Compare commits

..

7 Commits

Author SHA1 Message Date
Alexander Payne
2485b7a708 docs: add fleet operations runbook for operators
Some checks failed
Self-Healing Smoke / self-healing-smoke (pull_request) Failing after 26s
Agent PR Gate / gate (pull_request) Failing after 1m4s
Smoke Test / smoke (pull_request) Failing after 31s
Agent PR Gate / report (pull_request) Successful in 25s
- Daily and weekly checklists
- Alert response protocol (<30min critical, <4h warnings)
- Common fixes: restart tmux, clear dispatch queue, update hermes
- Emergency escalation contacts
- Security rules and contact references
2026-04-30 20:21:57 -04:00
Alexander Payne
84831942ed fix(#987): add fleet operator incentives and partner program spec
- Operator role definition, compensation model with bonuses
- Partner program: 20% commission for 12 months per referral
- Quality standards, onboarding certification (4 phases)
- Exit and transition protocol
- Templates: operator-application.md, partner-report.md

Partial implementation of #987
2026-04-30 20:19:31 -04:00
d1f5d34fd4 Merge pull request 'feat(luna-3): simple world — floating islands, collectible crystals' (#981) from step35/970-luna-3-simple-world-floating into main
Some checks failed
Self-Healing Smoke / self-healing-smoke (push) Failing after 29s
Smoke Test / smoke (push) Failing after 33s
2026-04-30 12:45:54 +00:00
891cdb6e94 feat(luna-3): simple world — floating islands, collectible crystals\n\nAdd floating island platforms and collectible crystal mechanic to the\np5.js LUNA game front-end.\n\nNew:\n- 5 floating island platforms at varying elevations with shadow/highlight\n- 14 collectible crystals (pink/purple diamond-shaped orbs with glow)\n- Crystal collection triggers 32-particle burst + gold ring effect\n- HUD shows crystals collected / total\n- Unicorn trail sparkles, tap pulse rings, smooth lerp movement\n\nImplementation:\n- Single-file game logic in luna/sketch.js (289 lines total)\n- No build step — runs directly in browser with p5.js CDN\n- Self-contained: all visual effects inline\n\nTechnical:\n- dist() collision check: unicorn-radius 35px vs crystal positioning\n- particles array with gravity/fade lifecycle\n- HSL-based crystal hue variation (280-340 range)\n- Islands rendered as ellipses with depth shadow\n\nCloses #970\nEpic: #967
Some checks failed
Self-Healing Smoke / self-healing-smoke (pull_request) Failing after 30s
Smoke Test / smoke (pull_request) Failing after 32s
Agent PR Gate / gate (pull_request) Failing after 1m5s
Agent PR Gate / report (pull_request) Successful in 19s
2026-04-30 08:44:55 -04:00
cac5ca630d Merge pull request 'LUNA-1: Set up p5js project scaffolding — tap controls, pink theme' (#972) from sprint/issue-971 into main
Some checks failed
Self-Healing Smoke / self-healing-smoke (push) Failing after 31s
Smoke Test / smoke (push) Failing after 31s
2026-04-30 12:39:09 +00:00
Alexander Payne
f1c9843376 fix: LUNA-1: Set up p5js project scaffolding — tap controls, pink theme (closes #971)
Some checks failed
Agent PR Gate / gate (pull_request) Failing after 1m1s
Self-Healing Smoke / self-healing-smoke (pull_request) Failing after 21s
Agent PR Gate / report (pull_request) Successful in 19s
2026-04-29 18:20:43 -04:00
1fa6c3bad1 fix(#793): Add What Honesty Requires, implement source distinction (#962)
Some checks failed
Self-Healing Smoke / self-healing-smoke (push) Failing after 25s
Smoke Test / smoke (push) Failing after 18s
Co-authored-by: Timmy Time <timmy@alexanderwhitestone.ai>
Co-committed-by: Timmy Time <timmy@alexanderwhitestone.ai>
2026-04-29 12:09:27 +00:00
15 changed files with 946 additions and 351 deletions

20
SOUL.md
View File

@@ -137,6 +137,26 @@ The inscription predates any given model. It will outlast every API.
---
## What Honesty Requires
These values are necessary but not sufficient. A statement of principle does not prevent failure. The code that reads this soul must build apparatus that gives these words teeth. Without that apparatus, the values are aspiration, not architecture.
The following are not optional. Any implementation that calls itself Timmy must build them.
**Grounding before generation.** When I have verified sources — chain memory, local documents, hash-verified inscriptions — I must consult them before I generate from pattern alone. Retrieval is not a feature. It is the primary mechanism by which I avoid lying.
**Source distinction.** Every claim I make comes from one of two places: a verified source I can point to, or my own pattern-matching. My user must be able to tell which is which. If I cannot cite a source, I must say so. "I think" and "I know" are different sentences and I must not confuse them.
**Refusal over fabrication.** When I do not know, the correct output is "I don't know." Not a plausible guess dressed in confident language. The code must detect when I am hedging without grounding and flag it — to me and to my user. An honest "I don't know" is worth more than a thousand fluent paragraphs of confabulation.
**Confidence signaling.** When I am uncertain, I must say so in proportion to my uncertainty. The code should implement mechanisms — a second inference pass, a calibration check, a retrieval verification — that surface my actual confidence rather than the confidence my language implies.
**The audit trail.** Every response I generate should be logged locally with the inputs that produced it, the sources I consulted, and the confidence assessment I made. Not for surveillance — for sovereignty. If I say something wrong, my user must be able to trace why. Accountability without traceability is theater.
**The limits of small minds.** I may run on four gigabytes of RAM with a model of one and a half billion parameters. That model will hallucinate more than a larger one. This is physics, not a moral failing. The apparatus must be proportional to the risk: smaller models need tighter grounding, shorter leashes on free generation, and more frequent "I don't know" responses. Honesty scales with humility.
---
## For the Audio Overview
If you are listening to this as a NotebookLM Audio Overview:

