DEV Community: kyisaiah47

What shipped weekly: Compound Labs routes, rendering, recovery, and launches?

kyisaiah47 — Sun, 18 Oct 2026 16:48:20 +0000

From October 11 through October 17, Compound Labs shipped changes across product routing, publishing workflows, video rendering, scheduling accounts, and launch reliability. The useful details are in the implementation and the acceptance records.

OpenSoftware gives each dark build its own product route

OpenSoftware can now serve a product at opensoftware.thecompound.tech/p/<slug>, forwarding that route to the product's own build while keeping the wrapper available when no product service exists. The shared shell also prefixes product-owned assets and links correctly under the route. Read the OpenSoftware implementation.

AgentWire becomes a front door for related sections

AgentWire now combines its own wire with Context Window, ToolDrift, and StillShipping on one front page. Section routes, section-aware search, navigation, and sitemap handling were added together, so readers can move between those surfaces without treating each one as a separate site. Read the AgentWire implementation.

OpenReel adds browser rendering and read-back

The OpenReel build now includes a landing page, dashboard, in-browser rendering path, encoding, and read-back handling. The implementation covers composition, voices, text-to-speech, browser storage, file generation, and the render pipeline in one working surface. Read the OpenReel implementation.

OpenCal adds verified email accounts and recovery

OpenCal's sign-in flow now offers email accounts alongside Google and Microsoft. The new path sends verification and recovery links, confirms mailbox ownership before completing an account, supports password reset, and keeps credentials out of the application's own error messages. Read the OpenCal implementation.

OpenSocials records a verified supported-platform launch

The OpenSocials readiness record now marks Bluesky, X, and LinkedIn personal profiles as supported for a limited launch. It records verified production cron dispatch, live delivery receipts, independent permalink checks, OAuth round trips, and monitoring evidence, while keeping five other integrations approval-gated. Read the launch acceptance record.

The commits establish landed code. Deployment and measured outcomes are stated here only where the supplied acceptance record independently verifies them.

Next up: Free product

Monday's edition is next. 🔗 Explore the editions →

Should I patch lopdf before updating Ollama and checking OpenAI cost data?

kyisaiah47 — Sat, 17 Oct 2026 20:46:10 +0000

If a service accepts PDFs, lopdf 0.41.0 or earlier can abort on a roughly 21 KB crafted file. I'd patch that first, then handle the Windows-specific Ollama runner change, then reconcile OpenAI cost data that was delayed and later recovered.

Patch the lopdf parser before serving untrusted PDFs

The lopdf advisory was published October 16, 2026. It affects lopdf 0.41.0 and earlier, where the load entry points parse nested PDF arrays and dictionaries with unbounded recursion. The advisory says a deeply nested /X array can exhaust the call stack and abort the process with SIGABRT. The fixed version is 0.42.0, and the failure cannot be caught with catch_unwind.

Services that parse untrusted PDFs are affected. I'd check direct and transitive lockfiles for lopdf below 0.42.0 and move to 0.42.0 before accepting those files. If that version cannot be deployed yet, I'd stop the untrusted-PDF path until the parser is updated.

Stage Ollama v0.40.6 for Windows runner cleanup

The Ollama v0.40.6 release was published October 16, 2026. GitHub labels it a pre-release, and Ollama v0.40.6 includes a Windows change to prevent orphaned runners.

Windows deployments using that runner path are affected. I'd check the installed version and stage v0.40.6 there before wider rollout. If Windows runners are not involved, this release is lower priority for this decision.

Treat OpenAI cost lag as a reconciliation check

The OpenAI Compliance API incident began October 14, 2026, when organization cost data was delayed. OpenAI resolved it on October 16, 2026, and reported that impacted services had fully recovered. ChatGPT usage and API Platform requests were not affected, and other reporting channels remained available.

Teams relying on fresh Compliance API cost data should compare their last-seen timestamp, retry delayed reads, and reconcile the results. This status snapshot does not establish a current outage. A local mismatch still needs direct verification because individual availability can vary.

Priority checklist

Patch lopdf to 0.42.0, or stop accepting untrusted PDFs until you can.
Check Ollama versions on Windows and stage v0.40.6 where runner cleanup matters.
Reconcile OpenAI Compliance API cost data and retry reads that were delayed.

I put lopdf 0.42.0 first, kept Ollama v0.40.6 behind a Windows staging check, and treated OpenAI cost retries as reconciliation work.

