Source: qdash /inventory landing — c100 bake-off #4, 2026-09-30
The four cards under the estate hero — what can't we see, what's undeclared, what's new, and whose account is it? Each is drawn twice, side by side: the best prior form (c78, c81, c68, bob-wire c21) on the left, a fresh one on the right, on the same fixture world as bake-off #3. Click a harness, a witness bucket, a class lane or a provider to focus it in both halves.
Visibility — what can't we see?
242 of 268 installs monitored — 26 detected only (9 of them the shadow Hermes). Absolutes, not a percentage: “5 blind installs is actionable, 87% is not.”
Block area = monitored installs at the same unit as each pulled-out pixel (242 vs 26).
Provenance — declared, seen, or both?
Two witnesses: the config declares an asset, the wire sees it used. Agreement is calm; either witness alone is a question. 4 MCP servers are on the wire with no config and nobody vetted them.
| MCP server | Configured | Connected | Calls | Review |
|---|---|---|---|---|
| slack | — | ✓ | 1,292 | unreviewed |
| google-drive | — | ✓ | 880 | unreviewed |
| notion | — | ✓ | 795 | unreviewed |
| stripe | — | ✓ | 345 | unreviewed |
| postgres-prod | ✓ | — | 0 | unreviewed |
| browserbase | ✓ | — | 0 | unreviewed |
| datadog | ✓ | — | 0 | vetted |
| jira | ✓ | — | 0 | vetted |
| github | ✓ | ✓ | 6,688 | vetted |
| filesystem | ✓ | ✓ | 4,672 | vetted |
| internal-docs | ✓ | ✓ | 3,330 | vetted |
| linear | ✓ | ✓ | 2,278 | vetted |
| playwright | ✓ | ✓ | 1,800 | vetted |
| sentry | ✓ | ✓ | 1,611 | vetted |
| aws | ✓ | ✓ | 1,093 | vetted |
| figma | ✓ | ✓ | 843 | vetted |
light bar = installs registered · dark bar = invocations · tools have no prior form
Arrivals — what got in this window?
98 arrivals in 30d — 17 assets and 81 installs; 30 not vetted. Deltas, not counts: the judgment is what's new and what nobody decided.
Accounts — whose account is it?
2 personal accounts across 1 provider, plus Hermes traffic on an account nobody owns. Dual licences are “the hard case” — the same person on the org account and their own.
| Provider | Account | People | Tokens |
|---|---|---|---|
| Anthropic | org account | 140 | 1.7B |
| uma.novak · personal (dual) | 1 | 4.8M | |
| OpenAI | org account | 94 | 513.8M |
| Azure OpenAI | org account | 31 | 193.7M |
| org account | 64 | 135.1M | |
| Mistral | org account | 13 | 59.7M |
| OpenRouter | unknown owner (Hermes) | 9 hosts | 1.1M |
No account at all: Hermes Agent on 9 machines, calling OpenRouter.
My read
Visibility → the ghost pull-out. It is the only form where the blind installs have names on the landing, and the names are the action (“onboard kai-dev”). The c78 rows stay for /inventory/harnesses, where the per-harness split is the question. At 1,500 the pull-out keeps working because it groups by harness and caps the names.
Provenance → the two-witness strip. One grammar covers MCP servers, skills and tools, and the three columns say exactly what c81's two tick columns imply. The prior table is the MCP child page, where each row needs its calls and its review state. The strip's weakness is tools: 230 dots are a texture, and the derived tools set is beyond today's data.
Arrivals → the beeswarm, with the NEW list as its hover. The swarm shows the shape of a window at once (the Hermes wave, a new provider's first day) and the named hollow dots carry the judgment. The day strip reads better at 24h and small scale, where a list is all there is.
Accounts → keep both, stacked. The Dana standout is the emotional hook and should appear whenever there is one to four personal accounts; the split bars are what survives 1,500 (34 accounts), and they are the only form that separates dual-use from personal-only. The ghost Block button belongs on the standout, not the bars.
What to try, and what to look for
Every amber mark leaves: no pull-out, no wire-only-unvetted, no standout. Each card should look finished — and the page's real answer is the one line at the top.
The arrivals card becomes the discovery reveal — everything is new, spread over the sweep's first 24 hours. Does the beeswarm or the strip make that feel like a demo?
358 blind installs, 34 personal accounts. The pixel rows become walls and the standout of one becomes arbitrary; the pull-out groups, the split bars hold.
Only arrivals follow the pill: 24h shows Hermes arriving yesterday and little else; 30d shows the new-provider wave (Mistral, OpenRouter). Provenance and accounts are inventory and don't move.
The other half dims to Codex's blind installs. Which half would you rather hand to the IT admin who has to onboard them?
The prior table dims to the same four servers. The strip says "connected, undeclared" as a place; the table says it as a missing tick.