Products built in the lab
Each one is an experiment, built on the lab's own open source.
In private beta
Each product's own site takes requests to join the beta.
A cache and WAF in front of a web servercastellan
Declared sites are rendered into edge configuration by a control plane and applied by an agent on each node. The edge is nginx-lua with both WAF modules in front of go-proxy-cache and Redis, and Terraform lands the same shape on any of the five major providers.
- A node never takes itself out of service: a bundle that fails validation is restored and the node keeps serving
- One setting moves the whole WAF, rate limiting, bot scoring, geo rules and signatures, between off, log only and block
- A purge is a durable record queued per site, so a node that was rebooting applies it when it returns
Your cluster checked against twelve compliance frameworks, in one PDFephemera
A read-only posture and compliance audit for a cluster, taken from an uploaded dump or a read-only CLI run against the live cluster. No agent is installed. Results arrive in minutes as a single board-ready PDF, with every finding mapped to the framework that asks for it.
- Findings mapped across twelve frameworks. ISO 27001, NIS2, NIST CSF, SOC 2, the EU CRA and GDPR among them, with remediation drafts attached
- Processing stays in the region you pick, and the raw side, cluster dumps, findings, PDFs, deletes itself after 24 hours
- What survives that deletion is the aggregate: scores and trends, so the dashboard still shows whether you are getting better
One scorecard across every repository you own, and which way it is movingproofhouse
Portfolio-wide security and quality posture across every repository an organisation owns. Teams run gandalf in their own CI and push the JSON run record here, where it is stored, projected, aggregated and trended.
- Nothing runs your code on this side: no clone credentials, no scanner licences, near-zero compute
- A gate whose scanner was missing is reported unavailable rather than counted as a pass, so the score cannot flatter you
- Cross-repo finding groups built on gandalf's versioned fingerprints, so suppressing something once settles it everywhere
A dated log of restores that actually completedlastresort
Evidence that your backups restore, produced on a schedule. A backup is fetched, restored into an isolated container with no route out, and checked against the questions you declared it should answer. The dated record is kept either way.
- The scratch container has no external egress, so a restored copy full of live credentials cannot call anything
- A failed check exits non-zero, which means cron and CI can act on it without a human reading a report
- The dated record is an evidence pack an auditor, a customer or an insurer can be handed
Scheduled failure drills, with a dated record of what survivedfiredrill
Failure drills on a schedule against a namespace or a compose stack: pods killed, disks filled, DNS withheld, certificates expired, each scored as survived, degraded or failed with the time to first impact. Every run leaves a dated record beside Lastresort's restore log.
- Checks adopted from a catalogue per plan and pinned by version, so the score compares run to run
- Each check carries a declared blast radius and a stop condition
- The dated record is what resilience-testing obligations ask a supplier to show
One ordered list of everything about to expirestillvalid
Certificates, domains, tokens, licences and secrets expire, and each is recorded somewhere different. The dates are discovered across those systems and ranked by what breaks when they pass, not by how soon they arrive.
- Ranked by consequence: a staging certificate and a payment gateway's are not the same nine days away
- Discovery runs on a cadence, so a thing nobody registered still turns up before it lapses
What the dependency bump did, and what is worth catching up withboneyard
A reviewable account of what a dependency bump actually changed: major jumps, licence changes, downgrades and newly-added transitive packages, each with the reason it matters.
- Two axes rather than a list: drift measured in libyears, viability from maintainer activity, release cadence and archived status
- Per pull request in review, and per quarter across the whole portfolio, from the same data
Every SaaS seat nobody has used in ninety days, with the money attachedlicensereap
The identity provider's people crossed with each vendor's usage, AI assistants included, per tool, to list the seats paid for and unused, priced from the contract and ready to reclaim.
- Leavers still holding seats, seats never used, tiers bought for one feature, tools that duplicate each other
- Where a vendor exposes no last-login, the seat is reported as unverified rather than counted
The cloud bill, explained in writing every month, against the budget that was setcloudledger
The cloud bill diffed every month against a declared budget, with every movement attributed to a team, a service or a dated change, and written up for the finance partner who will not open a console.
- Spend that no tag, team or ticket accounts for is reported as one number, which is the finding
- The report is the deliverable; the numbers travel with it for anyone who wants to check
An internal developer platform with your name on itpaved
Backstage in front, Argo CD and Crossplane behind, on Kubernetes. Every brand-dependent value is read as the app renders, so one container image serves any number of brands and a rebrand is a config change and a pod restart.
- A tenant is one object: namespace, quota, default-deny networking, RBAC, a scoped Argo project and a Vault path
- Nothing in the repository is a secret, every credential is generated at bootstrap
- Kyverno guardrails with assertions pinning what each policy allows, rejects and exempts
The management questions you cannot ask anyone at workmanager-os
A private space for the situations that cannot go to your team or your boss: answers drawn from a library of management playbooks, and guided tools that turn a short form into a finished document. Every playbook quoted is shown alongside the answer.
