Roundup — 2026-06-15

Repos scanned (11 git): keysat, matrix-bridge, premier-gunner, proof-of-work, recap-relay, recap, spark-control, standards (meta/tooling), ten31-database (the venture-fund CRM), ten31-signal-engine, ten31-transcripts. Skipped: start-os (external upstream — Start9Labs/start-os, no AGENTS.md by design); 13 non-git folders under ~/Projects (see Gaps). New since 2026-06-14 snapshot: keysat, matrix-bridge, ten31-signal-engine now carry a readable brain and appear here for the first time.

Generated by /roundup — read-only across all repos; quotes priorities/states as found and does not rank projects against each other. Overwritten each run; git history is the diff.

Per-project snapshot

keysat — Self-hosted Bitcoin-native software-licensing service (StartOS 0.4.x s9pk + 4 SDKs + keysat.xyz/docs). Live: registry publishes v0.2.0:55; all StartOS submission blockers shipped; suite green. In progress: none. Next: close the multi-profile GAP (product→merchant-profile write path missing).
matrix-bridge — Single-user Matrix bot turning a room message into a live Claude Code session on the Mac, surfaced to phone via Remote Control. Phase 0 PROVEN/DONE (2026-06-15) by N=3 by-hand runs; no bot code yet by design. Next: Phase 1 — the matrix-nio bot container on the Spark.
premier-gunner — Kid-friendly soccer-training tracker PWA, packaged as StartOS s9pk. Live at v0.1.7:0; all requested features built/deployed. In progress: none. Next: set a real login password via action; confirm speed unit; optional eval backlog. Known issue: in-app password change reverts on restart (use the action).
proof-of-work — Self-hosted multi-user workout logger (Next.js) as StartOS s9pk on a private registry. v1.2.0:1 (Next 14→15 / React 18→19 security upgrade) built + sideloaded 2026-06-13. Pending: confirm 1.2.0:1 boots clean on-box. Next: P3 hardening batch.
recap-relay — Operator-side credit-metered routing service (transcription/diarization/analysis → Gemini + Spark Control) with billing settlement. Aligned at relay 0.2.124 (app 0.2.155); suite green at 60; full eval done; all P0/P1 fixed. Next: persist webhook dedup so restart can't double-credit.
recap — YouTube/podcast summarizer + library; StartOS s9pk and cloud SaaS at recaps.cc. This session (2026-06-15) cleared 3 P0 + 4 P1 from the 2026-06-14 eval; 119 tests pass; leaked Gemini key purged from history. Pending: operator key rotation + real-world cloud tests.
spark-control — StartOS package controlling a dual NVIDIA DGX Spark cluster (vLLM model swaps, STT/diarization/TTS, embeddings, redaction). v0.20.0:0 installed and serving; Spark-connectivity helpers shipped + verified 2026-06-15. In progress: Signal-Engine "flakiness" diagnosed as transient GPU-busy (client remedy drafted, owner to forward). Next: forward concurrency note; start pytest harness.
standards — The global agent fleet (commands, subagents, how-i-work.md) + the four standards docs; symlinked into ~/.claude. Fleet built and live; tree clean, nothing in progress. Next: verify placement.md infra facts; quality-gate standard + /harden; non-git-folder sweep. (meta/tooling layer)
ten31-database — Self-hosted venture-fund CRM (~150 LPs, 250+ prospects) with draft-only agentic AI layer. v0.1.0:74 installed + healthy on Start9; main branch is ahead of box (list-view soft-delete fix + 3 tests). Next: reports-subsystem soft-delete sweep; bump version + redeploy.
ten31-signal-engine — Recurring pipeline ingesting audio/text → structured claims → investment signals as falsifiable predictions through Ten31's thesis lens. Battery test PASSES; Strike adversarial test STALLED (extraction worker died 2026-06-11; 608 jobs pending). Next: resume Strike pipeline (run-extract --limit 700 --max-chunks 4 → embed-claims → two-sided).
ten31-transcripts — Native macOS menu-bar app: detects video calls, records dual-track audio, sends to SparkControl for transcription/diarization. main clean + pushed; 73 tests passing; Release build installed with TLS-on by default. In progress: Meet visual fix (camera-off tile reject) unverified. Next: backend URL + primary→fallback persistence.

