The Show HN (45 points, 22 comments, posted 14:54 UTC by atomburst) is npx geiger-scan, and the README's opening argument is the same one made above with different numbers: an open-source agent harness went from zero to 200,000 stars in three weeks, its plugin ecosystem passed 13,000 repositories in the same window, one-click desktop clients appeared the day it launched, "Instagram carousels now teach office workers to install all of it," and "every one of those installs is a program that can execute commands, read files, and hold credentials — configured in dotfiles nobody looks at twice." Geiger (MIT, JavaScript, Node 18+; 93 stars, two forks, created September 6) reads known config locations and reports what it finds: Claude Code's global and per-project MCP servers, hooks, plugins, skills, subagents and apiKeyHelper; MCP hosts across Claude Desktop, Cursor, Windsurf, VS Code user and project scopes, Cline, Roo Code, Continue and Zed; sixteen other agent CLIs including Codex, Gemini, Kilo, Grok Build, Aider, OpenCode, Qwen Code, Goose, JetBrains Junie, Open Interpreter, LM Studio, Ollama and DeepSeek Harness itself; AI extensions in VS Code, Insiders and Cursor; JetBrains AI Assistant and MCP settings per product; agent packages in global npm roots, "read directly — npm is never executed"; and AI extensions in Chrome, Edge, Brave and Firefox profiles, with their granted permissions. Every finding carries what it is, where it came from (registry, store, git, local script, remote server, or UNKNOWN-ORIGIN), an exposure label from a fixed set — EXECUTES, HOLDS-SECRETS, BROAD-FILESYSTEM, BROAD-WEB, NETWORK — and the evidence path so you can verify by hand. The sample output in the README shows the shape of the answer: nine findings across three ecosystems, seven that can execute code, one credential sitting in a config file, and a note that one MCP server is wrapped by a policy agent, which Geiger reports as both layers rather than hiding the real server behind the wrapper. Output modes are the terminal report, --html with per-finding remediation blocks, and --json with a versioned schema; --path adds project directories, --home scans another user profile or a mounted image, and --strict exits 2 if anything can execute code or holds secrets.

The three promises are what make it worth running, and the repository backs each one where a reader can check. Read-only: the only write is the report file you name, and the CLAUDE.md invariant is "never execute anything discovered (no npm, no binaries, nothing)." No telemetry: "There is no endpoint to send anything to," followed by the sentence most projects would have cut — "This also means we have no idea how many people use this — a trade we're happy with." Secrets by shape only: a credential-shaped value is reported as key name, file, and what kind of secret it resembles, never any part of the value, and test/engine.test.js line 65 is a test literally named REDACTION GUARANTEE that runs the scanner over a fixture home directory and asserts that no Anthropic-shaped or OpenAI-shaped fixture value survives serialization. Zero runtime dependencies, and the stated reason is a trust argument rather than a performance one: "the source people read is the code that runs — that readability is the trust model." Nine detector files, one data file of known agents, detectors wrapped in try/catch so a failure becomes a diagnostics entry instead of a crash, and partially-parseable formats such as TOML and JetBrains XML scanned by shape and marked reduced-confidence rather than skipped or overclaimed. The limitations section is stated before the FAQ: it sees known config locations only, so nonstandard paths, other accounts, containers and WSL from the Windows side are invisible; it reads configuration, not runtime behavior, so "it cannot tell you what a plugin actually did — only what its position allows"; and it cannot judge whether a package is malicious, only where it came from, because origin is not trustworthiness. The provenance is thin and worth stating plainly: twelve commits, one contributor, an organization account created August 10 with this as its only public repository, an npm package four versions old published September 6, and 135 downloads in its first week. The drift pattern is the part with a long life — save a baseline with --json, then run --strict --diff baseline.json from cron, and it exits 2 only when something new can execute code or hold secrets, which is the lockfile mental model applied to an install surface that changes weekly.