- Each account is encrypted under its own key, and deleting the account destroys that key
- The model is never asked to recall management practice from memory
Briefings assembled from primary sourcesnewsletter-stack
Eight topics, each watching one machine-readable feed and sending only what moved: open roles, regulatory diffs, dependency advisories, new packages, end-of-life dates, public incident reports and cloud pricing changes.
- Every issue is public, and each topic lists the sources it reads
Desk tools
Run on your own machine, with no hosted component.
Many coding agents, each in its own worktreefleetmux
A control surface for running many coding agents at once: each isolated in its own worktree, ranked by which are blocked on you, capped by a spend budget, and scored by quality gates before the diff reaches you. Built as an addon over opencode.
- A worker per git worktree, with an urgency-ordered fleet view that reads without colour
- Quality gates score the work and feed their findings back to the agent
- A daemon underneath, so the terminal and the browser cannot disagree
A graded mock interview, run on your own machinemockterview
A realistic technical interview, conducted and graded on your own machine by a single binary. One model interviews against a rubric it never reveals; a second scores the transcript against that rubric and quotes your answers back.
- Two passes, two models: one interviews, one grades
- Transcripts and scores stay in a SQLite file on your machine
- Roles and rubrics are editable YAML, so a team can write its own
Real bugs in real codebases, solved in a terminal, graded against how the maintainer fixed themproddojo
A running environment in the browser, a bug report in a customer's words, and the project's own tests. A script grades the fix against the commit that closed the bug for real, and shows that commit beside yours.
- Challenges drawn from open-source fixes under permissive licences, credited on each
- Around them, a scenario library: katas, system design, incident replays, broken clusters, security flaws
The stack for what you are building, with the free tiers' real limits and the wiring already donegroundwork
A free picker that turns a description of a product into a stack of services with each free tier's real ceiling, a directory page per service kept to the same numbers, and a starter kit with those services already wired to each other.
- One typed SDK over sign-in, billing, email, flags, storage, jobs and the admin panel
- Credentials generated at bootstrap and kept out of the repository, the way Paved bootstraps a tenant
One page that tells you what a repository is, how healthy it is, and what to do nextcode-atlas
Surveys a repository and its forge, GitHub or GitLab plus Jira, and renders one self-contained HTML file: a map of the code framed by its health, history, CI, pull requests, issues and delivery. Scripts measure everything; Claude writes only what reading the code can give, and every claim is checked against the scan.
- A brief for someone with five minutes, an onboarding guide for someone new, and a chat that answers from the code
- A Fix button on everything a pull request could fix: Claude Code makes the change on a branch and opens it
- An estate view rolls many atlases into one page, worst repository first
More on code-atlas → Not released yet
Labs
Free tools for the work itself: a deck of practices, a toolbox and a weekly read of the market. The phone apps and the PR Deck browser extension are on Experiments.
Draw one practice from twelve well-architected frameworks, or take the day’s pickPractice Draw
Every checklist item from twelve vendors’ well-architected frameworks, 352 of them, shuffled into one deck. Draw a card to open a standup, seed a design review or pick this week’s improvement; every card deals once before any repeats. The daily pick is the same card for everyone until midnight.
- Deal one, three or five cards, limited to one framework or one of seven themes
- Pin cards to a shortlist and copy it as markdown, kept in the browser with no account
- Installs to the home screen and works offline
Small instruments for the parts of infrastructure that bite backinfra toolbox
Twenty-eight browser tools, each answering one question engineers get wrong under pressure: what no-cache actually means, whether a liveness probe will kill a slow-starting pod, which nginx location wins, what an IAM policy really grants. Paste a config, get one answer and the reasoning behind it, and share it as a link.
- Every tool is a pure function in the tab: no account, no backend, no telemetry, and nothing you paste is sent anywhere
- The whole input travels in the URL fragment, which browsers never send upstream, so a shared link reproduces the answer exactly
- Copy any answer as Markdown for a pull request or an incident doc
A weekly issue on what moved in the engineering market, and what agreesSignals
A weekly momentum score for every tracked technology, the Thoughtworks Technology Radar and a week of job postings, read against each other and organised by discipline: frontend, backend, platform, data and AI, management. Each issue leads with the move the most independent sources agree on, and closes on what the week adds up to.
- Every move is labelled by its evidence: converging when two or more independent feeds agree, contested when they disagree, single-source when nothing corroborates it
- Every figure is computed in SQL; the prose is written from those figures by a model and never adds one
- A scoreboard of postings, share and median pay per area, with share used because ingestion volume swings week to week
- Every tracked technology gets a weekly momentum score from six independent signals; one that cannot be measured is left out of the average rather than counted as zero
Experiments
Seven small apps from the lab. Six are phone apps for the hours around the work: a workout log, a break coach, a daily engineering brief, evening puzzles, an envelope budget and a migraine log. The seventh, PR Deck, is a browser extension that turns GitHub's pull request list into a review dashboard.
Where this goes next
Every product here carries a paper: the problem it measures, the method behind it, and what it deliberately does not do. The whitepapers are where that thinking is written down.
Read the papersUsing several of them? The Kodebeat Console puts them on one account and one list, and there is a demo to click through.