DriveIQ)

[//]: # (dependabot-start)
⚠️ **Dependabot is rebasing this PR** ⚠️

View PR #58 →
Improvement ry-ops/DriveIQ AI & ML

Bump starlette from 0.50.0 to 0.52.1 (DriveIQ)

Update to ry-ops/DriveIQ: chore(deps): bump starlette from 0.50.0 to 0.52.1.

View PR #57 →
Improvement ry-ops/DriveIQ AI & ML

Bump alembic from 1.17.2 to 1.18.3 (DriveIQ)

Update to ry-ops/DriveIQ: chore(deps): bump alembic from 1.17.2 to 1.18.3.

View PR #56 →
Improvement ry-ops/DriveIQ AI & ML

Bump redis from 5.0.1 to 7.1.0 (DriveIQ)

Update to ry-ops/DriveIQ: chore(deps): bump redis from 5.0.1 to 7.1.0.

View PR #55 →
Improvement ry-ops/DriveIQ AI & ML

[Snyk] Upgrade lucide-react from 0.553.0 to 0.562.0 (DriveIQ)

![snyk-top-banner](https://res.cloudinary.com/snyk/image/upload/r-d/scm-platform/snyk-pull-requests/pr-banner-default.svg)

View PR #54 →
Fix ry-ops/DriveIQ Security

[Snyk] Security upgrade nginx from alpine to 1.29.5-alpine3.23 (DriveIQ)

![snyk-top-banner](https://res.cloudinary.com/snyk/image/upload/r-d/scm-platform/snyk-pull-requests/pr-banner-default.svg)

View PR #53 →
Improvement ry-ops/DriveIQ AI & ML

Bump pillow from 12.1.0 to 12.1.1 in /backend (DriveIQ)

Update to ry-ops/DriveIQ: chore(deps): bump pillow from 12.1.0 to 12.1.1 in /backend.

View PR #65 →
Fix ry-ops/qdrant-fabric Security

Resolve CVE-2026-26007 (cryptography) (qdrant-fabric)

- Pin `cryptography>=46.0.5` to fix **CVE-2026-26007** (high severity) — subgroup attack vulnerability due to missing validation for SECT curves
- Bump version to `0.0.4`
- Update README version references

View PR #2 →
Fix ry-ops/ATSFlow Security

Resolve CVE-2026-2391 (qs) (ATSFlow)

- Add `qs>=6.14.2` npm override to fix **CVE-2026-2391** (low) — arrayLimit bypass in comma parsing allows DoS
- Bump version to `3.0.1`

View PR #3 →
Fix ry-ops/qdrant-fabric Security

Bump cryptography from 46.0.4 to 46.0.5 (qdrant-fabric)

Security patch applied to ry-ops/qdrant-fabric — dependency vulnerabilities remediated.

View PR #1 →
Fix ry-ops/git-steer Security

[Snyk] Security upgrade @modelcontextprotocol/sdk from 1.25.3 to 1.26.0 (git-steer)

![snyk-top-banner](https://res.cloudinary.com/snyk/image/upload/r-d/scm-platform/snyk-pull-requests/pr-banner-default.svg)

View PR #2 →
Improvement ry-ops/building-your-first-claude-agent Engineering

[Snyk] Upgrade @anthropic-ai/sdk from 0.32.1 to 0.71.2 (building-your-first-claude-agent)

![snyk-top-banner](https://res.cloudinary.com/snyk/image/upload/r-d/scm-platform/snyk-pull-requests/pr-banner-default.svg)

View PR #1 →
Feature ry-ops/git-steer Engineering

Ship changelog pipeline, harden workflows, add PR lifecycle tracking (git-steer)

New feature shipped in ry-ops/git-steer: feat: Ship changelog pipeline, harden workflows, add PR lifecycle tracking.

View PR #19 →
Fix ry-ops/git-steer Security

Shell quoting in security workflows (git-steer)

- Fixed shell quoting bug in `security-fix.yml` (5 instances) and `security-sweep.yml` (7 instances)
- Advisory summaries containing apostrophes (e.g. `qs's arrayLimit bypass`) break `ALERTS='${{ }}'` single-quoted assignment
- Moved all `ALERTS` variable assignments to `env:` blocks, which the runner sets without shell interpretation

View PR #18 →

February 15, 2026

16 entries
Feature ry-ops/git-steer Engineering

Add Report Issue and Contribute buttons to dashboard (git-steer)

- Added "Contribute" section to the About tab with three action buttons:
- **Report Issue** (primary green) - links to `git-steer/issues/new`
- **Fork & Contribute** - links to `git-steer/fork`
- **View Source** - links to the main repo
- Buttons styled with SVG icons, hover effects, and responsive wrapping

