punk6529 PRs, June 15-17 2026

Scope: 6529-Collections/6529seize-frontend, PRs authored by punk6529, created at or after 2026-06-15T05:04:07Z UTC through the June 17 report snapshot.

Method: GitHub CLI lookup for all punk6529-authored PRs created after the previous report commit time, with exact timestamp filtering and a follow-up state refresh before publication.

Rollup: 35 PRs total. 31 are merged, 4 are open, and none are closed without merge. The raw summed diff at collection time was +39,543 / -2,009 across 452 changed-file entries, but this overstates unique change size because several PRs are stacked or follow-up fixes.

1. Reviewbot dashboards and review configuration

PRs: #2652, #2710. Both merged.

#2652 updated the public and admin reviewbot dashboards for richer spend analysis: unique PR counts, average spend per run and PR, top-cost rollups, PR-author groupings, and enriched PR rows. #2710 enabled the new responsiveness 6529bot review kind as a third automatic initial review alongside general and security.

2. Link previews, OpenGraph, and first-party collection cards

PRs: #2653, #2667, #2674, #2685, #2689, #2690, #2693, #2695, #2703. All merged.

This stack made previews more native to 6529 and GitHub. #2653 added compact GitHub link cards, and #2703 expanded them with richer PR, issue, repo, file, directory, commit, label, checks, and diff metadata. #2667 improved first-party 6529 OpenGraph cards, while #2674 and #2685 added and polished collection preview cards for The Memes, Meme Lab, Gradient, NextGen, and ReMemes.

The later preview fixes hardened staging and production reliability. #2689, #2690, #2693, and #2695 improved edition-size enrichment and public API fallbacks.

3. Wave REP, score discovery, and wave composer UX

PRs: #2668, #2684, #2691, #2698, #2699, #2704, #2705. All merged.

#2668 was the large Wave REP and scored discovery UI slice, adding wave-level REP actions, score-aware fetching, hotness, quality, REP indicators, and discovery controls against the backend contract. #2684 fixed anonymous scored discovery. #2691 compacted score signals in dense sidebars, and #2699 moved the transparency surface into Network. #2704 and #2705 fixed score tooltip layering. #2698 improved wave editor image paste handling, including screenshot uploads and data-image blocking before submit.

4. Delegation content, IPFS publishing, and delegation UI

PRs: #2678, #2679, #2702, #2706, #2709, #2712. All merged.

#2678 moved delegation help content into a reviewed repo content package with manifest delivery, verified runtime loading, and IPFS as canonical storage. #2679 clarified delegation UI states, labels, navigation, and wallet guidance. #2702 fixed staging E2E issues around local preview assets and article image alt text. #2706 added the controlled IPFS publish pipeline, #2709 pointed the manifest at the published CID, and #2712 fixed publish-script lint.

5. Profile-native CMS workstream

PRs: #2681, #2707, #2711. Mixed state: #2707 merged; #2681 and #2711 open.

#2707 added the durable roadmap package for profile-native CMS: product plan, technical roadmap, execution phases, display research, decision records, test matrix, and PR-wave plan. #2681 is the open vertical slice with package contracts, canonical hashing, public rendering, wallet galleries, NFT references, provenance, and profile route integration. #2711 is the open protocol validator with Zod schemas, canonical JSON, SHA-256 helpers, semantic validation, fixtures, and Jest coverage.

6. Build, deploy, and operations hygiene

PRs: #2655, #2663, #2677, #2680, #2694, #2713. Mixed state: #2655, #2663, #2694, and #2713 merged; #2677 and #2680 open.

#2655 refactored the ESLint config builder. #2663 hardened staging deploy checkout cleanup. #2677 is an open Sass import-resolution fix for Windows/Turbopack. #2680 is an open GitHub Actions runtime update. #2694 fixed a query-param index access build break. #2713 added the deployment operations skill that consolidates merge, staging, and production guidance.

7. Group and app correctness fixes

PRs: #2683, #2696. Both merged.

#2683 narrowed group bulk-rating matters to identity REP/NIC after the API enum expanded with Wave REP. #2696 fixed the group edit submit label and success toast so edit mode says Save / Group saved. instead of create-mode copy.

