Cards are harvested from this app's BACKLOG/NOTES/TODO/ROADMAP files, handoff tokens, explicitly tagged central backlog lines, and one labelled repo baseline. The live dot, last-activity, and dev/prod drift are computed from disk and the session registry (cached ≤3 min). Central BACKLOG.md sample: Jul 28, 2026 · 3:46:22 PM EDT.
background refresh last succeeded 22s ago · stale after 270s
No cards in this column.
agy-cli Google-family cross-check — root cause found (holt-spine workspace never added to Antigravity/Jetski's trustedWorkspaces) but the fix is NOT yet applied; Quality/Audit has zero effective independent output until this lands · NEXT: apply the fix, re-test real file-reading audit invocations
Sentry face-tuning regression — a 7h re-check found ~21% false-alert rate, worse than the original tuning pass's own sample · NEXT: re-run the full 24h check post-tuning
authify-api missing health route — /, /health, /healthz all 404 though DEPLOYMENT.md specifies /healthz · NEXT: add the route, no Wolf decision needed
Holt-arm model pick — decided 2026-07-28: Fable-as-Holt. Wolf chose Fable over codex for the A/B eval. Wiring the actual harness choice happens in holt-ecosystem-packets/_terminus-eval's own session (/continue terminus), not this board note.
Kimi K3 eval — Moonshot made its open weights publicly available 2026-07-27 (a day ahead of its own schedule, 2.8T params/1.56TB), so the "wait" condition no longer applies. Wolf is deliberately leaving this parked for now rather than acting on it — still an open, unstarted decision on our side.
[sensitive content omitted]
DigitalOcean bounty program — confirmed still blocked, no ETA (Wolf, 2026-07-28) — contract ready whenever the Intigriti + DO account setup happens.
6 further ranked bounty candidates — Wolf confirmed 2026-07-28: leave research-only, no new authorization beyond KAYAK/Kiwi.com/DigitalOcean.
Personal-history ingestion — Pi teacher-curation stages, waits grad rate-limit headroom
Pi-embedder cosine recheck — retrieval smoke test for Holt's RAG bank, waits reason-eval freeing the embedder
Kiwi.com next-stage — Wolf chose deeper recon 2026-07-28: katana extended (+7,719 URLs/434 hosts), gau/waybackurls ran (40k+ historical URLs across both apexes), whatweb fingerprinted all 428 live hosts. New open thread: archive data surfaced several internal-tooling hostnames under the in-scope *.skypicker.com wildcard (jenkins, kibana-test, metabase-internal, grafana-sitespeedio, a few admin* variants) — none visited yet, archive-sourced only. A liveness check on these is the natural next step whenever Wolf wants it — still undecided, no urgency.
Holt CLI multi-turn REPL — [Pi] follow-ups are independent turns today
Holt reason-eval v2 — [Pi] autonomous, pid 1834674 · item ~74/96, $802/$1293 · ETA ~1 day as of 07-22 — likely finished by now, unverified · deliverable feeds sem-3 go/no-go
Holt /curriculum command — [Pi] Holt builds an ENTIRE curriculum from a course subject (course sequence, per-course syllabi, readings, assessments) — generalizes the grad-program machinery (tracks/exams/transcript) to any subject Wolf names (added 07-22)
Holt /class command — [Pi] Holt sets up a Coursera/Udemy-style class for a particular subject: modules/lessons, lectures, quizzes/assignments, progress tracking — the single-class counterpart to /curriculum (added 07-22)
Operational retry policy — provisional 2026-07-30; harvest/adjudication pending, no L-number assigned. One repeat is allowed only after the diagnosis and probe materially change. A repeated identical signature or automatic model fallback closes that lane for the sitting. Record requested model, actual model, refusal/fallback event, and host/tool failure separately; never count fallback as the requested model. When authorized, pivot to a different model family or a tool-free execution architecture. Never weaken sandboxing, use a bypass, or infer success from fallback. Preserve evidence and queue any human decision. Stay subscription-first; never silently switch to paid API, Console billing, or overage.
Overnight live-draft fallback — 2026-07-30. Local report: /Users/wolf/Projects/Holt/overnight/holt-overnight-2026-07-30.md. Pending canonical mirror, not yet written: /Users/wolf/Projects/holt-spine/_handoff/holt-overnight-2026-07-30.md.
