Point solve + telemetry defaults at production - #233

Merged
jack-champagne merged 1 commit into
mainfrom
feat/point-defaults-at-prod
Jul 29, 2026
Merged

Point solve + telemetry defaults at production#233
jack-champagne merged 1 commit into
mainfrom
feat/point-defaults-at-prod

Conversation

@jack-champagne

@jack-champagnejack-champagne commented Jul 29, 2026

Copy link
Copy Markdown
Member

Flips both client defaults to the production account, together, and pins them with a test.

Why

The single token in ~/.amico/cloud.json authenticates both the solve API and the run-corpus ingest. Each AWS account has its own harmoniqs-api-credentials table, and the ingest hashes the token and looks it up in its own account's table — so a token minted in the other account is rejected on every batch (401) while the UI still reports capture as enabled.

Nothing enforced that coupling. It broke for real today: a user holding a prod-minted credential against the staging ingest default produced ~1265 rejected batches in one morning, capturing nothing. Diagnosed via the harmoniqs-run-corpus-staging-ingest-rejected alarm.

What

defaultwasnow
DEFAULT_CLOUD_URL (cloud_key.ts)qy2gwqy5s5 (staging solves)vsaje7ynp5 (prod solves)
amicode.telemetry.endpoint (package.json)4pbhrnv2… (staging ingest)bld42qbg… (prod ingest)

Both endpoints verified live against AWS. Manifest bumped 0.1.0 → 0.1.1 for release.yml's version guard.

New test the solve and telemetry defaults point at the SAME account (production) pins the pair and rejects either staging URL, so a one-sided edit fails CI rather than silently shipping.

Consequences

  • Every existing staging-minted token stops working and must be re-minted in prod: raghav-internal, jacktest, jack-piccolissimo, jack, aaron.
  • Capture now lands in the prod corpus, alongside the traces already there.
  • Prod also has real headroom: Lambda concurrency 400 vs staging's 10 (AWS floor, shared across 7 functions).

Testing

pnpm --filter amicode test — 810 passed, 80 files, 0 failed.

@jack-champagne
Point solve + telemetry defaults at production
34eb1e7
The one token in ~/.amico/cloud.json authenticates BOTH the solve API and
the run-corpus ingest, and each AWS account has its own credentials table:
the ingest hashes the token and looks it up in ITS account's table, so a
token minted in the other account is rejected on every batch — 401, while
the UI still reports capture as enabled.
Nothing enforced that coupling, and it broke for real: a user holding a
prod-minted credential against the staging ingest default produced ~1265
rejected batches in one morning, capturing nothing.
Flip both defaults together:
DEFAULT_CLOUD_URL -> vsaje7ynp5 (prod solves)
amicode.telemetry.endpoint -> bld42qbg… (prod run-corpus ingest)
Add a test pinning the pair so a one-sided edit fails CI instead of
shipping. Bump the manifest to 0.1.1 to satisfy release.yml's version
guard for the v0.1.1 tag.
Every existing staging-minted token must be re-minted in prod.
@jack-champagne
jack-champagne merged commit 7bb9e47 into mainJul 29, 2026
5 checks passed
@jack-champagnejack-champagne mentioned this pull request Jul 29, 2026
Merged
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jack-champagne
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Point solve + telemetry defaults at production - #233
Merged
jack-champagne merged 1 commit into
mainfrom 
feat/point-defaults-at-prod
Jul 29, 2026
Merged
Point solve + telemetry defaults at production#233
jack-champagne merged 1 commit into
mainfrom 
feat/point-defaults-at-prod
Conversation
@jack-champagne
@jack-champagnejack-champagne
commented
Jul 29, 2026

