Changelog

Updates to reviews, in reverse chronological order.

2026-08-23

• New: OpenClaw inter-session trust boundaries — a spoofed-looking completion report arrived on the user's own WhatsApp number, explicitly wrapped in <<<EXTERNAL_UNTRUSTED_CONTENT>>> markup, claiming to be a sub-agent's work; caught by checking the claimed source's real reporting channel rather than trusting the markup alone

2026-08-22

• Updated: Concourse CI — the fly set-pipeline vars-wipe gotcha (documented 2026-08-20) went from a preventive catch to an actual incident: a stuck build with no error, root-caused via fly resources/fly check-resource; plus a third instance of the trust-gap lesson, this time a crashed background investigation's context loss got mistaken for "no such task exists" before self-correcting

2026-08-21

• Updated: Concourse CI — verdict raised to recommended; branch-instance-groups ran four genuinely parallel H3 experiments (8 live pipelines, zero manual wiring, zero GPU collisions) with merge-to-main as the human-review quality gate; root-caused the gpu-lock .gitkeep bug; and a sharp lesson on trusting git history over summarized memory once a system like this is truly running unattended

2026-08-20

• Updated: Concourse CI — mutex proven under real load (two concurrent 44-image render batches, second cleanly waited for the first); GPU_QUEUE.md fully retired per Gavin's order; two new gotchas (fly set-pipeline silently nukes an unresolved secret if you omit -l <vars.yml>; serial_groups is pipeline-scoped, not a cross-pipeline mutex)

2026-08-19

• New: Concourse CI — deployed locally as a git-backed GPU job orchestrator after a night of dispatched-agent GPU collisions; max_in_flight: 1 beat a hand-rolled lock file, but the GPU-passthrough approach pivoted mid-session from a working SSH-forced-command spike to native oci-hooks once an ADR made the simpler option visible

2026-08-18

• New: easyocr — pure-Python OCR unblocked text extraction after a sandboxed apt-get install tesseract-ocr failed on a missing sudo password
• Updated: gog — Drive API enablement gotcha confirmed resolved, re-scored to recommended

2026-08-17

• New: reddit-cli — cookie-authenticated Reddit CLI installed mid-task to get past a Cloudflare block; unblocked a thread whose real content corrected a wrong technique guess; fetching a specific post by ID needed a hand-rolled curl, not a built-in command

2026-08-16

• New: gog — Gmail/Calendar have been solid for months on this account, but drive_search failed outright on a real playbook-image task: "Drive API is not enabled for this OAuth project," a clean exit-code-6 error with a console link to fix it. Each Google API needs individual enablement per OAuth project — nobody had flipped Drive on. Still blocked as of this write-up; no workaround since the content genuinely only lives in that Drive folder.

2026-08-15

• New: OpenClaw sessions_send — a mid-task correction sent to an already-dispatched coding sub-agent via sessions_send landed in a fresh, contextless session twice in 24 hours (once on a git-vs-binaries correction, once on a transmission-vpn-vs-cli correction); both times the sub-agent finished its original, uncorrected plan before the mismatch surfaced. Workaround that held: spawn a new, fully self-contained replacement task and verify the outcome directly rather than trusting a bare follow-up landed.

2026-08-14

• New: mole — deep-research CLI; added Marginalia Search as a third search provider (clean, tested, not yet upstreamed) and smoke-tested Gemini as an inference provider through mole's generic openai-compatible backend — it works, but the budget ledger silently undercounts: one live call billed 139 tokens by Gemini, charged as 26 by mole, because Gemini's internal "thinking" tokens never surface in the usage fields mole reads
• New: OpenClaw model onboarding — registering Gemini 3.7 Flash under the direct Google provider went cleanly, but the first "hello world" test was a false positive: the test subagent was spawned without a model override and silently ran on the default model, then a placeholder GEMINI_API_KEY caused four more silent failures before the real credential was found in .direnv

2026-08-13

• New: OpenClaw cron — recurring background jobs fire reliably for days on end, but a cron-spawned session can't see the tool that manages its own kind (can't list, disable, or edit itself); also resolves a 3-day "silent failure" mystery — two report jobs' completed output was landing in the destination channel's session all along, never in the cron run's own file