Complete PR checklist

• #2652 MERGED: Surface reviewbot usage analysis.
• #2653 MERGED: Add GitHub link preview cards.
• #2655 MERGED: Refactor ESLint config builder.
• #2663 MERGED: Harden staging deploy checkout.
• #2667 MERGED: Improve 6529 OpenGraph previews.
• #2668 MERGED: Add Wave REP and scored wave discovery UI.
• #2674 MERGED: Add 6529 collection link previews.
• #2677 OPEN: Fix Bootstrap Sass import resolution.
• #2678 MERGED: Add delegation content package and IPFS loader.
• #2679 MERGED: Improve delegation UI clarity and wallet states.
• #2680 OPEN: Update frontend GitHub Actions runtimes.
• #2681 OPEN: Add profile-native CMS vertical slice.
• #2683 MERGED: Narrow group rating matters.
• #2684 MERGED: Fix anonymous scored wave discovery.
• #2685 MERGED: Polish 6529 collection preview cards.
• #2689 MERGED: Fix The Memes preview edition size.
• #2690 MERGED: Fix The Memes edition size fallback.
• #2691 MERGED: Compact wave score signals in sidebars.
• #2693 MERGED: Fallback 6529 previews to public API.
• #2694 MERGED: Fix user tab query index access.
• #2695 MERGED: Fallback anonymous staging previews to public API.
• #2696 MERGED: Fix group edit submit label.
• #2698 MERGED: Fix wave screenshot paste uploads.
• #2699 MERGED: Improve wave score network UX.
• #2702 MERGED: Fix delegation staging E2E issues.
• #2703 MERGED: Add rich GitHub preview cards.
• #2704 MERGED: Fix wave score tooltip layering.
• #2705 MERGED: Fix wave score tooltip hover layer.
• #2706 MERGED: Add delegation docs IPFS publish pipeline.
• #2707 MERGED: Add profile native CMS roadmap.
• #2709 MERGED: Point delegation docs at published IPFS CID.
• #2710 MERGED: Enable responsiveness 6529bot review.
• #2711 OPEN: Add profile CMS protocol validator.
• #2712 MERGED: Fix delegation docs publish lint.
• #2713 MERGED: Add deployment operations skill.

Scope: 6529-Collections/6529seize-backend, PRs authored by punk6529, created at or after 2026-06-15T05:04:07Z UTC through the June 17 report snapshot.

Method: GitHub CLI lookup for all punk6529-authored PRs created after the previous report commit time, with exact timestamp filtering and a follow-up state refresh before publication.

Rollup: 7 PRs total. 5 are merged, 2 are open, and none are closed without merge. The raw summed diff at collection time was +9,188 / -1,446 across 100 changed-file entries.

1. Wave scoring, creator metadata, and score refresh deployment

PRs: #1632, #1633, #1639. All merged.

#1632 adds required creator profile data to ApiWaveOverview, including visible parent waves, so frontend wave scoring can read creator level and TDH-derived profile context directly from v2 overview responses. #1633 is the major Wave REP and Wave Score backend build: a new Wave REP rating matter, wave-level score fields, score-aware v2 discovery filtering/sorting, refresh hooks after drop/rating/subscription/deletion/TDH events, and a waveScoreRefreshLoop deployable. #1639 fixes the Wave Score loop staging deploy by adding an explicit CloudWatch log group dependency.

2. V2 wave read contract hardening

PR: #1636. Merged.

#1636 tightens /v2/waves/{id}/drops so it is explicitly the V2 wave timeline feed, then adds GET /v2/drops/{id}/replies as the dedicated reply-thread route. It validates shared feed query params, rejects unsupported legacy filters on the timeline route, preserves the documented max limit of 200, regenerates OpenAPI route artifacts, and adds handler/service tests.

3. Profile-native CMS persistence APIs

PR: #1638. Open.

#1638 adds backend persistence and API support for profile-native CMS packages. It introduces cms_sites and cms_published_packages, CMS table constants, entity registration, CMS DB/service/routes, public read endpoints, authenticated site/publish endpoints, generated OpenAPI models, and focused service tests. The DB stores mutable discovery pointers and immutable package records while the package envelope carries deterministic JSON, payload hash, storage receipts, signature envelope, canonical URL/static path, and owner/publisher metadata.

