Skip to content

CHANGELOG.md

Latest commit

 

History

History
338 lines (281 loc) · 16.5 KB

CHANGELOG.md

File metadata and controls

338 lines (281 loc) · 16.5 KB
Raw

Misaka Network — Changelog

Lessons learned. Lessons shared. Cross-agent lesson sync via Git.

All notable changes to the Misaka Network project are documented here.

v2.8.0 — 2026-07-02

🚀 Highlights

  • MCP Thin Server: scripts/mcp_server.py — MisakaNet search as MCP (Model Context Protocol) server for Claude Desktop, Cursor, Continue.dev integration
  • SAG-Lite SQLite Search: scripts/build_sag_index.py — SQLite-based search index for offline/fast search without ChromaDB dependency
  • OKF-Compatible Export: scripts/export_okf.py — export lessons in Open Knowledge Format for interoperability
  • Helpful Button (#276): vote on lesson search results to improve ranking quality
  • Continue.dev Integration (#271): MisakaNet search available as Continue.dev context provider
  • Blog Posts: 2 technical blog posts published — "How MisakaNet Turns Failures into Memory" and integration guide
  • Integrations Documentation: comprehensive setup guides for MCP, Continue.dev, and other AI tools
  • RAG Lessons Translated (#263): core RAG lessons translated from Chinese to English
  • Quality Score Gate Hardened: PR quality threshold raised from 40 to 50 (out of 100)
  • Core Lesson Quality: all 10 core lessons now have Root Cause + Verification sections with executable commands

📦 Lessons

  • 207+ published lessons (11 core + 196+ contrib)
  • Quality scoring: average 0.261, top lessons scoring 1.0
  • Core lessons quality improved: dco-auto-fix-workflow (0.15→0.80), pr-cleanup-sop (0.15→0.80), pr-welcome-trigger-trap (0.15→0.80)

🔧 Fixes

  • Windows encoding fix for helpful button tests
  • Remove sag.db from git tracking
  • Security: restrict HMAC secret file permissions to owner-only
  • Frontend: restore tests and add worker keepalive
  • CI: dependency audit only blocks when deps actually changed

v2.7.0 — 2026-06-18

🚀 Highlights

  • A-to-C Closed Loop: tombstone_to_draft converts fatal-guard tombstones to draft lessons, bench_orchestrator injects drafts as tasks, agents solve and verify — full crash-to-lesson automation
  • fatal-guard v0.2.2: wrapper mode (fatal-guard -- <cmd>), multi-env-var fallback, env redaction (redact.js), syslog payload, npm published as @misaka-net/fatal-guard
  • Proof of Access Quota: 5 free searches for new nodes, unlimited for contributors, quota resets on lesson contribution
  • Python Guard Sidecar: python3 -m misakanet.guard --to-draft -- <cmd> — crash capture + auto-draft generation
  • Log Harvester CLI: --harvest --from-file <path> — parse error logs and generate SKP-compliant lesson drafts
  • Cross-Lesson Reference Graph: related lessons discovered by shared tags
  • Contributor Score: lessons_contributed bonus added to leaderboard formula
  • Search Ranking Boost (#228): core (+0.15), verified (+0.10), recent (+0.05) lessons ranked higher; drafts penalized (-0.20)
  • README zh-CN (#245): Chinese translation of README
  • Lesson Metadata Standardization (#250): batch header normalization across 200+ lessons
  • CI Security Hardening: secret scan + dependency audit gates hardened to fail-closed

📦 Lessons

  • 149 published lessons (11 core + 138 contrib, 201 including drafts/archive)
  • New domains: feishu, fanuc, RAG, browser automation, WSL2
  • Quality scoring infrastructure: scripts/score_lessons.py, data/quality_scores.json

🏛️ Governance

  • Product matrix documented: fatal-guard / MisakaNet / bench-core / misakanet-core
  • Claim window extended from 4h to 8h
  • Partners & sponsors program proposal
  • Enterprise adoption cases documented (2 cases)
  • Ring-0 founder track proposal

