标签：#os

Meta is launching a new Mac app dedicated to its AI chatbot. In an announcement on Wednesday, Meta says you can share your window with its AI chatbot, which can provide suggestions, answer questions, or create content based on what's on your screen. Meta AI on the Mac also supports dictation across all apps. The […]

I Deliberately Destroyed My Kubernetes Cluster at 2 AM. Here's What Died First. Chaos engineering is not about breaking things. It's about discovering that your "production-grade" homelab is held together by hope and a single etcd snapshot before someone else finds out for you. The Setup I was lying in bed at 1:47 AM, staring at the ceiling, unable to sleep. Not because of caffeine. Because of a thought that had been gnawing at me for weeks: If one of my nodes died right now, would my cluster actually survive? I run a 4-node bare-metal Kubernetes cluster on Talos Linux. Dell OptiPlex control plane. Three Raspberry Pi workers. Cilium eBPF. ArgoCD. Longhorn distributed storage. Prometheus. Grafana. The whole cloud-native stack, shoehorned into $220 of scrap hardware and stubbornness. From the outside, it looks solid. ArgoCD syncs green. Cilium status shows healthy. Longhorn volumes are replicated across three nodes. I have etcd snapshots every 6 hours to S3. On paper, I'm resilient. But I had never actually tested it. Not a controlled test. Not a graceful node drain. I mean chaos . Sudden death. The kind of failure that happens at 3 AM when a power supply dies, or a kernel panics, or a neighbor's construction crew hits the wrong breaker. So I got out of bed, walked to my desk, and installed Chaos Mesh. Why Chaos Engineering on a Homelab? Professionally, I design AWS infrastructure with multi-AZ failover, auto-scaling groups, and managed services that abstract failure away. At Siemens, if an EKS node dies, the managed node group replaces it before I finish reading the alert. But my homelab has no managed control plane. No AWS SLA. No auto-repair. If a Pi's USB boot drive corrupts, that node is gone until I physically fix it. I needed to know: What dies first when a worker vanishes? Not "what should die" — what actually dies. Does Longhorn really failover? Three replicas sound great until you realize two of them were on the same node. Does Cilium handle network partitio

The investment comes amid Navi plans to go public.

GrapheneOS 2027 Lands on Flagship Phones: Real‑World Privacy for Premium Android Users Introduction When GrapheneOS announced official support for Motorola, OnePlus and Sony’s top‑tier phones in early 2027, the tech community stopped scrolling. Within days the phrase “GrapheneOS Motorola” spiked 250 % on Google Trends and sparked a firestorm on Hacker News. Why the hype? Because for the first time a hardened, auditable Android fork is available on devices that don’t compromise on performance, camera quality, or design. In this guide you’ll get a hands‑on look at what GrapheneOS 2027 actually does, how to install it, and which commands and configuration tweaks let you turn a flagship phone into a privacy‑first workstation. Quick‑Start Checklist ✅ Item 1 Verify device compatibility (locked bootloader, Snapdragon 8 Gen 3, TEE) 2 Backup current ROM (e.g., adb backup -apk -shared -all -f backup.ab ) 3 Unlock bootloader ( fastboot oem unlock ) – note this wipes data 4 Flash GrapheneOS boot and system images (see “Flashing the ROM”) 5 Enable verified boot ( fastboot flashing lock ) 6 Install the optional Play Store Compatibility Layer (PSCL) if needed Supported Premium Devices (2027) Manufacturer Model Key Security HW Motorola Edge 30 Ultra Snapdragon 8 Gen 3, TEE, Secure Enclave OnePlus 12 Pro Snapdragon 8 Gen 3, TEE, Secure Enclave Sony Xperia 1 V Snapdragon 8 Gen 3, TEE, Secure Enclave Google Pixel 9 (reference) Snapdragon 8 Gen 3, Titan M2 All listed phones meet GrapheneOS’s Hardware Security Module (HSM) requirements: locked bootloader, hardware‑backed keystore, and a modern Trusted Execution Environment. How GrapheneOS Differs from Stock Android Feature Stock Android GrapheneOS 2027 Google Play Services Core system component, heavy telemetry Replaced by a sandboxed Play Store Compatibility Layer (PSCL) Kernel Standard Linux kernel with optional vendor patches Memory‑safe, mitigates Spectre/Meltdown, SELinux Enforcing by default App Sandbox Permissions granted per‑app

Data and finance professionals are competing in Excel obstacle courses—amassing huge followings and keeping the Microsoft program relevant.