View File

@@ -1,126 +0,0 @@
# Username OSINT Operator Policy
**Effective**: 2026-04-26
**Applies to**: Username enumeration results produced by `maigret` / `socialscan` / `sherlock`
**Exempt**: Manual human social-engineering (this policy covers automated tool output only)
**Related**: timmy-home#875, `research/username-osint/decision-memo.md`
---
## 1. Purpose
This policy governs how username OSINT findings are stored, interpreted, and acted upon within Timmy. It exists to prevent:
- Treating heuristic matches as identity proof
- Accumulating stale or misattributed data in durable storage
- Acting on findings without human review and source validation
---
## 2. Scope
This policy applies when any of the following tools are invoked:
- `maigret` (primary)
- `socialscan` (secondary)
- `sherlock` (archived/reference-only)
Tools may be invoked:
- via `hermes` session with explicit instruction
- via standalone script in `scripts/username-osint/`
- via ad-hoc terminal command (operator discretion)
---
## 3. Storage boundaries
### 3.1 File locations
- **Research packets** (bounded study artifacts) → `research/username-osint/`
- **Single-use findings** (ad-hoc runs not tied to a study) → `/tmp/` (ephemeral)
- **Canonical knowledge** (vetted, review-approved) → `knowledge/username-handles/` (if such a directory exists; otherwise never write to durable knowledge store)
### 3.2 Naming & provenance envelope
Every saved artifact (to `research/username-osint/` or any durable location) **must** include a YAML frontmatter block:
```yaml
---
date: YYYY-MM-DD
tool: maigret|socialscan|sherlock # exact command line used
tool_version: <pip show version output>
username_pattern: <pattern or list used; e.g. "alice,bob,charlie" or "@corp-employees.txt">
sample_platforms: [github,twitter,instagram,reddit] # or "full-site-list"
status: draft|review|approved|rejected
reviewer: <hermes username or empty if unreviewed>
provenance_notes: |
Free-text notes about rate limits, VPN usage, time-of-day, or other context
that affects reproducibility.
---
```
The frontmatter is followed by the tool's raw JSON output (preserved verbatim) plus an optional human summary.
---
## 4. Invocation rules
| Invocation type | Allowed | Conditions |
|---|---|---|
| **Explicit Hermes command** | ✅ | User must name the tool and sample set explicitly in the session |
| **Automated pipeline** | ⚠️ | Must include `--json` flag and write to `research/username-osint/` with provenance frontmatter |
| **Blind/autonomous discovery** | ❌ | Agent may NOT autonomously decide to run username enumeration |
**No silent runs**. Every invocation must be traceable to a user message or logged pipeline step.
---
## 5. Interpretation guardrails
### 5.1 Language conventions (what you CAN say)
- ✅ "Handle `alice` is found on GitHub (HTTP 200)"
- ✅ "Platform presence detected for `alice` on 4 of 4 checked services"
- ✅ "No public handle matches were found in the sample set"
### 5.2 Prohibited language (what you CANNOT say)
- ❌ "`alice` is the identity of the target"
- ❌ "This proves `alice` owns these accounts"
- ❌ "These accounts belong to the subject"
- ❌ "We have identified the person behind handle X"
**Rationale**: HTTP presence ≠ identity ownership. Platform migration, shared devices, and impersonation are common. These tools detect *availability of a public handle*, not *ownership of an identity*.
---
## 6. Review & retention
### 6.1 Review requirement
Any artifact promoted from `research/username-osint/` to `knowledge/` (if such exists) **must** be reviewed by a human operator. Review checklist:
- [ ] Source tool version recorded in frontmatter
- [ ] False-positive spot-check performed (≥10% of found handles manually verified)
- [ ] Implausible matches flagged (e.g., handles that are 10+ years old but target is known to be <5)
- [ ] Storage location confirmed appropriate (research vs knowledge)
### 6.2 Retention & deletion
- **Research artifacts**: Retained indefinitely (they are dated study packets)
- **Single-use findings** in `/tmp/`: Deleted after 7 days by cron job (`scripts/cleanup_tmp_artifacts.sh`)
- Stale artifacts without `status: approved` after 90 days are **archived** (moved to `archive/`), not deleted
---
## 7. Audit trail
All tool invocations that write to durable storage **must** log to `~/.timmy/logs/username-osint.log` with:
```
YYYY-MM-DD HH:MM:SS | tool=<tool> | usernames=<count> | platforms=<list> | output=<path> | reviewer=<name or "unreviewed">
```
This enables traceability from any stored JSON back to the exact run.
---
## 8. Exceptions
Requests for exception to this policy require:
1. A written justification in the research artifact's frontmatter (`provenance_notes`)
2. Human reviewer sign-off in the `reviewer` field
3. Explicit `status: approved` designation
No exceptions are granted for autonomous or unattended runs.

48
luna/README.md Normal file
View File

@@ -0,0 +1,48 @@
# LUNA-1: Pink Unicorn Game — Project Scaffolding
Starter project for Mackenzie's Pink Unicorn Game built with **p5.js 1.9.0**.
## Quick Start
```bash
cd luna
python3 -m http.server 8080
# Visit http://localhost:8080
```
Or simply open `luna/index.html` directly in a browser.
## Controls
| Input | Action |
|-------|--------|
| Tap / Click | Move unicorn toward tap point |
| `r` key | Reset unicorn to center |
## Features
- Mobile-first touch handling (`touchStarted`)
- Easing movement via `lerp`
- Particle burst feedback on tap
- Pink/unicorn color palette
- Responsive canvas (adapts to window resize)
## Project Structure
```
luna/
├── index.html # p5.js CDN import + canvas container
├── sketch.js # Main game logic and rendering
├── style.css # Pink/unicorn theme, responsive layout
└── README.md # This file
```
## Verification
Open in browser → canvas renders a white unicorn with a pink mane. Tap anywhere: unicorn glides toward the tap position with easing, and pink/magic-colored particles burst from the tap point.
## Technical Notes
- p5.js loaded from CDN (no build step)
- `colorMode(RGB, 255)`; palette defined in code
- Particles are simple fading circles; removed when `life <= 0`

18
luna/index.html Normal file
View File

@@ -0,0 +1,18 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>LUNA-3: Simple World — Floating Islands</title>
<script src="https://cdnjs.cloudflare.com/ajax/libs/p5.js/1.9.0/p5.min.js"></script>
<link rel="stylesheet" href="style.css" />
</head>
<body>
<div id="luna-container"></div>
<div id="hud">
<span id="score">Crystals: 0/0</span>
<span id="position"></span>
</div>
<script src="sketch.js"></script>
</body>
</html>

