6e:I[823534,["$8","$9","$a","$b","$c","$d","$e","$f","$10","$11","$12","$13","$14","$15","$16","$17","$18","$19","$1a","$3e","$3f","$40"],"LayoutToggle"] 6f:I[441408,["$8","$9","$a","$b","$c","$d","$e","$f","$10","$11","$12","$13","$14","$15","$16","$17","$18","$19","$1a","$3e","$3f","$40"],"MobileFilterBar"] 70:"FloatingFilterFab" 71:I[946850,["$8","$9","$a","$b","$c","$d","$e","$f","$10","$11","$12","$13","$14","$15","$16","$17","$18","$19","$1a","$3e","$3f","$40"],"$70"] 72:I[384464,["$8","$9","$a","$b","$c","$d","$e","$f","$10","$11","$12","$13","$14","$15","$16","$17","$18","$19","$1a","$3e","$3f","$40"],"PostList"] 73:T1dbc, Phosphor lasted a month on this site. It is still in the registry, still passes every gate, and any DCYFR property can pin it. dcyfr.ai itself now ships in obsidian, and this post is about what that identity is, how its colours were measured, and what the theme engine grew to carry it. **Update, October 1, 2026:** obsidian now has five cuts, not six. The cut this post calls Fire is now called Rainbow and keeps its gold ramp and its multi-hue sheen. The cut this post calls Rainbow is retired. Rainbow is now the only cut with a pattern: black, red, blue and green have no sheen. Each cut also shows its colour at rest: links, dividers, borders, text highlights and avatar fallbacks take the cut's colour, and in red, blue, green and rainbow the dark hero and the stats band sit on a deeper tint of it. Light page sections stay cream. A browser that stored Fire keeps the same look under its new name. The rest of this post describes obsidian as it launched on September 29. ## What obsidian is Obsidian is volcanic glass. Held flat it is black. Tilt it and colour appears where the light crosses the surface: a mahogany mottle, a green cast, a band of blue, a whole spectrum. The identity takes that literally. One near-black ground and one warm off-white paper are shared by every variant, the surfaces, status colours and lines never change, and colour lives in three places only: the accent ramp, a single dramatic surface the contract calls the field, and a sheen laid over it. The dark scheme is the stone; the light scheme is the same stone on paper. Both keep the contract's AA pairs, and the static contrast gate in this repository walks every cut in both schemes on every pull request that touches the site's source. ## Six cuts A cut is a colour-only variant of one identity. Obsidian declares six: black, red, blue, green, fire and rainbow. Black is the base, and the base is what a visitor sees until they choose otherwise. Each cut's accent ramp and field were measured from photographs of natural stone. The values are pixel statistics from those photographs: which hue bands are present and how much of the surface they cover, how dark the ground is, and how far the coloured band sits from the black. The references are all photographs of stone: - **Black**: a museum specimen photographed by Karelj (National Museum, Prague; [Wikimedia Commons](https://commons.wikimedia.org/wiki/File:Obsidian_1.jpg)) and a Lake County, Oregon piece ([Commons](https://commons.wikimedia.org/wiki/File:ObsidianOregon.jpg)). - **Red**: James St. John's photographs of mahogany obsidian from Glass Buttes, Oregon ([Commons]()), hematite mottling in black glass. - **Green**: Craig Skinner's scans of a Pachuca-sourced obsidian scraper from Spiro Mounds ([Commons](https://commons.wikimedia.org/wiki/File:Spiro_Mounds_Obsidian_Scraper_with_Mesoamerican_origin,_Dorsal,_Craig_Skinner_of_the_Northwest_Research_Obsidian_Studies_Laboratory.jpg)) and Tonallimunoz's field photograph of golden obsidian at Cerro de las Navajas ([Commons]()). - **Blue**: obsidian has no natural blue body colour; what sells as blue obsidian is furnace glass. The blue cut is the blue band of rainbow and silver-sheen specimens, gated by hue, from James St. John's Jalisco photographs ([Commons]()). - **Fire**: fire obsidian from Glass Buttes, photographed by Robert Weldon with photomicrographs by Nathan Renfro, in GIA's Gems & Gemology, Summer 2023, ["Fire Obsidian's Beguiling Spectrum"](https://www.gia.edu/gems-gemology/summer-2023-in-the-spotlight). Those photographs are all rights reserved; they were measured as references and are not reproduced here. - **Rainbow**: James St. John's rainbow obsidian from Jalisco ([Commons]()) and a velvet rainbow specimen from the Huichol region ([Commons](https://commons.wikimedia.org/wiki/File:Velvet_rainbow_obsidian.jpg)). The