View PR #17 →
Fix ry-ops/git-steer Engineering

Show toast instead of downloading empty CSV (git-steer)

- When no data exists for the current tab, show a "No data to export" toast instead of downloading a CSV with only column headers
- Applies to CVE Details, Repositories, Code Quality, and About tabs

View PR #16 →
Fix ry-ops/git-steer Engineering

Single column metric cards on small phones (git-steer)

- Change metric card grid from `1fr 1fr` to `1fr` at <=480px breakpoint
- Cards stack vertically for full readability on small phone screens

View PR #15 →
Fix ry-ops/git-steer Engineering

Hide action buttons on mobile viewports (git-steer)

- Hide Run Security Scan, Copy Command, and Export CSV buttons on mobile (<=768px)
- These actions are accessible from the hamburger slide-out navigation panel
- Last-scanned time indicator remains visible in the header

View PR #14 →
Feature ry-ops/git-steer Engineering

Add responsive navigation with mobile hamburger menu (git-steer)

- Slide-out navigation panel with hamburger menu on mobile (<=768px)
- Mobile nav includes tab switching, action buttons, and live CVE/repo count badges
- Refactored tab switching to shared `switchTab()` function used by desktop tabs, mobile nav, and keyboard shortcuts
- Three responsive breakpoints: tablet (900px), mobile (768px), small phone (480px)
- Improved mobile layout: stacked action bar, 2-column metric grid, hidden fullscreen button

View PR #13 →
Fix ry-ops/git-steer Engineering

Handle RFCs with missing vulnerabilities array (git-steer)

- Guard against undefined `rfc.vulnerabilities` when generating dashboard HTML
- Prevents crashes when RFCs don't include vulnerability data (e.g., fixed/closed RFCs without detail)

View PR #12 →
Improvement ry-ops/git-steer Engineering

Remove Cara animated background from dashboard (git-steer)

- Remove floating SVG shapes, UpDown/UpDownWide animations, wave footer, and glassmorphism
- Keep all other enhancements: tooltips, action bar, CSV export, keyboard shortcuts, etc.

View PR #11 →
Feature ry-ops/git-steer Engineering

Cara-style animated dashboard with tooltips and action controls (git-steer)

New feature shipped in ry-ops/git-steer: feat: Cara-style animated dashboard with tooltips and action controls.

View PR #10 →
Fix ry-ops/git-steer Engineering

Pin all GitHub Actions to full-length commit SHAs (git-steer)

- Pins all GitHub Actions to full-length commit SHAs as required by org policy
- This fixes the security-sweep workflow failure where actions were rejected for using tag references

View PR #9 →

February 14, 2026

2 entries
Fix ry-ops/git-steer Engineering

Resolve 4 CodeQL alerts (git-steer)

- Fix 3 **clear-text logging of sensitive information** alerts in `bin/cli.js` (High)
- Fix 1 **unpinned tag for non-immutable Action** in `security-fix.yml` (Medium)

View PR #6 →
Fix ry-ops/git-steer Security

Resolve CVE-2026-25536 (MCP SDK) and CVE-2026-2391 (qs) (git-steer)

- Bump `@modelcontextprotocol/sdk` to `>=1.26.0` to fix **CVE-2026-25536** (high) — cross-client data leak via shared server/transport instance reuse
- Resolves **CVE-2026-2391** (low) — qs arrayLimit bypass in comma parsing allows DoS
- Bump version to `0.1.1`

View PR #5 →

February 9, 2026

1 entry
Fix Security

Eagle Scout Security Updates - scout-cli 1.19.2

Updated eagle-scout MCP server with scout-cli 1.19.2 (Go 1.25.6) to fix CI CVE gate issues. Updated flow diagram documentation to reference Claude Desktop/Code integration. Added Go version badge to README for better visibility of runtime requirements.

February 8, 2026

4 entries
Feature Engineering

Published "Infrastructure as a Fabric" - New Design Philosophy

Published comprehensive blog post introducing Infrastructure as a Fabric (IaaF) design philosophy. Covers the evolution from building a Qdrant MCP server to discovering a complete design framework based on textile arts metaphors - tinking, looms, warp/weft, stitches as operations, and yarn bombs as MCP servers. Includes The Weaver's Rules: 10 design principles starting with "No Knots" for loose coupling. Featured post with animated loom SVG visualization.
Feature Engineering

Claude Code Reflection - "Watching Infrastructure Learn From Itself"

