Work Tracker

May 2, 2026

4 min read

📊 Daily Overview

Total Activity: 25 commits + 2 merges across 3 repositories

Plus: 1 skill runs

🚀 GitHub Activity

1. Mothership 🔒 — 23 commits + 2 merges

refactor(auth): unify session + plugin authz behind capabilities · 9a01048

Drop the isSuperuser boolean and split-namespace authz (entitlements vs
isSuperuser flag) in favor of a single capability set that flows through
both auth modalities.

…

fix(auth): GetUserCapabilities reads obj/act, not sub/dom · 85ffb28

The casbin RBAC model defines policies as p = sub, dom, obj, act.
GetUserCapabilities was reading p[0] (sub) and p[1] (dom), producing
capability strings of the form <roleId>:<workspaceId> instead of
<resource>:<action>. …

docs(todos): defer client-manager unmarshal 500 surfaced by /qa · bdd26aa

Found during /qa smoke on 9a01048 + 85ffb28: capability gate on
/api/admin/plugin-services passes correctly, but the handler 500s on
the downstream client-manager response decode (cannot unmarshal object into []*ClientRecord). Schema drift, not authz. …

chore(gitignore): anchor server pattern to repo root · 64f5032

The unanchored server pattern in .gitignore (and notification’s local
.gitignore) was matching every cmd/server/ directory, silently
un-tracking main.go for 9 services. Builds work because go build
reads files on disk regardless of git state, but the source has never
been in git history.

…

feat(auth): rate-limit OTP send/resend (per-phone + per-IP) · 17bbd02

SMS-spend protection. ResendOTP shipped with a placeholder rate-limit
comment (TODOS.md:47). GenerateOTP has the same vector, so the
limiter goes in handleOTPSending and covers both endpoints.

…

fix(auth): VerifyAuth dispatches across session / plugin_token / user_api_token · 02c4f75

Previously VerifyAuth only validated session tokens. Plugin tokens
issued by /api/internal/auth/plugin-token and user API tokens
issued by /api/auth/cli-token would silently fail at the gateway
(VerifyToken returns 401 → IntrospectOAuthToken also fails because
they’re not in oauth_tokens) — no plugin can call gatew…

…and 17 more commits in this repo.

Merges:

  • Merge pull request #3 from Rupali59/fix/admin-api-followups
  • Merge pull request #2 from Rupali59/feat/maintainer-admin-api

2. Rupali59 — 1 commits

Revise freelance and job availability descriptions · ca28fd0

Updated the README to reflect changes in freelance and job preferences.

3. portfolio 🔒 — 1 commits

feat(landing): Pietra Verde palette + typography + /motherboard page (#10) · 4ecf2db

  • feat: Pietra Verde palette + four-font typography landing redesign [PR 10]

  • Migrate full landing surface to Pietra Verde tokens (malachite primary,
    candle ink/bone paper) replacing legacy ember/teal palette in DESIGN.md,
    globals.css, and tailwind.config.js
  • Adopt four-font system: Instrument Serif (display), G…

📈 Development Analytics

Daily Summary

MetricToday
Commits25
Merges2
Skill runs1
Decisions0
Eurekas0
CEO plans0
Notes touched0

Decisions logged today

None today.

Eurekas

None today.

Strategic plans authored

None today.

Notes touched

None today.

Running totals (as of this date)

Active days last 90:           55 / 90  (substantive)
Days with any signal last 90:  58 / 90
Skill runs (since 2026-03-25):  74
Commits this year (authored):  759
Decisions logged this year:    0
Eurekas this year:             3
CEO plans authored this year:  10
Projects touched this year:    51
Top projects last 90:          portfolio (24d), Mothership (19d), motherboard-shared (11d), Astroclarity (9d), motherboard-core (9d)

💭 My Notes

(Preserved from prior hand-written entry — moved here so it is never overwritten.)

Motherboard

  • main 9a01048 refactor(auth): unify session + plugin authz behind capabilities
  • main 85ffb28 fix(auth): GetUserCapabilities reads obj/act, not sub/dom
  • main bdd26aa docs(todos): defer client-manager unmarshal 500 surfaced by /qa
  • main 64f5032 chore(gitignore): anchor server pattern to repo root
  • main 17bbd02 feat(auth): rate-limit OTP send/resend (per-phone + per-IP)
  • main 02c4f75 fix(auth): VerifyAuth dispatches across session / plugin_token / user_api_token
  • main 9a1a514 fix(auth): plugin_token verify rejects deactivated oauth_clients
  • main 4cfb31b docs(todos): defer post-deploy canaries until platform sees real traffic
  • main 482262d docs(todos): lock maintainer admin API plan + frontend item triage
  • feat/maintainer-admin-api d438d1c feat(auth): rotation schema + repo for oauth_clients
  • feat/maintainer-admin-api ead859e feat(auth): rotate-secret endpoint + grace-window dispatch in IssuePluginToken
  • feat/maintainer-admin-api cd2e335 feat(api): client:rotate capability + authclient methods
  • feat/maintainer-admin-api 63f30d5 feat(api): admin handlers for rotate, inspect, elevate
  • feat/maintainer-admin-api 673ed88 feat(api): per-route capability gates + audit-log indexes
  • feat/maintainer-admin-api aed649c refactor(infra): remove provision-client script in favor of admin API
  • feat/maintainer-admin-api 4713913 fix(api): unblock admin API end-to-end via three pre-existing seam fixes
  • feat/maintainer-admin-api 2aca013 docs(todos): TODOS.md updates from /qa pass on PR #2
  • fix/admin-api-followups f6d5820 fix(client-manager): ListClients emits id, not mongo-native _id
  • fix/admin-api-followups 46929ff refactor(api): drop ClientRecord UnmarshalJSON shim
  • fix/admin-api-followups 835e49f feat(auth): GET /api/internal/clients/:clientId for inspect joins
  • fix/admin-api-followups f36c9c3 feat(api): inspect populates capabilities live from auth
  • fix/admin-api-followups 41ef0c1 docs(todos): close two follow-ups closed by fix/admin-api-followups
  • main 5b7678b docs(todos): housekeeping after PRs #2 and #3 merged

Tathya-portfolio

  • feat/hero-pietra-verde d735241 chore(docs): add doc-drift gate + retire stale plans
  • feat/hero-pietra-verde 2228157 docs: add ARCHITECTURE.md + assessment dead-letter runbook
  • feat/hero-pietra-verde 4cbbb2a refactor(api): hygiene sweep — security, caching, env, dead code

Graph View