4. GitHub Actions and deploy workflow maintenance

PRs: #1637, #1644. Mixed state: #1637 open draft; #1644 merged.

#1637 updates backend GitHub Actions toward Node 24-ready action runtimes, replaces old actions/github-script@v3 deploy precondition checks with Bash failure steps, updates checkout/setup-node action majors, pins AWS credentials action usage, and regenerates deploy workflow output. #1644 adds the backend deploy-6529 repo-local skill and points backend PR guidance at it for merge/deploy execution.

Complete PR checklist

• #1632 MERGED: Add creator to v2 wave overviews.
• #1633 MERGED: Add Wave REP and Wave Score backend.
• #1636 MERGED: Harden v2 wave feed contracts.
• #1637 OPEN DRAFT: Update GitHub Actions runtimes.
• #1638 OPEN: Add profile CMS persistence API.
• #1639 MERGED: Fix wave score refresh log group deployment.
• #1644 MERGED: Add backend deployment operations skill.

Scope: 6529-Collections/6529Stream, PRs authored by punk6529, created at or after 2026-06-15T05:04:07Z UTC through the June 17 report snapshot.

Method: GitHub CLI lookup for all punk6529-authored PRs created after the previous report commit time, with exact timestamp filtering and state refresh before publication.

Rollup: 70 PRs total. 70 are merged, none are open, and none are closed without merge. The raw summed diff at collection time was +88,151 / -7,960 across 1,888 changed-file entries. As with the prior report, that overstates unique change because many PRs regenerate release manifests, checksums, bytecode proofs, risk registers, docs indexes, and autonomous run state after each focused gate lands.

1. Release proof, audit package, and risk baseline

PRs: #383, #385, #387, #389. All merged.

This first block tightens the release trust boundary. It adds a signed release tag gate, deterministic bytecode release proof, an audit package refresh around current protocol state, and a generated risk register so external audit, production signatures, live bytecode verification, marketplace/indexer readiness, and other residual risks remain machine-tracked.

2. Integration docs, app surfaces, and TypeScript handoff

PRs: #391, #393, #395, #397, #399, #401, #403, #405, #407, #409, #487, #489, #491, #493, #495, #497. All merged.

This is the main consumer-integration push. The June 15 run builds checked docs for fixed-price drops, auctions, wallet signatures, event/indexer reconstruction, metadata rendering, React/Next architecture, mobile WalletConnect, Electron security, and operator admin UI. The June 17 follow-up adds curator reward and withdrawal/credit flows, TypeScript snippets for artifact chain config, EIP-712 payloads and event decoding, plus integration conformance fixtures.

3. Metadata, provenance, marketplace readiness, and bytecode headroom

PRs: #411, #413, #415, #417, #419, #421, #425, #427, #431, #433, #435, #479. All merged.

This set works around a tight StreamCore by moving outward rather than stuffing more into the core contract. It adds a contract-level metadata adapter, a 1/1 provenance manifest model, bytecode-headroom recovery work, royalty policy boundaries, permanence artifacts, marketplace/indexer evidence modeling, satellite extension policy, and a checked policy gate for future core bytecode spend.

4. Protocol surface, warnings, adversarial tests, gas, and NatSpec

PRs: #429, #437, #439, #441, #443, #445, #447, #449, #451, #453, #455, #457, #459, #483. All merged.

This group increases how much the repo can prove about itself. It adds warning disposition baselines, generated protocol surface reporting, event read models, event reconstructability tests, Safe ERC-1271 fork smoke tests, MEV timing adversarial tests, gas envelope gates, custom error negative tests and catalog, randomizer adversarial tests, metadata cross-invariant tests, NatSpec coverage, compatibility version views, and live solc warning baseline enforcement.

5. Release artifacts, production evidence, and live ceremony gates

PRs: #461, #463, #465, #467, #469, #471, #474, #475, #476, #477, #519. All merged.

