463 changes this week, against 88 last week — the biggest week of the year by a wide margin, and five and a bit distinct efforts running at once. The headline is vetting: a community can now name who is allowed to vouch for newcomers, a newcomer can be vouched for by people who already know them, and the joining decision counts those vouches — the whole path, end to end, with a Linux-style PGP web of trust as the way a community bootstraps its first vetters. Running beside it, a security review across every project in the stack — 46 hardening changes in seven of them, ahead of taking this to Linux Plumbers. Data rooms reached the browser and the community app, personas became something a person can actually arrange and inspect end to end, and the interfaces got a lot of care — the terminal app has themes now. The one nobody asked for but should read: the agent's audit log became a tamper-evident chain, and clients stopped believing replies that are not signed.
Last week built two features to a design. This week ran five efforts at once and then walked the whole stack looking for ways in. The through-line is the same one as the last month: decide what the system must never be able to do, then make that structural. A vouch that cannot be forged because the community named who may give one. A reply that is not acted on because it was not signed. An address a wallet will not dial because it is not a public one.
A stack-wide security review ahead of Linux Plumbers — 46 hardening changes across seven projects, in one pass rather than as scattered fixes. The largest strand runs everywhere at once: anything that takes a web address it did not choose — from an identity document, a service advertisement, a push registration — now refuses addresses that are not genuinely public, and refuses to follow a redirect somewhere else. That closes a class of attack where a document you resolve talks your own server into fetching something on the attacker's behalf. Alongside it: backup files written readable only by their owner, an admin credential checked for who sealed it before it is installed, a sign-in challenge that stopped revealing whether an account exists, a plugin icon rendered as an image rather than as markup, and every automation step in every build pipeline pinned to an exact version and dropped to least privilege.
The week's headline, and new end to end. A community can publish what it requires to join, name who may vouch for a newcomer with a role credential it can revoke, list those vetters in a directory with profiles, and count the vouches in the joining decision. A vetter can withdraw a statement they later regret. A newcomer gets a guided join that says in plain words what this community wants, tracks their application, and can carry a QR ticket from an in-person meeting. For a Linux-style community that already runs on a PGP web of trust, there is a bootstrap that turns existing key-signing relationships into that first set of vetters — so the community does not start from zero.
Last week data rooms existed in the engine. This week they reached the surfaces people use. A browser can be a room member — not a viewer of someone else's session, an actual member that verifies a room's invitation itself. The community app gained a rooms console for operators, and the browser wallet gained a create-a-room flow that mints the room's identity as part of the flow rather than asking someone to prepare one first. Underneath, the parts that make a room trustworthy over time: a record commitment so a member can check the room's history has not been quietly edited, an epoch key chain so a joining member can read what came before, and read mirrors — a host that serves a copy and can write nothing.
Personas went from a mechanism to something a person can hold in their head. The organising idea is worlds — the parts of a life — with faces in them, so the app can say which links cross a part of your life rather than showing an undifferentiated list. Values can be marked sensitive and stay hidden behind a per-value Show, even from a listing that did not ask for them. A deployment can declare its own claim types rather than living with a fixed vocabulary. And a holder can mark a value as needing a second confirmation before it is ever disclosed — which now actually stops the disclosure, on the phone, rather than failing at the last hop.
A great deal of care went into the surfaces, in both apps. The terminal app got themes — built in, bring your own, light/dark that follows the system, accessible palettes, NO_COLOR, and import from Neovim and Omarchy. The browser wallet's identity panel was rebuilt as a picture rather than a form: guided first, then a map of where you are known — showing where you are known, not everywhere you could be. Forms open where you clicked. The setup guide steps backwards. And a fair amount of it was vocabulary: the screens stopped saying "disclosure" and "fact" and started saying what a person would say.