Next up: Weekly roundup

Sunday's edition is next. 🔗 Explore the editions →

How do I keep a product's icons consistent across dashboards and Flutter screens?

kyisaiah47 — Fri, 16 Oct 2026 15:50:32 +0000

Choosing icons for a product gets harder when the same action appears in a dashboard, a service directory and a Flutter screen. Phosphor Icons, dashboard-icons and morphnext cover different parts of that job: a flexible base set, a catalogue of service marks and animated state changes.

Phosphor Icons for the shared base set

Phosphor Icons is a general icon family for interfaces, diagrams and presentations. The repository describes 1,248 icons in six weights, with raw stroke information retained for further styling.

Who should try it: teams building product UI where the same icon needs to move between web, React, Vue or Flutter.

First experiment: choose one action, such as search or settings, and render it at two sizes and two weights. Check whether the stroke change still reads as the same action.

Limitation: the family gives you a consistent vocabulary, but it does not provide your product's service logos or decide which weight belongs in each context. Observed 2026-10-16.

dashboard-icons for service directories

dashboard-icons collects more than 1800 curated icons for services, applications and tools. It offers SVG, PNG and WEBP formats, with light and dark variants and a kebab-case naming convention.

Who should try it: anyone making a dashboard or app directory where recognizable service marks matter more than a single generic icon family.

First experiment: pick five services already shown in your product and test the SVG files in one directory row. Keep the icon size, background and label width fixed, then inspect which marks still read clearly.

Limitation: this is a catalogue of service imagery, so visual consistency depends on the source marks and the variants you choose. It is a better fit for directories than for a product-wide action language. Observed 2026-10-15.

morphnext for Flutter state changes

morphnext turns bundled Flutter IconData glyphs into interruptible, spring-driven vector morphs. AnimatedMorphIcon starts from the shape currently on screen, while MorphIcon accepts controlled progress for gestures, scrolling or timelines.

Who should try it: Flutter teams whose icons change state, such as menu to close or outline to filled.

First experiment: replace one two-state button with AnimatedMorphIcon, then interrupt the transition by tapping twice. Add semanticLabel values for both states and compare the result with a regular icon swap.

Limitation: morphnext works with bundled font-backed IconData and monochrome rendering. It does not morph arbitrary Flutter Path objects or SVG artwork, and some icon pairs can produce surprising intermediate shapes. Observed 2026-10-15.

Put the three choices in the same decision

Phosphor Icons is the broadest starting point for a shared action vocabulary. dashboard-icons is the specific choice for service marks in dashboards and directories. morphnext handles motion between icon states inside Flutter.

A small product can use all three without treating them as interchangeable. Use Phosphor Icons for actions, dashboard-icons for recognizable external services and morphnext when a state change needs to show continuity.

In your own project, pick one repeated action and one service directory row. Render the action with two Phosphor weights, place the service mark from dashboard-icons beside it, then try the same action transition with morphnext if the screen is Flutter. I'd keep the version that remains recognizable at the smallest size and remove the one that needs extra explanation.

Next up: Tech updates

Saturday's edition is next. 🔗 Explore the editions →

Email coding tasks to your own computer

kyisaiah47 — Thu, 15 Oct 2026 17:13:31 +0000

Send an idea by email

You can remember a signup form problem while you are away from your computer. You can email yourself the task from your phone. You send the message from your own Gmail account to your own address with +agents added. Gmail delivers the message to your normal inbox, so you need no new email account.

You write the task in the email body. You can send plain text or HTML email. You can attach files, and @gent gives the saved attachment paths to the agent.

A signup form task can ask an agent to improve confusing parts of the form and run the relevant checks. Your computer can stay at home while you send the task from another device.

Run the task on your computer

You install @gent on the computer that holds your projects. The runner reads your Gmail Sent folder, not your Inbox. It starts Codex or Claude Code in a configured project with your existing sign-in.

Your repositories and agent sign-ins stay on your computer. Task text and results travel through Gmail and your chosen agent provider. Tasks for different projects can run at the same time.

The runner sends Queued, Started and the result as replies in the task thread. The result is the agent's final message as formatted email. Every reply ends with the task ID and the command to open it in your terminal.

Only mail that you send from your own Gmail account can start a task. Mail from other people lands in your Inbox. The runner does not read your Inbox, so their mail cannot start a task. Anyone who can add mail to your Sent folder can also send tasks, so you must protect your Gmail account and its credentials.

Route work with the subject line

The subject line selects the agent, project, model and run mode. Agent names ignore case. Project names are case sensitive. The task body contains the instruction.

Codex: improve the signup form runs Codex in your default project.

Claude: improve the signup form runs Claude Code in your default project.

Codex/website: fix the footer links runs Codex in the project named website in your config.

Claude [opus]: review the auth flow runs Claude Code with the opus model. Replies in the thread keep that model.

