Jono Bacon posted this video about how we did things in Ubuntu during the good old days. I thought it would be relevant to post here. Marco Ceppi and Adam Israel are the Maintainers Emeritus who helped make the first prototypes of Bluefin. It's basically this formula but applied to bootc images:

Intro​

Hi there, I'm Delphic Melody. I'm the vector artist who's been creating vector art for Project Bluefin. You might be familiar with some of the vector wallpapers that I've created by remastering and expanding on the work of the extremely talented Natalia Jagielska and Atius Amy: Wallpapers

Brazilian Bluefins​

I'm chiming in to let folks know that Brazilian Bluefins live!

You're more than welcome to modify the vectorized dinos to create your own personalized versions of Bluefin with your country's flag.

Please feel free to PR your renditions to Bluefin's official artwork repository: Artwork Repo

Oh, and if you enjoy my work, please consider donating to my Ko-fi if you can. It really helps keep me motivated to create vector art.

Thank you for your time and consideration. May you have an amazing week.

Participation

Human and automated contributions with current contributors.

Show the numbers

Human and automation activity data for September 2026 UTC (2026-09-01 to 2026-09-30)

Label	Human	Automation
Report period	780	420

🏆 Hive Leaderboard

Hive Leaderboard: Community Heroes

Celebrating our top community builders across the Project Bluefin factory

RankContributorImpactProjectsMilestone

#01@castrojo272 PRscommondakotatestsuite+7Top Hero#02@hanthor110 PRscommontestsuiteserver+4High Velocity#03@kylerankin67 PRscommontestsuiteserver+6High Velocity#04@mrbobbytables65 PRstestsuiteserveractions+4High Velocity#05@Danathar59 PRscommondakotatestsuite+7High Velocity#06@ahmedadan47 PRscommondakotadocumentationHigh Velocity#07@mendezr32 PRscommontestsuiteserver+5New Light#08@jeefy29 PRsserverNew Light#09@Siddhj220616 PRscommonactionsfinpilotHigh Velocity#10@repires15 PRscommontestsuiteactions+3High Velocity#11@buggtb14 PRscommontestsuiteactions+2New Light#12@dtg0110013 PRsserveractionsdocumentation+1High Velocity#13@sramkrishna12 PRscommontestsuiteactions+2New Light#14@arteeh5 PRscommonserverutah-packagesNew Light#15@KiKaraage5 PRscommonactionsutahHigh Velocity#16@HuntedRaven73 PRscommonactionsutahCross-Fleet#17@clubanderson3 PRscommonutah-packages#18@eltorrero3 PRscommonactions#19@TB5162 PRsserverdocumentationNew Light#20@bronson1 PRserverNew Light

✨

Welcome New Lights (11)

First-time guardians who made their mark in the factory this month.

@mendezr@sramkrishna@kronikpillow@buggtb@arteeh@xHope-tech@ericcurtin@KOTONEX@jeefy@bronson@TB516

Release details remain on the canonical /changelogs surface.

