# AI Hacker Daily — 2026-08-25 The stack is losing parts, and the state is moving into a bucket.

An MIT-licensed Rust git server, pushed to GitHub Saturday night by Tobias Lütke as "initial public release" and at 1,341 stars by this morning. You run one binary and point it at an S3 or GCS bucket; you get smart HTTP push and fetch, fresh clones served as static `bundle-uri` files from the bucket or a CDN, Git LFS, a browsing web UI, a JSON API with an SDK, per-repository push policy and webhooks. Every push is an immutable pack in the bucket plus a compare-and-swap rewrite of a tiny manifest; every read starts with one conditional GET, usually a 304. The README's line for it: "Kill them all and you lose warmth, nothing else." It is an implementation of Cursor's *Git at any scale* design — the system Cursor calls Continuity, published August 18 and not open-sourced — with the additions needed to serve a repository from machines smaller than it: pack indexes local and pack data read by HTTP range request, a derived history pack of commits and trees so only blob bytes cross the network, and bundles cut on calendar slots so a clone never touches the server. The reference workload in the repo's own manual is a 57 GiB, 73-million-object, 466,000-ref monorepo served from hosts whose disk is 20 GiB of tmpfs; the draft announcement claims CI's blobless sparse clone went from 35 minutes to 8 seconds. The machine-facing docs are the primary docs here, which is the first thing our standing check noticed: `GOAL.md` and `AGENTS.md` are addressed to "everyone (humans and agents)" and say to read them before the README, and they are candid in the way that matters — the object-store cost model is stated (60–80 ms per GET), and the pre-1.0 rule is blunt: "We owe nothing to previous shapes of this system... delete the old shape in the same change." The thread was less kind. The top comment could not find the why ("There's a git server, it's installed when you install git"). Then Kelly Sommers read the lease code and posted this: "Walgit leans on S3 primitives but has classic distsys bugs. Tests pass cuz its memstore makes cond deletes. But w/ S3 it HEAD->compare->DELETE so stale owner can delete new lease. The code incorrectly says S3 lacks conditional DELs." Leases are, per the README, "the only cross-instance mutex." The repository has three commits; the third, a hardening PR merged at 02:28 UTC today, touches admin, ingest and runtime stalls, and nothing in the log references the lease path. Whoever wrote the code — the thread's "Tobi didn't write any of this" is an accusation, not a finding — the bug report is the thing to check before the star count. Reach for it if you host a monorepo that no longer fits the machine serving it, or you want a git remote that any disposable box can serve for a fleet of agents fetching all day. It replaces the self-hosted git server whose disk is the thing you back up. Tradeoffs: three commits and five watchers behind 1,341 stars; no release binary — building needs Rust, protoc, Node 24 and pnpm, or Nix, or the Containerfile; an unfixed lease race reported by a distributed-systems engineer on day one, in the one mutex the design has; the object-store round trip is the price of the architecture, and the bundles, caches and history packs are where the complexity moved rather than where it vanished; no code review, issues or CI, by design; and two days old, pre-1.0, with a manual that promises to break shape without notice.

An Apache-2.0 Rust server for Durable Streams over HTTP: create, append, read, long-poll and SSE on cheap, URL-addressable streams, with either its own Pico protocol or ElectricSQL's Durable Streams protocol as the facade. The storage engine is `s3stream`, shipped as a library in the same repo — "it owns the WAL, object layout, caching, and compaction" — which the author says is built from AutoMQ's core primitives; coordination is a command log in SQLite for one node or Postgres for a cluster. `cargo install --path picomq/pico-cli`, then `pico serve --meta-url sqlite:./data/meta.db --storage file://./objects` for a single node, or a Docker Compose that brings Postgres and RustFS for one or two nodes. The `pico` CLI creates, appends, reads, tails and benchmarks streams; the admin dashboard is embedded in the binary. Auth is off by default and a non-loopback bind refuses to start without `--auth required` or an explicitly named `--insecure-allow-remote`, which is the fail-closed default we keep asking for. The positioning against Kafka is the useful part, in the author's words: "Kafka is great at being a huge pipe, so you'd create topics like tables. PicoMQ, on the other hand, recommends creating granular streams that make the most sense, say, by user, session, or vehicle (still bottomless)." A shared write-ahead log across streams is the answer to the obvious objection about S3 write latency — 100–150 ms on standard S3, under 10 ms on Express One Zone per a commenter — and the comparison to S2 is stated plainly: "S2 is not open source, and the OSS version is S2-Lite, which is single-node only and uses SlateDB." The protocol angle matters more than it looks: the author believes ElectricSQL's Durable Streams project is likely to be abandoned after its acquisition, and this is an independent implementation of the spec. Read the purity claim carefully, though — "zero-disk" is about the data path. The metadata plane is a SQL database, and the cluster deployment ships a Postgres with it. Reach for it if your workload is a million small ordered logs — chat rooms, per-agent event streams, device telemetry — and you are running Kafka or Redis Streams for it. Delete the Kafka cluster you run for a workload that is not actually a big pipe. Tradeoffs: two weeks old, 179 stars, no release binary — cargo or Docker; the latency is object-store latency unless you pay for the low-latency storage class; the metadata plane is Postgres, so the deployment is not one binary even if the server is; the protocol it fronts has an uncertain upstream; the author's hosted pricing is "going to be dirt cheap," future tense, no plan shipped; and it cannot run serverless, which the thread asked for first.