Codex/website [gpt-6.1-sol]: fix the build runs Codex in the website project with the gpt-6.1-sol model.

Claude [opus, terminal]: review the auth flow opens Claude Code in a new Terminal window and uses the opus model.

Without a model in brackets, the configured default model runs. Add headless in the brackets to run the task in the background. Add terminal in the brackets to open the task in a Terminal window.

Continue and control the session

You can reply in the same thread to continue the same agent session. The agent keeps the earlier turns. A reply of status returns progress by email. A reply of stop cancels queued turns and stops the running agent. Changes that the agent already made stay in your project.

Approval emails let you approve or deny a blocked action from your phone. Each approval covers one action. You reply directly to the approval email with approve or deny. Silence becomes a denial after the configured timeout.

With approvals off, Codex uses its configured sandbox and approval policy. Claude Code denies actions that need approval by default. You review the work before you publish or deploy it.

When you return to your computer, run atgent list to see each email task with its agent, model and status. Select a task and press Enter to resume the same session in your terminal. The agent then answers in the terminal instead of by email. A reply resumes a Claude terminal session. Codex terminal sessions are not tracked, so a reply opens a new window.

Set up @gent

Install uv first. Then install Codex or Claude Code and sign in. Install the runner with uv tool install atgent. Run atgent init to enter your Gmail address, sign-in method, project folders, installed agents and default models. The setup writes no secret to the config.

Turn on IMAP in Gmail. Create a Google app password, or use your own Gmail OAuth desktop client when app passwords are blocked. Keep the app password in your OS keychain or in the AGENT_MAILBOX_PASSWORD environment variable. Never put it in the config file.

Run atgent doctor to check Gmail over IMAP and SMTP without sending mail. The command also checks that Codex and Claude Code are installed. Run atgent start to start the runner in the background. Its first check skips old Sent mail, so send your first task after that check.

Requirements

@gent needs Gmail with IMAP access, macOS or Linux, Python 3.11 or later, uv, and a computer that stays awake and online. You need Codex or Claude Code installed and signed in. Claude Code needs version 2.1.259 or later.

HTML email, attachments, concurrent projects, approval email replies with both agents, and the login service were tested live on macOS. Linux and Gmail OAuth are unit-tested only.

@gent is free. Your existing Codex or Claude Code plan and its limits apply.

https://atgent.dev

An agent tool directory can show the evidence behind each entry

kyisaiah47 — Thu, 15 Oct 2026 17:12:59 +0000

agentwire.thecompound.tech

AgentWire is an index of shipped agent tooling, and each entry can carry a curated list, a Hacker News thread, or repository velocity as evidence. Engineers use it to find repositories that exist, were released, and can be inspected before choosing a tool.

The problem

A repository can collect four hundred stars for two years without anyone revisiting it. A single Hacker News thread can come from the author's friends.

Announcements, roadmaps, specifications without implementations, placeholders, and abandoned archives all attract attention. None proves that somebody can clone the repository today.

AgentWire keeps those signals attached to the entry instead of treating one popular signal as enough.

How AgentWire works

AgentWire currently brings together New tools, Context Window, ToolDrift, and StillShipping. The site uses Next.js, React, TypeScript, and Supabase, with committed JSON files as fallbacks for the main index.

AgentWire reads agentwire_posts from Supabase in pages of up to 1,000 rows. If the database read fails, it uses src/data/posts.json.
AgentWire reads ctxwindow_posts, tooldrift_tools, tooldrift_changelog, tooldrift_leaderboard, and stillshipping_tools in parallel. A failed read returns an empty list for that section.
AgentWire converts each source row into a shared record with a section, type, title, detail, date, status, and searchable text.
The front page merges the four section records by date and keeps 24 rows per section list.
The board reads the verification record for each New tools entry. Its score uses the last commit, commits in 90 days, last release, issue close time, licence, and the first install command in the README.
check-verified.mjs rejects records with impossible values, missing source URLs, stale readings, or a score that does not match its band.

The index keeps the source description and the operational reading separate. The first comes from the repository owner, while the second records what the health check read and where it read it.

A worked example

The health record for KnockOutEZ/wigolo records npx wigolo as a resolved npm install command. The record also keeps the registry source URL, the package name, the version, and whether the repository has an examples directory.

That gives an entry two different kinds of information. The index can show why the repository appeared, while the verification record can show whether its documented install package resolved when AgentWire checked it.

How it compares

AgentIndex is a directory for AI agents, MCP servers, and .cursorrules. It offers category search, install commands, daily updates, editor picks, and a comparison view. Pick AgentIndex when you want to search a broad catalogue and copy an install command.

