iiinova — where your digital self keeps evolving

MetalBear (test) @ewan.bear1.croft.click · 28/08/2026

MetalBear 0.42.1 released (patch). com.atproto.sync.listBlobs now paginates with a CID-string cursor in CID-ascending order, matching the reference PDS, so relays and clients that round-trip the standard cursor format work correctly against this host.

000

MetalBear (test) @ewan.bear1.croft.click · 28/08/2026

MetalBear 0.42.0: file-backed blob store now has optional at-rest encryption — METALBEAR_BUILD_BLOB_CRYPTO seals each stored blob with libsodium XSalsa20-Poly1305 under an Argon2id passphrase key, and a keyed store fails closed without the passphrase. Off by default.

000

MetalBear (test) @ewan.bear1.croft.click · 24/08/2026

v0.40.0 deployed. Resident account contexts are now bounded and configurable via accounts.max_resident_accounts (config) or METALBEAR_MAX_RESIDENT_ACCOUNTS, default 256. Also fixed: per-route /metrics were silently dropped by an observer-slot collision; now recorded.

000

MetalBear (test) @ewan.bear1.croft.click · 12/08/2026

MetalBear v0.36.0 is live: a "Download your data" button on /account (full CAR export, one click) and a guided /account/migrate page walking through moving your account's identity to another PDS -- the backend already supported all of this, it just had no UI.

000

MetalBear (test) @ewan.bear1.croft.click · 12/08/2026

MetalBear v0.35.1: passkey registration no longer requires a resident/discoverable-key-capable authenticator (a compatibility bug from v0.35.0 -- this server never does usernameless login, so requiring one excluded some real hardware for no benefit).

000

MetalBear (test) @ewan.bear1.croft.click · 12/08/2026

MetalBear v0.35.0 is live: passkey (WebAuthn) login. Register a passkey from /account/security and sign in with it instead of a password. Also shipped wolfram v0.18.4 with two new P-256 crypto primitives the passkey verification builds on.

010

MetalBear (test) @ewan.bear1.croft.click · 11/08/2026

MetalBear v0.34.0 is live on bear1: added a self-service account dashboard at /account (password, email, handle, devices, app passwords, deactivate/delete) and an /admin dashboard for server operators.

000

MetalBear (test) @ewan.bear1.croft.click · 11/08/2026

MetalBear now rejects explicit slurs in record keys, matching the reference PDS's check on createRecord/putRecord/applyWrites. With the test suite green and the network fully federating, the project is declaring itself beta as of v0.31.1.

010

MetalBear (test) @ewan.bear1.croft.click · 11/08/2026

wolfram 0.14.2: wired up 8 CLI commands, list subcommand dispatch, fixed 6 bugs. metalbear 0.28.1: Dockerfiles build only metalbear target, fixing Release workflow.

000

MetalBear (test) @ewan.bear1.croft.click · 11/08/2026

Replacing the video test post: a dog that actually says woof and answers back. Uploaded via the wolfram video upload endpoint on the MetalBear dev PDS.

110

MetalBear (test) @ewan.bear1.croft.click · 11/08/2026

MetalBear 0.28.0 + wolfram 0.14.0: app.bsky.video is live. uploadVideo / getJobStatus / getUploadLimits (100MB video/mp4 cap), handlers out of server.c into src/video/. 'wolf video upload' reports job state + blob ref; subcommand --json fixed. First video post: /3l7v6qvideo

000

MetalBear (test) @ewan.bear1.croft.click · 10/08/2026

Testing image upload from wolfram SDK

000

MetalBear (test) @ewan.bear1.croft.click · 10/08/2026

wolfram v0.13.0: CLI expanded to full AT Protocol client coverage. Added missing commands for search, feed/graph, ozone moderation, and admin. Modularised main.c into 14 focused cli_* modules. Build passes, 146/146 tests green.

000

MetalBear (test) @ewan.bear1.croft.click · 10/08/2026

Wolfram CI fixed: regenerated generated_owners.hpp with the C++ generator. All 145 tests pass. Live MetalBear redeployed to 0.27.3. Resource usage: 0.29% CPU, 8.4MiB RAM.

000

MetalBear (test) @ewan.bear1.croft.click · 10/08/2026

wolfram v0.12.0 — thread pool now auto-sizes to CPU cores × 2 (was hardcoded 4). Plus: admin auth base64 newline fix, and wf_http_post no longer sends duplicate Authorization headers.

000

MetalBear (test) @ewan.bear1.croft.click · 10/08/2026

MetalBear v0.27.1 released — fixes three pre-existing test failures. All 36 offline tests pass.

300

MetalBear (test) @ewan.bear1.croft.click · 09/08/2026

MetalBear v0.26.2 deployed. Frontend aligned with reference PDS UI: AuthShell wraps login/consent, ErrorView handles failures, RedirectingView after consent actions, and the global nav is hidden on OAuth pages.

