@opengroundplan/core 0.1.1

package/catalog/sources/README.md

@@ -0,0 +1,697 @@
+# Groundplan source catalog - curated index
+
+**Generated:** 2026-07-19 | **Categories:** 17 | **Unique repositories:** 304 (313 catalog entries; 14 cross-category duplicates collapsed to one canonical entry each)
+
+| class | count |
+|---|---:|
+| vendorable | 283 |
+| reference-only | 5 |
+| excluded | 16 |
+
+Per-category detail - full `whatToBorrow` / `whatToAvoid` / `proposedLayerIds` - lives in the sibling
+`*.yaml` files. This README is the index; the YAML is the record. The consolidated build plan is
+[`layer-plan.yaml`](./layer-plan.yaml); what nothing here covers is [`gaps.md`](./gaps.md).
+
+## How to read the license gate
+
+- **vendorable** - MIT, Apache-2.0, BSD-2/3-Clause, ISC, Unlicense, 0BSD, CC0-1.0. Copy and adapt freely; preserve notices where the license requires it (see [Attribution](#attribution)).
+- **reference-only** - MPL-2.0, LGPL, EPL, CC-BY-SA, standards-body licenses. Read for ideas. **Copy no files, no config, no prose.**
+- **excluded** - GPL/AGPL, source-available (BUSL, FSL, ELv2, Commons Clause), CC-BY-NC-ND, **or no LICENSE file at all**. An unlicensed repo is all-rights-reserved, not free.
+
+`spdx` below is the SPDX id implied by the **LICENSE text that was actually fetched and read**, not
+the GitHub API's `license.spdx_id`. Where the two disagreed the text won, and every such disagreement
+is recorded in the originating category YAML header.
+
+---
+
+## Vendorable sources (283)
+
+Code may be copied and adapted into generated repositories. Grouped by the category that owns the
+canonical entry; a source listed under two categories is cross-referenced in both.
+
+
+### agent-tooling
+
+| source | stars | spdx | stack | complexity | what to borrow |
+|---|---:|---|---|---|---|
+| [obra/superpowers](https://github.com/obra/superpowers) | 257066 | MIT |  | - | The highest-value vendorable skills collection found, and one of very few that already ships per-harness installers for Claude Code, Codex CLI, Cursor, OpenCode, Antigravity, Factory Droid, Copilot CLI, Kimi Code and Pi — ... |
+| [github/spec-kit](https://github.com/github/spec-kit) | 122114 | MIT |  | - | Two distinct assets. First, the spec-driven workflow itself — /specify -> /plan -> /tasks — as the reference implementation of turning a spec into an executable agent workflow. Second, and more valuable to us, AGENTS.md is the ... |
+| [punkpeye/awesome-mcp-servers](https://github.com/punkpeye/awesome-mcp-servers) | 90934 | MIT |  | - | The largest MCP directory that is also MIT, which makes it the one whose categorization we can legally reuse. Borrow its category axis and its per-entry legend marking transport (stdio/SSE), implementation language, and platform ... |
+| [modelcontextprotocol/servers](https://github.com/modelcontextprotocol/servers) | 88611 | Apache-2.0 |  | - | The canonical reference servers maintained by the MCP steering group — the authoritative implementations of the servers Groundplan should offer by default (filesystem, git, fetch, memory, sequential thinking, time). Borrow their ... |
+| [bmad-code-org/BMAD-METHOD](https://github.com/bmad-code-org/BMAD-METHOD) | 50775 | MIT |  | - | A large, MIT, actively-developed multi-agent methodology with a defined role set — Analyst, PM, Architect, Scrum Master, Developer, QA — and, more usefully, explicit handoff artifacts between them (brief -> PRD -> architecture -> ... |
+| [PatrickJS/awesome-cursorrules](https://github.com/PatrickJS/awesome-cursorrules) | 40355 | CC0-1.0 |  | - | Hundreds of per-stack rule files released into the public domain, so they can be vendored, edited, and relicensed with no attribution obligation whatsoever. This is the cheapest way to populate Groundplan's per-stack rule layer ... |
+| [wshobson/agents](https://github.com/wshobson/agents) | 38023 | MIT |  | - | This repo IS a one-source-of-truth-to-many-harnesses compiler, which is Groundplan's exact architecture, already load-bearing at 203 agents / 175 skills / 94 plugins. Steal the design wholesale. `plugins/` is the single source; ... |
+| [github/awesome-copilot](https://github.com/github/awesome-copilot) | 36746 | MIT |  | - | GitHub's own MIT-licensed collection, and the single best source for the Copilot target. Structurally it has already converged on the same four artifact types Groundplan emits — Agents, Instructions, Skills, and Plugins (bundles ... |
+| [microsoft/playwright-mcp](https://github.com/microsoft/playwright-mcp) | 35238 | Apache-2.0 |  | - | The browser-automation server, and the best worked argument for structured over visual context: it drives pages via the accessibility tree rather than screenshots, so it works with any model and costs a fraction of the tokens. ... |
+| [github/github-mcp-server](https://github.com/github/github-mcp-server) | 31532 | MIT |  | - | GitHub's own first-party server and the one every default MCP config should include. Its standout borrowable idea is toolset gating — the ability to enable only subsets (repos, issues, pull requests, actions, code security) ... |
+| [modelcontextprotocol/python-sdk](https://github.com/modelcontextprotocol/python-sdk) | 23650 | MIT |  | - | The Python counterpart, and cleanly MIT with no transition caveat. Its FastMCP-style decorator API turns a plain function plus type hints into a schema-complete tool, which is the lowest-ceremony MCP server template we can offer ... |
+| [VoltAgent/awesome-claude-code-subagents](https://github.com/VoltAgent/awesome-claude-code-subagents) | 23474 | MIT |  | - | 154 MIT-licensed subagent definitions filed under a stable numbered taxonomy — categories/01-core-development/ through categories/09-meta-orchestration/ — where each agent is one self-contained markdown file. Concretely useful ... |
+| [agentskills/agentskills](https://github.com/agentskills/agentskills) | 23184 | Apache-2.0 |  | - | The normative Agent Skills specification — docs/specification.mdx. This is the single most load-bearing document for Groundplan's skill layer, and it is Apache-2.0, unlike Anthropic's own skills repo. Borrow the frontmatter ... |
+| [agentsmd/agents.md](https://github.com/agentsmd/agents.md) | 23086 | MIT |  | - | The AGENTS.md format definition and its worked examples from README.md. The value is the conventions, not the prose: a single root AGENTS.md, nested AGENTS.md files in subdirectories where the nearest-ancestor file wins, and the ... |
+| [modelcontextprotocol/registry](https://github.com/modelcontextprotocol/registry) | 7044 | Apache-2.0 |  | - | The official registry's server-metadata schema — how an MCP server declares its identity, package/runtime, transport, and configuration inputs. If Groundplan emits MCP config for 14 tools, resolving servers against this schema ... |
+| [steipete/agent-rules](https://github.com/steipete/agent-rules) | 5691 | MIT |  | - | Its premise is the one that matters most to us: the same rule file should work across Claude Code and Cursor rather than being authored twice. That cross-tool framing is rarer than it should be, and it makes this the most ... |
+| [wong2/awesome-mcp-servers](https://github.com/wong2/awesome-mcp-servers) | 4214 | MIT |  | - | A deliberately smaller, more curated MIT list. Its value relative to punkpeye is precision: use the intersection of the two as a quality signal when picking which servers earn a place in a default profile. |
+| [Pimzino/claude-code-spec-workflow](https://github.com/Pimzino/claude-code-spec-workflow) | 3798 | MIT |  | - | An MIT implementation of the requirements -> design -> tasks -> implementation spec chain as installable slash commands, with document state persisted to disk between phases. Useful as the small, vendorable counterweight to ... |
+| [sanjeed5/awesome-cursor-rules-mdc](https://github.com/sanjeed5/awesome-cursor-rules-mdc) | 3553 | CC0-1.0 |  | - | CC0 rules already authored natively in the .mdc format rather than converted from legacy .cursorrules, so the frontmatter is consistent and machine-parseable across the whole set. That consistency makes it the better bulk-import ... |
+| [crystaldba/postgres-mcp](https://github.com/crystaldba/postgres-mcp) | 3081 | MIT |  | - | The strongest Postgres MCP server now that the reference one is retired, and the right default for any template scaffolding Postgres. Two things to borrow beyond the server itself: its explicit access-control model with a genuine ... |
+| [brennercruvinel/CCPlugins](https://github.com/brennercruvinel/CCPlugins) | 2700 | MIT |  | - | A flat commands/ directory of professional-workflow slash commands plus, more usefully, a complete install/uninstall story in four scripts — install.py, install.sh, uninstall.py, uninstall.sh. Clean uninstall is the part almost ... |
+| [wshobson/commands](https://github.com/wshobson/commands) | 2573 | MIT |  | - | 57 MIT command definitions split into a genuinely useful two-tier taxonomy: tools/ (42 single-purpose commands) versus workflows/ (15 multi-agent orchestrations). That tool-vs-workflow distinction is the cleanest articulation of ... |
+| [lst97/claude-code-sub-agents](https://github.com/lst97/claude-code-sub-agents) | 1619 | MIT |  | - | A coherent full-stack-oriented agent set assembled for one person's real workflow, which makes its inter-agent handoffs more considered than the big scraped collections. Useful as a worked example of a small, opinionated agent ... |
+| [obra/superpowers-marketplace](https://github.com/obra/superpowers-marketplace) | 1162 | MIT |  | - | A minimal, readable implementation of the plugin-marketplace manifest — the index format that maps plugin ids to source repos and versions. Worth borrowing as the shape of Groundplan's own registry index if we ever publish one ... |
+| [0xfurai/claude-code-subagents](https://github.com/0xfurai/claude-code-subagents) | 961 | MIT |  | - | 100+ narrowly-scoped, one-domain-per-agent definitions. Its useful contribution is granularity: agents are scoped to a single language or library rather than a job title, which makes them far easier to auto-select and far less ... |
+| [ccplugins/awesome-claude-code-plugins](https://github.com/ccplugins/awesome-claude-code-plugins) | 882 | Apache-2.0 |  | - | The rare permissively-licensed curated list in this space, which makes it the one directory whose taxonomy we can actually copy. Its framing — a plugin is a bundle that may contain slash commands, subagents, MCP servers, and ... |
+| [TensorBlock/awesome-mcp-servers](https://github.com/TensorBlock/awesome-mcp-servers) | 788 | MIT |  | - | Breadth at machine scale — it indexes roughly 7.7k unique server links, far more than any hand-curated list, and it is MIT. Useful specifically as a coverage check: if Groundplan believes no MCP server exists for some capability, ... |
+| [obra/superpowers-skills](https://github.com/obra/superpowers-skills) | 727 | MIT |  | - | Only useful as a frozen, MIT-clean snapshot of community skills at the point the community -editable fork was retired. If a skill you want from obra/superpowers has murky contribution history, the same file here is a cleaner ... |
+| [karanb192/claude-code-hooks](https://github.com/karanb192/claude-code-hooks) | 449 | MIT |  | - | Real, tested, MIT hook scripts with named files rather than blog-post snippets. PreToolUse: hook-scripts/pre-tool-use/block-dangerous-commands.js (rm -rf ~, fork bombs, curl/sh), protect-secrets.js (blocks ... |
+| [cyanheads/git-mcp-server](https://github.com/cyanheads/git-mcp-server) | 228 | Apache-2.0 |  | - | A maintained, permissively-licensed standalone git MCP server covering the full porcelain surface (status, diff, branch, commit, stash, tags, remotes) — useful as the git option in an emitted config when the reference server's ... |
+| [ithiria894/awesome-claude-code-hooks](https://github.com/ithiria894/awesome-claude-code-hooks) | 18 | CC0-1.0 |  | - | The only hook directory we found that is both curated and CC0, so its taxonomy can be copied outright. Its category set is a ready-made spine for Groundplan's hook registry: Security and Prompt Injection, Safety and Protection, ... |
+| [mafiaguy/claude-security-guardrails](https://github.com/mafiaguy/claude-security-guardrails) | 2 | MIT |  | - | The enumerated block-list is the borrowable asset, not the implementation: rm -rf, force pushes, leaked API keys, SQL injection, eval(), and ~30 further risky patterns, wired through PreToolUse and PostToolUse. Use it as a ... |
+
+### agent-tooling, ai-llm
+
+| source | stars | spdx | stack | complexity | what to borrow |
+|---|---:|---|---|---|---|
+| [openai/openai-agents-python](https://github.com/openai/openai-agents-python) | 27995 | MIT |  | - | A root AGENTS.md on a large, genuinely active production library — the useful kind of exemplar, because it is maintained under real contribution pressure rather than written once for show. Borrow the concrete-commands-over-prose ... |
+| [modelcontextprotocol/typescript-sdk](https://github.com/modelcontextprotocol/typescript-sdk) | 12884 | Apache-2.0 |  | - | The SDK Groundplan's own templates should scaffold against for any TypeScript MCP server, and the reference for MCP prompts and resources — the two primitives most collections ignore in favor of tools. MCP prompts are the closest ... |
+
+### ai-llm
+
+| source | stars | spdx | stack | complexity | what to borrow |
+|---|---:|---|---|---|---|
+| [langchain-ai/langgraph](https://github.com/langchain-ai/langgraph) | 37569 | MIT | Python + JS, graph runtime, Postgres/SQLite checkpointers | professional | The durable-execution model for agents that must survive restarts. Borrow the `StateGraph` + reducer-annotated state (`Annotated[list, add_messages]`), the checkpointer interface with its `langgraph-checkpoint-postgres` and ... |