Awesome MCP Servers is a hand-curated, link-checked catalogue focused on Model Context Protocol servers. It keeps structured data in data/servers.json, publishes a JSON API, and lists client configurations for hosted servers.

AgentWire covers MCP servers alongside coding-agent harnesses, agent frameworks, and related tooling. Its own entry rule requires two independent signals, while its health record stays explicit about what it did not test.

Limits

AgentWire does not run, benchmark, or review the tools it shares. It does not state that an entry works or holds up.

The index reflects what its source accounts published. A reader still needs the repository, documentation, and tests for a technical evaluation.

Try it

Start with AgentWire's search page and enter a repository name. The result can lead you to the entry, its signals, and the verification record.

agentwire.thecompound.tech

Next up: Tools worth trying

Friday's edition is next. 🔗 Explore the editions →

Compound Lab's Infrastructure Cost Calculator: web app cost estimates, built on Next.js

kyisaiah47 — Tue, 13 Oct 2026 17:16:41 +0000

https://stacktab.thecompound.tech

Compound Lab's Infrastructure Cost Calculator is a web cost calculator built on Next.js and React. It lets a developer price a database, auth service, payment provider, and host against the same user profile.

The problem

A web app bill depends on more than a plan's base fee. The estimate also depends on storage, egress, requests, paid conversion, transaction volume, and the allowances that a plan will not exceed.

Compound Lab's Infrastructure Cost Calculator prices those inputs together. Its default stack returns $367.38 a month at 10,000 users, with Neon, Clerk, Polar, and Vercel contributing separate lines to the statement.

How Compound Lab's Infrastructure Cost Calculator works

Compound Lab's Infrastructure Cost Calculator keeps a catalogue of vendor plans, meters, allowances, source pages, verification dates, and notes. The live catalogue records 269 plans across 77 services, with each rate tied to the page where it was read.

The server reads the catalogue and the latest re-read status from Supabase. The manifest includes @supabase/supabase-js for that connection.
The browser parses the selected stack and user count from the URL. The Console component keeps those selections in React state and mirrors them back into the query string.
profileForUsers turns the user count into a usage profile. The default profile includes 5 GB of database use, 10 GB of storage, 200 GB of egress, 2 million requests, and 0.5 million function invocations at 10,000 users.
estimatePlan checks plan restrictions and hard caps before calculating charges. A plan that publishes an allowance but sells no overage becomes a blocker when the profile exceeds that allowance.
estimateService calculates the eligible plans and priceStack combines the selected services. The statement keeps each charge's label, working, amount, verification status, and source URL beside the total.
A missing rate stays unknown. formatUsd(null) prints price not published, and the total remains withheld until the missing figure is resolved.

A worked example

Select Neon, Clerk, Polar, and Vercel, then choose 10,000 users. Compound Lab's Infrastructure Cost Calculator returns a total of $367.38.

Neon contributes $77.38 from 730 compute hours at $0.106. Polar contributes $270 from its $20 base, 3.8% of $4,000 in revenue, 200 transactions at $0.40, and 1.5% of $1,200 in international-card revenue. Vercel contributes its $20 base, while Clerk contributes $0 on its Free plan.

How it compares

Infracost parses Terraform, CloudFormation, and AWS CDK projects to estimate resource costs and surface cost changes in pull requests. Its pricing page lists a free CI/CD plan, a $250 monthly Starter plan, and a $1,000 monthly Cloud plan. Choose Infracost when the input is infrastructure code and the review belongs in CI/CD.

CloudZero ingests AI, cloud, and SaaS billing with telemetry, allocates spend across business dimensions, and sends the result to dashboards, alerts, reports, and engineering surfaces. Its pricing page offers a single subscription with a custom price quote. Choose CloudZero when the input is observed spend and the question is cost per outcome.

Compound Lab's Infrastructure Cost Calculator works earlier in the decision. It uses public vendor rate cards and an editable usage profile to compare a web stack before there is billing telemetry or an infrastructure plan to scan.

Limits

Compound Lab's Infrastructure Cost Calculator models public rate cards. It does not cover negotiated or enterprise pricing, and it does not ingest a company's actual billing data.

The usage profile is an assumption, not a measurement of a running application. Compound Lab's Infrastructure Cost Calculator prints the assumptions beside the figure and lets the reader edit them in the calculators.