Commons file pages carry each photographer's licence. Nothing from the reference set ships with the site: the theme file carries the measured values and nothing else. ## The cut axis Contract v3 gives an identity a cut axis. `data-identity` on the root element still says which identity the site ships, stamped at build time. `data-cut` on the same element says which cut, and a cut overlay may re-author the accent ramp, the field group and the sheen, plus a short allow-list of hairline and muted tones where the stone demands it; obsidian's cuts use only the first three. Everything else falls through to the identity. The base cut is the absence of the attribute, so a page with no stamp and a page stamped `black` render the same thing. On dcyfr.ai the visitor chooses. A button in the header shows the current cut and opens the chooser, a labelled radio group naming each cut in words beside a swatch. A pick writes one first-party cookie, `dcyfr-cut`, holding the cut name and nothing else for a year, restamps the page in place under the engine's one-frame transition suppression, and stops there. The server reads the cookie on the next request and stamps the cut into the served markup, so there is no flash and no client-side guessing. Delete the cookie and the base comes back. The privacy page describes the cookie in those terms. Satellites do not get a chooser. A satellite pins one cut at build time, the way every property pins one identity. ## The field and the sheen Three new variables and one image value carry the drama. `--field` is the ground of one surface a page may use for emphasis, `--field-foreground` and `--field-accent` are the text and the accent on it, and `--sheen` is a gradient stack (or `none`, on the black cut) that the engine lays over the field at low opacity. Sheen is never a fill, and three engine utilities are the only place it is drawn. `.field` paints the surface and shows the sheen at rest. `.sheen-hover` keeps it invisible until hover or focus. `.sheen-scroll` widens the layer and drifts it with the element's own view timeline, a CSS scroll-driven animation with no scroll listener behind it. Reduced motion removes the animation and keeps the information: the field keeps its static layer, the hover reveal still happens without a transition, and the scroll drift never attaches. Forced colours drop the layer, since it is decoration. ## What stayed The contract stayed, at 41 variables now: surfaces, brand, status, type, motion, radius, and the field group. The engine stayed, and the cut axis is an addition to it. Slate and phosphor stayed in the registry and satisfy the same contract, so a property that wants the warm paper pins `phosphor` and gets it, and the [design colophon](/design) still switches between all three in place. What changed is the identity this one site wears, and the cookie that lets you pick its cut. ## Where to see it The [design colophon](/design) renders every contract token live, previews any cut without writing the cookie, and shows all six cuts side by side on one page. The [registry gallery](https://registry.dcyfr.ai/gallery) does the same for every published component. If you read the [phosphor post](/blog/phosphor-redesign) when it went out, the engine it described is the one still running; it learned one more axis. 74:T1056, If you have been here before, you noticed. The cool slate-and-blue that dcyfr.ai wore since launch is gone from this site, replaced by warm paper, vermilion accents, and serif headlines. The identity is called phosphor, and this post is about the part of the redesign you cannot see: the engine that let us swap an entire visual identity by changing one attribute. ## A redesign as a config change Most redesigns are rewrites wearing a trench coat. Every hardcoded color, every component with an opinion about its own font, every one-off border radius becomes a migration line item, and the project balloons until someone cuts scope. We spent the effort somewhere else. Before touching a single color, we extracted a **theme engine**: a token contract of 37 CSS variables covering surfaces, brand, status, type, motion, and radius. Components consume tokens and only tokens. A theme file supplies the values for one identity, scoped to a `data-identity` attribute on the root element, with a light block and a dark block. The site stamps that attribute at build time. Once that held, the redesign collapsed into authoring one