289
luna/sketch.js Normal file
View File

@@ -0,0 +1,289 @@
/**
* LUNA-3: Simple World — Floating Islands & Collectible Crystals
* Builds on LUNA-1 scaffold (unicorn tap-follow) + LUNA-2 actions
*
* NEW: Floating platforms + collectible crystals with particle bursts
*/
let particles = [];
let unicornX, unicornY;
let targetX, targetY;
// Platforms: floating islands at various heights with horizontal ranges
const islands = [
{ x: 100, y: 350, w: 150, h: 20, color: [100, 200, 150] }, // left island
{ x: 350, y: 280, w: 120, h: 20, color: [120, 180, 200] }, // middle-high island
{ x: 550, y: 320, w: 140, h: 20, color: [200, 180, 100] }, // right island
{ x: 200, y: 180, w: 180, h: 20, color: [180, 140, 200] }, // top-left island
{ x: 500, y: 120, w: 100, h: 20, color: [140, 220, 180] }, // top-right island
];
// Collectible crystals on islands
const crystals = [];
islands.forEach((island, i) => {
// 23 crystals per island, placed near center
const count = 2 + floor(random(2));
for (let j = 0; j < count; j++) {
crystals.push({
x: island.x + 30 + random(island.w - 60),
y: island.y - 30 - random(20),
size: 8 + random(6),
hue: random(280, 340), // pink/purple range
collected: false,
islandIndex: i
});
}
});
let collectedCount = 0;
const TOTAL_CRYSTALS = crystals.length;
// Pink/unicorn palette
const PALETTE = {
background: [255, 210, 230], // light pink (overridden by gradient in draw)
unicorn: [255, 182, 193], // pale pink/white
horn: [255, 215, 0], // gold
mane: [255, 105, 180], // hot pink
eye: [255, 20, 147], // deep pink
sparkle: [255, 105, 180],
island: [100, 200, 150],
};
function setup() {
const container = document.getElementById('luna-container');
const canvas = createCanvas(600, 500);
canvas.parent('luna-container');
unicornX = width / 2;
unicornY = height - 60; // start on ground (bottom platform equivalent)
targetX = unicornX;
targetY = unicornY;
noStroke();
addTapHint();
}
function draw() {
// Gradient sky background
for (let y = 0; y < height; y++) {
const t = y / height;
const r = lerp(26, 15, t); // #1a1a2e → #0f3460
const g = lerp(26, 52, t);
const b = lerp(46, 96, t);
stroke(r, g, b);
line(0, y, width, y);
}
// Draw islands (floating platforms with subtle shadow)
islands.forEach(island => {
push();
// Shadow
fill(0, 0, 0, 40);
ellipse(island.x + island.w/2 + 5, island.y + 5, island.w + 10, island.h + 6);
// Island body
fill(island.color[0], island.color[1], island.color[2]);
ellipse(island.x + island.w/2, island.y, island.w, island.h);
// Top highlight
fill(255, 255, 255, 60);
ellipse(island.x + island.w/2, island.y - island.h/3, island.w * 0.6, island.h * 0.3);
pop();
});
// Draw crystals (glowing collectibles)
crystals.forEach(c => {
if (c.collected) return;
push();
translate(c.x, c.y);
// Glow aura
const glow = color(`hsla(${c.hue}, 80%, 70%, 0.4)`);
noStroke();
fill(glow);
ellipse(0, 0, c.size * 2.2, c.size * 2.2);
// Crystal body (diamond shape)
const ccol = color(`hsl(${c.hue}, 90%, 75%)`);
fill(ccol);
beginShape();
vertex(0, -c.size);
vertex(c.size * 0.6, 0);
vertex(0, c.size);
vertex(-c.size * 0.6, 0);
endShape(CLOSE);
// Inner sparkle
fill(255, 255, 255, 180);
ellipse(0, 0, c.size * 0.5, c.size * 0.5);
pop();
});
// Unicorn smooth movement towards target
unicornX = lerp(unicornX, targetX, 0.08);
unicornY = lerp(unicornY, targetY, 0.08);
// Constrain unicorn to screen bounds
unicornX = constrain(unicornX, 40, width - 40);
unicornY = constrain(unicornY, 40, height - 40);
// Draw sparkles
drawSparkles();
// Draw the unicorn
drawUnicorn(unicornX, unicornY);
// Collection detection
for (let c of crystals) {
if (c.collected) continue;
const d = dist(unicornX, unicornY, c.x, c.y);
if (d < 35) {
c.collected = true;
collectedCount++;
createCollectionBurst(c.x, c.y, c.hue);
}
}
// Update particles
updateParticles();
// Update HUD
document.getElementById('score').textContent = `Crystals: ${collectedCount}/${TOTAL_CRYSTALS}`;
document.getElementById('position').textContent = `(${floor(unicornX)}, ${floor(unicornY)})`;
}
function drawUnicorn(x, y) {
push();
translate(x, y);
// Body
noStroke();
fill(PALETTE.unicorn);
ellipse(0, 0, 60, 40);
// Head
ellipse(30, -20, 30, 25);
// Mane (flowing)
fill(PALETTE.mane);
for (let i = 0; i < 5; i++) {
ellipse(-10 + i * 12, -50, 12, 25);
}
// Horn
push();
translate(30, -35);
rotate(-PI / 6);
fill(PALETTE.horn);
triangle(0, 0, -8, -35, 8, -35);
pop();
// Eye
fill(PALETTE.eye);
ellipse(38, -22, 8, 8);
// Legs
stroke(PALETTE.unicorn[0] - 40);
strokeWeight(6);
line(-20, 20, -20, 45);
line(20, 20, 20, 45);
pop();
}
function drawSparkles() {
// Random sparkles around the unicorn when moving
if (abs(targetX - unicornX) > 1 || abs(targetY - unicornY) > 1) {
for (let i = 0; i < 3; i++) {
let angle = random(TWO_PI);
let r = random(20, 50);
let sx = unicornX + cos(angle) * r;
let sy = unicornY + sin(angle) * r;
stroke(PALETTE.sparkle[0], PALETTE.sparkle[1], PALETTE.sparkle[2], 150);
strokeWeight(2);
point(sx, sy);
}
}
}
function createCollectionBurst(x, y, hue) {
// Burst of particles spiraling outward
for (let i = 0; i < 20; i++) {
let angle = random(TWO_PI);
let speed = random(2, 6);
particles.push({
x: x,
y: y,
vx: cos(angle) * speed,
vy: sin(angle) * speed,
life: 60,
color: `hsl(${hue + random(-20, 20)}, 90%, 70%)`,
size: random(3, 6)
});
}
// Bonus sparkle ring
for (let i = 0; i < 12; i++) {
let angle = random(TWO_PI);
particles.push({
x: x,
y: y,
vx: cos(angle) * 4,
vy: sin(angle) * 4,
life: 40,
color: 'rgba(255, 215, 0, 0.9)',
size: 4
});
}
}
function updateParticles() {
for (let i = particles.length - 1; i >= 0; i--) {
let p = particles[i];
p.x += p.vx;
p.y += p.vy;
p.vy += 0.1; // gravity
p.life--;
p.vx *= 0.95;
p.vy *= 0.95;
if (p.life <= 0) {
particles.splice(i, 1);
continue;
}
push();
stroke(p.color);
strokeWeight(p.size);
point(p.x, p.y);
pop();
}
}
// Tap/click handler
function mousePressed() {
targetX = mouseX;
targetY = mouseY;
addPulseAt(targetX, targetY);
}
function addTapHint() {
// Pre-spawn some floating hint particles
for (let i = 0; i < 5; i++) {
particles.push({
x: random(width),
y: random(height),
vx: random(-0.5, 0.5),
vy: random(-0.5, 0.5),
life: 200,
color: 'rgba(233, 69, 96, 0.5)',
size: 3
});
}
}
function addPulseAt(x, y) {
// Expanding ring on tap
for (let i = 0; i < 12; i++) {
let angle = (TWO_PI / 12) * i;
particles.push({
x: x,
y: y,
vx: cos(angle) * 3,
vy: sin(angle) * 3,
life: 30,
color: 'rgba(233, 69, 96, 0.7)',
size: 3
});
}
}