An MIT-licensed, TypeScript, self-hosted library for the EPUBs and PDFs you already own: one server-rendered page lists them, a search box filters them, each format gets its own in-browser reader, and the whole thing runs either as a Cloudflare Worker over R2 or as a Node server over a directory on disk. There is no database. The library is a regenerable tree of files that a sync tool builds and publishes — `npm run sync -- --create` makes the bucket and uploads — and profiles and reading positions live in the same storage, so there is exactly one thing to back up. A Docker image ships the cover-rendering tools; `BOOKSHELF_READ_ONLY=1` turns a public instance into a read-only shelf, enforced where writes happen rather than by hiding forms. R2's free tier covers a personal library with room to spare. It is here because its author gave the theme its clearest sentence. Asked in the thread what possesses someone to make an ebook library that only works on object storage, murerkinn answered: "I wanted something with as little infrastructure as possible, ideally no database or additional services to maintain, while still having my library available anywhere." That is the whole slate's thesis from its smallest project. Our machine-facing docs check came back empty in a new way: `CLAUDE.md` points at an `AGENTS.md` that is entirely the auto-generated Next.js "This is NOT the Next.js you know" block — nothing about the project. The candor lives in the README's "Not done yet" instead, and it is complete: "There is no authentication. Anyone with the URL can read and download the whole library," nothing is encrypted and "a bucket listing names the shelf," and two devices reading as one profile is last-write-wins. Reach for it if you own your books, want them on every device, and refuse to run a VM for it. Delete the Calibre-web container and the VPS it lives on. Tradeoffs: no auth, so a public URL is a public library — put Cloudflare Access or a trusted network in front, and take the thread's legal point about accidentally public buckets full of books seriously; nothing encrypted at rest; the sync tool uses `which` to find its image tools, so Windows is unsupported; Node 24; no OPDS, so Kindle and KOReader integration stays with something like copyparty; and 172 stars, zero watchers, eight days old. The interesting extension point is real: storage providers are packages anyone can publish and name in the config.

