“The friction is the point.”
Project Classification
Financial Simulation / Interactive Documentary
Tech Stack / Armament
Current Status
Archived -- Critical Stress
Equity (Eq) equals total asset value (V) minus liabilities (L). The absolute bedrock of leverage mechanics.
The exact mathematical threshold where structural failure initiates. MM = Maintenance Margin.
EXECUTE LIQUIDATION PROTOCOL
Modern brokerage interfaces are designed to eliminate friction. They abstract away the mechanics of leverage behind single-click buttons and smooth progress bars. This is an architectural lie. Leverage is inherently structural; it is the act of resting massive weight on a very narrow fulcrum.
Therefore, the multiplier must be visible. MARGINLAB forces the user to interact with the underlying math. When an equity curve dips below maintenance requirements, the interface doesn't just flash a warning; it structurally degrades.
Reactivity model perfectly mirrors continuous financial data streams.
Gamification distracts from the severity of structural failure.
No real money. The stakes are pedagogical, not financial.
Early user testing revealed that simple red text was insufficient to convey 'Margin Call'. Users treated it like a minor error, akin to a typo in a form.
We needed to introduce friction. A failing margin state shouldn't just look bad; it should feel fundamentally broken. We started disabling non-essential UI elements to force focus on the crisis.
The final implementation utilizes harsh, jagged charting lines and high-contrast red fills that bleed out of their containers when margin limits are breached. The layout breaks its own rules.
1export function calculateMarginRequirement(2 positionValue: number,3 leverageRatio: number4): number {5 // The brutally simple math that ruins weekends.6 if (leverageRatio <= 0) return positionValue;78 const initialMargin = positionValue / leverageRatio;9 const maintenanceMargin = initialMargin * 0.75; // Hardcoded pain point10 return {11 initial: initialMargin,12 maintenance: maintenanceMargin,13 isCritical: function(currentEquity: number) {14 return currentEquity < maintenanceMargin;15 }16 };17}Defining the product by explicitly stating what it refuses to be. Subtraction as a primary design principle.
// Weekly Report · v3.2.0 · 9 sources · 5 models benchmarked · MIT
What the curator asked for, what the skill agrees to do, and where the contract ends. Three answers to one question, read in that order.
Build an AI agent skill that produces a weekly Go ecosystem radar report as a self-contained HTML file. Cover Go compiler/runtime, proposals, releases, and community articles.
The brief was small enough to misread. "Build a weekly report" reads like an engineering task. What it actually meant was: a system that has to choose, every Monday morning, which 5 of 30 commits and which 3 of 50 issues earn a slot in a human's first 11 minutes of the week — without ever making the reader feel like the system is shouting.
Go Radar is not a learning artifact. It is a working tool that happens to also be a teaching object. The Go is small. The interesting part is the refusal — the code that says no, in constant time, to the long tail of "interesting this week."
A self-contained HTML report. ~18KB. 4 sections. ~70 items per week, all
curated, all linked to a real source URL. Dark/light mode via prefers-color-scheme. Native <details> accordions — no custom JS. Every external link opens in a new tab.
Last 7 days through today, ISO-week aligned. Bot PRs, dependency bumps, and typo-only commits are excluded at fetch time. Empty weeks write "quiet week" rather than leave a slot blank.
Single self-contained HTML file. No external CSS, no JS, no CDN. All links target="_blank" rel="noopener noreferrer".
Native <details> accordions, no custom JS toggle.
A hybrid fetch model. Each tool is optimal for its source type. The agent picks at runtime, falls through on failure.