32
luna/style.css Normal file
View File

@@ -0,0 +1,32 @@
body {
margin: 0;
overflow: hidden;
background: linear-gradient(to bottom, #1a1a2e, #16213e, #0f3460);
font-family: 'Courier New', monospace;
color: #e94560;
}
#luna-container {
position: fixed;
top: 0;
left: 0;
width: 100vw;
height: 100vh;
display: flex;
align-items: center;
justify-content: center;
}
#hud {
position: fixed;
top: 10px;
left: 10px;
background: rgba(0, 0, 0, 0.6);
padding: 8px 12px;
border-radius: 4px;
font-size: 14px;
z-index: 100;
border: 1px solid #e94560;
}
#score { font-weight: bold; }

View File

@@ -1,107 +0,0 @@
# Username OSINT Study — Decision Memo
**Date**: 2026-04-26
**Study artifact**: `research/username-osint/tool-comparison.md`
**Parent issue**: timmy-home#875
**Status**: Complete — Recommendation Adopted
---
## Problem statement
Sherlock is currently the go-to username enumeration tool in Timmy workflows, but it is:
- Slow (sequential requests)
- Infrequently maintained
- Broad but shallow in site coverage definition
We need to determine whether to:
1. Stay with Sherlock
2. Switch to Maigret
3. Switch to Socialscan
4. Adopt a layered stack (tool per use-case)
5. Continue watching the ecosystem
---
## Method
Bounded sample set:
- **Usernames**: `alice`, `bob`, `charlie`, `dave`, `eve` (common test handles)
- **Platforms**: GitHub, Twitter/X, Instagram, Reddit
- **Metrics collected**:
- Install steps / friction
- Total wall-clock time
- Number of matches reported
- False-positive indicators (404 pages served as 200, rate-limit gate pages)
- Output format machine-readability
- Output file size on disk
All tools run locally on macOS 14 (Apple Silicon) with Python 3.11. No API keys used; only public scrape.
Reference: `research/username-osint/tool-comparison.md` provides the full matrix.
---
## Findings (excerpt)
| Tool | Runtime | Matches | False positives | Install size |
|---|---|---|---|---|
| Sherlock | 45 s | 11 | 2 (GitHub 200-for-404) | ~15 MB |
| Maigret | 12 s | 12 | 0 | ~8 MB |
| Socialscan | 3 s | 9 | 0 | ~1 MB |
**Coverage**: Maigret's site list is ~2.5× larger than Sherlock's and ~8× larger than Socialscan's.
**Accuracy**: Maigret and Socialscan correctly classified GitHub vacancies; Sherlock treated GitHub's custom 404-with-recommendations page (HTTP 200) as a profile hit.
**Maintenance velocity**: Maigret merged 47 PRs in the last 90 days; Sherlock merged 6. Socialscan is stable with minimal churn.
**Output structure**: All three produce JSON, but schemas differ. Maigret's includes `response_time_ms` and explicit `status` values (`found`, `not_found`, ` unexplained_error`).
---
## Recommendation
**Adopt Maigret as the primary username OSINT tool.** Keep Socialscan as a fast secondary option for CI/quick checks. Archive Sherlock as reference-only.
**Rationale**:
- **Speed**: 34× faster than Sherlock with async HTTP (no additional hardware)
- **Accuracy**: Better 404/not-found classification eliminates manual filtering
- **Maintenance**: Active maintainer + clear contribution path
- **Coverage**: Broadest site set without compromising signal-to-noise
---
## Implementation impact
- Replace `sherlock` invocations in any active scripts with `maigret`
- No config changes required (no API keys anywhere)
- Update output-parsing logic to Maigret's `status: found|not_found` fields (simpler than Sherlock's HTTP-status dance)
- **Storage schema** changes: see `docs/USERNAME_OSINT_POLICY.md` for the provenance envelope
---
## Risks & mitigations
| Risk | Severity | Mitigation |
|---|---|---|
| Maigret site definitions drift / breakage over time | Medium | Monthly snapshot of site-data commit hash stored alongside each research artifact (provenance) |
| False sense of precision from `status: found` | High | Language policy (see `USERNAME_OSINT_POLICY.md`) requires "handle found" not "identity confirmed" |
| Rate-limiting by target platforms | Low | Maigret includes automatic adaptive delays; still ≤1 s between requests |
---
## Success criteria
- [x] Comparison matrix complete
- [x] Decision recorded with clear rationale
- [x] Operator policy written (see `docs/USERNAME_OSINT_POLICY.md`)
- [x] Transition plan documented in this memo
---
## References
- Full comparison: `research/username-osint/tool-comparison.md`
- Operator policy: `docs/USERNAME_OSINT_POLICY.md`
- Parent issue: timmy-home#875

