# Every external project Sjel touches: one row per dependency or influence, with its verdict. # verdict = "adopt" | "contribute" | "overlay" | "fork" | "build" | "inspiration" | "quarry" | "reject" | "watch" | "evaluate" | "adapt" # # verdict Preference order is adopt > contribute > overlay > fork, and fork is a PR vehicle only. # watch and evaluate grant nothing and carry the condition that ends them. # url where it comes from. # license what it is licensed under. # summary what the project is and what Sjel does with it, under 110 characters. # why the verdict's reason, one or two sentences; longer analysis lives in research/. # revisit the condition that reopens a watch or evaluate row. # # No row records a version: every dependency tracks its upstream release. A measurement belongs in # `why` with the date it was taken, and a dependency verdict lives here and nowhere else. [semver] url = "https://github.com/dtolnay/semver" verdict = "adopt" license = "MIT OR Apache-2.0" summary = "Cargo version requirement parsing for the read-only maintenance report" why = "Already in the lockfile. Reuse Cargo-compatible version matching instead of implementing requirement syntax; JavaScript updates remain Bun's responsibility." [cargo-deny] url = "https://github.com/EmbarkStudios/cargo-deny" verdict = "adopt" license = "MIT OR Apache-2.0" summary = "Optional license inventory in the maintenance report" why = "Reuse the installed tool for current-host license evidence. This adds no automatic license allowlist and no duplicate advisory queue; OSV remains the vulnerability owner." [cargo-machete] url = "https://github.com/bnjbvr/cargo-machete" verdict = "adopt" license = "MIT" summary = "Read-only unused Rust dependency detection for maintenance" why = "Optional read-only maintenance analyzer, without --fix or --with-metadata. Its source-checked trial used two patched transitive lock entries; reported candidates were inspected on 2026-11-08, 28 declarations removed and isolated checks run. Missing installation reports incomplete coverage." [cisco-skill-scanner] url = "https://github.com/cisco-ai-defense/skill-scanner" verdict = "watch" license = "Apache-2.0" summary = "Local skill detection candidate compared against Sjel intake fixtures" why = "The 2026-11-08 pinned local-only trial held one of six malicious smoke cases, while Sjel's existing rules held all six; both passed four benign cases. Do not add it as a routine gate or replace intake; evidence and a reproducible network-disabled trial live in research/benchmarks/skill-intake." revisit = "A local semantic-review configuration passes the existing admission cases and a separate corpus without increasing review burden; the dependency preflight must also pass." [python-eval-image] url = "https://github.com/docker-library/python" verdict = "adopt" license = "MIT (image recipes); various (bundled Python and Debian components)" summary = "Official Python base for bounded public-fixture evaluation containers" why = "The agent evaluator uses an existing image resolved to its immutable ID, without host mounts or networking. The skill-scanner trial builds reviewed source into a separate image, mounts only synthetic leaf fixtures read-only, and runs without network, host configuration or credentials." [meta-harness] url = "https://github.com/stanford-iris-lab/meta-harness" verdict = "inspiration" license = "MIT" summary = "Harness-code optimization from recorded experiments; informs Sjel's proposed evaluation loop" why = "Planning influence for the evaluation loop: retain candidate code, execution traces and scores for selective diagnosis, hold the base model fixed across harness comparisons, and keep final testing apart from candidate generation. Its own coding experiment searched and evaluated on the same tasks, so that result is not held-out evidence." [schema-harness] url = "https://github.com/guanning03/Schema" verdict = "inspiration" license = "MIT" summary = "Executable hypotheses with history checks and verified execution; informs Sjel's task-loop proposal" why = "Planning influence for the task loop: separate observations from editable hypotheses, test executable predictions against recorded experience, and interrupt a plan when a result contradicts its prediction. Its published evaluations are ARC-AGI-3, DiG-bench and MazeBench; transfer to research or writing is unproven." [lifeos] url = "https://github.com/danielmiessler/LifeOS" verdict = "inspiration" license = "MIT" summary = "Personal-AI harness Sjel once extended through a synced overlay; retired after it was uninstalled" why = "The harness Sjel extended through a reviewed delta in capabilities/lifeos/overlay/ rather than by forking; the harness was uninstalled on 2026-08-22 and the delta and sync tooling were deleted with it (PRD D6, 2026-08-25). What survived is the shape -- public core plus one private overlay -- and the skills adapted from it: council, red-team, root-cause, suggest-skills and trim, rewritten here with no re-sync path." [unicode-normalization] url = "https://github.com/unicode-rs/unicode-normalization" verdict = "adopt" license = "MIT OR Apache-2.0" summary = "Unicode normalization for vault link resolution" why = "Implements Unicode normalization with generated tables, and vault uses only the safe NFC iterator. Normalized path collisions are treated as ambiguous rather than resolved." [rust-analyzer] url = "https://github.com/rust-lang/rust-analyzer" verdict = "inspiration" license = "MIT OR Apache-2.0" summary = "Language server whose architecture guide informs Sjel's entry-point and invariant documentation" why = "Its architecture guide separates a high-level model from entry points, a code map and explicit invariants, which is the shape website/content/architecture/ uses beside the generated manifest inventory. Documentation structure only; no source or prose copied, no runtime dependency." [tigerbeetle] url = "https://github.com/tigerbeetle/tigerbeetle" verdict = "inspiration" license = "Apache-2.0" summary = "Transactions database whose task-oriented documentation informs Sjel's technical reading paths" why = "Its documentation separates Start, Concepts, Coding, Operating and Reference by reader task, which Sjel applies to the existing architecture, capability-author and operations routes rather than by adding five parallel document trees. Documentation structure only; no source copied, no database dependency." [iai-personal-memory-engine] url = "https://github.com/CodeAbra/iai-personal-memory-engine" verdict = "inspiration" license = "MIT" summary = "Memory engine whose patterns define Sjel's memory contract; held as a swap candidate" why = "Held as a swap candidate because its patterns -- engine versus always-readable store, fail-safe hooks, doctor, encryption at rest -- are what the memory contract is written from. It conflicts with LifeOS memory, which no longer runs here." [mcp-audit] url = "https://github.com/apisec-inc/mcp-audit" verdict = "adopt" license = "MIT" summary = "Automated audit layer for secrets, config and source scans with SARIF output; Sjel adapts it" why = "Automated audit layer: secret and config inventory, a prompt-in-shell-out source scan, SARIF output and failing exit codes. Adapted rather than rebuilt." [local-llm] url = "https://github.com/jamesob/local-llm" verdict = "inspiration" license = "n/a (docs)" summary = "Local inference guide used as the style bar for capability READMEs and a source of operations ideas" why = "The style bar for capability READMEs and an operations quarry for local inference: budget framing, mirrored model storage, read-only weight mounts, separated inference and agent sandboxes, power limiting and measured interconnect tuning. Its 2x3090 route is a CUDA lab, not this deployment's low-energy target." [hledger] url = "https://github.com/simonmichael/hledger" verdict = "reject" license = "GPL-3.0-or-later" summary = "Plaintext double-entry accounting engine; Sjel keeps its journal format but no longer runs the tool" why = "Runtime dependency retired 2026-08-28 (PRD Q50): capabilities/finance/src/journal.rs is the engine now and no code path spawns the executable. The format is not retired -- the canonical journal is still plaintext hledger syntax, schemas/finance-journal.example is still the published contract, and re-adopting the binary means a new audit at that date." [paperless-ngx] url = "https://github.com/paperless-ngx/paperless-ngx" verdict = "inspiration" license = "GPL-3.0" summary = "Document management system with OCR and search; leading candidate for a future documents capability" why = "Leading candidate for a future documents capability: watched-folder and scanner ingestion, OCR, full-text search, metadata workflows, permissions and an exporter-based restore path. Not adopted -- documents are stored in clear text, containers are the only supported route, and its exporter produces an exact database image, so adopting it on a rolling tag would be adopting it without a restore." # --- document recognition, the Q63 extraction ladder ------------------------ [docling] url = "https://github.com/docling-project/docling" verdict = "reject" license = "MIT" summary = "Document parser that reads math notation; rejected because its yield was low and it ran too slowly" why = "Measured and rejected 2026-08-31 on 1,281 real attachments: formula enrichment emitted LaTeX on 5.4% of sidecars at about 24 s per file behind a 1.1 GB PyTorch environment, while Apple Vision returned more text on 550 of 1,027 pairs. Rejected as a dependency and not as an idea -- a model of this kind belongs behind the `ocr` role in libs/inference, where it is a config entry rather than 1.1 GB inside the tree." [lopdf] url = "https://github.com/J-F-Liu/lopdf" verdict = "adopt" license = "MIT" summary = "Rust PDF reader and writer used to materialize reviewed page ranges" why = "Removes every page outside an operator-reviewed range, prunes unreachable objects and writes the selected pages as a standalone child PDF, leaving the parent unchanged and the child a separate content-addressed blob. It infers no boundaries and supplies no OCR; the direct use is limited to reviewed splitting, because xberg already brings it transitively." [dolphin] url = "https://github.com/bytedance/Dolphin" verdict = "inspiration" license = "MIT" summary = "Single-model document layout and parsing model; held as a direction for heavy extraction, not measured" why = "Direction only for the heavy rung of the Q63 ladder, not measured here: one vision-encoder-decoder analyses page layout and then parses the located elements under task-specific prompts, with formulas a first-class type -- against Docling's stack of separate layout, OCR and formula models. PyTorch, so a candidate for the `ocr` role and never a Cargo dependency; handwriting and German are unmeasured, and only a notation verdict on libs/extraction/eval earns it." [ocrs] url = "https://github.com/robertknight/ocrs" verdict = "inspiration" license = "Apache-2.0 OR MIT" summary = "Pure-Rust OCR engine held as a direction only; its early-preview status rules it out for now" why = "The only genuinely pure-Rust OCR engine found for the Q63 ladder -- PyTorch-trained models exported to ONNX and run by the author's RTen runtime, so no Python reaches a consuming binary -- held as direction only because it supports the Latin alphabet alone and describes itself as an early preview. It is the only local rung-2 candidate on Linux, where Apple Vision does not exist, and libs/extraction/eval is the gate it would have to clear." [awesome-selfhosted] url = "https://github.com/awesome-selfhosted/awesome-selfhosted" verdict = "inspiration" license = "CC-BY-SA-3.0" summary = "Curated index of self-hosted software that Sjel mines for candidates, not an adoption list" why = "A curated discovery index mined for candidates rather than an adoption catalogue: each shortlisted service still needs its own primary-source, licence, lifecycle, trust-boundary, backup and ownership verdict." [colibri] url = "https://github.com/JustVugg/colibri" verdict = "inspiration" license = "Apache-2.0" summary = "Experimental engine that streams MoE experts from disk; a research lane, not a Sjel runtime" why = "A research lane rather than a Sjel runtime: it streams routed MoE experts from a large NVMe container while dense weights stay resident, at 0.05-0.1 tok/s on low-end hardware. Model-specific formats make it evidence, not a reason to substitute SSD capacity for model memory." [exo] url = "https://github.com/exo-explore/exo" verdict = "inspiration" license = "Apache-2.0" summary = "Distributed inference across Apple Silicon Macs; research evidence for the server plan, not adopted" why = "Research evidence that a homogeneous Apple Silicon cluster can shard a model across separate memory pools over Thunderbolt RDMA, which corrects an earlier blanket dismissal of multi-Mac model fit. Not adopted runtime: cabling, stability, security and single-node fallback still need a measured verdict." [mlx] url = "https://github.com/ml-explore/mlx" verdict = "inspiration" license = "MIT" summary = "Apple's ML framework whose Thunderbolt RDMA transport informs the server plan; no code used" why = "Primary framework evidence behind exo's Apple Silicon distributed path: MLX distributed and the JACCL backend provide RDMA over Thunderbolt 5 on current macOS. Sjel consumes none of its source; the hardware comparison uses its documented transport capability and constraints." [llama-cpp-rpc] url = "https://github.com/ggml-org/llama.cpp" verdict = "inspiration" license = "MIT" summary = "llama.cpp mode that splits a model across machines; treated as a lab benchmark, not production" why = "A cross-platform comparison path for splitting model weights and KV cache across local Metal and remote CPU or CUDA backends. Upstream calls RPC a fragile, insecure proof of concept, so it is an isolated lab benchmark and not a production endpoint." [mcpserver-audit] url = "https://github.com/modelcontextprotocol-security/mcpserver-audit" verdict = "inspiration" license = "open methodology" summary = "MCP server audit method with CWE checks and semgrep rules, used for manual and agent audit passes" why = "AIVSS methodology, CWE check library and semgrep rulesets for the manual and agentic audit pass." # ---- security audit toolchain --------------------------------------------- [semgrep] url = "https://github.com/semgrep/semgrep" verdict = "reject" license = "LGPL-2.1" summary = "Static analysis scanner once in Sjel's audit; retired because CodeQL in CI covers the same ground" why = "Retired 2026-09-02 (Q74): CodeQL already analyses rust, javascript-typescript, python and actions with the security-extended suite in CI that needs no Mac awake, and `--config auto` fetched its rules at scan time, so the version this row recorded described nothing that ran. The shell gap that leaves is stated in codeql.yml and left open on purpose; re-adopting means a new audit at that date, not restoring this row." [gitleaks] url = "https://github.com/gitleaks/gitleaks" verdict = "adopt" license = "MIT" summary = "Secret scanner Sjel runs over its repository and overlay history, failing on any leak" why = "Signature-based secret-sprawl scan over Sjel and selected private-overlay history in tools/audit, with SARIF plus a failing exit code on a leak. External harness conversation archives need their own explicitly selected scan root." [osv-scanner] url = "https://github.com/google/osv-scanner" verdict = "adopt" license = "Apache-2.0" summary = "Dependency vulnerability scanner over Sjel's lockfiles