WinstonRedGuard

Local-first Python monorepo — 17 apps (14 active + 3 candidate) with strict governance and stdlib-first engineering. 62 legacy apps live in _archive/ after the 2026-04-23 scope-thesis pass and the 2026-04-24 candidate cleanup.

WinstonRedGuard is not a single product. It is an AI-assisted learning laboratory — 14 actively used tools, 3 apps pending a ship-or-retire decision, and 62 archived experiments. Every app in apps/ has confirmed real usage; everything else is honestly parked in _archive/.

🤝 Try ACP — coordinate concurrent AI coding agents in 60 seconds Running Claude Code + Codex + Cursor in parallel and hitting merge conflicts? ACP is a 3-layer protocol (SQLite TTL locks, .agents/ durable layer, SSE broadcast) that closes the intent gap before it becomes a merge gap.

🚀 Quickstart · 📄 Paper · 💬 Tell us your story

Quick Links

• PulseBoard (dormant — Railway free tier ended): apps/pulseboard
• Control Center: localhost:8766 — wrg_control_center
• wrg-devguard (PyPI): pypi.org/project/wrg-devguard — secret scanning + policy lint
• wrg-mcp-server (PyPI): pypi.org/project/wrg-mcp-server — full WRG monorepo as MCP tools
• instinct-mcp (PyPI): pypi.org/project/instinct-mcp — self-learning MCP memory
• wrg-rule-lab (PyPI): pypi.org/project/wrg-rule-lab — rule playground
• Personal site: yakuphanycl.github.io
• ACP paper: ACP_PAPER.md — coordination protocol for concurrent AI coding agents
• ACP quickstart: ACP_QUICKSTART.md — try in 60 seconds

Numbers

V0 Discipline

Every app follows strict engineering rules:

• stdlib-first — internal libraries (CLIs, pipelines, memory, registry, governance) stay on stdlib; only user-facing web services pull in a curated FastAPI + httpx + aiosqlite stack. 59% of apps have zero runtime deps (2026-04-24 audit)
• Python >=3.11 — requires-python declared per app; CI runs on 3.12
• SQLite as the default database for all apps
• 60% coverage floor — ratcheted across every app, no per-app exception
• Local-first — everything runs on your machine
• JSON artifacts — all pipeline steps produce JSON output
• Deterministic — reproducible results, no randomness

Quality Gates

• Branch protection on main (review + conversation resolution)
• Required CI/security checks before merge
• CodeQL analysis on push and PR
• Dependabot updates for workflow dependencies

Key Products

PulseBoard (Candidate)

GitHub repo health monitor deployed on Railway. 7 collectors (CI, Coverage, PR Age, Commits, Dependencies, License, Release Cadence) → single Pulse Score 0-100. FastAPI + aiosqlite, GitHub OAuth, PR commit status checks, Slack score-drop alerts, public profile pages, badge embed, TR/EN i18n. 186 tests. Railway free tier ended — picking free alt (Fly.io / Render) or keeping dormant.

research_motor (Active)

Deterministic research decision motor with 18 OSINT adapters:

• username, email, name, phone — identity intelligence
• domain, dns, ssl, ip, whois — infrastructure recon
• sherlock, social_reach — social media presence
• breach, paste — data breach monitoring
• tor_archive — Tor relay history (221K IPs)
• image_stego, metadata, avatar — media forensics
• wayback, company — historical & corporate data

OSINT features: rate limiting, SQLite cache, HTML reports, opportunity scoring, CLI, compare mode, watch mode, Control Center dashboard integration.

governance_check (Active)

Repo-wide quality gate — validates every app before release. 18 automated per-app checks covering tests, deps, docs, and code quality. No manual override allowed.

wrg_devguard (Active, PyPI)

Developer-first AI safety scanner: secret scanning + prompt-policy lint. Zero runtime deps. Ships as Python CLI, GitHub Action, Claude Code skill, and Cursor rule.

pip install wrg-devguard
wrg-devguard check --path . --fail-on error

wrg_mcp_server (Active)

MCP (Model Context Protocol) server exposing the full WRG monorepo to Claude Code, Claude Desktop, and any MCP-compatible client. Built on FastMCP — registers tools from every active app so an agent can list apps, run pipelines, query memory (FTS5 + TTL), trigger research scans, hit company/PulseBoard remote APIs, and run the release gate without shelling out. Three transports: stdio (Claude Desktop / Code), streamable-http (default), sse (legacy). Published to PyPI (v1.0.0) and live on the MCP Registry as of 2026-04-24.

cd apps/wrg_mcp_server && pip install -e ".[remote]"
wrg-mcp-server --transport stdio

wrg_agent / ACP (Active)

Three-layer coordination protocol for concurrent AI coding agents. Prevents file conflicts and duplicate work when Claude Code, Codex, Cursor, or other agents run in parallel on the same repo.

Layers:

• Runtime — SQLite KV store with TTL-based file locks and agent session registry (wrg_memory)
• Durable — .agents/tasks/ and .agents/locks/ JSON files committed alongside code; auditable via git log
• Broadcast — SSE endpoint on Control Center; live coordination events in dashboard

CLI (8 commands): register, done, lock, unlock, status, check, configure, whoami

Pre-commit hook generator enforces locking even for agents that skip the CLI. Full protocol: ACP_PAPER.md

All Apps

As of 2026-04-23, apps/ holds only apps with confirmed real usage. Everything else was moved to _archive/ during the scope-thesis pass (PR #235). See each section for what counts as "used".

