Short day — cleaned up three processing-engine correctness bugs that had been sitting in the tech-debt queue (#1019, #1023, #969) and centralized the duplicate MAX_FITS_FILE_SIZE_BYTES constant that was defined in three places.
Three small security-adjacent bug fixes — the FITS validator was loading the whole file before checking the size, the JWT middleware was swallowing validation failures silently, and a region endpoint was using assert for user input validation. Plus TypeScript 6 and a pile of feature ideas from the MAST Users Group winter report.
Part 2 of the exception infrastructure split — MAST exception subtypes landed — plus a small README update that actually matters for people finding the architecture docs.
Heavy security-infrastructure day — added the .NET exception hierarchy with centralized error middleware, security headers middleware on the gateway, gitleaks secret scanning in pre-commit and CI, plus the Claude Code GitHub workflow, a narrowed exception swallow in FITS save, and a full dependabot drop.
Split the hardcoded job timeout into configurable per-stage timers, added per-stack path filtering to skip unrelated CI jobs, and — because a friend in the channel kept needling about TDD — tried having Claude write the tests first for one of the fixes. It worked well enough to be a little annoying.
First of the month — ran the monthly git history audit and cleared the overnight dependabot drop (vitest coverage, jsdom, rolldown binding, react-router-dom).