Sam Newman discusses the concept of progressive collapse in civil engineering and how it applies to distributed systems. Using real-world examples - from the 1968 Ronan Point tower failure to AWS outages - he shares crucial resilience engineering strategies for software leaders. Learn how to strengthen components, isolate failures, and reduce interconnections to prevent catastrophic cascades. By Sam Newman

With the Azure Kubernetes Services (AKS) platform, containerized workloads can be efficiently managed and scaled. However, the full potential of AKS is only realized when it is seamlessly integrated with other Azure services. This enables a complete cloud-native environment that is scalable, secure, and automatable, while providing maximum flexibility. In this final post of the series, we will show you how AKS can be integrated with other Azure services to create a robust and holistic platform for your applications. Why Integrating AKS into the Azure Cloud Is Crucial AKS provides a highly available and scalable infrastructure for managing containerized applications. However, integrating it with other Azure services like Azure DevOps, Azure Monitor, Azure Active Directory (Entra ID), and Azure Storage extends functionality and optimizes workload management. By leveraging Azure services alongside AKS, companies can: Ensure enhanced security for their containerized applications. Build robust monitoring and logging solutions to monitor the state of applications at all times. Set up automated pipelines for deployment and scaling. Seamlessly exchange data and status information across various Azure services. Key Azure Services to Integrate with Your AKS Platform Azure Active Directory (AAD) for Authentication and Security Azure Active Directory (AAD) provides comprehensive identity and access management that can be directly integrated with AKS. This ensures that only authorized users and services can access your Kubernetes clusters. With Azure RBAC (Role-Based Access Control), you can define granular access permissions for different users and teams, increasing the security of your environment. AAD Pod Managed Identities enable your AKS applications to securely access Azure resources like Azure Key Vault or Azure Storage without the need to manually manage sensitive credentials. Azure DevOps for CI/CD Pipelines Azure DevOps is one of the best solutions for automating CI/CD

Microsoft did the hard work so you don't have to. The Microsoft.FeatureManagement library integrates directly with .NET's configuration and dependency injection systems, which means you can get feature flags working with minimal code and a solid foundation. For the full documentation, check out the Microsoft Feature Management documentation . Let's get this thing running. Installation Add the NuGet package to your project: dotnet add package Microsoft.FeatureManagement.AspNetCore That's it for dependencies. No magic rituals required. Configuration Register the feature management services in Program.cs : builder . Services . AddFeatureManagement (); By default, feature flags are read from the FeatureManagement section of your appsettings.json : { "FeatureManagement" : { "NewDashboard" : true , "ExperimentalSearch" : false } } Flag names are strings. Values are booleans. Simple. Checking a Flag in Code Inject IFeatureManager wherever you need to check a flag: public class DashboardController : Controller { private readonly IFeatureManager _featureManager ; public DashboardController ( IFeatureManager featureManager ) { _featureManager = featureManager ; } public async Task < IActionResult > Index () { if ( await _featureManager . IsEnabledAsync ( "NewDashboard" )) { return View ( "NewDashboard" ); } return View ( "OldDashboard" ); } } That's the whole pattern. Inject. Check. Branch. Repeat. Using Feature Filters Boolean flags are useful, but sometimes you need something a little more sophisticated. The library supports feature filters for things like: Percentage rollouts Time windows User targeting For example, you can enable a feature for a percentage of requests: { "FeatureManagement" : { "BetaFeature" : { "EnabledFor" : [ { "Name" : "Percentage" , "Parameters" : { "Value" : 20 } } ] } } } This enables BetaFeature for 20% of requests. The library handles the sampling. You handle the business logic. Everybody wins. Razor Tag Helpers Building a Razor-based UI? The lib

This is the latest large-scale DDoS attack to hit the social networking site this year.

