- Release Builds: the build/test matrix ran ~1,400 third-party build
scripts and tests with a contents:write token persisted in .git/config.
It now runs with contents:read and persist-credentials: false; a
separate publish job (no project or dependency code) downloads the
artefacts, writes SHA256SUMS and attaches both to the release. The
release now waits for every platform instead of publishing partially.
- CI/Fuzz checkouts don't persist credentials; cargo-audit is pinned
(0.22.2), fails on yanked crates, and also audits fuzz/Cargo.lock;
fuzz runs set -timeout=10 so slow-input bugs (like the IRC OSC one)
are reported instead of hiding under libFuzzer's 20-minute default.
- updates/index.php: array-valued query parameters no longer raise
TypeErrors/warnings; nosniff header.
Renames the product across the codebase: Go module path, config/data
paths, keychain service name, export file extension, build tooling,
docs, and UI text. Sidebar brand mark now reads ">_ AlchementaryLink"
with "Alchementary" in the connection-group gold accent colour, and
the window title is "Alchementary Link".
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019T8bJS8BCtY5GeSG2HBj1n
Andy Dixon