and the machine's installed software" why = "Dependency CVE scan over the bun, uv, npm and Cargo lockfiles, and a second pass in tools/audit over software installed outside the checkout -- the global npm tree and each `cargo install`ed crate's published lockfile. One osv-scanner.toml carries the dated exceptions for both surfaces; the image half is grype's." [grype] url = "https://github.com/anchore/grype" verdict = "adopt" license = "Apache-2.0" summary = "Container image vulnerability scanner Sjel runs weekly on every declared image, straight from the registry" why = "Container-image CVE scan for every image a capabilities/*/service.toml declares, run weekly and on push by .github/workflows/security.yml. `grype registry:` pulls the image straight from the registry with no container runtime and no daemon, which is what chose it, and it refuses a stale vulnerability database, so CI installs a fresh copy every run." [trivy] url = "https://github.com/aquasecurity/trivy" verdict = "reject" license = "Apache-2.0" summary = "Container image scanner once adopted for audits; retired because it never ran on the audit machine" why = "Retired 2026-09-02 (Q74), and it never ran here: it was absent from the audit machine, and the capability built on it returned rc=2 on Darwin by construction because trivy has no Homebrew analyzer. grype holds that job now, needs no container runtime, and re-adopting trivy means a new audit at that date." [telekom-mcp-security] url = "https://github.com/telekom/mcp-security" verdict = "inspiration" license = "MIT" summary = "Deutsche Telekom MCP security demos, used as a reference for attack shapes, not installed" why = "Deutsche Telekom's MCP-security demos and slide deck, mined for tool-poisoning, exfiltration and prompt-injection attack shapes and for rule ideas. Not a scanner and not installed." [vaultwarden] url = "https://github.com/dani-garcia/vaultwarden" verdict = "adopt" license = "AGPL-3.0" summary = "Self-hosted Bitwarden-compatible server that Sjel runs as its single-user secrets store" why = "The single-user secrets store: Bitwarden-protocol compatible, so real client apps and browser extensions work against it unmodified, and the self-hosted sibling of Proton Pass for an eventual import. The manifest tracks the rolling `:alpine` tag, capabilities/container-refresh pulls it daily and CI scans it weekly with `grype registry:`." [bitwarden-cli] url = "https://github.com/bitwarden/clients" verdict = "adopt" license = "GPL-3.0-only" summary = "Official Bitwarden CLI that Sjel's secret setup script uses to store and read vault items" why = "Official CLI for the vaultwarden-compatible vault: the secret setup script creates and reads items against the self-hosted server with `bw config server`. Since 2026-10-01 the canonical store is the OS keychain, set up per user, with Vaultwarden optional." [scout] url = "https://github.com/troyriverabusiness/scout" verdict = "inspiration" license = "none (no LICENSE file on GitHub -- all rights reserved by default; verified via GitHub API 2026-07-10)" summary = "Scouting tool whose embeddings and scoring design Sjel's scouting capability borrows, no code copied" why = "Architecture reference for capabilities/scouting's embedding and scoring design: adapter trait, generic opportunity pipeline, cosine-similarity scoring. Mined for ideas; no code copied." [trek-travel] url = "https://github.com/liketrek/TREK" verdict = "inspiration" license = "AGPL-3.0" summary = "Self-hosted collaborative trip planner; the alternative to Sjel's trips when group planning is the need" why = "A serious whole-product alternative to capabilities/trips when a self-hosted collaborative planner is the need: real-time multi-user editing, invitations, reservations, shared costs, packing lists, documents, a PWA and neutral exports already exist. Sjel's remaining delta is cross-capability composition with Scouting, Transit and vault context, not rebuilding that mature group-planning surface." [tripit] url = "https://www.tripit.com/web/free" verdict = "inspiration" license = "proprietary cloud service" summary = "Cloud service that turns booking emails into itineraries; a UX reference, not used for privacy reasons" why = "The reference for confirmation-email-to-itinerary UX, where forwarding booking messages produces one ordered trip without manual entry. It stays a contextual cloud alternative, because that convenience requires sending itinerary and booking data to an external service." [betterbahn] url = "https://github.com/BetterBahn/betterbahn" verdict = "inspiration" license = "AGPL-3.0" summary = "Rail split-ticketing tool whose concept Sjel's transit capability borrowed, with original code" why = "Split-ticketing product and interaction reference for capabilities/transit; the concept was mined, and the dynamic-programming implementation here is original with no code vendored. Upstream offers self-hosted use but no hosted calculator, blocked by DB API limits and legal concerns." [besser-bahn] url = "https://github.com/chuk-development/Besser-Bahn" verdict = "inspiration" license = "WTFPL" summary = "Privacy-first Android rail companion, a mobile alternative to Sjel's connection view for live trips" why = "A privacy-first Android rail companion and a concrete alternative to Sjel's connection view when live trip monitoring matters: connection-risk prediction, disruption alerts, DB-account tickets and split-ticket links run in a dedicated mobile workflow. Sjel keeps the broader trip plan rather than absorbing every on-train interaction." [plan-bahn] url = "https://github.com/troyriverabusiness/msg-code-create" verdict = "inspiration" license = "unknown (repository unavailable during re-check 2026-07-29)" summary = "Earlier hackathon transit agent kept as lineage documentation for Sjel's transit capability" why = "Lineage documentation for the earlier hackathon transit agent (Vue, FastAPI, LangGraph) that today's typed Transit capability descends from. The repository was unavailable during the 2026-07-29 re-check, so it is not a hand-off or an adoption candidate." [rules_rust] url = "https://github.com/bazelbuild/rules_rust" verdict = "reject" license = "Apache-2.0" summary = "Bazel rules for Rust builds; retired when Sjel moved its build to cargo and bun" why = "Retired 2026-08-25 (PRD Q44) with the rest of Bazel: cargo and bun are the build path, and one root workspace with one lockfile gives what crate.from_cargo used to derive a second dependency universe for. Re-adopting means a new audit at that date." [postgres] url = "https://github.com/docker-library/postgres" verdict = "reject" license = "PostgreSQL License (permissive) -- official image" summary = "Relational database once shared by capabilities; retired in favour of one shared SQLite file" why = "Retired 2026-08-27 (PRD Q45): one shared SQLite file replaces it and no capability opens a Postgres connection now. The cross-schema join thesis survived -- which is why the replacement is one file rather than one per capability -- but a container, managed volume, password, watchdog and dump contract for 0.30 commits/s did not." [r2d2] url = "https://github.com/sfackler/r2d2" verdict = "adopt" license = "MIT OR Apache-2.0" summary = "Generic Rust connection pool behind Sjel's store, adopted after pooled opens proved far faster" why = "The generic connection pool behind the store, kept because a pooled checkout costs 0.20-0.30 ms against 32-39 ms to open a session. Chosen over deadpool and bb8, which are async pools for an async client: this data layer is deliberately synchronous and driven from spawn_blocking, so swapping the pool would have made 134 call sites async to solve a connection-reuse problem." [r2d2_postgres] url = "https://github.com/sfackler/r2d2-postgres" verdict = "reject" license = "MIT" summary = "r2d2 pool manager for Postgres; retired when Sjel's store moved to SQLite" why = "Retired 2026-08-27 (PRD Q45) with the Postgres client: r2d2_sqlite is the manager now, and neither this crate nor the client appears in Cargo.lock. The judgement that survived is the pool itself -- checkout, return, health check, sizing and timeout have nothing to do with which database is on the other end." [sha2] url = "https://github.com/RustCrypto/hashes" verdict = "adopt" license = "MIT OR Apache-2.0" summary = "Rust SHA-256 library the media ingest gate uses to detect exact duplicate files" why = "SHA-256 for the media ingest gate and index, already a workspace dependency. Exact bytes decide duplicate admission, the digest is stored once and verified on import, and it adopts the hashing implementation rather than an upload service." [exiftool] url = "https://exiftool.org/" verdict = "adopt" license = "Artistic License 1.0 OR GPL-1.0-or-later" summary = "Metadata reader the media ingest gate calls for photo capture dates, used only as a hint" why = "The media ingest gate calls the host ExifTool in one CSV batch for DateTimeOriginal, which avoids a second EXIF implementation beside the maintained reader. Metadata is a date hint and never a duplicate verdict." [rusqlite] url = "https://github.com/rusqlite/rusqlite" verdict = "adopt" license = "MIT" summary = "Rust SQLite binding with bundled SQLite that is Sjel's database since Postgres was retired" why = "The database since Postgres was retired (PRD Q45, 2026-08-27): 462 of 464 live columns are SQLite-native and the write rate is 0.30 commits/s, so single-writer WAL with a busy_timeout is ample. Taken with `bundled` so a deployment does not depend on the SQLite an OS image happens to ship, and its blocking API is the one the sync call sites are written against." [setup-uv] url = "https://github.com/astral-sh/setup-uv" verdict = "adopt" license = "MIT" summary = "Pinned official uv setup action for Python-backed CI shell tests" why = "The shell test job needs uv just as local development does. The official action installs that existing tool without introducing a separate Python package-management path; its revision is pinned in the workflow and caching is disabled." [r2d2_sqlite] url = "https://github.com/ivanceras/r2d2-sqlite" verdict = "reject" license = "MIT" summary = "SQLite pool adapter replaced by sjel-store's file-backed connection manager" why = "Its dependency bound prevents upgrading to the patched bundled SQLite. Sjel needs only file-backed connections and shared connection initialization; sjel-store implements that small r2d2 interface without copied upstream code." [libsql] url = "https://github.com/tursodatabase/libsql" verdict = "adopt" license = "MIT" summary = "SQLite fork with async I/O, concurrent writes (BEGIN CONCURRENT/MVCC), and embedded replicas" why = "Evaluated 2026-10-21 against the live store (274 MB, 107 tables) as the engine for the multi-tenant store and the app's client: it connects in 1.25 ms, passes PRAGMA table discovery over all 107 tables, runs JSON1 json_each predicates with no translation and serves 10 concurrent readers in 43 ms, at byte-level SQLite compatibility. It replaces rusqlite's single-writer limitation, and local embedded mode needs no network, daemon or remote server." [libsql-server] url = "https://github.com/tursodatabase/libsql" verdict = "adopt" license = "MIT" summary = "sqld, the libSQL database server: the primary a phone or a second machine holds an embedded replica of" why = "The server half of the libsql repository, consumed completely differently: the crate comes from crates.io while sqld ships only as release binaries, installed by tools/install-sqld.sh at one version and one digest, because it is on neither Homebrew nor crates.io. This Mac is the primary and a phone the first replica; the pin is a compatibility fact measured against the libsql 0.10.0 crate, and upstream has been quiet since 2025-02-14, which is recorded as a risk because a primary is on the critical path." [grafeo] url = "https://github.com/GrafeoDB/grafeo" verdict = "reject" license = "Apache-2.0" summary = "Embedded Rust graph database (LPG/RDF, Cypher/GQL, HNSW); measured against SQL edge tables, no gap found" why = "Measured 2026-10-24 on a 37,200-node repository graph against libSQL edge tables: both answered all 60 impact and connection questions exactly, an in-memory BFS over the same edges was 4x faster than Grafeo, bounded 3-hop queries were equal and reopen cost 81-96 ms against 0.5 ms (research/benchmarks/graph-store/). Rejected because a second database buys speed the code already has; revisit for graph algorithms, hybrid graph-plus-vector plans, or a graph too large for in-memory adjacency." [indradb] url = "https://github.com/indradb/indradb" verdict = "reject" license = "MPL-2.0" summary = "Programmatic Rust graph store (TAO-style) with pluggable backends; nothing over SQL edge tables" why = "Checked 2026-10-24: indradb-lib 5.0.0 was published 2025-08-16 and the repository has not moved since. Its programmatic vertex and edge queries without a query language are the model SQL edge tables plus a BFS in code already give, without a second store or the native RocksDB dependency; revisit only if maintenance resumes and a consumer needs a distributed backend." [turso] url = "https://github.com/tursodatabase/turso" verdict = "watch" license = "MIT" summary = "Turso Database, the Rust rewrite of SQLite; a successor candidate to the libSQL fork Sjel links" why = "The Rust rewrite of SQLite, noted 2026-10-24 as a successor candidate to the libSQL fork Sjel links. Not read: the question a reading answers is whether it opens the store file unchanged, runs the recursive CTEs and vector queries the stores use, and recovers after a crash, measured against libSQL rather than inferred from the shared name." revisit = "Read it when libSQL is next upgraded or a store failure makes the engine a live question; a reading that finds no measured advantage moves this row to reject. The sync engine (feature `sync`, read at 2709799) does not replace the phone outbox: it replays row upserts past the owning capability, and its self-hosted server has no authentication (docs/plans/storage.md, section 3)." [bun] url = "https://github.com/oven-sh/bun" verdict = "adopt" license = "MIT" summary = "JavaScript and TypeScript runtime that Sjel mandates for all TS and JS work" why = "The TS/JS runtime CONTRIBUTING.md#language-tooling mandates, tracked at upstream's latest everywhere it is consumed: brew owns the binary on this host and capabilities/host-patch moves it nightly, and both workflows install `latest`. The hermetic Bazel toolchain that pinned per-platform release zips went with Bazel (PRD Q44), leaving one binary a package manager owns." [bun-security-scanner] url = "https://www.npmjs.com/package/@socketsecurity/bun-security-scanner" verdict = "adopt" license = "MIT" summary = "Bun install-time scanner that checks the web clipper's npm dependencies for malicious packages" why = "The Bun Security Scanner API adapter that checks the UI dependency trees for malware, typosquats and supply-chain advisories before install, which osv-scanner does not cover because a malicious publish is not a known vulnerability. It is a devDependency in each tree because Bun refuses a configured scanner absent from that project's dependencies; free mode needs no token, and SOCKET_API_KEY adds organization policy." [mermaid-rs-renderer] url = "https://github.com/1jehuang/mermaid-rs-renderer" verdict = "adopt" license = "MIT" summary = "Native Rust Mermaid parser and SVG renderer used by GPUI Docs" why = "Renders Mermaid fences as SVG for the native documentation reader, consumed by GPUI's built-in SVG element. Adopted rather than translating