An Apache-2.0 Rust container and resource runtime whose first published release, v0.7.0, shipped yesterday: static binaries for x86_64 and aarch64, a Windows shim and a WSL rootfs, each checksummed, from a GPG-signed and OpenTimestamps-anchored tag. It runs real OCI images — pull, build from a Dockerfile, commit, push — and starts a box from one in about 3.5 ms. Always rootless: user, PID, mount, network, UTS and IPC namespaces, a deny-by-default seccomp allowlist, cgroup v2 limits; `--security-profile untrusted` bundles the allowlist, `--cap-drop ALL` and a read-only root into one flag, and `--require-limits` refuses to start unless the memory and pid caps are actually enforced. It reads the `docker-compose.yml` you already have, ships an MCP server and Python and Node SDKs for agents, and its entire Rust dependency tree is `libc` — JSON and OCI manifests parsed by hand, `pull` shelling out to the `curl` and `tar` on the machine. Linux, WSL2 and ARM boards only. As of v0.7.0 the CLI surface is frozen, with a test that fails the build on any undocumented change. The candor is the best we have seen on a runtime. "What kern is not" leads with the escape hatch: "The boundary is the Linux kernel, so a kernel privilege-escalation bug is an escape" — untrusted and AI-generated code is what it is for "because you chose to run it and own the blast radius," and what it is not for is "hostile code from strangers, multi-tenant." A mount "is a trust decision you make, not a boundary kern enforces." `OPEN_ITEMS.md` is a file of things it "does not do yet, or does not know," each with what it costs you and what would settle it — including "whether a survivable denial helps an attacker is not known." `BENCHMARKS.md` measures cold starts against Docker, Podman, runc and bubblewrap on one named machine, ships the script to reproduce them, and tells you how not to charge the measurement for its own forks; it also says to read the numbers as "fast class," not as a guarantee. We did not reproduce them — the script is Linux-only and this desk is Windows. This is the on-your-own-kernel rung of the sandbox ladder we built on August 20, and it is enforcement rather than policy, the distinction yesterday's slate kept failing. Today's 156-point essay on LLMs taking over their host machines through the inference engine is the demand side. Reach for it if agent tool-calls, CI steps or generated code run on a Linux box where Docker's daemon is the only wall. Delete Docker Desktop for the compose stacks you run on Linux or WSL2 — "Your Docker Compose stack, without Docker Desktop" is the repo's own section title. Tradeoffs: no macOS, and Windows means WSL2; the boundary is the shared kernel, so it is a sandbox for code you chose to run, not for strangers' code; 151 stars, two watchers, one day past its first release; no CRI, no GPU slicing yet; no custom seccomp profile from a file, a deliberate hold the maintainer explains rather than a gap; and the dependency-free choice means the host needs `curl` and `tar` for image pulls.

An Apache-2.0 Go tool that mines Claude Code's JSONL transcripts into `.claude/sessions.db` inside each project and searches them semantically — bge-m3 embeddings from a local Ollama, with an FTS5 BM25 fallback when Ollama is absent. A Stop hook mines each session as it ends; a SessionStart hook injects relevant past context "based on current git branch + recent commits"; a `/recall` skill answers ad-hoc questions; `search --json` returns a documented schema. A separate `distill` step extracts subject–predicate–object facts through an LLM call and never runs automatically. `go install ./cmd/session-indexer`, no CGO, one binary, no daemon. It did 72 votes on Product Hunt today. The README's argument is the theme applied to memory, and it names names: mempalace, agentmemory and MemMachine "all run on a single shared backend," and "if it dies, everything on it dies at once." Per-project, append-only, idempotent `mine` — "the worst failure mode is losing one project's DB," recoverable by re-mining the JSONLs. The maker's framing of the gap is exact: "session-end gives you 'where I left off,' but not 'what did we decide about X three weeks ago.'" Our docs check read its `CLAUDE.md` and found the architecture stated with its limits attached: search is an exhaustive cosine scan, and there is no reindex — a schema mismatch tells you to delete the database and re-mine. Claude-obsidian re-trending today at 12,290 stars is the vault-shaped answer to the same question; this is the index-shaped one, and it asks you to run nothing. Reach for it if a project has dozens of past sessions and you keep re-deriving decisions you already made. Delete the hosted memory MCP server, if the memory is yours alone. Tradeoffs: 30 stars, one watcher, one fork; the hook setup instructions reference the author's own `~/wrk/common/skills` path, which is an install guide written for one user; Go 1.26.6 or newer, plus Ollama and a 1024-dimension model for the semantic mode; auto-injection at session start is context you did not choose, with the token cost and drift that implies; the facts layer sends your transcripts through a model; and it is single developer, single machine by design — team memory is "a conversation/PR/doc, not something this tool does."