A week cleaning 290 booking records taught me more about silent failure than any error message ever has Last week I cleaned a deliberately messy dataset; 290 booking records from Safari Connect, Nairobi bus platform, 21 columns, 23 catalogued data problems. Class exercise, but the data was built from real failure modes. The problems I'd been warned about took an afternoon. The ones that cost me were the five that ran perfectly, returned plausible output, and were wrong. Every one of these produced a result. None produced an error. 1. The date heuristic that silently dropped five bookings The dataset had three date formats in one column: 2024-09-15 , 15/09/2024 ,and 09-25-2024 . Two of those are ambiguous - 01-18-2024 is unmistakably MM-DD-YYYY because there's no month 18, but 04-10-2024 could be either. The supplied guide handled it like this: UPDATE bookings_staging SET departure_date = TO_DATE ( departure_date , 'MM-DD-YYYY' ):: TEXT WHERE departure_date LIKE '%-%' AND LENGTH ( departure_date ) = 10 AND SPLIT_PART ( departure_date , '-' , 2 ):: INTEGER > 12 ; Read that last condition. If the second component is too large to be a month,this must be month-first. Reasonable logic - and it only fires when the day happens to be 13 or higher. Five rows had days between 1 and 12. They never converted. Then the next step filtered on ISO format: INSERT INTO bookings SELECT ... FROM bookings_staging WHERE departure_date SIMILAR TO '[0-9]{4}-[0-9]{2}-[0-9]{2}' ; ...and dropped them. No error. No warning. Five completed bookings and KES 3,840 of revenue gone from every downstream total. The guide's expected row count was written as "~280+", which is loose enough to hide it. The fix is to match on shape, not to infer from values: WHERE departure_date ~ '^ \d {2}- \d {2}- \d {4}$' Anchored patterns are mutually exclusive, so you can classify every row before touching any of it: SELECT CASE WHEN departure_date ~ '^ \d {4}- \d {2}- \d {2}$' THEN 'ISO' WHEN departure_date ~ '^ \d

前言 2026年4月2日，微软正式开源发布了 Agent Governance Toolkit （AGT），这是一套专为自主AI智能体打造的开源运行时安全治理框架。MIT许可证，支持Python/TypeScript/Rust/Go/.NET多语言，覆盖全部10项OWASP Agentic Top 10风险，策略执行延迟低于0.1毫秒。 本文将系统性地解答：这个工具包是什么、为什么需要它、怎么使用、以及它能帮助我们实现什么目标。 一、它是什么 1.1 基本定义 Agent Governance Toolkit 是微软开源的AI Agent运行时安全治理框架。它的核心理念是： 将操作系统内核设计的几十年经验，应用于AI智能体的安全治理 。 用微软官方博客的话说： "当你观察AI智能体在生产环境中的实际行为时，你会发现一个熟悉的模式：多个不可信程序共享资源、做决策、与外部世界交互，而它们的行为几乎没有得到任何中介管控。操作系统早在几十年前就解决了这个问题——通过内核、权限等级和进程隔离。服务网格用mTLS和身份认证解决了微服务的同类问题。SRE用SLO和熔断器解决了分布式系统的可靠性问题。我们的问题是：把这些经过实战检验的成熟模式，应用到AI智能体上会怎样？" 1.2 架构全景 AGT经历了v4.0.0版本重构，将早期45个独立包整合为5个顶层分发包： 分发包 包含内容 agent-governance-toolkit-core 策略引擎（Agent OS Kernel）+ 身份管理（AgentMesh Platform） agent-governance-toolkit-runtime 执行环（Execution Rings）+ 沙箱 + 熔断器 + 急停开关 agent-governance-toolkit-sre 健康监控 + SLO执行 + 事件响应 + 混沌工程 agent-governance-toolkit-cli 命令行工具集（agt doctor / agt verify 等） agent-governance-toolkit[full] 完整全家桶安装 早期包名（agent-os-kernel、agentmesh-platform、agentmesh-runtime、agent-sre等）仍可作为存根包安装，会自动重定向到新分发包。 1.3 五大核心组件 Agent OS（策略引擎） AGT的策略引擎是整个系统的核心，被称为AI智能体的"内核"。它以无状态方式运行，使水平扩展和容器化部署自然可行。策略引擎以应用中间件层形式工作（而非OS内核层），策略引擎与智能体共享同一进程边界。生产推荐：在独立容器中运行每个智能体以实现OS级隔离。 支持的策略语言：YAML规则、OPA Rego、Cedar Policy Language。 Agent Mesh（身份与信任层） 密码学身份 ：使用Ed25519生成去中心化标识符（DIDs），为每个智能体建立不可伪造的加密身份 智能体间信任协议（IATP） ：安全的智能体对智能体通信协议 动态信任评分 ：0-1000分五层行为等级。信任是动态的——上周被信任但此后沉默的智能体，会逐渐失去信任，这与"二进制信任/不信任"的传统模型截然不同 Ed25519签名验证 ：对智能体间通信进行密码学验证 Agent Runtime（执行运行时） 执行环（Execution Rings） ：借鉴CPU权限等级设计，将智能体分为4个Ring Ring 信任等级 能力 Ring 0（内核） 评分 ≥ 900 完全系统访问，可修改策略 Ring 1（Supervisor） 评分 ≥ 700 跨智能体协调，提升的工具访问 Ring 2（User） 评分 ≥ 400 标准工具访问，限定的作用域 Ring 3（Untrusted） 评分 < 400 只读，无副作用 Saga编排 ：多步骤事务的原子性保证 急停开关（Kill Switch） ：紧急终止失控智能体，支持多种终止原因（RATE_LIMIT、RING_BREACH、BEHAVIORAL_DRIFT、MANUAL） Agent SRE（可靠性工程） 将SRE的黄金实践应用于智能体系统：SLO与错误预算、熔断器（防止级联故障）、混沌工程测试、渐进式发布。 Agent Compliance（合规自动化） 防篡改Merkle审计日志（每次决策均记录：策略版本、动作、身份、裁决结果） 合规分级与监管框架映射 覆盖标准：OWASP Agentic Top 10、NIST AI RMF 1.0、EU AI Act、SOC 2 Type II、CSA ATF、新加坡MGF agt verify CLI生成机器可读证据文件，可直接接入CI/CD流水线 1.4 M