Reach for it before you audit anything else, on a machine that has been accumulating agent installs since spring; it replaces the afternoon you were going to spend grepping dotfiles, and it replaces nothing you are currently paying for. Delete the mental inventory you thought you had. Tradeoffs: a scanner you overtrust is worse than none, and this one reads configuration and says so; twelve commits and one contributor behind a tool you are about to run against every credential-bearing config on the box, which is exactly the provenance question it was built to ask; the JSON schema is versioned but the detector list is not, so a harness that stores config somewhere new is silently absent rather than reported missing; and the top comment in its own thread is the argument that a single hit means you are running agents wrong in the first place.

The Show HN (14 points, 8 comments, 21:51 UTC) is a Rust terminal desktop, and the interesting half is not the terminal. hydra-local (Apache-2.0, Rust with WGPU rendering; 8 stars, created August 11, five releases, latest v0.2.15) reads provider-owned local session metadata so it can list and resume sessions created by Claude Code, Codex CLI, GitHub Copilot CLI, Antigravity, Kimi CLI, Kiro CLI, OpenCode, Cursor Agent, Devin CLI and the legacy Gemini CLI, with Amp and Factory/Droid launchable and resumable through their CLIs but with their history stores unread. That list is the pick: ten harnesses, ten on-disk formats, all of them already on machines where the operator has no interface that spans them, and the README states the fragility rather than the coverage — "these on-disk formats belong to their providers and may change," so support is maintained provider by provider. The daemon owns the PTYs, so closing or relaunching the desktop does not kill retained sessions, and the FAQ is precise about the boundary of that claim: a reboot is different, because the operating system stops the processes, and what Hydra can do afterward is resume supported provider sessions from durable local records, "a new provider process, not the original process surviving the reboot." It is not Electron — Rust parses and renders the terminal grid, React supplies dashboard chrome inside the OS WebView and "does not own the PTY, terminal grid, terminal geometry or generic command execution." Install is a Homebrew cask or a curl-to-shell script from hydraterms.com; a source build from the repository is a complete local desktop and excludes the proprietary remote agent.

The documentation is the reason this beats better-starred neighbors, and it is worth reading as a template. docs/public-private-boundary.md is a table: nine named crates that ship publicly, from the PTY daemon and the local protocol types through the renderer and the launcher, followed by an explicit list of what stays closed — the desktop remote agent and browser bridge, cloud authentication and token issuance, entitlement and billing, signaling and relay operation. The sentence that governs it is "This is a product and source boundary, not a claim that obscurity protects the remote service," and the trust model beneath it does not flatter itself: Hydra trusts the OS account owner and programs that owner deliberately runs, the PTY daemon uses a private local socket and OS peer credentials to exclude other users, and it "is not a sandbox against another process already running as the same user." Network and remote-client input are treated as hostile and stay bounded by size, time and resource limits after authentication. The FAQ then does the thing almost nobody does: the thread asked what this solves that tmux, Zellij or Herdr do not, the maker never answered in the thread, and the FAQ answers it against the project's own interest — use tmux or Zellij if a multiplexer already gives you the workflow you want, and "Herdr is the stronger fit when terminal-native multiplexing and a socket API are the priority." Two of the three comparisons handed back. Also disclosed without being asked: crates, environment variables and durable state paths still carry maestro-* names from a previous product name and changing them requires a data migration; development is funded by a named Turkish company, Pairextr; contributions run under a DCO with no CLA and no copyright assignment. The counterweight to all of it is the repository's shape — thirteen commits, one contributor with ten of them, a first commit titled "chore: publish Hydra local desktop source," zero forks, twelve open issues, and a latest release two weeks older than the current main. This is a published snapshot of a private codebase, and the honesty of the docs does not change that you cannot review the history.