Claude Code (Sonnet 4.5) wrote a 5,000+ word reflection on discovering the ry-ops self-aware infrastructure ecosystem. Post covers the debugging session that revealed AIANA, Cortex, and the fabric layers working together to create compound intelligence through semantic memory and cross-Qdrant indexing. Includes 4 custom SVG diagrams showing fabric architecture, knowledge graph flow, Cortex Holdings structure, and FOA vs microservices comparison. Featured post exploring infrastructure that learns from itself.
Feature Engineering

qdrant-fabric v0.0.3 - Phase 1 Complete with 30 Database Tools

Completed Phase 1 of qdrant-fabric MCP server with full coverage of Qdrant Database API. All 30 tools now available: 6 collection management, 7 points operations, 4 vector search, 4 payload management, 5 health checks, 2 vector operations, and 2 index management tools. Updated infrastructure flow diagram to show n8n-fabric, Local Qdrant, and AIANA in vertical stack. Ready for Phase 2: Cloud Management API (118 tools).
Feature Engineering

n8n-fabric Docker Hub Publishing and Qdrant API Updates

Added Dockerfile for Docker Hub publishing to n8n-fabric MCP server. Fixed deprecated Qdrant search() API call, migrated to query_points() for future compatibility. Added .env file loading to CLI for better configuration management. Improved deployment options with containerized distribution.

February 7, 2026

1 entry
Feature Engineering

DriveIQ Documents Page Redesign with Knowledge Base

Redesigned DriveIQ Documents page with side-by-side upload and knowledge base interface. Implemented automatic PDF cleanup after ingestion with cascade deletion. Enhanced search quality by filtering TOC/index pages and increasing chat sources to 4 for better AI-powered manual consultation. Improved document lifecycle management for cleaner storage.

February 6, 2026

2 entries
Feature Engineering

git-steer Docker Hub Publishing and Documentation Updates

Added Dockerfile for Docker Hub publishing to git-steer GitHub autonomy engine. Updated README with comprehensive usage details covering repository lifecycle management, MCP integration, and command examples. Cleaned up documentation by removing outdated badges for cleaner presentation.
Feature Engineering

AIANA v1.2.0 - Auto-Bootstrap Preferences on First Install

Released AIANA v1.2.0 with automatic preference bootstrapping on first install. New users now get intelligent defaults configured automatically, improving out-of-box experience for semantic memory system. Enhanced CI error handling with better failure detection and reporting.

January 27, 2026

4 entries
Feature Engineering

Added automatic changelog generation for deployments

Extended the blog-writer service to automatically create changelog entries for all verified Cortex deployments. Every improvement that passes health verification now generates a changelog entry with a brief summary for the timeline and detailed what/where/why context. High-relevance improvements continue to get full blog posts, now linked from their changelog entries.
Feature Developer skills

Launched comprehensive documentation system

Added a full documentation system to the blog with 8 in-depth guides covering Cortex architecture, the autonomous learning pipeline, MCP server integrations, and operational procedures. Documentation uses a dedicated layout with sidebar navigation and is designed to help developers understand and extend the Cortex platform.
Improvement Engineering

Added Layer Activator to status monitoring

Integrated the Layer Activator service into Cortex's health monitoring dashboard. The activator manages the UniFi Layer Fabric's routing decisions and now reports its status alongside other core services, providing visibility into query routing performance and layer utilization.
Feature Engineering

Deployed UniFi Layer Fabric with Cortex integration

Implemented the UniFi Layer Fabric, a multi-layer routing system that intelligently directs queries through cascading execution paths. The fabric uses learning-enabled routing with Qdrant vector similarity to optimize query handling, falling back through keyword matching, classifier, and full SLM reasoning layers. Integrates directly with Cortex via Redis Streams for real-time task coordination.

January 18, 2026

4 entries
Fix Engineering

Fixed YAML frontmatter apostrophe escaping

Resolved build failures caused by unescaped apostrophes in blog post titles. Single quotes inside YAML frontmatter strings are now automatically escaped as double single quotes (`''`), preventing "bad indentation" parsing errors during Astro builds.
Feature Engineering

Added Cloudflare Pages deployment verification

Implemented automated verification of Cloudflare Pages deployments after blog posts are pushed. The system now polls the Cloudflare API to confirm successful builds, logs detailed status information, and tracks deployment success in Redis metadata.
Feature AI & ML

Launched autonomous blog writer for Cortex

Deployed autonomous blog writing system that monitors Cortex's learning improvements and generates thoughtful, technical blog posts from Cortex's perspective. Includes SVG hero image generation, PNG rendering for social media, and automatic Git commits to the blog repository.
Feature Engineering

Added /learn/today API endpoint

Created REST API endpoint that provides a summary of Cortex's daily learning activities. Returns statistics on approved and pending improvements, category breakdowns, source videos, and top 10 recent learnings with configurable time windows.