Beads (bd) is a CLI-based issue tracking system designed for AI agents and developers, using Dolt as a version-controlled SQL database backend. It provides persistent, structured memory for coding agents through features like dependency tracking, workflow automation (molecules/formulas), and JSON output for scripting. The architecture features a modular Go design with clear separation between CLI, storage abstraction (supporting both embedded and server Dolt modes), workflow APIs, and extensibility systems. Key capabilities include issue lifecycle management, dependency graphs, blocking detection, telemetry, hook-based extensibility, and integrations with external trackers like Jira, GitHub, and Notion. The system emphasizes correctness through extensive conformance testing, transactional operations, and merge-safety mechanisms for distributed clones.
osquery is a cross-platform endpoint agent that exposes operating system state as SQL tables, enabling real-time monitoring, security analytics, and incident response. It runs as a daemon (osqueryd) or interactive shell (osqueryi), with a plugin architecture for configuration, logging, and event collection. The codebase is written in C++ and supports Linux, macOS, and Windows, with hundreds of tables covering processes, network connections, file integrity, hardware, and cloud metadata. The architecture is built around a registry pattern for plugins, an event publisher/subscriber model for real-time telemetry, and a SQLite virtual table layer for query execution. The project is production-grade, with extensive unit and integration tests, fuzzing harnesses, benchmarks, and a CVE scanning workflow. It is actively maintained with regular releases and a large contributor base.
Gentle-AI is a CLI-driven application that manages AI coding agents through installation, configuration, and review workflows. It provides a deterministic engineering environment with features like persistent memory (Engram™), receipt-driven development (RDD) for verifiable code reviews, and telemetry collection. The architecture is modular, separating concerns into CLI commands, agent adapters, components (like Skills and Context7), review transaction logic, state management, and a text-based user interface. The system interacts with external AI agents (Claude Code, OpenCode, Cursor, etc.) via adapter patterns, manages state in $HOME/.gentle-ai, and supports cross-platform operation (Linux, macOS, Windows). Key entry points include the gentle-ai CLI command and TUI screens for interactive workflows.
Thousand Island is a pure Elixir, OTP-based socket server library inspired by Ranch. It provides a supervision tree (Server → Listener + AcceptorPoolSupervisor → AcceptorSupervisor → Acceptor/DynamicSupervisor → Handler) that handles TCP and SSL connections with configurable concurrency, connection draining, and shutdown semantics. The library exposes a clean `ThousandIsland.Handler` behaviour for application-level protocol logic, and a `ThousandIsland.Socket` abstraction that decorates underlying transport sockets with automatic telemetry instrumentation. It emits rich telemetry spans for listeners, acceptors, and individual connections, supports suspend/resume of connection acceptance, and handles transient network errors and file descriptor exhaustion without crashing the acceptor tree. The code is thoroughly tested and free of external dependencies beyond telemetry, making it both a production-ready server and an exemplar of idiomatic Elixir/OTP patterns.
This repository is the OpenConfig public YANG models repository, a collaborative effort by network operators to develop vendor-neutral YANG data models for managing network devices. It contains hundreds of YANG modules covering configuration and operational state for routing protocols (BGP, OSPF, ISIS, MPLS, Segment Routing), interfaces, ACLs, QoS, optical transport, platform components, security, telemetry, and more. The models follow consistent patterns: config/state separation, identity-based extensibility, and augmentation-based composition. The repository also includes CI workflows for validation (pyang, goyang, yanglint), documentation, and release management. While not an application with runtime code, it serves as a foundational schema library for network automation and telemetry systems. The codebase is well-maintained with active development, frequent revisions, and a formal release process.
taoensso/encore is a foundational Clojure/ClojureScript utility library rather than an end-user application. It provides a broad collection of general-purpose cross-platform primitives: macros for control flow and aliasing, predicates and coercions, collection/string/time helpers, concurrency constructs, caching and memoization, rate limiting, async runners, environment configuration, Ring helpers, and ClojureScript AJAX support. The core functionality lives in a single large namespace, with additional experimental namespaces for byte manipulation, statistics, signal handling, and timers. It is designed to be embedded in other libraries and applications, not run standalone. The architecture is modular at the namespace level: `taoensso.encore` is the core grab-bag, while `taoensso.encore.bytes`, `taoensso.encore.stats`, `taoensso.encore.signals`, and `taoensso.encore.timers` provide focused, self-contained subsystems. A small Java class supplies high-performance NanoId/HexId generation. The code is heavily optimized for cross-platform behavior and performance, using reader conditionals, custom deftypes, CAS loops, and transient collections. It has a robust test suite and CI coverage for Clojure, ClojureScript, GraalVM, and Babashka. Although it contains statistical and byte-level utilities that could support data work, the repository is not a data pipeline or research project. There are no datasets, notebooks, or ETL flows. The stats module is a reusable library component, not an analytical schema. This is a dependency-first library with high reuse value for Clojure developers needing battle-tested utilities.