The one not on anyone's list, and arguably the most consequential. Two halves. First, the agent's audit log became a hash chain with an audit key of its own, and a way to verify it — so an entry cannot be removed or altered after the fact without the chain saying so, and use of the signing oracle is itself recorded. Second, and bluntly: the specification requires successful replies to be signed, 265 requirements say so, and neither service was sending one. Both now sign, and — the half that makes it mean anything — the clients, the wallet and the browser now check. A reply that is not signed is no longer acted on.
Most systems answer "is this person real?" by making you prove it to a corporation — upload a passport, pass a face scan, trust that the result is stored well. Communities have always had a better answer: the people already in the room know. A maintainer vouches for a contributor they have worked with for years; a key-signing party is exactly this, done with paper and pens. What shipped this week turns that into something a system can act on. The community decides what it needs, names whose word it takes, and the decision to admit someone counts those words — with no central verifier anywhere in the picture, and a vetter's authority revocable the moment it should be. For a community that already has a web of trust, the existing relationships carry straight over.
The stack has been signing things for a long time. This week it found that one whole direction was not: successful replies were unsigned, by both services, against a specification that requires it in 265 separate places. It is the most ordinary kind of gap — everything worked, every test was green, and nothing anywhere would have told you. That matters because a reply that is not signed can be replaced by whoever is carrying it, and a client that does not check could not tell. Both halves were fixed together, and that ordering is the point: signing without checking would have been a bigger lie than not signing at all, because it would have looked finished. The same pattern turned up in the audit trail, which is now a chain — an entry that is quietly altered later breaks the chain and says so.
The single biggest strand of the security review runs through every project, and it is one idea. Software here constantly follows addresses it did not choose: an identity document names where to fetch its history, a service advertisement names where to deliver a message, a device registers where to send its notifications. Each one is an instruction from somewhere else, and a server that follows it without judgement can be talked into fetching things on an attacker's behalf — including from inside its own network, where nothing is exposed to the internet and much is unguarded. Every one of those points now refuses addresses that are not genuinely public, refuses to be redirected elsewhere afterwards, and — the part that is easy to miss — checks every address a name resolves to, not just the name, because a name can be made to point inwards a moment after it was checked.
Think of joining a climbing club. You could prove yourself to a national body: send your documents, pay a fee, wait for a certificate, and trust that the body stored your passport properly. Or two members who have climbed with you say so, and the club — which decided in advance that two members' word is what it wants — lets you in. The second is faster, involves no central database of anyone's documents, and is how almost every real community has always worked. It has simply never been something software could act on. That is what shipped this week.
What was built. The whole path, in both the engine and the app. A community publishes its requirements in its join manifest, so a newcomer can see what is wanted before applying. It names its vetters by issuing each of them a role credential — which it can revoke, so "who may vouch" is a live answer rather than a list someone maintains. A vetter directory and profiles let a newcomer find the right person. A vetter writes a vetting statement; they can also withdraw one later, which matters, because a vouch nobody can take back is a vouch nobody should give. The joining decision counts the statements against the requirements. Around it, the practical parts: automatic grants when an application meets the bar, grant resend for when a message is lost, revocation checks on the grant itself, community branding so a newcomer can tell one community from another, and QR tickets so a vouch begun at a physical meeting carries into the app.
The Linux part. A community with no vetters yet has a chicken-and-egg problem: vetters are named by the community, and there is nobody to name them. For communities that already run on a PGP web of trust — which is to say most of the Linux world — the admin tool now bootstraps the first vetters from those existing key-signing relationships. The web of trust that already exists becomes the seed, so a community starts from where it actually is rather than from nothing.
Taking a trust stack to Linux Plumbers means people who break things for a living will look at it. So the week included a deliberate pass across every project rather than the usual incidental fixes. The largest strand is a single idea applied everywhere; the rest are the specific, unglamorous things a review turns up.
Identity documents name where to fetch their history. Service advertisements name where to deliver a message. Devices register where to send notifications. Each is an instruction from elsewhere, and following it blindly lets a document talk your server into fetching things for an attacker — often from inside your own network. Every such point across the engine, the developer kit, the browser wallet, the JavaScript library, the community app, the identity-log host and the phone app now refuses non-public addresses, refuses redirects, and checks every address a name resolves to — because a name can be pointed inwards a moment after it was checked.