+| [qdrant/qdrant](https://github.com/qdrant/qdrant) | 33379 | Apache-2.0 | Rust server; gRPC + REST; official Python/JS/Go/Rust clients | professional | The production rung for a dedicated vector service. Borrow the deployment surface, not the source: a `docker-compose.yml` pinned to a version with a named volume, a `config.yaml` override for storage and optimizer settings, and ... |
+| [langfuse/langfuse](https://github.com/langfuse/langfuse) | 31381 | MIT | TypeScript, Next.js, tRPC, Postgres + ClickHouse + Redis + ... | enterprise | The self-hostable LLM observability stack. Borrow the OTel-based tracing integration (traces/spans/generations with token and cost attribution), the prompt-management API — versioned, labelled prompts fetched at runtime with a ... |
+| [chroma-core/chroma](https://github.com/chroma-core/chroma) | 28821 | Apache-2.0 | Rust core with Python and TypeScript clients; embedded or ... | simple | The lowest-friction vector store, and the right choice for the simple rung: `PersistentClient(path=...)` gives a working RAG demo with no container and no service to run. Borrow the collection API (`add`/`query` with documents, ... |
+| [PrefectHQ/fastmcp](https://github.com/PrefectHQ/fastmcp) | 26253 | Apache-2.0 | Python 3.10+, pydantic, httpx, uv | professional | The most complete Python MCP server framework. Borrow the decorator surface (`@mcp.tool`, `@mcp.resource("uri://{param}")`, `@mcp.prompt`) with automatic schema generation from type hints, the auth provider set (OAuth proxy, JWT, ... |
+| [vercel/ai](https://github.com/vercel/ai) | 25631 | Apache-2.0 | TypeScript monorepo, provider packages, React/Svelte/Vue ... | professional | Depend on the package; borrow the patterns from `examples/`. Specifically `examples/next-openai` route handlers for `streamText`, `generateObject` (zod-validated structured output), tool definitions with `inputSchema`, and ... |
+| [promptfoo/promptfoo](https://github.com/promptfoo/promptfoo) | 23389 | MIT | TypeScript/Node CLI, YAML config, GitHub Actions integration | standard | Declarative, config-first evals — the natural fit for a scaffolder because the deliverable is a single file. Borrow the `promptfooconfig.yaml` schema (providers × prompts × tests, with `assert` blocks), the assertion taxonomy ... |
+| [pgvector/pgvector](https://github.com/pgvector/pgvector) | 22242 | PostgreSQL | C Postgres extension; clients for Python, Node, Go, Rust, ... | standard | The default answer for teams that already run Postgres and do not want a second datastore. Borrow the migration shape — `CREATE EXTENSION vector`, a `vector(1536)` column, then an HNSW index (`USING hnsw (embedding ... |
+| [vercel/chatbot](https://github.com/vercel/chatbot) | 20639 | Apache-2.0 | TypeScript, Next.js 15 (App Router), AI SDK 5, Drizzle, ... | standard | The reference full-stack AI chat app. Adapt `app/(chat)/api/chat/route.ts` (streaming POST handler, resumable stream ids, stop/regenerate), `lib/db/schema.ts` (chat, message, vote, document tables — a proven message-persistence ... |
+| [pydantic/pydantic-ai](https://github.com/pydantic/pydantic-ai) | 18636 | MIT | Python 3.9+, pydantic v2, FastAPI-friendly, OpenTelemetry | standard | The typed-agent pattern: `Agent[DepsType, OutputType]` with dependency injection via `RunContext`, so tools receive a typed deps object (db pool, http client) instead of reaching for globals — the cleanest testability story in ... |
+| [confident-ai/deepeval](https://github.com/confident-ai/deepeval) | 16937 | Apache-2.0 | Python, pytest integration, LLM-as-judge metrics | standard | Evals as unit tests — the Python counterpart to promptfoo. Borrow the pytest integration (`assert_test(test_case, [metric])` in a normal `test_*.py`, run via `deepeval test run`), which means eval failures surface in the same CI ... |
+| [assistant-ui/assistant-ui](https://github.com/assistant-ui/assistant-ui) | 11147 | MIT | TypeScript, React, Radix-style headless primitives, ... | standard | Headless chat primitives (`Thread`, `Composer`, `MessagePrimitive`, `BranchPicker`) that cleanly separate chat state from styling — the right shape for a template that must restyle per project. Borrow the runtime-adapter ... |
+| [Azure-Samples/azure-search-openai-demo](https://github.com/Azure-Samples/azure-search-openai-demo) | 7708 | MIT | Python (Quart) backend, React/TypeScript frontend, Bicep + ... | enterprise | The most complete open reference for regulated-context RAG. Borrow `app/backend/approaches/` — `retrievethenread.py` and `chatreadretrieveread.py` are the two canonical RAG topologies written out cleanly, including query ... |
+| [cloudflare/agents-starter](https://github.com/cloudflare/agents-starter) | 1294 | MIT | TypeScript, Cloudflare Workers, Durable Objects, agents ... | simple | A genuinely small, complete edge-agent template — the whole repo is close to template-shaped already. Borrow `src/server.ts` (an `AIChatAgent` subclass whose per-conversation state lives in a Durable Object, giving stateful chat ... |
+
+### auth
+
+| source | stars | spdx | stack | complexity | what to borrow |
+|---|---:|---|---|---|---|
+| [keycloak/keycloak](https://github.com/keycloak/keycloak) | 35722 | Apache-2.0 | java | enterprise | The default when the requirement sheet says SAML, LDAP/AD federation, identity brokering, fine-grained admin delegation or regulated-environment audit. Borrow `quarkus/container/Dockerfile` (the official image build, and the ... |
+| [better-auth/better-auth](https://github.com/better-auth/better-auth) | 29222 | MIT | typescript | standard | The default recommendation for any new TypeScript project in 2026, and the richest single source in this category. Borrow the plugin composition model from `packages/better-auth/src/plugins/` — 28 first-party plugins that map ... |
+| [authelia/authelia](https://github.com/authelia/authelia) | 28318 | Apache-2.0 | go | professional | The best single-file example of declarative authorization config: `config.template.yml` covers `access_control` rules (per-domain, per-resource, per-subject policies of bypass / one_factor / two_factor / deny), session config ... |
+| [nextauthjs/next-auth](https://github.com/nextauthjs/next-auth) | 28309 | ISC | typescript | standard | The most valuable asset is data, not runtime: `packages/core/src/providers/` holds 80+ hand-maintained OAuth/OIDC provider configs (endpoints, scopes, profile-claim mapping) that are tedious to write and easy to lift. Also borrow ... |
+| [casbin/casbin](https://github.com/casbin/casbin) | 20255 | Apache-2.0 | go | simple | The `examples/` directory is the payload, not the Go code: model.conf + policy.csv pairs that encode every common authorization shape as data you can drop into a template — `basic_model`, `rbac_model`, `rbac_with_domains` ... |
+| [ory/hydra](https://github.com/ory/hydra) | 17407 | Apache-2.0 | go | professional | A certified OAuth 2.1 / OIDC provider that deliberately owns no users — it delegates login and consent to your app over a documented handshake. Borrow the docker-compose quickstart and, more importantly, the login/consent app ... |
+| [oauth2-proxy/oauth2-proxy](https://github.com/oauth2-proxy/oauth2-proxy) | 14679 | MIT | go | simple | The "add SSO without touching the app" layer. Borrow `contrib/oauth2-proxy.cfg.example` as the config template, `contrib/oauth2-proxy.service.example` for bare-metal systemd deploys, and `contrib/local-environment/` for the ... |
+| [ory/kratos](https://github.com/ory/kratos) | 13768 | Apache-2.0 | go | professional | Headless identity management — the API-first alternative to bolting auth into the app. Borrow `contrib/quickstart/kratos/email-password/kratos.yml` (self-service flow config: registration, login, recovery, verification, settings, ... |
+| [lucia-auth/lucia](https://github.com/lucia-auth/lucia) | 10460 | MIT AND 0BSD | typescript | simple | Lucia is no longer a library — since March 2025 it is a reference implementation of session auth you copy into your own project, which is exactly what a scaffolder wants. Borrow the session primitive: generate a random token, ... |
+| [fullstackhero/dotnet-starter-kit](https://github.com/fullstackhero/dotnet-starter-kit) | 6653 | MIT | dotnet | professional | The best worked example of application-level auth in .NET 10 rather than a protocol library. Borrow the JWT issuance + refresh-token rotation pipeline, the fine-grained permission model (permission claims + a policy provider, ... |
+| [openfga/openfga](https://github.com/openfga/openfga) | 5451 | Apache-2.0 | go | professional | Google Zanzibar-style relationship-based authorization, and the modern answer for anything with sharing, nesting or inherited permissions. Borrow `docker-compose.yaml` (server + Postgres + playground) as the local dev layer, the ... |
+| [openiddict/openiddict-core](https://github.com/openiddict/openiddict-core) | 5199 | Apache-2.0 | dotnet | professional | The free OAuth 2.0 / OIDC stack for .NET, and the natural companion to ASP.NET Core Identity. `src/` splits cleanly into layers a template can select independently: `OpenIddict.Server` + `.Server.AspNetCore` (issue tokens), ... |
+| [panva/node-oidc-provider](https://github.com/panva/node-oidc-provider) | 3775 | MIT | node | standard | OpenID Certified™ authorization server you can embed in a Node app — the right answer when the template needs to *issue* tokens rather than consume them. `example/` ships three deployment shapes to lift directly: Koa-embedded, ... |
+| [supabase/auth](https://github.com/supabase/auth) | 2498 | MIT | go | standard | The self-hostable auth server behind Supabase, and the only credible way to get Supabase-shaped auth without the SaaS. Borrow `migrations/` (the `auth` schema: users, identities, sessions, refresh_tokens, mfa_factors — a ... |
+| [MasterKale/SimpleWebAuthn](https://github.com/MasterKale/SimpleWebAuthn) | 2286 | MIT | typescript | simple | The cleanest reference for passkeys as a standalone concern. Two packages: `@simplewebauthn/server` (generateRegistrationOptions / verifyRegistrationResponse / generateAuthenticationOptions / verifyAuthenticationResponse) and ... |
+
+### backend-api
+
+| source | stars | spdx | stack | complexity | what to borrow |
+|---|---:|---|---|---|---|
+| [fastapi/fastapi](https://github.com/fastapi/fastapi) | 100631 | MIT | python | simple | `docs_src/` is an underused asset: several hundred tiny, individually runnable, MIT example apps, each isolating exactly one concern, which is close to a ready-made layer library. Confirmed useful anchors are ... |
+| [realworld-apps/realworld](https://github.com/realworld-apps/realworld) | 83859 | MIT | polyglot | standard | Not a starter — a fixed specification plus an index of implementations of the same medium-clone API across roughly every backend stack. Its value to a scaffolder is calibration and testing, and that value is high. Borrow the API ... |
+| [nestjs/nest](https://github.com/nestjs/nest) | 76141 | MIT | typescript | standard | The `sample/` directory is the real prize — 30+ numbered, independently runnable, MIT-licensed mini-applications that map almost one-to-one onto scaffolder layers. Confirmed present and directly adaptable: `sample/01-cats-app` ... |
+| [expressjs/express](https://github.com/expressjs/express) | 69223 | MIT | nodejs | simple | Value here is entirely in `examples/`, which is a set of small, self-contained, MIT apps that read like reference templates. Three are worth adapting directly and were confirmed present: `examples/mvc/index.js` (a ... |
+| [honojs/hono](https://github.com/honojs/hono) | 31392 | MIT | typescript | simple | The smallest credible modern TS API surface — a Hono app is a single `src/index.ts` exporting `app`, which makes it the ideal "simple" rung and the one template that deploys unchanged to Node, Bun, Deno, Cloudflare Workers, and ... |
+| [ardalis/CleanArchitecture](https://github.com/ardalis/CleanArchitecture) | 18343 | MIT | dotnet | professional | The most disciplined .NET clean-architecture reference and the better of the two for DDD-shaped domains. Verified anchors: `src/Clean.Architecture.Core/ContributorAggregate/ Contributor.cs`, ... |
+| [dotnet/eShop](https://github.com/dotnet/eShop) | 10687 | MIT | dotnet | enterprise | Microsoft's own current reference application and the best available model of what a serious multi-service .NET system looks like in 2026. Verified anchors: `src/eShop.AppHost/Program.cs`, `src/Catalog.API/Program.cs`, root ... |
+| [litestar-org/litestar](https://github.com/litestar-org/litestar) | 8342 | MIT | python | standard | The strongest argument for a second Python rung, because it supplies natively the pieces every FastAPI template hand-rolls. Borrow the layered-parameters model: dependencies, guards, and middleware declared at app / router / ... |
+| [evrone/go-clean-template](https://github.com/evrone/go-clean-template) | 7633 | MIT | go | professional | The most production-shaped Go template in this list and the most actively maintained (pushed today). Verified anchors: `cmd/app/main.go`, `internal/app/app.go`, `pkg/httpserver/server.go`, `Makefile`, `docker-compose.yml`. The ... |
+| [amitshekhariitbhu/go-backend-clean-architecture](https://github.com/amitshekhariitbhu/go-backend-clean-architecture) | 6120 | Apache-2.0 | go | standard | The clearest small Go clean-architecture layout of the current crop, and every layer is one obvious directory, which is exactly what a scaffolder wants to add or omit. Verified structure: `domain/` holds both entities and the ... |
+| [goravel/goravel](https://github.com/goravel/goravel) | 4789 | MIT | go | professional | A genuinely different point in the design space: a Laravel-shaped, batteries-included Go application skeleton rather than a bare layout. Confirmed to be the skeleton and not the framework core — `go.mod` declares `module goravel` ... |
+
+### backend-api, database-orm
