{ "$schema": "https://hunterterrell.dev/record/schema.json", "site": "https://hunterterrell.dev/", "generated": "2026-09-04T19:24:00.437Z", "count": 5, "entries": [ { "id": "2026-09-04-soren-repository-access", "date": "2026-09-04", "project": "Soren", "claim": "Gave the Soren assistant read-only, hourly-refreshed access to seven repositories across GitHub and GitLab, with every push provably refused.", "state": "verified", "visibility": "public", "evidence": [ { "type": "commit", "ref": "gitlab.com/terrell-technology-workspace/soren@896a106", "note": "soren-repo-access.sh, the sync timer unit, and the ledger row" }, { "type": "document", "ref": "docs/brain/CAPABILITY_LEDGER.md", "note": "row \"Soren access to project repositories\", verified for 7 of 8" }, { "type": "measurement", "ref": "verify output, 7 repositories read=yes write_refused=yes" } ], "tags": [ "soren", "infrastructure", "security", "git" ], "url": "https://hunterterrell.dev/record/2026-09-04-soren-repository-access", "body": "Soren is the single assistant behind Terrell Technology, and until this week it\ncould not read a line of code from any project. This change gives it eyes\nwithout hands: one script clones an approved list of repositories onto the\nserver using path-scoped tokens that can only read, disables the push URL on\nevery clone, and proves the boundary by attempting a push and confirming the\nrefusal. A systemd timer fetches hourly. GitLab-first projects (Soren itself,\nthe HR platform, the innovation league, this record) and GitHub team projects\n(Coordi, Apothik, the consultancy site) are both covered, so the assistant sees\none view across two platforms. The eighth repository waits on an organization\nowner's token approval." }, { "id": "2026-09-04-hunterterrell-dev-live", "date": "2026-09-04", "project": "Provenance", "claim": "Launched hunterterrell.dev, a static site that renders only verified, public claims from an evidence-backed record and fails its build if a private or proposed entry leaks.", "state": "verified", "visibility": "public", "evidence": [ { "type": "url", "ref": "https://hunterterrell.dev", "note": "production on Vercel, apex and www, Let's Encrypt certificate" }, { "type": "commit", "ref": "gitlab.com/terrell-technology-workspace/provenance@3be5d65", "note": "merge of the site branch: Astro site, profile, projects, writing collections, publication guard" }, { "type": "measurement", "ref": "44 pages built; 11 guard tests passing; private entry URL returns 404 on the live domain" } ], "tags": [ "provenance", "site", "astro", "vercel" ], "url": "https://hunterterrell.dev/record/2026-09-04-hunterterrell-dev-live", "body": "The site is built with Astro from Markdown files in this repository and ships\nno client-side JavaScript beyond a theme toggle. Every entry, project, and\nprofile field is a reviewed file; a validator enforces the schema and a test\nrebuilds the site to prove that nothing marked private or proposed, and none\nof the self-reported metrics the evidence ledger grades below A, appears in\nthe output. The launch went through a GitLab merge request, a Vercel project\nwith the site directory as its root, and two DNS records at the registrar;\nthe certificate issued within three minutes of the records propagating." }, { "id": "2026-09-02-hermes-pantheon-readiness", "date": "2026-09-02", "project": "Soren", "claim": "Made Soren's provider-routing layer compatible with the Hermes Agent Pantheon release and proved it against the real tag in a disposable tree without touching a live system.", "state": "verified", "visibility": "public", "evidence": [ { "type": "commit", "ref": "gitlab.com/terrell-technology-workspace/soren@749dd39", "note": "request-builder wrapper, pinned-interpreter resolver, SQLite rollback helper, tests" }, { "type": "document", "ref": "docs/operations/hermes-pantheon-rollout-2026-09-01.md", "note": "section \"Disposable proof results\"" }, { "type": "measurement", "ref": "98 unit tests passing; privacy fields present on real Pantheon request and retry" } ], "tags": [ "soren", "hermes", "upgrade", "privacy" ], "url": "https://hunterterrell.dev/record/2026-09-02-hermes-pantheon-readiness", "body": "The upstream agent runtime changed the signature of the function Soren wraps\nto enforce zero-data-retention routing on OpenRouter, which would have broken\ninference on upgrade. The fix forwards every argument transparently and was\nverified the hard way: the exact release tag was built in a throwaway\ndirectory, every network call was blocked at the socket layer, the API client\nwas replaced with a recorder, and the recorder showed the three privacy fields\non the real request and on a forced retry, with only the inert `clarify` tool\nexposed. The same pass caught two behaviors the upgrade would have introduced\nsilently, a session-title request that bypassed the privacy wrapper and a\nruntime `pip install` at startup, and both became configuration invariants.\nThe rollback helper for the database migration was drilled on synthetic data." }, { "id": "2026-09-02-gitlab-canonical-with-github-mirrors", "date": "2026-09-02", "project": "Terrell Technology", "claim": "Moved four owned projects to GitLab as the working remote with SSH push mirrors that keep same-named GitHub repositories, and the GitHub contribution graph, current on every push.", "state": "verified", "visibility": "public", "evidence": [ { "type": "url", "ref": "https://github.com/TerrellUX/soren", "note": "mirror target; branches match the GitLab heads commit for commit" }, { "type": "url", "ref": "https://gitlab.com/terrell-technology-workspace", "note": "the canonical group for owned projects" }, { "type": "measurement", "ref": "4 mirrors, update_status finished, 3 pinned host keys each, 0 errors" } ], "tags": [ "git", "gitlab", "github", "workflow" ], "url": "https://hunterterrell.dev/record/2026-09-02-gitlab-canonical-with-github-mirrors", "body": "Owned projects now live where the development experience is better, GitLab,\nwhile GitHub remains the public face and the record of activity. Each GitLab\nproject pushes to a GitHub repository of the identical name over SSH, using a\nkey pair GitLab generates and holds; the public half is a write deploy key on\nthe GitHub side, and GitHub's published host keys are pinned so the mirror\ncannot be redirected. No token was created or typed anywhere. Team projects\nowned by other organizations stay on GitHub untouched. Setting this up\nsurfaced two upstream quirks worth recording: GitLab's API creates mirrors but\nsilently ignores host keys, and group access tokens require a paid tier while\ndeploy tokens do not." }, { "id": "2026-08-28-mana-foil-migration-parity-health", "date": "2026-08-28", "project": "Mana Foil", "claim": "Shipped migration-parity detection for the Mana Foil app, exposing schema drift through the health endpoint and an hourly worker probe.", "state": "verified", "visibility": "public", "evidence": [ { "type": "pull-request", "ref": "Templeton-Orrery/Mana-Foil-App#820", "note": "feat(health): migration-parity detection, /api/health plus hourly worker leg (FLOW-027)" }, { "type": "pull-request", "ref": "Templeton-Orrery/Mana-Foil-App#861", "note": "feat(health): hourly worker probes the always-fresh /api/health" }, { "type": "pull-request", "ref": "Templeton-Orrery/Mana-Foil-App#818", "note": "docs(release): FLOW-026, the worker leg of the database split" } ], "tags": [ "mana-foil", "reliability", "database", "health-checks" ], "url": "https://hunterterrell.dev/record/2026-08-28-mana-foil-migration-parity-health", "body": "After splitting the app's production and staging databases, the risk was a\nworker running against a schema its migrations had not reached. These changes\nmake that condition visible instead of silent: the health endpoint reports\nwhether applied migrations match the code's expectations, and an hourly worker\njob probes that endpoint so drift is caught between deploys rather than by a\nuser. The work landed as reviewed pull requests with the release procedure\ndocumented alongside it." } ] }