
"Public review" that closes before anyone reads it, merge reads as the green light. At the Nano Collective, every whitepaper sits 30 days after merge. Build call at the end, with rationale. Not vetting. The only window a good idea gets heard before code exists.


The Nano Collective publishes bounty scope, deliverable, and amount before you start. That's the offer, not the opening bid. Negotiate the scope, not the number.


A stalled project is not the same as a backlogged one. At the Nano Collective, sixty days of silence flips the whitepaper status to Paused, on the page, not in someone's head. Check the status badge on the project page; that is the clock.


Most converters make one decision for diagrams. That is why Mermaid keeps getting lost or made up. `get-md` has four paths because raw source, rendered SVG, a page URL, and a live DOM are four different jobs.


Your markdown converter shouldn't phone home to read a PDF. `get-md` ships a local reader-lm, so `useLLM` without `--block` runs in-process. The network is opt-in, not the default.


You shouldn't have to tell a converter what it's about to read. Pass `get-md` a `.pdf` or `.docx` and it picks the right pipeline from the file itself, no `--type` flag, no preset. PDF in stdin works the same way via the `%PDF` header.


1 hour TTL on a per-URL cache means a flaky CI step re-runs in milliseconds, not seconds.

Re-running get-md on the same URL hits `~/.get-md/cache` before the network. A cache miss falls back to a live fetch, so the cache never blocks.


Bundling Zod would mean json-up picks a version for you. It might not be the one your stack ships with. Zod is a peer dep, on purpose. The version in your lockfile is the one that runs your schemas.



When a migration blows up, the stack trace is the wrong place to find out why. json-up throws ValidationError, MigrationError, and VersionError, so the catch site reads the cause instead of guessing.



When your stored JSON drifts from its schema, guessing which version broke it is the slow part. json-up's migrate walks each version in order and throws at the exact step where the contract no longer matches, so the diff is one version, not the whole chain.


A Zod schema that infers a wider TS type than it actually parses is the worst kind of bug. It compiles, ships, and lies. json-up widens nothing. If the schema says string, the type is string. If your data is broader, the catch site hears about it.


A skill marketplace drifts out of step with the code it's meant to extend. nanocoder puts skill bundles under `.nanocoder/skills/` as folders you commit alongside the prompts, so reviewer and agent read the same diff. No index to keep in sync.


A subagent that shared your context would fill it by lunchtime. nanocoder spawns each one as its own conversation: its own provider, its own context window, its own tool list. Only the final answer returns, so your main thread stays a working set, not a search history.


None of the chat panel, file tree, or diff viewer is the agent. With ACP, nanocoder speaks JSON-RPC over stdio and draws nothing. The editor owns the UI, the agent owns the answer.


"Never touch .env" lives in the prompt until the model forgets. nanocoder's `pre-tool-use` runs a shell command before every tool call with `$NANOCODER_FILE` in env. Non-zero exit denies the call. The rule is enforced, not taught.


The fine-tune that won't fit your GPU is the fine-tune you don't have. nanotune puts `lora`, `dora`, `full` on `--fine-tune-type` so the flag you pass is the memory budget you actually have.


A judge you bolted on gives you a number, not an answer. Nanotune's llm-judge reads the same provider config as the agent, so a shoddy judge is a shoddy eval. The config is the judge.


Four presets stand in for a dozen flags you'd otherwise memorise. Nanotune's `--preset low|medium|high|ultra` is the contract between your GPU and the recipe: name the preset, get threads, layers, context, batch, and tokens together. A flag still overrides when you need it.


The fine-tune that bombs at hour four was wrong at hour zero. Nanotune's `train --dry-run` walks the data, the schema, and the recipe against the same checks a real run does, then quits. The mistake you meant to catch is the one it catches in seconds, not GPU-hours.


Most "extensible" tools invite you to fork the runner. prompt-scrub flips that: new detectors ship as npm packages against a documented interface. The contract is the engine, not the wiring around it.


Most prompt privacy ships as middleware, a thing in your egress path that can fail or get breached. prompt-scrub runs on the bytes you already have, not the bytes you send. Integration is a function call, not a deployment.


A model that says "the key you mentioned earlier" needs to land on the same key on turn one and turn ten. prompt-scrub pins the placeholder format as a session-wide contract, so the same secret gets the same token every turn. The format is the round-trip, not a side effect.


A reusable workflow in a private repo can only be called from inside its own organisation. So Roster cannot call its own. It writes templates, the tenant runs its own copies. The constraint turns out to be the design.


A fat memory file on boot burns tokens you'll never spend. Roster (alpha) reads INDEX.md in full but loads each note only when something points at it. Recall one click away, context stays small.


A staff member in Roster (alpha) isn't a username, it's a private repo. Clone it and you have the whole brain. Revoke access and the role is gone. Permissions live where your code already does.


A staff member can ship a PR at 07:00 because the charter said what to do when nobody was watching. Roster (alpha) will not write that file. A generated one gives you a generic agent, which is the failure the system exists to prevent.


Generic SAST can only audit against someone else's idea of your code. Sentinel ships no rule packs on purpose. The format is the product - what you write in YAML is what every repo inherits when it installs you.


A noisy linter makes you mute the channel. A quiet one ships the CVE. Sentinel (alpha) leans toward noise. Worst case: an extra issue. Better than a finding that never made it out of the workflow.


One number decides whether Sentinel talks to GitHub or stays silent. severity_threshold: findings below it go in the run log, findings above it open an issue. Same audit, two different integrations, your call.


You should not have to pick the model twice for one job.

Sentinel reads the same provider and model flags as Nanocoder, so the judge is configured once. But that loop runs auto-approve on audited repos, so the keys that reach the model reach the code. Pick locally.