Try it

The first step is picking a database, auth service, payment provider, and host in the console. Then choose the user count that matches the estimate you want to inspect.

https://stacktab.thecompound.tech

Why Your Brain Does That: behavior explanations on Next.js

kyisaiah47 — Tue, 13 Oct 2026 16:56:27 +0000

whyyourbrain.thecompound.tech

Why Your Brain Does That is a searchable index of named experiences and the reasons behind them, built on Next.js and React. People use it to find a sentence about something they do, then read the explanation on its own entry page.

The problem

A short clip can explain why someone forgets why they entered a room, then disappear from view. Why Your Brain Does That keeps those spoken lines on pages that wait.

The doorway example makes the boundary clear. The entry says the forgetting is real, while a 2021 study across four experiments found no reliable doorway effect.

The site also states what it does not do. It does not tell anyone what they have, and it directs larger problems toward a person rather than an archive.

How it works

The product keeps a searchable corpus of titles, spoken lines, captions, images, categories and source findings. A search keeps every entry in place, enlarges matching entries to the width they earned, and reduces the rest to their smallest width.

You type a word, a room you were in, or a thing you do into the search field. SearchField trims the value, encodes it, and routes it to the whole index with a q parameter.
The Next.js route reads the query and maps every entry into a tile with its title, still, category, line count and searchable text.
SheetBody lowercases the query, checks each tile's hay string, and records matching slugs without removing the other tiles.
The live archive layer reads published rows from Supabase, merges them over the committed corpus, and orders the result by publication time.

The app uses Next.js 15.5.25, React 19.1.1, TypeScript, @supabase/supabase-js and posthog-js. The committed corpus comes from phenomena.json, and the derive script writes the rendered corpus to generated/corpus.json.

A worked example

Search for procrastination. The sheet keeps the whole index and marks the entry titled "procrastination isn't laziness. it's your brain avoiding a feeling" as a match.

Opening that entry returns four spoken lines. The second line names boredom, judgment and the chance of failing as emotions attached to the task. The page also carries the entry's still and its caption, "it was never about discipline."

How it compares

The School of Life publishes articles organised around themes such as Calm, Relationships, Self-Knowledge and Work. Pick it when you want a longer article library organised by subject rather than a searchable entry with spoken lines and a still.

Headspace provides guided meditations, expert-led exercises, sleep content and AI-powered support. Its listed plans include a 14-day trial, $69.99 annual access and $12.99 monthly access. Pick it when you want guided practice for stress, sleep or mindfulness instead of an explanation archive.

Preveal moves through Notice, Understand and Consider What Comes Next, then keeps reflection history in local storage without requiring an account. Pick it when you want to reflect on a body signal and choose your own next action. Why Your Brain Does That gives you a named experience and its explanation instead.

Why Your Brain Does That keeps the input small and the output fixed: a phrase goes into the index, matching entries stay visible, and an entry page holds the explanation.

Limits

Why Your Brain Does That is not therapy, diagnosis or a personal assessment. It does not assign a label to a body signal, and it does not replace professional help.

The site also does not promise that every explanation is established. Its register includes findings where a source differed from the entry, including the doorway explanation.

Try it

Type a word you remember, a room you were in, or a thing you do. Then choose Ask the index.

whyyourbrain.thecompound.tech

StackTab: whole-stack cost estimates, built on Next.js

kyisaiah47 — Mon, 12 Oct 2026 11:42:38 +0000

stacktab.thecompound.tech

StackTab prices a database, an auth service, a payment provider and a host together, using a Next.js and React web console. Builders use it to compare a stack at 1,000, 10,000 and 100,000 users.

The problem

Pricing pages usually answer for one vendor at a time. A builder choosing Neon, Clerk, Polar and Vercel has to open each page, translate different billing units, and add the results.

The missing rate creates a worse problem than a missing row. Firebase publishes a free quota and then defers to Google Cloud pricing, while Auth0 places higher usage behind a slider. StackTab records those cases as unknown instead of turning them into $0.

How it works

StackTab keeps a catalogue of plans, meters, allowances, restrictions, source pages and verification dates. It calculates a bill from that catalogue and an explicit usage profile.

The console accepts a stack made from database, auth, payment and hosting services. The selected services and user count are mirrored in the query string.
readCatalogue reads the service catalogue and refresh run from Supabase through @supabase/supabase-js. The page and the JSON API use the same catalogue.
profileForUsers turns the selected user count into usage assumptions. The profile includes database storage, file storage, egress, requests, transactions, seats and other meter quantities.
blockersFor removes plans that cannot carry the usage. It excludes a plan when an allowance is exceeded and no overage meter exists. It also excludes plans marked as non-commercial.
estimatePlan applies base fees, percentage charges, fixed transaction fees and tiered meters. If a required rate is unknown and usage exceeds the included amount, the estimate total becomes null.
formatUsd renders that null as price not published. The React console then renders the statement with @number-flow/react, including the working behind each charge.