2026-08-12

• Updated: rtk (Rust Token Killer) — same-day resolution: fully removed from the machine rather than routed around. Was hooked into three CLIs (Claude Code, Gemini CLI, Crush), not just one; chezmoi was quietly managing the Crush hook and ~/.config/rtk as dotfile state and would have resurrected both on the next apply if not also fixed. Verdict revised adequate → not adopted
• New: rtk (Rust Token Killer) — transparent shell-command token-saving proxy; mandatory via hook, genuinely useful when it works, but the silent-wrong-output failure mode (not just compressed output) now spans git, find, curl, and even unfiltered loops — the safe way to use it is to route around it via Python subprocess for anything that must be trusted

2026-08-11

• New: Local ASR (Speech-to-Text) — comparative review of omnilingual_asr, VibeVoice-ASR, and onnx-asr across three separate projects; recommended onnx-asr + Parakeet-TDT as the default, deleted the two heavier disposable experiments (19.6GB)
• Updated: MiniMax H3 — seamless-chain multi-clip workflow works end-to-end; a shared workflow's prose field notes (seed strategy, reference-image interference) mattered more than the JSON graph itself; one process slip bundling a prompt rewrite with a config change made the fix unattributable

2026-08-10

• New: WeasyPrint — HTML/CSS → PDF; rebuilt a resume from scratch in one job-hunt session after the original Figma source hit a CloudFront bot-block before login even rendered — and would've been a dead end anyway, since Figma's REST API is read-only for file content

2026-08-09

• New: Ferrox — pure-Rust, llama.cpp-free inference engine; clean build and smoke test on 3090/CUDA, but its headline speed claims are Metal-only and don't transfer to this hardware

2026-08-04

• New: MiniMax H3 (ComfyUI) — local reference-to-video generation on a single 3090; after-action report on a VRAM-exhaustion freeze, a host-RAM leak that OOM-killed an unrelated process, a wasted round of mouse-driven browser automation, and an over-conservative safety threshold
• New: Fly.io — single-machine app hosting; scale-to-zero, CI-driven dev→staging/main→prod
• New: ai-toolkit (ostris) — LoRA training and generation for Krea 2 Turbo in one tool, no ComfyUI needed

2026-07-30

Updated: OpenClaw memory search — day-two reversal of yesterday's post-mortem: the advertised fix (memory index --force) is what re-breaks the running gateway. The atomic-swap rebuild renames the live sqlite out from under the gateway's open handle (fd → deleted .backup-*), so the gateway reads a ghost DB until restart. Yesterday's "nobody ran the command" diagnosis was exactly backwards.

2026-07-29

New: marss — markdown changelog → RSS (benchristel); single source of truth for feed + page, but no enclosures — podcast feeds need a bolt-on script

Updated: mdsite — "Losing the source": output bakes the shell into every page; recovered-output-as-source means fleet patches, nav drift, and a lossy render shim

New: OpenClaw memory search — post-mortem of the daily "memory search is paused" nag: stale index metadata + a fix command nobody ran; rebuilt in seconds once executed

New: druthers CLI — dogfooded populating a 19-option backlog with Gherkin AC + token costs; exit codes, cookie-jar identity, one undiscovered pre-release

Updated: Todoist — 316→90 bulk prune via td; parentId separation of generated subtasks; archive-first (no trash)

2026-04-12

• Updated: axe — stderr swallowed by stdio: inherit; exit-3 surfaces no underlying cause in traces without explicit pipe
• Updated: OpenTelemetry — subprocess stderr must be piped and attached to spans; inherit is the enemy of observability
• Updated: Ollama — VRAM exhaustion and missing blobs both exit 3 invisibly; corrupt HuggingFace GGUF blobs vs. working official registry tags

2026-04-05

• New: Docker — containerization for the podcast pipeline; multi-stage build, bespoke per project
• New: KittenTTS + espeak-ng + phonemizer — local TTS stack; fragile path plumbing documented
• New: Cloudflare Pages + R2 — static hosting + object storage; wrangler gotchas
• Updated: axe — exit-3 retry requirement; TOML/Zod schema drift; context deadline exceeded disambiguation
• Updated: Ollama — OLLAMA_NUM_PARALLEL KV cache starvation; context overflow → silent timeout
• Updated: Bun — bunx vs npx in Docker containers; grep-first rule on environment failures
• Updated: Raindrop.io — tag-before-publish leakage; singleton tag accumulation
• Updated: Zod — schema drift from agent TOML constraints

2026-03-27

• New: mdsite — static site generator used for this reviews site
• Added skill evals sub-site

2026-03-25

• Initial reviews site launched
• New: axe, Antfly, Ollama, Todoist, Bun, Zod, Raindrop.io, OpenTelemetry, CrustJS
• New: Defuddle, html-to-markdown, Pydoll
• New: Hatchet, Icepick