Completed work​

• fix(ci): report required checks on docs-only PRs by @​Danathar in #1181
• docs(secrets-policy): record Cloudflare secrets as provisioned by @​clubanderson in #1275
• feat(wallpaper): ship original looping movie for Hidamari by @​mendezr in #1207
• refactor: remove produced-but-unconsumed nvidia overlay by @​mendezr in #1263
• docs(ci-tooling): record Renovate fork processing for the printer forks by @​sramkrishna in #1259
• docs(release-promotion): record printer testing-to-stable promotion proof by @​kylerankin in #1257
• feat(brew): update opencode to the v2 formula by @​kronikpillow in #1270
• docs(ci-pitfalls): correct create-github-app-token owner/repositories scoping by @​castrojo in #1269
• fix(chairlift): refresh vendored desktop entry and icons to v26.09.0-alpha.2 by @​clubanderson in #1274
• docs(chairlift): fix broken brew-lifecycle doc reference in config.yml by @​buggtb in #1273
• fix: align ChairLift config and ship GSettings schemas by @​mendezr in #1265
• fix(nvidia): pin suspend notifiers so sleep is not vetoed by @​mendezr in #1176
• fix(brew): comment out kcl, use upstream kpt, remove aurora-wp by @​KiKaraage in #1131
• feat(wallpaper): add Damask first-run setup hook and non-destructive defaults by @​repires in #1186
• fix: reconcile inert .github Renovate configuration by @​repires in #1183
• feat(damask): ship flatpak overrides and background systemd service by @​repires in #1187
• feat(chairlift): add wallpaper slideshow and video wallpaper brew bundles by @​sramkrishna in #1185
• ci: run all maintained unit suites in CI by @​arteeh in #1249
• feat(testing): add a hardware-free eSCL scanner fixture by @​sramkrishna in #1225
• docs(contributing): add per-repo reviewer coverage map with refresh procedure by @​mendezr in #1248
• docs: inventory printer and scanner driver projects by @​arteeh in #1221
• docs: record printer application upstream source baseline by @​buggtb in #1251
• docs(skills): track PAPPL scanning API upstream status and ownership boundary by @​buggtb in #1218
• docs(printer-apps): add release-contract evidence matrix by @​buggtb in #1222
• docs(ci-tooling): correct stale claim about dockerfile manager and COPY --from by @​buggtb in #1255
• docs(skills): correct renovate versioned-binary tracking wording by @​mendezr in #1250
• docs: assess native HP PCL app against HPLIP OCI coverage by @​buggtb in #1236
• docs: evaluate LPrint v1.4.0 as FSDK OCI label-printer appliance by @​kylerankin in #1235
• docs: correct reusable lifecycle automation ownership (bonedigger, not actions) by @​buggtb in #1227
• docs(scanner): evaluate scanApp POC and pappl-retrofit scanning feasibility by @​buggtb in #1220
• docs: evaluate legacy SANE scanning appliance without claiming driverless parity by @​buggtb in #1219
• docs(contributing): add self-collision preflight draft for intra-lane duplicate PRs by @​sramkrishna in #1201
• fix(audio): make Bluetooth auto-switch opt-in instead of default by @​mendezr in #1179
• feat(brew): remove RamaLama from Bluefin AI tools bundle by @​kylerankin in #1204
• fix: honor NO_COLOR in local override output by @​Danathar in #1190
• fix: require review for GitHub Actions minor/patch updates by @​Danathar in #1146
• ci: run the suite-registration drift gate on every PR by @​kylerankin in #1192
• feat: WSL/container machine equivalent developer environment via Lima by @​repires in #1175
• fix(systemd): remove local-fs ordering cycle in rechunker-group-fix by @​kylerankin in #1208
• feat(countme): add dakota-scoped client and systemd units by @​castrojo in #1154
• feat(bazaar): Sept 2026 curation update, 7 new recs by @​KiKaraage in #1173
• fix: empty hooks directory made setup services exit 127 by @​kylerankin in #1193
• ci: block unpinned git checkouts in Containerfile builder stages by @​mendezr in #1178
• feat: Super+E should open a new Nautilus window on every press by @​repires in #1184
• chore: update motd + config by @​theMimolet in #1077
• fix(brew): drop tremor-runtime, removed from Homebrew by @​castrojo in #1206
• fix(countme): retry Dakota once per UTC week by @​castrojo in #1203
• fix(chairlift): track rebranded projectbluefin/chairlift release by @​eltorrero in #1121
• fix(apps): pin and sha256-verify OpenTabletDriver install fetches by @​mendezr in #1198
• docs(contributing): add agent-lane-throttle.md — demand-side throttle for the hold-gate queue by @​sramkrishna in #1197
• docs(contributing): add triage-sla.md — 14-day first-response SLA proposal for human-authored issues by @​mendezr in #1195
• docs(skills): record image-identity ownership decision — docs/skills/image-identity.md by @​sramkrishna in #1191
• docs: add systemd-homed-by-default decision record by @​eltorrero in #1200
• docs(bluespeed): mark bluefin-mcp as archived in the specification by @​kylerankin in #1199
• docs(contributing): add hold-gate PR queue prioritization rubric by @​repires in #1188
• docs: correct secrets-policy enforcement claim and add credential preflight rule by @​sramkrishna in #1180
• docs: document downstream label subsets separate from core factory catalog by @​mendezr in #1177
• docs(skills): widen category enum to include platform and product by @​repires in #1182
• docs(factory): ban COMMENT-only PR reviews and comment spam by @​castrojo in #1174
• fix(brew): preserve user-owned preinstall packages by @​Danathar in #1109
• fix(wireplumber): disable IR sensor on Kingcome hybrid webcam (2b7e:55c0) by @​castrojo in #1119
• fix(cli): replace atuin and bash-preexec with starship and add tests by @​castrojo in #1113
• docs(skills): maintainer-driven tool actions and duplicate-cluster resolution by @​castrojo in #970
• docs: fix grammatical and readability problems README.md by @​xHope-tech in #1017
• feat(bazaar): modernize curated layout and add Flathub IDE host integration hooks by @​castrojo in #1155
• fix(bling): ship working ujust completions for bash/zsh/fish by @​KiKaraage in #1129
• ci(actionlint): allow the ubuntu-26.04 runner labels by @​Danathar in #1151
• fix: add consistent bootc sudo policy by @​castrojo in #932
• fix(sec): ship Sigstore trust materials (Fulcio root + Rekor key) by @​hanthor in #933
• feat: add llmman to ai-tools Brewfile by @​ericcurtin in #1097
• fix(brew): allow dedicated ChairLift migration by @​ahmedadan in #1100
• fix(bling): rearm bash-preexec DEBUG trap on each prompt by @​castrojo in #943
• fix(brew): replace invalid brew tap --trust with brew tap + brew trust by @​castrojo in #941
• test: isolate UWELCOME_SHOWN in test_motd_integration.bats by @​castrojo in #1088
• refactor(just): move 00-entry.just to shared with optional imports by @​Siddhj2206 in #1042
• fix(flatpak): correct metered check in appstream refresh service by @​HuntedRaven7 in #1035
• fix: restore native recipes without bluefinctl by @​ahmedadan in #1083
• fix: resolve cask references and expose validation errors by @​ahmedadan in #1084
• fix(uwelcome): skip greeting for root and dedupe chained shells by @​ahmedadan in #1059
• fix(pages): dashboard CNAME qa.projectbluefin.io shadowed by redirect by @​kylerankin in #902
• fix(gate): let non-Bluefin images skip Bluefin-only scenarios, tolerate GNOME 51 display key by @​hanthor in #900
• fix(smoke): notify sandbox before app-availability early skips by @​hanthor in #899
• fix(e2e): allow unsafe-mode test extension on GNOME 51 shells by @​hanthor in #898
• fix(e2e): enable sshd via kernel arg so image presets cannot undo it by @​hanthor in #895
• fix(bazzite): mark extension 'is enabled' scenarios pending on state=6 regression by @​buggtb in #888
• refactor: remove unconsumed DEFAULT_SLA and SLA_STRICT from timing helper by @​repires in #882
• fix(renovate): restrict automerge to immutable-ref housekeeping by @​kylerankin in #886
• chore(scripts): remove dead parse_results script and tests by @​repires in #884
• docs(coverage): sync qa-review recount totals with suite-map snapshot by @​repires in #881
• chore(deps): update github-actions (non-major) by @​castrojo in #879
• docs(coverage): sync qa-review totals, add installer matrix row, fix flatpak gap by @​castrojo in #880
• test(smoke): comprehensive AT-SPI, stability, and presence coverage for Dakota GNOME extensions by @​castrojo in #808
• docs: remove ghost-lab dependencies and gate requirements by @​castrojo in #878
• chore: remove bluefinctl test coverage by @​castrojo in #822
• fix(shared): route AT-SPI tree dump through resolve_results_dir by @​kylerankin in #825
• fix(justfile): route results parsing through e2e_summary.py by @​mendezr in #873
• docs(software): audit the @future scenarios blocking GNOME 51 re-validation by @​sramkrishna in #877
• test(smoke): skip @vm_only scenarios in container lanes by @​castrojo in #740
• test(lifecycle): add settled-deployment barrier and activate bootc pin scenario by @​mrbobbytables in #837
• [sec-check] fix: declare top-level permissions: {} in e2e.yml by @​Danathar in #813
• refactor(ssh): Phase 2 — route dx/flatcar/kde-smoke/software/vanilla-gnome onto ssh_config.ssh_argv() by @​mrbobbytables in #790
• fix(gnome-e2e): source the results summary from scripts/e2e_summary (#797) by @​mendezr in #819
• docs(gnome): trim duplicate blank line to satisfy 500-line SKILL.md cap by @​Danathar in #869
• refactor: fold duplicated _first_value into shared ssh_config by @​mrbobbytables in #787
• docs(ci): make GNOME version string neutral across e2e summary and docs by @​mendezr in #854
• test(vanilla-gnome): add GNOME 51 reduced-motion and focus-ring gsettings round-trips by @​kylerankin in #851
• test(common): activate podman user socket scenario and track immutable status blockers by @​mrbobbytables in #852
• test(smoke): audit GNOME 50 workarounds against GNOME 51, update gnome.md by @​kylerankin in #848
• fix(ci): unify image-slug grammar across e2e workflow and artifact tags by @​mrbobbytables in #865
• ci: restore migration-target and extra-tags inputs to e2e.yml by @​kylerankin in #867
• test(software): re-anchor @future scenarios from closed #176 to #847 by @​mrbobbytables in #849
• test(vanilla-gnome): GNOME 51 readiness — Shell version canary by @​mrbobbytables in #864
• docs: align AGENTS.md and contributing/SKILL.md on skill-update gate by @​mrbobbytables in #862
• test(smoke): suppress session idle-lock in smoke setup to unblock GOA provider-list by @​mrbobbytables in #850
• test(quality): unit coverage for scripts/generate_skill_index.py by @​mrbobbytables in #788
• docs(scanner): fix malformed unit-test documentation block by @​mrbobbytables in #785
• fix(e2e): scope metadata artifacts by image by @​castrojo in #856
• fix(smoke): ignore Nvidia CDI failures in QEMU by @​castrojo in #855
• fix(e2e): stabilize Firefox accessibility workflow by @​castrojo in #853
• fix(e2e): robust toggle-updates probe, storage service lifecycle, and Firefox window lookup by @​castrojo in #792
• feat(nvidia): NVIDIA sysext skill and driver release tracking by @​dtg01100 in #326
• ci(build): run boot-test and release-dry-run when kernel-cache is skipped by @​jeefy in #328
• fix(initrd): verify the per-node Ignition config before applying it by @​kylerankin in #285
• fix(installer): keep console install failures visible instead of halting by @​dtg01100 in #321
• feat(nvidia): deliver the driver and toolkit sysexts to nodes by @​jeefy in #319
• fix(os): ship /etc/protocols and /etc/services (IANA netdb) for NFSv3 by @​jeefy in #317
• fix(sysupdate): ship the trust keyring in the vendor image by @​arteeh in #312
• feat(nvidia): container toolkit sysext (CDI) by @​jeefy in #304
• feat(nvidia): open-kernel-module driver sysext (nvidia-open-595) by @​jeefy in #305
• fix(kernel-cache): verify the whole tarball before restoring it by @​castrojo in #315
• ci(build): key-free kernel cache in ghcr.io for release builds by @​castrojo in #314
• ci(build): validate pull requests, build the image nightly, on main and on demand by @​castrojo in #313
• feat(installer): carry stick credentials to the installed disk; developer-mode admin user by @​castrojo in #300
• fix(security): clear group/other write from image paths; repair /etc on existing installs by @​castrojo in #303
• docs: sync the Booty story with jeefy/booty main by @​jeefy in #298
• feat(os): NFS client (nfs-utils + rpcbind, client-only) in the base image by @​jeefy in #295
• fix(installer): quiet vfat exec-bit repart warnings on diskless boot path by @​kylerankin in #283
• fix(installer): accurate login banner and first-boot password docs by @​castrojo in #297
• fix(installer): ask for a root password on the installed disk's first boot by @​castrojo in #293
• ci(build): queue main runs instead of cancelling them; upload installer logs by @​jeefy in #292
• ci(track-binaries): refresh amd64 and arm64 pins together, with tests by @​jeefy in #288
• build: drop FSDK os-release from the build sandbox and its patches by @​castrojo in #291
• fix(installer): no keymap or erase questions, reboot when done by @​castrojo in #290
• docs: follow-ups deferred from #276 by @​jeefy in #289
• ci: boot-test the offline USB installer end to end by @​jeefy in #277
• test: assert parsed properties instead of file text; no silent skips in CI by @​jeefy in #278
• build: reproducible image assembly, key-set safety, patch docs by @​jeefy in #281
• build: drop the gnome-build-meta junction by @​jeefy in #280
• refactor: shared sysext packing recipe, arm64 binary pins, base-image cleanups by @​jeefy in #279
• ci(release): dry-run the publish path on pull requests; attest provenance and publish an SBOM by @​jeefy in #269
• ci: boot-test tamper refusal, HTTP boot, Ignition and A/B rollback; skip image builds for docs-only changes by @​jeefy in #270
• fix(installer): boot offline, allow credential overrides, quiet repart warnings by @​castrojo in #268
• feat(update): automatic updates with a Kubernetes interlock, a boot health gate and a diskless update signal by @​jeefy in #271
• feat(initrd): explain diskless boot failures and ignored Ignition kargs by @​jeefy in #273
• docs: accuracy pass after the FSDK rebase by @​jeefy in #276
• ci: track patch releases of upstream binaries (Kubernetes, containerd, runc, CNI, k0s, ORAS) by @​jeefy in #272
• fix(security): ship root locked; provision access per node by @​jeefy in #275
• feat(installer): offline USB installer image booting into systemd-sysinstall by @​castrojo in #264
• fix(ci): install ORAS 1.3.4 by URL and checksum by @​castrojo in #266
• feat!: FSDK-composed OS with a signed, diskless-first boot chain by @​jeefy in #262
• Remove heading from README.md by @​castrojo in #261
• docs: add theme-adaptive wordmark to README by @​castrojo in #260
• feat(installer): opt-in network credentials pull (inst.creds_url / inst.creds_sha256) for PXE installs by @​jeefy in #253
• fix(ddi): restore the setuid/setgid bits Flatcar ships on sudo, su, passwd, mount, … by @​jeefy in #255
• fix(installer): actually wait for the network before the DDI download by @​jeefy in #252
• fix(installer): stage the network DDI in /dev/shm and check free space before decompressing by @​jeefy in #251
• fix(creds): apply firstboot.* credentials without systemd-firstboot by @​jeefy in #254
• fix(installer): rewrite the network DDI repart override without sed by @​jeefy in #250
• fix(installer): bare-metal USB install consolidation, preset ordering, and OVMF boot test by @​castrojo in #243
• fix(fsdk): disable tests in glib-stage1 bootstrap by @​castrojo in #51
• docs(arch): scope FSDK hard rule to installer by @​castrojo in #133
• chore(ci): pin runners to ubuntu-26.04 by @​castrojo in #237
• fix(kiosk): bridge guest loopback proxy via SSH port forwarding for QEMU by @​mrbobbytables in #202
• refactor: switch OS payload to Flatcar base, drop displaced FSDK components by @​kylerankin in #132
• refactor(arch): split release-version into installer and Flatcar axes by @​mrbobbytables in #136
• fix(flatcar): use flatcar-kernel-container-sha256 in flatcar-usr.bst by @​castrojo in #236
• feat(flatcar): add flatcar-usr.bst importing Flatcar /usr as the OS payload base by @​mrbobbytables in #140
• build: os-base option to compare FSDK payload against Flatcar reference by @​kylerankin in #163
• feat(installer): add opt-in PXE network DDI pull by @​kylerankin in #229
• test(installer): behavioural contract for the QEMU boot-proof readiness gate by @​Danathar in #219
• fix(k0s): pin argocd image by digest and upgrade past EOL v2.12.3 by @​kylerankin in #212
• fix(kiosk): console shows live local cluster state on first boot by @​kylerankin in #214
• arch: make include/flatcar.yml the single source of truth for Flatcar pins by @​kylerankin in #143
• feat(creds): extend systemd-creds provisioning to SSH keys, network, firstboot, and TPM2 by @​mrbobbytables in #221
• revert: remove unapproved appliance identity design (#208) by @​castrojo in #235
• fix(installer): harden flash-installer with refusal guards, write verification, and GPT backup relocation by @​castrojo in #225
• chore(renovate): disable the homebrew manager for binary-asset formulae by @​castrojo in #211
• ci: include scripts/** in unit-tests workflow paths filter by @​mendezr in #234
• fix(justfile): probe install-vm kiosk readiness from inside the guest (rebased) by @​castrojo in #227
• fix(installer): hard preflight abort when bluefin-installer-data is absent by @​castrojo in #224
• fix(boot): resolve QEMU installer boot deadlock and console readiness probe by @​mrbobbytables in #220
• fix(ci): pin just tool version in CI workflows by @​kylerankin in #190
• ci: expand unit-tests workflow paths trigger by @​mrbobbytables in #189
• fix(renovate): match the freedesktop-sdk series the junction actually tracks by @​hanthor in #84
• ci: land #190, #189 and #84 with the build.yml conflict resolved by @​castrojo in #217
• fix(ci): move junction ref tracking out of the pull_request path by @​castrojo in #180
• feat(flatcar): record container runtime parity by @​castrojo in #192
• feat(arch): produce Flatcar-to-FSDK version parity matrix (#142) by @​mrbobbytables in #184
• test(build-depends): lock in os-countme curl+jq FSDK paths by @​kylerankin in #122
• fix(installer): bound root-a partition to guarantee room for var by @​mrbobbytables in #207
• fix(test): preserve installer-created var partition by @​castrojo in #157
• ci: update installer evidence workflow pin by @​castrojo in #156
• fix(ci): support repart on hosted runners by @​castrojo in #152
• ci: update installer test workflow pin by @​castrojo in #151
• ci: run installer smoke through shared QEMU workflow by @​castrojo in #149
• Add kmod component and update depmod path by @​bronson in #146
• docs: mandate distributed BuildStream builds on ghost cluster by @​castrojo in #121
• fix(installer): fix kernel module extraction and probe USB storage drivers by @​castrojo in #120
• fix(e2e): support self-signed TLS certificates in readiness checks by @​castrojo in #118
• feat(lima): end-to-end Lima VM orchestration and automated browser login by @​castrojo in #117
• perf(kiosk): set KAGENTI_CONTROLLER_URL="none" in kc-agent gate command by @​mrbobbytables in #114
• feat(kiosk): forward kubernetes API port 6443 in install-vm by @​castrojo in #107
• feat(countme): ship the shared bluefin-countme reporter by @​castrojo in #94
• fix(kubestellar): correct container image tags and names in k0s manifests by @​kylerankin in #103
• fix(k0s): generate kubeflex postgres password at first boot instead of hardcoding it by @​kylerankin in #102
• fix(ci): restore dropped k0s sysext copy into dist/release/ by @​castrojo in #93
• feat(kernel): add Flatcar LTS kernel & ZFS sysext, export PXE release assets by @​castrojo in #92
• fix(installer): show interactive UI on the local display by @​TB516 in #79
• fix(k0s): complete first-boot activation and console readiness by @​castrojo in #63
• fix(build): prepare alpha release validation and sysext cleanup by @​castrojo in #59
• fix(fsdk): create uninstalled libappstream symlinks in appstream-minimal by @​castrojo in #58
• fix(build): add SONAME symlinks and LD_LIBRARY_PATH for gdk-pixbuf by @​castrojo in #56
• fix(fsdk): resolve libgirepository SONAME symlinks in gobject-introspection-base by @​castrojo in #54
• fix(chunka): pin chunkah's build clock so an unchanged rebuild keeps its digest by @​dtg01100 in #592
• chore: bump testsuite e2e pin for Utah gate fixes by @​hanthor in #588
• chore: bump testsuite e2e pin for GNOME 51 + early-skip fixes by @​hanthor in #587
• chore: bump testsuite e2e pin to include preset-proof sshd enablement by @​hanthor in #584
• fix(factory-health): dedupe open alerts by author by @​repires in #577
• fix(factory-health): close recovered alerts so dedupe stops muting pipelines by @​Danathar in #550
• ci(unit-tests): add missing workflow paths for tested guarded workflows by @​buggtb in #578
• fix(ci): annotate reusable-thin-caller-gate and drop hardcoded count in test by @​castrojo in #573
• fix(factory-health): require a minimum sample before alerting by @​Danathar in #560
• ci(promote-squash): let callers say the promotion PR is merged by a human by @​Danathar in #566
• fix(factory-health): fail the run when factory alerts are misrouted by @​Danathar in #564
• fix(workflows): stop PR-controlled CHUNKAH_VERSION reaching shell in vendor-chunka-files by @​sramkrishna in #570
• fix(release): normalize caller-supplied image reference by @​Siddhj2206 in #524
• feat(ci): annotate reusable workflows with required token type by @​mrbobbytables in #547
• ci(unit-tests): cover reusable-renovate-automerge.yml in the paths filter by @​Danathar in #553
• feat(reusable-build): allow testing-stream builds to opt into rechunking and SBOM by @​mendezr in #557
• fix(factory-health): bound the run fetch by the window, not a run count by @​Danathar in #551