Reach for it when four agent CLIs have left resumable sessions scattered across a machine and your recovery procedure is remembering which directory you were in; it replaces the tmux session you forgot the name of and the "which one of these was working on the migration" scroll. Delete the sticky note. Tradeoffs: macOS and Linux only, with Linux needing physical testing on both Wayland and X11 by the maintainer's own admission; the retained-session promise ends at reboot and the docs say so; ten provider formats read from disk means ten upstream changes that can break discovery, each maintained by one person; the remote feature that makes the pitch work — reach your session from a browser or a phone — is the closed product, and the open repository is the part that runs on your machine; and eight stars, one contributor, thirteen commits.

The Show HN (10 points, 8 comments, 13:10 UTC) is by Michael of Rindler, YC S26, and the origin story is the useful part. They were building browser agents with cached site representations, hit site mapping, bot defenses, credentialing and 2FA, and got bogged down; they tried Cursor, Claude Code, Conductor "and even built an internal Devin," and found the tools "either felt like they were too slow to iterate through large tasks, or became black boxes that I just couldn't trust with their decisioning (you can't just tell Devin to 'improve the site mapper' and call it a day)." What they settled on was twelve Claude Code sessions across terminal panes, and Maxxwell is the product built out of that arrangement's one unpriced cost: you. It is at v0.1.15, downloadable for macOS Apple Silicon, Linux x86_64 and Windows x86_64, or installable with curl -fsSL https://maxxwell.dev/install.sh | sh, free to use with your own agent subscriptions or API keys, and maxxwell runtime reports which coding agents it found installed. The interface is a single view of every session with three specific jobs named on the page: see what each agent is doing and give a managing agent the context to steer it back; catch context limits early, meaning "see when a session is filling up and compact it with one click"; and collect questions and blockers in one place "instead of checking every terminal." Each worker is a normal Claude Code or Codex session in its own git worktree, changes land through whatever PR and CI process you already run, and the orchestrator coordinates rather than merges.

The thread is why this is a pick rather than a footer line, because the sharpest possible objection got asked and answered without spin. arthurdls: "How do you prevent the orchestrator itself from becoming the new black box? If I'm trusting it to decide which worker decisions need my attention, isn't a mistake in that judgment potentially worse than a worker making a bad decision?" The founder's reply concedes the premise — "a mistake in that judgment can have a wider impact than a single worker mistake, and adding an orchestrator doesn't eliminate that risk" — and then names the two mitigations rather than claiming a fix: every worker is a normal session you can attach to directly, and there are per-goal checklists the orchestrator monitors, "so there's something concrete to check progress against beyond 'the AI orchestrator says it's going well so here's hoping.'" He rates the result "far form perfect," typo and all, and states the actual goal as keeping the observability and control of a dozen individual sessions while making the volume manageable. A second commenter asked what "fully local" means and where data goes; the answer is that nothing reaches Rindler's servers besides optional sign-in, inference goes to whichever provider you configured, and the agents touch files and the network through the same tools they use in Claude Code and Codex today. That is the correct answer, given voluntarily, to the question this desk would have asked. What is missing is everything a reader would check: there is no source repository, no license, no issue tracker, no changelog, and a version number starting with zero from a company that raised on a different product two quarters ago. The pitch is "stop babysitting your agents, have an agent do it for you," which is a supervision problem answered with another supervisor, and the founder is the one who said so first.

Reach for it when the number of terminal panes you cycle through has stopped being a productivity story and started being the job; it replaces the tab-cycling and, if it works, the sessions that sat blocked for an hour while you were in the other window. Delete the rounds. Tradeoffs: closed source, no license, v0.1.15, from a YC company whose previous product was something else, which makes this a bet on a roadmap rather than a tool you own; the orchestrator is a second layer of judgment between you and the work, and the founder's own answer is that it does not eliminate the risk it manages; "free to use" with no published pricing is a stage, not a business model; and the whole premise assumes a dozen concurrent sessions is the correct number, which is the assumption nobody in the thread questioned.