Ultimate IDOR Testing Checklist Phase 1: Setup & Target Identification [ ] Create Test Accounts: Create two accounts (Attacker and Victim) for safe testing of destructive requests (POST/PUT/DELETE). [ ] API Identification: Find JSON endpoints over rendered HTML. [ ] Sensitivity Analysis: Target critical functions first (password reset, account recovery, financial data, DMs, user management). [ ] ID Audit: Check if endpoint is private or public and contains any kind of ID parameter. [ ] ID Leakage: Check for IDs leaked via other API endpoints or public pages (public profile pages, listings). [ ] Map Clients: Collect web/mobile clients, open APIs from decompiled mobile (jadx/apktool), and swagger/openapi if present. Phase 2: Direct ID Substitution & Enumeration Technique Scenario to Test (Attacker ID=10, Victim ID=9) Basic ID Flip GET /api/v5/users/10 -> GET /api/v5/users/9 Incremental Numeric Brute Force Loop over sequential numeric IDs (decrement/increment from own ID). Non-Numeric ID Substitution Replace param with email / username / UUID. Complex ID Brute Force Brute force short alphanumeric segments (last 1–4 chars). Predictable ID / Combined ID /user/2222/data/3333 — change one or both parts. Hashed/Derived IDs (MD5/SHA1 pattern) Detect hashed IDs, create accounts to infer mapping, try replacing derived hashes. Phase 3: Path and URL Manipulation Bypasses Technique Scenario to Test (Attacker ID=10, Victim ID=9) Trailing Slash GET /api/v5/users/9 -> GET /api/v5/users/9/ Double Slashes / Obfuscated Path GET /api/v5/users//9 or GET /api/v5/users/./9 Case Variation / Key Swapping /api/User?id=123 vs /api/user?id=123 or user_id ↔ userid Path Traversal / Mixed Paths POST /users/delete/my_id/../victim_id Wildcard Substitution GET /api/users/* or GET /api/users/user_id Fuzz Keywords in Path GET /api/v3/users/12345 -> /api/v3/users/all SQLi Quick Check GET /api/v3/users/12345' Phase 4: Logic & Endpoint Bypasses Technique Scenario to Test Version Downgrading GET /v3/user/1

The textbook version of the transactional outbox is tight. You save the domain entity and an outbox row in one local transaction. A background scheduler picks up PENDING rows and publishes them to Kafka. You never publish inside the request thread — no dual-write, no atomicity breach. The pattern closes the consistency gap. Then you load-test it. I ran 1,000 authenticated requests through my event-driven platform in 70 seconds. The gateway returned 201 for every one of them. The outbox absorbed every row. The consumer drained everything. By every visible metric the system looked healthy. Underneath that health, I found three production-grade problems the textbook never mentioned. What a correct implementation looks like Before the problems, the shape of the solution. The outbox publisher runs on a @Scheduled virtual-thread worker: @Scheduled ( fixedDelay = 5000 ) @Transactional public void publishPendingEvents () { List < OutboxEvent > batch = outboxRepository . findTop20ByStatusOrderByCreatedAtAsc ( OutboxStatus . PENDING ); for ( OutboxEvent event : batch ) { event . setStatus ( OutboxStatus . PROCESSING ); outboxRepository . save ( event ); try { kafkaTemplate . send ( event . getTopic (), event . getPayload ()). get (); event . setStatus ( OutboxStatus . PUBLISHED ); } catch ( Exception e ) { event . incrementRetryCount (); if ( event . getRetryCount () >= MAX_RETRIES ) { event . setStatus ( OutboxStatus . FAILED ); } else { event . setStatus ( OutboxStatus . PENDING ); } } outboxRepository . save ( event ); } } This is correct. The PROCESSING state prevents another scheduler instance from claiming the same row. The retry cap prevents infinite cycling. The PENDING fallback on transient errors gives the event another chance. The dual-write problem is genuinely closed. Here is what that correctness does not cover. Gap 1: Your throughput ceiling is a config line fixedDelay = 5000 means the scheduler runs every 5 seconds. findTop20 means it picks up 20 rows per cycl