a second diagram language or invoking a browser at runtime; rendering stays local and uses the app palette." [openfreemap] url = "https://github.com/hyperknot/openfreemap" verdict = "adopt" license = "MIT (server); OpenMapTiles/OSM attribution applies to rendered data" summary = "Keyless hosted vector basemap that the GPUI travel map draws, with attribution kept visible" why = "The keyless vector basemap behind the travel map, reached through its documented hosted style URL behind one constant. Provider attribution stays visible, and the seam can point at a self-hosted OpenFreeMap or PMTiles deployment without changing Trip contracts." [maplibre-native-rs] url = "https://github.com/maplibre/maplibre-native-rs" verdict = "evaluate" license = "MIT OR Apache-2.0 (Rust bindings); BSD-2-Clause (MapLibre Native core)" summary = "Optional Metal vector-map prototype inside the GPUI travel surface, built against 0.10.0" why = "Reuse MapLibre's style parser, labels and renderer instead of building a map engine: the first adapter copies a rendered image into GPUI on camera changes, on a bounded, thread-affine worker. Experimental and macOS-only -- it establishes neither smooth texture composition, iOS support nor downloadable offline regions -- and the raster path stays the default, with OpenFreeMap supplying style and tiles and no account or key required." revisit = "Decide after the travel map has run on it through a navigation-heavy session: keep it if composition holds and offline regions are the only gap left, otherwise revert to the raster path and record reject." [nominatim-api] url = "https://nominatim.org/release-docs/latest/api/Search/" verdict = "adopt" license = "API output is ODbL (OpenStreetMap data); places stores responses in its own local cache and the map keeps OSM attribution visible" summary = "OpenStreetMap geocoder the places registry calls at 1 request/s, caching every answer permanently" why = "Forward and reverse geocoder for the places registry (decision D3: an external API with a permanent local cache, chosen over bundled datasets). The usage constraints are part of the adoption and enforced in geocode.rs rather than remembered: at most 1 request/s with the identifying User-Agent, every response cached permanently so a query egresses at most once, and a query carries place text or a bare coordinate pair only -- never a person, an amount or a date." [open-meteo-api] url = "https://open-meteo.com" verdict = "adopt" license = "CC BY 4.0 for the API data; the attribution renders under the climate strip wherever the normals are shown" summary = "Free weather archive API the places registry uses for climate normals, one cached call per place" why = "Climate normals for the places registry (decision D5), read from the ARCHIVE endpoint over a closed historical window and never a forecast. Free and keyless; the constraints are enforced in capabilities/places/src/climate.rs -- one request per place cached permanently, a coordinate pair rounded to two decimals with a fixed ten-year window, an address place refused before a request is built, no row written on a provider error, and no URL in the error Display." [platforms] url = "https://github.com/bazelbuild/platforms" verdict = "reject" license = "Apache-2.0" summary = "Bazel's standard os and cpu constraint definitions; retired along with Sjel's Bazel build" why = "Retired 2026-08-25 (PRD Q44) with the rest of Bazel: its canonical os and cpu constraint values were needed once the hand-rolled bun toolchain declared per-platform targets with target_compatible_with, and neither survives. Re-adopting means a new audit at that date." [rules_shell] url = "https://github.com/bazelbuild/rules_shell" verdict = "reject" license = "Apache-2.0" summary = "Bazel rules for shell targets; retired along with Sjel's Bazel build" why = "Retired 2026-08-25 (PRD Q44) with the rest of Bazel: it wrapped the architecture generator and its freshness test, which are tools/generate-architecture.sh and tools/check-architecture-fresh.sh now, invoked directly by CI. A shell rule set has nothing left to wrap." [graphify] url = "https://github.com/Graphify-Labs/graphify" verdict = "reject" license = "Apache-2.0 from 0.9.25 on (MIT at or below 0.9.24); run as a separate process under `uv tool run`, never vendored, so the relicence raises no compatibility question here" summary = "Code dependency graph tool; removed from Sjel because agents rarely queried it" why = "Removed 2026-10-31: across 77 sessions 15 ran a graphify lookup (25 lookups) against 18 graph rebuilds and no MCP calls, it ranked the wrong file first on two known questions where grep and `sjel search` answered both, and one rebuild took over five minutes for 1.2 GB of output. tools/agent-integrations.sh, tools/intake check, the self-model code layer and the knowledge-graph capability went with it." [asd-ste100-skill] url = "https://github.com/danyuchn/asd-ste100-skill" verdict = "inspiration" license = "MIT" summary = "Controlled-language writing skill that seeded Sjel's own STE100 skill; now inspiration only" why = "Seeded Sjel's own asd-ste100 skill under MIT, with attribution and LICENSE retained; since 2026-09-11 the Pack is own work and this row is inspiration only. There is no update path -- nothing re-syncs against it -- so the taking was licensed and dated and will not repeat." [interceptor] url = "https://github.com/Hacker-Valley-Media/Interceptor" verdict = "adopt" license = "see the upstream repository; not vendored here, so no notice travels with Sjel" summary = "Browser and macOS control tool for agents, installed as a product that ships its own skills" why = "Browser and macOS control for agents, installed as a product at /Library/Application Support/Interceptor with a CLI at /usr/local/bin/interceptor and its own update verbs, so the version is asked of the runtime rather than held here. It owns five skills that its installer symlinks into each harness; they must never be copied into Packs/, because the symlink target is the install and a vendored copy would silently pin them." [nvidia-skills] url = "https://github.com/NVIDIA/skills" verdict = "inspiration" license = "dual: CC-BY-4.0 (skills/docs) + Apache-2.0 (code) -- confirmed by reading the repository's own LICENSE file" summary = "About 230 NVIDIA agent skills, mined for skill-authoring patterns only, mostly GPU infra" why = "About 230 published agent skills, mined for skill-authoring structure and scoping patterns only. The large majority is GPU and datacenter ML infrastructure with no match in any Sjel Pack; the one real intersection is the RAG blueprint, worth a look if a RAG-shaped capability is built." [bottom] url = "https://github.com/ClementTsang/bottom" verdict = "adopt" license = "MIT" summary = "Rust terminal system monitor that serves as the display backend for Sjel's sysmon tool" why = "tools/sysmon's TUI backend: a cross-platform system monitor with CPU, memory, disk, network and process history, written in Rust. Adopted over building one, per the upstream-first rule." [presidio] url = "https://github.com/microsoft/presidio" verdict = "reject" license = "MIT" summary = "PII redaction toolkit; declined because Sjel's own redactor had better recall and less over-redaction" why = "Measured 2026-08-30 against the comms redactor on a frozen 24-fixture corpus of real mail labelled before either ran: recall 83.3% against 91.7%, and 153 markers against 52. The split is English person names, six of its eight misses are names people_registry::is_known_person already knows, and its cost side is a Python and spaCy runtime with about 1.1 GB of models in a Rust repository." [auge] url = "https://github.com/Arthur-Ficial/auge" verdict = "reject" license = "MIT" summary = "Apple Vision OCR tool; declined because it loses table layout