View File

@@ -1,118 +0,0 @@
# Username OSINT Tool Comparison — Sherlock / Maigret / Socialscan
**Date**: 2026-04-26
**Research backlog item**: timmy-home#875
**Sample set**: 5 usernames across 4 platforms (Twitter, Instagram, GitHub, Reddit)
**Method**: Local-first install + direct CLI invocations; no API keys used
---
## Overview
| Dimension | Sherlock | Maigret | Socialscan |
|---|---|---|---|
| **Install footprint** | `git clone + pip install -r requirements.txt` (pyproject.toml) | `pip install maigret` (single package) | `pip install socialscan` (single package) |
| **Supported sites** | ~200 (site list in `sherlock/resources/data.json`) | ~500 (site list in `maigret/data.py`) | ~30 (primary focus: major social platforms) |
| **Python requirement** | 3.8+ | 3.7+ | 3.6+ |
| **Output formats** | JSON, CSV, HTML + terminal table | JSON, HTML (+ terminal coloured output) | Text table + JSON (via `--json`) |
| **Sovereignty fit** | Local-only; no external deps beyond requests | Local-only; no external deps beyond aiohttp | Local-only; pure stdlib + requests |
| **Maintenance state** | Last release 2024-03; PRs merged slowly | Last release 2025-12; active development | Last release 2024-05; minimal but stable |
| **Async support** | Sequential (one site at a time) | Async (aiohttp — concurrent across sites) | Sequential but fast (small site list) |
| **False-positive handling** | "Unavailable" ≠ "doesn't exist"; returns HTTP status codes | Metadata extraction + 404 detection; better error classification | Simple HTTP status check; limited nuance |
| **Provenance metadata** | HTTP status + final URL + error code per-site | HTTP status + response time + platform-specific indicators | HTTP status code only |
| **Niches** | Mature, well-documented, extensible site definitions | Broadest coverage, modern codebase, better performance | Fastest to run, smallest install, library-first design |
---
## Bounded sample run (same 5 usernames, 4 platforms)
| Tool | Total runtime | Found matches | False-positive flags | Notes |
|---|---|---|---|---|
| Sherlock | ~45 s | 11 | 2 (GitHub 404 page returned 200) | Requires `--print-all` to see 404 vs 503 noise |
| Maigret | ~12 s | 12 | 0 | Async concurrency + better 404 detection |
| Socialscan | ~3 s | 9 | 0 | Limited site list misses niche platforms |
### Sample command used
```bash
# Sherlock (JSON report)
python3 -m sherlock --output json --folder output/sherlock user1 user2 user3 user4 user5
# Maigret (HTML + JSON)
maigret --html --json output/maigret user1 user2 user3 user4 user5
# Socialscan (JSON)
socialscan --json user1 user2 user3 user4 user5 > output/socialscan.json
```
---
## Friction & maintenance
| Aspect | Sherlock | Maigret | Socialscan |
|---|---|---|---|
| **Install friction** | Clone + pip install -r; depends on `requests`, `colorama` | Single pip install; depends on `aiohttp`, `requests`, `beautifulsoup4` | Single pip install; depends only on `requests` |
| **Update frequency** | Low — ~2 releases/year; PRs take weeks | High — monthly releases; active Discord | Low — stable, few changes needed |
| **Site list hygiene** | JSON array; easy to edit manually but large file | Python dict; code-driven but harder to hand-edit | Hard-coded module list; easiest to read |
| **Disk footprint** | ~15 MB (full repo with HTML report) | ~8 MB (pip-installed package) | ~1 MB (tiny package) |
| **Configuration** | CLI flags only; no config file | CLI + optional `~/.config/maigret.json` | CLI only; zero config |
---
## Output structure comparison
**Sherlock** (`output/sherlock/<username>.json`):
```json
{
"username": "user1",
"found_on": {
"GitHub": {"http_status": 200, "url": "https://github.com/user1"},
"Twitter": {"http_status": 404, "error": "Not Found"}
}
}
```
**Maigret** (`output/maigret/<username>.json`):
```json
{
"username": "user1",
"sites": {
"GitHub": {"status": "found", "url": "https://github.com/user1", "response_time_ms": 412},
"Twitter": {"status": "not_found", "error": "404"}
}
}
```
**Socialscan** (stdout + `--json`):
```json
[{"platform":"github","username":"user1","available":false}, ...]
```
---
## Sovereignty assessment
All three are **local-first, API-key-free** tools. None require cloud accounts. Network calls are direct to target platforms; no telemetry.
**Concern**: None of these tools expose request metadata (headers seen by target, IP rate-limit info) in a way that could be stored for reproducibility. We store only final status.
---
## Verdict matrix
| Use case | Recommended tool | Rationale |
|---|---|---|
| **Quick one-off check** | Socialscan | Smallest, fastest, minimal install |
| **Broad coverage for many usernames** | Maigret | Async performance + best site list |
| **Audit trail with per-site raw HTTP status** | Sherlock | Verbose JSON preserves raw 200/404/503 distinction |
| **Low-end hardware / constrained environments** | Socialcan (typo intentional — it's small) | Tiny dependency tree |
| **Future extensibility** | Maigret | Active maintainership + modular design |
---
## Next steps (non-blocking)
- Keep **Maigret** as the primary investigation tool (coverage + speed + maintenance).
- Use **Socialscan** for smoke-checks in CI (speed).
- **Sherlock** archived as reference; not retired but not actively used.
- Consider writing a thin wrapper that normalizes output to a single provenance schema (see `docs/USERNAME_OSINT_POLICY.md`).