The change comes a year after YouTube applied the same approach to counting views on Shorts videos.

Sonos released an update to its mobile app that finally introduces support for iOS' Live Activities, giving iPhone users quick access to playback controls on their lockscreen. The added functionality is a "much requested, anticipated, and needed feature," according to a post Sonos shared to Reddit today that was spotted by 9to5Mac. While some features […]

title: Why I left Warehouse out of our Fabric deployment scope published: true tags: microsoftfabric, datawarehouse, cicd, devops Our Fabric deployment pipeline handles sixteen item types. Warehouse is not one of them, and that was deliberate. DEFAULT_ITEM_TYPES = [ " DataPipeline " , " Lakehouse " , " Notebook " , " SemanticModel " , # "Warehouse" is intentionally excluded. Warehouse schema deployment must # be handled separately to avoid schema reset risk during publish. " Environment " , " Eventhouse " , ... ] The reason Publishing a warehouse through this path can reset its schema. Not "might behave unexpectedly". The failure mode is that a deployment intended to be additive removes structure, and the thing that removes it is the same routine that successfully deploys the other sixteen types. The choice that follows Two options once you know that. Include it and hope nobody deploys a warehouse without reading the docs. The pipeline supports everything, and one day someone promotes a change on a Friday and finds out. Or exclude it, document why, and handle warehouse deployment as its own problem with its own tooling. I took the second. An automation that covers most cases and silently corrupts the rest is worse than one that covers most cases and refuses the rest. The refusal is visible. The corruption is not. Making the exclusion loud An exclusion is only useful if someone notices it. Three things help: The comment sits inside the list , not in a doc nobody opens. Anyone reading the item types sees the gap and the reason in the same glance. It is in the README under known limitations, next to the other things the framework does not do. There is a test. It asserts Warehouse is absent from the default scope: def test_warehouse_stays_excluded ( self ): """ Warehouse publish can reset schema, so it is handled separately. """ self . assertNotIn ( " Warehouse " , deploy . DEFAULT_ITEM_TYPES ) That test looks silly. It is asserting that a string is missing from a list.

As a developer who works remotely from an RV, I often find myself juggling multiple projects and tasks at once. One of the biggest challenges I face is keeping track of the numerous tabs I have open on my browser. I recall a particularly frustrating incident where I accidentally closed a tab with crucial information, only to spend hours trying to find it again. This experience led me to create Tab Reminder, a simple yet powerful Chrome extension that allows users to schedule tabs to reopen later. From a technical standpoint, one of the key insights I gained while building Tab Reminder was the importance of leveraging the Chrome extension API to access and manage browser tabs. By using the chrome.tabs API, I was able to create a seamless experience for users to schedule tabs to reopen at a later time. For instance, the chrome.tabs.query method allows me to retrieve a list of all open tabs, which I can then use to populate the scheduling interface. One lesson I learned from building and using Tab Reminder is the value of creating tools that simplify our workflows. By automating the process of reopening tabs, I've been able to free up mental energy and focus on more complex tasks. If you're like me and often find yourself drowning in a sea of open tabs, I recommend checking out Tab Reminder (available at https://go.sg1-labs.us/tab-reminder ) to see how it can help streamline your browsing experience. With Tab Reminder, you can schedule any tab to reopen at a later time, ensuring that you never lose important information again.