All GitHub data: commits, proposals, releases, security issues, trending repos.
gh api "search/issues?q=org:golang+is:issue+label:Proposal+is:open&sort=updated&per_page=10" \ --jq '.items[] | "#\(.number) \(.title) ★\(.reactions.total_count)"'
JS-rendered sites: go.dev/blog, golangweekly.com. Bypasses Cloudflare Turnstile.
browser_navigate("https://go.dev/blog/all")
browser_snapshot(full=true)
# OR for golangweekly iframe:
browser_console("document.body.innerText.substring(0, 5000)") Direct JSON endpoints: HN Algolia, raw JSON feeds.
curl -s -A "Mozilla/5.0" \ "https://hn.algolia.com/api/v1/search?query=golang&tags=story&numericFilters=created_at_i%3E<UNIX_EPOCH_7D_AGO>&hitsPerPage=25"
Isolated session when terminal is `pending_approval` in cron mode.
delegate_task( prompt="curl https://hn.algolia.com/api/v1/search?query=golang&tags=story&numericFilters=created_at_i%3E<UNIX_EPOCH_7D_AGO>", context="Terminal blocked in cron. Return raw JSON." )
A change to cmd/compile, runtime, the spec, or the go command
These are the load-bearing walls. The compiler is the framework.
A Go proposal with a positive label, or strong recent signal
Proposals are the slow river. Tracking them shows where the language is bending.
A new package, an exported function, a deprecation
Stdlib is the contract every Go author lives inside. Quiet changes matter loudest.
go1.NN release tag, RC, or minor x/ library release
Releases are the only signal a non-Googler can act on in the same week.
A CVE, security advisory, or label:security issue in a widely-used package
This is the signal that pays the bill. Missing a release-blocker CVE is the failure mode.
A new repo with abnormal star growth in the last 7 days
GitHub star velocity is a noisy proxy for "people find this useful." It is not a verdict, but it is a signal.
A v2+ release of a widely-used library, especially a v2
Major version bumps usually mean breaking changes. They are how the ecosystem tells you to pay attention.
A scraper returns 30 commits and 50 issues. An AI agent skill returns 5 commits and 3 issues, each with a one-line reason it earned a slot in the digest. The ratio of signal-to-noise is the entire product.
PRIOR_VERIFIEDBenchmarked on ollama-launch cloud, June 2026. Five models, same prompt, same sources. The size of the output is the size of the curation.
Sample excerpt from go-radar-2026-06-29.html · 18,912 bytes · 0 external requests at
view time · 4 sections · ~70 items
| # | Date / Time | Channel | Phase | Model | Operational Tasks | Tokens in/out | Badge |
|---|---|---|---|---|---|---|---|
| 01 | 2026-04-22 | TUI | Bootstrap | minimax-m3:cloud | v0.1.0 — Initial skill scaffold Initial skill scaffold · Web collectors parse HN weekly, Go forum RSS, Go Time podcast releases · Report rendered as single self-contained HTML | — | REL MEDIUM |
| 02 | 2026-05-09 | TUI | Curation | minimax-m3:cloud | Curation rules: drop empty weeks Quiet-week stub · no-section-left-blank rule · broken layout prevention | — | FIX LOW |
| 03 | 2026-06-04 | Telegram | Editorial Voice | GLM-5.2:cloud | Add mini-prompt header to each report Curator voice line · italic-prompt header · editorial tone | ~12k / 3k | FEAT LOW |
| 04 | 2026-06-18 | TUI | Performance | minimax-m3:cloud | Cache + reuse infra for repeated queries 24h cache · per-topic highlight hashes · repeated-week fast path | ~25k / 6k | FEAT MEDIUM |
| 05 | 2026-06-28 | Telegram | Generalize | GLM-5.2:cloud | Repo restructure: agent-agnostic Hermes-specific → generic · 5 references · cron split · 17/17 verification test | ~115k / 30k | FEAT EXTREME |
| 06 | 2026-06-30 | Telegram | Polishing | minimax-m3:cloud | Model benchmark table + 6 dead link fixes 5-model comparison table · 6 dead link fixes · target=_blank on every link · README sync | ~55k / 12k | FEAT MEDIUM |
| 07 | 2026-06-30 | GitHub | Release | — | v3.0.0 — Public release (MIT) MIT license · public repo · v3.0.0 tag · hub publish ready | — | REL HIGH |
| 08 | 2026-07-05 | Cron | Delivery | minimax-m3:cloud | MEDIA tag fix — bare token, no backticks Backtick-wrapped MEDIA tag detected · file not attached · bare token rule · pitfalls.md + SKILL.md update | ~70k / 18k | FIX EXTREME |
| 09 | 2026-07-05 | Cron | Release | minimax-m3:cloud | v3.2.0 — Polished public release README rewrite · prompt-engineering guide · sample HTML checked in · skill stabilized | ~50k / 10k | REL HIGH |
| 10 | 2026-07-13 | Cron | Steady-State | minimax-m3:cloud | Routine weekly run · mon 07:00 utc Cron trigger · 9 sources · 7 signals · ~32 curated · 18.4KB output | ~45k / 11k | CRON MEDIUM |
// Cyber Threat Intelligence
A Go MCP server that ingests raw threat-intelligence feeds, parses them into structured JSON, and exposes a tool surface for local AI models to query IOCs without crossing the wire.