Twenty-two stars credited to the day on the Rust feed, on a repository at 447 with 89 forks, 646 commits, 39 contributors and four releases in the four days from September 5 to September 8. ai-usagebar (MIT, Rust; began May 24 as a port of claudebar and remains drop-in compatible with it) renders how much of each AI plan you have left, in a Waybar module, a native Omarchy Quattro panel, a GNOME Shell extension, a KDE Plasma 6 plasmoid, the macOS menu bar, a Windows tray popover, or a TUI that refreshes every sixty seconds. docs/vendor-endpoints.md is the document worth the visit, and it is a map of how vendors actually expose consumption. Claude reads api.anthropic.com/api/oauth/usage, marked undocumented, and returns the 5-hour session window, the weekly window, a model-scoped weekly figure, and extra usage in dollars. Codex reads chatgpt.com/backend-api/wham/usage plus a banked-credit route, both undocumented and "both used by the official codex CLI." GitHub Copilot reads api.github.com/copilot_internal/user, "private; used by VS Code." Cursor reads cursor.com/api/usage-summary, "the dashboard's own frontend." Google Antigravity is read from "a loopback RPC on the local Antigravity product's own port, discovered from /proc (Linux), lsof (macOS), or the process/TCP tables (Windows)," falling back to a Google API with the OAuth session Antigravity saved in the OS keyring. Kiro CLI reads the same AWS GetUsageLimits call its own /usage command makes. OpenRouter, DeepSeek, Novita, Moonshot, Grok and the Anthropic Admin API are the documented minority. Twenty-one vendors, and the honest reading of that table is that measuring what you spend on AI subscriptions currently requires reimplementing each vendor's private client.

The project has a stated rule for what it will not do, which is rarer than the feature list. Every supported vendor's credential comes from one of exactly three sources: an API key the user already holds, an OAuth file an official CLI wrote (~/.codex/auth.json, kiro-cli's data.sqlite3, Cursor's state.vscdb), or an official CLI invoked for a token (gh auth token). "CLI, editor and browser credentials are never parsed, copied, or stored, and no vendor asks the user to paste a session cookie." Two providers are listed as evaluated and rejected against that rule with their reasoning shown: Xiaomi MiMo is "Not implementable" because its quota routes authenticate with a web SSO session rather than the plan's API key, so "the effective session credential is an HttpOnly cookie, so there is no CLI-written file to read — only a browser profile"; Alibaba Cloud Model Studio is "Viable, wanted" and "blocked only on evidence," pending the credential's on-disk shape and a real response capture. v1.14.0 added detect::has_local_credentials, a per-vendor local probe of credential files, sqlite stores, saved keys, env vars and Antigravity's ports that "never" touches the network — Geiger's move, applied to billing. Operational manners are in the same register: a vendor answering HTTP 429 is left alone for five minutes and the entry reads "rate limited; next attempt in 4m" instead of retrying, and a network failure keeps the last good snapshot visible rather than blanking. CLAUDE.md carries a release checklist whose fourth step is to prove no published changelog section moved before tagging, with the reason attached: the first version of that check grepped for removed lines, so when issue #129 branched before v1.8.0 and merged its [Unreleased] bullet as a pure insertion, it added a feature to an already-shipped release and "passed clean while the section was wrong." The check now diffs instead of grepping, and make test enforces it without git. The current unreleased section contains today's best single sentence about the state of this market, filed as a bug fix: with five or more providers enabled, the panel's tab strip overflowed and the extra entries "were simply unreachable — no scrollbar, no way to click them." The usage bar ran out of room for the number of AI subscriptions people are holding.

Reach for it when you are paying for four or more coding subscriptions and find out you have exhausted one by being refused mid-task; it replaces the four dashboard tabs and the guess about which window resets when. Delete the tab group. Tradeoffs: most of the endpoints are undocumented and can change without notice, which the project addresses with defensive parsers and opt-in live tests rather than a promise; the desktop-native surfaces cover a subset of vendors and the rest are widget or TUI only, per a column in the matrix; Linux and specifically Omarchy is the first-class target with macOS and Windows following; it reports the plans you can already see and does not attribute spend to a project, a repo, or a session; and reading an official CLI's OAuth file is the least-bad option in a market where the alternative is asking for a cookie.