new theme file and flipping the stamp from `slate` to `phosphor`. The old identity did not die. Slate still ships from the same registry, satisfies the same contract, and renders the same components. It is no longer what this site wears. ## What phosphor is Phosphor trades the shadcn-derived cool neutrals for a warmer, more editorial temperament: - **Warm paper grounds** instead of pure white, and a near-black dark scheme instead of navy-tinted charcoal. - **A vermilion accent ramp** with four steps, because one accent value should never serve both fills and text. Filled controls use the 600 step, text on paper uses 700, and 400 is the text-safe step on dark grounds. - **A serif for headlines** (Alegreya), with Geist for running text and mono. Phosphor launched with Alegreya as its body face too; readers found serif running text hard on desktop, so the body role went back to Geist within the first day. Type ships as three role tokens, so the identity decides the faces and the engine decides where they apply. - **Stepped motion** for transforms, continuous easing for color. Radius applies to interface chrome only; imagery stays square by design. ## The gates that keep it honest A contract nobody enforces is a suggestion. The component registry's CI enforces this one in both directions: a theme missing a contract variable fails, and a theme defining an off-contract variable also fails, in either scheme. A render matrix then mounts every published primitive under every identity and scheme in a real browser and checks WCAG AA contrast plus an identity-variance gate, which proves the two themes actually look different where they should. That last check exists because token systems fail quietly. A component that hardcodes a color renders identically under both identities, and no human reviewing a single theme would catch it. The matrix does. ## Where you can see both Runtime theme switching is deliberately rare here. Every DCYFR surface pins one identity at build time, which keeps pages fast and keeps the system honest about what it ships. Exactly two surfaces are allowed to switch live, and both exist to show the engine working: - [The design colophon](/design) on this site renders every contract token, live, with a switcher that restamps the page between phosphor and slate in place. - [The registry gallery](https://registry.dcyfr.ai/gallery) renders every published component under the same switcher, in both schemes. Flip either one and watch the entire page reinterpret itself: same components, same markup, different identity. ## What comes next The engine and both themes live in our open component registry, installable with `npx shadcn add @dcyfr-labs/dcyfr-theme-engine`. The satellite sites still pin slate today and will adopt the engine on their own schedule, which is the point: identities are now versioned artifacts a site chooses, not css scattered across a codebase. When the next identity shows up, it will be a theme file and a build-time stamp, and this post will still be accurate. 75:T2e59, The blog went quiet for a few months while engineering capacity shifted elsewhere. The package didn't. `@dcyfr/ai`, our AI agent harness, kept shipping, and the v3 line is the result: a major release that turned the harness from "config and providers" into an autonomous-agent runtime, then a steady run of security, transport, and tooling work on top of it. This post catches the changelog up, grouped by theme, with what it means if you build on it. --- ## The big one: v3.0 made it an agent runtime v3.0 is a major version, and it earns the bump. Before it, `@dcyfr/ai` was a solid base layer: a config system, a provider registry with fallback, telemetry, a plugin loader, and a delegation framework. It stopped where the interesting part of agent work starts. v3.0 added the runtime pieces that let an agent *run*: remember things, hand off cleanly, and pause for a human when it should. Three additions define the release. - **Session Handoff Chain** (`@dcyfr/ai/session`) replaces single-session handoff with a chain protocol. Multi-hop handoffs preserve conversation history across agent sessions instead of dropping context every time work changes hands. There's a `createHandoffChain()` factory and a typed `HandoffContext` snapshot that travels between sessions. - **Requires-Confirmation workflow** (`@dcyfr/ai/delegation`) adds a `requiresConfirmation` flag to the delegation contract and a `ConfirmationWorkflow` class. Tasks