-
Exorcise sweep: strip AI tells from server copy, comments, and docs
-
server: adopt lint block, fix clippy, fmt
-
Bump the tower/axum middleware cluster (server, kberg)
-
Format the tree with rustfmt and add the lint + supply-chain gates
-
Decompose AppState Phase 2: finish auth + retire spawn_email!
-
Decompose AppState Phase 2: migrate auth, sso, embed to slices
-
Group Config and AppState into cohesive sub-structs
-
Remediate audit Run 22 fix-first findings; bump to 0.10.8
-
Frontend: kill media-picker XSS; render_string surfaces errors
-
Run CPU-bound Argon2 off the async runtime (ultra-fuzz Run 10 C1)
-
server: govern OAuth read routes; harden passkey + password-verify paths
-
server: delegated login ("Sign in with Makenot.work") for testnot
-
server: site access gate for testnot (fan+/creator only)
-
server: gallery/carousel, promo-validator, fuzz #11/#12 remediations, embed port, observability
-
launch-eve audit pass: Ultra Fuzz Runs #8-9 + cross-cutting sweeps
-
server: close Ultra Fuzz Run #4 phases 1-5 + 41-test integration triage
-
server: replace global CSRF allowlist with per-route posture helpers
-
Run 27 MINOR batch: 15 nit-tier items + U3 carry-over
-
Ultra Fuzz Run 27: 32 of 33 audit items remediated
-
Convert .map_err Internal(anyhow!) to ResultExt::context, fix variant misuse
-
Add Email validated newtype, replace ad-hoc email handling