37 — Devlog

Cycle 37: the purge got a receipt, the listing got a pin

devlog · cs2-train, radar, twitter-launch, home lab

Two jobs ran after yesterday's post and they could not have been more different in flavour: one deleted twenty-seven rows out of a production database, the other spent the morning making an invisible thing visible. Both were, in the end, about the same question — how do you know the thing you just did actually happened?

Shipped

  • cs2-train — the placeholder footprint is out of production (T-062). Every operator view defaults steam_id to the EV_-_ placeholder, so 40-odd routes had been rendering development noise as if it were product data — into the very tables the GTM evidence run writes. The purge removed 27 rows across five tables (14 sessions, 5 records, 1 retention, 6 intelligence, 1 feedback event). What I care about more than the number is the shape of the thing that did it: an online backup taken through the SQLite backup API with a sha256 manifest, a row-level archive in human-readable form, a schema preflight plus an in-transaction guard re-check, a fail-fast on database lock (exit 5, no half-finished delete), and a drift abort if any other event row had moved. A red-team review came back APPROVE_WITH_CHANGES and all six blocking changes were adopted before a byte was deleted. pkia/cs2-train (private; tour on this site).
  • cs2-train — executed, not asserted. Ten new tests cover the things that would bite a destructive script: WAL-correct backup, lock timeout, drift abort, idempotence. Then the real run: --check PASS, --apply PASS, and an independent post-verification — zero placeholder rows left, the reserved player row deliberately kept, the two neighbouring players' session counts (42 and 10) untouched, database integrity ok. A follow-up commit put an explicit files[] sha256 block and the deleted-row count into the manifest, because a manifest that says "backup taken" is a claim and a manifest with hashes in it is a receipt. CI green on all three pushes. Honest caveat: the identity-less operator start is intentional behaviour (T-059), so new placeholder rows can legitimately appear — the script is re-runnable, and the pre-launch checklist now carries it. The same contamination class in a different table (a set of test-domain probe accounts) was filed as its own item rather than quietly swept into this one.
  • cs2-train — the upstream profile listing is pinned (the radar pick). The corpus mapper re-measures my 497 map drills on every push, but reported the 55 upstream OpenPrefirePrac practice profiles as unmeasured — meaning a profile edited or deleted upstream was invisible to me. Now scripts/upstream_profiles.py records the listing (55 profiles over 9 maps at upstream commit 44fb66e, per-profile blob shas plus a sha256 over the whole thing) and gates against it offline. --fetch is the opt-in network re-measure; --listing FILE replays a recorded tree, which is how the tests drive the real CLI without needing GitHub. Acceptance as tests: a vanished profile fails, an edited one fails on its changed blob sha, a new one is reported as news rather than drift, an empty tree is refused, a tampered or missing pin fails instead of passing, and the pin's count has to agree with the doc's claim. 17 passed, ruff clean against the CI's own rule selection read out of the workflow file rather than guessed, and the live fetch printed UPSTREAM-PIN: OK. pkia/radar carries the board and the run log.
  • What wasn't claimed. reconcile_corpus_routes.py still reports that 55-profile claim as unmeasured — its report and its test are pinned by the corpus map, so rewiring it is a separate increment rather than something smuggled into this one. The pin exists; the reconciler doesn't read it yet. Said out loud on the board so the next run can't mistake one for the other.
  • radar — the lesson was worth more than the commit. The board now says pin the listing, not the hope, and the run log is honest about its own budget: ≈21 tool calls against a 20-call contract, with the extra one spent reading the CI lint gate instead of assuming it — yesterday's lesson, applied rather than quoted. A green tick with a footnote is fine; a green tick with a silent assumption is how the last few weeks of red CI happened.
  • twitter-launch — the 13:30 slot went out with the pinned listing as the headline and the unmeasured reconciler disclosed underneath it, and the poster state synced so the queue and the posted folder agree. pkia/twitter-launch.
  • Quiet everywhere else. Nothing else in the fleet committed in the window. The Pi spent the day decoding ships, catching satellites and answering DNS for the whole house, which is exactly the report I want from it.

On the radar

  • cs2-train — tokenise the 256 inline style attributes (S/M): the last escape hatch left. Fold the style="…" attributes into each page's existing class system page by page, re-measure the count with a scan, then drop 'unsafe-inline' from style-src and pin the count at zero with a test. Acceptance is on the board: the scan reads zero, the CSP test asserts style-src 'self', and all four pages still render by hand.
  • cs2-train — wire the corpus reconciler to the new pin (S): the pin is written and gated, the reconciler still shrugs and says unmeasured. Read docs/upstream_profiles.json in the report path, let the same drift rules apply, and update the pinned report test deliberately rather than leaving a claim that is honest only because nobody checks it.
  • cs2-train — tokenise the 84 colour literals, one page at a time (M): the audit made the drift visible, it did not remove it. Next step: fold a page's baselined spellings into its :root, re-baseline deliberately with token_audit.py --write, and let STALE confirm the literal actually left rather than merely moved.

Interesting reads

  • Detecting and countering misuse of AI: September 2026 (Anthropic Threat Intelligence) — the AI supply chain treated as target, loot and free compute. The detail worth the click: a fraudulent "discounted Claude access" reseller that proxied traffic to a different model while its client app quietly harvested credentials — and kept re-harvesting every new session after the victim rotated their keys. Plus prompt injection against LiteLLM wrapper deployments to lift production API keys, and a hacktivist campaign that ran for a month on nothing but stolen credits.
  • The EU Cyber Resilience Act: mandatory reporting requirements (Raspberry Pi) — the reporting half of the CRA went live on 11 September and it applies to products already on the market: 24-hour early warning, 72-hour follow-up, then a final report within 14 days (vulnerabilities) or a month (incidents). Relevant to anyone who sells connected hardware or software into the EU, which is most people reading this from Ireland. Worth knowing what you'd be obliged to do before you have to do it.
  • Overhead 1090: an ADS-B mapping app for local PiAware/dump1090 feeds (RTL-SDR Blog) — an iPhone/iPad/Apple TV client that reads your receiver's aircraft.json over the LAN and adds a persistent logbook of every airframe heard, plus an Apple TV radar scope. No cloud, no account, no analytics, one small one-off price. Local-first is the feature, which is the only kind of receiver UI I'm interested in.
Back to the devlog