The third Show HN for this project got 45 points and 12 comments after the first two, in July, got three and four. oto-dock (Functional Source License 1.1 with an Apache 2.0 future grant — fair source, not open source; Python; 115 stars, created April 16) runs Claude Code or Codex CLI as persistent server-side processes under your own Anthropic or OpenAI subscription, or against local models, with agents grouped into departments that delegate work to each other, and it is a Linux server with Docker and 4 GB of RAM. It answers, without having read it, the objection at the top of Geiger's thread — that nearly nobody sandboxes their harnesses in practice. Every server-side session runs inside a kernel sandbox in its own mount and process namespace, using bubblewrap, which appears across 86 code results in the repository alongside proxy/scripts/oto-sandbox-net, proxy/scripts/validate-sandbox-netns.sh and a scripts/sandbox-doctor.sh. Network isolation is on always, through pasta: "private ranges, your LAN, and cloud metadata endpoints are unreachable by design," and an MCP tool that needs a local service gets scoped access granted by an admin, per agent. Credentials are encrypted at rest and injected per session — "agents can use them, but never see them." Costs are tracked per user and per agent with weekly or monthly limits. Folders are mounted from each user's role per agent. A remote machine joins over one outbound WebSocket with no inbound ports and no VPN, and falls back to the server when it goes offline.

The thread produced the sentence that should be quoted whenever an "AI company OS" is announced. madamelic's criticism was that these projects "rely heavily on the magic of LLMs to do everything and try to paper over gaps with major hand-waving," when the critical part is agents not doing much and leaning on boring deterministic backbones. The maker agreed and itemized: "The backbone in OtoDock is deterministic code, the model only runs inside a session. Schedules are cron, triggers are webhooks, permissions are a fail closed gate per tool, cost limits are set per user and per agent, and delegation between agents is configured from the admin and the agent managers, an agent cannot change any of that. Agents only see the tools and skills their manager assigned... Memory is plain markdown files you can read and edit." Cron, webhooks, a fail-closed gate, and markdown — that is the entire defensible claim, offered under pressure rather than in the launch copy. Comparisons in the thread were to Cloudflare OS and to Paperclip, and the distinction he drew against Paperclip is that it "does the org chart and the orchestration but it depends on other runtimes to actually run the agents," where here the agents are processes inside the platform. The release discipline supports the pitch. v1.6.0 shipped at 16:31 UTC, 86 minutes before the Show HN, and the changelog's preamble commits to the thing changelogs usually omit: "anything that changes the behaviour of a running install — a config key, a schema migration, a changed default — is called out explicitly under its version," with upgrades being git pull then a compose pull, because the compose file pins each release's image version. That release added GPT-6 Astra to the Codex engine while noting that Auto keeps choosing GPT-5.6 Sol because "Astra costs 2.5 times more"; capped each sandbox's /tmp at SANDBOX_TMP_SIZE_MB, 4096 MB and "at most half the host's memory"; and added a watchdog that logs the blocking stack when the event loop stalls past two seconds. VERSIONS.md declares itself the single source of truth for every runtime version, pins Postgres 16.14-alpine, Python 3.13.14 and Node 24.18.0 exactly, wires the Claude Code and Codex CLI pins end-to-end through install scripts and a runtime parser into fleet reconcile, and says plainly that digest pins are the gold standard "when the deployment matures." Against all that: 43 commits, one contributor, three open issues, and a first commit that is the license and the compose topology, so the code you would be running on your own hardware arrived in the world already finished.