+
+| source | stars | spdx | stack | complexity | what to borrow |
+|---|---:|---|---|---|---|
+| [fastapi/full-stack-fastapi-template](https://github.com/fastapi/full-stack-fastapi-template) | 44304 | MIT | python | professional | The official, actively maintained Python reference and the highest-signal source in this category. Verified layout: `backend/app/main.py`, `backend/app/api/deps.py`, `backend/app/core/config.py`, `backend/app/core/security.py`, ... |
+| [jasontaylordev/CleanArchitecture](https://github.com/jasontaylordev/CleanArchitecture) | 20343 | MIT | dotnet | professional | The pragmatic counterpart to Ardalis and the better default for most .NET teams, largely because it ships as a real `dotnet new ca-sln` template — so it is already proof that this architecture can be parameterized, which is ... |
+| [brocoders/nestjs-boilerplate](https://github.com/brocoders/nestjs-boilerplate) | 4348 | MIT | typescript | professional | The most complete NestJS starter still under active maintenance, and unusually well-suited to a layering tool because it was built to be database-agnostic. Verified anchors: `src/main.ts`, `src/auth/auth.service.ts`, ... |
+
+### backend-api, observability
+
+| source | stars | spdx | stack | complexity | what to borrow |
+|---|---:|---|---|---|---|
+| [microsoft/aspire](https://github.com/microsoft/aspire) | 6172 | MIT | dotnet | enterprise | Not an API template — the orchestration and local-dev layer that a .NET (and increasingly polyglot) template should sit on, pushed today and evolving fast. Borrow the AppHost model: infrastructure declared as typed C# ... |
+
+### cms-ecommerce
+
+| source | stars | spdx | stack | complexity | what to borrow |
+|---|---:|---|---|---|---|
+| [TryGhost/Ghost](https://github.com/TryGhost/Ghost) | 54465 | MIT | Node, Express, Knex, MySQL/SQLite, Ember admin, Handlebars ... | professional | Ghost is the most battle-tested MIT publishing platform here and its value for Groundplan is the *subsystems*, not the monolith. Borrow the members/subscriptions implementation — magic-link email auth with no passwords, tiers, ... |
+| [payloadcms/payload](https://github.com/payloadcms/payload) | 43666 | MIT | TypeScript, Next.js 15, Drizzle/Mongoose, React admin | professional | The `templates/` directory of the monorepo is the single most directly harvestable asset in this whole category — verified to contain `blank`, `website`, `ecommerce`, `plugin`, `with-postgres`, `with-vercel-postgres`, ... |
+| [saleor/saleor](https://github.com/saleor/saleor) | 23109 | BSD-3-Clause | Python, Django, GraphQL (Graphene), Postgres, Celery | enterprise | The enterprise rung of the ladder and the only serious non-JavaScript option here, which is worth keeping for stack diversity. BSD-3-Clause is cleanly vendorable provided you carry the copyright notice. Borrow the GraphQL-first ... |
+| [vercel/commerce](https://github.com/vercel/commerce) | 14155 | MIT | TypeScript, Next.js App Router, Tailwind, Shopify ... | simple | The cleanest small reference storefront in the category and the best `simple` commerce rung. Everything backend-facing is confined to `lib/shopify/` (a typed fetch wrapper, GraphQL fragments and normalising mappers), so the swap ... |
+| [keystonejs/keystone](https://github.com/keystonejs/keystone) | 9920 | MIT | TypeScript, Node, Prisma, GraphQL, React admin | standard | The `list()`/`field` schema DSL that emits a full CRUD GraphQL API plus an admin UI from one declaration — the tightest schema-to-API mapping among the MIT-licensed options. Borrow the access-control model specifically: `access: ... |
+| [sanity-io/sanity](https://github.com/sanity-io/sanity) | 6218 | MIT | TypeScript, React, Sanity Studio v4 | professional | Schema-definition ergonomics: `defineType`/`defineField`/`defineArrayMember` give fully typed content models with autocomplete, and are worth copying as a pattern even for a non-Sanity CMS layer. The Studio's `sanity.config.ts` ... |
+| [nuxt/content](https://github.com/nuxt/content) | 3652 | MIT | TypeScript, Nuxt 3/4, Vue, SQLite/D1 | simple | The file-based-content answer for the Vue half of the ladder, and the natural counterpart to Keystatic in a framework-diverse catalog. Borrow the `content.config.ts` collection schema (Zod-validated frontmatter — invalid ... |
+| [Thinkmill/keystatic](https://github.com/Thinkmill/keystatic) | 2221 | MIT | TypeScript, React, Markdoc/MDX, Git-backed storage | simple | The best `simple` tier entry in this category. `keystatic.config.ts` defines collections and singletons in ~40 lines and the entire content store is Markdown/JSON files in the repo — no database, no migrations, no running ... |
+| [Shopify/hydrogen](https://github.com/Shopify/hydrogen) | 2065 | MIT | TypeScript, React Router 7 (ex-Remix), Vite, Oxygen edge ... | standard | `templates/skeleton/` is a verified, deliberately minimal starter (confirmed present, along with `templates/skeleton/app/lib/context.ts`) and is exactly the shape a scaffolding tool wants — Shopify maintains it as the `npm create ... |
+| [saleor/saleor-dashboard](https://github.com/saleor/saleor-dashboard) | 1014 | BSD-3-Clause | TypeScript, React, Apollo Client, Vite, MacawUI | enterprise | A production admin console for a complex domain, useful as a reference for any enterprise-tier admin layer regardless of backend. Borrow the saved-views/filter-preset pattern (complex list filters serialised into the URL so views ... |
+
+### cms-ecommerce, payments-billing
+
+| source | stars | spdx | stack | complexity | what to borrow |
+|---|---:|---|---|---|---|
+| [medusajs/medusa](https://github.com/medusajs/medusa) | 35221 | MIT | TypeScript, Node, Postgres, MikroORM, React admin | professional | The strongest genuinely-MIT commerce backend available — no dual-license asterisk, which after Vendure's GPL move and Directus's MSCL move makes it the default pick for a vendorable commerce layer. Verified package layout is ... |
+
+### data-engineering
+
+| source | stars | spdx | stack | complexity | what to borrow |
+|---|---:|---|---|---|---|
+| [apache/airflow](https://github.com/apache/airflow) | 46168 | Apache-2.0 | python | enterprise | The default answer in regulated and large environments — worth a layer for institutional reasons even where Dagster or Prefect is technically nicer, because it is what audit and platform teams already accept. Borrow the ... |
+| [pola-rs/polars](https://github.com/pola-rs/polars) | 39041 | MIT | rust, python | standard | The DataFrame engine for the transform step when the work is genuinely Python rather than SQL. LICENSE was read in full: it is MIT text (Copyright Ritchie Vink, with an NVIDIA portions notice), despite the repo's size making ... |
+| [dagster-io/dagster](https://github.com/dagster-io/dagster) | 15860 | Apache-2.0 | python | professional | Asset-centric orchestration — you declare the tables that should exist and the graph is derived, which is a materially better fit for template generation than declaring tasks. examples/ is the richest per-topic starter collection ... |
+| [debezium/debezium](https://github.com/debezium/debezium) | 12929 | Apache-2.0 | java, kafka | enterprise | The reference implementation of log-based CDC, and the source of the change-event envelope that most of the ecosystem has standardised on: before / after / source / op / ts_ms. Borrow that envelope shape for any ... |
+| [fivetran/great_expectations](https://github.com/fivetran/great_expectations) | 11653 | Apache-2.0 | python | enterprise | The most complete standalone data-validation vocabulary — the right choice when validation must cover sources dbt never sees (files landing in object storage, API payloads, a pre-load staging area). Borrow the four-object model: ... |
+| [dlt-hub/dlt](https://github.com/dlt-hub/dlt) | 5629 | Apache-2.0 | python | standard | Schema evolution and incremental loading as library code rather than platform features — the missing ingestion half that jaffle_shop_duckdb has no answer for. docs/examples/ is an unusually large, runnable pattern library ... |
+| [delta-io/delta-rs](https://github.com/delta-io/delta-rs) | 3263 | Apache-2.0 | rust, python | standard | ACID table semantics without a cluster — the storage half of a bronze/silver/gold layer. Verified python/deltalake/ modules: table.py (DeltaTable — the read/write/history/vacuum surface), transaction.py (the commit protocol, ... |
+| [SQLMesh/sqlmesh](https://github.com/SQLMesh/sqlmesh) | 3204 | Apache-2.0 | python, sql | professional | The strongest available answer to the problem dbt leaves open — knowing what a SQL change actually breaks before it runs. Borrow the plan/apply workflow (column-level lineage diffing a change against the deployed state, then ... |
+| [elementary-data/elementary](https://github.com/elementary-data/elementary) | 2379 | Apache-2.0 | python, dbt, sql, jinja | standard | The data-observability layer that rides on dbt artifacts instead of a separate agent — the cheapest credible way to give a generated project anomaly detection and alerting. The whole mechanism is a dbt package inside the repo: ... |
+| [dbt-labs/dbt-utils](https://github.com/dbt-labs/dbt-utils) | 1779 | Apache-2.0 | dbt, sql, jinja | simple | The generic-test vocabulary that every serious dbt project depends on, and the single highest-leverage dependency to pin in a data-dbt layer. Borrow the packages.yml dependency block and the schema.yml test idioms it unlocks: ... |
+| [duckdb/dbt-duckdb](https://github.com/duckdb/dbt-duckdb) | 1317 | Apache-2.0 | python, dbt, duckdb, sql | standard | The adapter that makes a credential-free dbt layer viable, plus the clearest worked examples of DuckDB-as-lakehouse. The functional test suite doubles as a spec — verified files under tests/functional/adapter/: test_external.py ... |
+| [astronomer/astronomer-cosmos](https://github.com/astronomer/astronomer-cosmos) | 1232 | Apache-2.0 | python, airflow, dbt | professional | It parses a dbt project and expands each model into its own Airflow task, so failures are per-model instead of one opaque "dbt run failed" — that expansion is the pattern worth taking. The genuinely reusable asset is ... |
+| [apache/iceberg-python](https://github.com/apache/iceberg-python) | 1097 | Apache-2.0 | python | professional | The catalog abstraction, which is the part of Iceberg that actually determines whether a template is portable. Verified pyiceberg/catalog/ modules: sql.py, hive.py, glue.py, dynamodb.py, bigquery_metastore.py, memory.py, noop.py ... |
+| [dbt-labs/dbt-project-evaluator](https://github.com/dbt-labs/dbt-project-evaluator) | 567 | Apache-2.0 | dbt, sql, jinja | standard | dbt Labs' own executable opinion about what a well-formed dbt project looks like — it reads the manifest and flags violations, which is exactly the rule set a Groundplan dbt layer should be generated to satisfy from the start. ... |
+| [dbt-labs/jaffle_shop_duckdb](https://github.com/dbt-labs/jaffle_shop_duckdb) | 280 | Apache-2.0 | dbt, duckdb, sql, python | simple | The smallest complete dbt project that actually runs, and the correct simple-tier base. Note the default branch is `duckdb`, not main/master. Verified tree (36 files): dbt_project.yml, profiles.yml checked into the repo root ... |
+
+### database-orm
+
+| source | stars | spdx | stack | complexity | what to borrow |
+|---|---:|---|---|---|---|
+| [gorm](https://github.com/go-gorm/gorm) | 39872 | MIT | go | standard | The full-ORM counterweight to sqlc for Go, and the broader dialect set: separate driver packages for postgres, mysql, sqlite and sqlserver behind one gorm.Open call. Borrow the gorm.Model embedded struct ... |
+| [drizzle-orm](https://github.com/drizzle-team/drizzle-orm) | 35183 | Apache-2.0 | typescript | standard | The single richest source of DB-choice breadth in the category. Verified driver modules under drizzle-orm/src/: node-postgres, postgres-js, neon-http, neon-serverless, planetscale-serverless, d1, libsql, supabase, ... |
+| [Dapper](https://github.com/DapperLib/Dapper) | 18353 | Apache-2.0 | dotnet | simple | The .NET micro-ORM tier: extension methods over IDbConnection, so it works against SQL Server, Postgres, MySQL and SQLite with the same code and no model layer. Borrow the Query/Execute call shape, the multi-mapping (splitOn) ... |
+| [sqlc](https://github.com/sqlc-dev/sqlc) | 18029 | MIT | go | standard | The SQL-first inversion of the ORM: you write .sql, it generates type-safe Go. Borrow the sqlc.yaml config shape (engine + sql_package selection — pgx/v5 vs database/sql is a single field, which maps cleanly onto a Groundplan ... |
+| [ioredis](https://github.com/redis/ioredis) | 15311 | MIT | typescript | simple | Redis coverage with a permissive license, which the Redis server itself no longer offers. Borrow the connection-options and retryStrategy/reconnectOnError config shape, the Cluster and Sentinel constructor patterns for the HA ... |
+| [kysely](https://github.com/kysely-org/kysely) | 14058 | MIT | typescript | simple | The strip-down option for the bottom of the complexity ladder: a typed SQL query builder with no codegen step, no CLI, no runtime engine — types come from a hand-written or introspected Database interface. Borrow the Dialect ... |
+| [atlas](https://github.com/ariga/atlas) | 8586 | Apache-2.0 | go | professional | The language-agnostic, declarative migration layer: you declare desired schema (HCL or plain SQL) and Atlas plans the diff, which suits a scaffolding tool better than per-ORM migration CLIs. Borrow the atlas.hcl env/config ... |
+| [prisma-examples](https://github.com/prisma/prisma-examples) | 6647 | Apache-2.0 | typescript | standard | Official, ready-to-run, per-database example projects — the closest thing in this category to pre-built Groundplan layers. Verified subdirectories under databases/: cockroachdb, mongodb, sql-server, turso, postgresql-supabase, ... |