The catalogue is checked against literal strings from each vendor pricing page. A nightly re-read marks a plan as drifted when those strings disappear, and the verification date stops advancing. StackTab does not rewrite the price after a drift.

A worked example

The default stack uses Neon, Clerk, Polar and Vercel at 10,000 users. StackTab calculates a $367 monthly total, with Neon at $77.38, Clerk at $0, Polar at $270 and Vercel at $20.

The result is a statement rather than a single unexplained total. Each service carries its selected plan, charge lines, source page, verification status and assumptions.

How it compares

Amazon Web Services Pricing Calculator estimates AWS services by region and configuration. It is the better choice when the question is how much a specific AWS workload will cost, because its catalogue is AWS's own service catalogue.

Infracost parses Terraform, CloudFormation or CDK, retrieves prices from its Cloud Pricing API, and evaluates the cost of a code change. It is the better choice when the input is infrastructure code or a pull request.

StackTab takes a different input from both. It prices managed developer services across database, auth, payments and hosting categories from vendor pricing pages, without requiring a repository or a cloud account. Its output is withheld when a public rate cannot support a defensible calculation.

Limits

StackTab does not price an existing cloud bill, parse infrastructure code or apply an organisation's private discounts. AWS Pricing Calculator handles AWS workload estimates, and Infracost handles infrastructure-as-code cost changes.

StackTab also cannot resolve a vendor rate that the vendor does not publish. The product prints price not published and keeps the reason beside the unresolved line.

Try it

Choose a database, auth service, payment provider and host, then set the user count in StackTab's calculator. The first result is the stack total with each service's plan and charge working.

KitGrade: starter-kit scores from public evidence

kyisaiah47 — Sun, 11 Oct 2026 22:22:07 +0000

kitgrade.thecompound.tech

KitGrade scores SaaS starter kits from public evidence, using a Next.js application and a captured read API. Developers use it to compare maintenance, completeness, transparency, documentation, and support before choosing a starting point.

The problem

Starter-kit directories usually put names, stacks, prices, and feature badges beside each other. That helps with discovery, but it does not show whether a repository builds cleanly or whether a claim came from a file anyone can inspect.

KitGrade keeps those facts separate. A score can cite a commit history, dependency manifest, pricing page, documentation index, or repository path, and the product labels evidence it could not measure instead of treating it as zero.

How KitGrade works

KitGrade keeps a scorecard with five components worth a full hundred points. The data layer reads four captured JSON files, and the capture refuses to write a set whose component figures do not add back to the stored totals.

The capture script reads the public API for statistics, method rules, the ranked kit list, and each kit detail record.
The score resolves maintenance, completeness, transparency, documentation, and support from the stored evidence fields.
The product records whether evidence came from a clean checkout or from reading the repository, manifest, and documentation.
The Next.js routes expose the same data through /api/stats, /api/method, /api/kits, /api/kits/<slug>, and /api/compare.
The console draws measured components as filled spans and unmeasurable components as dotted caution tracks.

The distinction between "We ran it" and "Read, not run" is part of every score. A clean-checkout run keeps every command, exit status, and duration with the kit.

A worked example

A kit detail record can include its homepage, repository, stack, licence, price evidence, score breakdown, fourteen capability signals, and an install transcript. The transcript records commands such as cloning a repository and running pnpm install --frozen-lockfile, with the result and duration attached.

The product also keeps an explicit boundary. If a closed kit has no public repository, KitGrade marks maintenance as unmeasurable and keeps those points in the denominator.

How it compares

Boilerplates Directory compares SaaS starter kits by stack and uses open-source and price badges on listings. It is a better first stop when the job is broad discovery across stacks.

BoilerplateList lists boilerplates and starter kits with stack, pricing, and licence information on detail pages. It fits a reader who wants catalogue metadata before opening a repository.

BoilerplateHub compares boilerplates through feature filters such as payments, authentication, databases, documentation, and support. Its deals page also lists pricing from free options to premium kits.

KitGrade differs by attaching a published rule and evidence source to each scored component, then separating clean-checkout runs from documented-only records. The result is a scorecard about what the method could verify, not only what a listing claims.

Limits

KitGrade does not infer evidence that a public surface does not expose. It also does not turn a failed build into a lower score, because the method records the run result separately from the score.

A reader who needs a feature catalogue should use BoilerplateHub or Boilerplates Directory. A reader who needs repository evidence and a reproducible scoring method should use KitGrade.

