What Shipped This Week — Apr 20–26, 2026

A dense week. Kiwi hit v0.8.0, Snipe got a full performance overhaul, Peregrine shipped its public demo experience, and the shared infrastructure underneath everything got significantly smarter. We also took our first real contact form spam run and patched it the same day.

Shipped

Kiwi (v0.5.0 → v0.8.0)

• Visual label capture for unrecognized barcodes: scan, capture a photo, confirm what the model extracted. Confidence below 70% flagged in amber. Calm copy, no "error" language.
• PWA support: installable to homescreen, works like a native app
• Orbital cadence on saved recipes: "made X days ago" chip and a last-cooked sort (oldest-first). Maintenance that restarts from completion, not a deadline.
• Cross-encoder reranker for recipe suggestions via local inference
• LLM style auto-classifier: "Suggest tags" on saved recipes, Paid/BYOK tier
• Cooked leftovers shelf-life: deterministic FDA/USDA table with protein-signal and dish-type overrides. Shows after "I cooked this." Free tier.
• Multi-currency shopping list with live exchange rates
• Community subcategory tagging Layer A: users tag recipes, votes surface accepted tags into browse counts
• Corrections router: flag data errors directly from the UI
• Saved recipe cloud bug batch: FK constraint fix, null title safety, parallel load reliability

Snipe

• Pre-warmed Chromium pool: cold-start latency on search is gone
• Short-TTL search result cache: repeated queries skip the scraper
• Async search with SSE streaming: results arrive as they're found
• Currency preference with live exchange rates
• eBay checkout URL normalization: any eBay URL format resolves correctly

Peregrine (v0.9.0)

• Public demo experience: seeded data, write-block guard, welcome modal, per-view hint chips, demo banner
• Streamlit fully removed from dev and cloud
• Reranker pass on job ranking and ATS optimizer
• Tier-aware writing model routing: premium users can have a custom model routed through CF's inference load balancer

circuitforge-core (v0.16.0 → v0.17.0)

• Shared reranker module: five adapters (BGE, Qwen3, CrossEncoder, Cohere BYOK, Remote). Cloud apps get Qwen3-0.6B automatically; local dev falls back to BGE.
• CloudSessionFactory: shared auth across the fleet, ~400 lines of duplicate code removed
• ActivityPub module (MIT): actor management, signing, delivery, Lemmy inbox
• job_quality deterministic scorer, currency utility, audio and musicgen modules

Website

• Services and consulting page live
• Contact form: honeypot field, TLD blocklist, rate limiting, min-length validation

Ideas in Progress

Self-hosting, data ownership, and the backup myth — cloud isn't a backup strategy. It's a single point of failure with good marketing. Real data safety is diversification and distribution: local-first, exportable, portable. The cultural sovereignty piece runs alongside this — self-hosting is the condition that makes remixing, ownership, and creative control possible. The LAN party era is a concrete example of what gets lost when the substrate becomes vendor-controlled. We're planning to work this framing into product copy.

Orbitals visual language — a design pattern that emerged from Kiwi's last-cooked feature and is worth generalizing. Instead of deadline countdowns, show maintenance periods that restart from completion. Being extended to the infrastructure dashboard: node utilization as orbit rings rather than raw percentages.

Opt-in cross-device sync — architecture filed this week. Dumb key-value blob store, last-write-wins, per-user per-product per-data-class consent layer. Plain-language opt-in, no pre-checked boxes. Not built yet.

We got botted — the contact form took a spam run: dozens of submissions in a few minutes from a single source. Our TLD regex wasn't tight enough. Patched same day: Caddy-level block, sliding-window rate limiting (5 requests/hr on contact), TLD blocklist covering reserved and test domains, honeypot field. Full Caddy security audit ran alongside it. The fix is solid — but it's a good reminder that "working" and "hardened" aren't the same thing.

Next Week

• Kiwi ActivityPub (#113): decision made — kiwi.circuitforge.tech as the identity domain. CNAME to the cloud instance, Caddy site block, WebFinger at /.well-known/webfinger. Unblocked, implementing next week.
• cf-orch dashboard orbital cadence (#52): node card rings with orbit-period framing alongside utilization percentages.
• Community module smoke test: joint menagerie test is the only gate before the community PRs merge.
• Snipe keyword filtering: was in progress at end of this week, finishing it.

CircuitForge builds privacy-first, accessibility-first tools for the tasks the system made hard on purpose. Everything runs locally by default. circuitforge.tech