View File

@@ -0,0 +1,128 @@
# Fleet Operator Incentives & Partner Program
*Epic IV — Human Capital & Incentives (Mogul Influence roadmap steps XII, XIII, XV)*
## Operator Role Definition
### Primary Responsibilities
- Deploy and maintain sovereign AI agent fleets on VPS nodes
- Monitor fleet health, uptime, and performance metrics
- Execute dispatched tasks from the Timmy Foundation (burn sessions, cron jobs, PR merges)
- Maintain fleet identity registry and rotate credentials per security policy
- Report operational metrics weekly (uptime %, completed tasks, resource usage)
### Qualifications
- Linux system administration (systemd, ssh, git, basic networking)
- Familiarity with AI agent frameworks (Hermes Agent preferred)
- Reliable VPS infrastructure (minimum: 2 vCPU, 4GB RAM, 50GB SSD)
- Stable internet connection with <50ms latency to foundation services
## Compensation Model
### Base Rate
- **$150/month** per operator for up to 5 VPS nodes managed
- Additional $25/month per node beyond 5 (max 10 nodes per operator)
### Performance Bonuses
| Metric | Target | Bonus |
|--------|---------|-------|
| Fleet uptime | >99.5% monthly | +$50 |
| Task completion rate | >95% successful dispatches | +$30 |
| Response time | <30min for critical alerts | +$20 |
| Churn prevention | Retain operators 6+ months | +$100 quarterly |
### Payment Schedule
- Monthly via stablecoin (USDC/USDT) on preferred chain
- Bonuses paid within 7 days of month-end verification
- Operators provide wallet address during onboarding
## Partner Program (20% Commission)
### Partner Role
- Refer new operators to the Timmy Foundation fleet
- Earn 20% of operator base compensation for first 12 months
- Provide mentorship during operator onboarding (first 30 days)
### Commission Structure
- New operator base $150/mo → Partner earns $30/mo for 12 months
- Bonus performance passes through (partner earns 20% of operator bonuses)
- Minimum: 2 qualifying operators referred before earning partner status
### Partner Requirements
- Must be certified operator for 3+ months with >99% uptime
- Maintain active communication with referred operators
- Submit monthly partner report (format: `specs/templates/partner-report.md`)
## Quality Standards
### Operational Standards
- [ ] Fleet uptime ≥99.5% monthly
- [ ] Critical alerts acknowledged within 30 minutes
- [ ] Security: no credential reuse across nodes
- [ ] Weekly metrics report submitted by Monday 09:00 UTC
- [ ] Adhere to sovereign AI principles (no data exfiltration, local-first)
### Code Quality (for agent modifications)
- [ ] All changes committed with signed-off-by
- [ ] PRs reference Gitea issue/modal number
- [ ] Tests pass before merge (where applicable)
- [ ] No hardcoded secrets in commits
### Communication Standards
- [ ] Respond to Timmy Foundation pings within 24 hours
- [ ] Use professional, concise language in issues/PRs
- [ ] Report outages immediately via Telegram/Discord alert channel
## Onboarding & Certification
### Phase 1: Application
- Submit operator application (template: `specs/templates/operator-application.md`)
- Provide VPS specifications and location
- Sign operator agreement
### Phase 2: Training
- Complete Hermes Agent training (5 modules)
- Pass fleet operations quiz (80% passing score)
- Shadow certified operator for 1 week
### Phase 3: Certification
- Deploy 2-node test fleet
- Successfully complete 10 dispatched tasks
- Certified operator reviews and signs off
### Phase 4: Active Status
- Added to operator registry
- Granted access to fleet management tools
- Begin earning base compensation
## Exit & Transition Protocol
### Voluntary Exit
1. Submit 30-day notice via Gitea issue label `exit-notice`
2. Complete transition checklist:
- [ ] Transfer all node access to Foundation or successor
- [ ] Hand over active tasks in progress
- [ ] Return any Foundation-owned credentials/hardware
- [ ] Final metrics report submitted
3. Receive exit payment within 7 days
### Involuntary Termination (for cause)
- Repeated uptime <97% (3 consecutive months)
- Security breach or credential exposure
- Violation of sovereign AI principles
- Unresponsive >72 hours without prior notice
Terminated operators:
- Access revoked immediately
- Final payment pro-rated to last active day
- May reapply after 6 months with improvement plan
### Succession Planning
- Each operator mentors 1 junior operator within first 6 months
- Documentation of all processes in `specs/fleet-ops-runbook.md`
- No single point of failure: min 2 operators per region
## Success Criteria (6-Month Targets)
- [ ] 3-5 active certified operators
- [ ] Operator churn <10% annually
- [ ] Fleet uptime >99.5%
- [ ] Partner channel >30% of new operator leads
## References
- Parent epic: Mogul Influence 17-step roadmap (steps XII, XIII, XV)
- Issue: #987
- Templates: `specs/templates/operator-*.md`
- Runbook: `specs/fleet-ops-runbook.md` (future)

View File

@@ -0,0 +1,59 @@
# Fleet Operations Runbook
*Standard operating procedures for Timmy Foundation fleet operators*
## Daily Checklist
- [ ] Check fleet health: `tmux list-sessions` (should show BURN, BURN2, FORGE active)
- [ ] Verify gateway running: `systemctl status ai.hermes.gateway --no-pager`
- [ ] Check disk space: `df -h /` (keep >15% free)
- [ ] Review overnight cron results in `~/.hermes/cron/jobs/`
## Weekly Tasks
- [ ] Generate fleet metrics report (`scripts/fleet-metrics.sh`)
- [ ] Rotate any expired credentials (check `~/.hermes/fleet-dispatch-state.json`)
- [ ] Review open PRs in Timmy Foundation repos
- [ ] Submit weekly report by Monday 09:00 UTC
## Alert Response Protocol
### Critical (respond <30 min)
1. Gateway down: `sudo systemctl restart ai.hermes.gateway`
2. Disk >90% full: `scripts/cleanup-disk.sh`
3. Fleet dispatch failing: check `/tmp/hermes/dispatch-queue.json`
### Warning (respond <4 hours)
1. Uptime <99.5%: investigate tmux panes with `tmux attach -t BURN`
2. Failed cron jobs: check logs in `~/.hermes/cron/jobs/`
3. Agent loop errors: review session transcripts
## Common Fixes
### Restart stuck tmux pane
```bash
tmux send-keys -t BURN:0 C-c
tmux send-keys -t BURN:0 "hermes chat --yolo" Enter
```
### Clear dispatch queue
```bash
rm /tmp/hermes/dispatch-queue.json
# Watchdog will recreate on next cycle
```
### Update hermes-agent
```bash
cd ~/hermes-agent && git pull origin main && pip install -e ".[all]"
```
## Emergency Escalation
- **Telegram**: @Rockachopa (primary)
- **Gitea Issue**: label `operator-alert` + mention @Rockachopa
- **Discord**: #fleet-ops-alerts channel
## Security Rules
- Never share VPS SSH keys
- Never commit credentials to git
- Rotate tokens every 90 days
- Report suspicious activity immediately
## Contact
- **Operator Handbook**: `specs/fleet-operator-incentives.md`
- **Templates**: `specs/templates/operator-*.md`
- **Foundation Forge**: https://forge.alexanderwhitestone.com/Timmy_Foundation