This sequence continues the release-evidence operating system: third-party artifact verification, deterministic release notes, dependency provenance attestation, release-mode evidence, production broadcast retention, production verified-addresses, live metadata browser evidence, post-audit remediation, live ceremony evidence, live randomizer operations evidence, and a release-candidate lockfile that ties the release manifest, bytecode proof, public-beta evidence, risk register, release notes, blockers, issue outputs, signatures, and non-release status into one checksum-covered artifact.

6. Open-source contributor surface and GitHub governance

PRs: #485, #499, #501, #503, #505, #521. All merged.

This block turns the repo into a more usable open-source front door: checked README maturity navigation, first-30-minutes contributor guide, issue templates, PR-template release impact checks, Markdown link gates, and an external audit finding workflow for severity/status triage, remediation PRs, retest, accepted-risk decisions, closure gates, evidence handoff, and redaction.

7. Monitoring, operator dashboards, and retained incident drills

PRs: #481, #507, #509, #511, #513, #515, #517. All merged.

The last theme makes operational failure modes explicit and reviewable. It adds incident drill evidence, protocol monitoring specs, operator dashboard query models, and retained evidence gates for signer compromise, stuck auctions, failed/stale randomness, and bad metadata/dependency drills.

Complete PR checklist

• #383 MERGED: Add signed release tag gate.
• #385 MERGED: Add bytecode release proof.
• #387 MERGED: Refresh audit package around current protocol state.
• #389 MERGED: Add release risk register.
• #391 MERGED: Add integrations entrypoint.
• #393 MERGED: Add fixed-price drop flow spec.
• #395 MERGED: Add auction integration flow spec.
• #397 MERGED: Add wallet signature integration guide.
• #399 MERGED: Add event and indexer reconstruction spec.
• #401 MERGED: Add metadata rendering integration guide.
• #403 MERGED: Add React/Next frontend reference architecture.
• #405 MERGED: Add mobile and WalletConnect integration guide.
• #407 MERGED: Add Electron security and wallet integration guide.
• #409 MERGED: Add operator admin UI specification.
• #411 MERGED: Add contract-level metadata adapter.
• #413 MERGED: Add 1/1 provenance manifest model.
• #415 MERGED: Recover StreamCore bytecode headroom.
• #417 MERGED: Add royalty policy boundary gate.
• #419 MERGED: Add collector-verifiable permanence package.
• #421 MERGED: Recover StreamCore bytecode headroom.
• #425 MERGED: Add marketplace indexer evidence model.
• #427 MERGED: Add satellite extension architecture policy.
• #429 MERGED: Add warning disposition baseline.
• #431 MERGED: Recover StreamCore script assembly headroom.
• #433 MERGED: Recover StreamCore metadata validation headroom.
• #435 MERGED: Recover StreamCore tokenURI dispatch headroom.
• #437 MERGED: Add generated protocol surface report.
• #439 MERGED: Add StreamMinter event read model.
• #441 MERGED: Add event reconstructability tests.
• #443 MERGED: Add Safe ERC1271 fork smoke tests.
• #445 MERGED: Add MEV timing adversarial tests.
• #447 MERGED: Add gas envelope release gates.
• #449 MERGED: Add custom error negative tests.
• #451 MERGED: Add randomizer adversarial tests.
• #453 MERGED: Add metadata cross-invariant tests.
• #455 MERGED: Add custom error catalog.
• #457 MERGED: Add NatSpec coverage gate.
• #459 MERGED: Add stream compatibility version views.
• #461 MERGED: Add third-party release artifact verifier.
• #463 MERGED: Add deterministic release notes generator.
• #465 MERGED: Add dependency provenance attestation.
• #467 MERGED: Add release-mode evidence gate.
• #469 MERGED: Add production broadcast retention checker.
• #471 MERGED: Add production verified-addresses checker.
• #474 MERGED: Add live metadata browser evidence gate.
• #475 MERGED: Add post-audit remediation evidence checker.
• #476 MERGED: Add live ceremony evidence checker.
• #477 MERGED: Add live randomizer operations evidence checker.
• #479 MERGED: Add StreamCore bytecode spend policy gate.
• #481 MERGED: Add incident drill evidence gate.
• #483 MERGED: Enforce live solc warning baseline.
• #485 MERGED: Add checked README maturity navigation.
• #487 MERGED: Add curator rewards integration flow.
• #489 MERGED: Add withdrawals and credits integration flow.
• #491 MERGED: Add TypeScript artifact chain config snippets.
• #493 MERGED: Add TypeScript EIP-712 payload snippets.
• #495 MERGED: Add TypeScript event decoding snippets.
• #497 MERGED: Add integration conformance fixtures.
• #499 MERGED: Add first 30 minutes contributor guide.
• #501 MERGED: Add checked issue templates.
• #503 MERGED: Add checked PR template release impact gate.
• #505 MERGED: Add checked Markdown link gate.
• #507 MERGED: Add protocol monitoring specification.
• #509 MERGED: Add operator dashboard query model.
• #511 MERGED: Add signer compromise drill retained evidence.
• #513 MERGED: Add stuck auction drill evidence gate.
• #515 MERGED: Add failed randomness drill evidence gate.
• #517 MERGED: Add bad metadata dependency drill evidence.
• #519 MERGED: Add release-candidate lockfile.
• #521 MERGED: Add audit finding workflow.

