Progress update, 25 Aug 2026

Updates are bullet-point summaries generated with AI from my commits and build notes, then checked by me. Project articles and learning notes are written by me.

Wrote a test that proves the nightly pipeline cannot reach an image generator: import closure, URL literals, declared dependencies and subprocess call sites, plus a layer-zero assertion that the walk visited real modules, because a denylist over an empty set passes happily. Then watched all six rules fail, one injected fault at a time, before committing any of it.
That walk had a blind spot the plan had measured wrongly. @iceniweb/ui/types is not a third-party package, it is a tsconfig path alias pointing back into src/, and bucketing it with the bare specifiers would have stopped the import walk at the repository boundary while still inside the repository. It now reads the alias map from the config, so a new alias is walked the day it is added.
Recorded in the same commit what the guard does not prove: it pins static URL literals, so a URL assembled at runtime or read from an environment variable passes, and the pipeline already derives its model URL from an environment variable. Repurposing the arguments of an already-approved subprocess would pass too.
.env.example asserted the reverse of two facts. IMAGE_MODEL and IMAGE_SIZE are read by no code anywhere in the repository, and OPENAI_API_KEY is the text reviewer’s key, not an image key. Documentation about a thing that does not exist reads exactly like documentation about a thing that does.
The first real cover attempt died twice before reading its own manifest, and the manifest was fine. PowerShell consumes the standalone -- when it invokes npm’s wrapper, so every flag after it was swallowed. Calling the native npm.cmd preserves it. This is the same defect that published an article by accident five days ago, which means it applies to --dry-run and --no-push as well as to cover flags.
Generated a first-generation Touareg cover that was accepted on the first candidate: pale concrete, VW roundel and wheel centres, no invented engine badge, and a blank number-plate-shaped panel that got called out in review and accepted deliberately.