THE HANGAR

One place per project, with its dated Ship Check reports.

A report your agent writes today is kept here with the date it arrived, so the next one has something to compare against.

The Hangar is a signed-in room. Sign in to add your first project — the Launch Bay stays open to everyone, no account.

Below is a sample of what a recorded report looks like — an example project, not your app. Your own project keeps your own reports, dated on arrival.

Project board · Ship Check report

TALLY

Next.js + Postgres on a PaaS

DEMO SAMPLE · example project TALLY · not your app

Report received on 2026-09-08 · reported by your agent · heuristic checks

2 BLOCKED · 3 WARNING · 9 PASSED · 12 NOT SCANNED

Each system holds back a named villain — the failure it guards against. This is an example report, so you can see the shape of one before you bring your own.

Blocked means: fix this before your first real week. Accept the risk only if you can say why, in writing, here.

◆ The Gatekeeper · Security · 1 blocked
1 blocked in systems with no theme of their own yet

SECRETS · holds back THE LEAKBLOCKED
A credential-shaped value exists in git history.
Deleting a value from the current file does not remove it from earlier commits.
- git:4c1f9ab — deleted in a later commit; still in history
- lib/db.ts:12
Train the reflex →Peers who fought THE LEAK →
DEMO SAMPLE · example project TALLY · not your app
ENV FILES · holds back THE COMMITTED KEYBLOCKED
An env file is tracked by git.
An env file in git can disclose project credentials.
- .env.production — tracked, not ignored
Train the reflex →Peers who fought THE COMMITTED KEY →
DEMO SAMPLE · example project TALLY · not your app
HEALTH · holds back THE SILENT CRASHWARNING
No health endpoint or container health check.
A health signal gives an operator a place to begin checking an application.
- Dockerfile — no HEALTHCHECK
Train the reflex →Peers who fought THE SILENT CRASH →
DEMO SAMPLE · example project TALLY · not your app
RATE LIMITS · holds back THE FLOODWARNING
A public POST route has no rate limit.
An unrestricted write route can consume resources through repeated requests.
- app/api/waitlist/route.ts:8
Train the reflex →Peers who fought THE FLOOD →
DEMO SAMPLE · example project TALLY · not your app
DEPENDENCIES · holds back THE ROTTEN PLANKWARNING
A third-party action is not pinned to a commit.
A movable action reference can change what a workflow executes.
- .github/workflows/deploy.yml:22 — floating tag
Train the reflex →Peers who fought THE ROTTEN PLANK →
DEMO SAMPLE · example project TALLY · not your app

Some checks for this system were not scanned. The board declaration does not mean every check passed.

Not established: 0 unknown · 12 not scanned

NOT SCANNED · SECRETSA workflow step prints a secret.Read workflow steps for commands that print credentials. Cite the workflow path and line; never execute a step or retrieve a value.
NOT SCANNED · ENV FILESThe image build can copy env files.Read Dockerfile COPY instructions and .dockerignore patterns for env inclusion. Do not build or run an image; report relevant file locations.
NOT SCANNED · DATABASEThe database accepts public network access.Read Terraform or Azure configuration for database network exposure. Do not query a provider or connect to the database; report UNKNOWN if deployment settings are unavailable.
NOT SCANNED · BACKUPSBackup retention is below seven days.Read declared Terraform or Azure backup retention and compare with seven days. Do not query the provider or run a restore; report UNKNOWN if the setting is unavailable.
NOT SCANNED · RATE LIMITSA retry loop has no backoff or attempt cap.Read retry loops for attempt bounds and increasing delays. Cite the source; never exercise a remote failure to test the loop.
NOT SCANNED · DEPENDENCIESThe base image tag floats.Read base-image references for mutable tags and digest pins. Do not pull, build or run an image; cite Dockerfile locations.
NOT SCANNED · COSTSResources carry no owner or environment tag.Read declared Terraform or Azure resource tags for owner and environment. Do not query or change provider resources.
NOT SCANNED · COSTSNon-production compute runs without a schedule.Read non-production compute declarations and schedules. Do not query billing or start and stop resources; report UNKNOWN when scheduling is outside the available configuration.
NOT SCANNED · COSTSNo budget alert exists.Read Terraform or Azure budget-alert declarations and recipient references. Never query billing or send an alert; report UNKNOWN when settings live outside the available files.
NOT SCANNED · COSTSModel or API calls have no token, time, or quota cap.Read model or API call sites for token, timeout and quota bounds. Do not send a request, use credentials or infer runtime enforcement from a setting alone.
NOT SCANNED · COSTSA billed call sits inside a loop.Read loops, maps and batch handlers for calls to a billed API or model. Do not send a request or look up a provider's price; cite the file and line of the loop and of the call.
NOT SCANNED · COSTSA queue consumer has no redelivery limit.Read queue and subscription declarations for a maximum receive or delivery count and a dead-letter target. Do not send, receive or purge a message; report UNKNOWN when the queue is declared outside the available files.

BLOCKED · SECRETS · The Gatekeeper (Security)
BLOCKED · ENV FILES · no theme of its own yet
PASSED · AUTH · The Gatekeeper (Security)
PASSED · DATABASE · The Gatekeeper (Security)
NOT SCANNED · BACKUPS · no theme of its own yet
WARNING · HEALTH · The Firewatch (SRE)
PASSED · ERRORS · The Firewatch (SRE)
WARNING · RATE LIMITS · The Firewatch (SRE)
WARNING · DEPENDENCIES · no theme of its own yet
NOT SCANNED · COSTS · The Nimbus (Cloud)