SP05 T3 ruling — gateway envFrom order kept, stale monitor comments, offline context boot
The service template — Boot 3.3.4, secured internal surfaces, no scheduling
SP11 T26 rulings — take-over dialog, re-take control after a sleep, panel state and reason, AA colours
Watch, Take over and Hand back controls, and the AI workstation panel
RRULE subset for scheduled responsibilities
The normal form has one spelling per rule (plain decimal numbers, lists without spaces, empty or repeated values), since the stored text feeds the charter stamp...
SP11 T5 ruling — the island and the AI ports pinned as structure, not substrings
A dry run through the web proxy stays a dry run
The /api/email/** proxy builds its own headers for the hop to EmailService and relayed only Range, so X-Kamo-Dry-Run never arrived: a member's dry run of a send...
VNC links, AI state reads and a supervisor-session pause for AI workstations
SP11 T3 ruling — SP02's access-log append test pins the group's start, not the enum's end
AI workstation profile, token and take-over columns
HostedComputerProfile {STANDARD, AI_WORKSTATION} (STRING, lenient parse to STANDARD); HostedComputer gains profile, ai_primary, the MCP token triple (cipher @Js...
Charter types, section catalogue, validation mirror, schedule and hours helpers, API client
SP03-T36 ruling — member BOUNDARY lock, faithful fromRRule, mirror range checks (Task 5 exempts BOUNDARY)
Client calls for watching, taking over and handing back an AI workstation
SP04 preflight — contract check, conflict scan, 18 rulings; ledger started
Aligns SP04 with SP01 as shipped (Hugging Face tool round trip, KnownModelCatalog, model-org rule, 401-only health), SP00's org_not_found rule, SP05 D5's actor ...
SP05 preflight — contract check, conflict scan, 13 rulings; ledger started
Cross-SP fixes: SP10 edited-approval key, caller headers on K6/KM1 (SP13/SP14), 503 RETRY is definitive, AI_WORK workItemId derived from the idempotency key (ca...
The media.* host no longer reaches MediaService's server-to-server endpoints
The media-route IngressRoute sends every path on a media.* host straight to MediaService, past the API gateway, so the gateway's carve-outs (master spec section...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.