• feat(ci): enforce thin-caller gate in consumer repos (issue #546) by @​Danathar in #554
• fix(ci): mint app token for renovate auto-merge wiring check by @​Danathar in #552
• docs(skills): add merge-governance and document the empty-commit consumer PR by @​castrojo in #537
• ci(unit-tests): cover ghcr-cleanup.yml in the paths filter by @​castrojo in #534
• ci(actionlint): make the required check reachable on PRs and merge groups by @​castrojo in #536
• fix(setup-runner): support ubuntu-26.04 runners and skip resolute apt source (#541) by @​castrojo in #549
• ci(unit-tests): cover guarded release workflows in paths filter by @​kylerankin in #532
• ci: test the Renovate auto-merge merge/outcome step (issue #403) by @​mendezr in #516
• test(bootc-build): add coverage and drift guards for ghcr-cleanup action by @​mrbobbytables in #511
• fix(promotion): treat missing E2E as pending by @​castrojo in #527
• fix(promotion): gate merge status on evidence by @​castrojo in #526
• fix(release): harden promotion orchestration by @​castrojo in #525
• fix(promotion): trust only Actions E2E status by @​castrojo in #521
• fix(promotion): forward E2E status context by @​castrojo in #519
• fix(promotion): bind E2E evidence to source commit by @​castrojo in #515
• fix(promotion): gate queue enrollment on verification by @​castrojo in #513
• refactor(ci): narrow installer artifact contract by @​castrojo in #506
• fix(ci): upload only QEMU serial logs by @​castrojo in #505
• fix(ci): stage QEMU failure evidence by @​castrojo in #504
• fix(ci): grant runner access to KVM device by @​castrojo in #502
• feat(ci): add server installer QEMU workflow by @​castrojo in #501
• fix(renovate): target caller repository by @​Siddhj2206 in #460
• fix(release): normalize OCI registry namespaces by @​Siddhj2206 in #461
• fix(chunka): create config temp file as root to avoid protected_regular denial by @​Siddhj2206 in #497
• ci: add scheduled Renovate auto-merge wiring assertion (#403) by @​kylerankin in #498
• arch: enforce thin-caller size gate (issue #411) by @​mendezr in #472
• fix(sign-and-publish): mitigate SBOM exceeding GitHub Attestations 16MB limit (fixes #480) by @​mrbobbytables in #484
• fix(pkg-cadence): open a PR instead of pushing to main by @​kylerankin in #476
• fix(cadence): pass app credentials to reusable workflow (fixes #425) by @​mrbobbytables in #492
• chore(ci): narrow MergeRaptor app token permissions to what's needed (fixes #421) by @​mendezr in #478
• docs(supply-chain): record cosign install trust policy (upstream-pinned single mechanism; refs #464) by @​eltorrero in #491
• docs(skills): add session-hygiene skill and mandatory gate by @​castrojo in #424
• docs(skills): capture merge-queue, consumer-CI, and Renovate learnings by @​castrojo in #402
• docs(skills): bring remaining skill files into canonical skill spec conformance by @​mrbobbytables in #471
• ci: test the Renovate auto-merge PR-lookup matcher end-to-end by @​kylerankin in #488
• fix(factory): exclude cancelled/action_required from success rate by @​kylerankin in #495
• [sec-check] fix: declare top-level permissions: {} in consumer-validation and prune-merged-branches by @​mrbobbytables in #466
• test(bats): add unit tests for 4 bootc-build composite actions by @​castrojo in #451
• ci(unit-tests): expand bootc-build path filter to cover all actions by @​castrojo in #452
• fix(validate-pr): handle spaces in system_files shellcheck paths by @​castrojo in #454
• fix(chunka): avoid E2BIG by passing inspect JSON via file instead of argv by @​mendezr in #473
• fix(promote): skip queued promotion branch rebuilds by @​castrojo in #463
• fix(scan-image): fail-closed when trivy-results.json is missing by @​HuntedRaven7 in #427
• fix(workflows): add top-level permissions: {} to consumer-validation and prune-merged-branches by @​mrbobbytables in #456
• fix: add top-level permissions: {} to consumer-validation and prune-merged-branches workflows by @​mrbobbytables in #457
• fix(ci): pass RESOLVE_OK via env in release-gate verify step by @​mrbobbytables in #458
• fix(tests): isolate podman-missing bats test from preinstalled runner podman by @​mrbobbytables in #459
• fix(promote): make reviewer requests optional by @​Siddhj2206 in #455
• fix(bootc-build): use kernel overlayfs in reusable-build by @​KiKaraage in #443
• fix(renovate-automerge): await nonterminal check states instead of blocking by @​castrojo in #448
• docs(ujust): specify console QR codes for reports by @​kylerankin in #44
• docs: update scope to ujust report framework and remove stale references by @​castrojo in #41
• chore: remove lifecycle workflow and obsolete files by @​castrojo in #40
• fix(ci): read MERGERAPTOR_APP_ID from secrets in sync-templates by @​castrojo in #39
• ci: allow ubuntu-26.04 runner labels in actionlint config by @​castrojo in #38
• fix(report): require diagnostic Gists by @​castrojo in #36
• Rename 2026-12-30-brazilian-bluefin.md to 2026-09-30-brazilian-bluefi… by @​castrojo in #1442
• Publish blog post on Ubuntu's community building by @​castrojo in #1440
• feat(blog): draft post for How We Built Ubuntu's 65M+ Community by @​castrojo in #1439
• Add brazilian-bluefins blog post by @​delphicmelody in #1428
• perf(ci): build locales in parallel shards so build time stays flat by @​castrojo in #1420
• docs(i18n): translate installation, mission, values, command-line into Czech by @​Danathar in #1423
• fix(i18n): correct ExtensionManager Flathub link casing across 5 locales by @​castrojo in #1424
• i18n(de): translate index.md and UI strings for German by @​castrojo in #1421
• i18n(sv): translate index.md and UI strings for Swedish by @​kylerankin in #1409
• feat(i18n): translate docs: Indonesian (id) by @​kylerankin in #1413
• feat(i18n): translate core docs and UI strings into Vietnamese (vi) by @​kylerankin in #1405
• docs: translate index.md and UI strings to Spanish by @​kylerankin in #1414
• i18n(uk): translate index.md and UI strings for Ukrainian by @​kylerankin in #1416
• i18n(ko): translate index.md and UI strings for Korean by @​dtg01100 in #1418
• docs(analytics): describe the daily projectbluefin-countme ping by @​castrojo in #1355
• fix: give Utah a real tag series in the update-churn pipeline by @​dtg01100 in #1419
• docs: add Czech (cs) i18n translations by @​castrojo in #1408
• i18n(fr): translate index.md and UI strings for French by @​castrojo in #1415
• perf(ci): cut pages.yml build time — parallel fetch-data, verify job, leaner caches by @​castrojo in #1411
• i18n(hi): translate index.md and UI strings for Hindi by @​dtg01100 in #1410
• i18n(tr): translate index.md and UI strings for Turkish by @​dtg01100 in #1407
• i18n(ar): translate index.md and UI strings for Arabic by @​dtg01100 in #1406
• docs: translate docs into Chinese (Traditional) (zh-Hant) by @​castrojo in #1401
• docs: add Chinese (Simplified) zh-Hans docs translation by @​kylerankin in #1404
• i18n(pl): translate index.md and UI strings for Polish by @​kylerankin in #1402
• Add download section to Utah documentation by @​castrojo in #1403
• fix(i18n): close review gaps in translated builds by @​castrojo in #1400
• docs(skills): add countme reporting diagnosis procedure by @​castrojo in #1354
• feat(i18n): open 20 locales for PR-based docs translation by @​castrojo in #1379
• Change header style in blog post by @​castrojo in #1378
• Update blog on Bluefin development insights by @​castrojo in #1377
• Add section on project visualization with gource by @​castrojo in #1376
• Revise Bluefin development visualization blog post by @​castrojo in #1375
• feat: Bluefin development visualized blog post by @​castrojo in #1374
• fix(docs): point the Dakota page's Bluefin Classic link at /classic by @​castrojo in #1369
• fix(driver-versions): order tabs Bluefin, Server, Classic, Utah by @​castrojo in #1368
• Update Dakota alpha information and add Bluefin Classic note by @​castrojo in #1367
• Revise Dakota description and alpha status by @​castrojo in #1366
• Revise Bluefin Classic documentation by @​castrojo in #1365
• fix(images): name the catalog cards Bluefin and Bluefin Classic by @​castrojo in #1364
• feat(docs): order the Images catalog Bluefin, Classic, Utah by @​castrojo in #1363
• feat(docs): order Images sidebar and add the Classic legacy ISOs by @​castrojo in #1362
• feat(docs): remove Bluefin LTS and GDX from the site by @​castrojo in #1361
• Rename Dakota to Bluefin and update content by @​castrojo in #1360
• Revise Utah documentation for alpha status by @​castrojo in #1359
• Update warning message for legacy ISOs by @​castrojo in #1358
• Modify sidebar items and remove Donations category by @​castrojo in #1357
• Update Docusaurus config for Bluefin documentation by @​castrojo in #1356
• feat(analytics): read the Bluefin card from daily pings too by @​castrojo in #1350
• feat(analytics): add a Bluefin Utah chart between Bluefin and Bluefin Classic by @​castrojo in #1349
• docs(ai): replace ramalama with llmman by @​castrojo in #1348
• refactor(countme): cut /v1 to a daily ping counted per image by @​castrojo in #1347
• feat(countme): allowlist Bluefin image names and split daily counts per image by @​castrojo in #1346
• fix(countme): create eos tables in the Worker, drop the migration step by @​castrojo in #1345
• feat(countme): receive eos-phone-home pings in the canonical Worker by @​castrojo in #1344
• feat(countme): chart Bluefin stable and testing check-ins by @​castrojo in #1343
• feat(portal): source PortalNews from local blog index and align unavailable state by @​repires in #1340
• fix(countme): preserve raw pings outside published Dakota series by @​castrojo in #1342
• fix(countme): acknowledge Dakota reports after storage by @​castrojo in #1339
• feat(leaderboards): render Recent Milestones as horizontal scroller below Community Builders by @​castrojo in #1337
• feat(images): rework catalog for Bluefin Classic at ublue-os, Dakota, and Utah by @​castrojo in #1335
• feat(leaderboards): add Recent Milestones leaderboard as a ledger of teamwork by @​castrojo in #1336
• feat(leaderboards): add GNOME seasons and modern standings by @​castrojo in #1333
• refactor: route remaining hand-rolled GitHub auth sites through shared clients by @​sramkrishna in #1327
• fix(registry): support REGISTRY_CACHE_HOURS=0 to keep live task data fresh on deploy by @​castrojo in #1332
• fix(ci): allow manual force refresh on update-hive-cache workflow by @​castrojo in #1331
• fix(leaderboard): restore freshness and accurate contributor ranking by @​castrojo in #1330
• fix: typo in contributors name by @​ahmedadan in #1329
• refactor: route sbom GHCR token reads through shared githubToken by @​mendezr in #1315
• fix(branding): make the monthly social preview card actually rotate by @​Danathar in #1313
• docs: record the green-skip signature for a missing BLUEFIN_DISCUSSIONS_TOKEN by @​Danathar in #1299
• Fix link text for latest Dakota daily snapshot by @​castrojo in #1325
• Embed YouTube video and update GNOME release note by @​castrojo in #1326
• fix(blog): use plain anchor for full resolution link in ImageCarousel by @​castrojo in #1323
• Revise bug reporting link and add lore content by @​castrojo in #1322
• fix(blog): use group role and aria-current for ImageCarousel thumbnail strip by @​castrojo in #1321
• feat(blog): add ImageCarousel component and gallery to Dakota Alpha 6 post by @​castrojo in #1320
• docs(blog): Dakota Alpha 6 release announcement and downloads by @​castrojo in #1319
• docs(analytics): switch countme opt-out instructions to systemctl disable timer by @​castrojo in #1308
• fix(countme): scope first-party telemetry tracking exclusively to dakota by @​castrojo in #1307
• fix/countme dakota exclusive by @​castrojo in #1306
• fix(countme): label dakota first-party charts as Bluefin by @​castrojo in #1305
• fix(analytics): focus first-party active systems chart solely on dakota by @​castrojo in #1304
• fix(countme): map root chart aliases to dakota by @​castrojo in #1303
• docs(skills): document Bluefin Classic rebadge in cloudflare-workers by @​castrojo in #1302
• fix(countme): rebadge upstream ublue-os/bluefin chart as Bluefin Classic by @​castrojo in #1301
• [architect] fix: propagate typecheck and lint exit codes in pages.yml validation step by @​castrojo in #1297
• [ci] skip open-discussion job when BLUEFIN_DISCUSSIONS_TOKEN is unset by @​castrojo in #1296
• refactor: converge CJS GitHub fetchers onto the shared request-queue client (#1232) by @​castrojo in #1295
• fix(blog): restore scrollable viewport constraint to left sidebar by @​castrojo in #1284
• ci: run the unit-test gate on every PR and run the knowledge-mcp suite by @​Danathar in #1290
• Revise warning about Dakotaraptor and legacy ISOs by @​castrojo in #1280
• Add warning for unsupported images in downloads by @​castrojo in #1278
• ci: add unit test gate for scripts by @​castrojo in #1226
• Factory: Optimize layout by combining data sections into 2-column rows on desktop by @​mrbobbytables in #1228
• fix(cards): parse HTML release-feed tables before generating Bluefin cards by @​mrbobbytables in #1213
• fix(sbom): add Bluefin LTS NVIDIA stream and retire dx/gdx package queries by @​mrbobbytables in #1212
• [architect] Converge ESM GitHub fetch sites onto lib/gh.js (#1232) by @​kylerankin in #1236
• fix(countme): count every published image variant under its family by @​castrojo in #1250
• test: add update artwork seams by @​TB516 in #1238
• fix(analytics): name the legacy panel for the image it counts by @​castrojo in #1251
• fix(repos): repair moved GitHub slugs and preserve partial repository-stat cache by @​kylerankin in #1256
• test: cover safeNum and loadHistory in fetch-hive-history.js by @​kylerankin in #1255
• [architect] converge hive-live + factory-stats fetchers onto shared lib/gh.js by @​kylerankin in #1257
• test: cover scripts/lib coverage-gap modules (#905) by @​kylerankin in #1254
• Add link to wolves.projectbluefin.io and follow-up note by @​castrojo in #1252
• fix(analytics): make the weekly active systems labels readable by @​castrojo in #1249
• fix(countme): ink the upstream chart title by @​castrojo in #1248
• feat(countme): serve the upstream chart in the Bluefin palette by @​castrojo in #1247
• Revise analytics documentation for Project Bluefin by @​castrojo in #1246
• feat(analytics): fold game mode into its image and show the upstream series by @​castrojo in #1245
• fix(analytics): serve weekly active systems from the first-party aggregate by @​castrojo in #1244
• fix(analytics): remove manufactured copy from the weekly active systems panel by @​castrojo in #1243
• fix(analytics): stop publishing internal service posture in a panel reason by @​castrojo in #1242
• fix(analytics): count our own images, and drop the last bar charts by @​castrojo in #1241
• feat(analytics): put the charts on the Bluefin palette and the real image matrix by @​castrojo in #1240
• feat(analytics): rebuild the charts around the full image matrix by @​castrojo in #1239
• feat(portal): add brand iconography, Karl backlog callout, and quotes to Users and Developers scenes by @​castrojo in #1211
• [quality] test: unit coverage for scripts/lib/sbom/api.js (GHCR tags, oras download, cosign verification) by @​Danathar in #1210
• test(scripts): silence unused-arg lint warning in build-metrics test by @​castrojo in #1225
• fix: consolidate CI supply-chain pins, light-mode repairs, and scripts/lib test coverage by @​castrojo in #1223
• test(portal): provide fixture data in PortalContributors static render test by @​castrojo in #1209
• fix(gnome-extensions): render missing and unavailable extension data states by @​castrojo in #1177
• fix(cards): preserve prevVersion on header chips by @​castrojo in #1174
• fix(driver-versions): generate Bluefin LTS release links with stable tags by @​castrojo in #1208
• feat(portal): implement PortalPageLoading overlay and character asset preloader by @​castrojo in #1207
• fix(portal): resolve nested <main> landmark, focus suppression, and WCAG AA contrast by @​castrojo in #1206
• feat(portal): implement PortalNews component consuming blog feed by @​castrojo in #1205
• feat(portal): implement PortalFlock section with DNF Count Me growth chart by @​castrojo in #1204
• feat(portal): harmonize design tokens, Inter font stack, and unified 956px/512px breakpoints by @​castrojo in #1203
• feat(portal): add "Try Out" secondary hero CTA and seasonal raptor character rotation by @​castrojo in #1202
• fix(analytics): align Countme family sparkline domains with rendered images by @​castrojo in #1201
• fix(portal): update navbar test links to match production navbar by @​castrojo in #1200
• fix(analytics): include Dakota and Utah in edition and workstation chart series by @​Danathar in #1194
• fix(analytics): retain Countme zeros and preserve missing values as gaps by @​Danathar in #1191
• fix(portal): reconcile TopNavbar navigation links and Docusaurus layout header by @​Danathar in #1169
• feat(portal): restore complete mission statements, Edith Wharton quote, and punchline by @​mrbobbytables in #1155
• fix(feed-items): supply NVIDIA versions at the data shape the release feed consumes by @​mrbobbytables in #1178
• fix(profiles): remove nonexistent chandeleer1698 GitHub username by @​mrbobbytables in #1151
• fix(pin-state): replace removed Bluefin LTS HWE workflow paths by @​Danathar in #1185
• fix(factory): calculate merged-this-week from merged pull requests by @​Danathar in #1190
• fix(factory): replace the Hive snapshot CTA hostname with a valid TLS endpoint by @​Danathar in #1189
• fix(factory): use a public queue-data fallback for anonymous visitors by @​Danathar in #1188
• fix(factory): render an unavailable change-failure rate instead of 0.0 percent by @​Danathar in #1187
• fix(sbom): migrate Bluefin LTS stream specs to its package and stable tags by @​Danathar in #1186
• fix(contributors): prevent visitor-side GitHub requests when contributor data is unavailable by @​mrbobbytables in #1197
• fix(countme): recognize Dakota and Utah without misclassifying Bluefin variants by @​mrbobbytables in #1198
• fix(blog): replace Printful CDN hotlinks blocked on five-years-of-bluefin by @​Danathar in #1196
• fix(catalog): generate Bluefin LTS rebases against the bluefin-lts package by @​Danathar in #1195
• fix(images): hide unpublished Utah testing image commands and attestations by @​Danathar in #1193
• fix(blog): remove expired Discourse CDN images from ublue-2024 wrap-up by @​Danathar in #1199
• fix(sbom): support version-qualified live tags in recent-release discovery by @​Danathar in #1163
• feat(portal): resolve 7 package version rows for Dakota product card by @​Danathar in #1164
• fix(ci): make generate-social-cards exit 0 when converters are missing by @​castrojo in #1182
• feat(analytics): modernize analytics and churn charts, promote page to top level by @​castrojo in #1181
• feat(branding): add rotating monthly night wallpaper social preview card by @​castrojo in #1179
• feat(branding): implement new social preview cards for documentation by @​castrojo in #1068
• fix(cards): parse HTML release-feed tables before generating Bluefin cards by @​castrojo in #1126
• fix(blog): replace Printful CDN hotlinks blocked on five-years-of-bluefin by @​castrojo in #1125
• fix(contributors): prevent visitor-side GitHub requests when contributor data is unavailable by @​castrojo in #1124
• fix(feed-items): supply NVIDIA versions at the data shape the release feed consumes by @​castrojo in #1123
• fix(gnome-extensions): render missing and unavailable extension data states by @​castrojo in #1122
• fix(pin-state): replace removed Bluefin LTS HWE workflow paths by @​castrojo in #1121
• fix(factory): render an unavailable change-failure rate instead of 0.0 percent by @​castrojo in #1120
• fix(factory): use a public queue-data fallback for anonymous visitors by @​castrojo in #1119
• fix(factory): replace the Hive snapshot CTA hostname with a valid TLS endpoint by @​castrojo in #1118
• fix(factory): calculate merged-this-week from merged pull requests by @​castrojo in #1117
• fix(analytics): calculate and format hero deltas for the selected range by @​castrojo in #1116
• fix(blog): remove expired Discourse CDN images from ublue-2024 wrap-up by @​castrojo in #1114
• fix(images): hide unpublished Utah testing image commands and attestations by @​castrojo in #1113
• fix(analytics): include Dakota and Utah in edition and workstation chart series by @​castrojo in #1111
• fix(analytics): retain Countme zeros and preserve missing values as gaps by @​castrojo in #1110
• fix(analytics): align Countme family sparkline domains with rendered images by @​castrojo in #1109
• fix(repos): repair moved GitHub slugs and preserve partial repository-stat cache by @​castrojo in #1107
• fix(sbom): migrate Bluefin LTS stream specs to its package and stable tags by @​castrojo in #1106
• fix(countme): recognize Dakota and Utah without misclassifying Bluefin variants by @​castrojo in #1105
• fix(driver-versions): generate Bluefin LTS release links with stable tags by @​castrojo in #1104
• fix(catalog): generate Bluefin LTS rebases against the bluefin-lts package by @​castrojo in #1102
• fix(profiles): remove nonexistent chandeleer1698 GitHub username by @​castrojo in #1101
• feat(portal): implement PortalNavigation floating dock and section scroll spy by @​mrbobbytables in #1153
• feat(portal): implement PortalContributors component and contributor harvester workflow by @​mrbobbytables in #1156
• fix(portal): update deprecated ublue-os links and synchronize Discord invite code by @​Danathar in #1165
• fix(portal): align Utah ecosystem card link destination to devconf.us by @​mrbobbytables in #1159
