One coordinated hardening pass across roughly twelve products in a day: SSRF guards, money-path races, moderation gates, and new test suites everywhere. Every repo got a backup tag first. We hack our own stuff; this was the scheduled version.
id_token signatures verified, nonce and RP-logout added, and a native Windows installer. The install page lists only methods we actually verified ourselves.
The turn lock self-heals with a generation timeout, invites accept cleanly, and a concurrent send no longer eats the AI's reply.
Real provider cost now flows through as fractional CGC, free calls stopped being charged, and Sign in with Google landed on the OIDC flow.
Cloudflare Pages in front, a D1-backed Worker behind api.cognitive-industries.org, HiveMind SSO for staff. First-party everything.
The whole backend ported to Cloudflare Workers and Durable Objects: campaign engine, multiplayer rooms, roulette, commerce, moderation gates, all of it. Flat-rate credits came back with it, so users stopped paying metered provider cost.
A production-hardening PR, a LAUNCH.md runbook, and a day of CI archaeology (Intel Mac runners are retired, apparently). The runbook's first finding: you can't distribute from a private repo.
mxcs-discovery landed: autonomous out-of-distribution vulnerability discovery for the range, with a code-enforced coordinated-disclosure gate so nothing found ever leaves without review.
One substrate for every app we run: SSO, an atomic credit wallet, a metered LLM gateway, secrets, telemetry, an operator console, and SDKs in TypeScript, Python, and Rust. Seven build phases landed the same day, down to the fail-closed kill-switch and a tamper-evident audit chain.
Nine repos got LICENSE, SECURITY.md, CONTRIBUTING, and a hardened .gitignore on the same day. Boring and deliberate, and the reason every later hardening pass had somewhere to write its report.
A phase state machine, fan-out/reduce decisions, a critic ensemble, and episodic memory with RAG hints, all in one burst. DESIGN-v2 is in the repo.
A clean public source tree for the from-scratch Rust kernel: capability security, content-addressed storage, deterministic execution, packaged so people can actually build it.
Last reviewed · Site changelog