Standup overview — July 2026

Eight ADRs locked (0029–0036, 0040–0041), one billing tier repriced, the connector registry expanded to eight platforms, and two auth bypasses caught before any code shipped.

Brain content and observability. The month opened by retiring the full-text citation surface entirely — ADR-0033 superseded ADR-0029 a week after it was accepted, replacing lazy-fetched brain bodies with invisible weaving. What had been a content-access architecture is now purely an authoring and quality problem. On the quality side: retrieval_events (ADR-0032) closes the funnel gap between “top-k candidate” and “model actually cited,” and the offline eval harness locked pass-rate thresholds (denylist ≥ 99.0%, term-overlap ≥ 98.0%) against 319 real profiles. ADR-0035 is still in Proposed — the eval-monitoring system is sampling staging traffic, but Blair’s written sign-off hasn’t landed. That needs to close before V1 launch.

Billing and entitlements. Stripe Pro billing shipped end-to-end, then the price dropped from $29 to $19.95 late in the month — the KB doc preserved the original profitability threshold with a note that it requires re-derivation at the new price. Two entitlement race conditions in the streaming quota service were found during code review of each other and fixed with a single INSERT ... ON CONFLICT DO UPDATE statement. The 14-day MemberPress Pro trial landed, including a subtle trap: invoice.payment_succeeded fires on the $0 trial-start invoice and was caught before it sent a spurious payment-confirmation email.

Connector platform expansion. The module-registry refactor (memberintel-connect) turned MemberPress from inline SQL into the first concrete Billing_Module, then shipped MemberMouse, EDD, BuddyPress, WishList, PMPro, LearnDash, and Ultimate Member in sequence. ADR-0036’s cost condition was satisfied by ingest measurement — WishList’s 202 queries/member was the binding constraint on the Free-tier connector allow-list, and it evaporated the same day WishList batching shipped. ADR-0041 records the consequence: connector platform identity is not a tier-gating axis; member count is.

Infrastructure and security. The :latest Cloud Run deploy bug is the sharpest item of the month: any config-only terraform apply against the prod service was silently re-pulling main HEAD, bypassing the promotion gate entirely, since the environment split. Fixed in #823 by pinning to immutable commit SHAs. The plugin signing security review caught two auth bypasses before any code was written — a domain-control echo exploitable by any HTTP server, and a client-controlled version header that made the bearer-only→signed transition down-switchable. The Terraform drift job caught a real out-of-band env var on its first run; a blind apply would have stripped it from the live service.

Notable. The nudge cadence (#904) found that CRON_SECRET had never been provisioned in infra/, so the reminder scheduler had been failing closed to 401 in every environment since launch — zero nudge emails delivered. Same structural gap as the admin/ Vitest suite that had never run in CI, and the email verification link that silently returned 200 without consuming the token. Three features shipped, working as designed, delivering nothing.