Copy link


Copy Markdown

Member
Flips both client defaults to the production account, together, and pins them with a test.
Why
The single token in ~/.amico/cloud.json authenticates both the solve API and the run-corpus ingest. Each AWS account has its own harmoniqs-api-credentials table, and the ingest hashes the token and looks it up in its own account's table — so a token minted in the other account is rejected on every batch (401) while the UI still reports capture as enabled.
Nothing enforced that coupling. It broke for real today: a user holding a prod-minted credential against the staging ingest default produced ~1265 rejected batches in one morning, capturing nothing. Diagnosed via the harmoniqs-run-corpus-staging-ingest-rejected alarm.
What
defaultwasnow
DEFAULT_CLOUD_URL (cloud_key.ts)qy2gwqy5s5 (staging solves)vsaje7ynp5 (prod solves)
amicode.telemetry.endpoint (package.json)4pbhrnv2… (staging ingest)bld42qbg… (prod ingest)
Both endpoints verified live against AWS. Manifest bumped 0.1.0 → 0.1.1 for release.yml's version guard.
New test the solve and telemetry defaults point at the SAME account (production) pins the pair and rejects either staging URL, so a one-sided edit fails CI rather than silently shipping.
Consequences
  • Every existing staging-minted token stops working and must be re-minted in prod: raghav-internal, jacktest, jack-piccolissimo, jack, aaron.
  • Capture now lands in the prod corpus, alongside the traces already there.
  • Prod also has real headroom: Lambda concurrency 400 vs staging's 10 (AWS floor, shared across 7 functions).
Testing
pnpm --filter amicode test — 810 passed, 80 files, 0 failed.
@jack-champagne
Point solve + telemetry defaults at production
34eb1e7
The one token in ~/.amico/cloud.json authenticates BOTH the solve API and
the run-corpus ingest, and each AWS account has its own credentials table:
the ingest hashes the token and looks it up in ITS account's table, so a
token minted in the other account is rejected on every batch — 401, while
the UI still reports capture as enabled.
Nothing enforced that coupling, and it broke for real: a user holding a
prod-minted credential against the staging ingest default produced ~1265
rejected batches in one morning, capturing nothing.
Flip both defaults together:
DEFAULT_CLOUD_URL -> vsaje7ynp5 (prod solves)
amicode.telemetry.endpoint -> bld42qbg… (prod run-corpus ingest)
Add a test pinning the pair so a one-sided edit fails CI instead of
shipping. Bump the manifest to 0.1.1 to satisfy release.yml's version
guard for the v0.1.1 tag.
Every existing staging-minted token must be re-minted in prod.
@jack-champagne
jack-champagne
merged commit 7bb9e47
into
mainJul 29, 2026

5 checks passed

@jack-champagnejack-champagne
mentioned this pull request
Jul 29, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@jack-champagne

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Point solve + telemetry defaults at production - #233
Merged
jack-champagne merged 1 commit into
mainfrom 
feat/point-defaults-at-prod
Jul 29, 2026
Merged
Point solve + telemetry defaults at production#233
jack-champagne merged 1 commit into
mainfrom 
feat/point-defaults-at-prod
Conversation
@jack-champagne
@jack-champagnejack-champagne
commented
Jul 29, 2026

Copy link


Copy Markdown

Member
Flips both client defaults to the production account, together, and pins them with a test.
Why
The single token in ~/.amico/cloud.json authenticates both the solve API and the run-corpus ingest. Each AWS account has its own harmoniqs-api-credentials table, and the ingest hashes the token and looks it up in its own account's table — so a token minted in the other account is rejected on every batch (401) while the UI still reports capture as enabled.
Nothing enforced that coupling. It broke for real today: a user holding a prod-minted credential against the staging ingest default produced ~1265 rejected batches in one morning, capturing nothing. Diagnosed via the harmoniqs-run-corpus-staging-ingest-rejected alarm.
What
defaultwasnow
DEFAULT_CLOUD_URL (cloud_key.ts)qy2gwqy5s5 (staging solves)vsaje7ynp5 (prod solves)
amicode.telemetry.endpoint (package.json)4pbhrnv2… (staging ingest)bld42qbg… (prod ingest)
Both endpoints verified live against AWS. Manifest bumped 0.1.0 → 0.1.1 for release.yml's version guard.
New test the solve and telemetry defaults point at the SAME account (production) pins the pair and rejects either staging URL, so a one-sided edit fails CI rather than silently shipping.
Consequences
  • Every existing staging-minted token stops working and must be re-minted in prod: raghav-internal, jacktest, jack-piccolissimo, jack, aaron.
  • Capture now lands in the prod corpus, alongside the traces already there.
  • Prod also has real headroom: Lambda concurrency 400 vs staging's 10 (AWS floor, shared across 7 functions).
Testing
pnpm --filter amicode test — 810 passed, 80 files, 0 failed.
@jack-champagne
Point solve + telemetry defaults at production
34eb1e7
The one token in ~/.amico/cloud.json authenticates BOTH the solve API and
the run-corpus ingest, and each AWS account has its own credentials table:
the ingest hashes the token and looks it up in ITS account's table, so a
token minted in the other account is rejected on every batch — 401, while
the UI still reports capture as enabled.
Nothing enforced that coupling, and it broke for real: a user holding a
prod-minted credential against the staging ingest default produced ~1265
rejected batches in one morning, capturing nothing.
Flip both defaults together:
DEFAULT_CLOUD_URL -> vsaje7ynp5 (prod solves)
amicode.telemetry.endpoint -> bld42qbg… (prod run-corpus ingest)
Add a test pinning the pair so a one-sided edit fails CI instead of
shipping. Bump the manifest to 0.1.1 to satisfy release.yml's version
guard for the v0.1.1 tag.
Every existing staging-minted token must be re-minted in prod.
@jack-champagne
jack-champagne
merged commit 7bb9e47
into
mainJul 29, 2026