Priority queue (all projects + untriaged inbox)

Grouped by the priority signal each item carries; batch lines expand into their sub-items in the source repo's ROADMAP. No cross-project ranking — that's the user's call.

P0 — none open. (Every repo reports its P0s cleared.)

[P1] ten31-transcripts mini-retrofit (add inbox-check line, .claude/settings.json, canonical .gitignore incl. .env.*/!.env.example, optional docs reorg) — source: inbox(untriaged) — INBOX.md

[P2] premier-gunner — upgrade @fastify/static 8.3.0 → ≥9.1.3 (path-traversal advisories) — source: premier-gunner — ROADMAP eval backlog
[P2] premier-gunner — input validation: reject unknown metric kind; validate calendar-date semantics; 400 instead of raw SQLITE_CONSTRAINT_FOREIGNKEY 500 — source: premier-gunner — ROADMAP
[P2] premier-gunner — automated test suite (record-recompute direction, streak math, migration idempotency) — source: premier-gunner — ROADMAP
[P2] ten31-database — reports-subsystem soft-delete sweep (~16 aggregate queries still count soft-deleted rows) + report-endpoint tests — source: ten31-database — next step #1 / known debt
[P2] ten31-database — ?limit=abc crashes — source: ten31-database — next step #3 / known debt
[P2] ten31-database — other known debt: TLS verify off; cryptography==42.0.5; unpkg/no-SRI; hardcoded Spark/Qdrant IPs; 5.4k-line monolith — source: ten31-database — known debt
[P2] ten31-transcripts — mmss() NaN/∞ guard; rewrite stale README; add SessionController state-machine tests — source: ten31-transcripts — eval (EVALUATION.md)
[P2] spark-control — tech-debt (track): pytest harness (build_launch_command incl. injection, swap transitions, _merge_words_with_speakers); loose dep floors / no lockfile / no upload caps; opaque 500 on /api/models when MODELS_OVERRIDES unset; NGC API key on process cmdline; global mutable catalog race; container runs uvicorn as root on 0.0.0.0:9999 — source: spark-control — EVALUATION.md
[P2] recap — known debt: SSE error-string scrub; credit over-spend TOCTOU; multi-mode operator-key bypass; GET /api/history perf; dep CVEs (nodemailer 6.10.1 high); integration tests; unsanitized IDs in _meta.json; PUT /api/history/meta schema validation; doc drift — source: recap — ROADMAP
[P2] recap — daily digest via SMTP (recaps or a recaps relay) — source: inbox(untriaged) — INBOX.md
[P2] recap — bug: minimizing then expanding an embedded video shows black + loses playback (needs hard refresh) — source: inbox(untriaged) — INBOX.md
[P2] recap — bug: background video processing triggers a refresh resetting transcript/summary scroll to top + interrupts audio playback — source: inbox(untriaged) — INBOX.md
[P2] recap — bug: remove the original processing box that precedes the pizza tracker (now redundant) — source: inbox(untriaged) — INBOX.md
[P2] recap — bug: mobile gets stuck, can't scroll back to top on recaps.cc transcript view — source: inbox(untriaged) — INBOX.md
[P2] standards — API automation for Gitea in /new-project (automate the manual create/publish gate via Gitea API) — source: inbox(untriaged) — INBOX.md (meta/tooling)
[P2] ten31-transcripts — add Jitsi support — source: inbox(untriaged) — INBOX.md

[P3] premier-gunner — CSRF token beyond SameSite=Lax; cross-category metric guard; logout without session; consistent 404s; validate category color — source: premier-gunner — ROADMAP
[P3] proof-of-work — hardening batch: login timing oracle, CSP unsafe-eval, /api/health info disclosure, rate-limit map leak, exerciseId ownership on workout PATCH/sets POST, 30-day sessions, text max-length; unify the 3rd JSON-parse pattern — source: proof-of-work — next step #1 / ROADMAP
[P3+] recap-relay — post-eval backlog (deferred, low risk for private box): no rate limiting, dashboard stored-XSS, lan-fetch TLS verify off, debug/error leaks; prune 126 startos/versions files, pin yt-dlp, manifest polish; /relay/health stale 0.2.11; bulk doc fixes — source: recap-relay — ROADMAP
[P3] recap — hardening: request-size/fetch caps, invoice-ID hijack, container root user, auth rate-limit buckets, repo hygiene (stale s9pk, cookies.txt rotation, package.json rename), StartOS registry submission (deferred), bulk doc reconciliation — source: recap — ROADMAP
[P3] spark-control — bulk-fix when next touching docs/packaging: stale README; deprecated @app.on_event + hardcoded version; NimInstallBody.register rename; httpx names leak into error text; innerHTML sink; packaging placeholders (marketingUrl/packageRepo/upstreamRepo); per-service SSH users absent from inputSpec; Makefile x86-only vs aarch64 manifest; misc body/upload size limits + VLLM_PORT crash guard — source: spark-control — EVALUATION.md
[P3] ten31-transcripts — reconcile docs/ specs; incomplete AGENTS layout; missing manifest.json contract; unused entitlements; unauthenticated LAN backend — source: ten31-transcripts — eval