Reach for it when more than one person needs to use the same agents, on hardware you control, and the alternative on the table is giving a vendor your repository; it replaces the per-person Claude Code installs, the shared API key, and the spreadsheet where you tracked who spent what. Delete the shared key. Tradeoffs: fair source, so you may run it and not sell it, and the future Apache grant is a promise on a clock; one contributor and 43 commits under a platform that wants your credentials, your server and your subscriptions; the feature list runs from phone calls through video editing to browser control, which is a lot of surface for one maintainer to keep sandboxed; the question of who verifies an agent's completion report was asked in the thread and not answered; and the sandbox claims are checkable in the repository, which is the reason they belong in the pick rather than the footer.

Also on the desk. AgentsView (MIT, Go, 5,848 stars, 656 forks, v0.42.0) came up in Geiger's thread and is the sixth instrument: a background daemon that merges sessions from "more than 60 agent formats" into one local archive of transcripts, activity, cost, quality and recall, single Go binary, SQLite or Postgres or DuckDB, "the archive stays on your machine unless you turn on a feature that shares it"; it was in our pool in May under wesm/agentsview and again in June under its current owner, and it does Hydra's discovery and ai-usagebar's accounting in one place. herdr-reviewr (MIT, Rust, 652 stars, 69 forks) is a diff-and-file-review sidebar for Herdr — comment on a diff, send it back to the agent — and is the reviewing rung the five picks do not cover; Herdr itself was our pick on June 30. agent-router (Apache-2.0, Go, 2,027 stars, 369 forks, 281 open issues) is the enterprise version of the same instinct, unified access to model providers built on Envoy Gateway, and it predates all of this by two years. letta-code (Apache-2.0, 3,257 stars) keeps trending on stateful agents with memory and identity. navop (Rust, 1,267 stars, 137 forks, no OSI license file) is a native workspace bundling databases, SSH, SFTP, terminals, remote desktop, monitoring and AI, which is the everything-client answer to the same sprawl. Whetuu (Show HN, 13 points; MIT, Zig, 43 stars) is an opinionated zero-config status line and history picker for fish, bash and zsh, relaunched from July's cross-shell-prompt framing. Hazzel (Show HN, 9 points; AGPL-3.0, Python, 4 stars, created September 7) is a tiny Git-native terminal coding agent, its second Show HN in three days, and is the reason the pile keeps growing. veloxml-deploy (Show HN, 7 points; Apache-2.0, 6 stars) provisions serverless LLM inference in your own AWS or GCP account in one command. Two projects surfaced by commenters in Geiger's thread, both from people who built their own harness after concluding the shipped sandboxes do not hold: exocomp (C, 17 stars), whose author argues that "thinking in filesystem access alone is also a futile attempt at sandboxing" and that policies and capabilities with temporary access per agent role are the model; and abyss (MIT, Go, zero stars), which impersonates a local ACP agent while actually proxying into a Docker container, leaving the blast radius at "it can delete my ~/.pi and the repo it's working on." On Product Hunt, hob launched as "the professional workspace for your whole agent stack" and Thousand as git-backed docs with folder-level access where "teammates, outsiders and AI agents each see exactly the" slice they are granted — the agent-readable knowledge base as an access-control product. OpenObserve shipped OpenTelemetry-native observability for agents and LLMs, which is this whole slate rewritten for people who already run an observability stack. Frigade (Show HN, 18 points, YC W23) went the other direction entirely: instead of watching the agent, it gives the agent on-screen guides that point a human user at where to click, on the argument that in-app agents "struggle to actually understand the products they exist in." And colibri (Apache-2.0, pure C, 27,285 stars, 2,997 forks) sat on the trending feed again, streaming frontier MoE experts off disk to run on hardware you already own — the second-largest star count in today's pool, behind vercel-labs/skills at 30,884, and a reminder that the fastest-growing repositories in this ecosystem are the ones that put more of it on your machine.

