max / makenotwork

• synckit: add constant-time OAuth state check, tighten loopback TLS exemption (ultra-fuzz Run #1 Auth)

  Max Johnson 2026-06-19 22:36 64c640f

• synckit: honor retry contract + overflow-guard pricing, non_exhaustive API (ultra-fuzz Run #1 API)

  Max Johnson 2026-06-19 22:34 98c5776

• synckit: verify + AAD-bind blob content hash, jitter backoff (ultra-fuzz Run #1 Transport)

  Max Johnson 2026-06-19 22:29 5ce8d33

• synckit: bind entry ciphertext to (table,row_id), explicit wire version, HLC overflow guard (ultra-fuzz Run #1 Sync)

  Max Johnson 2026-06-19 22:21 e4266f1

• synckit: bind AEAD associated data + version tag, fix rotation resume (ultra-fuzz Run #1 Crypto)

  Max Johnson 2026-06-19 22:14 225a0ee

• server: report authoritative license activation_count (ultra-fuzz Run #1 Payments MINOR)

  Max Johnson 2026-06-19 21:30 0acbd0a

• server: compute onboarding progress percent in Rust (ultra-fuzz Run #1 UX LOW)

  Max Johnson 2026-06-19 21:30 7e3dcca

• server: size-bound the idempotency negative cache (ultra-fuzz Run #1 Perf LOW)

  Max Johnson 2026-06-19 21:30 65bfa70

• server: enqueue old S3 key inside the replace tx (ultra-fuzz Run #1 Storage LOW)

  Max Johnson 2026-06-19 21:30 fe2aeea

• server: harden OAuth code redemption + challenge length (ultra-fuzz Run #1 Security LOWs)

  Max Johnson 2026-06-19 21:10 0268eb4

• server: route idempotency cache write through bounded pool (ultra-fuzz Run #1 Perf MODERATE)

  Max Johnson 2026-06-19 21:10 8669659

• server: dedup section slugs and hash-fallback non-Latin slugs (ultra-fuzz Run #1 UX)

  Max Johnson 2026-06-19 20:51 339512f

• server: weave version id into download S3 key (ultra-fuzz Run #1 Storage HIGH)

  Max Johnson 2026-06-19 20:51 b0f29b7

• synckit-client: enforce https for non-loopback sync servers

  Max Johnson 2026-06-19 19:54 631ef45

• synckit-client: order sync conflicts by hybrid logical clock

  Max Johnson 2026-06-19 19:28 27defcd

• sando: drop plans/ from git (relocated to _private Syncthing layer)

  Max Johnson 2026-06-19 17:54 2696457

• mt: bound directory count + tighten search query (ultra-fuzz P1, P4)

  Max Johnson 2026-06-19 17:51 cd0acf5

• mt: clear ultra-fuzz minor batch (S-2, U3, draft, link_preview, CSP, category awaits)

  Max Johnson 2026-06-19 17:40 a0494c2

• mt: branded in-handler error pages + filter-preserving pagination (ultra-fuzz U1, U2)

  Max Johnson 2026-06-19 02:57 3845886

• mt: supervise background sweeps + exclude mod-removed posts from profile counts (ultra-fuzz P-sup, B1/B2)

  Max Johnson 2026-06-19 02:45 9f0d497

• mt: stop trusting attacker-controlled X-Forwarded-For for rate limiting (ultra-fuzz C1)

  Max Johnson 2026-06-19 02:36 7f0555e

• mt+server: close internal-API replay chain (ultra-fuzz C2+E1)

  Max Johnson 2026-06-19 02:29 21d5371

• sando+server: boot_smoke probes /health on a known port instead of liveness-only

  Max Johnson 2026-06-19 01:27 a0a22c5

• sando: refuse to build on a non-build host (ultra-fuzz structural, never build on prod)

  Max Johnson 2026-06-19 01:21 c58cbb7

• bento: collapse a nested if in runner (clippy, rust 1.95)

  Max Johnson 2026-06-19 01:10 b058fc7

• bento: seal publish behind an unforgeable PublishAuthority (ultra-fuzz structural)

  Max Johnson 2026-06-19 01:09 15f1353

• sando: clear clippy lints from toolchain drift (rust 1.95)

  Max Johnson 2026-06-19 01:05 294d309

• sando: fail closed on a serving tier with no promotion gate (ultra-fuzz structural CF1)

  Max Johnson 2026-06-19 01:03 c106137

• server: close license-activation revoke TOCTOU; stop pending-refund dup re-queue

  Max Johnson 2026-06-18 22:43 f42d2d0

• server: fix join-wizard HTMX validation input loss; clamp discover paging

  Max Johnson 2026-06-18 22:35 4674725