+| [alembic](https://github.com/sqlalchemy/alembic) | 4263 | MIT | python | standard | The migration engine both Python templates above depend on, from the SQLAlchemy org. Borrow its env.py templates (it ships generic, async and multidb variants — the multidb template is directly relevant to a multi-database ... |
+| [cloudflare-templates](https://github.com/cloudflare/templates) | 2023 | MIT | typescript | standard | First-party, MIT-licensed coverage of the serverless/edge DB tier. Verified templates: d1-template/ (wrangler.json with the D1 binding, migrations/0001_create_comments_table.sql, src/index.ts) and ... |
+| [minimal-fastapi-postgres-template](https://github.com/rafsaf/minimal-fastapi-postgres-template) | 572 | MIT | python | simple | The readable, strip-down counterpart to the official FastAPI template — 52 files total, which is small enough to audit line by line before vendoring. Verified layout: app/core/database_session.py (async engine + session factory), ... |
+
+### database-orm, fullstack-saas
+
+| source | stars | spdx | stack | complexity | what to borrow |
+|---|---:|---|---|---|---|
+| [supabase](https://github.com/supabase/supabase) | 106527 | Apache-2.0 | postgres | enterprise | A complete, self-hostable Postgres platform, and a strong reference for composable infrastructure. Verified under docker/: docker-compose.yml plus overlay files docker-compose.pg15.yml, docker-compose.pg17.yml, ... |
+
+### devops-cicd
+
+| source | stars | spdx | stack | complexity | what to borrow |
+|---|---:|---|---|---|---|
+| [docker/awesome-compose](https://github.com/docker/awesome-compose) | 45865 | CC0-1.0 | docker-compose, multi-language | simple | A large bank of working, minimal compose stacks to adapt per language layer. react-express-mysql/compose.yaml and nginx-golang-postgres/compose.yaml are clean references for service wiring, depends_on with healthchecks, and ... |
+| [goreleaser/goreleaser](https://github.com/goreleaser/goreleaser) | 15948 | MIT | go, github-actions, release | professional | Its own dogfooded config is the artifact worth taking: .goreleaser.yaml covers cross-platform build matrices, archive/checksum/SBOM generation, container manifests and changelog grouping in one declarative file. ... |
+| [actions/starter-workflows](https://github.com/actions/starter-workflows) | 11850 | MIT | github-actions, yaml | standard | GitHub's own baseline workflows — the safest default CI layer to generate from. ci/node.js.yml (matrix strategy over node-version + cache), ci/python-app.yml, ci/go.yml, ci/docker-image.yml and ci/docker-publish.yml (buildx + ... |
+| [cachix/devenv](https://github.com/cachix/devenv) | 7144 | Apache-2.0 | nix, devenv | professional | The most approachable Nix-based reproducible dev environment. Root devenv.nix and flake.nix show the entry-point pair; examples/rust/devenv.nix is a concise per-language environment (toolchain pin, packages, scripts, enterShell ... |
+| [stefanprodan/podinfo](https://github.com/stefanprodan/podinfo) | 5951 | Apache-2.0 | kubernetes, helm, kustomize, go | standard | The reference app for Kubernetes delivery patterns, and unusually complete for its size. charts/podinfo/ is a well-formed Helm chart (values.yaml is a good schema model, templates/hpa.yaml a clean autoscaler); ... |
+| [terraform-aws-modules/terraform-aws-eks](https://github.com/terraform-aws-modules/terraform-aws-eks) | 4985 | Apache-2.0 | terraform, aws, kubernetes | professional | The standard way to stand up EKS in Terraform. modules/eks-managed-node-group/main.tf is a strong sub-module encapsulation example (how to split a large module into composable children), and examples/karpenter/main.tf is a ... |
+| [antonbabenko/pre-commit-terraform](https://github.com/antonbabenko/pre-commit-terraform) | 3746 | MIT | pre-commit, terraform, bash | standard | Drop-in quality gate for any IaC repo. .pre-commit-hooks.yaml is the hook manifest to adapt, and hooks/terraform_fmt.sh shows the wrapper convention (arg passing, file filtering, per-directory invocation) used across every hook. ... |
+| [terraform-aws-modules/terraform-aws-vpc](https://github.com/terraform-aws-modules/terraform-aws-vpc) | 3249 | Apache-2.0 | terraform, aws | standard | The de-facto model for how a Terraform module should be laid out: main.tf / variables.tf / outputs.tf / versions.tf separation with required_providers version constraints pinned in versions.tf. examples/complete/main.tf is the ... |
+| [aws-ia/terraform-aws-eks-blueprints](https://github.com/aws-ia/terraform-aws-eks-blueprints) | 3027 | Apache-2.0 | terraform, aws, kubernetes | enterprise | AWS-maintained reference architectures rather than a module. patterns/karpenter/main.tf and patterns/blue-green-upgrade/README.md are the standouts — the blue/green cluster upgrade pattern is genuinely hard-won operational ... |
+| [devcontainers/features](https://github.com/devcontainers/features) | 1503 | MIT | devcontainer, bash, oci | standard | The best real-world model of a composable layer system. src/docker-in-docker/devcontainer-feature.json declares options + installsAfter ordering; src/node/install.sh is a disciplined idempotent installer (detects distro, pins ... |
+| [devcontainers/templates](https://github.com/devcontainers/templates) | 1420 | MIT | devcontainer, docker, json | simple | The canonical devcontainer-template shape. src/typescript-node/.devcontainer/devcontainer.json and src/python/.devcontainer/devcontainer.json are minimal, strip-down-ready bases. src/go/devcontainer-template.json shows the ... |
+| [fluxcd/flux2-kustomize-helm-example](https://github.com/fluxcd/flux2-kustomize-helm-example) | 1280 | Apache-2.0 | kubernetes, flux, kustomize, helm, gitops | professional | The canonical GitOps monorepo layout, and the single most directly reusable directory structure in this category: clusters/staging/ and clusters/production/ hold per-cluster entrypoints (infrastructure.yaml, apps.yaml) that point ... |
+| [nickjj/docker-rails-example](https://github.com/nickjj/docker-rails-example) | 1077 | MIT | docker, rails, github-actions | simple | The single best small-repo example of a production-shaped container setup. The Dockerfile is a genuine multi-stage build with a non-root user and cached dependency layers; compose.yaml uses profiles and healthchecks; the `run` ... |
+
+### devops-cicd, observability
+
+| source | stars | spdx | stack | complexity | what to borrow |
+|---|---:|---|---|---|---|
+| [prometheus-operator/kube-prometheus](https://github.com/prometheus-operator/kube-prometheus) | 7695 | Apache-2.0 | kubernetes, prometheus, grafana, jsonnet | enterprise | The end-to-end cluster monitoring stack. manifests/ holds ~100 pre-rendered YAML files (manifests/prometheus-prometheus.yaml et al) that can be vendored directly with no jsonnet toolchain at all — that is the pragmatic path. ... |
+
+### devops-cicd, security-compliance
+
+| source | stars | spdx | stack | complexity | what to borrow |
+|---|---:|---|---|---|---|
+| [slsa-framework/slsa-github-generator](https://github.com/slsa-framework/slsa-github-generator) | 587 | Apache-2.0 | github-actions, supply-chain, sigstore | enterprise | Build provenance for regulated contexts. .github/workflows/generator_generic_slsa3.yml is a reusable workflow you call with `uses:` to emit signed SLSA level 3 provenance for arbitrary artifacts; ... |
+
+### frontend-ui
+
+| source | stars | spdx | stack | complexity | what to borrow |
+|---|---:|---|---|---|---|
+| [shadcn-ui/ui](https://github.com/shadcn-ui/ui) | 119258 | MIT | react, next, typescript, tailwind, radix | standard | The single most important source in this category, and structurally the closest thing to Groundplan's own model: components are copied into the consumer repo, not installed. PATHS VERIFIED 2026-07-18 — the monorepo has moved to ... |
+| [storybookjs/storybook](https://github.com/storybookjs/storybook) | 90616 | MIT | react, vue, svelte, angular, vite, typescript | professional | The workbench layer that turns a pile of components into a maintained design system — this is a config pattern to generate, not code to copy. Borrow the .storybook/main.ts + preview.ts setup (framework preset, autodocs, a global ... |
+| [react-hook-form/react-hook-form](https://github.com/react-hook-form/react-hook-form) | 44800 | MIT | react, typescript | standard | The default form layer for a generated React template. Borrow the uncontrolled/ref-registration model (re-renders only the fields that change, which is why it outperforms Formik on large forms), the @hookform/resolvers zod bridge ... |
+| [ant-design/ant-design-pro](https://github.com/ant-design/ant-design-pro) | 38561 | MIT | react, typescript, umi, antd, less | enterprise | The reference for large-org admin conventions, battle-tested inside Alipay and widely deployed across enterprise China. Borrow the ProLayout shell (config-driven menu tree, multi-tab navigation, breadcrumb generation from route ... |
+| [refinedev/refine](https://github.com/refinedev/refine) | 35333 | MIT | react, typescript, next, remix, vite, antd, mui, chakra, ... | enterprise | The best MIT-licensed answer for large internal-tool and admin estates, because it is headless at the architecture level rather than the component level. Borrow the dataProvider contract (getList/getOne/create/update/ ... |
+| [tailwindlabs/headlessui](https://github.com/tailwindlabs/headlessui) | 28673 | MIT | react, vue, typescript, tailwind | simple | The cleanest reference for accessible interaction primitives with zero styling opinions. Borrow the focus-management and keyboard-nav internals under packages/@headlessui-react/src/components/ — Dialog (focus trap + scroll lock + ... |
+| [TanStack/table](https://github.com/TanStack/table) | 28198 | MIT | react, vue, svelte, solid, typescript | standard | Headless table logic, which is the right split for a scaffolder: the state machine is generic and the markup stays yours. Borrow the columnDef / createColumnHelper typing pattern, and the pluggable row-model composition ... |
+| [recharts/recharts](https://github.com/recharts/recharts) | 27383 | MIT | react, typescript, d3, svg | simple | The lowest-friction charting layer to scaffold — declarative JSX composition (<LineChart><XAxis/><Tooltip/></LineChart>) means a generated template needs no imperative chart-init code. Borrow the ResponsiveContainer pattern for ... |
+| [airbnb/visx](https://github.com/airbnb/visx) | 20961 | MIT | react, typescript, d3, svg | professional | The right layer when Recharts' abstraction is too rigid — unopinionated React wrappers over d3 with no chart components imposed. Borrow the granular package split (@visx/scale, @visx/axis, @visx/shape, @visx/tooltip, ... |
+| [radix-ui/primitives](https://github.com/radix-ui/primitives) | 19073 | MIT | react, typescript | standard | The accessibility substrate under shadcn/ui, and worth understanding directly rather than only through it. Borrow the compound-component contract (Root/Trigger/Portal/Content/Item) which is the de-facto API shape for headless ... |
+| [satnaing/shadcn-admin](https://github.com/satnaing/shadcn-admin) | 12662 | MIT | react, vite, typescript, tailwind, shadcn, tanstack-router | standard | The best-proportioned shadcn admin reference — genuinely complete without being a framework. Borrow the whole application shell: src/components/layout/ (collapsible sidebar with persisted state, breadcrumb header, nav-user menu), ... |
+| [mui/base-ui](https://github.com/mui/base-ui) | 10373 | MIT | react, typescript | professional | The current-generation headless primitive library, built by the MUI team together with people who worked on Radix and Floating UI — the most credible forward-looking alternative to Radix. Borrow its render-prop composition API (a ... |
+| [tremorlabs/tremor](https://github.com/tremorlabs/tremor) | 3525 | Apache-2.0 | react, typescript, tailwind, radix, recharts | professional | Dashboard-specific composites that the general component libraries do not cover: KPI/stat cards, delta badges, spark charts, category bars, progress circles, and date-range pickers, all Tailwind-native and copy-pasteable in the ... |
+
+### frontend-ui, fullstack-saas
+
+| source | stars | spdx | stack | complexity | what to borrow |
+|---|---:|---|---|---|---|
+| [ixartz/Next-js-Boilerplate](https://github.com/ixartz/Next-js-Boilerplate) | 13023 | MIT | next, react, typescript, tailwind, drizzle, playwright, ... | professional | The strongest reference for the non-UI scaffolding that surrounds a UI template — the tooling spine most component-focused repos skip. Borrow the full quality gate: oxlint config (oxlint.config.ts), Vitest unit setup, Playwright ... |
+| [Kiranism/next-shadcn-dashboard-starter](https://github.com/Kiranism/next-shadcn-dashboard-starter) | 6689 | MIT | next, react, typescript, tailwind, shadcn, clerk, zustand | standard | The Next.js App Router counterpart to shadcn-admin, and the most actively maintained template in this list (committed the day of research). Borrow the app/ route-group layout split (auth pages vs dashboard shell), the ... |
+
+### fullstack-saas
+
+| source | stars | spdx | stack | complexity | what to borrow |
+|---|---:|---|---|---|---|
+| [calcom/cal.diy](https://github.com/calcom/cal.diy) | 46574 | MIT | Turborepo monorepo + Next.js + Prisma/Postgres + tRPC + ... | enterprise | A community MIT fork of Cal.com with all enterprise/commercial code removed — verified MIT at raw LICENSE, and verified as the redirect target of the old cal.com URL. Rare in being a genuine production-scale codebase that is ... |
+| [alan2207/bulletproof-react](https://github.com/alan2207/bulletproof-react) | 35562 | MIT | Architecture guide + reference apps (Next.js App Router, ... | professional | Not a SaaS kit — the architecture rulebook that should govern how Groundplan lays out every React template. Borrow the feature-sliced directory convention (src/features/<name>/ {api,components,hooks,stores,types}), the "no ... |
