Track important changes in Model Routing and Gateways, including capabilities, product updates, adoption signals, risks, and evidence worth continued monitoring.
A TOCTOU race in the gateway cancel flow caused two concurrent `cancel_run` calls to both pass the initial existence check, so when the first request interrupted the run the second still returned `409` even though cancellation had effectively happened. The fix is a post-cancel re-read under the authoritative state; if that status is `interrupted` or the record is gone, the router now returns `202`, while preserving `409` for truly non-cancellable states.
What ChangedA TOCTOU race in the gateway cancel flow caused two concurrent `cancel_run` calls to both pass the initial existence check, so when the first request interrupted the run the second still returned `409` even though cancellation had effectively happened. The fix is a post-cancel re-read under the authoritative state; if that status is `interrupted` or the record is gone, the router now returns `202`, while preserving `409` for truly non-cancellable states.
Why It MattersOperators and API clients that retry or issue concurrent cancel requests now avoid unpredictable 409 failures, so cancel workflows become reliable instead of intermittently failing halfway through automation scripts or user-driven retries. Concretely, the router now treats already-interrupted or cleaned-up runs as a successful terminal outcome (202) after a cancellation attempt, while still surfacing 409 when the run is genuinely non-cancellable; continue watching for regressions in status edge cases and any latency overhead from the extra status read under high cancel-throughput workloads.
This PR fixes kg-extract so TypeScript `import type` edges are no longer counted as runtime dependencies, preventing false graph cycles, and updates kg-traverse to use an enabled AgentDB path while adding CI smoke checks for the new behavior.
What ChangedThis PR fixes kg-extract so TypeScript `import type` edges are no longer counted as runtime dependencies, preventing false graph cycles, and updates kg-traverse to use an enabled AgentDB path while adding CI smoke checks for the new behavior.
Why It MattersDevelopers and operators running ruflo’s knowledge-graph extraction on large TypeScript codebases will get cleaner outputs with fewer fake dependency-cycle alerts, which reduces wasted debugging and makes refactoring decisions more trustworthy; watch for any parser/template changes or SKILL.md drift that could reintroduce false-positive cycle detection. The pipeline now also locks in the expected tool and relation rules through CI checks, so a future change that re-enables the wrong controller or regresses `import type` handling is more likely to be caught before merging.
Final score 80Confidence 931 evidence itemkg-extractkg-traversetype-depends-onimport typeagentdb_pattern-searchagentdb_semantic-routeSKILL.mdscripts/smoke-kg-extract-type-imports.mjs
Aider introduces native OrcaRouter support (`orcarouter/` model prefixes) so users can invoke OrcaRouter-hosted models through existing aider flows with one provider-style key, instead of treating it as an external add-on path.
What ChangedAider introduces native OrcaRouter support (`orcarouter/` model prefixes) so users can invoke OrcaRouter-hosted models through existing aider flows with one provider-style key, instead of treating it as an external add-on path.
Why It MattersAider users can now run a broad set of third-party models via one OrcaRouter entry (`orcarouter/<vendor>/<model>`) with consistent metadata and routing, which makes model experiments and provider switching in day-to-day workflows faster and less error-prone. The router implementation reuses aider’s existing OpenAI-compatible request path by rewriting to `openai/<rest>` for litellm and injecting OrcaRouter credentials/headers, so teams should watch pricing-feed availability and format changes, 24-hour cache drift, and any provider-side API/base-url incompatibilities that could cause wrong model selection or unexpected token-cost estimates.
Final score 80Confidence 931 evidence itemOrcaRouteraiderOrcaRouterModelManagerModelInfoManagerModel.send_completionlitellmORCAROUTER_API_KEYorcarouter-auto
Overstory’s dependency bump to `@os-eco/mulch-cli` 0.8.0 is mainly about safer record lifecycle handling: `ml prune` now defaults to soft-archiving stale records instead of deleting them, so cleanup becomes reversible when operators hit a bad classification. This is the key behavioral shift that changes how teams can recover from maintenance mistakes.