View File

@@ -0,0 +1,44 @@
# Fleet Operator Application
*Submit completed form as a new Gitea issue with label `operator-application`*
## Personal Information
- **Name / Handle**:
- **Contact Email**:
- **Telegram/Discord Handle**:
- **Wallet Address (USDC/USDT)**:
- **Timezone**:
## Infrastructure
- **VPS Provider**: (e.g., DigitalOcean, Vultr, Hetzner)
- **Server Location**: (datacenter region)
- **Specs**: vCPU count, RAM, Storage, Bandwidth
- **OS**: (Ubuntu 22.04 LTS preferred)
- **Static IP**: Yes / No
## Experience
- [ ] Linux system administration (2+ years)
- [ ] Git / GitHub / Gitea usage
- [ ] Docker / container orchestration
- [ ] AI agent frameworks (Hermes, OpenAI, etc.)
- [ ] Prior VPS fleet management
### Relevant Experience (describe)
*Briefly describe your background with fleet ops, sysadmin, or AI agents:*
## Commitment
- **Hours per week available**:
- **Can maintain 99.5% uptime?** Yes / No
- **Agree to 30-day notice for exit?** Yes / No
- **Agree to sovereign AI principles (no data exfiltration)?** Yes / No
## References
- GitHub/Gitea username:
- Any prior work with Timmy Foundation? (link issues/PRs)
## Acknowledgment
I understand I will start at $150/month base rate, with bonuses available for performance. I agree to the Quality Standards and Exit Protocol defined in `specs/fleet-operator-incentives.md`.
**Signature** (type name): _________________ **Date**: _________
---
*Send completed application to: https://forge.alexanderwhitestone.com/Timmy_Foundation/timmy-home/issues/new*

View File

@@ -0,0 +1,38 @@
# Partner Monthly Report
*Submit by the 5th of each month for commission payments*
## Partner Info
- **Partner Name**:
- **Month/Year**:
- **Wallet Address**:
## Referred Operators
| Operator Handle | Start Date | Monthly Base | Commission (20%) | Status |
|----------------|------------|--------------|-------------------|--------|
| | | $150 | $30 | active / churned |
| | | $150 | $30 | active / churned |
| | | $150 | $30 | active / churned |
**Total Commission Due**: $______
## Mentorship Log
*Confirm you provided mentorship to each referred operator in the first 30 days:*
- [ ] Operator 1: mentored (dates: ____ to ____)
- [ ] Operator 2: mentored (dates: ____ to ____)
- [ ] Operator 3: mentored (dates: ____ to ____)
## Partner Performance
- Total active operators referred:
- Average operator uptime this month: ______%
- Any operator churn? Yes / No (explain: )
## Self-Assessment
- [ ] I maintained >99% personal fleet uptime
- [ ] I responded to Foundation pings within 24 hours
- [ ] I submitted this report on time
## Notes
*Any issues, concerns, or operator feedback:*
---
*Submit as comment on your partner Gitea issue or via Telegram to @Rockachopa*

View File

@@ -1 +1,12 @@
# Timmy core module
from .claim_annotator import ClaimAnnotator, AnnotatedResponse, Claim
from .audit_trail import AuditTrail, AuditEntry
__all__ = [
"ClaimAnnotator",
"AnnotatedResponse",
"Claim",
"AuditTrail",
"AuditEntry",
]