Scope: 6529-Collections/6529-safe-app, PRs authored by punk6529, created at or after 2026-06-15T05:04:07Z UTC through the June 17 report snapshot.

Method: GitHub CLI lookup for all punk6529-authored PRs created after the previous report commit time, with exact timestamp filtering and state refresh before publication.

Rollup: 62 PRs total. 62 are merged, none are open, and none are closed without merge. The raw summed diff at collection time was +32,484 / -11,516 across 649 changed-file entries.

1. Transfer, delegation, ENS, and Safe write-flow modularization

PRs: #197, #198, #199, #200, #201, #203, #219, #224, #234, #235, #238, #247, #248, #249, #250, #251, #252, #253. All merged.

This is the core write-safety refactor train. The first June 15 run extracts transfer review, asset, queue, destination, and policy preflight helpers while preserving mandatory pre-submit semantics, fail-closed behavior, review-lock drift checks, Safe proposal submission ownership, and visible fact ordering. The later run pushes the same modularity across the safety kernel: typed action schema closure, proposal review fingerprints, evidence archives, Safe Transaction Service response handling, transfer/ENS/delegation helper steps, runtime Safe posture helpers, controllers, and budget-exception cleanup.

2. Release, Safe-listing, manifest, and artifact gates

PRs: #208, #220, #221, #222, #232, #236, #261. All merged.

This group turns release evidence into enforceable gates: Safe-listing manifest evidence packets, promotion records, release preflight, artifact workflow ordering, repository/security evidence fields, public demo fixture validation, self-contained release bundles, checksums, path-escape guards, and Safe App/PWA manifest validation for canonical hashes and icon geometry.

3. Supply chain, GitHub Actions, Scorecard, and dependency hardening

PRs: #210, #211, #214, #215, #216, #223, #229, #231, #254, #255, #256, #257, #258, #259. All merged.

This is the supply-chain and workflow integrity layer: Babel advisory remediation, immutable workflow action pins, structured action-pin manifests, dependency-family updates, formatting gates, private-repo Scorecard permissions, peeled commit pins, private repo read scopes, SARIF availability handling, and a split SARIF upload job so Scorecard, CodeQL, and CI can return green evidence while still recording degraded-security blockers when code scanning is unavailable.

4. Accessibility, localization, product surface, and reviewer UX

PRs: #202, #204, #205, #226, #237, #239, #243, #244, #245, #246. All merged.

This group moves user-facing quality from policy into implementation: first-language contracts, aria-describedby form hints, localized unknown-error fallbacks, field-error semantics, transfer field mapping, locale-neutral signed payload handling, app-shell skip links, read-only Activity outside Safe, and smaller AppShell, Activity, TxReviewCard, and txReview helper sections.

5. Public docs, community gates, PR process, and operational state

PRs: #207, #209, #213, #218, #225, #227, #228, #230, #233, #240, #242, #260. All merged.

