Verified, evidence-backed entries about what Hunter Terrell has built.https://hunterterrell.deven-ushttps://hunterterrell.dev/record/2026-09-04-soren-repository-accesshttps://hunterterrell.dev/record/2026-09-04-soren-repository-accessSoren is the single assistant behind Terrell Technology, and until this week it could not read a line of code from any project. This change gives it eyes without hands: one script clones an approved list of repositories onto the server using path-scoped tokens that can only read, disables the push URL on every clone, and proves the boundary by attempting a push and confirming the refusal. A systemd timer fetches hourly. GitLab-first projects (Soren itself, the HR platform, the innovation league, this record) and GitHub team projects (Coordi, Apothik, the consultancy site) are both covered, so the assistant sees one view across two platforms. The eighth repository waits on an organization owner's token approval.Fri, 04 Sep 2026 00:00:00 GMTSorensoreninfrastructuresecuritygithttps://hunterterrell.dev/record/2026-09-04-hunterterrell-dev-livehttps://hunterterrell.dev/record/2026-09-04-hunterterrell-dev-liveThe site is built with Astro from Markdown files in this repository and ships no client-side JavaScript beyond a theme toggle. Every entry, project, and profile field is a reviewed file; a validator enforces the schema and a test rebuilds the site to prove that nothing marked private or proposed, and none of the self-reported metrics the evidence ledger grades below A, appears in the output. The launch went through a GitLab merge request, a Vercel project with the site directory as its root, and two DNS records at the registrar; the certificate issued within three minutes of the records propagating.Fri, 04 Sep 2026 00:00:00 GMTProvenanceprovenancesiteastrovercelhttps://hunterterrell.dev/record/2026-09-02-hermes-pantheon-readinesshttps://hunterterrell.dev/record/2026-09-02-hermes-pantheon-readinessThe upstream agent runtime changed the signature of the function Soren wraps to enforce zero-data-retention routing on OpenRouter, which would have broken inference on upgrade. The fix forwards every argument transparently and was verified the hard way: the exact release tag was built in a throwaway directory, every network call was blocked at the socket layer, the API client was replaced with a recorder, and the recorder showed the three privacy fields on the real request and on a forced retry, with only the inert `clarify` tool exposed. The same pass caught two behaviors the upgrade would have introduced silently, a session-title request that bypassed the privacy wrapper and a runtime `pip install` at startup, and both became configuration invariants. The rollback helper for the database migration was drilled on synthetic data.Wed, 02 Sep 2026 00:00:00 GMTSorensorenhermesupgradeprivacyhttps://hunterterrell.dev/record/2026-09-02-gitlab-canonical-with-github-mirrorshttps://hunterterrell.dev/record/2026-09-02-gitlab-canonical-with-github-mirrorsOwned projects now live where the development experience is better, GitLab, while GitHub remains the public face and the record of activity. Each GitLab project pushes to a GitHub repository of the identical name over SSH, using a key pair GitLab generates and holds; the public half is a write deploy key on the GitHub side, and GitHub's published host keys are pinned so the mirror cannot be redirected. No token was created or typed anywhere. Team projects owned by other organizations stay on GitHub untouched. Setting this up surfaced two upstream quirks worth recording: GitLab's API creates mirrors but silently ignores host keys, and group access tokens require a paid tier while deploy tokens do not.Wed, 02 Sep 2026 00:00:00 GMTTerrell Technologygitgitlabgithubworkflowhttps://hunterterrell.dev/record/2026-08-28-mana-foil-migration-parity-healthhttps://hunterterrell.dev/record/2026-08-28-mana-foil-migration-parity-healthAfter splitting the app's production and staging databases, the risk was a worker running against a schema its migrations had not reached. These changes make that condition visible instead of silent: the health endpoint reports whether applied migrations match the code's expectations, and an hourly worker job probes that endpoint so drift is caught between deploys rather than by a user. The work landed as reviewed pull requests with the release procedure documented alongside it.Fri, 28 Aug 2026 00:00:00 GMTMana Foilmana-foilreliabilitydatabasehealth-checks