Constellation · 06
Trust
Deputy: supply chain you can audit
Why this band exists
Your product is your dependency graph. Most teams treat that graph like weather. Remade Trust is how you own it: offline when needed, scanned on change, deployable on purpose, so a remade internet does not ship on a poisoned lockfile.
Why now
Memory-safe Rust removes a class of accidents. It does not stop a malicious build.rs. Supply chain casual became normal when yellow CI badges replaced review. Disco firmware and Home Computer apps cannot depend on crates.io staying honest and online forever.
How it fits
Every other constellation star pulls crates. Media codecs, Mind weights glue, Memory stores, Identity verifiers, Edge firmware: Trust is the gate in front of all of them. Without it, Digital Freedom for users is theater while your build is a lottery ticket.
Stars in Trust
Each crate is open under Remade-With-Rust. Open the repo, then the field note, then compose with the rest of the sky.
Deputy · replaces unchecked supply chains
Dependency discovery, offline vault, change scan
What to build first
- A Deputy-backed mirror of the crates you actually ship
- CI that treats Cargo.lock diffs as code review, not weather
- Release trains that still compile when the public registry has a day off
Field notes in Trust
cargo vet Criteria: safe-to-run vs safe-to-deploy in Rust
cargo vet fails a build until each dependency is audited, imported or exempted. What safe-to-run and safe-to-deploy promise, and how to read a red vet job honestly.
November 10, 2026
The Rails ImageMagick Flaw Validates remade_ffmpeg_rs
On 4 November 2026 Rails patched an ImageMagick upload flaw scored 9.8. remade_ffmpeg_rs is how the house keeps the FFmpeg C binary off that path.
November 4, 2026
How To Use Deputy With Your Next AI Assisted Coding Project
How to use Deputy with your next AI assisted coding project: vault every crate the agent adds, verify hashes, and keep builds working when crates.io blips.
October 24, 2026
Pure Rust Alternative for PHP
The pure Rust alternative for PHP never starts that interpreter. Services on mata.network do not run the PHP2Shell worker, so the bug is not on their path.
October 23, 2026
Is Your Samsung TV Always Listening?
A 21 October 2026 report says a new Samsung TV was always listening. Remade's protection is a home microphone and camera that stay on the LAN.
October 23, 2026
Cloudflare's 21 October Edge Fix, and Why the House Is Not That Edge
Cloudflare fixed a minor India cache delay on 21 October and shipped a PHP2Shell firewall rule. A MATA home computer still answers on the LAN.
October 21, 2026
GitLab's Regex Compiler Overflow, and the Patch on 21 October
GitLab patched CVE-2026-110264, a critical regex-compiler overflow that can run code with no login on self-managed servers. The MATA cloud is not GitLab.
October 21, 2026
Node.js on 21 October: Four High Fixes in the Runtime
On 21 October, Node.js 26.12.1, 24.22.1, and 22.23.4 patch DNS, TLS hostname checks, and a Brotli decoder bug. The MATA cloud does not run Node.js.
October 21, 2026
The rest of the constellation
Six technology bands, one sky. Open another star, or return to the full map.
01
Media
ffmpeg, H.264, Opus, PNG/JPEG: pure Rust pipelines
02
Mind
FFAI, Mercury, Carmenta, Diana: AI that stays local
03
Memory
rusty_alloc, SpaceDB: local-first replicas
04
Identity
mID & Sovereign ID: keys you hold
05
Edge
ESP mesh nodes: neighborhood hardware