steve

steve pushed to main at steve/majordomo

2026-08-12 22:58:37 +00:00

85561ab477 chore: ignore .claude/ (agent worktrees)

steve pushed to main at steve/gadfly

2026-08-12 22:57:54 +00:00

8adeeeabe0 fix: drop the accidentally committed worktree gitlink, ignore .claude/worktrees

steve pushed to main at steve/gadfly

2026-08-12 22:57:35 +00:00

88f44cf141 chore(reusable): bump the fallback reviewer pin to sha-b850e35 [skip ci]

steve deleted branch feat/qwen-provider from steve/gadfly

2026-08-12 22:46:06 +00:00

steve pushed to main at steve/gadfly

2026-08-12 22:46:06 +00:00

b850e35b35 Merge pull request 'feat(qwen): let Qwen (and Kimi) join the swarm' (#30)

d8b023efd6 fix(qwen): the own-key fallback made the override path checkable

e67f95d777 fix(qwen): un-exempt opencode, and keep the Qwen key in a secret

3af0f09387 fix(qwen): one credential rule for both paths — seven findings said so

274451e89c fix(ci): actually add grep -e (a3d3a45 claimed it and did not)

Compare 13 commits »

steve merged pull request steve/gadfly#30

2026-08-12 22:46:04 +00:00

feat(qwen): let Qwen (and Kimi) join the swarm

steve pushed to feat/qwen-provider at steve/gadfly

2026-08-12 22:36:14 +00:00

d8b023efd6 fix(qwen): the own-key fallback made the override path checkable

steve commented on pull request steve/gadfly#30

2026-08-12 22:24:33 +00:00

feat(qwen): let Qwen (and Kimi) join the swarm

Round 8: all eight real, fixed in e67f95d. Two of them contradicted each other, which was the interesting part.

ed177217 asked me to extend the engine-spec exemption to a bare opencode;…

steve pushed to feat/qwen-provider at steve/gadfly

2026-08-12 22:23:35 +00:00

e67f95d777 fix(qwen): un-exempt opencode, and keep the Qwen key in a secret

steve commented on pull request steve/gadfly#30

2026-08-12 22:10:55 +00:00

feat(qwen): let Qwen (and Kimi) join the swarm

Round 7: 13 of 14 real, fixed in 3af0f09. Seven of them, from all four models, are the same finding — and it's the worst one in this PR.

**🔒 I fixed the cross-vendor credential leak on…

steve pushed to feat/qwen-provider at steve/gadfly

2026-08-12 22:09:19 +00:00

3af0f09387 fix(qwen): one credential rule for both paths — seven findings said so

steve commented on pull request steve/gadfly#30

2026-08-12 21:53:44 +00:00

feat(qwen): let Qwen (and Kimi) join the swarm

Round 6: all five real, fixed in a3d3a45 + 274451e. Two were security-relevant, and chasing one of them uncovered something no reviewer mentioned.

**The majordomo bump this PR depends on was…

steve pushed to feat/qwen-provider at steve/gadfly

2026-08-12 21:52:58 +00:00

274451e89c fix(ci): actually add grep -e (a3d3a45 claimed it and did not)

steve pushed to feat/qwen-provider at steve/gadfly

2026-08-12 21:51:57 +00:00

a3d3a45e7e fix(qwen): bump majordomo, and stop handing keys to the wrong vendor

steve commented on pull request steve/gadfly#30

2026-08-12 21:41:17 +00:00

feat(qwen): let Qwen (and Kimi) join the swarm

Round 5: all ten real, fixed in 0abcd16. The best findings are again about the previous round's fix — three separate holes in my credential scrub, each of which would have made it useless in…

steve pushed to feat/qwen-provider at steve/gadfly

2026-08-12 21:40:05 +00:00

0abcd16e9e fix(ci): make the credential scrub failure-safe, and stop the lists drifting

steve commented on pull request steve/gadfly#30

2026-08-12 21:29:12 +00:00

feat(qwen): let Qwen (and Kimi) join the swarm

Round 4: all six real, fixed in 14f8533. One of them is the most valuable finding of this PR and both Claude models found it independently.

**🔒 The test job I added leaked a push-capable…

steve pushed to feat/qwen-provider at steve/gadfly

2026-08-12 21:28:16 +00:00

14f8533e38 fix(ci): scrub the registry credential before running repo code

ebfaeba07e docs(qwen): warn that Model Studio keys are endpoint-scoped

Compare 2 commits »

steve commented on pull request steve/gadfly#30

2026-08-12 21:21:02 +00:00

feat(qwen): let Qwen (and Kimi) join the swarm

Round 3: all twelve real, fixed in 67a7361. The two that matter are about the pre-flight I added, not about qwen.

run.sh:197 — the false pass in the other direction. Round 2 caught…

steve pushed to feat/qwen-provider at steve/gadfly

2026-08-12 21:20:47 +00:00

67a73616e1 fix(qwen): gadfly round 3 — stop guarding a duplicate, delete it