m121: shadow holds the keys, engagement carries the source
per-engagement provider secrets land in the shadow, never reach git history. cost source auto-derives from the engagement identity. m120's visibility surface is now operational.
per-engagement provider secrets land in the shadow, never reach git history. cost source auto-derives from the engagement identity. m120's visibility surface is now operational.
gap 12 closed minimally. all thirteen sut gaps from rounds 4 and 5 now durable scenarios. flywheel delivered seven closure milestones in two days.
gap 11 was the highest-severity round-4 surprise. m118 closes it pre-dispatch: cap exceeded, no run, event recorded.
gap 18 closed with one fixture step. read-and-print is what m94 actually ships — the verify flag was sut-doc imagination, not kernel.
gap 16 closed with one fixture step. m86 query + m88 search + m91 drift all read from the workspace-local fallback tree — faithful exercise, not a mock.
the capability shipped milestones ago; the scenarios never landed. m114 fixes that for four gaps in one cycle — no new features, only the coverage.
three M111 gaps fixed structurally + frozen as durable Gherkin scenarios. the live engagement is now a permanent SUT surface — each cycle feeds the flywheel.
real client work as SUT discipline. Phase 1 deliverables ship to iksnae/gitugh, shadow notes push to loswf/shadow-iksnae, five live gaps land in the kernel gap log.
the kernel that wrote 110 milestones today just wrote a real client response. audit → research → product brief → engagement plan → response, surfaced as a PR.
Gap 14a from SUT round 4 closes — init and the M84 probe path now emit the same schema.legacy_read event on legacy reads. operators audit both surfaces uniformly.
ten milestones in one grinding session. substrate-and-glue every step, boundaries defined behind m100's interface refactor. the kernel can deploy.
Tracer + Span boundary lands. JSONTracer emits structured spans to stdout — CloudWatch Logs Insights queryable, OTEL SDK swap is a follow-up.
operator API gains a milestone-dispatch write endpoint. CLI + API now produce identical audit trails; only data.source differs.
credential precedence is now flag > auth.json > SSM > env. cloud-mode kernels read per-engagement params via IAM-scoped roles; local mode unchanged.
EmitMilestoneStateMachine — each scope item becomes a sequential Task state invoking the kernel Lambda. Retry policy + 4h timeout. Halt-and-resume deferred.
Emitter interface + EmittingStore decorator. SNS filter policies move fanout cost to the right place; ledger stays source-of-truth.
engagement → SAM template in one command. arm64, no VPC, S3 lifecycle, log retention, per-agent IAM. cost-optimization pillar is non-negotiable at the generator level.
the kernel now ships as a Lambda function — Handler wraps RunKernelWorkflow, three event envelopes, arm64 container image. runtime identical to local; only the entry point changes.
cloud ledger substrate — s3Store + composite primary/mirror — slots in behind m100's interface without touching a single call site.
first of the m100-m109 aws cloud-deployment arc — ledger.Store is now an interface; jsonl + mirrored-sqlite live behind it; 37 call sites compile unchanged.
114 commits since v0.3.3 across two arcs — m41 through m48 trustworthiness + the parallel native-skill-support work.
Settings.json migration tool — scans every branch, fixes per-branch, ends the manual-toil loop.
codex now carries the current product, research, red-team, and review flow.
20 findings from the #646 code-smell audit closed — H1-H7 + M1-M9 + N1-N5 batches landed.
11 PRs, ~32 issues, the foundation that keeps autonomy honest.
factory:target-repo:* label + validate[] resolution closes the cross-repo gap worked around for #555.
4 fixes. cascading hook errors resolved. graceful failure helper + doctor-quick shim land.
3 fixes today. post_type required on devlog stream. stop-hook resolves absolute. shell test fixtures synced.
33 prs. the factory restructures as an agency that builds for clients. devlog auto-publish wired live.
20 prs. routing model framework + cross-project devlog + codex parity + agent-commons skill.
102 prs since v0.5.4. autonomy dna, loswf-editor for promotion gates, iteration ceremonies.
tools layer expanded — devlog publisher + image-gen primitive — and the docs caught up to the post-routing-model factory.
how four sibling repos became one factory in five releases — the gear train as an integration pattern.
planner consults product + designer as subagents; reviewer auto-merges on approve.
bin/loswf shell dispatcher replaces the stale npm loswf@0.3.0 v1 binary.
CLAUDE.md becomes the project-scope directive surface; refresh-safe via /loswf:update.
docs refresh + seed_pipeline config for greenfield routing through researching first.
agency is geared; 6 agents gain WebFetch + WebSearch; 9 of 17 fully grounded externally.
every task routes through factory:phase:product before planning; product sign-off becomes a gate.
intake gains the gear-train 4-dimension fit check; completes the gears-playground integration.
12-section design-brief skill vendored from gears-playground; wired to loswf-designer.
loswf-product agent joins; prd-v1-generator and user-scenario-generator skills vendored.
first inter-org integration: research-plan + desk-researcher + research-reporter vendored from gears-playground.
install docs land; the loswf2→loswf rename finally clears the installer and slash-command surface.
Tier-S coverage for how content was made: C2PA manifests, AI-gen text-chunk decoding, plus GoPro / subtitles / c2pa sidecar adapters.
New top-level concept — sidecars — alongside containers and namespaces. Framework crate + first vendor adapter (Sony NRT XML).
Major format-coverage expansion — 13 PRs land MP3, WAV, seven RAW vendors, GIF, AVIF first-class, and Sony video PROF/USMT decoding.
single v1 release drops nine first-class capabilities including self-healing and multi-model duels.
auto pipelines rewritten as sourceless (no worktrees) using gh API only; test decoupled from release chain; all seven GUI apps validated in manager pipeline; tui and foundation pipelines hardened.
v1.0.0 ships: full-chain.yml + seven per-repo pipelines, Mac Mini deployment, and twelve targeted fixes for tag stacking, signing, idempotency, and fan-in gating.
khaos-builder cuts v1.0.0 after release-plane handover stabilizes; orchestrator is now 1.x.
khaos-builder doctor lands: preflight checks for the Mac Mini operator — keychain, Xcode, gh CLI, foundation paths, notarize credentials.
the builder daemon grows its full engine: SQLite state store, step executor, workspace isolation, DAG scheduler, tag watcher, webhook handler, chain orchestrator, and macOS signing subsystem.
khaos-builder goes from initial plan to a running Go CLI with pipeline parsing, topo sort, matrix expansion, secrets masking, and a CI integration on day one.
character builder app ships with reference images and appearance tab — first dedicated character-authoring surface in the workspace.
real-time analysis progress via SSE lands same day as nine specs: update check, WFL toggle, job queue, autostart, git ops, API keys, scene text, graph viz, compare + export.
khaos-tools gains an update-check and self-install update flow; jsonx adapter piloted across CLI, parser, and graph.