What ChangedOverstory’s dependency bump to `@os-eco/mulch-cli` 0.8.0 is mainly about safer record lifecycle handling: `ml prune` now defaults to soft-archiving stale records instead of deleting them, so cleanup becomes reversible when operators hit a bad classification. This is the key behavioral shift that changes how teams can recover from maintenance mistakes.
Why It MattersRepo operators and maintainers using `ml prune` can now recover from overly aggressive cleanup runs, because stale records are preserved in archive files instead of being deleted, reducing operational risk when maintaining shared knowledge data. The release also adds explicit archived-state tracking (`status: "archived"`, `archived_at`) and restoration support, improving rollback visibility and recovery flow. Watch for scripted cleanup workflows that assumed deletion, monitor archive growth, and validate cross-domain restore behavior so recovery does not become ambiguous.
Final score 77Confidence 931 evidence item@os-eco/mulch-climl prunesoft-archive.mulch/archiveml restore
The PR regenerates Goose’s canonical model registry from models.dev and updates the provider metadata snapshot so the catalog reflects newly available model/provider data, including google/gemini-3.5-flash. This is a catalog data refresh of routing metadata rather than a runtime or training change.
What ChangedThe PR regenerates Goose’s canonical model registry from models.dev and updates the provider metadata snapshot so the catalog reflects newly available model/provider data, including google/gemini-3.5-flash. This is a catalog data refresh of routing metadata rather than a runtime or training change.
Why It MattersDevelopers and operators using Goose for model routing can now discover and use newly listed models like google/gemini-3.5-flash faster, without manual intervention to patch registry files, which can shorten time to enable new model capabilities in deployments. The refresh updates `canonical_models.json` and `provider_metadata.json` from the source catalog, so the next step to watch is whether any regenerated entries have incorrect metadata or unavailable endpoints in real traffic before broader production routing.
Final score 74Confidence 961 evidence itemcanonical model registryprovider metadata snapshotmodels.devgoogle/gemini-3.5-flash
InsForge v2.1.6 adds `?v=<etag>` to storage download URLs to force CDN cache-busting when artifact content changes.
What ChangedInsForge v2.1.6 adds `?v=<etag>` to storage download URLs to force CDN cache-busting when artifact content changes.
Why It MattersUsers and operators pulling release artifacts are less likely to deploy stale binaries from CDN caches after an update, which reduces rollout inconsistencies and unexpected behavior caused by outdated files. Because the URL now changes with content, cache invalidation becomes content-driven; monitor cache hit/miss signals and any edge/client URL normalization behavior to ensure query parameters are preserved and that ETag values always change when bytes do.
Final score 66Confidence 931 evidence itemstorageCDNETagdownload URLcache busting
The PR regenerates Goose’s canonical model registry from models.dev and updates the provider metadata snapshot so the catalog reflects newly available model/provider data, including google/gemini-3.5-flash. This is a catalog data refresh of routing metadata rather than a runtime or training change.
ContributionRebuilt and synchronized the canonical model registry and provider metadata files from models.dev, adding new provider/model entries and reducing stale catalog data for model routing.
ImpactDevelopers and operators using Goose for model routing can now discover and use newly listed models like google/gemini-3.5-flash faster, without manual intervention to patch registry files, which can shorten time to enable new model capabilities in deployments. The refresh updates `canonical_models.json` and `provider_metadata.json` from the source catalog, so the next step to watch is whether any regenerated entries have incorrect metadata or unavailable endpoints in real traffic before broader production routing.
This PR fixes kg-extract so TypeScript `import type` edges are no longer counted as runtime dependencies, preventing false graph cycles, and updates kg-traverse to use an enabled AgentDB path while adding CI smoke checks for the new behavior.
ContributionImplemented a concrete dependency-classification fix that separates type-only imports from value imports in kg-extract, eliminating phantom cycle links, then re-routed traversal to a supported AgentDB search controller and added explicit smoke tests (contract + behavioral fixture) to prevent the regression.
ImpactDevelopers and operators running ruflo’s knowledge-graph extraction on large TypeScript codebases will get cleaner outputs with fewer fake dependency-cycle alerts, which reduces wasted debugging and makes refactoring decisions more trustworthy; watch for any parser/template changes or SKILL.md drift that could reintroduce false-positive cycle detection. The pipeline now also locks in the expected tool and relation rules through CI checks, so a future change that re-enables the wrong controller or regresses `import type` handling is more likely to be caught before merging.