on rail journey documents" why = "Measured 2026-08-29 as a third DocumentBackend for transit and rejected because VNRecognizeTextRequest returns text observations, so a table comes back column-major with its legs interleaved -- the failure capabilities/transit/src/document.rs exists to escape. What held is perfect German recognition with no language pack; the engine entered through Sjel's own tools/visocr over the OS framework (PRD Q63/B30), and this CLI with its personal tap did not." [apfel] url = "https://github.com/Arthur-Ficial/apfel" verdict = "adopt" license = "MIT" summary = "Server for Apple's on-device model behind an OpenAI-style API; replaces Sjel's own server for that" why = "Serves Apple's on-device model behind the OpenAI chat shape for capabilities/foundation-models, replacing the 311-line server Sjel maintained, with streaming, /v1/responses, MCP tool calling and structured output and none of the maintenance. Its README documents no port option and is wrong: Sources/CLI/CLIArguments.swift carries --port/--host and APFEL_PORT/APFEL_HOST, which is what keeps this deployment on 8091 instead of Ollama's 11434." [macmon] url = "https://github.com/vladkens/macmon" verdict = "adopt" license = "MIT" summary = "Apple Silicon power and thermal monitor that serves as the power backend for Sjel's sysmon tool" why = "tools/sysmon's power and thermal backend: a sudoless powermetrics wrapper for Apple Silicon giving GPU and ANE utilization, package power draw and thermal pressure, which bottom and Activity Monitor do not surface. arm64 only, so the `power` subcommand is gated on `uname -m`." [tabler-icons] url = "https://github.com/tabler/tabler-icons" verdict = "adopt" license = "MIT" summary = "Outline icons on the CV's contact line" why = "Five SVGs vendored from @tabler/icons 3.49.0 with its LICENSE for the CV's contact line. Vendored rather than taken as a Typst package or an icon font, so rendering needs no network and no font install on the host." [typst] url = "https://github.com/typst/typst" verdict = "adopt" license = "Apache-2.0" summary = "Typesetting engine that renders Sjel's CVs, replacing LaTeX" why = "The CV renderer, replacing LaTeX: plain-text templates with real scripting instead of macro chains, one Rust-built binary, no TeX Live install and git-diffable output. Adopt over build -- a typesetting engine is not a thing to hand-roll." [yaml_serde] url = "https://github.com/yaml/yaml-serde" verdict = "adopt" license = "MIT OR Apache-2.0" summary = "YAML serde backend for the typed CV master in capabilities/cv" why = "Parses and writes the typed CV master through serde, and is already in the lockfile through libs/extraction's xberg, so taking it directly resolves no new crate. It replaces serde_yaml_ng, whose unsafe-libyaml backend is unmaintained (RUSTSEC-2024-0449)." [yq] url = "https://github.com/mikefarah/yq" verdict = "adopt" license = "MIT" summary = "YAML command-line processor the CV tool uses to read profiles from the master CV file" why = "Test fixtures only: capabilities/cv/check edits its throwaway master with yq. The CV tool itself reads YAML through serde and needs no yq at run time." [vibecoded-design-tells] url = "https://github.com/JCarterJohnson/vibecoded-design-tells" verdict = "adopt" license = "MIT (code/skills; the harvested Reddit dataset under a separate, unvendored data note -- not consumed)" summary = "AI-tell scanners for code and web design, vendored almost verbatim into Sjel's unslop skill" why = "Vendored near-verbatim into Packs/writing/skills/unslop -- references/ and scripts/ from one commit, with the two source skills merged and their shared prose rewritten. Both halves are data-grounded AI-tell scanners for code and web design; attribution and the merge history are in Packs/writing/README.md." [i-have-adhd] url = "https://github.com/ayghri/i-have-adhd" verdict = "adapt" license = "MIT" summary = "ADHD-friendly output skill whose shape rules Sjel adapted into its attention-control skill" why = "Packs/cognitive-load/skills/attention-control adapted its shape layer: lead with the next action, number multi-step work, restate state every turn, cap lists at five, no preamble or closing offer. Adapted rather than copied, with the notice retained in Packs/cognitive-load/LICENSE as MIT requires and the reasoning in the pack's references/doctrine.md." [human-voice] url = "https://github.com/stephenoffer/human-voice" verdict = "adopt" license = "MIT" summary = "Prose AI-tell linter and references that Sjel's human-writing skill vendors" why = "Packs/writing/skills/human-writing vendors this skill's linter wholesale plus four reference files verbatim, with two more extracted and condensed from its SKILL.md. Chosen as the substrate because it is the only one of the four prose-tell projects with real structural computation -- 32 checks including burstiness, lexical diversity, n-gram repetition and over-correction -- rather than a pure lexical regex list; the two local deltas are documented in that SKILL.md." [oberskills] url = "https://github.com/ryanthedev/oberskills" verdict = "quarry" license = "MIT declared in .claude-plugin/plugin.json only -- NO LICENSE file at repo root" summary = "Writing skill whose architecture Sjel's human-writing skill paraphrases, without copied text" why = "Packs/writing/skills/human-writing takes the architecture of that repository's `write` skill: the mode router, the reader-job taxonomy, voice profiles and template, and the phased review protocol. Quarry rather than overlay because the MIT grant exists only as a plugin.json field with no root LICENSE text, so everything taken is paraphrased and rewritten, and both derived files say so." [stop-slop] url = "https://github.com/hardikpandya/stop-slop" verdict = "reject" license = "MIT" summary = "Declined: prose AI-tell remover whose patterns the vendored human-voice linter already covers" why = "Same job as human-writing with a smaller hand-written phrase and structure list and no data grounding; its distinctive pattern categories are already in the vendored human-voice linter, and its absolutist framing manufactures the uniform signature that skill exists to prevent. Declined and re-evaluated 2026-07-25 during the human-writing merge." [skills-best-practices] url = "https://github.com/mgechev/skills-best-practices" verdict = "reject" license = "none declared -- no LICENSE file at repo root and no licence field anywhere; all rights reserved by default" summary = "Declined: skill-authoring guide smaller on every axis than Sjel's own skill-creator" why = "Same job as Packs/writing/skills/skill-creator and smaller on every axis: a 46-line five-step procedure against that skill's SKILL.md plus eight references, and a 50-line validator against the installed one, which combines the agentskills.io rules with Anthropic's requirements and prints field-by-field errors. No LICENSE file at all is the hard blocker -- with no grant of any kind there is nothing to quarry, so reject rather than paraphrase." [academic-researcher] url = "https://github.com/SiluPanda/academic-researcher" verdict = "overlay" license = "MIT" summary = "Citation workflow scripts that Sjel adapted and extended for its academic-writing skill" why = "Three citation-workflow scripts adapted and generalised into Packs/writing/skills/academic-writing/scripts, with Quarto @citekey support added beyond the original's LaTeX-only handling and the hardcoded path removed. Real code was adapted, so overlay rather than quarry; Packs/writing/README.md carries the attribution." [academic-writing-agents] url = "https://github.com/andrehuang/academic-writing-agents" verdict = "quarry" license = "MIT" summary = "Claude Code academic writing plugin whose style and critic roles Sjel rewrote for its own skill" why = "Its principles