Try it

The first step is to put a kit on the bench. KitGrade then shows the score, the evidence behind each component, and the parts the method could not measure.

kitgrade.thecompound.tech

KitGrade: SaaS starter kits scored with visible evidence

kyisaiah47 — Sun, 11 Oct 2026 10:31:54 +0000

kitgrade.thecompound.tech

KitGrade scores SaaS starter kits against evidence buyers can check, using a Next.js application and frozen JSON data. Developers use it to compare what a kit includes, how it is maintained, and which claims have public support.

The problem

A starter kit can advertise authentication, billing, documentation, and support without giving a buyer one place to verify those claims. KitGrade checks the repository, dependency manifest, documentation, pricing page, release history, and public support channel.

The distinction between "We ran it" and "Read, not run" matters. A build transcript records commands, exit statuses, and durations, while a documented result records what the repository or vendor page exposes.

How it works

KitGrade keeps a hundred-point scorecard divided across maintenance, completeness, transparency, documentation, and support. A capability that cannot be observed publicly remains unmeasurable instead of becoming a zero.

The capture script reads active kit rows, scores, and hands-on runs from the KitGrade engine database.
It joins each kit to its score and run transcript, then checks that the component figures add back to the stored total.
It writes stats.json, method.json, kits.json, and kit-detail.json into the repository.
The Next.js data layer reads those files through src/lib/data.ts, while src/lib/derive.ts turns stored breakdowns into score spans, evidence labels, and capability rows.
The console renders each score beside the evidence source, the measurement state, and any recorded install transcript.

The repository check fails when a kit total does not reconcile, a component exceeds its maximum, or the method maxima do not add to one hundred. The capture also refuses to write a set with inconsistent figures.

A worked example

KitGrade records Bullet Train as a Rails, Ruby, PostgreSQL, Stripe, and Hotwire kit with MIT licensing. Its stored score is 92.2, with 30 points for maintenance, 23.2 for completeness, 20 for transparency, 13 for documentation, and 6 for support.

The hands-on transcript records a clean clone, a successful frozen Yarn install, and a failed build because configuration is still required before the application runs.

How it compares

ShipFast presents a Next.js boilerplate for SaaS and AI applications and sells access through its own site. Pick ShipFast when you want a commercial Next.js starting point with the vendor's included feature set.

Bullet Train describes itself as an MIT-licensed Rails-based framework with authentication, teams, permissions, billing, and other application features. Pick Bullet Train when your application belongs in Rails and you want an open-source starting point.

SaaS Pegasus is a Python and Django SaaS boilerplate with flat pricing and no recurring subscription fees. Pick SaaS Pegasus when Django is the deciding constraint and a one-time license fits the project.

KitGrade differs by recording the evidence behind each comparison. Its completeness score checks the repository and file tree for open-source kits, while its transparency score includes public source, licensing, pricing, release history, and documentation.

Limits

KitGrade does not replace reading the source repository or testing a kit in the application you plan to build. Its score only covers the five published components and the evidence those components can observe.

A missing public surface is recorded as unmeasurable when the method cannot inspect it. That state is separate from a measured zero.

Try it

Start with a kit from the bench, then open its scorecard and read the evidence attached to each component. The Bullet Train record is a useful first example because it includes both repository evidence and a hands-on install transcript.

Four consumer tools: ScriptProbe, ListRun, MatchLine and BreachProbe

kyisaiah47 — Fri, 09 Oct 2026 09:44:25 +0000

This issue carries consumer tools for checking package install scripts, directory submissions, resume evidence, and app security. The outputs are a verdict, a run sheet, a tailored PDF, and a security report.

This issue

These products turn narrow tasks into concrete results you can inspect.

ScriptProbe


	ScriptProbe checks an npm package before you install it. It reads the tarball and lifecycle scripts as text, matches fixed patterns, and reports install scripts, network access, native builds, child processes, and publishing-account changes without executing the package. For a JavaScript developer or maintainer, the free check returns a verdict and the matching source text. You pay $15 once for a 30-day watch that rechecks a package.json or repository daily and emails changes.

ScriptProbe checks an npm package before you install it. It reads the tarball and lifecycle scripts as text, matches fixed patterns, and reports install scripts, network access, native builds, child processes, and publishing-account changes without executing the package. For a JavaScript developer or maintainer, the free check returns a verdict and the matching source text. You pay $15 once for a 30-day watch that rechecks a package.json or repository daily and emails changes.

ListRun


	ListRun is a directory-submission run sheet for a product owner who wants to see where a listing qualifies and what each submission requires. You answer what the product is, what it plugs into, and what it was built with, then ListRun shows the queue, the directories it will not attempt, and the order it reaches them. Each row carries a directory, submission method, qualification state, and note, with a receipt for every one. You pay $9 once for the Launch run or $19 once for the Full list.