2026-07-30: holt-spine physically consolidated into Holt (see _handoff/holt-move.md); Holt is now the canonical working directory; HoltEcosystem/lockify-api deliberately left in place; holt-engage model-routing pin (Sonnet/grok only, never Opus/Fable) reconfirmed and made explicit in the handoff header.
KAYAK: two backlog items approved, queued (not dispatched) — Wolf, 2026-07-30. (1) Probe
**Self-matching-pgrep watcher fuck-up — provisional 2026-07-31; harvest/adjudication pending, no
/continue holt-engage — handoff: holt-engage.md
/continue holt-security — handoff: holt-engage.md
/continue holt-move — handoff: holt-move.md
/continue holt-security — handoff: holt-security.md
/continue holt-engage — handoff: holt-security.md
No cards in this column.
Sentry (Epic B) tuning — WIP — actively iterating: camera tilt 15-20° would raise recognition · more frontal face crops needed · tuning dials open (SENTRY_FACE_GRACE, SENTRY_COOLDOWN, thresholds) · reboot-persistence still not proven end-to-end
Repo baseline — Holt (README.md)
No cards in this column.
2 hires landed, Founder-approved, and both now probed — shipped 2026-07-28: Exploit/PoC Developer (Engineering, Opus 4.8 primary, mandatory honest-framing header) delivered its first real dispatch (KAYAK CORS PoC below) — a confirmed dead end, correctly closed without a submission. Portfolio/Engagement Manager (Operations, Sonnet/Haiku two-tier) has delivered multiple clean dispatches.
KAYAK active-scan phase done, shipped 2026-07-28 — nuclei (652 findings, 650 info/2 low) and naabu (1,162 open host:port pairs, mostly routine 443/80/8443/8080) both ran to completion. The one real candidate — credentialed CORS misconfig on 7 in-scope hosts including p4console/p5console.kayak.com — got a genuine impact-proof attempt: safe-surface-validated first, then tested live, and came back a confirmed dead end (both consoles sit behind Cloudflare Access/Zero Trust, no realistic path to sensitive data). Correctly not submitted — stays confirmed-config/impact-unproven/CIF-ineligible. Two hostnames worth a future look, not urgent: whm.kayak.com, webdisk.kayak.com (WHM/cPanel-style management interfaces).
Thrift-rule violation — done, fixed 2026-07-27. Root cause was dispatch practice (no explicit model override on Agent calls), not staffing data being wrong; fixed, and Model Routing's own review caught + corrected an overclaim in the original fix's reasoning before it was finalized.
Company docs done — committed and promoted 2026-07-28 — all of dev's accumulated work (CHARTER/CONTRACTS/NOTES/staffing/company/programs, plus the handoff lane-split below) committed in one pass, and prod fast-forwarded to match. Nothing outstanding on dev anymore.
Handoff lane-split shipped, done 2026-07-28 — _handoff/holt-security.md (conducting: org/hiring/routing/cost/research, no live-target content) split from the new _handoff/holt-engage.md (target-facing engagement: recon/scan findings/exploit-dev), because the whole project kept getting flagged as a unit even though conducting/research work isn't the flaggable part. Standing practice logged as rule 8 in operating-system.md so future handoffs don't merge back into one file.
Holt education lane: terminus-task practicum — done, ready for real use 2026-07-28. Reframed as Holt's own professional-development track (Wolf's framing), GO given, read-only clearance confirmed for Snorkel/terminus. Research: tooling gap was small (Pi already has Docker; each task is a self-contained image), no existing governance doc (a minimal scope recommendation was drafted, not yet ratified), 17-task security corpus groups into 5 skill areas (crypto protocol misuse, PKI/cert lifecycle, platform-integrity/attestation, access-control modeling, memory-safety parsing). Architecture: runs on the Pi. Both blockers found in validation are now fixed and verified (full detail on the holt-ecosystem-packets board): qemu-user-static/binfmt-support installed so Ruby-based tasks run under emulation, and score.sh's materialize step generalized beyond Go — a real Rust hook plus a Dockerfile-parsed multi-stage-leak cleanup, regression-tested (Go/Python still pass) and proven on two separate Rust tasks (both full PASS via reward.txt, including an anti-cheat check the leak-cleanup exists for). C++/Java hooks deliberately not added — investigated and found not to fit safely, flagged rather than forced. NEXT: no blocker left for the practicum's mechanics — the open items now are governance (ratify the scope recommendation) and actually giving Holt his first real practice task.
No cards in this column.