YARP (Yet Another Reverse Proxy) is a high-performance, extensible reverse proxy toolkit for .NET, built on ASP.NET Core. It provides a library and samples for creating custom proxy servers with features including request forwarding, load balancing (random, round-robin, least-requests, power-of-two-choices), active and passive health checks, session affinity (cookie, hash, ARR, custom header), request/response transforms, and telemetry consumption. The architecture is middleware-based, with a pipeline that includes routing, load balancing, session affinity, health checks, and delegation (Http.sys). Configuration is driven by immutable records and supports dynamic reload via change tokens. YARP also includes a Kubernetes Ingress Controller module that watches Ingress, Service, Endpoint, and Secret resources to dynamically configure the proxy. The codebase demonstrates strong engineering practices: extensive unit and functional tests, pluggable policy interfaces, efficient stream copying with telemetry, and a transform builder pattern for declarative request/response modifications. It is actively maintained by Microsoft and used in production scenarios.
Apollo Router is a production-grade GraphQL gateway written in Rust. It accepts incoming GraphQL HTTP requests, composes a supergraph schema from subgraph schemas, plans queries across subgraphs, and executes them through a tower-style service pipeline. It supports federation, subscriptions, persisted queries, demand control, entity caching, progressive overrides, connectors, and defer. Configuration is YAML-based and can be managed via Apollo GraphOS Uplink for schema/config propagation.
This repository is a community-driven research project that maintains structured telemetry coverage matrices for major EDR (Endpoint Detection and Response) products across Windows, Linux, and macOS. It currently tracks 25+ vendors with approximately 100 telemetry sub-categories mapped to MITRE ATT&CK data sources. The primary data artifacts are three JSON files (EDR_telem_windows.json, EDR_telem_linux.json, EDR_telem_macOS.json) that are manually curated through pull requests, each with evidence requirements. The project provides a scoring system that computes weighted vendor scores based on coverage, an automated statistics pipeline that generates historical change events, vendor score timeseries, and contributor summaries, and platform-specific telemetry generators that produce test events for validation purposes. While the core asset is the curated dataset, the repository also contains reusable software components including a modular scoring model, a diff engine for snapshot comparison, and a PR evidence classifier. The project has a substantial community with nearly 2000 stars, active issue triage, and continuous updates through GitHub Actions workflows that regenerate statistics and synchronize data to a Supabase database.
Bluejay is embedded firmware for Electronic Speed Controllers (ESCs) that control brushless motors in multirotor drones. It processes DShot digital signals (150/300/600) to regulate motor speed, provides bidirectional DShot telemetry for RPM data, and implements motor commutation, power management, and safety features. The architecture is a monolithic 8051 assembly program built for SiLabs EFM8 BB2/BB51 MCUs, using a superloop design with interrupt handlers for real-time signal processing. Key components include DShot decoding/encoding, six-step motor commutation, and a cooperative scheduler for background tasks like telemetry transmission and temperature monitoring.
The stripe/java repository is the official Java client library for the Stripe API, providing type-safe access to Stripe's payment processing and financial services. It features a layered architecture with model classes representing Stripe objects, service classes for API resource access, parameter builders for request configuration, and webhook handling infrastructure. The library supports both legacy static API patterns and a modern instance-based StripeClient entry point, with comprehensive telemetry, expandable fields, and extra parameters for accessing beta features. Code generation from OpenAPI specs ensures consistency with Stripe's API evolution, while hand-crafted components like utility classes and webhook verification demonstrate engineering excellence.
This repository implements OpenTelemetry eBPF Instrumentation (OBI), a production-grade observability agent that uses eBPF to automatically capture distributed traces, metrics, and logs from user-space applications without any code changes. It supports a wide range of protocols (HTTP/1.1, HTTP/2, gRPC, SQL, Redis, Kafka, MongoDB, AMQP, MQTT, DNS, and more) and multiple language runtimes (Go, Java, Python, Node.js, Ruby, .NET, Rust). The agent can run as a standalone binary, a Docker container, or an OpenTelemetry Collector receiver. Its architecture consists of eBPF programs (kprobes, uprobes, tracepoints, TC) that emit events to ring buffers, which are read by Go userspace tracers and processed through a pipeline of discovery, decoration, filtering, and export stages. Telemetry is exported via OTLP (gRPC/HTTP) or Prometheus, with optional Kubernetes metadata enrichment and network flow monitoring. The codebase is well-structured with clear separation of concerns, extensive integration tests, and several reusable generic components (message queues, pipeline runners, expiry caches, attribute filters). It is actively maintained with frequent commits and comprehensive CI/CD.
