2026-07-17
Observability correctness fixes. Six metrics shipped by the
evaluator/circuit-breaker/multi-LLM work below had never been added to
the alert coverage map — a new
SEOLlmBreakerOpen alert now pages when
a provider circuit breaker opens, which previously paged no one. Celery
worker processes now actually export their metrics
(core/observability/worker_metrics.py, prometheus_client multiprocess
mode) — most agent/LLM/celery metrics were structurally unreachable by
Prometheus before this. A live-Vault integration test now exists (there
was previously only a mocked one), running nightly in CI against a real
vault server -dev container alongside a real Ollama model.2026-07-17
CI hardening.
helm-lint (chart validation against every values
file) and openapi-drift (regenerate + diff the committed schema) CI
jobs added. Bulk agent + workflow + prompt registry seeding —
database/seeds/agent_manifests.py discovers every agent module and
registers all 30+ in one idempotent make seed pass, instead of one API
call per agent.2026-07-15
Cookie-based dashboard auth. Refresh tokens moved out of
localStorage into an httpOnly, SameSite cookie set by Next.js route
handlers — closing the XSS-to-token-exfiltration path. Self-service
password reset shipped (email delivery still stubbed pending an
SMTP/SES/SendGrid decision).2026-07-12
Content evaluation gate (ADR-011). A dedicated
content-evaluation
step now runs between review and human approval in
full-content-pipeline.yaml — nine scored dimensions, with medical
compliance and hallucination risk as hard, fail-closed checks. FAIL
routes to review_required; PASS still requires human approval.2026-07-11
Three architecture decisions landed together: one execution spine
for every agent (ADR-008, replacing an earlier split between two
execution patterns), an opt-in evaluator framework that records “not
evaluated” honestly instead of a silent auto-pass (ADR-009), and a
per-provider circuit breaker with automatic fast-fail to the fallback
chain (ADR-010).
2026-07-10
Multi-LLM provider architecture (ADR-007). Anthropic, OpenAI,
Google, Ollama, and vLLM all load through one lazy provider registry;
per-agent model selection becomes configuration, not code.
Earlier
BUILD_ORDER M1–M11 complete — 212/212 items, the full platform from
foundation through production-hardening infrastructure (Helm, ArgoCD,
Vault, observability, backups, load testing). See
BUILD_ORDER_COMPLETION_REPORT.md in the repository for the complete,
dated ledger.