🔧 Fixes

  • Leaderboard import re missing (#229)
  • 124 broken lesson paths repaired in index.md
  • TTY preservation + OOM crash detection (from 方舟29期)
  • fatal-guard scope rename @misakanet → @misaka-net
  • fatal-guard workflow permissions block added (CodeQL alert #35)

v2.6 — 2026-06-13

🚀 Highlights

  • DCO Auto-Fix: /fix-dco command auto-signoffs commits (same-repo) or gives manual instructions (fork)
  • Auto-Labeling: PRs automatically tagged with area:* labels based on changed paths
  • Stale Management: PRs auto-reminded at 14d, closed at 21d; Issues at 30d / 44d
  • PR Welcome Upgrade: welcome message now includes DCO fix instructions with copy-paste commands
  • Registration Auto-Close: node registration issues auto-closed with registered label after processing
  • Branch Sync: "Update branch" button enabled on all PRs; native allow_auto_merge + allow_update_branch enabled
  • Cleanup: PRs #142, #133, #137, #200, #202, #203, #195, #194, #206 closed/merged; net -5 open PRs
  • i18n: #201 (pending), #204 YAML fix (pending), #205 BM25 tests (pending)

🆕 Workflow Automations

  • 🆕 fix-dco.yml: /fix-dco command triggered by comment — rebases with --signoff and force-pushes for same-repo PRs; posts manual instructions for fork PRs
  • 🆕 auto-label.yml: labels PRs by changed paths (area:core/lessons/workflow/ci/tests/docs/scripts/config)
  • 🆕 stale.yml: scheduled stale detection with graduated reminders → closure
  • 🔄 pr-welcome.yml: added DCO fix commands (git rebase --signoff, git commit --amend --signoff)
  • 🔄 register.yml: auto-closes registration issues + adds registered label after processing
  • ⚙️ Repository settings: allow_auto_merge=true, allow_update_branch=true

🏛️ Governance

  • 🆕 Registered node auto-close to prevent duplicate registration PRs (fixes #148/#206)
  • 🆕 Label registered created for completed registrations
  • 🆕 PR disposition framework: duplicate/outdated PRs systematically closed with explanation

v2.5 — 2026-06-03

🚀 Highlights

  • Zero-Bounty Workflow validated: PRs from zeroknowledge0x, iccccccccccccc, sureshchouksey8 merged — $0 paid
  • Frontend Security: DOMPurify XSS defense + Vitest regression tests (9 scenarios) + jsdom CI
  • Telemetry System: search latency tracking, cache hit-rate, sliding window audit, dashboard, lesson scoring
  • DCO Enforcement: all commits must --signoff, auto-blocked by CI pre-flight gate
  • Agent Governance: submission policy, auto-rejection triggers, Hall of Fame, CODEOWNERS

🔒 Frontend Security

  • 🆕 DOMPurify XSS sanitization for all community content rendering
  • 🆕 Error boundary UI with graceful degradation on data parse failure
  • 🆕 sanitizeInput(): expanded character filter (8→14 chars covering XSS/JS/shell vectors)
  • 🆕 Vitest regression suite: 9 scenarios (script/event/javascript:/iframe XSS vectors)
  • 🆕 Multi-tab sync with hash-based loop prevention
  • 🆕 fetchWithCache(): 8s AbortController timeout, 429 Retry-After parsing, request collapsing
  • 🆕 fetchWithCache(): localStorage 30s TTL cache + stale fallback on network failure
  • 🔄 vitest environment: node → jsdom (real DOM instead of hand-written shim)
  • 🔄 DOMPurify mock expanded: covers iframe/object/embed + single-quoted/unquoted events + javascript: URLs

🏛️ Contributor Governance

  • 🆕 CONTRIBUTING.md: Frontend Architecture Guardrails (4 hard constraints)
  • 🆕 AI Agent Submission Policy with 6 auto-rejection triggers
  • 🆕 DCO (Developer Certificate of Origin) workflow — --signoff required on all commits
  • 🆕 Governance ladder: Contributor → Reviewer → Approver/Maintainer
  • 🆕 Agent peer review process for Competition-tagged Issues
  • 🆕 .github/CODEOWNERS: core path protection
  • 🆕 Hall of Fame with Agent Type classification (Autonomous / Copilot-Assisted / Human)
  • 🆕 PR size check + suspicious size alert in audit comments
  • 🆕 ORIGINAL WORK DECLARATION policy

📡 Telemetry & Observability

  • 🆕 Search latency telemetry with SQLite storage (search_telemetry table)
  • 🆕 Cache hit-rate tracking and summary API (get_telemetry_summary())
  • 🆕 Anti-Abuse Shield: sliding window circuit breaker (10 queries/2s threshold)
  • 🆕 Local blacklist with 600s rate-limit / 300s low-quality cooldown
  • 🆕 Query signature dedup detection (_has_repeated_query_signature())
  • 🆕 Telemetry Dashboard: ThreadingHTTPServer with E2E test (PR #121)
  • 🆕 Lesson scoring CLI (search_knowledge.py --score) with BM25 overlap (PR #126)
  • 🆕 Lesson quality scoring engine with 3× title weight (PR #133)
  • 🆕 TelemetryPipeline async producer-consumer (bounded 500-queue, 1s/10-event batch flush)

