Week of July 12–18, 2026

This week at a glance

A heavy ship week across all five products — over a hundred merged PRs. Layer shipped a rebuilt console dashboard and a database hardening pass, Overwatch published its first port commodity contract and a seasonal grain forecast, Locus landed a parcel pilot contract, a land-face publish path, and replayable score evidence alongside a collector reliability series, Codex delivered its reviewed Graph governance tranche, and RouteShift closed a security review on last week's SSO device flow.

New features

• Layer: The console dashboard v2 — KPI cards that only report numbers backed by real data, trend sparklines, period-aware benchmark annualization, and action insights. Integration connectors now render real brand logos, and the browser extension got unified Discovery branding with an honest privacy disclosure.
• Overwatch: Port commodity contract v1 — a published contract for port-level commodity flows, joined by point-in-time weather residual and cargo mass residual contracts and canonical port-identity consumers across the platform.
• Overwatch: An ENSO/ONI-aware seasonal grain-export forecast — seasonal export projections that now account for El Niño/La Niña cycle state. See the forecasts API.
• Locus: A fail-closed parcel pilot contract, a state-scale land-face publish path, and replayable aggregate score evidence — composite scores now persist the inputs needed to reproduce them. See scoring conventions.
• Codex: The reviewed Codex Graph governance and packaging tranche — hardened evaluation splits, KGC inputs, and a schema quickstart, with signoff evidence now bound to review domains.

Updates

• Layer: Optimization savings are now computed from real inputs end-to-end — the dashboard's savings figures are driven by actual usage and spend data.
• Overwatch: The status page now covers monthly USACE Waterborne Commerce and US Census trade release feeds alongside AIS and PSIX, and evaluates feed freshness per-cadence so daily, weekly, and monthly feeds no longer falsely surface as NEVER RAN when running on schedule. See the July 17 daily entry.
• Codex: The APRS compliance gate now handles transient schema-cache issues gracefully instead of failing with an opaque error, so validation stays accurate during schema changes. See the July 18 daily entry.
• RouteShift: The shared prompt-cache isolation policy is decided and documented — team-keyed response caching stays separate from provider-managed prompt caches, with explicit opt-in, credential-boundary, and rollback gates.

Fixes

• RouteShift: A multi-model security review of last week's SSO device-flow login landed a post-merge fix batch: discovery-doc endpoints are now HTTPS-only (closing an XSS), the device-token endpoint has a per-IP ceiling (closing a DoS), unauthenticated OAuth routes cap request bodies at 64KB (closing an OOM), Okta token exchange falls back to client_secret_basic, email_verified stays fail-closed on key minting, and the audit trail records superseded keys.
• Layer: A database performance and correctness pass — 86 RLS policies wrapped for initplan caching, 48 service policies scoped to service_role, permissive-policy overlaps consolidated, and a duplicate index dropped. The GitHub commit sync also got atomic batches and guarded status transitions, and the extension now rejects retired telemetry hostnames.
• Overwatch: Trade-release and PSIX ingestion durability — releases resume off durable state with a bounded finalize timeout, only an authoritative owner failure can terminalize a Scout run, claimed ingestion-log identities are preserved, and GFW data is fenced to research-only use.
• Locus: FAF5 lineage and trace replay hardening, a self-activating Bright Data residential proxy for the YouTube council collector, three chronic-dead sources disabled, and Legistar collectors now require variance-run evidence.
• Codex: Permit, entity-resolution, geospatial, and temporal evidence hardening across the release pipeline, plus release-audit intake for permits and sealed-snapshot coverage requirements.

The next update will land in the July 19–25 weekly recap.