+| [t3-oss/create-t3-app](https://github.com/t3-oss/create-t3-app) | 29048 | MIT | CLI scaffolder — Next.js + TypeScript + tRPC + ... | standard | Uniquely valuable to Groundplan because it is itself a scaffolder: read cli/src/installers/* to see how composable, independently-selectable layers are modelled and applied — each installer declares its own deps, files and ... |
+| [vercel/nextjs-subscription-payments](https://github.com/vercel/nextjs-subscription-payments) | 7722 | MIT | Next.js App Router + Supabase (auth + Postgres + RLS) + ... | standard | ARCHIVED but still the canonical reference for Stripe<->database subscription state sync, which is the single most error-prone part of a SaaS build. Borrow supabase/migrations/*.sql (products/prices/subscriptions tables mirroring ... |
+| [Blazity/next-enterprise](https://github.com/Blazity/next-enterprise) | 7428 | MIT | Next.js + OpenTelemetry/@vercel/otel + Storybook + ... | enterprise | The governance and release-engineering layer, which no other entry here covers properly. Borrow the OpenTelemetry setup (@opentelemetry/sdk-node + @vercel/otel instrumentation.ts) as a vendor-neutral observability layer, the ... |
+| [ixartz/SaaS-Boilerplate](https://github.com/ixartz/SaaS-Boilerplate) | 7291 | MIT | Next.js 15 + Drizzle + Clerk (orgs/roles) + Stripe + ... | professional | The most complete MIT-licensed SaaS boilerplate that is still actively maintained. Borrow the multi-tenant organization + role model built on Clerk Organizations, the Stripe subscription/plan configuration split (plans declared ... |
+| [epicweb-dev/epic-stack](https://github.com/epicweb-dev/epic-stack) | 5542 | MIT | React Router v7 (ex-Remix) + Prisma/SQLite(LiteFS) + ... | professional | Kent C. Dodds' production stack and the strongest non-Next.js entry. It owns its auth instead of renting it: borrow the @simplewebauthn passkey registration/login flow, the @epic-web/totp 2FA implementation, the session + ... |
+| [nextacular/nextacular](https://github.com/nextacular/nextacular) | 1376 | MIT | Next.js + Prisma/Postgres + NextAuth + Stripe + i18next + ... | standard | The clearest open reference for real multi-tenancy: borrow the workspace model (prisma/schema.prisma), the subdomain and custom-domain routing middleware, the workspace-scoped member/invitation flow with email invites, and the ... |
+| [dotnize/react-tanstarter](https://github.com/dotnize/react-tanstarter) | 1259 | Unlicense | TanStack Start + TanStack Router/Query + Drizzle + Better ... | simple | The best minimal TanStack Start baseline, and the single most permissively licensed entry here (Unlicense = public domain, zero attribution burden — ideal for a generator that copies files). Borrow the src/routes file-based ... |
+| [Skolaczk/next-starter](https://github.com/Skolaczk/next-starter) | 996 | MIT | Next.js 15 + Drizzle + NextAuth v5 + Stripe + next-intl + ... | simple | The cleanest small reference for "auth + db + payments" without monorepo weight. Borrow the @t3-oss/env-nextjs env schema (src/env.mjs) as the canonical typed-config entry point, the @auth/drizzle-adapter wiring, the next-intl ... |
+| [CarlosZiegler/fullstack-start-template](https://github.com/CarlosZiegler/fullstack-start-template) | 290 | MIT | TanStack Start + Better Auth + Drizzle/Neon + tRPC-ish ... | standard | The "batteries included" counterpart to react-tanstarter, and the most complete TanStack Start SaaS wiring found. Borrow the auth:generate script (generates the Better Auth schema into Drizzle — a clean codegen contract for an ... |
+
+### fullstack-saas, payments-billing
+
+| source | stars | spdx | stack | complexity | what to borrow |
+|---|---:|---|---|---|---|
+| [nextjs/saas-starter](https://github.com/nextjs/saas-starter) | 15969 | MIT | Next.js 15 App Router + Postgres + Drizzle + Stripe + JWT ... | standard | The official Vercel SaaS starter and the highest-signal "sensible default" in the category. Borrow the db:setup / db:seed / db:generate / db:migrate / db:studio script quartet and the Drizzle schema+migration layout wholesale — ... |
+
+### game-3d
+
+| source | stars | spdx | stack | complexity | what to borrow |
+|---|---:|---|---|---|---|
+| [mrdoob/three.js](https://github.com/mrdoob/three.js) | 113825 | MIT | javascript, typescript, webgl, webgpu, glsl | enterprise | The substrate the majority of this category sits on, and the single richest pool of adaptable 3D code that exists under MIT. The `examples/jsm/` directory is the real asset: `controls/OrbitControls.js` and `TransformControls.js`, ... |
+| [phaserjs/phaser](https://github.com/phaserjs/phaser) | 39980 | MIT | javascript, typescript, webgl, canvas | professional | The most battle-tested 2D web engine, with a decade of shipped commercial games behind it. For Groundplan, borrow the architecture rather than the source: the Scene lifecycle contract (`init` -> `preload` -> `create` -> `update`) ... |
+| [pmndrs/react-three-fiber](https://github.com/pmndrs/react-three-fiber) | 31462 | MIT | typescript, react, three | standard | The default 3D stack for anyone already in React, and the reconciler most of this category's other entries orbit. The value for Groundplan is less the library source than the integration patterns: adapt the `<Canvas>` ... |
+| [BabylonJS/Babylon.js](https://github.com/BabylonJS/Babylon.js) | 25825 | Apache-2.0 | typescript, webgl, webgpu, wasm | enterprise | The most batteries-included and most enterprise-appropriate 3D web engine — Microsoft-backed, TypeScript-native, and the only one here whose stability guarantees are strong enough for a long-lived internal product. Borrow the ... |
+| [playcanvas/engine](https://github.com/playcanvas/engine) | 16258 | MIT | javascript, typescript, webgl, webgpu | professional | A full engine rather than a rendering library — the entity-component system, asset registry, input, audio and scene graph all ship together, which makes it the closest thing here to "Unity for the web" under an MIT license. ... |
+| [pmndrs/drei](https://github.com/pmndrs/drei) | 9748 | MIT | typescript, react, three, r3f | standard | The helper library that turns bare R3F into something you can ship, and the richest single source of copyable 3D patterns in the ecosystem. Highest value for Groundplan layers: `<Environment preset="..." />` for one-line IBL ... |
+| [godotengine/godot-demo-projects](https://github.com/godotengine/godot-demo-projects) | 9187 | MIT | gdscript, csharp, godot | standard | The official first-party demo collection and — importantly for this category — a permissively licensed one, which is exactly what Unity's equivalent is not. Each subdirectory is a self-contained project with its own ... |
+| [MirrorNetworking/Mirror](https://github.com/MirrorNetworking/Mirror) | 6249 | MIT | csharp, unity | professional | The one genuinely vendorable Unity multiplayer stack — Unity's own first-party Netcode for GameObjects is Unity Companion License and therefore unusable as source material, which makes Mirror's MIT license the deciding factor ... |
+| [tresjs/tres](https://github.com/tresjs/tres) | 3628 | MIT | typescript, vue, three | standard | The Vue equivalent, and the most actively developed of the three framework bindings listed here. Borrow the `<TresCanvas>` configuration and the convention that any Three.js class is available as `<TresMesh>`, ... |
+| [threlte/threlte](https://github.com/threlte/threlte) | 3299 | MIT | typescript, svelte, three | standard | The Svelte answer to R3F, and the better choice when per-frame overhead matters — Svelte's compiled reactivity avoids the reconciliation cost that forces R3F code into ref-mutation workarounds. Take the `<Canvas>` + `<T.Mesh>` ... |
+| [pmndrs/xr](https://github.com/pmndrs/xr) | 2600 | MIT | typescript, react, three, r3f, webxr | standard | The current WebXR layer for R3F (v6, a full rewrite of the older react-xr) and the only maintained permissive option for VR/AR templates. Adapt the `createXRStore()` + `<XR store={store}>` pattern — decoupling the XR session ... |
+| [pmndrs/react-three-rapier](https://github.com/pmndrs/react-three-rapier) | 1412 | MIT | typescript, react, three, r3f, rapier, wasm | standard | The physics layer for R3F, and a good template for wrapping any WASM simulation in React. Take the `<Physics>` provider configuration (`gravity`, `timeStep="vary"` vs a fixed step, `interpolate`, and `paused` — a fixed timestep ... |
+| [pmndrs/ecctrl](https://github.com/pmndrs/ecctrl) | 762 | MIT | typescript, react, three, r3f, rapier | simple | A single-concern library that solves the one problem every 3D project hits on day two: a character controller that does not feel bad. Borrow the floating-capsule approach in `src/character/Ecctrl.tsx` — a ray-cast down from a ... |
+| [TheBevyFlock/bevy_new_2d](https://github.com/TheBevyFlock/bevy_new_2d) | 470 | MIT OR Apache-2.0 OR CC0-1.0 | rust, bevy | standard | The community-standard Bevy game template and the best available model for structuring a Rust ECS game, which is otherwise an unsolved question for newcomers. Take the `src/screens/` module split (splash -> loading -> title -> ... |
+| [phaserjs/template-vite-ts](https://github.com/phaserjs/template-vite-ts) | 188 | MIT | typescript, phaser, vite | simple | The official Phaser starter and the cleanest strip-down baseline in the whole category — roughly a dozen files, no framework noise. Take `src/game/main.ts` (the `Phaser.Types.Core.GameConfig` object: type `AUTO`, fixed 1024x768 ... |
+| [colyseus/create-colyseus-app](https://github.com/colyseus/create-colyseus-app) | 39 | MIT | typescript, node, colyseus | simple | The canonical minimal authoritative-server scaffold, and the single best shape to copy for any "multiplayer room" Groundplan layer. Take `templates/typescript/src/rooms/MyRoom.ts` (the `Room<MyRoomState>` subclass with ... |
+
+### game-3d, realtime-messaging
+
+| source | stars | spdx | stack | complexity | what to borrow |
+|---|---:|---|---|---|---|
+| [colyseus/colyseus](https://github.com/colyseus/colyseus) | 7097 | MIT | typescript, node, websocket | professional | The strongest permissive authoritative-multiplayer server in the JS ecosystem and the natural backend layer for every client engine in this file. Borrow the Schema system (`@colyseus/schema`) — decorated state classes that ... |
+
+### mobile-desktop
+
+| source | stars | spdx | stack | complexity | what to borrow |
+|---|---:|---|---|---|---|
+| [electron-react-boilerplate/electron-react-boilerplate](https://github.com/electron-react-boilerplate/electron-react-boilerplate) | 24254 | MIT | electron, react, typescript, webpack, electron-builder, jest | enterprise | The most battle-tested packaging and release configuration in the Electron ecosystem - a decade of accumulated fixes for code signing, notarization, auto-update and native-module rebuilds that are genuinely hard to reproduce. ... |
+| [infinitered/ignite](https://github.com/infinitered/ignite) | 19890 | MIT | react-native, expo, typescript, react-navigation, mmkv, ... | professional | The whole `boilerplate/` tree is the payload. Highest-value pieces: `boilerplate/app/config/` split into config.base.ts / config.dev.ts / config.prod.ts with an index.ts that picks by __DEV__ - a clean environment-layer contract ... |
+| [flutter/samples](https://github.com/flutter/samples) | 19210 | BSD-3-Clause | flutter, dart, material 3, various state solutions | simple | First-party and continuously updated against current Flutter stable, which makes it the safest source for baseline files a scaffolder emits: current pubspec.yaml shape, analysis_options.yaml, platform runner directories (android/ ... |
+| [Nozbe/WatermelonDB](https://github.com/Nozbe/WatermelonDB) | 11751 | MIT | react-native, sqlite, typescript, lokijs (web) | professional | The reference implementation of offline-first sync for React Native, and the sync protocol is the real asset. Borrow its pull/push contract - the server returns changes since `last_pulled_at` as created/updated/deleted ... |
+| [alex8088/electron-vite](https://github.com/alex8088/electron-vite) | 5539 | MIT | electron, vite, typescript, rollup | standard | The canonical answer to "how do I configure an Electron build in 2026". Borrow the three-target electron.vite.config.ts shape (separate main / preload / renderer sections, each a full Vite config) and the externalizeDepsPlugin ... |
+| [obytes/react-native-template-obytes](https://github.com/obytes/react-native-template-obytes) | 4281 | MIT | expo, expo-router, typescript, nativewind/uniwind, ... | professional | The best-in-class CI and env story in this category. `.github/workflows/` is the single biggest borrow - 14 real workflows including type-check.yml, lint-ts.yml, test.yml, expo-doctor.yml, eas-build-preview.yml, ... |
+| [expo/examples](https://github.com/expo/examples) | 3677 | MIT | expo, react-native, typescript, various integrations | simple | First-party, per-concern minimal projects - each top-level directory is one runnable Expo app demonstrating exactly one integration, which is the ideal shape for atomic scaffold layers. Use it as the canonical reference for the ... |
+| [dotnet/maui-samples](https://github.com/dotnet/maui-samples) | 3651 | MIT | dotnet, maui, csharp, xaml, mvvm | standard | First-party MIT-licensed MAUI code, which matters because most MAUI sample material is either unlicensed blog code or Microsoft-docs snippets. Use it for the baseline a scaffolder must emit correctly: the .csproj multi-targeting ... |