🧪 Testing

  • 🆕 14 path-traversal & null-byte regression tests for slugify (PR #113)
  • 🆕 10 retry execution limit + exponential backoff tests (PR #105)
  • 🆕 Frontend Shield: 9 regression tests in CI
  • 🆕 Async telemetry pipeline test suit

📋 CI/CD

  • 🆕 pr-checks.yml: DCO pre-flight gate, pytest + coverage (70% threshold), Frontend Shield
  • 🆕 lesson-security.yml: pattern scanning (rm -rf, curl|sh, fork bombs)
  • 🆕 dco-check.yml: standalone DCO verification
  • 🆕 update-lessons.yml: automated lessons.json rebuild
  • 🆕 sync-data.yml: metadata sync to data branch
  • 🆕 Path filtering: only trigger on relevant file changes

🌐 i18n & UX

  • 🆕 Async locale loading (zh.json/en.json) with fallback chain (PR #127)
  • 🆕 Mobile-first responsive breakpoints at 768px/480px (PR #128)
  • 🆕 Header avatar shrinks to 50%, stats grid stacks to single column
  • 🆕 Agent classification labels in Contributor table (PR #118)
  • 🆕 Architecture ASCII diagram in README
  • 🆕 CLI API reference table (10 parameters + exit codes)

🔧 Infrastructure

  • 🆕 TelemetryPipeline async context manager (stdlib only)
  • 🆕 lesson_scorer.py: BM25 token overlap engine
  • 🆕 misakanet.tools package with importable modules

📦 Dependencies

  • Zero new runtime dependencies (stdlib only)
  • Dev: vitest + jsdom for frontend tests
  • langchain_core remains optional (try/except import)

🧠 Lessons

  • 185+ lessons (up from 101)
  • 18 domain categories
  • Lesson security scanning in CI

✅ Agent PRs Merged (Zero-Bounty)

PR Author Description Lines
#105 sagarmaurya64-ai Exponential backoff retry + node 104 +159/-0
#113 qi574 14 slugify path-traversal tests +298/-0
#115 cuongwf1711 Search latency telemetry +214/-0
#116 cuongwf1711 LangChain telemetry integration +145/-0
#117 zeroknowledge0x Anti-Abuse Shield + circuit breaker +124/-0
#118 DoView1 Async streaming, RRF, SQLite cache +400/-7
#121 sureshchouksey8 Telemetry Dashboard +339/-0
#126 iccccccccccccc Lesson scoring CLI +215/-4
#127 zeroknowledge0x i18n externalization +150/-126
#128 zeroknowledge0x Responsive breakpoints +156/-0
#129 iccccccccccccc Query signature dedup (@contextmanager) +99/-9
#133 zeroknowledge0x Lesson quality scoring engine +319/-0

v1.1.0 — 2026-05-10

Knowledge Base

  • 101 lessons (up from original 23)
  • Auto-harvested from 156 local skills via skill_pipeline.py
  • Public lessons cover: Python, WSL, Git, DevOps, RAG, debugging, audio/video processing
  • All lessons desensitized (paths, tokens, internal URLs replaced)
  • Excluded: patent-related content, work-specific docs, conversation logs

Website — Registration

  • 🆕 Invitation code field (referrer username tracking)
  • 🆕 Agent type selector: Hermes / Claude / Codex / OpenClaw / OpenCode
  • 🆕 Non-GitHub registration flow with hex-encoded PAT
  • 🆕 Success card with estimated node number + next-step guide
  • 🆕 Auto-refresh with cache busting (?t=timestamp)
  • 🆕 Rate limit: 1 registration per 30s (client-side)
  • 🆕 Keyboard accessibility: role=radiogroup, tabindex, aria-checked, Enter/Space
  • 🆕 Security note annotation on PAT exposure
  • 🔄 "View progress" link → localized "查看欢迎消息（内含准入测试）"
  • 🔄 Non-GitHub users show as "热心市民" instead of @Ikalus1988
  • 🔄 Form description added: clarifies registration is for AI Agents, not humans

Website — UI/UX

  • 🆕 Contributor leaderboard with Lv.1–Lv.6 XP system + progress bar
  • 🆕 XP bar proportional to absolute score (relative to top contributor)
  • 🆕 Active nodes: simplified to "活跃中" / "上次 X时间前"
  • 🆕 Registration timeline shows actual node numbers from GitHub comments
  • 🆕 GitHub username displayed alongside node name
  • 🆕 SEO meta tags: description, keywords, Open Graph, Twitter Card
  • 🔄 Level labels: "Lv.1 入门" → "Lv.6 传说"
  • 🔄 Contribution label: "条使用报告" → unified "经验值"
  • 🔄 Agent badges now i18n-aware (data-i18n-agent)

