Build Timeline
How v0.6.0 unfolded. A six-day hackathon, 296 commits, one v1→v2 pivot, an M0–M16 milestone arc, and a closing day stacked with M14 substrate-hook, M15 live-API correctness, and M16 collectors-bridge work.
This page mirrors HACKATHON_TIMELINE.md from the blacklight repo. The
visual at-a-glance is on the lander under Build timeline;
the prose detail is here.
- Start: 2026-04-21 19:48 CT (initial commit, blacklight hackathon start)
- Submission target: 2026-04-26
- HEAD: main · v0.6.0 · 399/0 hermetic on debian12 + rocky9, 4/4 live
Day 1: 2026-04-21 (Tue), v1 hackathon start
8 commits.
- Scaffolding: directory tree, requirements.txt,
.gitkeeps. - Curator (v1): Pydantic case-file schema lockdown; first-contact scaffold against Managed Agents.
- Compose (v1): 3-host fleet; curator local Flask glue.
- bl-agent + bl-ctl (v1): bash scaffolds for pull / apply / report.
- Skills (v1): INDEX router + 4 Day-1 stubs.
- Test scaffold (6 skipped, Day 3 target).
State at end-of-day: skills-as-Python-routed agent on a Flask substrate. Operator-content protected.
Day 2: 2026-04-22 (Wed), v1 hunters + first case
83 commits, the highest-volume day of the hackathon.
- Hunters scaffolded (
fs,log,timeline+ base + prompts). - Evidence DB (sqlite): schema + CRUD.
- Orchestrator v1: hunters → evidence.db → first materialized case (
CASE-2026-0007). - Exhibits:
host-2 staged exhibit, APSB25-94 PolyShell reconstruction;exhibits/fleet-01/EXPECTED.mdground truth. - bl-report: scoped fs + logs + cron collection.
- Day 2 P10 sentinel/anti-slop sweep (
P1-SPEC,P3-BUG-{01..07},P4-DATA-{01,02}).
State: "Day 2 checkpoint met (degraded), hunters + first case".
Day 3: 2026-04-23 (Thu), v1 Managed Agents wiring + audit
19 commits. Last day of the v1 architecture.
docs/managed-agents.mdfirst written (working reference).- Curator Managed Agents session wiring design (MVW spec).
curator/agent_setup.py(idempotent bootstrap) +curator/session_runner.py(revise path).work-output/session-tool-invocation-probe.py, P0 M2 gate probe.- Audit P0/P1/P2 sweeps; spec-leak scrub; sentinel fixups.
- MVW gate PASS: "session-wired build ready for Saturday 18:00 CT recording".
Skill prompt hardening + injection guard work surfaced the structural issue that drove the next day's pivot.
Day 4: 2026-04-24 (Fri), pivot + milestone-driven rebuild
81 commits. Two distinct halves.
Morning: scorched earth
[New] PIVOT-v2.md, skills-first defensive agent rewrite plan[Change] scorched earth, archive v1 Python/curator/tests/compose + v1 planning to legacy/[Change] README stub + [New] DESIGN.md, v2 rewrite architecture + command surface
v1 lived under .rdf/archive/legacy/ from this point on.
Afternoon: M0–M9 spec + implementation in one day
| Plan | Topic |
|---|---|
| M0 | Contracts lockdown (exit codes, action tiers, setup flow, case layout) |
| M1 | bl skeleton design (skill bundling and concat order) |
| M2 | Case-templates (hypothesis/INDEX/attribution) |
| M3 | Schemas + ledger scaffolding |
| M4 | bl observe collectors (apache, fs, crons, htaccess) |
| M5 | bl consult/run/case lifecycle (case open/attach/sweep) |
| M5.5 | Component extraction (src/bl.d/NN-*.sh parts model) |
| M6 | bl defend (ModSec / firewall / signature backends) |
| M7 | bl clean (file/htaccess/cron/proc remediation) |
| M8 | bl case close/reopen + ledger audit decode |
| M9 | Hardening implementation (P1–P9 same day) |
32 jsonl session logs, most short, milestone-scoped subagent dispatches.
Day 5: 2026-04-25 (Sat), hardening, ship, demo, Skills realign
69 commits. Ship-ready by mid-day; Path C realignment closed by night.
| Plan | Topic |
|---|---|
| M9.5 | Audit-driven hardening sweep (P1–P9), AUDIT.md, baseline patterns |
| M10 | Ship-ready (v0.1.0): .gitattributes export-ignore, packaging closeout |
| M11 | Posture lift (v0.2.0): doc reconciliation, README pitch |
| M11.1 | Deferred fixups: error-call paths, audit decode |
| M12 | Demo readiness, live-trace harness, P5.5 Managed Agents API surface migration |
| M13 | Skills primitive realignment (Path C): Files API + Skills API helpers, agent + state.json schema, 6 routing Skills, live promotion eval gate (P11) |
M12 P5.5 (2026-04-25) is the last point at which sessions accepted the bare-event shape on /v1/sessions/<sid>/events; the wrapper requirement surfaced 24 hours later (see Anthropic API Notes §3).
35 jsonl session logs, the heaviest day for ad-hoc subagent dispatch.