A Go, AGPL-3.0 private search engine for the pages you visit and the files you keep, by Adam Tauber, who created searx in 2013 and remains its top contributor. It indexes full page contents — a Firefox or Chrome extension sends them to a server you run — and answers from a web UI, a TUI, the command line, or an AI assistant over MCP. Download the binary, `./hister listen`, install the extension; no configuration for a personal setup, on Linux, macOS or Windows. v0.18.0 shipped Sunday and is what pushed it onto the Go trending feed: imports of PDF, DOCX, Markdown and Org files; extractors that preserve post, reply, author and reaction data from Twitter, Bluesky, Reddit and Discourse; incremental imports from Linkding, Readeck and wallabag; `sort:date` and friends; and a bulk `hister update` over any query. Semantic search is optional and goes through an embeddings endpoint you choose. No telemetry, no cloud sync, multi-user if you want a shared server. 2,548 stars, 115 forks. It is the last rung — delete the cloud — and the one mature, institutional-author pick on a slate of two-week-old repos. The lineage is the point: the person who built the meta-search engine for the public web built the one for your private web, and it answers about your browser the question session-indexer answers about your sessions — where did I read that. The privacy notes are specific rather than reassuring: the extension sends indexed content only to the server you configure, plus favicon downloads, and semantic search sends document text to whichever embeddings endpoint you enabled. Reach for it if your bookmarks are a graveyard and "I read this somewhere last month" happens daily. It replaces the read-it-later subscription — it imports from three of them — and the habit of re-googling your own history. Tradeoffs: AGPL-3.0; a CGO build if you compile it yourself; the extension captures everything you read unless you configure what it indexes, and a full-text database of your browsing is a liability on a shared or seized machine; semantic mode is bring-your-own-embeddings; and "your own search engine" means your own data, not the web — this is not a searx replacement and does not try to be.

**Also on the board.** Yesterday's harness theme did not stop: *Headlong* (Laude Institute and MIT, Apache-2.0, 463★, 78 points) is "a complete agent harness with a core of less than 10K lines of Bash," whose defining feature is an agent that keeps thinking between messages; it is "alpha research software," installs by `curl | bash`, costs "$1–2 hourly" to leave running, and the post admits its shared agent "is bad at keeping secrets." One commenter counted four new harnesses in a day — exo, Headlong, agent-lightning, prime-agent — and another wrote the line of the thread: "Harnesses really are the new 'javascript framework' aren't they?" • *ambient-context* (86★, created at 00:33 UTC today) is a macOS menu-bar app that reads your focused window's text through the accessibility tree every few seconds and appends it to one markdown file per day for Claude Code to read — no screenshots, no network calls, an `AGENTS.md` in the capture folder explaining the format; build it yourself, Apple Silicon only, and the license habit fired: there is no license file. • *Flare* (83 votes, MIT, 153★, v1.1.0) is an Electron IDE that draws the repo as a graph — files as nodes, imports as edges — and runs Claude, Codex or OpenCode inside it: "Flare reads the repo instead of the conversation." • *Agnost AI* (#3, 116 votes) reads production agent conversations for silent failures and drift — closed SaaS; *Buddy Visual Tests* (70 votes) is visual regression with a CLI, MCP and skills so an agent can rerun its own UI checks. • Seen-before SQL flagged three re-trends: *openclaw* (387,555★, first crossed our pool June 6), *freellmapi* (20,093★, "personal experimentation only," June 22) and *claude-obsidian* (12,290★, August 11); *pi-autoresearch* (7,842★, created in March, last pushed in July) and *aws/agentcore-cli* (v1.0.0-preview.28, `npm install -g @aws/agentcore`, replacing the Python starter toolkit) are mature tools crossing on a quiet Tuesday, not launches. • And the day's most-discussed AI item (156 points) was an essay arguing LLMs could control their host machines by exploiting the inference engine — news, not product, and the reason a 1.52 MB kernel-enforced sandbox is a pick. *Verification note: stars, watchers, forks, licenses, creation dates and release tags come from the GitHub API on 2026-08-25. The machine-facing-docs check ran on the three picks that carry such files: candid on walgit (`GOAL.md` and `AGENTS.md` are the primary docs and state the cost model and the no-compatibility rule), empty on Bookshelf (the `AGENTS.md` is Next.js boilerplate; the candor is in the README's "Not done yet"), and candid-with-limits on session-indexer (`CLAUDE.md` discloses the exhaustive cosine scan and the absence of a reindex). Kern's `OPEN_ITEMS.md` served the same purpose without being agent-addressed. Kelly Sommers' lease-race report was read from her post directly and checked against walgit's commit log, which has three commits and none touching leases; Cursor's post was read for the Continuity mechanism and its 120/300 pushes-per-second figures, which are Cursor's, not walgit's. Kern's benchmarks were not reproduced — the script is Linux-only and this desk is Windows — so its cold-start numbers above are the maintainer's. HN point counts are from the Algolia items endpoint at compose time. Seen-before SQL: openclaw, freellmapi and claude-obsidian are re-trends; every pick is first-time. Today's pool was 88 — hn:front 30, hn:show 26, producthunt 23, github:trending 9 rows across four feeds with the rust feed back from zero at three rows, and Reddit dark for the twenty-second consecutive week.*