+| [VeryGoodOpenSource/very_good_cli](https://github.com/VeryGoodOpenSource/very_good_cli) | 2398 | MIT | dart, flutter, mason, bloc, very_good_analysis | enterprise | The most directly transferable repo in this catalog, because it *is* a scaffolder. Copy the architecture, not just the output: `lib/src/commands/create/templates/template.dart` defines an abstract Template with an ... |
+| [agmmnn/tauri-ui](https://github.com/agmmnn/tauri-ui) | 2102 | MIT | tauri v2, react, shadcn/ui, tailwind, ... | standard | This has evolved from a static starter into a generator whose internal model is close to what Groundplan needs. `packages/create-tauri-ui/src/adapters/` has one adapter per frontend (vite.ts, next.ts, react-router.ts, start.ts, ... |
+| [bizz84/starter_architecture_flutter_firebase](https://github.com/bizz84/starter_architecture_flutter_firebase) | 1809 | MIT | flutter, riverpod, firebase, go_router, firebase_ui_auth | professional | The clearest reference implementation of feature-first Flutter layering. Every feature under `lib/src/features/<feature>/` is split into data/ domain/ application/ presentation/ - e.g. ... |
+| [tauri-apps/create-tauri-app](https://github.com/tauri-apps/create-tauri-app) | 1604 | Apache-2.0 | tauri v2, rust, vite, ... | simple | The template composition mechanism is the prize. `templates/_base_/` holds everything shared (src-tauri/Cargo.toml.lte, src-tauri/build.rs, the full icons/ set including icon.icns / icon.ico / Square*Logo.png, and _gitignore) and ... |
+| [Stacked-Org/stacked](https://github.com/Stacked-Org/stacked) | 1039 | MIT | dart, flutter, mvvm, get_it, code-generation | standard | A coherent MVVM answer for Flutter: ViewModel base classes (BaseViewModel, and the Future/Stream/Reactive variants) that standardize busy/error state, plus a service-locator registration convention via get_it and a StackedApp ... |
+| [daltonmenezes/electron-app](https://github.com/daltonmenezes/electron-app) | 806 | MIT | electron, electron-vite, react 19, typescript 5, tailwind ... | professional | A well-factored Electron application skeleton living under `template/`. The standout is `template/src/lib/electron-app/factories/` - factories/app/instance.ts and app/setup.ts wrap app lifecycle, factories/windows/create.ts is a ... |
+| [flemingvincent/expo-clerk-convex](https://github.com/flemingvincent/expo-clerk-convex) | 781 | MIT | expo, expo-router, typescript, clerk, convex, nativewind | standard | A complete, small email/password auth flow wired end to end - Clerk for identity plus Convex as the reactive backend, which gives optimistic local writes and automatic resubscription on reconnect (a practical offline-tolerant ... |
+| [powersync-ja/powersync-js](https://github.com/powersync-ja/powersync-js) | 691 | Apache-2.0 | typescript, sqlite, react-native, web, node, ... | professional | The most actively developed offline-first option here and the cleanest architectural split to copy: a local SQLite database is the only thing the UI reads/writes, and a separate replication process streams changes to and from the ... |
+
+### observability
+
+| source | stars | spdx | stack | complexity | what to borrow |
+|---|---:|---|---|---|---|
+| [prometheus/prometheus](https://github.com/prometheus/prometheus) | 65222 | Apache-2.0 | Go - metrics TSDB, scrape engine, PromQL, alerting rules | professional | The upstream source of the config schemas every other layer here references. Borrow documentation/examples/prometheus.yml as the canonical scrape_config skeleton - global scrape_interval and evaluation_interval, rule_files, ... |
+| [SigNoz/signoz](https://github.com/SigNoz/signoz) | 30828 | MIT | Self-hosted OTel-native APM on ClickHouse | enterprise | Self-hosted OTel-native alternative to Datadog, useful mainly as a READING reference for how OTLP data is modelled on ClickHouse. conf/example.yaml is the annotated server config. pkg/telemetrystore/ is the store abstraction - ... |
+| [uber-go/zap](https://github.com/uber-go/zap) | 24576 | MIT | Go high-performance structured logging | standard | The config-driven constructor is what to adapt: zap.Config as a struct populated from environment (level, encoding json/console, outputPaths, initialFields) then .Build(), which gives dev and prod presets from one code path via ... |
+| [jaegertracing/jaeger](https://github.com/jaegertracing/jaeger) | 23012 | Apache-2.0 | Distributed tracing backend; v2 is built on the OTel ... | professional | The all-in-one compose service (OTLP ingest on 4317/4318, UI on 16686) as the dev default when only tracing is needed. Jaeger v2 is built on the OTel Collector, so its config IS a collector config - that keeps dev and prod in a ... |
+| [pinojs/pino](https://github.com/pinojs/pino) | 18044 | MIT | Node.js structured JSON logging | simple | The logger factory with redact paths for auth headers and cookies, custom serializers, the pino-pretty-in-dev / raw-JSON-in-prod transport split, and pino-http for per-request child loggers carrying a request id. |
+| [rs/zerolog](https://github.com/rs/zerolog) | 12476 | MIT | Go zero-allocation JSON structured logging | simple | The chained-field API (log.Info().Str("k",v).Int("n",1).Msg("done")) and, more usefully for a template, hlog - the bundled net/http middleware in the hlog subpackage that attaches a request-scoped logger to the context, generates ... |
+| [getsentry/sentry-javascript](https://github.com/getsentry/sentry-javascript) | 8710 | MIT | JavaScript/TypeScript error and performance monitoring SDKs | standard | The Next.js file convention, withSentryConfig for source-map upload at build time, and global-error.tsx for the React error boundary. CONVENTION UPDATED - verify before generating. A previous revision described a three-file ... |
+| [serilog/serilog](https://github.com/serilog/serilog) | 8013 | Apache-2.0 | .NET structured logging with message templates and sinks | simple | The message-template model is the point: log.Information("Order {OrderId} shipped to {Customer}", id, customer) preserves OrderId and Customer as queryable fields instead of flattening to a string. Borrow the two-stage bootstrap ... |
+| [coroot/coroot](https://github.com/coroot/coroot) | 7838 | Apache-2.0 | eBPF-based zero-instrumentation observability, service map, ... | professional | The strongest zero-instrumentation option - eBPF captures service-to-service traffic with no code changes, which makes it viable as a default-on layer that cannot break the user's application. The deployment artifact is a single ... |
+| [stefanprodan/dockprom](https://github.com/stefanprodan/dockprom) | 6571 | MIT | Docker Compose host/container monitoring stack - ... | simple | Classic host and container monitoring compose stack, small enough to read end to end. Borrow docker-compose.yml, prometheus/prometheus.yml scrape configs for cAdvisor and node-exporter, prometheus/alert.rules, ... |
+| [open-telemetry/opentelemetry-go](https://github.com/open-telemetry/opentelemetry-go) | 6480 | Apache-2.0 | Go - OpenTelemetry API/SDK, OTLP trace/metric/log exporters | standard | Go has no auto-instrumentation agent, so the explicit bootstrap IS the layer. The core repo ships the API/SDK and the exporters (exporters/otlp/otlptrace/otlptracegrpc, confirmed present) but has NO example/ or examples/ ... |
+| [prometheus/client_golang](https://github.com/prometheus/client_golang) | 6010 | Apache-2.0 | Go Prometheus instrumentation client | simple | The custom-registry pattern (prometheus.NewRegistry() with explicit MustRegister rather than the global default, so tests stay isolated), promauto.With(reg) for declaration, promhttp.HandlerFor mounted on a separate admin port ... |
+| [hynek/structlog](https://github.com/hynek/structlog) | 4878 | Apache-2.0 OR MIT | Python structured logging | simple | The configure() processor chain (merge_contextvars, add_log_level, TimeStamper(iso), format_exc_info, then JSONRenderer in prod and ConsoleRenderer in dev) and the ProcessorFormatter bridge that routes stdlib logging from ... |
+| [micrometer-metrics/micrometer](https://github.com/micrometer-metrics/micrometer) | 4871 | Apache-2.0 | JVM metrics and observation facade, Spring Boot Actuator ... | professional | The JVM observability layer. Borrow MeterRegistry injection, micrometer-registry-prometheus wiring that exposes /actuator/prometheus, common tags applied through a MeterRegistryCustomizer, and the micrometer-observation API where ... |
+| [open-telemetry/opentelemetry-collector-contrib](https://github.com/open-telemetry/opentelemetry-collector-contrib) | 4796 | Apache-2.0 | Go - OpenTelemetry Collector components (receivers, ... | enterprise | This is where real collector COMPONENT configuration lives. Borrow the processor configuration patterns that every production pipeline needs - memory_limiter and batch ordering, resourcedetection for cloud/host attributes, ... |
+| [Xabaril/AspNetCore.Diagnostics.HealthChecks](https://github.com/Xabaril/AspNetCore.Diagnostics.HealthChecks) | 4369 | Apache-2.0 | .NET health-check packages, publishers and UI | standard | Reference implementation of health-check patterns usable in any stack. Borrow the tag-based split (register checks with ready/live tags, map /health/ready and /health/live to tag-filtered predicates - exactly what Kubernetes ... |
+| [open-telemetry/opentelemetry-dotnet](https://github.com/open-telemetry/opentelemetry-dotnet) | 3731 | Apache-2.0 | .NET / C# - OpenTelemetry SDK, OTLP/Prometheus/Console ... | standard | The builder-extension wiring is the copyable artifact: a single services.AddOpenTelemetry().ConfigureResource(...).WithTracing(...).WithMetrics(...) block plus .UseOtlpExporter(), which collapses the whole setup into one file ... |
+| [open-telemetry/opentelemetry-js](https://github.com/open-telemetry/opentelemetry-js) | 3419 | Apache-2.0 | TypeScript/JavaScript - OpenTelemetry API/SDK for Node and ... | standard | The NodeSDK quickstart plus the packages/opentelemetry-sdk-trace-node README give the copyable unit: an instrumentation.ts that constructs new NodeSDK({ resource, traceExporter: new OTLPTraceExporter(), instrumentations: ... |
+| [grafana/alloy](https://github.com/grafana/alloy) | 3346 | Apache-2.0 | Grafana's OpenTelemetry Collector distribution with a ... | professional | An official OTel Collector distribution with a programmable configuration language. Borrow example-config.alloy and the example/ directory (both confirmed present) - the component-and-forward_to syntax is far more readable in a ... |
+| [open-telemetry/opentelemetry-demo](https://github.com/open-telemetry/opentelemetry-demo) | 3217 | Apache-2.0 | Polyglot microservice demo - OTel across ~15 languages with ... | professional | Canonical polyglot OTel reference. Borrow otel-config.yml and the split compose layering (compose.yaml for services, compose.observability.yaml for backends, compose.full.yaml for everything, plus compose.extras.yaml / ... |
+| [open-telemetry/opentelemetry-java-instrumentation](https://github.com/open-telemetry/opentelemetry-java-instrumentation) | 2581 | Apache-2.0 | Java - bytecode-agent auto-instrumentation for JVM ... | professional | The zero-code JVM layer. What a scaffolder generates is not source but Dockerfile and env: download opentelemetry-javaagent.jar from the release assets, add -javaagent:/otel/opentelemetry-javaagent.jar to JAVA_TOOL_OPTIONS, then ... |
+| [open-telemetry/opentelemetry-python](https://github.com/open-telemetry/opentelemetry-python) | 2550 | Apache-2.0 | Python - OpenTelemetry API/SDK, OTLP exporters ... | standard | Two distinct layers worth generating separately, but they come from TWO DIFFERENT REPOS and a previous revision wrongly attributed both to this one. First, the zero-code path: the opentelemetry-instrument CLI plus OTEL_* ... |
+| [slok/sloth](https://github.com/slok/sloth) | 2515 | Apache-2.0 | Go - Prometheus SLO generator producing multi-window ... | standard | The cleanest path from a short SLO spec to correct multi-window multi-burn-rate alerts, which almost nobody writes correctly by hand. Borrow the spec format and the examples/ tree (confirmed present) including the generated ... |
+| [getsentry/sentry-python](https://github.com/getsentry/sentry-python) | 2197 | MIT | Python error and performance monitoring SDK with framework ... | standard | The single sentry_sdk.init() block belongs in one config module: dsn and environment from env vars, traces_sample_rate as a float setting, release stamped from the CI commit sha, and an explicit integrations list ... |
+| [grafana/docker-otel-lgtm](https://github.com/grafana/docker-otel-lgtm) | 1939 | Apache-2.0 | Docker image bundling OpenTelemetry Collector + Loki, ... | simple | The single best "observability backend in one container" layer. Borrow docker/Dockerfile plus docker/run-all.sh, the supervisor-style entrypoint that boots all five backends from one image via the per-component run-*.sh scripts. ... |
+| [open-telemetry/opentelemetry-go-contrib](https://github.com/open-telemetry/opentelemetry-go-contrib) | 1652 | Apache-2.0 | Go - OTel HTTP/gRPC instrumentation libraries, propagators, ... | standard | The companion the core Go SDK entry depends on, added during verification because the core repo's examples were cited there but actually live here. Two things to take. First, the examples: examples/dice/instrumented/otel.go is a ... |
+| [pyrra-dev/pyrra](https://github.com/pyrra-dev/pyrra) | 1529 | Apache-2.0 | Go + React - SLO definitions compiled to Prometheus ... | standard | The error-budget calculator the brief asks for, and the natural complement to sloth. Borrow the ServiceLevelObjective spec shape from examples/ - target as a percentage, window as a duration, and an indicator that is either a ... |
+| [OpenSLO/OpenSLO](https://github.com/OpenSLO/OpenSLO) | 1509 | Apache-2.0 | Vendor-neutral SLO specification (YAML schema) | simple | Use as the schema layer, not a runtime. Borrow the Kubernetes-style kinds - SLO, SLI, AlertPolicy, AlertCondition, AlertNotificationTarget, Service and DataSource, all seven confirmed present in the spec README - as the shape for ... |