Architecture

flowchart TB
    WRG(["WinstonRedGuard<br/>17 apps · 18/18 gates<br/>+ 62 in _archive/"])

    subgraph ACT ["Active (14) · confirmed real usage"]
        direction LR
        RM["research_motor<br/>18 OSINT adapters"]
        GC["governance_check<br/>18 gates<br/>no manual override"]
        WCC["wrg_control_center<br/>FastAPI + Electron<br/>localhost:8766"]
        WDG["wrg_devguard<br/>PyPI · secret scan<br/>+ policy lint"]
        WAG["wrg_agent<br/>ACP protocol<br/>8-cmd CLI"]
        WME["wrg_memory<br/>SQLite KV · FTS5 · TTL"]
        WPI["wrg_pipeline<br/>DAG runner<br/>partial-success"]
        WSC["wrg_scheduler<br/>cron · retry · locks"]
        WMCP["wrg_mcp_server<br/>Claude Code MCP"]
        WN3["wrg_notifier3<br/>JSON · watch dedup"]
        WVPN["wrg_vpn_control"]
        AR["app_registry"]
        DJ["data_janitor"]
        PC["pulse_core"]
    end

    subgraph CAND ["Candidate (3) · decision pending"]
        direction LR
        PB["pulseboard<br/>Railway free tier ended"]
        IG["invoice_gen<br/>take down Railway"]
        RL["rule_lab<br/>PyPI · maintenance mode"]
    end

    subgraph ARCH ["_archive/ (62) · honestly parked"]
        direction LR
        SPORTS["sports betting (12)<br/>never placed a bet"]
        CONTENT["content production (7)<br/>too much effort"]
        AIML["AI/ML exploration (6)<br/>never used"]
        PLAT["platform utilities (14)<br/>folded into active"]
        ETC["other (22)<br/>pre-existing scaffolds"]
    end

    subgraph INFRA ["Infrastructure & Tooling"]
        direction LR
        AG[".agents/<br/>ACP durable layer"]
        WF[".github/workflows<br/>10 CI pipelines"]
        TL["tools/<br/>release_check · health"]
        DOCS["docs<br/>ACP_PAPER · README"]
    end

    subgraph DIST ["Distribution"]
        direction LR
        PYPI["PyPI<br/>wrg-devguard · instinct-mcp · wrg-mcp-server · wrg-rule-lab"]
        RW["Railway<br/>pulseboard · invoice_gen<br/>(free tier ended)"]
        GHS["GitHub Pages<br/>yakuphanycl.github.io"]
    end

    WRG --> ACT
    WRG --> CAND
    WRG --> ARCH
    WRG --> INFRA
    WRG --> DIST

    %% Cross-connections
    WAG -.->|locks/SSE| AG
    WCC -.->|reads| WME
    WCC -.->|dashboards| RM
    GC -.->|audits| ACT
    GC -.->|audits| CAND
    WF -.->|invokes| TL
    WDG -.->|publishes| PYPI
    RL -.->|publishes| PYPI
    PB -.->|deployed| RW

    classDef active fill:#0d4d29,stroke:#2ea043,stroke-width:2px,color:#fff
    classDef candidate fill:#3a2a0e,stroke:#d29922,stroke-width:2px,color:#fff
    classDef archived fill:#2f1f1f,stroke:#6e5757,stroke-width:2px,color:#cfc9c9
    classDef infra fill:#2a2630,stroke:#8b7ec7,stroke-width:2px,color:#fff
    classDef dist fill:#3a0e2a,stroke:#d92a8f,stroke-width:2px,color:#fff
    classDef root fill:#08111f,stroke:#1f6feb,stroke-width:3px,color:#fff

    class RM,GC,WCC,WDG,WAG,WME,WPI,WSC,WMCP,WN3,WVPN,AR,DJ,PC active
    class PB,IG,RL candidate
    class SPORTS,CONTENT,AIML,PLAT,ETC archived
    class AG,WF,TL,DOCS infra
    class PYPI,RW,GHS dist
    class WRG root

Each app follows flat layout: apps/{name}/src/{name}/ with pyproject.toml, tests/, and optional tools/.

Health Ops

• Standardized health schema: tools/health_schema.py (health.v1)
• Snapshot runner: pwsh -File tools/health_snapshot.ps1
• Full release gate with JSON report:
  • pwsh -File tools/release_check.ps1 -All
  • pwsh -File tools/release_check.ps1 -All -JsonOut artifacts/health/release_check.json

Task Runner

Two equivalent task runners are provided — pick whichever fits your shell:

# Linux/macOS/Git Bash/WSL — GNU Make
make help
make test                       # all apps
make test APP=research_motor    # one app
make release                    # full release gate
make ci-local                   # governance + agent + release

# Windows PowerShell
.\tasks.ps1 help
.\tasks.ps1 test
.\tasks.ps1 test -App research_motor
.\tasks.ps1 release
.\tasks.ps1 ci-local

Additional utility targets (both runners):

make doctor              # diagnose working-tree drift (orphan dirs, stale artifacts)
make sync-registry       # mirror registry.json from canonical → src/ (idempotent)

Roadmap

Now (0-3m) — Ship & measure

Next (3-6m) — Multi-tenant & integrations

Long (6-12m) — Productization

Author

Yakuphan — solo founder of WinstonRedGuard

• GitHub: @yakuphanycl
• LinkedIn: in/yakuphanycl
• X: @rg_winston3375
• Site: yakuphanycl.github.io