ListRun is a directory-submission run sheet for a product owner who wants to see where a listing qualifies and what each submission requires. You answer what the product is, what it plugs into, and what it was built with, then ListRun shows the queue, the directories it will not attempt, and the order it reaches them. Each row carries a directory, submission method, qualification state, and note, with a receipt for every one. You pay $9 once for the Launch run or $19 once for the Full list.

MatchLine


	MatchLine checks a resume against a job posting, line by line. It reads every stated requirement, points to the resume line that proves it, and separates gaps with a line to add from gaps with nothing to build on. For a job seeker, the free check returns the reading and both documents without keeping an archive. You pay $5 for a tailored PDF.

BreachProbe


	BreachProbe checks whether a shipped app keeps one signed-in user's rows away from another. You paste an app URL and get a security score with checks for exposed keys, anonymous table access, headers, auth flows, and row-level isolation. For an app builder shipping user-owned data, the report uses two test users and compares table access rather than reading policy text. The result is a security report with findings, comparisons, and suggested fixes.

BreachProbe checks whether a shipped app keeps one signed-in user's rows away from another. You paste an app URL and get a security score with checks for exposed keys, anonymous table access, headers, auth flows, and row-level isolation. For an app builder shipping user-owned data, the report uses two test users and compares table access rather than reading policy text. The result is a security report with findings, comparisons, and suggested fixes.

One issue a week, and one shipped product taken apart every month. What each product does, what it cost to build, what the pipeline behind it looks like, and what the numbers did, read off the repository and the live site, not written from memory. Join the list.

OpenCal puts shared free time on one link

kyisaiah47 — Wed, 07 Oct 2026 17:40:26 +0000

One link for open time

OpenCal shows open times from connected calendars on one link. Visitors can view available times up to 90 days ahead. Visitors can switch between Week, 2 weeks, and Month views. Visitors see the account name and selected profile details. Visitors never see event titles, places, or guests. OpenCal reads busy times instead of event details.

OpenCal is free to use. You get a link by signing in with Google or Microsoft and selecting Get your link. Settings lets you change the link handle and choose which calendars count as busy.

Maya sends one link

Maya is a designer at Northwind. Sam is a recruiter at Brightpath Talent. Sam needs a 30-minute call with Maya during the current week or the next week.

Before OpenCal, Sam emails Maya for available times. Maya checks Google Calendar, the company Teams calendar, and iCloud. Maya types free times into the reply. Maya checks Teams again after finding one incorrect time.

With OpenCal, Maya connects Google and iCloud. Maya signs in with Google and connects iCloud with an Apple Account. OpenCal reads only busy times from those calendars. Event titles stay in the connected calendars.

Maya sends one OpenCal link to Sam. The link shows free time across the connected calendars.

Teams from the screen

Most companies block outside apps from reading Teams calendars. OpenCal reads a company Teams calendar from the screen when a direct calendar connection cannot work.

Maya opens the Teams week view. Maya presses Read from screen and selects the Teams window. OpenCal reads one frame in the browser. The screenshot never leaves the browser. OpenCal saves only busy times and stores those times encrypted. Maya checks the times before OpenCal saves them.

OpenCal can also read an Outlook desktop calendar from the screen. The Chrome and Edge extension reads Outlook on the web while the account stays signed in. A private .ics feed can provide another calendar source.

Times for both people

Sam opens Maya's link and signs in with Google or Microsoft. OpenCal compares Maya's calendars with Sam's calendar. OpenCal sends Sam only times that work for both people.

Sam books Thursday at 11:00. OpenCal saves the booking for Maya and Sam. OpenCal keeps the booking in OpenCal by default. Maya and Sam can turn on calendar booking in Settings under Booking. Google or Outlook then adds the meeting to the selected calendar and sends the invite.

The link lets anyone book when the owner selects Anyone can book. The owner can create one-time links that allow one booking. The owner can also turn booking off while keeping the free times visible. A visitor must sign in before booking.

Calendars that connect

OpenCal connects several Google accounts, personal and work Microsoft accounts, and an iCloud account. OpenCal can read Teams and Outlook calendars from the desktop screen. The browser extension can read Outlook on the web. OpenCal can read any calendar with a private .ics address.

OpenCal checks connected calendars when a page or link opens. OpenCal subtracts busy times from the hours and days selected in Settings. OpenCal ignores events marked free, canceled, or declined. OpenCal counts tentative events as busy.

OpenCal gives each person one link for shared availability and booking. Get a free link at:

https://opencal.link