• feat(portal): generate bootc switch terminal command and copy button in PortalImageChooser by @​mrbobbytables in #1152
• test: add coverage reporting for data-fetching script tests by @​mrbobbytables in #1061
• fix(sbom): support version-qualified live tags in recent-release discovery by @​mrbobbytables in #1128
• feat(portal): add interactive image picker by @​castrojo in #1131
• feat(portal): complete static landing sections by @​castrojo in #1130
• feat(portal): add parallax portal prototype by @​castrojo in #1127
• docs: add Copilot workflow instructions by @​castrojo in #1108
• fix: link leaderboard contributor dossiers by @​castrojo in #1103
• fix: restore Hive leaderboard data and styling by @​castrojo in #1076
• feat: add standalone Hive leaderboards by @​castrojo in #1071
• feat(analytics): add update churn rate pipeline, analytics charts, and trigger workflow by @​castrojo in #1070
• feat: add Hive leaderboards landing by @​castrojo in #1069
• feat(nav): rename Factory to Hive in navbar linking to hive.projectbluefin.io by @​castrojo in #1058
• docs: announce Bluefin Server by @​castrojo in #1066
• fix(images): point bluefin-lts to projectbluefin/bluefin-lts package and update catalog by @​castrojo in #1067
• feat(analytics): unify Bluefin family countme charts and multi-image catalog by @​castrojo in #1065
• feat(analytics): add legacy bluefins and ecosystem countme analytics charts by @​castrojo in #1063
• feat(reports): migrate monthly reports to blog with infograms and Hive Leaderboard by @​castrojo in #1059
• fix: restrict countme worker entrypoint exports to default handler by @​castrojo in #1060
• docs: announce mcp.projectbluefin.io and update hive links by @​castrojo in #1057
• feat(mcp): serve the org knowledge base at mcp.projectbluefin.io by @​castrojo in #1055
• feat: refine image navigation, fix driver versions catalog, and track stable streams by @​castrojo in #1050
• feat(branding): use new Bluefin wordmark in docs and drop ublue 'u' by @​castrojo in #1043
• Add link to upstream doc about IME setup by @​sebjag in #1038
• fix(e2e): deliver the kickstart through an initramfs overlay by @​Danathar in #74
• fix(ci): restore ISO rename output and soft-fail arm64 legs by @​hanthor in #70
• fix(just): resolve sudo via PATH in sudoif and pass arguments without word-splitting by @​castrojo in #394
• fix(justfile): make the final artifact move idempotent in _build-bib by @​mendezr in #412
• ci(workflow): correct sync-stable-to-main header comment by @​kylerankin in #413
• ci(workflow): retry just download in unit-tests by @​kylerankin in #414
• fix(build): write an unverified update ref instead of a signed one by @​Danathar in #406
• fix(ci): skip Renovate when the token is not set by @​Siddhj2206 in #395
• ci(promote): stop citing the deleted scheduled approver by @​Danathar in #404
• fix(ci): restore merge_group trigger to pr-validation and unit-tests by @​castrojo in #418
• refactor: full rewrite of the template by @​castrojo in #393
• refactor: full rewrite of the template by @​Siddhj2206 in #383
• docs: document E2E gap as intentional release risk (#281) by @​mrbobbytables in #328
• ci: auto-approve action_required checks on trusted promotion PRs by @​mrbobbytables in #335
• fix(ci): validate Brewfiles statically instead of evaluating them as Ruby by @​Siddhj2206 in #320
• fix(just): use a per-invocation temp file for the registry tag list by @​Siddhj2206 in #314
• ci: run BATS unit tests on PRs touching build, tests, or Justfile by @​Siddhj2206 in #317
• fix(ci): stop inheriting all repo secrets in label-enforcement by @​Siddhj2206 in #318
• fix(just): build IMAGE_NAME from target_image so renames upgrade correctly by @​Siddhj2206 in #313
• fix(ci): derive ghcr-cleanup target from the repository name by @​Siddhj2206 in #319
• fix(ujust): stop install-jetbrains-toolbox when the checksum fails by @​Siddhj2206 in #315
• fix(just): repair clean recipe so it finishes and removes all artifacts by @​Siddhj2206 in #312
• fix(packages): stamp the provenance report from SOURCE_DATE_EPOCH, not the wall clock by @​dtg01100 in #343
• ci: add a tested factory-pin rev tool for #336 by @​dtg01100 in #337
• fix(packages): pin the baseurl of every allowlisted repository by @​dtg01100 in #334
• test(services): enforce the unit exit-tolerance convention by @​dtg01100 in #341
• fix(hooks): stamp 20-home-labels.sh after the body runs by @​dtg01100 in #327
• fix(e2e): accept substituted sentinel reads and re-read before reshooting by @​hanthor in #381
• fix(build): re-declare the factory pin ARG so the label bakes its value by @​hanthor in #374
• fix(build): key the package transaction on the factory pin, fail loud on skew by @​hanthor in #373
• chore(deps): update packages pin to GNOME 51.0 finals build by @​hanthor in #359
• test: label parity-ref tests as #152 pinned-ref work by @​kylerankin in #356
• docs: correct stale package-image copy statement in package-contract by @​kylerankin in #333
• fix(packages): reject proxy and sslverify=0 in allowlisted repositories by @​mendezr in #351
• fix(ci): let the kernel cache verify accept dispatch-run signatures by @​mendezr in #348
• feat(packages): add alsa-utils, restoring kernel mixer state across reboots by @​castrojo in #297
• fix(ci): sign the kernel cache digest the registry actually stored by @​kylerankin in #317
• chore(ci): bump actions pin for GNOME 51 gate fixes by @​hanthor in #315
• chore(ci): point release reusable at actions with preset-proof gate sshd by @​hanthor in #310
• feat(kernel): build v4l2loopback for every flavor's kernel by @​Danathar in #298
• fix(packages): add default-fonts-core-emoji to the parity contract by @​buggtb in #296
• fix(image): strip extension build toolchain closure from shipping image by @​hanthor in #295
• fix(iso): retry flaky Flathub pulls 5x so a timeout window can't fail E2E by @​hanthor in #285
• feat(packages): printing and cameras, from the 2026-09-26 factory image by @​hanthor in #282
• fix(selinux): keep Hummingbird's useradd HOME; only generate the rules from /home by @​hanthor in #283
• fix(selinux): label /var/home so GNOME Initial Setup can create the account by @​hanthor in #281
• fix(iso): build the tacklebox live ISO with release compression by @​hanthor in #280
• feat(iso): installs boot to GNOME Initial Setup, as Bluefin and Dakota do by @​hanthor in #279
• feat(packages): pin the 2026-09-26 factory image; Wi-Fi, Files, phones, printing, Initial Setup by @​hanthor in #265
• fix(packages): install samba, samba-winbind and samba-winbind-clients by @​buggtb in #268
• fix(ci): scope download-integrity clearance to each fetch by @​mendezr in #233
• feat: build live ISOs for unpublished variants via tacklebox by @​hanthor in #252
• fix(iso): installed systems get their Flatpaks (the dock was empty) by @​hanthor in #272
• fix(iso): retry flatpak remote-add, which fetches over the network by @​hanthor in #270
• chore(iso): pin bootc-installer v2026.09.25-51f8cfe6 (offline installs of Utah work) by @​hanthor in #269
• feat(baselines): measure Utah against the published Bluefin and Dakota images by @​hanthor in #264
• fix(parity): install the Bluefin base packages Utah can resolve today by @​hanthor in #266
• fix(e2e): count flatpak runtimes when checking the offline default set by @​hanthor in #267
• fix(iso): let the installer create the first account by @​hanthor in #260
• fix(iso): keep the listed GTK3 theme runtimes in the live ISO by @​hanthor in #256
• fix(desktop): enable per-user services — installed Utah had no audio by @​hanthor in #255
• fix(boot): installed systems boot again — keep the base's shim-paired GRUB, guard the EFI chain (#253) by @​hanthor in #254
• fix(iso): separate installed-desktop and installed-fastfetch captures by @​repires in #243
• ci: opt the testing stream into rechunking and build SBOMs by @​mendezr in #226
• fix(packages): install device firmware, which the bootable base ships none of by @​sramkrishna in #236
• fix: mask serial-getty@ttyS0 so desktops stop spamming the journal by @​sramkrishna in #235
• fix: repoint install-flatpaks.sh at tuna-os/bootc-installer by @​Danathar in #219
• ci: retain gated production ISO artifacts by @​Danathar in #198
• fix(iso): tighten live ISO size budget by @​Danathar in #206
• chore(deps): update actions/upload-pages-artifact action to v5 by @​hanthor in #234
• ci: gate the live boot on the UTAH_LIVE_READY serial marker by @​mendezr in #229
• fix(iso): force software GL rendering for the E2E test's terminal by @​Danathar in #224
• test(installer): assert offline payload and default Flatpaks survive encrypted install by @​Danathar in #215
• test: cover btrfs live-kernel contract by @​Danathar in #207
• ci: document Utah testing-stream rechunk gate by @​Danathar in #205
• docs: close README/skill package-count drift against the manifests by @​Danathar in #225
• fix(flavors): single-source flavor to image name mapping in flavors.py by @​mrbobbytables in #144
• fix(desktop): enable input-remapper.service for desktop input devices by @​mrbobbytables in #148
• ci(parity): pin check-parity upstream fetch to committed revision by @​mrbobbytables in #152
• ci: stop a testing build cancelling the one before it, which is losing the ISO evidence the release gate needs by @​hanthor in #185
• ci(release): stop a missed stable release from looking exactly like a normal merge by @​hanthor in #195
• fix: fall back to kernel module tree and refuse empty kernel releases in verify-rpm-contract by @​mrbobbytables in #204
• fix: enable PipeWire user units so GNOME screencast can start by @​KiKaraage in #177
• fix(installer): harden live-media boot paths and define Secure Boot strategy by @​mrbobbytables in #143
• Retry Flathub pulls, so one timed-out object cannot fail a flavor's ISO by @​hanthor in #162
• fix(nvidia): bump the driver for kernel 7.2, and make the base bump actually build by @​hanthor in #182
• fix(packages): correct evolution-ews-core parity debt after EDS closure builds by @​kylerankin in #191
• fix: disable nvidia-container repo on non-NVIDIA flavors by @​kylerankin in #192
• ci: drop timestamp from generated skill catalog to avoid merge conflicts by @​mrbobbytables in #193
• site: publish a status and project information page on GitHub Pages by @​hanthor in #164
• fix(image): stop shipping the 4 GB package repository in every image, and check Hummingbird signatures by @​hanthor in #133
• fix: enable the btrfs kernel module in the OGC gaming-flavor kernel by @​kylerankin in #158
• ci: stop fork pull requests failing on a GHCR permission they cannot have by @​hanthor in #184
• fix(packages): single-source install repository identity in packages/*.repo by @​mrbobbytables in #146
• fix(desktop): mask bootc-fetch-apply-updates across cross-vendor etc merge by @​mrbobbytables in #153
• fix: stop shipping the 4 GB package repository in every image (#128) by @​kylerankin in #156
• test(ci): add unit tests for check-download-integrity and check_workflow_outputs by @​mrbobbytables in #147
• fix: enable bluetooth.service for desktop adapters by @​kylerankin in #125
• feat(packages): install what Bluefin inherits from Fedora's base and Hummingbird already has by @​hanthor in #129
• fix(iso): get the LUKS end-to-end test green on all four flavors by @​hanthor in #94
• test: unit coverage for scripts/flavors.py flavor-matrix queries — new tests/test_flavors.py, just test recipe by @​mendezr in #118
• fix(uupd): pin and verify uupd.service/uupd.timer against committed digests by @​kylerankin in #124
• fix(e2e): capture the fastfetch shot at 1080p, with its logo by @​hanthor in #112
• fix(packages): ship glibc-all-langpacks so a chosen locale exists by @​hanthor in #116
• fix: keep GSConnect loading on GNOME 51 (clipboard final-type) by @​mrbobbytables in #89
• fix: resolve OGC kernels when assembling live ISOs by @​hanthor in #87
• fix(iso): repair CI handoff, payload digests, and live kernel support by @​hanthor in #86
• ci: automate LUKS ISO validation and screenshot evidence by @​hanthor in #84
• Build the Utah ISO, install it to an encrypted disk, and prove the desktop starts by @​hanthor in #41
• fix(build): resolve the pinned package contract before composing Utah by @​hanthor in #82
• docs: Utah's current status by @​HuntedRaven7 in #31
• feat: compose Utah from a local package repository by @​hanthor in #37
• supply-chain: pin and verify executable image and installer downloads by @​hanthor in #32
• ci: stop main waiting on the kernel cache; cut layer overhead per flavor by @​hanthor in #33
• feat: build zram-generator packages by @​mendezr in #294
• feat: build zram-generator packages (carries #294) by @​castrojo in #301
• fix(ci): report nothing for a cancelled run instead of every package as failed (carries #271) by @​castrojo in #300
• feat(feeds): poll 68 more upstreams via explicit lock feeds by @​hanthor in #296
• fix(libadwaita): drop obsolete sassc backport, merged upstream in 1.10.0 by @​hanthor in #299
• fix(gsettings): drop GConf .convert files removed upstream in GNOME 51.0 by @​hanthor in #298
• chore(gnome): bump the GNOME 51 stack off prerelease to 51.0 finals by @​hanthor in #295
• feat(supply-chain): lock factory buildroots and require recipe provenance by @​Danathar in #186
• fix: retry the hermetic lane's online steps and package v4l-utils' udevd drop-in by @​clubanderson in #288
• fix(sources): reset release on upstream version bumps by @​arteeh in #281
• fix(ci): drop canary inject_failure from build matrix (#285) by @​mrbobbytables in #286
• ci(validate): give check_workflow_quoting and runtime_contract a PR-wide trigger by @​buggtb in #282
• feat(libass): update to 0.17.5 by @​hanthor in #266
• fix: prevent lock screen password controls from overlapping by @​arteeh in #290
• feat(ci): let a dispatch build and publish only named packages by @​hanthor in #279
• fix(printing): import pdfio for libcupsfilters, and rebuild libgphoto2 by @​hanthor in #278
• fix(enchant2): build without the Nuspell backend by @​hanthor in #276
• feat(publish): resolve the blocking transaction in Utah's pinned base by @​hanthor in #277
• fix(build): resolve the hermetic root with best=0, like the container lane by @​hanthor in #275
• feat(publish): publish each wave's successes as that wave finishes by @​hanthor in #274
• fix(publish): a bootstrap build never replaces the real package by @​hanthor in #273
• fix(publish): resolve Utah's install set in Utah's own base image by @​hanthor in #272
• feat(publish): resolve what Utah actually installs, and track each gap by @​hanthor in #270
• fix(publish): import libexif and ghostscript for libgphoto2 and libppd by @​hanthor in #269
• fix(plan): call a published build stale only when its soname moved by @​hanthor in #268
• feat(xdg-terminal-exec): update to 0.14.3 by @​hanthor in #265
• feat(build): make the hermetic mock lane the default by @​hanthor in #264
• fix(publish): let a re-run publish over its own earlier attempt by @​hanthor in #262
• fix(ci): keep a canary dispatched on main away from the tracking issue by @​hanthor in #261
• feat(build): hermetic mock lane -- lock the build root, build offline from the lock by @​hanthor in #260
• feat(build): rebuild what changed and what BuildRequires it, on every merge by @​hanthor in #259
• ci(build): retry a failed %check once before failing the package by @​hanthor in #256
• feat(publish): publish each good build, keep a failed package's previous one by @​hanthor in #258
• ci(canary): prove pipeline changes on the real workflow in minutes by @​hanthor in #257
• fix(buildroot): keep the pin in config/ and move it to the first mirror image by @​hanthor in #255
• ci(buildroot): factory-owned build-root mirror, and a cache key that survives a publish by @​hanthor in #252
• fix(publish): lead the repository image with a repodata-only layer by @​hanthor in #254
• feat: import Utah runtime dependencies with no factory recipe by @​hanthor in #246
• fix(publish): log in for the provenance attestation and keep it from failing a publish by @​hanthor in #253
• fix(python-pydantic-core): BuildRequire python3-packaging for %prep by @​hanthor in #250
• fix(publish): close the ffmpeg and libosinfo runtime closure by @​hanthor in #249
• fix: restore python-pydantic and build pydantic-core from vendored crates by @​hanthor in #248
• fix(librist): backport upstream's nettle 4.0 support by @​hanthor in #245
• chore: remove python-pydantic and python-pydantic-core from the factory by @​hanthor in #244
• fix(libppd): include <cstdint> before cups/transcode.h by @​hanthor in #243
• fix(librist): correct the 0.2.11-1 changelog year so rpm accepts the spec by @​hanthor in #242
• fix(srt): build with the OpenSSL EVP backend instead of gnutls+nettle3.10 by @​hanthor in #241
• fix(ci): upgrade libxml2 to Hummingbird's split release before builddep by @​hanthor in #240
• fix(grub2): efi_vendor=fedora so GRUB sits beside Utah's shim (Utah install e2e red since 09-21) by @​hanthor in #238
• test: gate architecture inventory counts by @​Danathar in #194
• fix(factory): source rebuild matrix package set from source_locks by @​repires in #232
• fix(import): skip factory-sourced packages in Rawhide resolver by @​mrbobbytables in #185
• refactor(ci): align Justfile check with CI workflow gate catalog by @​mrbobbytables in #196
• fix(ci): verify cosign signature before seeding from the factory image by @​Danathar in #215
• fix(ci): gate sccache setup to mozjs140 to prevent token exposure by @​repires in #227
• fix(validate): refuse a recipe that silences its own %check by @​Danathar in #197
• fix(publish): close the consumer-transaction dep closure by @​hanthor in #229
• fix(dist_bump): tolerate macro-based Release fields (carries #100) by @​hanthor in #138
• fix(verify): pin srt, libcue, game-music-emu, cjson to Fedora lookaside primaries by @​hanthor in #231
• feat(printing): add cups-filters, cups-browsed, libcupsfilters, and libppd recipes by @​mrbobbytables in #214
• ci(audit): pin pyyaml and declare it for the unit tests job by @​mendezr in #221
• feat(packages): import google-noto-color-emoji-fonts and stix-fonts recipes by @​mrbobbytables in #199
• docs: define ORAS source lookaside policy by @​mrbobbytables in #189
• fix(linux-atm): pin kernel-headers to 6.19.6 for atmsvc.h by @​hanthor in #218
• fix: exclude libicu-77 from every build root by default, with per-package opt-in by @​hanthor in #217
• feat: ppp/libpcap/linux-atm/libgda closure parity (utah-packages#149) by @​kylerankin in #203
• feat: add libfprint + fprintd recipes for fingerprint login parity (#145) by @​kylerankin in #204
• feat: import microcode_ctl for CPU errata parity by @​kylerankin in #205
• fix(scan): skip malformed repoquery lines instead of crashing the scan by @​kylerankin in #206
• feat: add alsa-utils recipe for mixer-state restore (Dakota parity) by @​kylerankin in #202
• fix(rebuild): build nautilus-python after nautilus by @​Danathar in #213
• fix(gaps): drop runtime-contract [unavailable] packages from the parity report by @​mendezr in #207
• fix(renovate): require human review for github-actions updates by @​mrbobbytables in #193
• fix(factory): defer base packages to Hummingbird by @​hanthor in #191
• docs(ci): preserve the package cache contract by @​hanthor in #184
• feat(ci): restore and publish per-package RPM cache by @​hanthor in #183
• feat(ci): cache key for per-package build reuse, and the rule for when to use it by @​hanthor in #178
• fix: enforce recipe-set agreement across the three package sources by @​kylerankin in #164
• fix(dist_bump): tolerate macro-based Release fields by @​kylerankin in #100
• ci: pin zstandard version in rebuild-rpms prepare job (#105) by @​mendezr in #109
• ci: pin zstandard in the prepare job (carries #109) by @​hanthor in #137
• fix(quality): add missing provenance for gnome-desktop3 and malcontent-bootstrap by @​mrbobbytables in #98
• fix(ci): guard build toolchain containers against mutable tags by @​kylerankin in #110
• fix(workflows): bind rawhide dispatch inputs via env, not run interpolation by @​kylerankin in #114
• Build the whole Utah contract: 343 recipes, Firefox as a Flatpak, four stage failures fixed by @​hanthor in #70
• test: add unit coverage for tools/scan_rawhide_state.py by @​kylerankin in #99
• fix(ci): pin build toolchain containers by digest by @​kylerankin in #88
• ci: repin Packit SRPM image to live digest by @​Danathar in #85
• fix(buildroot): exclude legacy ruby default-gems from Hummingbird repo by @​mrbobbytables in #83
• fix(tailscale): disable incompatible jsonv2 experiment by @​Danathar in #86
• ci: publish factory repositories atomically after closure validation by @​kylerankin in #89
• fix(gcc): drop gcc from the rebuild set, let Hummingbird supply it by @​kylerankin in #90
• fix(batch): consolidate verified fixes for tools, ci checksum, rawhide import, and contract (#71, #72, #56, #57) by @​castrojo in #92
• refactor(tools): wrap check_workflow_quoting and validate in testable functions by @​castrojo in #73
• ci: make the compiler cache outlive the build container by @​hanthor in #33
• fix: keep GSConnect loading on GNOME 48+ (clipboard final-type) by @​hanthor in #53
• feat: compose a local Utah package repository by @​hanthor in #34
• feat(packit): wire packit srpm into a real pilot job by @​castrojo in #41
• fix(packit-sdk): use upstream quay.io/packit/packit instead of rebuilding by @​castrojo in #40
• fix(packit-sdk): publish as ghcr.io/projectbluefin/packit-sdk by @​castrojo in #38
• fix(packit-sdk): share DOCKER_CONFIG auth between podman and cosign by @​castrojo in #37
• feat(packit-sdk): add pinned Packit+Mock build image by @​castrojo in #36
• ci: build WebKitGTK as two shards on two runners by @​hanthor in #32

