Changelog - May 2026

May's headline is a completely rebuilt medalsocial.com — the site you're on now is running on the new foundation. Beyond that, the CLI toolkit gained its widest distribution yet, the wake-word engine went fully open-source, and a quiet but important security hardening pass landed across the platform.

A new medalsocial.com

The marketing site is rebuilt from the ground up. It runs on a Sanity-powered CMS so the team can publish and update content through a purpose-built editor rather than pushing code changes. The new landing shell introduces a refreshed layout and a slot-based design system that makes it fast to add, rearrange, or retire pages. DNS has fully cut over — the live site is the new build.

Pilot CLI on npm, Homebrew, and curl

The Pilot command-line toolkit is now installable from three standard channels: npm install -g @medalsocial/pilot, a Homebrew tap, and a one-line curl installer for zero-dependency bootstrap on a fresh machine. Pilot also earned an OpenSSF Silver badge this month, confirming supply-chain controls, token scoping, and branch-protection requirements all meet the standard. Developers who want to drive the platform from the terminal now have a first-class installation path on any machine.

Wake-word detection goes open-source

The always-on wake-word engine that triggers hands-free voice sessions has been migrated from a proprietary model to openWakeWord, an open-source alternative. This removes the dependency on a closed third-party runtime, reduces licensing surface, and opens the door to custom model training in the future.

Security and supply-chain hardening

All GitHub Actions across Medal Social repos are now pinned to exact commit SHAs, eliminating a class of supply-chain risk from action tag mutation. The package manager version in CI is locked via Corepack, preventing silent drift between environments. The public SDK hit 100% test coverage this month as part of a quality and security batch, and a set of security patches shipped in the Next.js-based template layer.

Key fixes

• Removed a residual first-party error-monitoring integration that was leaking deployment configuration into public build artifacts.
• Resolved a rendering glitch in the CLI terminal UI where a progress indicator showed an incorrect directional arrow after its target was already met.