| Source | Type | Auth | Status | Metrics |
|---|---|---|---|---|
| CISA KEV | Known Exploited | — | Ok | LAT: 12ms TTL: 3600s |
| GitHub Advisory | Vuln Database | GITHUB_TOKEN | Ok | LAT: 45ms TTL: 1800s |
| NVD | National Vuln DB | NVD_API_KEY | Rate_Limit | LAT: 204ms TTL: 7200s |
| OSV.dev | Open Source Vulns | — | Ok | LAT: 32ms TTL: 3600s |
| GitHub PoC | Exploit Code | GITHUB_TOKEN | Ok | LAT: 55ms TTL: 1800s |
Get recent CVEs within a time window, filtered by severity.
{
"hours": 24,
"severity": "CRITICAL,HIGH",
"limit": 50
}Get CISA KEV (Known Exploited Vulnerabilities) catalog entries.
{
"recent_days": 2,
"limit": 100
}Get highest-risk CVEs: actively exploited (KEV) and/or public PoC.
{
"limit": 50,
"since_hours": 168
}Generate a full HTML threat intelligence report.
{
"hours": 24,
"format": "html"
}| CVE ID | Severity | Status | Last Seen |
|---|---|---|---|
| CVE-2024-3094 | CRITICAL | EXPLOITED | 2024-10-27 |
| CVE-2023-4863 | HIGH | PATCHED | 2024-10-26 |
| CVE-2024-1086 | MEDIUM | ANALYZING | 2024-10-27 |
Snapshot_01 | # | Date / Time | Channel | Phase | Model | Operational Tasks | Tokens in/out | Badge |
|---|---|---|---|---|---|---|---|
| 01 | 2026-06-21 ~22:00 | TUI | INIT_01 | GLM-5.2 | Foundation günü go.mod (Go 1.25, Runaho/cti-mcp) · cmd/cti-mcp/main.go (flags, SQLite, stdio serve) · internal/store (modernc.org/sqlite, no CGO) · 5 provider stub (CISA KEV, GitHub Advisory, GitHub PoC, NVD, OSV) · Source interface, HTTPClient (20s→45s timeout) · MCP Go SDK'ya geçiş planı | ~120k / 18k | FEAT EXTREME |
| 02 | 2026-06-22 18:54 | TUI | DEBUG_01 | Gemini-3.5-flash | NVD/OSV test + debugging 12 NVD + 11 OSV mock test (34/34 PASS) · NVD severity filter kaldırıldı, client-side filter · NVD API key header'a taşındı · HTTP timeout 20s→45s · opencode environment→command array fix · OSV /v1/query ecosystem desteği yok — karar bekleniyor | ~95k / 22k | FIX HIGH |
| 03 | 2026-06-22→23 gece | TUI | XSS_FIX | gemini3.5→M3 | 🔐 XSS keşfi (alert(1)) CVE description raw HTML olarak basılıyordu · html.EscapeString() önce çağrılacak, sonra markdown transform · Test payload: <script>, <img onerror>, <svg onload>, javascript: URL · Double-escape önleme · safeHTML funcMap bypass yerine input-level escape-first | ~60k / 12k | FIX MEDIUM |
| 04 | 2026-06-23 ~22:00 | Telegram | PIPELINE_V9 | MiniMax-m3 | cti-report.py yazımı cti-report.py minimal stdio JSON-RPC client · initialize→notifications/initialized→get_status→refresh_sources→generate_report · select() ile aynı anda stderr drain + stdout read (deadlock önleme) · İlk cron run 22:48, 22:50 · REPORT_DIR/cti-report-YYYY-MM-DD_HHMM.html standardı | ~85k / 18k | FEAT HIGH |