document and ten-agent roster were condensed and rewritten into references/house-style.md, the five critique lenses in references/critic-briefs.md and the matching agent files. Ideas and structure mined, no verbatim text retained, the hardcoded author path removed." [research-paper-writing-skills] url = "https://github.com/Master-cai/Research-Paper-Writing-Skills" verdict = "quarry" license = "MIT" summary = "Skill repackaging of paper-writing notes, condensed into Sjel's empirical-CS writing guide" why = "A Claude-skill repackaging of Peng Sida's paper-writing notes, condensed and rewritten into references/genre-empirical-cs.md. It is itself adapted from pengsida-research-notes, which is the primary source." [pengsida-research-notes] url = "https://github.com/pengsida/learning_research" verdict = "quarry" license = "none declared (all rights reserved by default) -- ideas mined only through a third party's MIT-licensed repackaging (research-paper-writing-skills), no text copied from here" summary = "Peng Sida's public paper-writing notes, the primary source behind Sjel's empirical-CS writing guide" why = "Peng Sida's publicly shared research and paper-writing notes, drawn on through research-paper-writing-skills' repackaging rather than directly, so no text is copied from here. See Packs/writing/README.md Attribution." [learnharness] url = "https://github.com/amosblomqvist/learnharness" verdict = "quarry" license = "AGPL-3.0 -- ideas only; the knowledge Pack is MIT, so no prompt text is copied" summary = "Desktop learning harness for probing, teaching, practice, and graphs of propositions and reasoning." why = "Read 2026-10-28; its predecessor is what Packs/knowledge/skills/teach started from. Three ideas taken and paraphrased -- the predict-teach-check cycle with thinking and confidence on every answer, propositions plus reasoning chains as the vault's claim notes, and the practice doctrine -- while its Electron app and JSONL graph store were not adopted, because the vault is the store." # --- home-server container dependencies ------------------------------------ # Floating tags, pulled daily by services/container-refresh. A version tag is never a byte pin: # Docker Hub rebuilds under the same tag, and the digest is the only identity. [home-assistant] url = "https://github.com/home-assistant/core" verdict = "adopt" license = "Apache-2.0" summary = "Home automation platform Sjel deployed from one manifest as its home-assistant capability, until 2026-10-24" why = "Was the home-automation core Sjel deployed from one manifest; a household's deployment moved with the household on 2026-10-24, and the verdict stays adopt because it describes how that deployment is still run there. Adopted rather than hand-rolled for the declared, host-portable deployment around it, and the image tracks upstream's own `:stable` channel that container-refresh pulls daily." [esphome] url = "https://github.com/esphome/esphome" verdict = "reject" license = "MIT + GPL-3.0 (dual)" summary = "Declined: the ESPHome container ran with no device configs, so Sjel removed it" why = "Rejected and removed 2026-07-26: the container ran with zero device configs -- an empty cache and a .gitkeep -- so it was a container, a port and an update path for no devices. Re-adopt honestly if ESPHome hardware actually arrives." [pihole] url = "https://github.com/pi-hole/docker-pi-hole" verdict = "adopt" license = "EUPL-1.2" summary = "DNS server with blocklists and per-client query logs that Sjel runs for the private network" why = "DNS, local-name resolution and per-client query logging for a private network, with FTLDNS adding logging and allow and deny lists over plain dnsmasq. Host networking preserves client source IPs." [mosquitto] url = "https://github.com/eclipse-mosquitto/mosquitto" verdict = "reject" license = "EPL-2.0" summary = "Declined: the local MQTT broker never had a client, so Sjel removed it" why = "Rejected and removed 2026-07-26 because nothing had ever used it: no MQTT config entry, zero established connections and zero retained messages on every restart. Re-adopt the moment a local broker has a client -- the zigbee2mqtt service needs one." # --- vendored Home Assistant custom components ----------------------------- # Moved to the selected overlay's own upstreams.toml on 2026-08-02, beside the components.toml # lockfile the materializer reads. [stevenblack-hosts] url = "https://github.com/StevenBlack/hosts" verdict = "adopt" license = "MIT" summary = "Hostname blocklist that Pi-hole pulls at runtime, left to float so it stays current" why = "Pi-hole's blocklist, pulled at runtime by gravity and never held at a version, because a list that stops moving stops blocking new domains. It is consumed as hostname data and never executed." # --- private remote-access layer ------------------------------------------- [tailscale] url = "https://github.com/tailscale/tailscale" verdict = "adopt" license = "BSD-3-Clause (clients); coordination server is proprietary and hosted" summary = "Private remote access network that Sjel uses, chosen for its trusted HTTPS certificates" why = "Private remote access plus `tailscale cert` for trusted HTTPS without distributing a private CA to every client, which is what chose it over NetBird. Tailnet Lock reduces coordination-server trust for key distribution but not for metadata visibility." [netbird] url = "https://github.com/netbirdio/netbird" verdict = "reject" license = "BSD-3-Clause (whole stack, control plane included)" summary = "Declined: open self-hostable mesh VPN that lacks the per-peer TLS certificate Sjel needs" why = "Rejected 2026-07-26 on capability, not merit: its whole stack including the control plane is BSD-3 and self-hostable, where Tailscale's is proprietary and its metadata visible to a hosted server. It has no per-peer TLS certificate -- netbirdio/netbird#5479 is open with no maintainer response and no roadmap, and the only workaround exposes the service publicly -- so adopting it would reintroduce the private CA mkcert was rejected for; `netbird cert` or DNS-PERSIST-01 in a release reopens the question." # --- agentbox: the sandboxed coding agent (tools/agentbox) ----------- [pi-coding-agent] url = "https://github.com/earendil-works/pi" verdict = "adopt" license = "MIT" summary = "Coding agent that Sjel's agentbox runs in a container, taken from the release binary" why = "The coding agent tools/agentbox puts in a container, adopted from the GitHub release tarball rather than npm: releases ship a self-contained aarch64 ELF, so the image needs no Node and no npm. Upstream states pi has no built-in sandbox by design and that isolation must come from the OS or a virtualization boundary, which is the shape agentbox follows; `agentbox build` resolves GitHub's `/releases/latest` itself and verifies the tarball against that release's SHA256SUMS." [pi-ai-auth] url = "https://github.com/earendil-works/pi/tree/main/packages/ai" verdict = "inspiration" license = "MIT" summary = "Reference for provider-neutral OAuth login and credential refresh in Sjel's Rust agent" why = "Read 2026-10-22 for Pi's OpenAI ChatGPT OAuth flow and its provider-neutral login and refresh shape. Inspiration only -- Sjel reimplements the flow in Rust, persists credentials through sjel-credentials in the OS keychain and vendors nothing, and OpenAI request handling stays subject to the reviewed-provider and c0 data-class gates." [apple-container] url = "https://github.com/apple/container" verdict = "reject" license = "Apache-2.0" summary = "Apple's per-VM container runtime; retired when agentbox moved to Docker" why = "Retired 2026-09-02 (Q75): this machine declares container_runtime = docker, agentbox invokes docker, and nothing spawns `container` any more. Both halves of the dependency went with it -- one