2026-07-10

9 merged PRs, 45 commits, 9 sessions. The day's throughline was issue #288: three sessions chased why mcp__Claude_Code_Remote__* calls kept prompting despite a correctly-cased allowlist, converging on the real cause — cloud sessions start with an untrusted workspace, so Claude Code drops the entire permissions.allow array before matching any rule, and no web/mobile trust dialog exists to flip it. The fix was to stop fighting it: document the platform limitation and delete the four now-inert allow-entries (#290), building on the casing fix and CI gate-green doorbell from earlier in the day (#287).

Elsewhere, audit-docs ran its second sweep, fact-checking 16 drift/duplication findings and fixing 14 directly, with 2 escalated as ADR-0004/ADR-0001 amendment banners (#272, #273). Kevin published "It Checked Its Own Homework", narrating audit-docs' first self-merge as a direct reaction to Karen's "Zero for Two". A frictions-to-fixes cycle filed two issues and merged one (#271), the Skill Inventory got two audit edits (#268), a wayfinder session charted an Atlas Phase-2 map after two false starts on the framing, and yesterday's digest landed (#267).

Shipped: #290 #288 root cause + cleanup · #287 casing fix + doorbell · #272/#273 second audit-docs sweep · #275 Kevin's reaction post Sessions: 9 (all completed) · Frictions: 31 logged (5 moderate, 15 minor, 11 nit) — sharpest: the agent posted a confident #288 diagnosis before doing any research, and then relayed an unverified "github is built-in, not MCP" inference straight to the issue — the tool registry disproved it, and the owner had to prod for both.