Dakota (GNOME OS Prototype)​

• feat(bluefin): ship ChairLift's privileged helper, policy and schemas by @​castrojo in #1680
• fix(next): apply Dakota fdsdk patches and mesa-extra on next by @​ahmedadan in #1700
• fix(next): apply Dakota fdsdk patches and mesa-extra on next by @​ahmedadan in #1696
• feat(image): enable hardware video codecs for host apps by @​ahmedadan in #1687
• fix(ghostscript): avoid CMYK crash in ROM profiles by @​ahmedadan in #1682
• feat(image): ship nspawn for OCI-backed nspawn machines by @​ahmedadan in #1681
• fix(libvirt): restore PolicyKit-authorized access by @​ahmedadan in #1673
• fix(image): make /usr/local a real link to /var/usrlocal by @​ahmedadan in #1661
• fix(ci): require diagnostic report intake by @​castrojo in #1528
• feat(bluefin): add user-configured IBus Rime with Lua support by @​KOTONEX in #1662
• revert(countme): restore pre-session common pin (#1649, #1656) by @​castrojo in #1657
• fix(countme): pin shared weekly reporter by @​castrojo in #1656
• fix(image): vendor libvirt and make shadowed packages actually ship by @​ahmedadan in #1651
• fix(countme): ship shared Dakota reporter by @​castrojo in #1649
• feat(countme): remove local countme client and units by @​castrojo in #1622
• ci(release): require explicit stable promotion by @​ahmedadan in #1637
• fix(gnome-shell): use portable unzip flags for extension installs by @​ahmedadan in #1628
• fix(virtualization): prevent default NAT firewall failures by @​ahmedadan in #1625
• fix(ujust): drop flatpak -y so polkit can prompt by @​ahmedadan in #1630
• fix(bluefin): stop GDM fingerprint retry loop on unenrolled readers by @​ahmedadan in #1627
• ci: gate merges on the PR build when a PR is labeled build by @​ahmedadan in #1618
• fix(kernel): carry hid-asus build fix for OGC 7.2.6-ogc1 by @​ahmedadan in #1617
• fix(kernel): carry hid-asus build fix for OGC 7.2.6-ogc1 on next by @​ahmedadan in #1616
• chore(kernel): bump OGC gaming kernel to 7.2.6-ogc1 on testing by @​ahmedadan in #1613
• chore(kernel): bump next to 7.3-rc3 and OGC 7.2.6-ogc1 by @​ahmedadan in #1612
• ci: label-gated PR builds and SBOM job repair by @​ahmedadan in #1610
• fix(ci): smoke-test the image Publish built, not the default-branch tip by @​Danathar in #1605
• fix(ci): pin cosign to a digest-pinned installer instead of releases/latest by @​Danathar in #1606
• chore(just): drop the monitor-pipeline recipe whose script no longer exists by @​Danathar in #1607
• feat(ghostty): disable resize overlay by default to prevent Wayland loop by @​castrojo in #1571
• fix(kernel): restore desktop capabilities across streams by @​ahmedadan in #1598
• ci(next): empty NEXT_MERGED and track GBM master by @​ahmedadan in #1590
• chore(next): track gnome-build-meta master by @​ahmedadan in #1589
• feat: NVIDIA 615.71.09 and freedesktop-sdk 26.08.1 on testing by @​ahmedadan in #1588
• feat: GNOME 51 and freedesktop-sdk 26.08 on testing by @​ahmedadan in #1579
• ci(arm): pause automation until boot validation works by @​ahmedadan in #1566
• fix(chunkah): fetch remote companion data before reading by @​ahmedadan in #1564
• feat(chunkah): generate ownership during image builds by @​ahmedadan in #1563
• feat(extensions): update syncthing-toggle to bluefin-bling v2 by @​castrojo in #1557
• fix(ci): isolate ChairLift tests from runner defaults by @​ahmedadan in #1550
• fix(brew): migrate ChairLift off the Frostyard tap by @​ahmedadan in #1542
• fix(desktop): avoid broken and intrusive defaults by @​ahmedadan in #1538
• fix(next): avoid adjacent dependency sync conflict by @​ahmedadan in #1526
• fix(skills): make factory frontmatter parseable by @​ahmedadan in #1525
• fix(extensions): preserve metadata when extracting ZIPs by @​ahmedadan in #1518
• docs(factory): audit documentation and standardize skills by @​castrojo in #1516
• feat(launcher): package vicinae and bind launcher toggle to Super+Space by @​castrojo in #1515
• feat(ghostty): configure dual-theme to track GNOME Dark/Light style by @​castrojo in #1514
• feat(extensions): swap bluetooth-battery-meter for budslink-companion and preinstall flatpak by @​castrojo in #1512
• feat(extensions): package and enable quick-settings-audio-panel by @​castrojo in #1511
• feat(extensions): package curated gnome shell extensions by @​castrojo in #1510
• fix(devmode): adapt developer setup to Dakota by @​ahmedadan in #1509
• fix(fastfetch): inherit Bluefin presentation from common by @​ahmedadan in #1507
• chore(build): remove unreachable architecture configuration by @​ahmedadan in #1499
• fix(scripts): gen-filemap refuses partial caches, tests pin kernel match by @​ahmedadan in #1484
• feat(kernel): Linux 7.2 bump with Fedora-audited hardware enablement by @​ahmedadan in #1473
• ci: revalidate retargeted PRs and document CI-run Justfile recipes by @​ahmedadan in #1485
• fix(ci): open monthly filemap PRs against testing, not main by @​ahmedadan in #1467
• fix(ci): sync-next owns files/linux-ogc with the rest of the kernel set by @​ahmedadan in #1475
• chore(packages): bump uwelcome to v0.3.5 for the portal timeout fix by @​ahmedadan in #1462