5 checks passed

@jack-champagnejack-champagne
mentioned this pull request
Jul 29, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@jack-champagne

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Point solve + telemetry defaults at production - #233
Merged
jack-champagne merged 1 commit into
mainfrom 
feat/point-defaults-at-prod
Jul 29, 2026
Merged
Point solve + telemetry defaults at production#233
jack-champagne merged 1 commit into
mainfrom 
feat/point-defaults-at-prod
Conversation
@jack-champagne
@jack-champagnejack-champagne
commented
Jul 29, 2026

Copy link


Copy Markdown

Member
Flips both client defaults to the production account, together, and pins them with a test.
Why
The single token in ~/.amico/cloud.json authenticates both the solve API and the run-corpus ingest. Each AWS account has its own harmoniqs-api-credentials table, and the ingest hashes the token and looks it up in its own account's table — so a token minted in the other account is rejected on every batch (401) while the UI still reports capture as enabled.
Nothing enforced that coupling. It broke for real today: a user holding a prod-minted credential against the staging ingest default produced ~1265 rejected batches in one morning, capturing nothing. Diagnosed via the harmoniqs-run-corpus-staging-ingest-rejected alarm.
What
defaultwasnow
DEFAULT_CLOUD_URL (cloud_key.ts)qy2gwqy5s5 (staging solves)vsaje7ynp5 (prod solves)
amicode.telemetry.endpoint (package.json)4pbhrnv2… (staging ingest)bld42qbg… (prod ingest)
Both endpoints verified live against AWS. Manifest bumped 0.1.0 → 0.1.1 for release.yml's version guard.
New test the solve and telemetry defaults point at the SAME account (production) pins the pair and rejects either staging URL, so a one-sided edit fails CI rather than silently shipping.
Consequences
  • Every existing staging-minted token stops working and must be re-minted in prod: raghav-internal, jacktest, jack-piccolissimo, jack, aaron.
  • Capture now lands in the prod corpus, alongside the traces already there.
  • Prod also has real headroom: Lambda concurrency 400 vs staging's 10 (AWS floor, shared across 7 functions).
Testing
pnpm --filter amicode test — 810 passed, 80 files, 0 failed.
@jack-champagne
Point solve + telemetry defaults at production
34eb1e7
The one token in ~/.amico/cloud.json authenticates BOTH the solve API and
the run-corpus ingest, and each AWS account has its own credentials table:
the ingest hashes the token and looks it up in ITS account's table, so a
token minted in the other account is rejected on every batch — 401, while
the UI still reports capture as enabled.
Nothing enforced that coupling, and it broke for real: a user holding a
prod-minted credential against the staging ingest default produced ~1265
rejected batches in one morning, capturing nothing.
Flip both defaults together:
DEFAULT_CLOUD_URL -> vsaje7ynp5 (prod solves)
amicode.telemetry.endpoint -> bld42qbg… (prod run-corpus ingest)
Add a test pinning the pair so a one-sided edit fails CI instead of
shipping. Bump the manifest to 0.1.1 to satisfy release.yml's version
guard for the v0.1.1 tag.
Every existing staging-minted token must be re-minted in prod.
@jack-champagne
jack-champagne
merged commit 7bb9e47
into
mainJul 29, 2026

5 checks passed

@jack-champagnejack-champagne
mentioned this pull request
Jul 29, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@jack-champagne