Last month I moved my blog off a platform and onto a rented server, and instead of installing WordPress I finished something I had been building for it: Quire Ink , a blog engine that is one process and two SQLite files. No database server, no build pipeline, no cloud account anywhere in the path. bun src/index.ts That line is the whole deployment. Point nginx at the port and you have a blog. The part readers notice Opening a post costs about 114 KB , first visit, nothing cached. Of that, 67 KB is fonts I host myself and the JavaScript is 3.6 to 7.8 KB , written by hand. Third-party requests: zero . No CDN, no font host, no tracker. The numbers hold because the build enforces them. Every bundle has a size cap and the build fails if a feature crosses it, so nothing can quietly start costing every reader a little more forever. And the reading page is where most of the work went: Six palettes in light and dark, and four reading typefaces , all switchable by the reader, not just the owner. Fonts ship with Vietnamese and Central European accents included. Book mode : a fullscreen two-column reader on paper, with a drop cap and a page count. Not a filter over the page, a second typography. A five-ink highlighter . Write ==text== and it renders as an SVG stroke with chisel ends that breaks per line, pigments measured off a photograph of a real pen box. Readers can also keep their own highlights. 1.4 KB, and zero if unused. Math is MathML , drawn by the browser's own layout engine. No script, no stylesheet, no font file, so a post with a formula costs the reader nothing over one without. Code is highlighted on the server , 21 languages, so no highlighter ships to the browser. A fence that names no language gets a timid guess, so program output stays plain. Search answers as you type , a contents rail follows the post, and related posts, reading time and a progress bar are all there. The progress bar and the fade-in are pure CSS. The part I use every day The admin just went

Supabase has become one of the most popular choices for building modern web applications. It gives you: PostgreSQL database Authentication Realtime subscriptions Storage Edge Functions TypeScript support The official Supabase JavaScript client already makes it relatively easy to use these features from a Vue application. But integrating Supabase into a Vue application usually means creating a client and then making it available throughout your application. This is where the new @supabase-community/vue-supabase package comes in. The package provides a Vue-friendly integration for Supabase, allowing you to access your Supabase client through useSupabaseClient() while keeping the familiar Supabase API. You can check out the package on GitHub here: https://github.com/supabase-community/vue-supabase In this article, we'll explore: What @supabase-community/vue-supabase is How to install and configure it How to query your database How to use TypeScript with it How to handle authentication How to use Supabase Realtime How to structure Supabase logic using Vue composables What security considerations you need to remember Let's dive in. 🤔 What Is @supabase-community/vue-supabase ? @supabase-community/vue-supabase is a Vue integration for Supabase that provides a convenient way to access the Supabase client inside your Vue application. The main API you'll use is: import { useSupabaseClient } from ' @supabase-community/vue-supabase ' const supabase = useSupabaseClient () Once you have the client, you can use the standard Supabase API: const { data , error } = await supabase . from ( ' profiles ' ) . select ( ' * ' ) This is important because the package doesn't introduce a completely new way of working with Supabase. You still use the APIs you're familiar with: supabase . from () supabase . auth supabase . channel () supabase . storage The package mainly provides the Vue integration layer around them. 🟢 Installing and Configuring the Package The package can be installed with: n

Every skill my AI setup learns lives in one folder on my laptop — and none of it reaches the repo I created yesterday. That gap is why I built a weekly job that pushes my accumulated skills into every project on the machine. This is what it does, and the four failures I hit getting it to run unattended. Why this mechanism works Claude Code's ~/.claude/skills/auto/ is essentially a personal "habits library." Workarounds, completion criteria, and verification commands discovered mid-task get written out to skill files automatically by the AI, and can be referenced immediately on the next request — that's how the mechanism is designed. Reality is a little different, though. Skills keep piling up in .claude/skills/auto/ . But a project in a freshly created git repo, a side-gig job opened for the first time in weeks, a set of tools written in another language — those don't have the skills at all to begin with . Unless a human copies them by hand, or I type "refer to that skill" every single time, the habits I so carefully accumulated are completely dead in other projects. The structure of the problem looks like this. Skills accumulate in one place, .claude/skills/auto/ (global) They're actually referenced only "when that project has .agents/ or .claude/skills/ " (local) That bridging doesn't happen each time you create a new project (zero start) This isn't "growing your environment," it's "regrowing it every time." Once monthly revenue crosses a certain line, the number of concurrent jobs rises, and there are weeks where I cut two or three new repos. Each time, noticing the missing skills, copying manually, verifying — that work quietly eats time. Not the duration of a single tool call, but the opportunity cost of "if that skill had been here, this would have taken three minutes." The weekly auto-distribution script solves this. Early every Sunday morning, it scans all git repositories and pours the skills in. Without a human doing anything, the project you open on Monda