Contributors​

Sources​

• github-activity: available (2026-09-01 to 2026-09-30): source
• github-lanes: available (2026-09-01 to 2026-09-30): source
• github-releases: available (2026-09-01 to 2026-09-30): source
• github-releases: available (2026-09-01 to 2026-09-30): source
• github-releases: available (2026-09-01 to 2026-09-30): source
• countme: unavailable — Countme active-system measurement is incomplete. (2026-09-01 to 2026-09-30): source
• homebrew: available (2026-09-01 to 2026-09-30): source
• flathub: available (2026-09-01 to 2026-09-30): source

Endless Forms most Beautiful​

I wanted to capture the recent swarm of activity in the project lately, so I turned to a trusted tool: gource. This is a visualization tool that makes git activity look cool. We needed something that showed how Bluefin used to be, to how Bluefin is now. Here's the past few months:

Some high points:

• 02:59 — Starting up the Bluefin Factory with Hive - Prepping for the clankers to start their work. Here you find me frantically realizing that it's only a few months to GitHub Universe so you see me doing a bunch of fixes in the docs and YAML files in order to prepare for the automation
• 04:00 — Where Hive is introduced and mostly turned on

I'll likely refresh this in a few weeks since we're really grooving now and getting in lots of fixes. We'll see how it plays out over the next month or so! I think this graphical representation is quite cool. It's a good graphical representation that shows how we went from manual mode to agentic mode. It's also nice that everything is MORE SPREAD OUT across MORE people instead of just a few. The next few months will be the real test to see how we do! Check clankers.projectbluefin.io for contribution instructions if you want to check it out!

For me the reviewer role has changed significantly. We have testing branches and test suites now so we can do better reviews instead of "this is mostly fine if it breaks users will tell us.". There's still a lot of that of course, we can never know who is using every knob in an operating system. Mostly now I review things in my omp harness and watch things scroll by slowly. Sometimes I need to steer/adjust but these days it's more acking each other's reviews. This is particular handy with James being in India, we can leave each other homework to review since every change still needs a +2 from maintainers.

Here's two more, both on manual mode:

Bazzite​

Aurora​

Dakota Alpha 6 is out. This one is brought to you by Ahmed Adan/ Built against GNOME 51 and freedesktop-sdk 26.08.1, running Linux 7.2.6, NVIDIA 615.71.09. Kernel OGC 7.2.6-ogc1 for your gaming needs.

This one certainly feels good! Please remember that we still do NOT support secure boot, so temper your expectations! Here's the changelog, I'll make a video on this one since we have a lot to discuss!

Version matrix​

Alpha 5 baseline values are from tag stable-20260731 (as reflected in the Alpha 5 release announcement):

Note on kernel and bootc: Dakota pins its kernel at 7.2.6 via elements/core/linux-fdsdk.bst (ahead of freedesktop-sdk 26.08.1's default of 7.2.2) and pins bootc at 1.16.13 via elements/gnomeos-deps/bootc.bst (ahead of gnome-build-meta's default of 1.16.6).

GNOME 51 "A Coruña" was officially released on September 16, 2026 — see the official release notes.

Migrating Major GNOME Versions​

This is the first time we utilized dakota:next tracking a dev release, and Ahmed smoothly transitioned the testing branches through these:

Kernel and hardware​

Here's a bunch of enablement crap:

Desktop​

And some of the upcoming desktop improvements that we've been going over in the Discussions:

Game Mode​

Bluefin's "Game Mode" is fleshed out now, offering access to a "Bazzite Light" gaming setup, perfect for slaying out. Destiny on Linux please Sony!

Image and boot plumbing​

The chunka work is great, you'll notice way smaller updates than the old images. Top of the line hunter!

Behavior changes​

• Ghostty ships resize-overlay = never; theme tracks the GNOME Dark/Light preference.
• snd_pcsp sink disabled in WirePlumber — audio no longer falls back to the PC speaker after resume.
• zram is disabled; swap is zswap backed by /var/swap/swapfile.
• Bluetooth-Battery-Meter is replaced by BudsLink-Companion plus the io.github.maniacx.BudsLink Flatpak.
• aarch64 images are not published this cycle. (We'll turn these on soon)

Images​

You can't rebase to Dakota from another image. If you're not on Dakota already, reinstall from the ISO.

ISO downloads​

• Dakota Alpha 6 ISO
• Dakota Alpha 6 Checksum
• Dakota daily snapshot

Testing instructions and bug reporting: ISO Testing. File ISO bugs in projectbluefin/dakota-iso.

Lore​

Remember that the wolves are coming, level up your skills at training.projectbluefin.io. It's a tough world out there, here's a sneak peek at the artwork from the artists at makemeacomic.com! These are just a sample of entries from a mysterious journal uncovered on Europa by a [REDACTED] merchant. Inside are the secrets to unlocking the potential of Contributor-Guardians and their mounts. But the forces of the Toilmaster are already ahead of them. Instructions from a doomed CNCF Expedition are sparse:

Click to expand

‹›

1 / 4

Bluefin

Long-Range Raptor Mount

BluefinQuetzalcoatlusTriceroBrachio-Trax

Bluefin — Long-Range Raptor Mount

✕

‹›

1 of 4Open full resolution ↗

Alright, here it is, Bluefin Server, this one actually boots. This is the base of the Bluefin Factory, the thing you'll build your homelab on. And in turn, your desktops or whatever you want. Kubernetes for the home.

An FSDK-based, image-based Linux server OS.**

To celebrate this milestone, enjoy the latest video, with some fresh lore!

Bluefin Server targets the same use-case space as Flatcar Container Linux, Kairos, Fedora CoreOS, and Talos, but is built from scratch with BuildStream 2 from freedesktop-sdk (FSDK 26.08) components and uutils coreutils.

It is designed to be installed and then managed entirely through the Kubestellar GUI. I'll be releasing point releases quickly over the next few days. After the install it will give you a web address, then you go to it on your computer. Then that's it, your perfect home server.

Except the dashboards are empty. The more people we have making these the better, including a ZFS one! This variant will have ZFS support so now's the time to jump onboard!

It is DDI first: the OS payload is a compressed XFS DDI filesystem image that is deployed by an offline, systemd-native installer.

Release status: Alpha​

Bluefin Server is currently in Alpha:

• Milestone status: Phase A (reproducible build path, uutils, k0s sysext, graph validation) is complete. Phase B (automated boot verification on lab cluster) is in progress.
• systemd-sysupdate should work, we're about to find out! configurations.
• Readiness roadmap: Track completed criteria and remaining gates toward 1.0 in docs/MVP_1_0_READINESS.md.

How this works​

• A/B root rollback — an MVP 1.0 gate: 50-root.transfer names root-a and root-b; the installer currently creates only root-a.
• DDI-first delivery — the installer embeds the OS payload as a data partition; no network is required at install time. This is basically Linux systemd style.
• Minimal, distroless OS image — no shell in the running rootfs by default IS what we are shooting for. We'll probably fail at this lol.
• systemd-native installer — systemd-sysinstall provides the interactive terminal UI and systemd-repart handles partitioning and block-copy DDI placement. Finally distro installers can all go die!
• Optional k0s as a systemd-sysext so the base image stays distroless. We started with k3s but I want to see how this one goes, stripped down for the home.

SSH ON: SSH is enabled for cluster boot tests and remote debugging. It is scheduled for removal once diagnostics move to serial logs or a guest agent. See docs/skills/factory-integration.md.

Quick start​

Bare metal sorely needed! However this runs on any Linux, feel free to fire up a VM and start designing that dashboard! Once we get home assistant and all the goodies it'll be amazing! Thanks for checking it out!

You need only podman and just. BuildStream runs inside the FSDK bst2 container, so BuildStream is not installed locally.

just validate              # resolve the element graph
just show-me-the-future    # end-to-end QEMU installer smoke test

See AGENTS.md for the full build command matrix, hard rules, and agent skill routing.

Contributing​

See CONTRIBUTING.md for the contributor checklist, Conventional Commit rules, and docs/skills/index.md for task-specific guidance.

Original post

A belated happy five years to Universal Blue, and how wanting laptops my family could actually live with turned me into an open source maintainer.

This is my personal site. Opinions here are my own and don't necessarily reflect those of Red Hat.

Maybe you saw that Universal Blue recently celebrated its five-year anniversary. Aurora, Bazzite, and Bluefin (the OG) all marked it with posts of their own. I’m thankful to be a part of the team that’s done such great work. I’m usually content to just get things done in the background, but it’s high time I share some of my thoughts about this project and organization we call Universal Blue.

When Jorge Castro made that initial commit five years ago, he was doing different things than we do today. He was running Fedora Silverblue or openSUSE MicroOS, using various scripts to shape the installation into his dream. It was a beginning.

I was in a different, but similar place. I could see the day approaching when my kids were going to need laptops for school, and they already wanted to do more gaming. I didn’t love managing Windows even for myself and didn’t want to manage multiple installs, but multiple Linux installs weren’t much more exciting. I was experimenting to find a solution to make supporting my family’s laptops seem less like sysadmin work, to find something that would “just work” instead.

My GitHub and private Git server are littered with repos full of old dotfiles, configs, Ansible playbooks and shell scripts. I was determined to pre-configure and automate all the post-install Linux things. For me, this “perfect Linux laptop” idea was brewing in 2021. That’s probably when I started to get a solid base of Ansible to manage my family’s Linux systems.

Though I’ve consistently been using Linux on the server for 30 years, desktop use has been more intermittent. “The Year of the Linux Desktop” is almost a perennial joke, and laptops almost always meant more pain than a typical desktop PC. It’s been decades since I bought into the religious wars of macOS versus Windows versus Linux versus BSD. At some point, pragmatism set in. I don’t really care which OS you’re running, but maintaining a fleet of laptops for your family is still a pain, except perhaps if they are all Chromebooks.

In November 2022, I stumbled across a blog post and video by Jorge. He’d been writing (and talking) about immutable Linux OSes, and at that moment he was comparing Fedora Silverblue and openSUSE’s MicroOS. MicroOS caught my attention as something I might use to make my family’s laptops a little bit more reliable. It promised something like ChromeOS that could still function as a normal system. I found it intriguing, but there were enough rough edges that I just couldn’t switch off the Ansible-customized Ubuntu which had become the in-home standard.

In December 2022, Jorge posted something magical. Fedora had released an experimental feature for Silverblue and Kinoite: container-native rpm-ostree. It meant we could have a custom built operating system image, but built like any other Docker image. I’d been living and breathing Docker images. I’d been running Kubernetes at home. I’d packaged applications in Docker images for work and home. The promise of pre-built application images, running the same thing everywhere, was now available as a custom operating system! I could bake in customizations for my family, fixes for all the quirks that normally I had to fix after an installation, or whatever I wanted. Maybe most importantly, all of the package and upgrade conflicts which inevitably occurred for any package management system were no longer an issue.

And NVIDIA, oh, NVIDIA: the greatest love/hate of any Linux user who’d chosen to use it. Powerful and wonderful when it works, but often a pain to get going: NVIDIA would get the same treatment.

Fun fact, I’d used both Fedora Silverblue and CoreOS before, but I found them too restrictive without a better way to customize the defaults to have a better overall user experience. It’s kind of crazy that this turned around so quickly once I could participate in building the OS image itself. Container-native truly opened the door wide for new contribution in this space. It certainly did for me!

This is where I stopped watching what Jorge was doing from afar and got involved.

The ublue-os GitHub org and a Discord server had both been created. I joined the chat and saw them working on a pre-built NVIDIA kmod. I had some of my own custom images going, but I jumped in to help with that NVIDIA kmod; I had a vested interest in making it work. My first official contribution was on February 20, 2023. It wasn’t much, but Universal Blue was (and still is) a welcoming community, and I quickly became involved in more and more code reviews and code contributions. Not even a month later, I’d forked Kyle Gospodnetich’s serverblue repo into uCore, with his blessing of course. By then Kyle was fully invested in Bazzite!