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Point solve + telemetry defaults at production - #233
Merged
jack-champagne merged 1 commit into
mainfrom 
feat/point-defaults-at-prod
Jul 29, 2026
Merged
Point solve + telemetry defaults at production#233
jack-champagne merged 1 commit into
mainfrom 
feat/point-defaults-at-prod
Conversation
@jack-champagne
@jack-champagnejack-champagne
commented
Jul 29, 2026

Copy link


Copy Markdown

Member
Flips both client defaults to the production account, together, and pins them with a test.
Why
The single token in ~/.amico/cloud.json authenticates both the solve API and the run-corpus ingest. Each AWS account has its own harmoniqs-api-credentials table, and the ingest hashes the token and looks it up in its own account's table — so a token minted in the other account is rejected on every batch (401) while the UI still reports capture as enabled.
Nothing enforced that coupling. It broke for real today: a user holding a prod-minted credential against the staging ingest default produced ~1265 rejected batches in one morning, capturing nothing. Diagnosed via the harmoniqs-run-corpus-staging-ingest-rejected alarm.
What
defaultwasnow
DEFAULT_CLOUD_URL (cloud_key.ts)qy2gwqy5s5 (staging solves)vsaje7ynp5 (prod solves)
amicode.telemetry.endpoint (package.json)4pbhrnv2… (staging ingest)bld42qbg… (prod ingest)
Both endpoints verified live against AWS. Manifest bumped 0.1.0 → 0.1.1 for release.yml's version guard.
New test the solve and telemetry defaults point at the SAME account (production) pins the pair and rejects either staging URL, so a one-sided edit fails CI rather than silently shipping.
Consequences
  • Every existing staging-minted token stops working and must be re-minted in prod: raghav-internal, jacktest, jack-piccolissimo, jack, aaron.
  • Capture now lands in the prod corpus, alongside the traces already there.
  • Prod also has real headroom: Lambda concurrency 400 vs staging's 10 (AWS floor, shared across 7 functions).
Testing
pnpm --filter amicode test — 810 passed, 80 files, 0 failed.
@jack-champagne
Point solve + telemetry defaults at production
34eb1e7
The one token in ~/.amico/cloud.json authenticates BOTH the solve API and
the run-corpus ingest, and each AWS account has its own credentials table:
the ingest hashes the token and looks it up in ITS account's table, so a
token minted in the other account is rejected on every batch — 401, while
the UI still reports capture as enabled.
Nothing enforced that coupling, and it broke for real: a user holding a
prod-minted credential against the staging ingest default produced ~1265
rejected batches in one morning, capturing nothing.
Flip both defaults together:
DEFAULT_CLOUD_URL -> vsaje7ynp5 (prod solves)
amicode.telemetry.endpoint -> bld42qbg… (prod run-corpus ingest)
Add a test pinning the pair so a one-sided edit fails CI instead of
shipping. Bump the manifest to 0.1.1 to satisfy release.yml's version
guard for the v0.1.1 tag.
Every existing staging-minted token must be re-minted in prod.
@jack-champagne
jack-champagne
merged commit 7bb9e47
into
mainJul 29, 2026

5 checks passed

@jack-champagnejack-champagne
mentioned this pull request
Jul 29, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@jack-champagne

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Point solve + telemetry defaults at production - #233
Merged
jack-champagne merged 1 commit into
mainfrom 
feat/point-defaults-at-prod
Jul 29, 2026
Merged
Point solve + telemetry defaults at production#233
jack-champagne merged 1 commit into
mainfrom 
feat/point-defaults-at-prod
Conversation
@jack-champagne
@jack-champagnejack-champagne
commented
Jul 29, 2026