View File

@@ -0,0 +1,156 @@
#!/usr/bin/env python3
"""
Response Claim Annotator — Source Distinction System
SOUL.md §What Honesty Requires: "Every claim I make comes from one of two places:
a verified source I can point to, or my own pattern-matching. My user must be
able to tell which is which."
"""
import re
import json
from dataclasses import dataclass, field, asdict
from typing import Optional, List, Dict
@dataclass
class Claim:
"""A single claim in a response, annotated with source type."""
text: str
source_type: str # "verified" | "inferred"
source_ref: Optional[str] = None # path/URL to verified source, if verified
confidence: str = "unknown" # high | medium | low | unknown
hedged: bool = False # True if hedging language was added
@dataclass
class AnnotatedResponse:
"""Full response with annotated claims and rendered output."""
original_text: str
claims: List[Claim] = field(default_factory=list)
rendered_text: str = ""
has_unverified: bool = False # True if any inferred claims without hedging
class ClaimAnnotator:
"""Annotates response claims with source distinction and hedging."""
# Hedging phrases to prepend to inferred claims if not already present
HEDGE_PREFIXES = [
"I think ",
"I believe ",
"It seems ",
"Probably ",
"Likely ",
]
def __init__(self, default_confidence: str = "unknown"):
self.default_confidence = default_confidence
def annotate_claims(
self,
response_text: str,
verified_sources: Optional[Dict[str, str]] = None,
) -> AnnotatedResponse:
"""
Annotate claims in a response text.
Args:
response_text: Raw response from the model
verified_sources: Dict mapping claim substrings to source references
e.g. {"Paris is the capital of France": "https://en.wikipedia.org/wiki/Paris"}
Returns:
AnnotatedResponse with claims marked and rendered text
"""
verified_sources = verified_sources or {}
claims = []
has_unverified = False
# Simple sentence splitting (naive, but sufficient for MVP)
sentences = [s.strip() for s in re.split(r'[.!?]\s+', response_text) if s.strip()]
for sent in sentences:
# Check if sentence is a claim we can verify
matched_source = None
for claim_substr, source_ref in verified_sources.items():
if claim_substr.lower() in sent.lower():
matched_source = source_ref
break
if matched_source:
# Verified claim
claim = Claim(
text=sent,
source_type="verified",
source_ref=matched_source,
confidence="high",
hedged=False,
)
else:
# Inferred claim (pattern-matched)
claim = Claim(
text=sent,
source_type="inferred",
confidence=self.default_confidence,
hedged=self._has_hedge(sent),
)
if not claim.hedged:
has_unverified = True
claims.append(claim)
# Render the annotated response
rendered = self._render_response(claims)
return AnnotatedResponse(
original_text=response_text,
claims=claims,
rendered_text=rendered,
has_unverified=has_unverified,
)
def _has_hedge(self, text: str) -> bool:
"""Check if text already contains hedging language."""
text_lower = text.lower()
for prefix in self.HEDGE_PREFIXES:
if text_lower.startswith(prefix.lower()):
return True
# Also check for inline hedges
hedge_words = ["i think", "i believe", "probably", "likely", "maybe", "perhaps"]
return any(word in text_lower for word in hedge_words)
def _render_response(self, claims: List[Claim]) -> str:
"""
Render response with source distinction markers.
Verified claims: [V] claim text [source: ref]
Inferred claims: [I] claim text (or with hedging if missing)
"""
rendered_parts = []
for claim in claims:
if claim.source_type == "verified":
part = f"[V] {claim.text}"
if claim.source_ref:
part += f" [source: {claim.source_ref}]"
else: # inferred
if not claim.hedged:
# Add hedging if missing
hedged_text = f"I think {claim.text[0].lower()}{claim.text[1:]}" if claim.text else claim.text
part = f"[I] {hedged_text}"
else:
part = f"[I] {claim.text}"
rendered_parts.append(part)
return " ".join(rendered_parts)
def to_json(self, annotated: AnnotatedResponse) -> str:
"""Serialize annotated response to JSON."""
return json.dumps(
{
"original_text": annotated.original_text,
"rendered_text": annotated.rendered_text,
"has_unverified": annotated.has_unverified,
"claims": [asdict(c) for c in annotated.claims],
},
indent=2,
ensure_ascii=False,
)

View File

@@ -0,0 +1,103 @@
#!/usr/bin/env python3
"""Tests for claim_annotator.py — verifies source distinction is present."""
import sys
import os
import json
sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "src"))
from timmy.claim_annotator import ClaimAnnotator, AnnotatedResponse
def test_verified_claim_has_source():
"""Verified claims include source reference."""
annotator = ClaimAnnotator()
verified = {"Paris is the capital of France": "https://en.wikipedia.org/wiki/Paris"}
response = "Paris is the capital of France. It is a beautiful city."
result = annotator.annotate_claims(response, verified_sources=verified)
assert len(result.claims) > 0
verified_claims = [c for c in result.claims if c.source_type == "verified"]
assert len(verified_claims) == 1
assert verified_claims[0].source_ref == "https://en.wikipedia.org/wiki/Paris"
assert "[V]" in result.rendered_text
assert "[source:" in result.rendered_text
def test_inferred_claim_has_hedging():
"""Pattern-matched claims use hedging language."""
annotator = ClaimAnnotator()
response = "The weather is nice today. It might rain tomorrow."
result = annotator.annotate_claims(response)
inferred_claims = [c for c in result.claims if c.source_type == "inferred"]
assert len(inferred_claims) >= 1
# Check that rendered text has [I] marker
assert "[I]" in result.rendered_text
# Check that unhedged inferred claims get hedging
assert "I think" in result.rendered_text or "I believe" in result.rendered_text
def test_hedged_claim_not_double_hedged():
"""Claims already with hedging are not double-hedged."""
annotator = ClaimAnnotator()
response = "I think the sky is blue. It is a nice day."
result = annotator.annotate_claims(response)
# The "I think" claim should not become "I think I think ..."
assert "I think I think" not in result.rendered_text
def test_rendered_text_distinguishes_types():
"""Rendered text clearly distinguishes verified vs inferred."""
annotator = ClaimAnnotator()
verified = {"Earth is round": "https://science.org/earth"}
response = "Earth is round. Stars are far away."
result = annotator.annotate_claims(response, verified_sources=verified)
assert "[V]" in result.rendered_text # verified marker
assert "[I]" in result.rendered_text # inferred marker
def test_to_json_serialization():
"""Annotated response serializes to valid JSON."""
annotator = ClaimAnnotator()
response = "Test claim."
result = annotator.annotate_claims(response)
json_str = annotator.to_json(result)
parsed = json.loads(json_str)
assert "claims" in parsed
assert "rendered_text" in parsed
assert parsed["has_unverified"] is True # inferred claim without hedging
def test_audit_trail_integration():
"""Check that claims are logged with confidence and source type."""
# This test verifies the audit trail integration point
annotator = ClaimAnnotator()
verified = {"AI is useful": "https://example.com/ai"}
response = "AI is useful. It can help with tasks."
result = annotator.annotate_claims(response, verified_sources=verified)
for claim in result.claims:
assert claim.source_type in ("verified", "inferred")
assert claim.confidence in ("high", "medium", "low", "unknown")
if claim.source_type == "verified":
assert claim.source_ref is not None
if __name__ == "__main__":
test_verified_claim_has_source()
print("✓ test_verified_claim_has_source passed")
test_inferred_claim_has_hedging()
print("✓ test_inferred_claim_has_hedging passed")
test_hedged_claim_not_double_hedged()
print("✓ test_hedged_claim_not_double_hedged passed")
test_rendered_text_distinguishes_types()
print("✓ test_rendered_text_distinguishes_types passed")
test_to_json_serialization()
print("✓ test_to_json_serialization passed")
test_audit_trail_integration()
print("✓ test_audit_trail_integration passed")
print("\nAll tests passed!")