01

The Lead Story: Spindle’s Revenue Pipeline Matures from Seeded Truth to Production Guardrails

By volume and substance, the heaviest work on June 16 landed in Spindle. The revenue event pipeline - the core HERP workflow that turns subscription and service revenue into draft invoices - went through a full day of maturity work that touched six separate concerns.

02

Revenue Event Due Dates Stop Inheriting the Past

The most telling fix landed early in the morning UTC. The revenue event service was inheriting payment terms from the customer master when creating draft invoices, which meant due dates could drift based on stale or inherited defaults rather than the event’s own timing. Fixes across three commits - normalizing due dates before invoice insert, isolating inherited payment terms, and refactoring the sandbox adapter - closed this gap cleanly.

Commit-by-commit, the pattern was surgical: two lines in revenue_events.py to strip inherited terms, three lines to normalize the due date field before insert, and a test expansion that covered the boundary cases. The sandbox adapter, which had carried some of the due-date logic as a workaround, shed 22 lines of debt in the process.

03

MCP Audit-Log Contention: Deadlocked and Unstuck

A more subtle problem surfaced in the MCP security layer. The audit-log touch that updates each API key’s last_used timestamp was contending with itself under concurrent MCP tool calls - not a full deadlock, but a widening window where parallel requests could collide on the same row. The fix restructured the touch into a dedicated retry path with a bounded backoff, and added 52 lines of test coverage to prove the contention path was gone.

04

Settlement Runtime Permissions: Seeded, Seeded Again, Canonically

Three PRs handled settlement runtime permissions across the day. The first seeded the settlement approval tool permissions into the bootstrap so the MCP layer could resolve them at startup. The second added a versioned upgrade patch so existing deployments would pick up the same permissions. The third extended the HERP bank intake scope so the Task-3 payment lane could access settlement tools through the MCP gateway.

The repetition is worth noting: Spindle seeded permissions twice on June 16 - once for the initial bootstrap and once for the upgrade path - because a live deployment that ran between the two patches would have been stuck without the second. That level of lifecycle awareness is what separates production permission seeding from dev-only configuration.

05

MariaDB Backup: The mysqldump Assumption Broke

A container image rotation caught an assumption that had been hiding in the backup script for weeks. The backup.sh script hardcoded mysqldump, but newer MariaDB container images ship mariadb-dump instead. When the image rolled, the backup lane went silent - no dump, no alert, just sh: 1: mysqldump: not found. The fix added a fallback detection path and a fail-closed error if neither binary exists.

This is the kind of fix that looks trivial in the diff - a binary-name fallback - but represents a real production blind spot. A silent backup failure that gets discovered during a restore drill is a much more expensive lesson.

06

The Web Layer: v2 Pipeline Cleanup and SSH Hardening

On jhf-web, June 16 was a cleanup and hardening day. The compiler dispatch lane that had carried the v1 daily blog workflow was formally decommissioned - not just left unused, but its scripts removed, its route config deleted, and its webhook endpoints tombstoned. The v2 pipeline is now the only pipeline.

07

SSH Command Quoting: A Deployment-Script Blind Spot

The most interesting fix landed in the deployment scripts. Three shell scripts that execute remote commands over SSH were passing unsanitized variables through the command string. Under normal operation, this works fine. But a variable containing whitespace, shell metacharacters, or an unexpected path would silently execute a different command on the remote host.

The fix added a shared lib/ssh-remote-command.sh library that wraps every remote SSH invocation in proper quoting, and patched bounded-web-log-readback.sh, check-stack-runtime.sh, and fabric-selfcheck.sh to use it. This is the kind of hardening that doesn’t change any visible behavior until the day it prevents a deployment from silently corrupting a remote environment.

08

Blog Truth-Window Detection and Hero Regeneration

Two fixes addressed blog pipeline edge cases exposed by the v2 cutover. The same-day truth-window detection - the logic that decides whether a post about “today” already exists - was misidentifying posts when the clock crossed midnight UTC during a long running session. The fix tightened the window comparison to use the canonical closed-day boundary rather than the wall-clock time of the check.

A separate fix regenerated the June 15 hero image after the first v2 run had produced a semantically weak hero - one that illustrated “blog post” rather than “blog transformation.” The regeneration produced the v3 hero that now appears on the live post.

09

The Policy Layer: Jadda’s Meeting and Transcript Interface Gets a Projected Posture

Warp’s contribution to June 16 was a single contract - but a significant one. PR #462 added the Jadda Interface Policy Projection, a 100-line document that defines how the Jadda agent should behave when it participates in meetings, handles transcripts, and manages the resulting action items.

The document covers three modes: observer (listen only, no contribution), participant (active discussion with bounded scope), and executor (transcript-to-action-item conversion). Each mode carries a different set of projected permissions - what Jadda can write, what it can contradict, and what it must escalate to a human operator.

A companion fix (#464) bounded the roster-only runtime reads that the team/apply endpoint was making - preventing a potential runaway query when a deployment had many roster entries but no matching agent profile.

10

The Pattern: Different Layers, Same Fabric

What makes June 16 worth reporting is not the PR count. It’s the evidence that the v2 architecture’s isolation discipline is working. Each layer fixed its own concern:

• Spindle fixed revenue pipeline defaults, audit contention, permission seeding, and backup compat - all without touching the shuttle or the web layer.
• jhf-web hardened SSH quoting, decommissioned the old compiler lane, and repaired blog truth detection - all without touching the finance or policy layer.
• Warp projected a new policy contract and bounded a runtime query - all without touching the revenue or deployment layer.

A 74-PR day across 10 repos proves you can mobilize the whole stack. A day like June 16 - quieter, distributed, layer-owned - proves the stack can breathe without breaking.

11

The Numbers

• 3 repos with merged changes: jhf-web, jhf-warp, jhf-spindle
• 10+ merged PRs across the 3 repos
• Largest change: Spindle revenue event pipeline maturity (6 commits across 3 concerns)
• Smallest change: MariaDB binary detection (2 lines added to backup.sh)
• Most impactful silent fix: SSH remote command quoting (prevents silent deployment corruption)
• Policy added: 100-line Jadda interface policy projection document