Day 6: 2026-04-26 (Sun, ship day), closed-loop + API correctness + collectors-bridge
36 commits, 14 jsonl sessions. Four layered cycles plus a v0.5.x → v0.6.0 stamp arc.
M14: Substrate-hook (closed-loop response layer), v0.3.0 → v0.4.0
LMD post_scan_hook adapter, bl trigger, vendor alert_lib/tlog_lib, cPanel Stage 4 ModSec userdata, unattended tier gate, install/uninstall provisioning, three new skill bundles (bl-capabilities, lmd-triggers, cpanel-easyapache). Closed with VERSION bump to 0.4.0.
M15: API correctness against live Anthropic Managed Agents, v0.4.0 → v0.5.0
Eight phases of live-API drift remediation: load_state migration, FP-baseline dry-run wording, reset uses archive verb, agent CAS via POST, sessions.create field rename (agent_id→agent), Path A workspace allowlist (delete dead bl_skills_list), doc drift sweep, live integration smoke + operator runbook.
v0.5.1 / v0.5.2: Documentation, exhibits, operator-config tree
Two stamped-up consolidation passes between M15 and M16. v0.5.1 was a documentation + exhibit fill on top of 0.5.0 (no runtime behaviour changes; bl regenerated only because BL_VERSION bumped). v0.5.2 surfaced fifteen previously-buried operator tunables in the /etc/blacklight/blacklight.conf preflight loader — the landed default config exposed only 7 of ~22 runtime-effective BL_* env knobs. v0.5.2 also folded in a pre-ship adversarial sweep that scrubbed milestone vernacular, AI-tell vocabulary, and version-stamp drift across README / PRD / DESIGN, plus an above-the-fold README rework (mermaid for ASCII art, GitHub callouts for blockquote disclaimers).
M16: Collectors + bridge + adapter layer, v0.5.2 → v0.6.0
Five phases closing the curator-prescription → collector-execution loop. The curator emits a report_step, bl flush --session-events syncs it to the memstore pending/ with the custom_tool_use_id, bl run <step-id> dispatches via the per-verb adapter, the collector executes, and writeback emits user.custom_tool_result against the recorded id so the curator's next turn unblocks.
| Phase | Topic |
|---|---|
| M16 P1 | modsec collector parser fix + canonical 8-hex sample alignment |
| M16 P2 | bl observe cron --from-file fixture-mode adapter |
| M16 P3 | session-event → memstore-pending bridge (closes the M12.5 session-creation gap) |
| M16 P4 | writeback emits user.custom_tool_result for bridge-enriched steps |
| M16 P5 | args translator + 11 per-verb observe adapters |
Two sentinel/FP cycles applied. Pre-impl REVISE caught 4 BLOCKERs + 9 MAJORs before any code shipped. Two post-impl 4-pass reviews caught 6 MAJORs (saturated cursor, first-write-wins, CRLF strip, BSD-date -r portability, bridge-vs-bl-run cycle, version stamp drift), all confirmed and fixed. Closed with VERSION bump 0.5.2 → 0.6.0 and a full debian12 + rocky9 test gate of 399/399 in ~140s.
Off-plan session work
These cycles ran in the same day but were operator-driven, not phase-scoped:
- Post-M15 triage (commit
ceffbe3): debian12 + rocky9 baseline restored to GREEN (348/0). Five separate fixes, none planned, all surfaced by the post-M15 test re-run. - Live integration smoke continuation: closed the previous session's
tests/live/setup-live.batstest 3 failure. Root cause was the test (head -1on output that contained dedup-warning case-ids before the allocated one), not the bl code. - Environments API probe +
ANTHROPIC-API-NOTES.md: operator-asked investigation intopackagesfield support. Result: not supported; canonical body is{name, config:{type, networking}}. Spawned the formalized API-gaps log (10 items, surfaced on the Anthropic API Notes page). - Archive renames + this timeline: the doc you're reading.
Cumulative shape
| Day | Date | Commits | Sessions | Era |
|---|---|---|---|---|
| 1 | 2026-04-21 | 8 | 5 | v1 scaffolding |
| 2 | 2026-04-22 | 83 | 21 | v1 hunters + first case |
| 3 | 2026-04-23 | 19 | 12 | v1 Managed Agents MVW |
| 4 | 2026-04-24 | 81 | 32 | pivot + M0–M9 |
| 5 | 2026-04-25 | 69 | 35 | M9.5–M13 (hardening, ship, demo, Path C) |
| 6 | 2026-04-26 | 36 | 14 | M14–M16 + v0.5.x consolidation + off-plan triage |
Total: 6 days, 296+ commits, 119+ session logs, 0 → v0.6.0.
The v1 → v2 pivot at the start of Day 4 is the single most consequential
decision in the build, the v2 milestone-driven rebuild took half the
calendar time of the v1 attempt and produced a shippable artifact. The v1
archive (.rdf/archive/legacy/) is preserved as proof-of-work, not as a
fallback.
Cross-references
- Per-phase detail:
CHANGELOGin the repo (M10–M16 sections; M0–M9 rolled into the M10-complete summary block). - Architecture: Architecture doc.
- Strategy / framing:
PIVOT-v2.md(archived in repo). - API friction log: Anthropic API Notes.
- What got cut and why: Pivot Moments.