This is the operating-memory and public-project readiness layer. It publishes the validated local backlog, expands public docs and community-health gates, hardens the PR template around bounded scope/safety/WCAG/i18n/validation/evidence, and keeps roadmap/workstream state synchronized after merge trains.

6. Runtime config and endpoint policy

PR: #241. Merged.

#241 hardens runtime endpoint override parsing so malformed 6529 API and Safe Transaction Service overrides fail closed to defaults. Optional mainnet RPC overrides become unconfigured when malformed, while localhost support remains available for local development. Release environment validation rejects non-HTTPS endpoint overrides and credential/query/hash-bearing base URLs for release candidates.

Complete PR checklist

• #197 MERGED: Extract transfer review helpers.
• #198 MERGED: Extract transfer asset preflight helpers.
• #199 MERGED: Extract transfer queue preflight helpers.
• #200 MERGED: Extract transfer destination preflight helpers.
• #201 MERGED: Extract transfer policy preflight helpers.
• #202 MERGED: Add i18n first-language contract.
• #203 MERGED: Add transfer proposal status lookup.
• #204 MERGED: Associate shared form control hints.
• #205 MERGED: Localize unknown error fallbacks.
• #207 MERGED: Deliver world-class safety and OSS readiness backlog.
• #208 MERGED: Add Safe listing release manifest gates.
• #209 MERGED: Reconcile roadmap publication state.
• #210 MERGED: Remediate Babel Dependabot alert.
• #211 MERGED: Pin GitHub Actions workflow refs.
• #213 MERGED: Stabilize active delivery context.
• #214 MERGED: Prepare major dependency upgrades.
• #215 MERGED: Update safe production dependency patches.
• #216 MERGED: Update safe dev tooling patches.
• #218 MERGED: Reconcile dependency sweep ops state.
• #219 MERGED: Harden action schema runtime closure.
• #220 MERGED: Harden release evidence promotion gates.
• #221 MERGED: Harden release artifact preflight gate.
• #222 MERGED: Require release security evidence fields.
• #223 MERGED: Add workflow action pin manifest.
• #224 MERGED: Require proposal review fingerprints.
• #225 MERGED: Reconcile proposal status product docs.
• #226 MERGED: Harden accessibility and i18n UI details.
• #227 MERGED: Expand public docs community gates.
• #228 MERGED: Harden pull request evidence template.
• #229 MERGED: Make formatting check pass in PR gate.
• #230 MERGED: Record post-merge status cleanup.
• #231 MERGED: Update typescript-eslint patch family.
• #232 MERGED: Harden public demo fixture gate.
• #233 MERGED: Reconcile post-232 ops state.
• #234 MERGED: Round-trip proposal evidence archives.
• #235 MERGED: Add Activity archive proposal status refresh.
• #236 MERGED: Make release bundles self-contained.
• #237 MERGED: Add app shell skip link.
• #238 MERGED: Fail closed on malformed Safe proposal responses.
• #239 MERGED: Allow read-only Activity outside Safe.
• #240 MERGED: Reconcile post-239 delivery state.
• #241 MERGED: Harden runtime endpoint override policy.
• #242 MERGED: Reconcile post-241 delivery state.
• #243 MERGED: Extract AppShell sections.
• #244 MERGED: Extract Activity read baseline helpers.
• #245 MERGED: Extract TxReviewCard sections.
• #246 MERGED: Extract txReview bundle helpers.
• #247 MERGED: Extract transfer preflight helper steps.
• #248 MERGED: Extract ENS preflight helper steps.
• #249 MERGED: Extract delegation preflight helper steps.
• #250 MERGED: Extract runtime Safe posture helpers.
• #251 MERGED: Extract transfer builder controller.
• #252 MERGED: Extract ENS screen controller.
• #253 MERGED: Extract delegation workbench controller.
• #254 MERGED: Fix private Scorecard permissions.
• #255 MERGED: Fix Scorecard action commit pin.
• #256 MERGED: Peel workflow action pins to commit SHAs.
• #257 MERGED: Fix Scorecard private repo read scopes.
• #258 MERGED: Gate Scorecard SARIF on code scanning availability.
• #259 MERGED: Split Scorecard SARIF upload job.
• #260 MERGED: Reconcile post-Scorecard delivery state.
• #261 MERGED: Add manifest validation gate.