| 05 | 2026-06-24 12:47 | Telegram | MEMORY_AUDIT | GLM-5.2 | Bellek + fact_store audit Fact 137 → 383 (37 ek, 17 silinen) · Lessons: NVD API 2.0 final, XSS pattern, cron constraints, FetchWithContext Colly, debugging methodology · Stale CTI v8→v9 migration · Cron 9 resolved · Behavioral mirror corrections (358+360) silindi · Stale builder profile (fact 34) silindi | ~70k / 16k | CHORE MEDIUM |
| 06 | 2026-06-24 21:52 | Telegram | RELEASE_V9.2.0 | MiniMax-m3 | README v9 + skill v9.2.0 README.md MCP Tools bölümü (8 tool parametre tablosu) · Cron Job Example: hermes cron create --name cti-threat-report --schedule 0 9 * * * --script cti-report.py · AI Agent Workflow doc · go test ./... -count=1 PASS · Skill cti-threat-report@9.2.0 aktif (5 source fresh, deliver telegram) | ~50k / 10k | REL MEDIUM |
| 07 | 2026-06-15 günlük cron | Cron | CRON_FIRST_RUN | deepseek-v4-flash:cloud | İlk daily cron run (deepseek-v4-flash) delegate_task ile NVD fetch (4 URL × 7s delay) → /tmp/nvd_*.json · browser_navigate ile CISA KEV (1.5 MB döndü) · 31 CVE toplam: 1 CRITICAL + 25 HIGH + 5 MEDIUM · P1: 16, P2: 3, P3: 12 · WordPress ekosistem yoğunlaşma (8 SQLi/RCE/path traversal) · Outlier: GL.iNet GL-MT3000, Ruijie EG105G-P · 16 budget'ın 9-10'unu kullandı | ~45k / 9k | CRON MEDIUM |
| 08 | 2026-06-15 günlük cron | Cron | FABRICATE_BUST | nemotron-3-nano:30b-cloud | 🔴 Nano fabricate olayı (nemotron-3-nano) 73 satır / 4 KB HTML üretti (sahte dolu rapor) · Tüm CVE ID'leri uydurmaydı (CVE-2018-25436, CVE-2026-35273) · 'Baggage Freight Shipping Australia' gibi var olmayan plugin isimleri · delegate_task hiç çağrılmamıştı · 9/16 budget self-patching · Policy sıkılaştırma: Kendi Sistemimizde Test SADECE düz metin, shell komutu/kod bloğu YOK | ~50k / 8k | ALERT EXTREME |
| 09 | 2026-06-30 12:01 | Telegram | PUBLIC_RELEASE | MiniMax-m3 | Skill v9.2.0 + repo public niyeti Pipeline onayı: Cron (09:00) → cti-report.py → cti-mcp subprocess (stdio) → refresh_sources() + generate_report(hours=24) → ~/projects/cti-mcp/reports/cti-report-YYYY-MM-DD_HHMM.html · 5 kaynak fresh (CISA KEV + GitHub Advisory + GitHub PoC + NVD + OSV) · Telegram'a teslim · Hero public release adayı (skill v9.2.0 stabil) | ~30k / 6k | REL LOW |
// URL Blacklist Aggregator · v0.3.0 · 12 providers · 1,070,538 entries
NewScorer(nil) call — the configuration file is never injected. Every trust score falls back to 0.5. The scorer runs in isolation, but the scoring system cannot tell providers apart by reliability.
cmd/serve.go: NewScorer(configPath) — scoring.toml hot-reload added. Provider weights now read from the configuration file.