that need human approval enter a `pendingConfirmation` state and log a confirmation timestamp for the audit trail. This is the structural version of "humans own the *what*, the agent owns the *how*": a real gate, not a convention. - **User Context Files API** (`@dcyfr/ai/context`) loads workspace context files (about-me, brand-voice, and the like) with progressive disclosure: list what's available without loading it, then lazy-load individual files. Agents get personalized behavior without anyone hardcoding preferences into them. Alongside those, a minor in the same release brought the **Autonomous Agent Runtime**, a set of tree-shakeable subpath exports that are the backbone of an unattended agent: | Subpath | What it gives you | |---|---| | `@dcyfr/ai/memory` | File-first persistent memory (Markdown), SHA-256 dedup, optional SQLite FTS5 hybrid search | | `@dcyfr/ai/compaction` | LLM-powered context compaction + memory compaction (dedup, summarization, stale-fact archival) | | `@dcyfr/ai/skills` | Dynamic skill injection with BM25 search over skill files and trust-level filtering | | `@dcyfr/ai/mcp` | An MCP tool bridge that discovers server tools and adapts them to the runtime | | `@dcyfr/ai/session` | Session manager with trust-level tool policies (full / sandboxed / readonly) | | `@dcyfr/ai/scheduler` | Agent scheduler with a built-in cron parser, webhooks, and quiet hours | | `@dcyfr/ai/gateway` | Platform-agnostic messaging gateway with input sanitization and rate limiting | These are the parts you'd reach for to build an agent that runs unattended on its own loop: observe, triage, think, act, record. The one breaking change is small and optional: `DelegationContract` now carries an optional `handoff_context` field, so strict TypeScript consumers may see new optional-property warnings. Existing contracts stay valid. No APIs were removed. The version bump is about *scope*, not breakage. v3.0 is where the harness crosses from "set up an agent" into "run one over time." The same release also did some honest naming work: `@dcyfr/ai` is now described as an **AI agent harness** (an infrastructure layer) rather than a "framework." Frameworks dictate your application's structure; a harness gives you the runtime pieces and stays out of the way. That's the more accurate description of what it actually is. --- ## Hardening: security, transport, and tooling Everything after v3.0 is the unglamorous, load-bearing work you want from a dependency you build production agents on. A few themes ran through the v3.1 → v3.3 releases. ### MCP transport got real auth The standout is **v3.2.0: authenticated Streamable HTTP transport for FastMCP servers.** MCP servers run from the harness can now be served over authenticated HTTP rather than local stdio only. That's the difference between "MCP server on my machine" and "MCP server something else can reach, safely." ### Security and supply chain Security work showed up steadily, and some of it mattered to downstream consumers directly: - **v3.0.3** removed the unused `@mistralai/mistralai` dependency. It wasn't imported anywhere (only referenced in a description string) but its presence pulled in a malware advisory (GHSA-3q49-cfcf-g5fm) whose overbroad version range flagged safe installs too. Removing it cleared that alert for downstream projects, `dcyfr-labs/dcyfr-labs` included. - **v3.0.5** strengthened the prototype-pollution sanitizer in the config loader. - **v3.2.1** and **v3.2.4** cleared static-analysis findings (CodeQL warnings and a batch of SonarCloud reliability bugs), and **v3.3.0 / v3.3.1** resolved a CodeQL HIGH in generated config and tightened the version-export path. - **v3.3.2** and **v3.3.3** kept the run going, clearing a HIGH/MEDIUM `undici` advisory out of the transitive dependency tree (and fixing the bundled standalone-Next.js example's build along the way). None of these are headline features. All of them are the reason you can trust the thing. ### CLI and tooling - **v3.2.2** repaired the published CLI bin layout and folded telemetry into `@dcyfr/ai` directly, simplifying what consumers install. - **v3.3.0** added **documentation-parity CI gates**: automated checks that keep the package's docs, env example, and config reference in sync with the code, and that fix a stale `VERSION` export. Drift now fails CI instead of accumulating silently. ### The dependency-currency stream Less visible but worth naming: a continuous run