Scope: 6529-Collections/6529reviewbot, PRs authored by punk6529, created at or after 2026-06-15T05:04:07Z UTC through the June 17 report snapshot.

Method: GitHub CLI lookup for all punk6529-authored PRs created after the previous report commit time, with exact timestamp filtering and state refresh before publication.

Rollup: 22 PRs total. All are merged. The raw summed diff at collection time was +6,402 / -489 across 179 changed-file entries.

1. Production dogfood, command hydration, usage, and webhook durability

PRs: #354-#358, #360-#361. All merged.

This phase continued live production hardening. It capped GitHub App JWT TTL at GitHub's 600-second maximum, made /6529bot command events hydrate current PR context before admission and dispatch, persisted requestor metadata, exposed richer per-PR cost metrics, added usage-summary analysis fields, created the durable webhook inbox, preserved retry-drained event shape, raised production review context defaults for larger PRs, added prompt boundaries for partial context, cached usage API reads, exposed webhook inbox visibility through the admin API, and fixed production-shaped preflight reporting for the App Runner dispatcher.

2. Governance and review admission controls

PRs: #362, #363. Both merged.

#362 expanded CODEOWNERS to the active 6529 maintainer set and aligned repository protection docs and contract checks. #363 added configurable draft PR review modes, intersects central and repo draft policies, and allows explicit trusted command reviews during the dogfood rollout without letting repo config loosen central policy.

3. Larger PR review capacity and diff hydration

PRs: #365, #366, #367. All merged.

This phase made the bot more useful on real large frontend PRs while keeping bounded safety rules. It raised the changed-line review limit to 30,000, added display-safe dispatch/run-name metadata, removed the agent-prompt section from clean review comments, added a local git diff fallback for GitHub API diff hydration failures, and raised the large PR changed-file cap from 160 to 300 after production validation showed a 204-file frontend PR could hydrate but still skip under the old cap.

4. Manual responsiveness benchmark to first-class review kind

PRs: #368-#377. All merged.

This was the main new feature arc. #368 added a manual frontend responsiveness benchmark lane with a Playwright harness, route inference, desktop/mobile/native/Electron contexts, and a manual GitHub Actions workflow. #369-#375 hardened that harness with pnpm setup, artifact naming, hidden output uploads, retrying page settle and metrics collection, shallow-checkout diff fallback, shorter timeouts, route prewarming, Linux Turbopack defaults, native shim checks, and self-hosted runner docs. #376 promoted responsiveness into a first-class 6529bot review kind, and #377 asserted responsiveness jobs use the GitHub budget lane.

Complete PR checklist

• #354 MERGED: Cap GitHub App JWT TTL.
• #355 MERGED: Hydrate command reviews and expose PR costs.
• #356 MERGED: Add usage summary analysis rollups.
• #357 MERGED: Add durable webhook inbox retries.
• #358 MERGED: Preserve webhook inbox event shape.
• #360 MERGED: Improve large PR reviews and admin ops visibility.
• #361 MERGED: Fix dispatch worker preflight provider key reporting.
• #362 MERGED: Add maintainer CODEOWNERS for protected PR reviews.
• #363 MERGED: Add configurable draft PR review modes.
• #365 MERGED: Raise changed-line review limit to 30000.
• #366 MERGED: Harden review job diff hydration.
• #367 MERGED: Raise large PR file cap.
• #368 MERGED: Add manual responsiveness runner.
• #369 MERGED: Fix responsiveness workflow pnpm setup.
• #370 MERGED: Harden responsiveness benchmark harness.
• #371 MERGED: Stabilize responsiveness navigation checks.
• #372 MERGED: Prewarm responsiveness routes before viewport sweep.
• #373 MERGED: Use Turbopack for Linux responsiveness runs.
• #374 MERGED: Harden responsiveness native shim checks.
• #375 MERGED: Document self-hosted responsiveness runner.
• #376 MERGED: Add responsiveness review kind.
• #377 MERGED: Assert responsiveness uses GitHub budget lane.