Unprioritized — needs triage (no priority signal in source; preserved, not dropped)

keysat — close multi-profile GAP (product→merchant-profile picker); deferred UIs (rail picker, per-profile SMTP, rail-pref editor); unlimited_merchant_profiles on master Pro/Patron; split audit:read out of blanket :read; build admin "API keys" SPA panel; ROADMAP: Zaprite contacts dedup cache, harden Zaprite declined/expired failure shapes, multi-arch publish (arm+riscv), align manifest license vs LICENSE, registry-submission criteria, registry-landing repurpose, Elastic License v2 vs custom (parked), re-test KEYSAT_INTEGRATION.md, e2e Zaprite sandbox multi-profile webhook routing — source: keysat
keysat — known debt (file labels P2): no rate-limit on /v1/purchase+/v1/redeem; 422/415 errors plain-text not JSON; product slug no validation; GET /v1/admin/products returns 405; dep advisories; no CI + fmt/clippy/prettier unenforced — source: keysat
matrix-bridge — phase-ordered (no Pn): Phase 1 matrix-nio bot container; Phase 2 multi-room routing; Phase 3 Spark Control integration; Phase 4+ intent-routing brain (Qwen3), thread continuity, Nextcloud/CalDAV output, E2EE (low) — source: matrix-bridge
premier-gunner — set login password; confirm speed unit (mph vs km/h); Phase 3 AI coach (deferred, DGX Spark Qwen3.6 35B); product backlog ("log another", km/h option, per-metric direction toggle); platform (password-UX reconcile, packaging hygiene, other arches) — source: premier-gunner
proof-of-work — confirm 1.2.0:1 boots clean on-box (pending verify); tiered AI prompt formatting; Next 15→16 later; verify StartOS proxy forwards real client IPs; fix publish.sh Step-3 registry-register no-op; product (adherence tracking, export/import polish + scheduled backups, charts); hygiene (delete legacy s9pk, drop bcryptjs, revisit workout-planner/) — source: proof-of-work
recap-relay — persist webhook dedup (restart double-credit) [next step #1]; BTCPay hard-requirement decision; money-path unit tests + scope cors() off /admin/* + split 2225-line routes/internal-meetings.js + fix 2 AGENTS.md auth-doc drifts; speaker-tool follow-ups (re-infer names, renumber letters, preserve base, async re-polish, merge provenance); window-boundary empty-analysis (low) — source: recap-relay
recap — operator key rotation + real-world cloud tests (pending); provider-preference server-side persistence; apply Export menu to clip-collection panel; CI lint+type-check decision; failed auto-queue dashboard banner; Zaprite recurring card billing (blocked on Zaprite); architecture-simplification gaps; Max tier-quota default — source: recap
spark-control — owner forwards concurrency note to Signal-Engine dev; concurrency sweep (if dev wants the knee); parakeet-asr --memory cap via Reapply-patches; audio quality (echo cancellation, LLM referee for low-confidence label-merge); platform (Qdrant auth + snapshots, observability/GPU-busy metrics, API-key auth only if public); second audio worker (if load outgrows one GPU); dashboard (per-model vLLM flags UI, Spark host update actions, Open WebUI link-out) — source: spark-control
standards — verify+correct guides/placement.md infra facts (ROADMAP #7); cross-repo quality-gate standard + /harden (#1); non-git-folder sweep under ~/Projects; SessionStart hook for inbox surfacing (#3, optional); thread inbox-check line into bootstrapping (#4) — source: standards (meta/tooling)
ten31-database — bump version + rebuild/redeploy (ship list-view fix sitting ahead of box); Grant + Jonathan freeze v2.0 canonical thesis spine; reply-all for Tier-B drafts; confirm Appendix-A + Maple/OpenSecret/Primal then promote; ROADMAP Phase 1 (grid persistence, admin-invite auth, Tailscale/compose deploy, backups), Phase 2 (advanced views, formula engine v2, activity/audit), Phase 3 (tasks/reminders, automation rules, email, granular permissions) — source: ten31-database
ten31-signal-engine — resume Strike pipeline (stalled, 608 extract jobs pending) [next step #1]; confirm materiality with Grant (Unchained, Debifi, Coinkite); resolve BTC Sessions feed + ingest; ROADMAP: frontier-fan-out test (H6), estimator rework (H4), build real resolver, extend claim-type weighting to §7.1, Job A scorers, MD&A targeting for filings, River image-PDF OCR/vision, lineage-aware corpus expansion, automated test suite, episode-pipelining, corpus-management UI, forward live operation, Start9 s9pk packaging — source: ten31-signal-engine
ten31-transcripts — backend URL + primary→fallback persistence in Settings + mmss() guard [next step #1]; validate Meet visual fix with real app+backend; ROADMAP visual detection (faint-blue border, screen-share exclusion, speaker-view layout, Zoom/Teams ring gating, 1:1 Signal pill fallback, a11y-tree names), audio/speakers (self-VAD tightening, adaptive chunk sizing), app/UX (per-app recording control, recap width), tooling (SwiftLint/SwiftFormat decision, env-var shadowing); cross-device self-unification by voiceprint (deferred) — source: ten31-transcripts

