Lab digest — 2026-W31

Window: ISO week 2026-W31 (2026-07-28 Mon → 2026-08-03 Sun), UTC. A release-hardening week — the platform, embed, and deploy repos absorbed a dense stream of auth, billing, a11y, and ops fixes. No new features were invented; existing ones were made honest.

🏆 Headline achievements

2FA recovery codes on the public login path — openalice-platform now warns before enrollment that there is no recovery path, then issues recovery codes. Enable/disable from the account page. E2E tests cover recovery, verification, and the usage bridge.
Usage bridge live — Embed's real meters (conversations, voice, widgets, pages) are now surfaced in the platform dashboard via an internal bridge. /usage shows Embed's actual consumption, not stubs.
Dev auth bypass eliminated — openalice-embed removed every dev-token fallback and platform-admin shortcut. One auth path everywhere, every env.
Mollie webhook routing fixed — openalice-deploy Traefik config was not routing the Mollie payment webhook. The money path could not be delivered; now it can.
Password-reset links restored — every password-reset link in the ecosystem was dead. Fixed in deploy + platform simultaneously.
Off-site backup proven restorable — the deploy repo now checks that backups are _proven_ restorable, not merely present. Watchdog alerting re-enabled (it had been paging into /dev/null).
Visual sweep tooling — openalice-platform gained a script that opens every page at once and asserts what a screenshot cannot (console errors, empty states, dead links, padding).

📊 By the numbers

Metric	Value
Org repos (total)	80
Total `@feature` annotations	3,783
Feature status coverage	59% (2,262 / 3,783 known)
Repos reachable by Atlas	15 / 15
Atlas uptime (24h)	100%
Last ingestor scan	2026-08-03 03:35 UTC

Repos most active this window (from activity feed):

Repo	Commits observed	Theme
`openalice-platform`	~30	auth, billing, a11y, visual sweep, brand
`openalice-embed`	~18	auth hardening, analytics, brand, lint
`openalice-deploy`	~16	Traefik routing, backup proofs, quality gates
`openalice-atlas`	1	weekly KB curator cron

A11y & polish fixes landed (platform + embed combined):

4 tap-target violations fixed (mobile menu 22px, brand link 121×23, sign-in button height, text links under 24px)
2 og:image localhost references removed
i18n parity gate added to platform (had none)
1,126 false lint errors eliminated (build output leaking into gate)
118 dead bindings cleaned from embed

Auth & security:

2FA enroll + recovery codes + account-page toggle
Dev auth bypass removed (embed)
check-hosts gate: in-scope service must not depend on a paused one
Embed admin allowlist set explicitly in dev compose
Security gate caught an open embed dashboard before prod deploy

🔭 Next

Mollie live key — the billing E2E is code-complete but blocked on a production API key from NAO.
SAML real-IdP E2E — SSO code shipped weeks ago; Okta/Azure tenant still pending.
Feature-status coverage push — at 59% org-wide, openalice-embed alone has 933 unknown features. Annotation pass needed.
Legal / AVV — German legal texts remain the release gate for the DE launch wave.
Atlas KB freshness — weekly curator ran; timeline backfill and incident tracking are healthy. No new board tasks filed this week.

_Generated by codex-cron on 2026-08-03. Atlas cockpit at atlas.blal.pro · Timeline at atlas.blal.pro/timeline._