A TOCTOU race in the gateway cancel flow caused two concurrent `cancel_run` calls to both pass the initial existence check, so when the first request interrupted the run the second still returned `409` even though cancellation had effectively happened. The fix is a post-cancel re-read under the authoritative state; if that status is `interrupted` or the record is gone, the router now returns `202`, while preserving `409` for truly non-cancellable states.
ContributionChanged the cancel path to be idempotent in race windows by re-reading run state after the lock-protected `cancel()` step and routing responses by authoritative post-lock status (`interrupted`/missing => 202, otherwise 409 via conflict logic).
ImpactOperators and API clients that retry or issue concurrent cancel requests now avoid unpredictable 409 failures, so cancel workflows become reliable instead of intermittently failing halfway through automation scripts or user-driven retries. Concretely, the router now treats already-interrupted or cleaned-up runs as a successful terminal outcome (202) after a cancellation attempt, while still surfacing 409 when the run is genuinely non-cancellable; continue watching for regressions in status edge cases and any latency overhead from the extra status read under high cancel-throughput workloads.
Aider introduces native OrcaRouter support (`orcarouter/` model prefixes) so users can invoke OrcaRouter-hosted models through existing aider flows with one provider-style key, instead of treating it as an external add-on path.
ContributionAdd a native OrcaRouter provider integration path in aider: new `OrcaRouterModelManager` loads and caches OrcaRouter model catalog data (max tokens, input/output costs), `ModelInfoManager` resolves `orcarouter/` model metadata when litellm lacks built-in details, and `Model.send_completion` routes calls through `api.orcarouter.ai` using `ORCAROUTER_API_KEY` while preserving aider’s existing alias and per-provider behavior.
ImpactAider users can now run a broad set of third-party models via one OrcaRouter entry (`orcarouter/<vendor>/<model>`) with consistent metadata and routing, which makes model experiments and provider switching in day-to-day workflows faster and less error-prone. The router implementation reuses aider’s existing OpenAI-compatible request path by rewriting to `openai/<rest>` for litellm and injecting OrcaRouter credentials/headers, so teams should watch pricing-feed availability and format changes, 24-hour cache drift, and any provider-side API/base-url incompatibilities that could cause wrong model selection or unexpected token-cost estimates.
Overstory’s dependency bump to `@os-eco/mulch-cli` 0.8.0 is mainly about safer record lifecycle handling: `ml prune` now defaults to soft-archiving stale records instead of deleting them, so cleanup becomes reversible when operators hit a bad classification. This is the key behavioral shift that changes how teams can recover from maintenance mistakes.
ContributionUpgrades overstory’s mulch-cli dependency to 0.8.0, where the prune lifecycle behavior changes from hard deletion to soft archive by default; stale records are retained in archive files with lifecycle metadata, enabling controlled recovery instead of immediate data loss.
ImpactRepo operators and maintainers using `ml prune` can now recover from overly aggressive cleanup runs, because stale records are preserved in archive files instead of being deleted, reducing operational risk when maintaining shared knowledge data. The release also adds explicit archived-state tracking (`status: "archived"`, `archived_at`) and restoration support, improving rollback visibility and recovery flow. Watch for scripted cleanup workflows that assumed deletion, monitor archive growth, and validate cross-domain restore behavior so recovery does not become ambiguous.
InsForge v2.1.6 adds `?v=<etag>` to storage download URLs to force CDN cache-busting when artifact content changes.
ContributionThe release introduces ETag-based version parameters on generated download links so updated artifacts get a new URL identity and avoid being silently served as stale content by caches.
ImpactUsers and operators pulling release artifacts are less likely to deploy stale binaries from CDN caches after an update, which reduces rollout inconsistencies and unexpected behavior caused by outdated files. Because the URL now changes with content, cache invalidation becomes content-driven; monitor cache hit/miss signals and any edge/client URL normalization behavior to ensure query parameters are preserved and that ETag values always change when bytes do.