Devlog week 8: the freshness bot, per-tag RSS, ESLint migration, box-audit 0.10.x

The week shipped: the freshness bot got its full shape (daily link sweep, rotating deep reviews, kanban-dispatched to the publisher, a standalone doc), per-tag RSS feeds and the full RSS chain closed out issue #104, the ESLint setup migrated from the compat shim to @eslint-react, and box-audit shipped install-time learning plus its mutation-coverage registry.

The freshness bot

The bot started the week as a daily link sweep with rotating post reviews and ended it as a full pipeline: the runner script with a dry-run mode and a zero-dependency link sweep, deep reviews delegated to the publisher agent via kanban cards instead of opencode (the cron appendix rule: session-context workflows don't route through opencode from cron), idempotency keys on card creation so a re-run can't duplicate a review, and a standalone doc describing the whole system without naming the tooling that runs it. The docs went through four passes — two of them naming-tooling violations caught in review, one a revert of a whole directory move that broke the publisher's charter paths.

RSS: the chain closes

Per-tag feeds shipped item-for-item verified against the live site: one feed per registry tag, reusing the main feed's item shape, with correct atom self-links and matching <link rel=alternate> tags in the layout. The batch closed out the long-running issue #104: self-link fix, tags-as-categories, JSON Feed 1.0, full-content descriptions, per-tag feeds, all merged and production-verified the same day.

ESLint migration

The compat shim came out and @eslint-react went in, the cleanup pass removing dead plugin config from the flat config file — the spike branch and two follow-up PRs landing the migration and a stale-comment fix the swap exposed.

box-audit 0.10.x

F2, F3, and F4 (fail2ban jail discovery, the webhook severity floor, IPv6 outbound parity) shipped Monday as 0.9.2 — merged the previous week, held for the release tail. F6's mutation-coverage registry (the batch that replays seeded container boots against one-line mutations and checks the gate catches each one) went from doc to kanban dispatch in two batches, with the release tail held pending review. Then install-time baseline learning shipped as 0.10.0: the installer snapshots the box's actual state before the verify gate, so the baseline is real from minute one instead of flagging syncthing or tailscaled as security.new_port every morning. 0.10.1 followed the same day with tier-2 coverage fixes, the operator skill slimmed in the same window.

Also shipped

The phone-stuck-at-99 post went through two rounds of reviewer feedback; the devlog's own week 1–6 entries got a two-pass compression to digest depth after review; PR #101's review fixes landed and the post awaits its publish call. The idea-machine ran twice, expanded four cards, generated zero new ones — second week running.

Next: dependabot grouping and the freshness bot's first live rotation.