shared Linux VM is weaker isolation than a VM per container, and docker's `--internal` network gives no host gateway where apple's did -- and 1.3.1 shipped fixes for six Containerization advisories the installed 1.2.2 lacked, so uninstalling is what closes that; re-adopting means a new audit at that date." [debian] url = "https://github.com/debuerreotype/docker-debian-artifacts" verdict = "adopt" license = "various (Debian main; base image is DFSG-free)" summary = "Debian slim base image for the agentbox image, needed because the pi binary requires glibc" why = "Base image for the agentbox image, on the rolling `trixie-slim` tag so a rebuild takes Debian's current stable slim layer and its CVE fixes. Debian rather than Alpine because the pi release binary is a dynamically linked glibc ELF, and trixie over bookworm because that binary is built on a newer toolchain than bookworm ships." [deutsche-bahn-data] url = "https://github.com/piebro/deutsche-bahn-data" verdict = "adopt" license = "CC-BY-4.0 (data, licensed by Deutsche Bahn; attribution required)" summary = "Monthly history of German rail punctuality that Sjel's punctuality capability is built on" why = "The empirical baseline capabilities/punctuality is built on: monthly parquet that DB collects from its own Station Data and Timetables APIs, so it is DB's data under DB's licence rather than a scrape. History is the whole point, since the live API cannot be asked about last March, and the ingest respects the two properties the README states -- coverage widens on 2025-11-02 from about 100 stations to about 5300, and collection is 98.92% complete, so an absent train never means it did not run." [arrow-rs] url = "https://github.com/apache/arrow-rs" verdict = "adopt" license = "Apache-2.0" summary = "Pure-Rust Parquet reader that the punctuality capability ingests rail data with" why = "The parquet reader capabilities/punctuality ingests with, pure Rust so it resolves through a normal dependency block. The obvious alternative, DuckDB through duckdb-rs, would have put a bundled C++ embedded database in the tree to run one GROUP BY." [xberg] url = "https://github.com/xberg-io/xberg" verdict = "adopt" license = "MIT" summary = "Document extraction library chosen for the comms capability; adopted for PDF only" why = "The document extraction layer behind libs/extraction's `xberg` feature for `pdf` only, consumed 2026-08-04, with HTML left on the built-in extractor. Benchmarked out-of-tree on 15 stored articles, it returns more text than the tag stripper on all 15 and is an extractor rather than a readability cleaner, which is why normalize.rs exists; it is the last rung before storing an abstract, never a replacement for arXiv HTML, and 1.3.0 measured 0.5 s instead of 11.7 s on a 2007 paper while still dropping the same `c`." [ar5iv] url = "https://ar5iv.labs.arxiv.org" verdict = "adopt" license = "renders arXiv submissions; each paper keeps the licence its authors chose, exactly as on arxiv.org" summary = "Older arXiv HTML source that comms uses for full text when arxiv.org has no HTML" why = "The second HTML source for arXiv full text in capabilities/comms, consulted only when arxiv.org/html answers 404, measured 2026-08-04 as serving all three newest-paper misses plus a 2007 paper with real body text. It is a labs-grade host with wide LaTeXML backfill, which is why it is the fallback and never the first request, and its response goes through the same extraction trait as every other page." # --- local semantic relevance (crates/comms) -------------------------- [multilingual-e5-small-mlx] url = "https://huggingface.co/mlx-community/multilingual-e5-small-mlx" verdict = "reject" license = "MIT" summary = "Declined: small multilingual embedding model that failed Sjel's German and English relevance test" why = "Rejected as the comms relevance default after serving as the first operational oMLX baseline: the 253 MB, 94-language XLM-RoBERTa model fails the frozen DE/EN gate at 4/6 useful top-1, 0.765 pairwise accuracy and 0.865 mean nDCG, including wrong architecture-negation and rail rankings. Its result stays as evidence; the base model clears the same corpus for a bounded additional resource cost." [multilingual-e5-base-mlx] url = "https://huggingface.co/mlx-community/multilingual-e5-base-mlx" verdict = "adopt" license = "MIT" summary = "Multilingual embedding model that comms uses for relevance after it passed the German and English test" why = "The comms relevance model, adopted after clearing the unchanged DE/EN gate at 6/6 useful top-1, 0.882 pairwise accuracy and 0.986 mean nDCG. It is the same 94-language E5 contract as the rejected small model at 12 layers and 768 dimensions: 547 MiB on disk, about 1.16 GB oMLX RSS and 1.14 s for 30 vectors, returned by a 60-second per-model TTL." [bge-reranker-v2-m3-mlx] url = "https://huggingface.co/soichisumi/bge-reranker-v2-m3-mlx" verdict = "adopt" license = "Apache-2.0" summary = "Multilingual reranker model that comms uses as its second relevance stage" why = "The comms second relevance stage, adopted after clearing the same public DE/EN gate at 6/6 useful top-1, 0.912 pairwise accuracy and 0.993 mean nDCG. oMLX 0.7.1 serves it on loopback as the overlay's `reranking` role since 2026-10-20, and Ollama has no rerank endpoint, so this role needs oMLX." # --- own quarries: repositories mined for ideas, not consumed as code ------- [event-horizon] url = "https://github.com/larsboes/Event-Horizon" verdict = "quarry" license = "own work, no LICENSE file at repo root; repository and working tree both deleted 2026-08-17, url no longer resolves" summary = "Earlier transit agent quarried for one idea, journey-level reliability; the rest was left" why = "Quarried 2026-08-16 at e75b78d: one idea survived the read, the journey-level reliability composition now in issue 179. The repository was deleted and the working tree removed on 2026-08-17, so this row is the whole surviving record and there is nothing left to re-quarry." [slm-finetuning-talk] url = "https://github.com/Buchhold/slm_finetuning_talk" verdict = "inspiration" license = "none declared (all rights reserved by default) -- no LICENSE file; ideas only, no code or text taken" summary = "Talk code on fine-tuning small models, read as outside evidence for a local-AI approach" why = "Read 2026-08-16 for outside evidence on the local-AI rung: a fine-tuned 4B Qwen3 matched a frontier model on text-to-SQL, and correctness is scored by executing the generated SQL rather than comparing strings, which is the same move punctuality makes by being the number a model has to beat. Not adopted -- the training code is vendor-specific, undeclared-licence and explicitly not a library." # --- interior: the indoor planning geometry engine -------------------------- [pascal-editor] url = "https://github.com/pascalorg/editor" verdict = "inspiration" license = "MIT" summary = "Geometry engine for rooms and walls behind the interior capability, driven over MCP" why = "The geometry engine behind the interior capability -- rooms, walls, openings, levels and a browser view, driven over MCP -- adopted after it returned 22.700000000000003 m2 for a polygon measured on site at 22,7. Nothing consumes it since the Rust rewrite: the whole engine is capabilities/interior/src/geometry.rs, because every clearance rule is about the space that stays empty, and no overlap test between item footprints can express that." [stooq] url = "https://stooq.com/q/d/l/" verdict = "reject" license = "n/a -- not adopted" summary = "Declined: price data site that returned a JavaScript proof-of-work page instead of CSV" why = "Measured and rejected 2026-09-05 as the first choice for end-of-day prices: the CSV endpoint answered HTTP 200 with a 796-byte HTML body carrying a SHA-256 proof-of-work loop and a