Comb Smith

What comes out of the workshop

• Beekeeping tech

  Broodly turns what you see in the hive into the next right action, and broodminder-export gets your BroodMinder data out of the API and into portable files — resumable and rate-limit-aware.

• Market data

  markets is tooling for pulling, storing, and analysing market data, dual-licensed AGPL and commercial so it can be used either way.

• Terminal UX

  TalkTerm is a terminal-based communication tool, for the people who would rather not leave the shell to talk about the work in it.

• AI content tooling

  ContentTwin is a social-media agent for small organisations — an enterprise-quality presence at non-profit pricing.

• Agent orchestration

  bmad-bgreat-suite supplies SRE and DevOps agents and workflows for the BMad Method ecosystem, with the org's own agents running the same rails.

• Everyday automation

  google-app-scripts collects the small personal-productivity scripts that are too useful to keep to one machine.

How an idea gets here

• Incubator first. Ideas start as discussions, a short decision brief, and a disposable proof of concept in the incubator.
• Graduation earns a repo. Once a POC proves out, the idea moves into its own product repository — scaffolded from the org template, wired to the shared standards on day one.
• Nothing ships unsupervised. Every repo runs the same CI rails, so a project that stops earning its keep is retired rather than left to rot.

The standard everything is held to

• Versioned, staged CI. Reusable workflows on a stable channel, promoted through concentric rings, with every action pinned and permissions scoped.
• Secrets never reach a remote. Push protection as primary enforcement, local pre-commit prevention, and CI secret scanning as a second line — with a live-fire canary that proves the check still works.
• Dependencies stay current. Stack-specific Dependabot policy, auto-merge for the safe cases, and a vulnerability audit that fails the build rather than filing a note.
• Agents run on a budget. Token-budget breakers, daily per-agent cost bounds, and canary rollout for the automation that writes code here.
• The posture is measured. A weekly compliance audit, an OpenSSF Scorecard sweep, and a standards-deploy job that opens PRs for repos that have drifted.