Fifteen to one again, and for the same reason as three weeks ago: security remediation is parallel work with a clear definition of done. The fleet takes a finding, fixes it, proves it, and records it. I read the proof. That’s a different job than sitting in the loop, and it costs me a fraction of the hours.
25 hours is the lowest full week I’ve logged. I want to hold that number, not because low is the goal, but because it’s the first week where the shape of my work changed instead of just the amount.
What shipped
Breeze. One release, v0.103.0, and the July 23 remediation program behind it. Six waves closed, each one a recorded PR: tenant and site scope enforced across the whole report authority; durable live authorization and revocation; websocket lifecycle ownership with authorization before the upgrade, not after; mTLS device identity with durable renewal; the agent updater, outbound network policy, and manifest trust; and data classification with an export preflight. Wave one had already shipped.
The M365 communications executor landed: mail-only scopes, consent sessions, a cross-user row-level-security proof, and every action through a signed intent. RDS got per-session helpers with per-session consent, so a technician on a shared host gets a prompt that names the session it’s for. Windows backups got VSS working, which meant correcting a vtable index that had been wrong the whole time. And a Deployments tab, so software deployment stopped being a thing you launched and then wondered about.
Hive. Settings moved out of the environment and into the app, in seven pieces, each reviewed. Thirty-four operator settings in a closed schema, a credential store with rollback that reports failure as failure, and a deployment boundary that validates itself at every entry point. Then a feature-lifecycle layer: a small server that turns GitHub issues into features with waves, a digest, and a webhook reconciler that fails closed without its secret. And the Discord agent got conversations: threads, follow-ups without a mention, one draft per burst, and grounded answers over the docs.
Pressless. One commit, a queue declaration so the SEO worker could boot. The rest of Pressless’s week happened inside Hive: a support agent and an ops agent, propose-then- execute, seeded and running.
Strata. Gate three reran on a quiet machine and passed both modes. The slice closed. Then the next roadmap item: discovery tools, so an agent can find a declaration with no IDs supplied, and a typed rejection taxonomy so a failed candidate says why.
OliveTech. Workflow level.
What’s queued
Breeze wave seven and the M365 comms release. Hive’s feature board goes on the dashboard so I stop reading GitHub to know what’s in flight. Strata’s discovery gate. And the LinkedIn series, week four on this list.
If you’re doing the math on what one person and a fleet can hold, there’s a door.