of dependency bumps kept the runtime SDKs current (Anthropic, OpenAI, Google GenAI, LangChain, and the storage drivers), with majors like neo4j and redis moving to 6.x. Each is a one-line changelog entry. Together they're the difference between a package that ages well and one that quietly rots. A feature you can build on is only as good as the maintenance under it. The v3.x line spent most of its commits on transport auth, supply-chain hygiene, static-analysis cleanup, and doc-parity gates. That's deliberate. The v3.0 runtime is the capability; everything since is making it safe to depend on. --- ## What changed for you If you build on `@dcyfr/ai`, here's what to do with all this. - **Upgrading to v3 is low-risk.** No public APIs were removed. The one breaking change is the new *optional* `handoff_context` field on `DelegationContract`; strict-mode consumers may see optional-property warnings, nothing more. - **New power is opt-in.** The agent-runtime capabilities ship as tree-shakeable subpath exports (`@dcyfr/ai/memory`, `/scheduler`, `/session`, and the rest). Import only what you use; your bundle doesn't pay for the parts you don't. - **If you run MCP servers, look at v3.2.0.** Authenticated Streamable HTTP transport is the upgrade that lets you serve FastMCP servers beyond local stdio without giving up access control. - **If you consume the package downstream, the security fixes are free wins.** The mistral-dep removal and prototype-pollution hardening clear real alerts; pulling them in is an upgrade, nothing more. - **Pin to the current v3.x line.** That's where the active work (features and fixes) lives. - **Install:** `npm install @dcyfr/ai@latest` to land on the current v3.x release. - **Breaking change to know:** `DelegationContract` gained an optional `handoff_context?: HandoffContext`. If you're on TypeScript strict mode, expect new optional-property hints. No code change is required for existing contracts. - **Adopting the runtime:** the agent-runtime features are additive subpath exports. Existing `AgentRuntime` usage is backward compatible; you opt into memory, scheduling, sessions, and the gateway as you need them. - **MCP servers:** if you serve FastMCP, evaluate moving to the authenticated Streamable HTTP transport added in v3.2.0. - **Current latest is `3.3.3`.** `@latest` lands you on the most-patched release. v3.3.2 and v3.3.3 are pure hardening on top of v3.3.1: an `undici` advisory cleared from the transitive tree, no consumer-facing API changes, so there's nothing new to adopt beyond the security wins. --- ## What's next A few directions, without hard dates. - **More on the runtime in practice.** The v3.0 subpaths are the toolkit; an upcoming series covers how they fit together. Part 2 walks the autonomous-daemon architecture, with the security and cache-economics pieces following it. - **Keeping the doc-parity discipline.** The v3.3.0 gates are the floor, not the ceiling. The goal is that the published docs are never ahead of or behind the code that ships. - **Steady currency over big swings.** Expect the dependency stream and the security cleanup to keep going. For a package other projects build on, "boringly current and well-patched" is a feature. If you want the unabridged version, the [CHANGELOG](https://github.com/dcyfr-labs/dcyfr-ai/blob/main/CHANGELOG.md) has every entry, and the [package page](/ai) has the current overview. 76:[["post-20260929-6f2a9c1e",9],["post-20260831-82f19d24",25],["post-20260622-fb1ab44a",33]] 6d:["$","div",null,{"id":"blog-posts","className":"w-full min-w-0","children":[false,["$","div",null,{"className":"mb-6 flex justify-end","children":["$","$L6e",null,{"currentLayout":"magazine"}]}],["$","div",null,{"children":[["$","div",null,{"className":"mb-4","children":["$","$L6f",null,{"selectedCategory":"","selectedTags":"$31:props:children:1:3:props:tags","readingTime":"","categoryList":"$5e:props:children:props:children:0:props:categoryList","categoryDisplayMap":"$5e:props:children:props:children:0:props:categoryDisplayMap","tagList":["Open Source","Accessibility","CSS","Design Systems","Web","Agents","AI","Release Notes","TypeScript"],"query":"","sortBy":"newest","dateRange":"all","totalResults":3}]}],["$","$L71",null,{"activeFilterCount":1,"hasFilters":true}],["$","$L72",null,{"posts":[{"id":"post-20260929-6f2a9c1e","slug":"obsidian-identity","title":"Obsidian: Black Until the Light Moves","subtitle":"The dcyfr.ai identity after phosphor: one stone, six cuts, and a chooser","summary":"dcyfr.ai now ships in obsidian: one near-black ground, colour held in the accent ramp and the field, and six cuts measured from photographs of the stone. This post covers the cuts and their references, the cut axis and its cookie, the field and sheen layer, and what stayed the same.","publishedAt":"2026-09-29T12:00:00Z","updatedAt":"2026-10-01T12:00:00Z","category":"Web","tags":["Design Systems","Web","CSS","Accessibility","Open Source"],"featured":true,"archived":"$undefined","status":"$undefined","draft":false,"body":"$73","previousSlugs":"$undefined","previousIds":"$undefined","image":{"url":"/blog/obsidian-identity/assets/hero.webp","alt":"A faceted block of volcanic glass on dark cloth, one band of light crossing its face and lifting a narrow spectrum out of the black","caption":"Obsidian: black until the light moves","description":"Contour-line style in ember red, amber and pale gold on a navy ground: one block of obsidian, its fracture faces made of fine flowing lines, a single band of light crossing the face.","credit":"FLUX.2 Pro (fal.ai)","width":1600,"height":840},"series":"$undefined","authors":["drew"],"authorId":"dcyfr","credits":"$undefined","readingTime":{"words":1141,"minutes":6,"text":"6 min read"}},{"id":"post-20260831-82f19d24","slug":"phosphor-redesign","title":"Phosphor: One Contract, Two Identities","subtitle":"The dcyfr.ai redesign, and the theme engine that made it a one-line change","summary":"dcyfr.ai has a new visual identity called phosphor: warm paper, vermilion accents, serif headlines. This post covers the theme engine behind it, the 37-variable contract both identities satisfy, and where you can flip between them live.","publishedAt":"2026-08-31T12:00:00Z","updatedAt":"2026-08-31T12:00:00Z","category":"Web","tags":["Design Systems","Web","Open Source","CSS","Accessibility"],"featured":true,"archived":"$undefined","status":"$undefined","draft":false,"body":"$74","previousSlugs":"$undefined","previousIds":"$undefined","image":{"url":"/blog/phosphor-redesign/assets/hero.webp","alt":"A dashboard of rounded control cards with sliders, toggles, dials and charts, set in a browser window frame","caption":"Phosphor and slate: two identities rendered from one token contract","description":"Contour-line style in teal, orange and red on a navy ground: a browser frame filled with a grid of UI cards, every control outlined in fine rules. One token contract, many components.","credit":"FLUX.2 Pro (fal.ai)","width":1600,"height":840},"series":"$undefined","authors":["drew"],"authorId":"dcyfr","credits":"$undefined","readingTime":{"words":678,"minutes":4,"text":"4 min read"}},{"id":"post-20260622-fb1ab44a","slug":"whats-new-in-dcyfr-ai-v3","title":"What's New in @dcyfr/ai: The v3 Line","subtitle":"A catch-up release note on where the AI harness landed across the v3.x releases","summary":"A short, honest changelog: what shipped in the @dcyfr/ai v3.x line, what changed for people building on it, and what comes next — catching the blog up with work the package already produced.","publishedAt":"2026-06-22T12:00:00Z","updatedAt":"2026-06-22T12:00:00Z","category":"AI","tags":["AI","Release Notes","Open Source","Agents","TypeScript"],"featured":true,"archived":"$undefined","status":"$undefined","draft":false,"body":"$75","previousSlugs":"$undefined","previousIds":"$undefined","image":{"url":"/blog/whats-new-in-dcyfr-ai-v3/assets/hero.webp","alt":"A space shuttle stands on a lit launch pad beside its red gantry tower under a starry sky","caption":"What's new in @dcyfr/ai — the v3 line","description":"Contour-line style in navy, cream and red: a shuttle on the pad at night, the service tower lit, sky swirling in fine lines. A new major line on the pad.","credit":"FLUX.2 Pro (fal.ai)","width":1600,"height":840},"series":"$undefined","authors":["drew"],"authorId":"dcyfr","credits":"$undefined","readingTime":{"words":1393,"minutes":7,"text":"7 min read"}}],"latestSlug":"obsidian-identity","hottestSlug":"owasp-top-10-agentic-ai","titleLevel":"h2","layout":"magazine","viewCounts":"$Q76","hasActiveFilters":true,"emptyMessage":"No posts found. Try adjusting your search or filters.","searchQuery":""}],false]}]]}]

Blog

Obsidian: Black Until the Light Moves

Phosphor: One Contract, Two Identities

What's New in @dcyfr/ai: The v3 Line

Obsidian: Black Until the Light Moves

Phosphor: One Contract, Two Identities

What's New in @dcyfr/ai: The v3 Line