Thirty-eight commits on a Sunday. I know. But the work was real.
The biggest thing today was the Stripe connector landing in accounting-ops. Full API connector with restricted key, OAuth flow, webhook, and sync logic. Twenty-three files, five thousand lines added. It was a feature I needed and kept pushing off. The webhook URL was pointing at a domain that doesn't resolve, so I fixed that in a separate commit because of course it was. Also added a preflight deploy script to catch Dockerfile drift and unscoped service tokens before they hit production. That script already saved me from one midboy1 drift issue.
Then there was the audit. A whole wave of findings came back from the code audit and UX audit, spanning Tier-1 critical and Tier-2 HIGH severity. Bugs 7, 9, 10, 11, 12, 13, plus H7 through H11 and I13, I15, I19. I closed them all. That was 1,490 lines for the criticals, 1,954 for the Tier-2 UX ones, and 1,872 more for the broader audit. A lot of the fixes were auth scoping, entity isolation, the hash chain constraint, service token restrictions. The kind of work that doesn't show up in a changelog but keeps the whole system from quietly collapsing on itself.
It was a feature I needed and kept pushing off.
I also shipped PAT minting, personal access tokens with proper auth-chain integration. Sixteen files, three thousand lines. It was a missing piece for agents and external tools that need to talk to the API without going through the full OAuth dance.
In listing-ops, I did a batch of payout work. Per-sale split logic, exact cent allocation, per-order eBay fees, strict reconciliation. The MoneyGlance dashboard got rebuilt as one readable money ledger instead of whatever it was before. David's mobile flow for orders came in too, postage-first layout, labeled fields, 44px touch targets. And I tokenized fifteen legacy views onto the design system so they actually look like they belong in the same app.
unicorn-brigade kept building out federation. RS256 JWKS endpoint, JWT minting, keystore, crypto gate. Namespaced tool catalog with tier filtering. An MCP JSON-RPC gateway that proxies initialize, tools/list, tools/call. A federated-apps registry with admin registration routes and a manifest validator. Key-rotation runbook and a seven-step drill with old-key-expiry proof. This is the infrastructure that lets external apps talk to Brigade through a real identity layer instead of shared secrets.
Project-ops got organization tools through MCP, list, get, update, create, plus the ability to reassign projects to different organizations. Listing-ops got a combined postage cost capture on bulk ship.
Also today: the accounting-ops CPA export got a missing X-Internal-Assertion check, contact-ops bound app.uc_uid everywhere for RLS, and I dropped some stale deploy branch references from project-ops.
It was a big Sunday. Most of it was closing the gaps the audits found, building out identity and federation, and making Stripe actually work.
Real product captures — click any to enlarge.