Every automation step in every pipeline is now pinned to an exact version by fingerprint rather than a moving label, and the permissions each one runs with dropped to the minimum. Workflow inputs reach their scripts through a controlled channel and are validated, so text someone supplies cannot become a command. In the git-signing project these rules are now enforced by tests that read the pipeline files structurally, so the protection cannot quietly be undone by a later edit, and the paths that matter got named owners.
Backups are written readable only by their owner. An admin credential arriving sealed is checked for who sealed it before installation. The signing oracle is domain-separated, so a signature made for one purpose cannot be replayed as another, and an operator can mark a key as never leaving the agent. On the phone, the holder's key is stored bound to the device and never deleted in order to be rewritten, the notification token stopped being logged, and nothing is approved in the background — it asks the person, every time.
The sign-in challenge revealed whether an account existed. A demo relying party answered cross-origin requests by reflecting whoever asked instead of checking a list. A plugin icon supplied by a third party was rendered as markup rather than as an image. The enclave tool resolved its helper through the search path instead of by absolute location. A page-facing message listener accepted messages without checking their origin. Individually small; collectively the list a review exists to produce.
Counted the same way as the previous eight weeks, from the exact commit each project had reached in the Week 36 report. One project was added this week — the browser wallet — and it is written in a different language, so it contributes nothing to these four measures either before or after: the comparison below stays a clean like-for-like across the same eight projects as last week. Its 182 changes are included in the headline change, line and file counts, which is stated wherever those appear.
In one line: the busiest week of the year by a factor of five, with the largest test rise and the largest interface-sealing rise ever recorded here — and one measure that got worse. Four honest notes. First, the 463 is not comparable to last week's 88 without saying why: a tenth project joined the count this week and contributed 182 of them, so the like-for-like figure against last week's nine projects is 281 — still more than three times last week, but not five. Second, unused-code markers rose by five and that is reported as a regression, not buried: it is the measure that moves the wrong way when a week is fast, which is exactly when it is worth watching. Third, the "265 requirements" finding is not a win, it is a miss being corrected — the specification has required signed replies all along, neither service sent one, and no test anywhere went red; the fix is good news, the gap having existed for that long is not. Fourth, the test stand-in figure reads 778 where the Week-36 page published 774 as its ending value: the earlier number was read from a local copy a few commits behind the published line, and the base here is that same scan point re-read on the published main line.
The published report tracks around eleven projects. This update is drawn from the ten repositories present in this workspace — the nine from last week plus the browser wallet, added this week because it shipped 182 changes and sits at the centre of three of the week's themes. Other parts, such as the personal-AI agent and the data-room demonstration site, aren't included. Figures are read from each project's published main line, not a local copy, and each project is measured from the exact commit it had reached in the Week 36 report.
NO_COLOR, export, and import from Neovim and Omarchy. Small in engineering terms and large in whether anyone enjoys using it.Run the vetted join with an actual Linux community. Everything above works end to end — but end to end internally, with people who already trust each other. The claim that matters is that a newcomer nobody here knows can be vouched for by people who do, and admitted on that basis. Linux Plumbers is the natural place to find out, and the PGP bootstrap exists precisely so a real community can start from the web of trust it already has rather than from an empty registry. Finish the address review where it is hardest. The shared guard is built and adopted in the Rust projects; the JavaScript and Swift versions have the worked examples to be held to but have not yet been held to them. A guard that is strong in one language and approximate in two others is as strong as the weakest one. Watch the measure that got worse. Unused-code suppressions rose by five — small, but it is the one that drifts when a week moves this fast, and the fast weeks are now the normal ones. And land the messaging branch. Its specification cleared review this week and the reference implementation shipped; the reasons to keep it on a branch have largely gone, and every week it sits apart is a week the rest of the stack moves underneath it.