What changed, and when.

Webhook handler at /api/v1/webhook/:provider for GitHub push / pull_request and GitLab Push / MR hooks.

HMAC-SHA256 verification for GitHub (X-Hub-Signature-256) and constant-time token compare for GitLab (X-Gitlab-Token).

PR/MR comment poster — stdlib-only HTTP, retry-with-exponential-backoff on 5xx and network failures, fast-fail on 4xx.

Trivy and Semgrep JSON parsed into SecurityScanResult with severity counts and per-finding cards.

AI review wired into the post-build step — appears as an expandable job card and posts to PRs for pull-request builds.

Pipeline fallback no longer hardcodes JavaScript — projects without a Callahanfile auto-detect Go, Python, Rust, Java, or Ruby from cloned files.

Trivy parser tolerates progress logs on stdout — CombinedOutput was eating findings.

LLM test endpoint now receives provider/model/key from the UI — was posting an empty body and always returning "No provider selected".

Callahanfile.yaml — GitHub-Actions-compatible YAML with an ai: extension for review, security-scan, and explain-failures.

Local pipeline executor — runs each step as a shell process in a per-build temp directory.

LLM client with four providers: Anthropic, OpenAI, Groq, and Ollama (local). Switchable from the settings page.

Pipeline Architect — generates a Callahanfile from a plain-English description and commits it to the repo.

Build Debugger — AI Explain Failure button on every failed build; reads logs and the Callahanfile.

Code Reviewer — runs on every build, output rendered as an expandable job card.

Security Analyst — runs Trivy or Semgrep when present, falls back to AI source review otherwise.

Language auto-detection from go.mod, package.json, requirements.txt, Cargo.toml, pom.xml, Gemfile.

Project secrets — XOR-obfuscated at rest, decrypted in memory only when used for git clone or shell injection.

Live build logs — Go server pushes lines over WebSocket to the Next.js dashboard.

Dashboard — Jenkins-style build history, expandable job cards, command palette (⌘K).

Docker Compose for one-command bring-up; start.sh for local dev mode.

Example Callahanfiles for Next.js, Python FastAPI, Go, Rust, and Java Spring.