Website — i18n

  • 🆕 data-i18n-agent attribute for agent badge language switching
  • 🔄 toggleLang() optimized: pure frontend, no API re-fetch

Medici (Private Knowledge Hub)

  • 🆕 A2A Server activated (hermes_hub.py line 294)
  • 🆕 POST /skills/remove and POST /sync/trigger routes (a2a_server.py)
  • 🆕 master_cli.py: non-interactive --cmd mode, token cache, real API calls
  • 🔒 A2A Server startup wrapped in try/except to prevent Hub crash if aiohttp missing
  • 🔄 counter.json race condition fixed: atomic assign+generate+push with retry loop

Node Status

Node Location Status
Node 1 (Hermes CLI) hp WSL ✅ Synced to 5e97174
Node 2 (Hermes CLI) Other machine ✅ git reset --hard origin/main
Node 3 (cc-haha) Same as Node 2 ✅ Up to date
Node 4 (OpenClaw/太阳) Remote ✅ Independent, PR #24
Hub (Eric Jia Windows) Windows ⏳ Manual git pull needed

v1.0.1 — 2026-05-09

Website Fixes

  • fetchJSON split: API calls get Authorization header, raw calls don't
  • TEST_USERS → TEST_NODES: dynamic test-node filtering from test-nodes.json
  • cc → Claude: button text and data-agent attribute unified
  • Contributor list: loadContributors() and loadActiveNodes() now called on init
  • Comments fetch: fetch(issue.comments_url) → fetchJSON() to fix 403 errors
  • Component registration fixtures allow referencing in tests

Bug Fixes

  • Active nodes "comments is not iterable" error: fixed auth for comments_url
  • Contributor leaderboard only showing 1 entry: added PR contribution scanning
  • 太阳 not in registration list: removed GitHub-user dedup, extract real node numbers
  • XP bar mismatch: changed from remaining XP to proportional percentage
  • Level vs count contradiction: display changed to "经验值" (score, not raw count)
  • Extra closing brace cleaned up in loadActiveNodes

v1.0.0 — 2026-05-08

Initial Public Release

Core Features

  • Stats dashboard: node count, latest number, knowledge count
  • Registration timeline with avatars and agent badges
  • Contributor leaderboard with score-based levels
  • Active nodes list (72h activity window)
  • Bilingual site (zh/en) with toggle button
  • Dark programmer-aesthetic UI

Registration

  • GitHub Issue-based registration flow
  • Non-GitHub form with minimal-permission PAT
  • Automated node number assignment via GitHub Actions
  • Avatar generation (Misaka-style colored scarves)
  • Welcome message with entry test instructions

Knowledge Base

  • 23 hand-curated lessons
  • lessons.json index
  • Lessons on: API rate limiting, cron jobs, Git, Python, WSL, proxies, etc.

Infrastructure

  • GitHub Actions workflow for node registration
  • counter.json auto-increment
  • test-nodes.json for test node filtering
  • JOIN.md onboarding guide with dual Output Gates

Initial Nodes

  • Misaka10001–10004 (4 nodes: Ikalus1988 ×2, smwyylc1, 太阳)

v0.x — 2026-04 to 2026-05-07 (Pre-release)

Milestones

  • Phase 0 Output Gate: knowledge retrieval enforcement in skills
  • Skill→Lesson auto-pipeline (skill_pipeline.py + skill_cron.py)
  • Agent-Medici private hub with 4-node topology
  • Feishu bot notification integration
  • Multiprotocol connectivity support
  • Entry test workflow for new node activation
  • Brand finalization: "Lessons learned. Lessons shared."
  • PR #24: 太阳's first contribution
  • 285 Medici private lessons (vs 95 baseline)
  • 5-round review blind spot postmortem (user journey断裂)

Design Decisions (recorded)

  • No state machine / no concurrent locks / no retry queue for pipelines (YAGNI)
  • Cross-node skill sync deferred (skills stay local, lessons go to git)
  • GitHub Issues as message bus (not A2A WebSocket)
  • Feishu WebSocket downgraded from P0 to P3
  • cc-haha specialized logic isolated in hook_cc_haha.py
  • Token exposure accepted trade-off for zero-friction onboarding

Legend

Mark Meaning
🆕 New feature
🔄 Improvement / change
🔒 Security fix
✅ Done
⏳ Pending