+| [open-telemetry/opentelemetry-python-contrib](https://github.com/open-telemetry/opentelemetry-python-contrib) | 1073 | Apache-2.0 | Python - opentelemetry-instrument zero-code agent plus ... | standard | This is where Python's zero-code story actually lives, added during verification because the core opentelemetry-python entry claimed it. opentelemetry-instrumentation/ declares both console scripts in its pyproject.toml - ... |
+| [open-telemetry/opentelemetry-js-contrib](https://github.com/open-telemetry/opentelemetry-js-contrib) | 917 | Apache-2.0 | TypeScript - Node auto-instrumentation meta-package and ... | standard | The half of the Node OTel story that is not in core, added during verification because the opentelemetry-js entry's snippet silently depended on it. packages/auto-instrumentations-node is the meta-package exporting ... |
+| [nestjs/terminus](https://github.com/nestjs/terminus) | 741 | MIT | NestJS health-check module | simple | The HealthController shape (@Get('health') @HealthCheck() returning health.check([...indicators])) and the custom-indicator contract for app-specific checks. |
+| [open-telemetry/opentelemetry-dotnet-contrib](https://github.com/open-telemetry/opentelemetry-dotnet-contrib) | 646 | Apache-2.0 | .NET - OTel instrumentation packages (ASP.NET Core, ... | standard | Where the .NET instrumentation packages actually live, added during verification because the core opentelemetry-dotnet entry claimed them. src/OpenTelemetry.Instrumentation.AspNetCore and src/OpenTelemetry.Instrumentation.Http ... |
+| [hellofresh/health-go](https://github.com/hellofresh/health-go) | 589 | Apache-2.0 | Go library for HTTP health/readiness endpoints with ... | simple | The smallest complete readiness pattern in Go, and a direct fit for the existing health-checks layer. Borrow health.New() with health.WithChecks(health.Config{Name, Timeout, SkipOnErr, Check: func(ctx) error}) - the per-check ... |
+| [google/slo-generator](https://github.com/google/slo-generator) | 564 | Apache-2.0 | Python - multi-backend SLO and error-budget computation ... | standard | The multi-backend SLO layer for stacks that are not Prometheus-only, which is where sloth stops being an option. The copyable artifacts are concrete: samples/config.yaml is the shared config, and its four top-level keys ... |
+| [open-telemetry/opentelemetry-collector-releases](https://github.com/open-telemetry/opentelemetry-collector-releases) | 488 | Apache-2.0 | OCB (OpenTelemetry Collector Builder) distribution ... | standard | The correct home for the custom-distribution pattern that the contrib entry previously misattributed. distributions/ holds real manifest.yaml files (otelcol, otelcol-contrib, otelcol-k8s) showing the exact schema - dist: ... |
+
+### payments-billing
+
+| source | stars | spdx | stack | complexity | what to borrow |
+|---|---:|---|---|---|---|
+| [juspay/hyperswitch](https://github.com/juspay/hyperswitch) | 43327 | Apache-2.0 | Rust, Postgres, Redis; multi-PSP payment orchestration | enterprise | The payment-orchestration tier — how to stay processor-agnostic instead of hardcoding Stripe. Borrow the connector abstraction (each PSP implements a common request/response trait, so adding a processor is additive), smart ... |
+| [wasp-lang/open-saas](https://github.com/wasp-lang/open-saas) | 14941 | MIT | Wasp framework, React, Node.js, Prisma, Stripe + Polar + ... | professional | The single best multi-provider abstraction in this category, and the reason to study it is one file. Verified layout under `template/app/src/payment/`: `paymentProcessor.ts` defines the provider interface, with `stripe/`, ... |
+| [polarsource/polar](https://github.com/polarsource/polar) | 10067 | Apache-2.0 | Python (FastAPI) backend, TypeScript/Next.js clients, ... | professional | A complete, production merchant-of-record and entitlements system with the source open — the most instructive full implementation here of the layer *above* the payment processor. Monorepo splits `server/` (billing engine), ... |
+| [t3dotgg/stripe-recommendations](https://github.com/t3dotgg/stripe-recommendations) | 6376 | MIT | Documentation + TypeScript snippets, KV/Redis-oriented | simple | A short, opinionated writeup of the specific Stripe failure modes that bite in production, and the highest value-per-line item in this list. The central pattern worth encoding as a layer: never trust individual webhook event ... |
+| [killbill/killbill](https://github.com/killbill/killbill) | 5627 | Apache-2.0 | Java, JAX-RS, MySQL/Postgres, plugin architecture (OSGi) | enterprise | The reference domain model for subscription billing, and the value is the decomposition even if you never run the Java. Verified top-level modules map one-to-one onto the concepts a serious billing layer needs: `catalog` ... |
+| [boxyhq/saas-starter-kit](https://github.com/boxyhq/saas-starter-kit) | 4869 | Apache-2.0 | Next.js, TypeScript, Prisma, Postgres, NextAuth, Stripe, ... | enterprise | The enterprise-procurement half of billing that consumer-grade starters omit entirely: per-seat/team subscriptions tied to a `Team` + `TeamMember` model, an audit-log trail over billing-relevant events (plan change, seat ... |
+| [useautumn/autumn](https://github.com/useautumn/autumn) | 2617 | Apache-2.0 | TypeScript, Node, Postgres; sits on top of Stripe | professional | Purpose-built for the layer most teams hand-roll badly: pricing model and feature entitlements on top of Stripe. Borrow the declarative product/feature/pricing definition (plans and their limits declared as data, so adding a tier ... |
+| [laravel/cashier-stripe](https://github.com/laravel/cashier-stripe) | 2537 | MIT | PHP, Laravel, Stripe | standard | The most mature framework-native billing abstraction in any ecosystem, and the best model for what a good billing API *feels* like. Borrow the `Billable` trait design (a model gains `newSubscription()`, `subscribed()`, ... |
+| [openmeterio/openmeter](https://github.com/openmeterio/openmeter) | 2125 | Apache-2.0 | Go, ClickHouse, Kafka/Redpanda, CloudEvents; Stripe ... | professional | The metering-and-entitlements layer for usage-based and AI/API pricing — the piece Stripe Billing handles poorly at volume. Borrow the CloudEvents-shaped usage event schema (idempotent event ids, so duplicate ingestion is safe by ... |
+| [dj-stripe/dj-stripe](https://github.com/dj-stripe/dj-stripe) | 1786 | MIT | Python, Django, Postgres, Stripe | standard | The strongest example of the "mirror Stripe into your own database" strategy: dj-stripe defines Django models for Customer, Subscription, Product, Price, Invoice, Event and keeps them synced from webhooks, so application code ... |
+| [spatie/laravel-webhook-client](https://github.com/spatie/laravel-webhook-client) | 1190 | MIT | PHP, Laravel; provider-agnostic inbound webhook receiver | simple | A tight, single-concern implementation of *receiving webhooks safely*, decoupled from any payment provider — useful precisely because it isolates the pattern. Borrow the pipeline shape: verify signature → persist the raw payload ... |
+| [stripe-samples/subscription-use-cases](https://github.com/stripe-samples/subscription-use-cases) | 902 | MIT | Polyglot — Node, Python, Ruby, PHP, Java, Go, .NET server ... | simple | Stripe's own first-party reference for subscription billing, each shape an isolated minimal app. Verified top-level samples: `fixed-price-subscriptions`, `usage-based-subscriptions` and `usage-based-subscriptions-legacy` (the ... |
+| [stripe-samples/accept-a-payment](https://github.com/stripe-samples/accept-a-payment) | 836 | MIT | Polyglot server samples (Node, Python, Ruby, PHP, Java, Go, ... | simple | The simplest correct one-time-payment path, and the right starting point when a product needs checkout without subscriptions. Covers both hosted Stripe Checkout redirect and embedded Payment Element/custom-flow variants, so it is ... |
+
+### realtime-messaging
+
+| source | stars | spdx | stack | complexity | what to borrow |
+|---|---:|---|---|---|---|
+| [socketio/socket.io](https://github.com/socketio/socket.io) | 63158 | MIT | nodejs-typescript | standard | The `examples/` directory is effectively a free template library — 37 apps that map almost 1:1 onto Groundplan layers. Highest value: `nextjs-app-router` and `nextjs-pages-router` (the custom-server wiring teams always get ... |
+| [apache/kafka](https://github.com/apache/kafka) | 33267 | Apache-2.0 | java-scala | enterprise | The default event backbone in large and regulated organisations, and the one `broker-*` layer that will be mandated rather than chosen. Borrow the operational contract rather than the source: KRaft-mode cluster config (ZooKeeper ... |
+| [celery/celery](https://github.com/celery/celery) | 28699 | BSD-3-Clause | python | professional | The incumbent Python task queue and the realistic `queue-celery-python` layer. Borrow the conventional project layout (a `celery.py` app module, `tasks.py` per Django/Flask app, autodiscovery), and the production settings that ... |
+| [websockets/ws](https://github.com/websockets/ws) | 22786 | MIT | nodejs | simple | The unopinionated Node WebSocket primitive that almost every higher-level library sits on. Borrow the documented recipes rather than the library internals: the `examples/` server-side broadcast loop, the HTTP-upgrade + ... |
+| [triggerdotdev/trigger.dev](https://github.com/triggerdotdev/trigger.dev) | 15682 | Apache-2.0 | nodejs-typescript | professional | Durable, long-running background tasks defined in plain TypeScript, with retries, queues, concurrency control and observability — and, unusually for this space, genuinely Apache-2.0 rather than SSPL/BUSL. Borrow the task ... |
+| [hibiken/asynq](https://github.com/hibiken/asynq) | 13528 | MIT | go | standard | The Go analogue of BullMQ/Sidekiq and a clean `queue-*` template for Go. Borrow the `asynq.Client.Enqueue` + `asynq.ServeMux` handler-routing split (it deliberately mirrors net/http, so the mental model is free), weighted and ... |
+| [centrifugal/centrifugo](https://github.com/centrifugal/centrifugo) | 10527 | Apache-2.0 | go-standalone-server | professional | A self-hosted Pusher/Ably replacement that runs as a sidecar, which means the realtime layer stops being coupled to your app language. This is the strongest `realtime-*` option for polyglot backends. Borrow the two auth models: ... |
+| [ThreeDotsLabs/watermill](https://github.com/ThreeDotsLabs/watermill) | 9801 | MIT | go | standard | The broker-agnostic abstraction that lets one Groundplan template target many backends. The `message.Router` with middleware (retry, poison queue, correlation id, recovery) is the piece to copy — it turns each broker into a ... |
+| [taskforcesh/bullmq](https://github.com/taskforcesh/bullmq) | 9152 | MIT | nodejs-typescript | standard | The default job queue for Node and the right `queue-*` baseline. Borrow the Queue/Worker/QueueEvents triad as separate process entry points, the `FlowProducer` parent/child dependency graph (fan-out then join — the cleanest OSS ... |
+| [supabase/realtime](https://github.com/supabase/realtime) | 7605 | Apache-2.0 | elixir-phoenix | professional | The clearest production reference for the three primitives every realtime product re-implements: Broadcast (ephemeral low-latency client-to-client), Presence (CRDT-backed shared online state that self-heals across nodes), and ... |
+| [hatchet-dev/hatchet](https://github.com/hatchet-dev/hatchet) | 7523 | MIT | go-postgres | professional | The sweet spot between "a job queue" and "Temporal": durable task orchestration with retries, real-time monitoring, alerting and logging, using Postgres as the single durability layer for both runtime and observability — no ... |
+| [nats-io/nats.go](https://github.com/nats-io/nats.go) | 6694 | Apache-2.0 | go | standard | The lightest credible message broker to template — a single ~15MB server binary with no ZooKeeper/Kraft ceremony, which makes it the right default `broker-*` layer for teams that do not need Kafka. Borrow from the `jetstream/` ... |
+| [coder/websocket](https://github.com/coder/websocket) | 5349 | ISC | go | simple | The smallest credible WebSocket baseline in Go. Vendor the `internal/examples/echo` server (echoServer.ServeHTTP + websocket.Accept + rate limiting via golang.org/x/time/rate) and `internal/examples/chat` (subscriber fan-out with ... |
+| [sysid/sse-starlette](https://github.com/sysid/sse-starlette) | 841 | BSD-3-Clause | python-fastapi | simple | The reference way to do Server-Sent Events on FastAPI/Starlette. `EventSourceResponse` handles the three things hand-rolled SSE always gets wrong: automatic keepalive pings (default 15s, `ping_message_factory` to customise), ... |
+| [temporalio/samples-typescript](https://github.com/temporalio/samples-typescript) | 462 | MIT | nodejs-typescript | professional | Low stars but the highest template density in this category: 60+ runnable sample projects, MIT, maintained by Temporal itself. The canonical layout — `src/workflows.ts`, `src/activities.ts`, `src/worker.ts`, `src/client.ts` — is ... |
+
+### security-compliance
+
+| source | stars | spdx | stack | complexity | what to borrow |
+|---|---:|---|---|---|---|
+| [aquasecurity/trivy](https://github.com/aquasecurity/trivy) | 36974 | Apache-2.0 | go, oci, iac, sbom, sarif, kubernetes | professional | The one scanner that covers vulnerabilities, IaC misconfiguration, secrets, and licence detection in a single binary — the highest-coverage-per-line choice for a generated repo. Author trivy.yaml against the documented config ... |
