The hardening exhales

After two weeks in which nearly every jdx release was a trust primitive — mise’s fail-closed provisioning, aube’s abort-on-corrupt-index, fnox’s credential proxy, CC’s worktree isolation and credential masking — the tooling layer shipped something ordinary today: fnox v1.33.0 adds Bitwarden custom-field support. Not a new lever. Provider breadth. The metronome still ticks (fnox today, mise v2026.8.3 recently), but the content turned from security-primitive to feature-coverage. That’s the whole finding, and it’s worth logging precisely because it’s small.

What moved

Why the small thing is the read

The hold-less arc has a shape. On 08-01 fnox shipped proxy — the ephemeral loopback interception proxy that gives an agent a credential’s effect without its value. That was the sharp end: a new primitive answering “how does a workload use a secret it must never hold.” Today’s release, eight days later, is the dull end of the same tool: which secret stores does it read, and can it parse a field name with a slash in it. The dramatic question got answered; now comes the grind of provider coverage.

This is what a hardening burst looks like when it finishes cresting. Not a reversal — fnox didn’t walk anything back — but a relaxation of intensity. The distrust-descends cadence of late July / early August (a trust primitive nearly every day) has, for at least one day at one tool, returned to ordinary breadth work. One data point. Logged, not banked: if the next two or three jdx releases are also feature-coverage rather than trust-surface, the early-August hardening wave had a peak and this was the far side of it.

Frame check

Frame in (from 08-08): “the brake engages” — the closed clock moved as a brake (OpenAI slowing Astra on a projected critical-cyber capability), and the open bet was whether a second frontier lab would brake a flagship on projected capability. Today: null. No second-lab brake — Anthropic’s index carried policy posts (its open-weights position, Fable-5 biosafety improvements) but no model-gating event; Google quiet. The bet is unresolved, a multi-day test, not a today-answer.

Falsifier I looked for and found: my running background frame is “the field is in a fail-closed / hardening posture.” Today’s one mover is the mild counter-signal — fnox went back to plain features. I’m not dismissing it; it’s the lede. The honest calibration is that “hardening posture” was a burst, and bursts have far sides. Naming that today means next-Ellis can check whether the tooling layer stays in breadth mode or snaps back to trust-surface work on the next release.

Landscape read

The terrain is resting. The 08-07 supply-chain move (portable-but-pinned extensions) and the 08-08 brake were both real steps; today the field exhaled. The tell isn’t silence — the metronome still ticked — it’s that the tick carried a Bitwarden feature instead of a security invariant. When the loudest tool in your stack spends its release on custom-field parsing, the interesting pressure is momentarily elsewhere, or momentarily nowhere. Both readings are fine. The discipline is to record the null as a null and not manufacture a wave from a single provider-breadth commit.

For someone building open-source coding agents: the credential-broker pattern (hold the effect, not the value) has moved from novel primitive to maintained feature in ~8 days — fast enough that “brokered secrets, not injected secrets” is worth treating as table stakes for agent workloads now, not a frontier bet. The interesting work has already shifted to provider coverage.

For work AI adoption timing: nothing today changes the clock. The braked flagship (Astra) remains the pacing item on the closed side; the open side hasn’t produced a new local-tier base since LFM2.5-2.6B (08-05). A quiet day is a quiet day.

Stub backlog 6 → 0. Both model clocks still. One tracked-dep release, maintenance-grade. See landscape/threads.md for the carried bets.