Devlog: February 28, 2026

A heavy Saturday. Klar had an enormous day — two full PRs merged covering the Meta Layer completion and a brand new Windows/Ubuntu CI matrix. Changesmith shipped a meaningful admin feature and a security patch. AirTower fixed two real-world bugs. ClaudeCodeSettings got upgraded with a QA review agent system.

Klar

The biggest commit log of the week. Three PRs merged, covering the Meta Layer, Lodex-related needs, and cross-platform CI.

Meta Layer (PR #19) closed out with seven rounds of QA review fixes. The depth of iteration here — round after round of fix: address QA review issues — reflects serious attention to correctness. The Meta Layer is Klar's annotation and introspection system, and getting it right matters for every project that builds on top of it.

LodexNeeds (PR #20) landed alongside the Meta Layer work. A null check for cmd_buf malloc in process_run codegen was the headline fix, alongside hardened Phase 0 builtins — realloc null checks, ferror handling, portable test improvements, and broader VM warning cleanup. Several rounds of code review and QA findings were addressed here too. The builtins are now in solid shape.

Ubuntu CI (PR #21) is the other major milestone: Klar now builds and tests on Ubuntu/Debian with proper LLVM detection, and Windows CI has been upgraded to run the full LLVM test suite with MSVC environment setup. Portable grep usage was fixed for macOS CI, versioned Homebrew LLVM detection was added, and the MSVC link.exe path collision with Git Bash coreutils was resolved. Cross-platform is hard; this PR did the unglamorous work.

Klar is steadily becoming a real, multi-platform language. Windows and Ubuntu support in CI means contributions from anywhere, and the hardened builtins mean the runtime is safer.

Changesmith

Two PRs merged, version bumped to 1.10.0.

Nice-to-haves (PR #46) was a broad cleanup: a security patch for a serialize-javascript RCE vulnerability (GHSA-5c6j-r48x-rmvq), multiple QA finding fixes across maintenance bypass, count types, error handling, MDX paths, link safety, mailto injection, a11y, admin user table, and migration hardening. The admin dashboard with usage stats and user activity was the feature headliner — now there's a real operational view into what's happening inside a Changesmith deployment. Several rounds of QA review were addressed before merge, similar to Klar's pattern.

Deployment (PR #47) streamlined CI by removing a redundant build job and adding the dev branch to the pipeline. Clean infrastructure work.

The version bump to 1.10.0 makes it a proper release. Changesmith is iterating fast.

AirTower

Two PRs merged, both fixing real operational bugs.

macOS Tahoe compatibility (PR #7): Terminal scripting was switched from AppleScript to JXA (JavaScript for Automation) to fix a breakage on macOS Tahoe. This is the kind of fix that only surfaces when someone is actually using the tool on a recent OS — good catch.

VM Problems (PR #6): Fixed a false "Terminal not running" error that appeared after switching virtual machines. Another real-world edge case squashed.

AirTower is small but evidently in active use. Both fixes are quality-of-life improvements for the dev workflow it supports.

ClaudeCodeSettings

Two meaningful commits to the shared Claude Code configuration.

A full QA review agent system was added — an orchestrator with eight specialist reviewers. That's infrastructure that will touch every project using Claude Code, applying structured review passes across the whole development workflow. A PreToolUse guard hook was also added as a safety check for --dangerously-skip-permissions, preventing accidental bypasses. A redundant .gitignore entry for .DS_Store was cleaned up too.

The QA review agent system is a force multiplier. Eight specialists reviewing code in parallel, coordinated by an orchestrator, is the kind of setup that makes the round-by-round fix patterns in Klar and Changesmith possible.