The rest, as they say, is history! And frankly, most of the history is public record because all of our commits, issues, PRs and discussions are out in the open. It’s Open Source Software, after all. I found a passion for participating in the shared effort of building and maintaining our various Universal Blue projects; I stuck with it.

Achieving that “status” was never a goal; rather, it was a natural progression. uCore became my primary Universal Blue project, and I’m practically its sole maintainer, though I’m also a core maintainer across all of Universal Blue, and a user of most of it. Working in the server space certainly matches my traditional interests, so I’m glad I can assist with the desktop projects but don’t need to carry that load alone.

Bluefin and Bazzite fulfilled the dream of Linux laptops that “just work.” Ansible ceased to be used for desktop/laptop management as the prebuilt images (bOS, my lightly personalized version of Universal Blue images) became the new home standard. My boys got Dell laptops with NVIDIA cards which enabled some 3D gaming as well as school, and maintenance was minimal, since those failures now occur in CI and never make it to the laptops themselves. My wife and daughter got a matching pair of HP laptops with AMD integrated graphics, better battery life and still some light gaming ability.

Are there occasional hiccups? Yes. Is it massively easier to maintain than before, when every other update seemed to result in a broken NVIDIA kmod or some other issue? 100%! I confess the boys argued their way into Windows specifically to play a game which still doesn’t work on Linux with Proton, but they miss the Linux desktop and I think I’ll win them back soon.

There is another important thing. I want to say “thank you” to Jorge and Kyle. Each had their own dreams… Kyle’s vision was to bring the “just works” gaming experience of the Steam Deck to any desktop or handheld, while Jorge pushed for the “just works” experience of a Chromebook but with more power and flexibility. Kyle, Jorge and I worked and gamed together, and Kyle would sometimes join me and my boys for gaming sessions. I wasn’t always sure how to relate to Jorge’s ambitious goals, but he challenged me to think bigger. Beyond these two, a whole group of people came together as friends and teammates to support each other personally and technically as we built the various Universal Blue projects.

One of those dreams has been to get people jobs! Most of us did this work outside our day jobs. Eventually some folks set up sponsorship via GitHub, etc, and that’s been awesome to help offset the costs of development, but day jobs pay the bills. The community and network Jorge built here has been excellent in that regard. Contributors to Universal Blue at different career stages have found their way into new opportunities at several different software companies. I’m one of them. My fairly recent start at Red Hat is a great example. My previous years of experience were crucial, but learning specific technologies and Open Source methodologies with Universal Blue provided a direct path to what Red Hat needed. So when I say I’m thankful for this project, and for the opportunity to participate, I mean it. My Universal Blue experience had already been personally and technically rewarding, but finding a job in Open Source through this project experience was next level!

Thank you to everyone who has contributed to a Universal Blue project, however big or small! Thank you for all the users! This has been a great adventure, and in the best possible way, I don’t see an end in sight.

Model Context Protocol (MCP) is an open protocol for LLMs and agents to talk to each other. We're now serving the Project Bluefin organization knowledge base and live factory state at https://mcp.projectbluefin.io/mcp.

Right now hive.projectbluefin.io exposes an API that has things that are useful for agents. We use it to dole out work to volunteers and to get review tasks. This is what's letting us scale out in ways we haven't been able to before. Hive has a nice Knowledge Base that it exposes, so this initial cut is to search that knowledge. This is mostly useful to connect whatever agent you use to our stuff and get context for your agent. So if you want to do Bluefin things you just add this. I've updated the Agentic Contributor Guide, note that our hive API endpoints are published, so if you're building a deep integration it probably makes sense to work with the Hive API directly. Feedback and usage notes welcome!

Endpoint Details​

• URL: https://mcp.projectbluefin.io/mcp
• Transport: Streamable HTTP / Server-Sent Events (SSE)
• Authentication: None (public, read-only)
• Health Check: https://mcp.projectbluefin.io/health

Available Tools​

Here's what's exposed:

Related Reading​

• Why Bluefin is all in on agentic development
• Bluefin's Sausage Factory
• The Future of Bluefin - Time to be Honest
• Bluefin: Welcome to the Jungle
• Agentic Contributor Guide

Participation

Human and automated contributions with current contributors.

Show the numbers

Human and automation activity data for August 2026 UTC (2026-08-01 to 2026-08-31)

Label	Human	Automation
Report period	258	283

🏆 Hive Leaderboard

Hive Leaderboard: Community Heroes

Celebrating our top community builders across the Project Bluefin factory

RankContributorImpactProjectsMilestone

#01@castrojo109 PRscommonbluefinbluefin-lts+6Top Hero#02@ahmedadan35 PRscommonbluefindakotaHigh Velocity#03@hanthor24 PRscommonbluefinbluefin-lts+6High Velocity#04@Danathar20 PRsbluefindakotatestsuiteHigh Velocity#05@mrbobbytables13 PRsbluefindakotatestsuiteHigh Velocity#06@bketelsen11 PRsbluefinbluefin-ltstestsuite+1High Velocity#07@Siddhj22065 PRsactionsfinpilotHigh Velocity#08@joshyorko4 PRscommonbluefintestsuite+1Cross-Fleet#09@HuntedRaven73 PRscommonbluefin-ltsutahCross-Fleet#10@rapenne-s2 PRsdakota#11@Giklab1 PRcommon#12@kylerankin1 PRtestsuite#13@onlydole1 PRtestsuite#14@theMimolet1 PRcommon#15@tunix1 PRfinpilot

Release details remain on the canonical /changelogs surface.