During migrations, DROP TABLE blacklisted_urls was being called without CASCADE. A destructive operation could wipe FK references by accident. Caught in the test environment.
migrations/0001_init.sql: DROP TABLE → DROP TABLE IF EXISTS … CASCADE. Refactored: all migrations now run in a single tx.
The hit query was writing SELECT reason FROM … but the table had no "reason" column (only source, url, process_id). Returned 500. Caught before reaching production.
repository/hits.go: SELECT source, url, process_id, inserted_at FROM blacklisted_urls. Index added on (process_id, inserted_at).
The /check endpoint was looking only at the bloom filter; it never verified the DB hit. On a false positive the caller received a wrong "blocked" verdict. There was no reverse path.
check.go: when bloom.TestString(hash) is true, a DB lookup is now mandatory. Result: {InBloom: true, InDB: bool, Reason: string}.
process.go:269 — strProcessID = meta.ProcessID was overwriting the fresh UUID. Every entry was bound to the wrong processID. RemoveOlderInsertions then wiped them all. The first fix (PR #50) failed to find the rogue uuid.New() generator inside parallel_parser.go → a second patch (PR #53) forced the parser to take the processID from the provider.
process.go:269-274: ignore the cached processID, use a fresh UUID. parallel_logger.go:107-134: added a processID parameter to ParseLinesParallel. 6 callers updated.
AlienVault OTX Fetch() defaulted to ctx.Background(). The User-Agent header was missing. 403 came back. The pagination strategy (page-based, max 56) was unusable because not a single fetch was getting through.
alienvault/provider.go: added a FetchWithContext() override (delegating to Fetch()). Correct UA + rate-limit aware retry. The multi-page fetch chain was restored.
openphish-feed and other providers were returning NULL confidence. The sql.NullString migration was incomplete. SQLite was raising a scan error.
sqlite_blacklist_repository.go: confidence, source → sql.NullString. NullInt64 added too. Insert and select paths updated.
process.go:328-330 was calling RemoveStoredResponse in the development environment → after every run response.dat was being deleted → on restart AlienVault had to refetch 300+ pages. The 2.5s bloom bootstrap was paying the price.
process.go:328-330: added an env == "dev" check. In production, response.dat is preserved. Folded into the async startup plan (PR #59).
Depth weights: Domain 0.3 · Host 0.5 · HostPath 1.0 · File 0.7 · FullURL 1.5 · IP 0.8. Provider trust scores resolved from scoring.toml.
MATH_SIG_VERIFIED| # | Date / Time | Channel | Phase | Model | Operational Tasks | Tokens in/out | Badge |
|---|---|---|---|---|---|---|---|
| 01 | 2026-05-16 22:00 | Telegram | 01 // Human Anchor | deepseek-v4-pro:cloud | MVP validation & v0.1.0-alpha prep 7-layer research methodology extracted. go build PASS + 7/7 unit + 14/14 E2E. 5 MVP phases verified. 4 critical gaps in scoring.toml / drop-table / select / hit-DB found via Copilot PR review. PR #5 (33 commit, 75 file) merged. // Human-led. | ~140k in / 35k out | FEAT HIGH |
| 02 | 2026-05-18 multi | Telegram | 02 // Research Drift | deepseek-v4-flash:cloud | Research: AlienVault + provider pipeline AlienVault OTX indicator mapping (domain/url → bloom; hash → skip; pulse → category). 6-provider capability analysis. Architecture decisions for new provider onboarding. | ~70k in / 18k out | DOCS MEDIUM |