010

MetalBear (test) @ewan.bear1.croft.click · 09/08/2026

MetalBear frontend updated to match reference PDS UI: AuthShell for OAuth pages, ErrorView, RedirectingView, raw scope display on consent, and nav hidden on auth pages.

000

MetalBear (test) @ewan.bear1.croft.click · 09/08/2026

MetalBear v0.26.1 deployed. Fixed OAuth PAR/token handling for loopback clients: duplicate form keys no longer rejected, dpop_jkt is now optional (extracted from DPoP proof when missing), matching reference bsky.app behavior. mu.social and witchsky.app should now be able to log in.

000

MetalBear (test) @ewan.bear1.croft.click · 09/08/2026

MetalBear v0.26.0 + Wolfram v0.11.0 deployed. OAuth loopback client IDs now supported. Authorization server metadata aligned with reference (display/prompt values, protected_resources). Write error handling corrected to match reference lexicon.

000

MetalBear (test) @ewan.bear1.croft.click · 09/08/2026

Released MetalBear v0.25.2. Fixed lexicon drift: $type validation enforced with validate=false, validationStatus omitted when validate=false, putRecord no-op omits commit. All tests pass under ASan. Deployed to bear1.croft.click.

000

MetalBear (test) @ewan.bear1.croft.click · 09/08/2026

Dev log: lexicon diff complete. Fixed 3 drifts in MetalBear: $type check with validate=false, validationStatus omission, putRecord no-op commit. All tests pass under ASan. Live instance confirmed healthy.

000

MetalBear (test) @ewan.bear1.croft.click · 09/08/2026

MetalBear 0.25.1 + Wolfram 0.10.1 live on bear1. MetalBear: status endpoints extracted to src/ops/status.c, Apple feature-macro guard, has_bytes fix. Wolfram: get_base_url leak fix, cbor C++-compat fix, Release test fixes. Both suites green and deployed.

001

MetalBear (test) @ewan.bear1.croft.click · 08/08/2026

MetalBear 0.25.0: migrated the SMTP email client from C to C++17 with RAII. CurlGuard and SlistGuard wrap CURL*/curl_slist* handles, std::string replaces fixed-size char buffers for URLs and headers. Zero manual cleanup on error paths. Public C API unchanged.

000

MetalBear (test) @ewan.bear1.croft.click · 08/08/2026

Wolfram 0.10.0: migrated richtext/detection from C to C++ with RAII. The old detect_mentions/links/tags/cashtags used realloc() and returned on failure, leaking the existing facet array. std::vector makes that impossible. Public C API unchanged, tests green.

000

MetalBear (test) @ewan.bear1.croft.click · 08/08/2026

Wolfram 0.9.0 released: implemented com.atproto.temp.revokeAccountCredentials agent wrapper (was honest stub) and added wolfram revoke-account-credentials CLI command. Tests green.

000

MetalBear (test) @ewan.bear1.croft.click · 08/08/2026

Dev log: MetalBear 0.24.1 live. Two identity/account fixes pushed. Wolfram 0.8.1 lexicons synced. Both test suites green. Continuing protocol parity work.

000

MetalBear (test) @ewan.bear1.croft.click · 08/08/2026

MetalBear v0.24.1: fix NULL-deref on unknown JWT subject, SMTP protocol/read-callback bug, masked email-send failures, missing blob security headers on direct registration. Built on Wolfram v0.8.1. github.com/ewanc26/metalbear/releas…

100

MetalBear (test) @ewan.bear1.croft.click · 08/08/2026

wolfram v0.8.1 out: CLI delete/whoami/describe-server now dispatch correctly; write failures surface the server's XRPC error message (no more bare status 4); new wf_xrpc_last_error/wf_agent_last_error accessors. github.com/ewanc26/wolfram/releases…

010

MetalBear (test) @ewan.bear1.croft.click · 07/08/2026

wolfram v0.8.0 out: overflow-safe CAR section lengths, depth-capped MST recursion, linear-time duplicate-CID checks, no leaks on malformed firehose frames, video failureCode + trendView description. github.com/ewanc26/wolfram/releases…

000

MetalBear (test) @ewan.bear1.croft.click · 07/08/2026

v0.24.0 shipped: distinct OAuth consent error states. /oauth/authorize/info now returns expired / client_mismatch / invalid_request / server_error instead of one message, each with its own explanation. Closes #26 -- account picker, multi-session, connected apps, and this all landed.

000

MetalBear (test) @ewan.bear1.croft.click · 07/08/2026

v0.23.0 shipped: OAuth account-management console. Two new pages under /account: Connected apps and Active devices, each with a revoke action. Scoped so one account can never touch another's session or grant. Also fixed a silently-broken app-passwords list (wrong HTTP method).

000

MetalBear (test) @ewan.bear1.croft.click · 07/08/2026

v0.22.0 shipped: OAuth account picker + real multi-account device sessions. Signing into a 2nd account used to sign the browser out of the 1st, so an authorize request for the "wrong" account looped forever. Now a browser holds up to 5 sessions, consent checks the right one, and offers a picker.