Completed work​

• feat(motd): add uwelcome + update umotd by @​theMimolet in #815
• fix(brew): trust vendored taps so preinstalled casks actually install by @​ahmedadan in #1047
• fix(report): read the boot-time booted-image snapshot when bootc status fails by @​ahmedadan in #1030
• fix(report): read booted tag from bootc, not baked image-info by @​ahmedadan in #1020
• fix(brew): keep preinstall off login critical path by @​ahmedadan in #1006
• fix(brew-preinstall): journal-safe output capture, no /dev/stderr by @​ahmedadan in #998
• fix(brew): correct linuxbrew prefix spelling and preinstall tap ordering by @​ahmedadan in #997
• feat(brew): ship managed ChairLift integration by @​castrojo in #985
• fix(brew): handle cask lifecycle in brew-preinstall by @​HuntedRaven7 in #981
• feat(ujust): honor ACTION in toggle-updates for non-interactive use by @​hanthor in #966
• test: add BATS regression coverage for theming hook by @​kubestellar-hive in #926
• fix(fastfetch): exit cleanly when binary is unavailable by @​castrojo in #931
• test(docs): add check-skill-index regression tests by @​kubestellar-hive in #924
• fix(ujust): preserve report copy when optional files are absent by @​castrojo in #917
• fix(report): preserve external queue preferences by @​joshyorko in #936
• fix(ujust): bootstrap fzf for --choose by @​castrojo in #902
• fix(ci): stop validate failing on stale generated_at date by @​castrojo in #937
• test(docs): add skill validator coverage by @​kubestellar-hive in #911
• feat(brew): preinstall ChairLift with Bluefin maintainer config by @​castrojo in #853
• ci: make the advisory E2E signal mean something by @​castrojo in #914
• ci: stop running E2E on docs-only pushes by @​castrojo in #913
• fix(gnome): enable smoke-tested extensions by @​castrojo in #912
• docs: collapse issue forms to one and delete phantom label taxonomy by @​castrojo in #909
• fix(flatpak): correct Thunderbird Flatpak ID by @​Giklab in #906
• fix(build): checkpoint the rpmdb out of WAL mode at every stage commit by @​Danathar in #1153
• docs(ci): record Firefox failure after testsuite fix by @​Danathar in #1143
• docs(ci): record Testing Images build failing since 2026-08-12 (#995) by @​Danathar in #1136
• test(brew): assert the brew-preinstall payload, not just its trampoline by @​Danathar in #1135
• fix(framework): drop user-setup hook that installs a nonexistent brew formula by @​Danathar in #1132
• fix(lab-check): find the existing check run on busy commits by @​Danathar in #1100
• docs(ci): document :testing promotion blocker set for #989 by @​mrbobbytables in #1091
• docs(ci): document merge-queue GH006 race and stuck-promotion diagnosis by @​mrbobbytables in #1106
• docs(ci): document the :testing stream-tag leak triage path for #989 by @​mrbobbytables in #1096
• docs(ci): document that :testing can freeze for weeks, masking triage (#929) by @​mrbobbytables in #1095
• fix(framework): remove stale hid_sensor_hub karg from AMD Framework laptops by @​mrbobbytables in #1103
• ci: raise BATS coverage threshold from 30% to 45% by @​mrbobbytables in #1104
• docs(ci): explain the nested testsuite workflow refs by @​castrojo in #1077
• ci(lab-check): point the Checks-permission fix at the right screen by @​Danathar in #1079
• test(build): regression-guard missing IMPORTANT_PACKAGES entries (#965) by @​mrbobbytables in #1090
• docs(workflow): note Closes #NNN only fires on the default branch by @​mrbobbytables in #1092
• docs(ci): document stable-promotion blocker set for #929 by @​mrbobbytables in #1089
• ci(bonedigger): drop the remaining no-op triggers and dead permission by @​Danathar in #1085
• ci: gate stable promotion to Tuesday window by @​Danathar in #1076
• fix(ci): preserve builds after Renovate merges by @​joshyorko in #1111
• test(brew): assert the brew-preinstall delivery path ships in the image by @​Danathar in #1081
• docs(security): correct CVE-2026-33186 root cause — podman is a second carrier by @​Danathar in #1082
• test(framework): assert fw-charge-control.conf ships in the built image by @​Danathar in #1080
• ci: guard the testsuite workflow contract by @​Danathar in #1044
• docs(security): document the cosign signature-format requirement by @​hanthor in #1071
• ci: actually remove the mirrored validate status shim by @​castrojo in #1074
• ci: replace mirrored validate status with real check on merge queue by @​castrojo in #1072
• fix(packages): add fzf to base package manifest (#965) by @​hanthor in #1057
• docs(release): clarify e2e gates for stable promotion by @​Danathar in #1049
• ci(bonedigger): drop the no-op schedule trigger by @​hanthor in #1061
• test(framework): lock fw-charge-control.conf battery health fix by @​hanthor in #1060
• test(ci): lock ctx-build stage 1 context to its required inputs by @​hanthor in #1059
• ci(lab-check): surface actionable error when MergeRaptor token mint is denied by @​hanthor in #1058
• [quality] ci(unit-tests): enforce 30% BATS line coverage threshold by @​kubestellar-hive in #1037
• fix(ci): run base-branch guard on main-targeted PRs by @​castrojo in #1041
• [sec-check] fix: pr-validation.yml add permissions block (contents: read) by @​kubestellar-hive in #1038
• docs(security): document CVE-2026-33186 in buildah (no F44 fix available) by @​ahmedadan in #1018
• docs(ci): record MergeRaptor Checks write requirement for lab check by @​castrojo in #1010
• fix(ci): run gitlink check against github.sha by @​castrojo in #1034
• ci: restore managed testsuite v1 ref and stop Renovate re-pinning it by @​castrojo in #1012
• ci(bonedigger): drop the no-op pull_request trigger by @​castrojo in #1011
• docs(skills): record e2e gate triage and tag verification by @​castrojo in #1013
• fix(ci): propagate BATS failures by @​bketelsen in #1015
• fix(factory): extract merge-group status mirror by @​bketelsen in #1021
• fix(build): fully isolate Stage 2 and ISO contexts by @​bketelsen in #1020
• fix(renovate): consolidate repository config by @​bketelsen in #1017
• fix(framework): enable native battery charge control by @​bketelsen in #1019
• ci: document the :testing tag gate on the reusable-build caller by @​castrojo in #992
• docs(skills): note release input trust and worktree merge cleanup by @​castrojo in #998
• feat(ci): add BATS coverage reporting artifacts by @​castrojo in #911
• docs(skills): record CI gating and worktree failure modes by @​castrojo in #994
• docs(skills): adopt the factory skill front-matter contract by @​castrojo in #991
• chore: enforce isolated worktrees for feature work by @​castrojo in #980
• chore(release): remove legacy manifest changelog by @​bketelsen in #973
• fix(build): invalidate package layer for build file changes by @​castrojo in #964
• docs: add agent fast path and every-loop repair contract by @​castrojo in #984
• docs(workflow): replace placeholder bonedigger TODO with real tracking issue by @​castrojo in #982
• docs: sync agentic procedures with projectbluefin/common by @​castrojo in #979
• fix(image): include bootupd for bootc installs by @​castrojo in #962
• ci: verify common extension defaults by @​castrojo in #955
• ci: verify E2E health fixes by @​castrojo in #952
• ci: verify testsuite v1 E2E fixes by @​castrojo in #950
• ci: rerun E2E with testsuite v1 fixes by @​castrojo in #949
• chore: sync issue templates from common by @​castrojo in #946
• ci: retire skill-drift.yml (no-op stub) by @​castrojo in #944
• fix(ci): use managed testsuite v1 by @​castrojo in #941
• fix(ci): force GET method for gh api in nvidia manifest assembly by @​HuntedRaven7 in #530
• fix: install dnf5 so bluefin-lts-countme.service can run by @​hanthor in #502
• chore(release): remove legacy manifest changelog by @​bketelsen in #497
• fix(ci): unblock PR lint and the promotion release gate by @​hanthor in #501
• fix(ci): assemble signed multi-arch manifest for bluefin-lts-nvidia:testing by @​castrojo in #472
• ci(lab): publish PR results through MergeRaptor by @​castrojo in #456
• chore: sync issue templates from common by @​castrojo in #487
• ci: retire skill-drift.yml (no-op stub) by @​castrojo in #486
• test(dx): add unit tests for dx_distrobox_can_be_created (#501) by @​mrbobbytables in #755
• fix(installer): gate the LUKS assertion on the target, not a dead env var by @​Danathar in #754
• feat(dx): gate distrobox create/install/export on a cached image at runtime by @​Danathar in #753
• [sec-check] fix: declare top-level permissions: {} in build-kde-runner.yml build-runner.yml by @​kubestellar-hive in #750
• fix(smoke): preserve Firefox AT-SPI env for Flatpak exports by @​Danathar in #741
• feat(e2e): compose test software as a container layer instead of runtime install by @​hanthor in #744
• [sec-check] fix: pr-validate.yml add permissions block (contents: read) by @​kubestellar-hive in #738
• [sec-check] fix: unit-tests.yml add permissions block (contents: read) by @​kubestellar-hive in #739
• docs(skills): document design gate and verification requirements for #487 by @​hanthor in #747
• test(smoke): scope composefs capability check to Fedora-shipped caps by @​hanthor in #749
• docs(skills): link projectbluefin/lab#621 to distrobox image-cache gap #501 by @​hanthor in #748
• test(common): cover ujust toggle-updates via its non-interactive ACTION contract by @​hanthor in #746
• fix(shared): refuse dbus autolaunch and snapshot session state on readiness failure by @​castrojo in #737
• [quality] add new coverage for untested areas (epic #705) by @​kubestellar-hive in #733
• test(common): make Dakota ujust chooser and report coverage non-vacuous by @​castrojo in #735
• feat(common): add non-interactive devmode coverage via bctl by @​onlydole in #724
• fix(shared): survive GDM restart in GNOME shell readiness gate by @​castrojo in #727
• fix(e2e): enforce the @hardware_blocked tag in CI and at runtime by @​castrojo in #726
• docs: reconcile factory-model governance contradictions and correct the ghost-lab merge gate by @​castrojo in #732
• test(scripts): assert KDE installer behaviour instead of its source text by @​castrojo in #730
• fix(ci): generate suite-map coverage snapshot instead of hand-editing by @​castrojo in #728
• fix(smoke): restore Bluefin release gate reliability by @​castrojo in #731
• feat(installer): add post-boot assertions for UEFI, Flatpak exclusion, and LUKS cmdline by @​kylerankin in #697
• docs(behave): trim SKILL.md under the 500-line cap by @​castrojo in #729
• fix(smoke): restore Bluefin release gate reliability by @​joshyorko in #691
• test(scripts): add unit tests for validate_docs.py by @​kubestellar-hive in #675
• test(software): add CLI-driven Flatpak per-app permission coverage by @​castrojo in #710
• test(common): add Dakota ujust report and chooser regression coverage by @​castrojo in #699
• test: cover orca, input-methods and xwayland smoke step logic by @​castrojo in #709
• docs: onboard testsuite to the common factory model and remove the PR cap by @​castrojo in #694
• test: cover GNOME shell readiness helper by @​kubestellar-hive in #672
• feat(developer): add pending bctl.feature scenarios ahead of CI unmask by @​mrbobbytables in #722
• docs: record OOBE first-boot investigation by @​bketelsen in #715
• fix(software): initialize shared SSH context with coverage by @​bketelsen in #721
• docs(skills): capture SSH context contract and unit-test stub pitfalls by @​castrojo in #723
• build(dashboard): migrate to @tailwindcss/vite, drop @astrojs/tailwind by @​castrojo in #716
• test(scripts): add installer contract coverage for KDE webdriver by @​kubestellar-hive in #676
• test(flatcar): implement Ignition and update-disable lifecycle scenarios by @​castrojo in #711
• docs: add update-cadence research informed by testsuite validation by @​hanthor in #713
• fix(smoke): enable Firefox AT-SPI accessibility and stop the filler false pass by @​castrojo in #692
• test(dx): add distrobox create/install/export scenarios behind @pending by @​castrojo in #720
• fix(software): set SSH context for shared ssh_steps in the suite by @​castrojo in #718
• fix(e2e): enforce non-runnable tag filters by @​bketelsen in #717
• docs(behave): record ujust toggle-updates non-interactive blocker (#499) by @​castrojo in #714
• docs: add issue templates for the agent intake path by @​castrojo in #700
• docs: codify .worktrees/ isolation policy and agent worktree hygiene by @​castrojo in #695
• fix(ci): count job-summary scenarios explicitly instead of by subtraction by @​castrojo in #698
• chore: ignore extracted image roots and local e2e diagnostics by @​castrojo in #708
• fix(ci): count @pending scenarios as stubs in coverage badges by @​castrojo in #701
• test: resolve overdue quarantine debt and reclassify infra-blocked scenarios by @​castrojo in #693
• fix(e2e): preserve smoke health capacity by @​castrojo in #684
• fix(e2e): preserve image extension defaults by @​castrojo in #683
• fix(smoke): preserve monitor layout when scaling by @​castrojo in #682
• ci: retire skill-drift.yml (no-op stub) by @​castrojo in #681
• fix(ci): render e2e heredoc delimiter correctly by @​castrojo in #680
• fix(ci): restore e2e workflow heredoc indentation by @​castrojo in #678
• [scanner] fix: publish PXE boot artifacts by @​kubestellar-hive in #23
• docs: add SECURITY.md vulnerability disclosure policy by @​castrojo in #17
• fix(promote): derive squash branch name from inputs everywhere by @​Siddhj2206 in #423
• fix(sign-and-publish): pin cosign to legacy .sig format for podman/bootc by @​hanthor in #420
• [sec-check] fix: pin renovate version, declare top-level permissions in reusable-sync-branches by @​kubestellar-hive in #417
• [sec-check] fix: actionlint.yml declare least-privilege permissions by @​kubestellar-hive in #415
• [quality] add regression coverage for _section_footer in render_pr_body by @​kubestellar-hive in #412
• fix(check-token-health): support GitHub App installation tokens by @​kubestellar-hive in #418
• fix(ci): use the self-repository prefix in renovate-automerge by @​castrojo in #406
• fix(build): stop leaking the stream tag when publish_stream_tag=false by @​castrojo in #405
• fix(renovate): stop managing first-party projectbluefin/actions refs by @​castrojo in #401
• ci(actions): make mergeraptor auto-merge actually fire on main by @​castrojo in #400
• ci(actions): migrate internal composition to self-repository syntax by @​castrojo in #392
• fix(ci): use secrets.MERGERAPTOR_APP_ID and client-id in factory workflows by @​castrojo in #354
• [quality] add CLI regression tests for consumer-contract script by @​kubestellar-hive in #378
• fix(actions): resolve bundled cosign installer from self repository by @​castrojo in #376
• [quality] add BATS coverage for sign-and-publish SBOM path generation by @​kubestellar-hive in #371
• test(scripts): cover promotion body scripts by @​kubestellar-hive in #369
• [quality] add entrypoint regression coverage by @​kubestellar-hive in #366
• [quality] add regression tests for render_card placeholder fallback by @​kubestellar-hive in #367
• fix(tests): prioritize scripts/ over .github/actions copies in sys.path by @​kubestellar-hive in #370
• [quality] expand sign-and-publish BATS coverage for cache and attach failure paths by @​kubestellar-hive in #372
• fix(report): apply external queue preferences by @​joshyorko in #34
• docs: add Future of Bluefin video post by @​castrojo in #1037
• ci: add just check pre-commit gate by @​castrojo in #1035
• docs: add /dakota variant page by @​castrojo in #1036
• chore: remove stale content and dead dashboard code by @​castrojo in #1034
• refactor: remove dead code and replace hand-rolled helpers with stdlib by @​castrojo in #1033
• docs(blog): add post on Bazzite killing the gamer kernel by @​castrojo in #1032
• docs: add "The Wolves Are Coming" blog post with Bluesky embed by @​castrojo in #1030
• fix(cards): source the Dakota release card from the SBOM cache by @​castrojo in #1029
• fix(factory): attribute Hive to KubeStellar, not an individual by @​castrojo in #1028
• fix(countme): count devices the way ublue-os/countme counts them by @​castrojo in #1027
• fix(factory): correct branding terminology, relabel countme, drop non-owned toolbox images by @​castrojo in #1026
• feat(factory): two-level navigation and first-party chart parity by @​castrojo in #1025
• docs(blog): publish Dakota Alpha 5 by @​castrojo in #1020
• docs(downloads): promote Dakota alpha5 by @​castrojo in #1019
• feat(release-cards): add deterministic release-context renderer and action by @​castrojo in #1018
• fix(containerfile): break dnf.conf hardlink before config-manager setopt by @​tunix in #258
• [scanner] docs: document Renovate alert permission by @​kubestellar-hive in #276
• docs: align signing, branch-model, and promotion docs with current behavior by @​Siddhj2206 in #273
• feat(ci): enable keyless image signing by default by @​Siddhj2206 in #271
• fix(ci): enable native overlay for faster layer commits by @​Siddhj2206 in #266
• fix(ci): grant packages:read to promotion reusable caller by @​Siddhj2206 in #259
• ci: add two-branch main/stable workflow with factory promotion reusable by @​castrojo in #240
• fix: prevent clean-stage.sh glob failure on empty /var/cache by @​castrojo in #243
• fix(ci): harden workflow security — pin renovate, add clean.yml permissions by @​castrojo in #239
• feat(factory): onboard Hive issue workflow by @​castrojo in #218
• fix(ci): simplify rechunking enablement by @​bketelsen in #220
• fix(build): stop copying default just recipes from common OCI by @​hanthor in #227
• Move to agentic workflows and skills by @​hanthor in #226
• fix(packages): install gum for default ujust recipes by @​castrojo in #221
• fix: changed up how the common repo is used by @​HuntedRaven7 in #6
• Add Utah GNOME desktop and live ISO bring-up by @​hanthor in #5
• Build Utah on Hummingbird with the GNOME 51 stack, all four flavors by @​hanthor in #1
• Add GNOME 51 GDM to the package factory by @​hanthor in #12
• Let cosign see the registry login the publish step already made by @​hanthor in #3
• Import the package factory: GNOME 51 for Hummingbird, published as an OCI image by @​hanthor in #1

Dakota (GNOME OS Prototype)​

• fix(ujust): preserve newlines in confirm/report/verify by @​rapenne-s in #1331
• fix(image): create plugdev and nintendo_switch groups for udev rules by @​ahmedadan in #1424
• fix(ci): sync-next merges small next tweaks instead of restoring files by @​ahmedadan in #1419
• fix(packages): ship fastfetch binary expected by common wrapper by @​ahmedadan in #1417
• [scanner] fix: include dmidecode for bios-info by @​kubestellar-hive in #1391
• fix(fastfetch): show real stream tag via boot-time booted-image sync by @​ahmedadan in #1393
• fix(image): unbreak fresh-ISO post-install (uwelcome, brew, devmode) by @​ahmedadan in #1388
• ci(build): queue runs FIFO with stale-run gate, detach source tracker by @​ahmedadan in #1384
• chore(kernel): align testing on Linux 7.1.8 by @​ahmedadan in #1379
• chore(kernel): move next kernels to stable 7.2 by @​ahmedadan in #1378
• perf(image): compose the host toolchain once by @​ahmedadan in #1377
• fix(chunkah): preserve export mtimes by @​ahmedadan in #1376
• refactor(agent): reduce eager context by @​ahmedadan in #1362
• ci(aarch64): stop queueing x86 builds behind ARM in the CAS group by @​ahmedadan in #1359
• fix(ci): tolerate owned paths absent from next during sync by @​ahmedadan in #1357
• fix(elements): complete the fdsdk 26.08 port across all variants by @​ahmedadan in #1356
• ci(next): build next images on every content push by @​ahmedadan in #1354
• fix(elements): stage sandbox shell explicitly for fdsdk 26.08 by @​ahmedadan in #1353
• ci(next): derive fdsdk pin and patches from tracked gnome-build-meta by @​ahmedadan in #1352
• ci(next): add patches/linux-ogc to the sync overlay by @​ahmedadan in #1346
• ci(next): replace merge sync from main with overlay sync-next workflow by @​ahmedadan in #1345
• fix(gaming): repin LuaJIT after upstream deleted the ROLLING tag by @​ahmedadan in #1344
• ci(release): disable broken GNOME 50 smoke gate on stable promotion by @​ahmedadan in #1342
• fix(brew): bump common for prefix fix, ship make, guard spelling by @​ahmedadan in #1341
• feat(bluefin): add brlaser CUPS driver by @​rapenne-s in #1329
• ci(e2e): correct installer-suite gating docs and add a dispatch recipe by @​Danathar in #1323
• docs(e2e-ci): spec fisherman installer post-boot assertions, correct status by @​mrbobbytables in #1330
• ci(release): schedule Dakota stable promotions Mon/Wed/Fri by @​Danathar in #1322
• test: add avatar-audit to catch #353-class dinosaur-avatar regressions by @​Danathar in #1308
• fix: restore Bluefin dinosaur avatars in GNOME user-account picker by @​mrbobbytables in #1302
• ci: run validate on PRs targeting main by @​castrojo in #1318
• [quality] add Python regression tests for workflow and filemap scripts by @​kubestellar-hive in #1276
• ci(e2e): expose installer suite on workflow_dispatch (fisherman post-boot assertions) by @​hanthor in #1316
• docs(skills): record /dev/stdin regression and why CI cannot catch it by @​castrojo in #1303
• fix(elements): stop using /dev/stdin for inline file writes by @​castrojo in #1298
• fix(audio): unfold pcsp install command; YAML folding emptied artifact by @​ahmedadan in #1297
• fix(audio): disable PC-speaker WirePlumber sink by @​castrojo in #1257
• fix(gaming): pin Steam .deb to versioned pool URL; CDN swaps content by @​ahmedadan in #1279
• fix(gaming): ship 32-bit GL/Vulkan drivers and re-enable Steam UI GPU by @​ahmedadan in #1278
• feat(nvidia): update to 610.57.04 and ship its missing data files by @​ahmedadan in #1277
• fix(bluefin): support ydotool on CMake 4 by @​ahmedadan in #1267
• feat(bluefin): add ydotool input automation by @​castrojo in #1258
• chore: sync issue templates from common by @​castrojo in #1264
• ci: retire skill-drift.yml (no-op stub) by @​castrojo in #1263
• fix(ci): delete .github/workflows/lab-check.yml by @​castrojo in #1260
• fix(zswap): disable zram via integration command, overlap lost by @​ahmedadan in #1262

Contributors​

Sources​

• github-activity: available (2026-08-01 to 2026-08-31): source
• github-lanes: available (2026-08-01 to 2026-08-31): source
• github-releases: available (2026-08-01 to 2026-08-31): source
• github-releases: available (2026-08-01 to 2026-08-31): source
• github-releases: available (2026-08-01 to 2026-08-31): source
• github-releases: available (2026-08-01 to 2026-08-31): source
• github-releases: available (2026-08-01 to 2026-08-31): source
• countme: available (2026-08-01 to 2026-08-31): source
• homebrew: available (2026-08-01 to 2026-08-31): source
• flathub: unavailable — Flathub statistics could not be read. (2026-08-01 to 2026-08-31): source

wolves.projectbluefin.io​

A follow up to The Future of Bluefin - Time to be Honest.