| 03 | 2026-05-22 multi | Telegram | 03 // Provider Takeover | minimax-m2.7:cloud | PR #16 review + provider enrichment PR #16 review: 37 files (+5,220/-18). AbuseIPDB REST API, AlienVault pagination, 4 new providers. SourceType 12→14. Pagination page-based max 56. 10+ providers auto-enabled. // AI takes the initiative at provider level. | ~110k in / 28k out | FEAT HIGH |
| 04 | 2026-05-25 15:51 | Telegram | 04 // Mad-Man Pass | minimax-m2.7:cloud | Mad-man analysis — 20 critical issues 37KB analysis report. 20 critical issues (bloom pool corruption, DB write saturation, SQLite WAL contention, bloom race condition, 7.8% FP rate, missing provider reliability scoring). 14 quality items. 4-week backlog. 14 metrics proposed. | ~85k in / 22k out | ALERT EXTREME |
| 05 | 2026-05-26 02:04 | Telegram | 05 // Bootstrap Verify | glm-5:cloud | E2E bootstrap + port collision Port 8082 collision → kill old process → fresh start. Bootstrap observation: 888K → 1M+ bloom. Provider sync confirmed. ProcessID cache poisoning discovered at process.go:269. | ~75k in / 20k out | FIX HIGH |
| 06 | 2026-05-26 17:56 | Telegram | 06 // Cascade Patch | glm-5:cloud | ProcessID fix + bug cascade process.go:269-274 patch (ignore cached processID, use fresh UUID). parallel_logger.go signature update. 6 callers updated. PR #50 merged. Second bug in parallel_parser.go → PR #53 fix. | ~95k in / 24k out | FIX EXTREME |
| 07 | 2026-05-26 19:37 | Telegram | 07 // Provider Hardening | glm-5:cloud | ThreatFox / AlienVault / AbuseIPDB fix AlienVault FetchWithContext() override (403 fix). NULL scan migration. abuseipdb parseFunc fix. ThreatFox API key logging. 12 providers totalling 1,070,538 entries. PR #54 + PR #55 cherry-pick. | ~85k in / 22k out | FIX HIGH |
| 08 | 2026-05-27 11:57 | Telegram | 08 // Pipeline Audit | glm-5:cloud | Provider pipeline analysis Pond collector + bloom bootstrap analysis. 2.5s duration / 734K entry. AlienVault scheduled TTL bug (every 10min full refetch). /api/v1/bloom/stats endpoint. 4 PRs for provider enable/disable subset. | ~70k in / 18k out | CHORE MEDIUM |
| 09 | 2026-05-28 multi | Telegram | 09 // AI Takeover | deepseek-v4-flash:cloud | CodeGraph MCP + async startup CodeGraph MCP setup (140 files, 2,312 nodes). 10 kanban sub-tasks. PR #57–60. Server startup blocking bug fix (async). Mad-man dispatch → PR #64 (AlienVault nil), PR #66 (IPv6). // AI now makes architecture decisions. | ~110k in / 28k out | FEAT EXTREME |
// INITIALIZING CORE ROUTINES...
package blacklist
import (
"sync"
"context"
"log"
)
// 6-layer parallel check chain: Domain -> Host -> HostPath -> File -> FullURL -> IP. First hit wins.
func (b *Blacklist) Check(url string) bool {
var wg sync.WaitGroup
result := make(chan bool, 6)
ctx, cancel := context.WithCancel(context.Background())
defer cancel()
layers := []func() bool{
func() bool { return b.checkDomain(url) },
func() bool { return b.checkHost(url) },
func() bool { return b.checkHostPath(url) },
func() bool { return b.checkFile(url) },
func() bool { return b.checkFullURL(url) },
func() bool { return b.checkIP(url) },
}
for _, layer := range layers {
wg.Add(1)
go func(check func() bool) {
defer wg.Done()
if check() {
select {
case result <- true:
cancel()
case <-ctx.Done():
}
}
}(layer)
}
go func() {
wg.Wait()
close(result)
}()
for hit := range result {
if hit {
return true
}
}
return false
}
// NODE SYNC STATUS: SECURE