Not yet pushed down (inbox)

Untriaged items that exist nowhere but INBOX.md, grouped by target project:

ten31-transcripts — [chore][P1] mini-retrofit (full .claude/ + portability wiring); [feature][P2] add Jitsi. → drain via /triage inside that repo.
recap — [feature][P2] daily SMTP digest; [bug][P2] embedded-video black-on-expand; [bug][P2] background-processing scroll/audio reset; [bug][P2] remove redundant processing box; [bug][P2] mobile can't scroll to top. → drain via /triage inside recap.
standards — [feature][P2] Gitea API automation for /new-project. → drain via /triage here.

Proposed new projects

The (new:…) inbox items — ideas awaiting the new-repo bootstrap (/new-project), not tasks in an existing repo:

embedded-links-reader — [project][P2] give the app an article/blog URL; it scrapes the author's embedded links, reads them, and summarizes them.
portfolio-scraper — [project][P2] track portfolio companies (podcasts, tweets, founder appearances, news) and deliver a digest via email or another interface.

Gaps

start-os — external upstream (Start9Labs/start-os); no AGENTS.md/ROADMAP.md by design, so no trackable state. Reader confirmed it's a StartOS build system (core modules, build scripts, image recipes). Expected, not a retrofit candidate — listed as skipped, same as the 2026-06-14 snapshot.
guides/placement.md infra facts are UNVERIFIED (standards self-flags; generated one-shot from chat history) — placement decisions in /new-project ride on facts not yet checked with the owner (standards ROADMAP #7).
Workout-log/ folder still present under ~/Projects though standards' Current state reports it was deleted last session — discrepancy to reconcile (it's a non-git folder; reader did not open it).
Stale on-box / deploy gaps to verify: proof-of-work 1.2.0:1 boots-clean check still pending; ten31-database main branch is ahead of the deployed box (list-view fix + tests not yet shipped); recap operator-key rotation + cloud tests pending; ten31-signal-engine Strike pipeline stalled since 2026-06-11.
13 non-repo folders skipped: discount-watcher, expense-organizer, giga, Grand-Cayman-paddleboard, heart-rate, one-river, "satoshi-sleep (need to add code)", "START9 PACKAGING", ten31-command-center, timestamp-converter, timestamp-newspaper, website-landing, Workout-log. Standards' non-git-folder sweep (ROADMAP item-6 residual) covers these; none are git repos so none carry trackable state. (Down from "15 non-git folders" in the 2026-06-14 snapshot.)
No reader failed; every git repo except start-os had a readable AGENTS.md (+ ROADMAP where present).

17 KiB Raw Blame History