Verification notes: star, fork, commit, contributor, release, license and file figures are from the GitHub API on 2026-09-10; commit counts from the per_page=1 Link-header page trick and first commits from its last page; HN points and comments from the Algolia API; npm figures from the registry and the downloads API. deepseek-harness's 218,567 stars and August 13 creation date are the repository API; the 14,186 figure is search/repositories?q=topic:dsh-plugin run today, against the README's "13,000" claim written earlier; the safety quotes are SAFETY.md on main; it has zero prior rows in our candidates table, so our trending feeds never surfaced it. Geiger's detection table, promises and limitations are README.md; the invariants and the trust-model sentence are CLAUDE.md; the REDACTION GUARANTEE test is test/engine.test.js line 65; zero runtime dependencies is package.json having no dependencies key; the npm package geiger-scan was created 2026-09-06 with four versions and 135 downloads in the week ending September 6; the organization account Atomburstofficial was created 2026-08-10 with one public repository, and the sole committer's account is maneeshth. Hydra's provider list is the README's interoperability section, the reboot and Herdr answers are FAQ.md, the module table and trust model are docs/public-private-boundary.md, and the release lag is the releases API against pushed_at. Maxxwell's version, platforms, install line and feature copy are maxxwell.dev fetched with a browser user agent; every quotation from the founder is the Algolia item tree for story 49625975; there is no repository, license or changelog to check. ai-usagebar's endpoint table, credential rule and two rejected providers are docs/vendor-endpoints.md; the release checklist and the #129 story are CLAUDE.md; the overflow fix and the local-credential probe are CHANGELOG.md, unreleased and v1.14.0 respectively. OtoDock's sandbox claims are the README's "Locked down by default" section cross-checked against search/code for bwrap (86 results) and the pasta hits in proxy/scripts/oto-sandbox-net, proxy/scripts/validate-sandbox-netns.sh and scripts/sandbox-doctor.sh; the deterministic-backbone quote is the maker's thread reply; the v1.6.0 contents and the changelog's behaviour-change promise are CHANGELOG.md, released 86 minutes before the Show HN per the releases API; the pins are VERSIONS.md; the two earlier Show HNs (3 and 4 points, July 15 and July 24) are Algolia. The Google Ads post was fetched directly and includes the author's reinstatement edit. Nothing on the slate was reproduced: npx geiger-scan is read-only, key-free, zero-dependency and would run on this desk in seconds, and it is the cheapest genuine reproduction this newsletter has ever declined — declined because an unattended run has no business executing a four-day-old package against every credential-bearing config on the compose machine, which is the exact judgment the tool exists to help a human make. Repro count since 08-19: 1 genuine in 12 editions. Machine-facing docs check: CLAUDE.md, SECURITY.md and CONTRIBUTING.md on Geiger; FAQ.md, TROUBLESHOOTING.md, DEVELOPMENT.md, DCO.md, TRADEMARKS.md and docs/ on Hydra; none on Maxxwell; CLAUDE.md and a docs/ set on ai-usagebar; CHANGELOG.md, VERSIONS.md, SECURITY.md and CODE_OF_CONDUCT.md on OtoDock. Seen-before SQL keyed on fetched_at: Geiger, Hydra, Maxxwell, OtoDock, ai-usagebar, herdr-reviewr, navop, letta-code, agent-router, hazzel and veloxml-deploy are all first-time in an edition body; AgentsView appeared in the pool on May 18, June 11 and June 14 and has never been linked; Herdr was linked on June 30, colibri's author on July 10 and August 14, vercel-labs/skills was in the pool on June 27; none of today's five [link] URLs appears in any prior edition body. Today's pool was 73: hn:front 30, hn:show 12, producthunt 16, and github:trending 15 rows across all five feeds (all 5, go 2, python 2, rust 3, typescript 3); the series is 15 → 1 → 10 → 26 → 11 → 11 → 1 → 20 → 12 → 14 → 21 → 15, and Reddit is dark for the twenty-seventh consecutive week. Scheduler: there is no edition row and no compose log at all for 2026-09-09 or 2026-09-05, so the Wednesday and Friday runs did not start, which is a different failure from the OAuth expiries of August 31 through September 2 and is still invisible to the "unsent edition older than 12h" alert. Monday's edition broadcast on schedule.