Docfork is a documentation lookup service designed specifically for AI coding agents and developers. It provides up-to-date, version-pinned documentation through a Model Context Protocol (MCP) server with two core tools: `search_docs` for finding relevant documentation sections and `fetch_doc` for retrieving full content. The service is accessed via IDE plugins (Cursor, Claude Code, etc.), a command-line interface (dgrep), and a TypeScript SDK. The architecture features a monorepo structure with separate packages for the MCP server, CLI tool, SDK, and IDE integrations, using Turborepo for build orchestration and pnpm workspaces for package management. Key features include authentication via API keys or OAuth, team-based 'Cabinets' to scope documentation to specific project stacks, and privacy-first telemetry that collects only metadata without querying user data.
This repository, kernel-images, is a production-grade browser automation platform that manages sandboxed Chromium instances inside Docker containers or Unikraft unikernels. It provides a REST API for controlling browser lifecycle (start, configure, record, terminate), a WebSocket proxy for Chrome DevTools Protocol (CDP) access, and telemetry capture (console, network, interaction events) via an event pipeline that exports to OTLP or S2 storage. The system supports headful and headless modes, with a Vue.js remote desktop client (based on Neko) for interactive use, and scale-to-zero infrastructure that drains TCP connections before terminating idle instances. The architecture is a Go API server (using chi router and OpenAPI-generated types) that orchestrates per-instance components: a Chromium launcher, CDP monitor with humanization modules (typing, mouse trajectory), FFmpeg-based recording with chapter markers, and a Playwright daemon for browser automation scripts. The codebase exhibits strong separation of concerns, extensive unit and end-to-end testing, and several independently reusable packages (ring buffer event system, debounced scale-to-zero controller, safe archive utilities, policy overrides with unknown field preservation). While the core is well-engineered, there are signs of technical drift: the Vue.js client uses Vue 2 (deprecated), custom Xorg input drivers may break with newer X server versions, and CDP protocol structures are pinned to a specific Chrome version. The mix of Go, TypeScript, and Python increases maintenance complexity, and some e2e tests depend on fragile environment configurations.
Flix is an open-source ESP32-based quadcopter project built from scratch. The repository contains flight controller firmware, a Python control/telemetry library, C++ utilities for log conversion, simulation assets, and extensive documentation. It is primarily an application repo, though it also includes CAD models and data-conversion tools that serve as supporting assets. At runtime, the ESP32 firmware reads IMU data, estimates attitude, and drives motors, communicating via MAVLink and ESP-NOW for telemetry and control. The Python library (tools/pyflix/flix.py) provides an observable API for interacting with the vehicle, and CLI tools convert flight logs from CSV to MCAP and ULog formats for analysis in standard robotics tooling. A Gazebo simulation and a Python test harness validate behavior without hardware. Architecture is a multi-part monorepo: firmware, Python tools, C++ tools, docs, and 3D-printable mechanical parts. External dependencies include the Arduino ESP32 core, MAVLink, ESP-NOW, Gazebo, and custom math classes. The code is generally well-structured, but some data flow relies on global variables and hardware-specific assumptions, limiting reuse outside the ESP32 ecosystem. The project appears actively maintained with CI workflows, but dependency pinning and tight hardware coupling create moderate drift risk.
This repository is a collection of domain blocklists designed for use with Pi-hole and similar DNS-based ad-blocking services. It provides multiple specialized text files containing domain names to block, categorized by purpose (e.g., ads and trackers, telemetry, specific applications like TikTok and WhatsApp, malware, ransomware, and spam). The README explains how to integrate these lists into Pi-hole's adblocking configuration. While the repository lacks visible data processing code (showing only the final curated lists), the topical organization and maintenance updates suggest an ongoing curation effort aimed at removing false positives and optimizing the lists for specific use cases.
This repository is a curated, versioned collection of domain names and URLs used by mobile location tracking libraries, analytics SDKs, adware, spyware, stalkerware, malware, and other telemetry-gathering software. The primary output is three text files in standardized ad-blocking formats (plain hostnames, AdBlock Plus syntax, uBlock Origin syntax) plus a separate Windows telemetry list. The data is sourced from reverse engineering Android APKs (referenced by file hash), public security research reports, passive DNS data, and investigative journalism. The repo serves both as a domain blocklist for privacy-focused users and as a reference for threat intelligence analysts. It is not a software application or an automated data pipeline; it is a manually curated dataset maintained through ongoing research and community contributions.