Copy link


Copy Markdown

Member
Flips both client defaults to the production account, together, and pins them with a test.
Why
The single token in ~/.amico/cloud.json authenticates both the solve API and the run-corpus ingest. Each AWS account has its own harmoniqs-api-credentials table, and the ingest hashes the token and looks it up in its own account's table — so a token minted in the other account is rejected on every batch (401) while the UI still reports capture as enabled.
Nothing enforced that coupling. It broke for real today: a user holding a prod-minted credential against the staging ingest default produced ~1265 rejected batches in one morning, capturing nothing. Diagnosed via the harmoniqs-run-corpus-staging-ingest-rejected alarm.
What
defaultwasnow
DEFAULT_CLOUD_URL (cloud_key.ts)qy2gwqy5s5 (staging solves)vsaje7ynp5 (prod solves)
amicode.telemetry.endpoint (package.json)4pbhrnv2… (staging ingest)bld42qbg… (prod ingest)
Both endpoints verified live against AWS. Manifest bumped 0.1.0 → 0.1.1 for release.yml's version guard.
New test the solve and telemetry defaults point at the SAME account (production) pins the pair and rejects either staging URL, so a one-sided edit fails CI rather than silently shipping.
Consequences
  • Every existing staging-minted token stops working and must be re-minted in prod: raghav-internal, jacktest, jack-piccolissimo, jack, aaron.
  • Capture now lands in the prod corpus, alongside the traces already there.
  • Prod also has real headroom: Lambda concurrency 400 vs staging's 10 (AWS floor, shared across 7 functions).
Testing
pnpm --filter amicode test — 810 passed, 80 files, 0 failed.
@jack-champagne
Point solve + telemetry defaults at production
34eb1e7
The one token in ~/.amico/cloud.json authenticates BOTH the solve API and
the run-corpus ingest, and each AWS account has its own credentials table:
the ingest hashes the token and looks it up in ITS account's table, so a
token minted in the other account is rejected on every batch — 401, while
the UI still reports capture as enabled.
Nothing enforced that coupling, and it broke for real: a user holding a
prod-minted credential against the staging ingest default produced ~1265
rejected batches in one morning, capturing nothing.
Flip both defaults together:
DEFAULT_CLOUD_URL -> vsaje7ynp5 (prod solves)
amicode.telemetry.endpoint -> bld42qbg… (prod run-corpus ingest)
Add a test pinning the pair so a one-sided edit fails CI instead of
shipping. Bump the manifest to 0.1.1 to satisfy release.yml's version
guard for the v0.1.1 tag.
Every existing staging-minted token must be re-minted in prod.
@jack-champagne
jack-champagne
merged commit 7bb9e47
into
mainJul 29, 2026

5 checks passed

@jack-champagnejack-champagne
mentioned this pull request
Jul 29, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@jack-champagne

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Point solve + telemetry defaults at production - #233
Merged
jack-champagne merged 1 commit into
mainfrom 
feat/point-defaults-at-prod
Jul 29, 2026
Merged
Point solve + telemetry defaults at production#233
jack-champagne merged 1 commit into
mainfrom 
feat/point-defaults-at-prod
Conversation
@jack-champagne
@jack-champagnejack-champagne
commented
Jul 29, 2026

Copy link


Copy Markdown

Member
Flips both client defaults to the production account, together, and pins them with a test.
Why
The single token in ~/.amico/cloud.json authenticates both the solve API and the run-corpus ingest. Each AWS account has its own harmoniqs-api-credentials table, and the ingest hashes the token and looks it up in its own account's table — so a token minted in the other account is rejected on every batch (401) while the UI still reports capture as enabled.
Nothing enforced that coupling. It broke for real today: a user holding a prod-minted credential against the staging ingest default produced ~1265 rejected batches in one morning, capturing nothing. Diagnosed via the harmoniqs-run-corpus-staging-ingest-rejected alarm.
What
defaultwasnow
DEFAULT_CLOUD_URL (cloud_key.ts)qy2gwqy5s5 (staging solves)vsaje7ynp5 (prod solves)
amicode.telemetry.endpoint (package.json)4pbhrnv2… (staging ingest)bld42qbg… (prod ingest)
Both endpoints verified live against AWS. Manifest bumped 0.1.0 → 0.1.1 for release.yml's version guard.
New test the solve and telemetry defaults point at the SAME account (production) pins the pair and rejects either staging URL, so a one-sided edit fails CI rather than silently shipping.
Consequences
  • Every existing staging-minted token stops working and must be re-minted in prod: raghav-internal, jacktest, jack-piccolissimo, jack, aaron.
  • Capture now lands in the prod corpus, alongside the traces already there.
  • Prod also has real headroom: Lambda concurrency 400 vs staging's 10 (AWS floor, shared across 7 functions).
Testing
pnpm --filter amicode test — 810 passed, 80 files, 0 failed.
@jack-champagne
Point solve + telemetry defaults at production
34eb1e7
The one token in ~/.amico/cloud.json authenticates BOTH the solve API and
the run-corpus ingest, and each AWS account has its own credentials table:
the ingest hashes the token and looks it up in ITS account's table, so a
token minted in the other account is rejected on every batch — 401, while
the UI still reports capture as enabled.
Nothing enforced that coupling, and it broke for real: a user holding a
prod-minted credential against the staging ingest default produced ~1265
rejected batches in one morning, capturing nothing.
Flip both defaults together:
DEFAULT_CLOUD_URL -> vsaje7ynp5 (prod solves)
amicode.telemetry.endpoint -> bld42qbg… (prod run-corpus ingest)
Add a test pinning the pair so a one-sided edit fails CI instead of
shipping. Bump the manifest to 0.1.1 to satisfy release.yml's version
guard for the v0.1.1 tag.
Every existing staging-minted token must be re-minted in prod.
@jack-champagne
jack-champagne
merged commit 7bb9e47
into
mainJul 29, 2026

