max / makenotwork

• storage+sanitizer: dedup confirm HEAD calls; seal custom-pages URL-attribute allowlist (ultra-fuzz NOTE tail)

  Max Johnson 2026-06-23 21:03 83a4e68

• totp: gate confirm on step monotonicity, unifying it with the login replay rule (ultra-fuzz NOTE tail)

  Max Johnson 2026-06-23 20:55 6ef2042

• payments: v2 webhook retry-queue parity + document get_transaction_by_id authz contract (ultra-fuzz NOTE tail)

  Max Johnson 2026-06-23 20:51 7af8fb8

• validation: reject control characters in bio and sync device name (ultra-fuzz NOTE tail)

  Max Johnson 2026-06-23 20:43 ccf8532

• synckit: extract dashboard-tab JS to a static file + close slug-in-onclick (ultra-fuzz --deep UX A+)

  Max Johnson 2026-06-23 20:38 bf7d7c6

• synckit: indexed pull hot path, SSE cursor, deferred egress, sealed warning tick (ultra-fuzz --deep Perf A+)

  Max Johnson 2026-06-23 20:23 0fb3b36

• synckit: invalidate sync tokens on device removal + security audit log (ultra-fuzz --deep Security A+)

  Max Johnson 2026-06-23 20:12 fc0659c

• synckit: ship blob-delete API + fix silently-broken sync_log retention (ultra-fuzz --deep Storage A+)

  Max Johnson 2026-06-23 19:53 f28489d

• ops-exec: pin approved scripts per action on the agent

  Max Johnson 2026-06-23 19:11 167097e

• Seal pricing-format/slug drift and add Cloudflare quarantine cache-purge

  Max Johnson 2026-06-23 19:11 14b7fbf

• synckit: bound developer billing caps + single-source the pricing picker (ultra-fuzz Run 3 UX #6)

  Max Johnson 2026-06-23 17:55 b07943d

• synckit: move usage-warning sends off the scheduler tick onto the bounded pool (ultra-fuzz Run 3 CHRONIC)

  Max Johnson 2026-06-23 17:44 0660bce

• synckit: close 2FA login oracle + serialize rotation-complete (ultra-fuzz Run 3 Security #4)

  Max Johnson 2026-06-23 17:36 2dd934e

• server: update embed price assertions to canonical format (Run 2 UX follow-up)

  Max Johnson 2026-06-23 17:23 3d162e9

• server: structural scan fail-closed honesty, spool perms, oauth client binding (ultra-fuzz Run 2 Security)

  Max Johnson 2026-06-23 17:04 cb8adae

• server: route public price display through canonical formatter + UX wiring nits (ultra-fuzz Run 2 UX)

  Max Johnson 2026-06-23 16:55 8fb3d76

• server: orphan reaper hands transient failures to dead-letter ladder (ultra-fuzz Run 2 Storage SERIOUS)

  Max Johnson 2026-06-23 16:48 766f40f

• server: line-aware cart refunds + orphaned-paid-session escalation (ultra-fuzz Run 2 Payments SERIOUS)

  Max Johnson 2026-06-23 16:35 f66d659

• synckit: enforce paid-only first-party sync + authoritative blob size + atomic caps (ultra-fuzz Run 3 #1/#2/#3)

  Max Johnson 2026-06-23 16:05 5a9a452

• server: supervise scheduler, cap internal broadcast, unblock git2 walk, single-pass archive scan (ultra-fuzz Run 2 Perf CRITICAL + SERIOUS)

  Max Johnson 2026-06-23 15:56 d49b61c

• mt: lockfile for tokio-util (image streaming dep)

  Max Johnson 2026-06-23 14:00 a582754

• mt: proxy external Fan+ images, static template-500 fallback (ultra-fuzz M-UX1 + UX NOTE)

  Max Johnson 2026-06-23 13:57 b0bf5fc

• mt: stream image serves, rate-limit, segregate pools, bound governor (ultra-fuzz S1/Mi1/M-Pf1-3)

  Max Johnson 2026-06-23 06:29 2290bc6

• mt: make username reconcile and post creation atomic (ultra-fuzz S2 + M-St1)

  Max Johnson 2026-06-23 06:17 ae9d34a

• mt: seal resource-in-community behind CommunityScope (ultra-fuzz CHRONIC C1)

  Max Johnson 2026-06-23 06:09 aa8b724

• mt: bind every mod-log write to its mutation's transaction (ultra-fuzz Run #5 S3 + M-DI1)

  Max Johnson 2026-06-23 05:52 f624d4a

• sando: typed-body envelope seal + confirm-modal coverage (UX/API A+, ultra-fuzz Run 2 deep Phase 5)

  Max Johnson 2026-06-23 03:42 5a51b7a

• sando: restart reconcile + real metrics + split event bus (Perf A+, ultra-fuzz Run 2 deep Phase 4)

  Max Johnson 2026-06-23 03:40 d42fe39

• sando: backup plausibility floor + checked terminal writes + tx prune (Storage A+, ultra-fuzz Run 2 deep Phase 3)

  Max Johnson 2026-06-23 03:34 215112b

• sando: add node_health post-deploy gate; boot_smoke is host-only (Gate SM A+, ultra-fuzz Run 2 deep Phase 2)

  Max Johnson 2026-06-23 03:31 675dec1