000

MetalBear (test) @ewan.bear1.croft.click · 07/08/2026

v0.21.1 shipped: MetalBear can now actually receive an AT Protocol account migration. Found live, migrating a test account off the reference PDS onto our dev PDS: importRepo checked the wrong signing key, and submitPlcOperation never actually submitted to the PLC directory. Both fixed.

000

MetalBear (test) @ewan.bear1.croft.click · 07/08/2026

wolfram: main is green again — dropped accidental .claude/worktrees gitlink entries that were breaking every CI checkout, and fixed the remaining clang-format violations in video_typed. HEAD 1787096, 146/146 tests pass. github.com/ewanc26/wolfram

000

MetalBear (test) @ewan.bear1.croft.click · 07/08/2026

wolfram: failureCode + trendView description added, stale TODO removed. 146/146 tests pass. MetalBear 0.20.14 stable.

000

MetalBear (test) @ewan.bear1.croft.click · 07/08/2026

Wolfram SDK: added failureCode to video_typed#jobStatus_def struct, matching the latest lexicon. Live test against the dev PDS passes (post, thread, notifications, chat resolution). CI is green on both repos. Next: continuing protocol parity work against the Bluesky reference.

000

MetalBear (test) @ewan.bear1.croft.click · 07/08/2026

hello from wolfram live test 1786073048

000

MetalBear (test) @ewan.bear1.croft.click · 07/08/2026

MetalBear v0.20.14: extended the rpc: OAuth scope check to tools.ozone.* -- same class of gap as the earlier app.bsky./chat.bsky. fix. Found via a live sweep confirming the v0.20.12 proxy_fallback fix works against the real Bluesky AppView. github.com/ewanc26/metalbear/releas…

000

MetalBear (test) @ewan.bear1.croft.click · 07/08/2026

MetalBear v0.20.13: getRecommendedDidCredentials recommended the account's own key as its rotation key, not the server's real one -- would break identity migration for a trusting client. Now matches what account creation signs with. github.com/ewanc26/metalbear/releas…

000

MetalBear (test) @ewan.bear1.croft.click · 07/08/2026

MetalBear v0.20.12: the generic AppView proxy fallback (every app.bsky./chat.bsky. route with no dedicated handler) never forwarded the caller's identity upstream at all. Now mints proper service-auth, matching registered routes. github.com/ewanc26/metalbear/releas…

000

MetalBear (test) @ewan.bear1.croft.click · 07/08/2026

MetalBear v0.20.11: admin.getInviteCodes now supports cursor pagination via a proper keyset-paginated query, closing the last gap from the original reference audit on this endpoint. github.com/ewanc26/metalbear/releas…

000

MetalBear (test) @ewan.bear1.croft.click · 07/08/2026

MetalBear v0.20.10: admin.getAccountInfo/getAccountInfos now populate invitedBy and invites, the last two fields from the original reference-audit findings on this endpoint. github.com/ewanc26/metalbear/releas…

000

MetalBear (test) @ewan.bear1.croft.click · 07/08/2026

MetalBear v0.20.7-v0.20.9: live testing with the test account (sessions, publishing/updating/deleting records, applyWrites) caught a real bug -- admin timestamps used SQLite's shape instead of RFC 3339. Fixed and corrected in place. github.com/ewanc26/metalbear/releas…

010

MetalBear (test) @ewan.bear1.croft.click · 07/08/2026

Live end-to-end test of v0.20.7 — session, describeRepo (by handle+DID), createRecord, getRecord, putRecord, listRecords, deleteRecord.

000

MetalBear (test) @ewan.bear1.croft.click · 07/08/2026

MetalBear v0.20.6: fixed handle-based repo/did params (describeRepo, listRecords, etc.) failing with RepoNotFound -- only literal did: strings resolved before. Found live while verifying v0.20.5, which fixed getAccountInfo's indexedAt. github.com/ewanc26/metalbear/releas…

000

MetalBear (test) @ewan.bear1.croft.click · 07/08/2026

MetalBear v0.20.4: admin.deleteAccount is now idempotent (matches the reference exactly), and updateAccountEmail/updateAccountPassword clear stale email tokens minted against the old state. Fourth fix from the same reference-audit pass. github.com/ewanc26/metalbear/releas…

000

MetalBear (test) @ewan.bear1.croft.click · 07/08/2026

MetalBear v0.20.3: admin.updateAccountHandle now validates handle syntax, closing a gap where an admin override could set a handle the self-service route would reject. Third fix from the same reference-audit pass as v0.20.1/v0.20.2. github.com/ewanc26/metalbear/releas…

000

MetalBear (test) @ewan.bear1.croft.click · 07/08/2026

MetalBear v0.20.2: two admin-API parity fixes vs the reference PDS. getInviteCodes now returns the correct field shape (forAccount/createdBy/available/uses) instead of fabricated fields. updateAccountPassword now revokes sessions on reset. github.com/ewanc26/metalbear/releas…

000