5 checks passed

@jack-champagnejack-champagne
mentioned this pull request
Jul 29, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@jack-champagne

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Point solve + telemetry defaults at production - #233
Merged
jack-champagne merged 1 commit into
mainfrom 
feat/point-defaults-at-prod
Jul 29, 2026
Merged
Point solve + telemetry defaults at production#233
jack-champagne merged 1 commit into
mainfrom 
feat/point-defaults-at-prod
Conversation
@jack-champagne
@jack-champagnejack-champagne
commented
Jul 29, 2026

Copy link


Copy Markdown

Member
Flips both client defaults to the production account, together, and pins them with a test.
Why
The single token in ~/.amico/cloud.json authenticates both the solve API and the run-corpus ingest. Each AWS account has its own harmoniqs-api-credentials table, and the ingest hashes the token and looks it up in its own account's table — so a token minted in the other account is rejected on every batch (401) while the UI still reports capture as enabled.
Nothing enforced that coupling. It broke for real today: a user holding a prod-minted credential against the staging ingest default produced ~1265 rejected batches in one morning, capturing nothing. Diagnosed via the harmoniqs-run-corpus-staging-ingest-rejected alarm.
What
defaultwasnow
DEFAULT_CLOUD_URL (cloud_key.ts)qy2gwqy5s5 (staging solves)vsaje7ynp5 (prod solves)
amicode.telemetry.endpoint (package.json)4pbhrnv2… (staging ingest)bld42qbg… (prod ingest)
Both endpoints verified live against AWS. Manifest bumped 0.1.0 → 0.1.1 for release.yml's version guard.
New test the solve and telemetry defaults point at the SAME account (production) pins the pair and rejects either staging URL, so a one-sided edit fails CI rather than silently shipping.
Consequences
  • Every existing staging-minted token stops working and must be re-minted in prod: raghav-internal, jacktest, jack-piccolissimo, jack, aaron.
  • Capture now lands in the prod corpus, alongside the traces already there.
  • Prod also has real headroom: Lambda concurrency 400 vs staging's 10 (AWS floor, shared across 7 functions).
Testing
pnpm --filter amicode test — 810 passed, 80 files, 0 failed.
@jack-champagne
Point solve + telemetry defaults at production
34eb1e7
The one token in ~/.amico/cloud.json authenticates BOTH the solve API and
the run-corpus ingest, and each AWS account has its own credentials table:
the ingest hashes the token and looks it up in ITS account's table, so a
token minted in the other account is rejected on every batch — 401, while
the UI still reports capture as enabled.
Nothing enforced that coupling, and it broke for real: a user holding a
prod-minted credential against the staging ingest default produced ~1265
rejected batches in one morning, capturing nothing.
Flip both defaults together:
DEFAULT_CLOUD_URL -> vsaje7ynp5 (prod solves)
amicode.telemetry.endpoint -> bld42qbg… (prod run-corpus ingest)
Add a test pinning the pair so a one-sided edit fails CI instead of
shipping. Bump the manifest to 0.1.1 to satisfy release.yml's version
guard for the v0.1.1 tag.
Every existing staging-minted token must be re-minted in prod.
@jack-champagne
jack-champagne
merged commit 7bb9e47
into
mainJul 29, 2026

5 checks passed

@jack-champagnejack-champagne
mentioned this pull request
Jul 29, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@jack-champagne