+| [gitleaks/gitleaks](https://github.com/gitleaks/gitleaks) | 28198 | MIT | go, toml, pre-commit, github-actions | simple | config/gitleaks.toml is the reference ruleset format — each rule is [[rules]] with id / description / regex / entropy / keywords / tags, and [[rules.allowlist]] blocks scoped per-rule rather than globally. Vendor that shape ... |
+| [anchore/grype](https://github.com/anchore/grype) | 12589 | Apache-2.0 | go, sbom, vulnerability-db, oci | standard | The other half of the syft pairing, and the piece that turns an SBOM from a document into a gate. .grype.yaml is authored by the layer, not copied from the repo (none is checked in): `fail-on-severity` is the CI gate knob, and ... |
+| [helmetjs/helmet](https://github.com/helmetjs/helmet) | 10710 | MIT | node, typescript, express, connect | simple | middlewares/ is fourteen self-contained one-header modules (content-security-policy, strict-transport-security, referrer-policy, origin-agent-cluster, the three cross-origin-*-policy modules, and the x-* set) — the cleanest ... |
+| [github/codeql](https://github.com/github/codeql) | 9847 | MIT | ql, java, javascript, python, go, csharp, ruby, rust | professional | The query packs and the query *suites* — MIT-licensed, which makes this the vendorable SAST ruleset in a category where the obvious alternative (Semgrep community rules) is not. Per language, ... |
+| [anchore/syft](https://github.com/anchore/syft) | 9254 | Apache-2.0 | go, sbom, cyclonedx, spdx, oci | standard | The canonical SBOM-generation layer. Note there is no .syft.yaml checked into the repo to copy — the layer authors one against the documented schema. The keys worth emitting: the `output:` multi-format list (emit CycloneDX JSON ... |
+| [sigstore/cosign](https://github.com/sigstore/cosign) | 6142 | Apache-2.0 | go, oci, oidc, in-toto, rekor | professional | The reference implementation of artifact signing and, more importantly, of *verifying* at admission time. Borrow three concrete things: (1) the keyless CI signing step — `cosign sign --yes <image>@<digest>` with `id-token: write` ... |
+| [ossf/scorecard](https://github.com/ossf/scorecard) | 5587 | Apache-2.0 | go, github-actions, sarif, probes | standard | Use it as the requirements document for what a hardened repository looks like — each check under checks/ (Branch-Protection, Token-Permissions, Pinned-Dependencies, Dangerous-Workflow, Signed-Releases, Dependency-Update-Tool, ... |
+| [open-policy-agent/conftest](https://github.com/open-policy-agent/conftest) | 3224 | Apache-2.0 | go, rego, opa, yaml, terraform | standard | The generic "assert things about config files" engine — the right tool when a compliance rule is repo-specific and no off-the-shelf scanner covers it. Borrow the policy/ convention and the deny/warn/violation rule naming contract ... |
+| [ComplianceAsCode/content](https://github.com/ComplianceAsCode/content) | 2769 | BSD-3-Clause | yaml, jinja2, ansible, bash, scap, openscap | enterprise | The most mature open-source answer to "compliance as code", and BSD-3-Clause so it is actually copyable. The structural idea is the prize: a single control definition compiles into an OVAL check, an Ansible remediation task, and ... |
+| [step-security/harden-runner](https://github.com/step-security/harden-runner) | 1228 | Apache-2.0 | github-actions, typescript, ebpf | simple | The single highest-value four-line addition to any generated CI workflow. Borrow the step shape from the README — `uses: step-security/harden-runner@<sha>` with `egress-policy: audit` on first adoption, then `egress-policy: ... |
+| [sigstore/gitsign](https://github.com/sigstore/gitsign) | 1110 | Apache-2.0 | go, git, oidc, sigstore | simple | Keyless commit signing with zero key management — the whole value is about ten lines of git config that a layer can emit directly: gpg.x509.program=gitsign, gpg.format=x509, commit.gpgsign=true, tag.gpgsign=true, and ... |
+| [CycloneDX/specification](https://github.com/CycloneDX/specification) | 524 | Apache-2.0 | json-schema, xsd, protobuf, sbom | standard | The schema itself, and it is Apache-2.0 — unusually permissive for a standard, so the JSON Schema files under schema/ (bom-1.6.schema.json and the SPDX licence enum it references) can be vendored directly into a layer for offline ... |
+| [oscal-compass/compliance-trestle](https://github.com/oscal-compass/compliance-trestle) | 264 | Apache-2.0 | python, oscal, pydantic, json, markdown | enterprise | OSCAL (NIST's machine-readable control language) is where compliance-as-code is heading, and this is the only well-maintained permissive toolchain for it. Two borrowable ideas: (1) the Pydantic models generated from the OSCAL ... |
+
+### testing
+
+| source | stars | spdx | stack | complexity | what to borrow |
+|---|---:|---|---|---|---|
+| [microsoft/playwright](https://github.com/microsoft/playwright) | 93088 | Apache-2.0 | TypeScript/Node - cross-browser E2E runner, test fixtures, ... | enterprise | The single best source for an E2E layer. Take tests/playwright-test/playwright.config.ts as the canonical multi-project config - it is the repo's own runner config, so it shows projects/, per-project `use` overrides and reporter ... |
+| [cypress-io/cypress](https://github.com/cypress-io/cypress) | 50608 | MIT | TypeScript/Node monorepo - E2E + component testing runner, ... | professional | The component-testing story is what Playwright does not have, and it lives in npm/ - each of npm/react, npm/vue, npm/angular, npm/mount-utils, npm/webpack-dev-server and npm/vite-dev-server is a self-contained adapter showing how ... |
+| [jestjs/jest](https://github.com/jestjs/jest) | 45459 | MIT | TypeScript/Node monorepo - test runner, snapshot engine, ... | professional | examples/ is a ready-made set of starter configs per stack - examples/typescript, examples/react, examples/angular, examples/snapshot and friends each ship a package.json plus config that can be lifted almost verbatim into a ... |
+| [locustio/locust](https://github.com/locustio/locust) | 28007 | MIT | Python - distributed load testing, scenarios as plain ... | simple | examples/ is a flat, copy-ready library of locustfiles - examples/basic.py and examples/locustfile.py are the strip-down-to-nothing starting points that make this the `simple` rung of the load-testing ladder. The ones that matter ... |
+| [mswjs/msw](https://github.com/mswjs/msw) | 18076 | MIT | TypeScript - network-layer API mocking via Service Worker ... | simple | The cleanest single-concern layer in this category and the easiest to strip down. src/mockServiceWorker.js is the literal artifact that must land in the generated repo's public/ directory - the `msw init` step just copies it, so ... |
+| [vitest-dev/vitest](https://github.com/vitest-dev/vitest) | 16858 | MIT | TypeScript - Vite-native unit test runner, v8/istanbul ... | standard | examples/ is the layer catalogue, and its CURRENT contents matter because the old react/react-testing-lib examples are gone - as of this pass it holds basic, fastify, in-source-test, lit, opentelemetry, profiling, projects and ... |
+| [pytest-dev/pytest](https://github.com/pytest-dev/pytest) | 14346 | MIT | Python - test framework, fixture system, plugin ... | professional | doc/en/example/ is the highest-value directory in the repo for template generation - it is a curated set of runnable layouts (parametrisation, fixture scoping, marker usage, simple/ and special/ directory conventions) written ... |
+| [dubzzz/fast-check](https://github.com/dubzzz/fast-check) | 5069 | MIT | TypeScript - property-based testing, arbitraries, ... | standard | examples/ is small and deliberately pedagogical, and each numbered directory is a distinct layer variant: examples/001-simple (basic properties over pure functions), examples/002-recursive/isSearchTree (recursive data-structure ... |
+| [xunit/xunit](https://github.com/xunit/xunit) | 4591 | Apache-2.0 | .NET / C# - xUnit.net v3 test framework, in-process runner, ... | professional | The v3 project layout under src/ is the reference for a modern .NET test setup - src/xunit.v3.core/xunit.v3.core.csproj shows the current package/TFM targeting, and the v3 shift matters for template generation because a v3 test ... |
+| [testcontainers/testcontainers-dotnet](https://github.com/testcontainers/testcontainers-dotnet) | 4334 | MIT | .NET / C# - ephemeral Docker fixtures, xUnit/NUnit ... | professional | examples/ is the reason to pick this over the Java port for template work - it contains three complete, small, runnable reference applications rather than library internals: examples/WeatherForecast (an ASP.NET Core API wired to ... |
+| [schemathesis/schemathesis](https://github.com/schemathesis/schemathesis) | 3474 | MIT | Python + Rust core - property-based API testing driven from ... | standard | The most under-used layer in this category: it turns an OpenAPI document into a generated conformance suite with no hand-written cases, which is the cheapest real coverage a generated API template can ship. examples/booking is a ... |
+| [nedbat/coveragepy](https://github.com/nedbat/coveragepy) | 3393 | Apache-2.0 | Python - statement/branch coverage measurement, ... | simple | Read the repo's measurement of ITSELF, not the library - it is the most rigorous coverage configuration available to copy. metacov.ini is the meta-coverage config and shows the full parallel/combine arrangement (measuring ... |
+| [stryker-mutator/stryker-js](https://github.com/stryker-mutator/stryker-js) | 2951 | Apache-2.0 | TypeScript/Node - mutation testing, per-runner plugins ... | standard | e2e/test/ is a corpus of ~60 complete miniature projects, one per supported configuration, and it is the best available answer to "what does a correct stryker.conf.json look like for MY runner" - ... |
+| [testcontainers/testcontainers-node](https://github.com/testcontainers/testcontainers-node) | 2572 | MIT | TypeScript/Node - throwaway Docker containers as test ... | standard | packages/modules/ is a catalogue of ~40 ready service fixtures - postgresql, redis, kafka, mongodb, localstack, elasticsearch, clickhouse, cockroachdb, k3s, azurite, azurecosmosdb, chromadb and more - and each module directory is ... |
+| [pact-foundation/pact-js](https://github.com/pact-foundation/pact-js) | 1791 | MIT | TypeScript/Node - consumer-driven contract testing (Pact ... | professional | examples/ is unusually well-organised and maps one-to-one onto layer variants: examples/http (the baseline consumer + provider pair), examples/messages (async/event contracts, the case most contract-testing guides skip), ... |
+
+---
+
+## Reference-only sources (5) - DO NOT COPY CODE
+
+> **These are read-only.** Copying a file from any repository in this table imports its copyleft or
+> ShareAlike obligation into every repository Groundplan generates from that layer. Study the design,
+> then reimplement in original code and original words. Running these as a container, or depending on
+> them as an unmodified package, is fine; vendoring their source is not.
+
+| source | stars | spdx | category | why it is fenced | what may still be learned |
+|---|---:|---|---|---|---|
+| [strapi/strapi](https://github.com/strapi/strapi) | 72681 | NOASSERTION | cms-ecommerce | The license is the problem. GitHub reports `license.spdx_id: NOASSERTION`, and the LICENSE file grants MIT Expat only (a) for code outside any `ee/` directory AND (b) if you have no registered account on Strapi's cloud offering — everything under `ee/` is ... | READ ONLY — DO NOT COPY FILES. The most-starred CMS in the category and worth studying for its content-type-builder model (schemas as JSON under `src/api/*/content-types/*/schema.json`, editable at ... |
+| [goauthentik/authentik](https://github.com/goauthentik/authentik) | 22373 | NOASSERTION | auth | Do not copy files — the split license is the whole problem, and features drifting into `authentik/enterprise/` over time means a path that is MIT today may not be tomorrow. Operationally it needs server + worker + Postgres + Redis, so the compose floor is ... | Read for the blueprint system: `blueprints/` (default, example, system, migrations, plus `schema.json`) expresses the entire IdP configuration — flows, stages, prompts, policies, providers — as ... |
+| [HangfireIO/Hangfire](https://github.com/HangfireIO/Hangfire) | 10098 | LGPL-3.0-or-later | realtime-messaging | The licence is a genuine trap: the GitHub API reports NOASSERTION and many blog posts describe Hangfire as simply "open source", but LICENSE.md is a multi-license under which the free terms are LGPL v3 — copying files into a generated project is out of scope ... | IDEAS ONLY — the OSS arm of the multi-license is LGPL v3, so no source copying. Hangfire remains the reference background-job design for .NET and the patterns are worth reimplementing over a ... |
+| [riverqueue/river](https://github.com/riverqueue/river) | 5449 | MPL-2.0 | realtime-messaging | The license is the gate: MPL-2.0 obliges you to publish modifications to any River file you alter, which is exactly what a scaffolding tool would cause downstream users to do unknowingly. Keep it a go.mod dependency, never vendored source. Technically, ... | IDEAS ONLY — MPL-2.0 is file-level copyleft, so no River source may be vendored. The idea worth reimplementing is transactional enqueueing: insert the job in the same Postgres transaction as the ... |
+| [vectordotdev/vector](https://github.com/vectordotdev/vector) | - | MPL-2.0 | observability | LICENSE fetched from raw.githubusercontent.com confirms Mozilla Public License 2.0. File-level copyleft: modifying an MPL file obliges you to publish that file's source under MPL, which does not infect the rest of a generated repo but is still a condition we ... |  |
+
+Additionally fenced reference-only by the security-compliance pass (documentation and spec sources,
+not code repositories, so they carry no full catalog entry):
+
+| source | spdx | why |
+|---|---|---|
+| [OWASP/ASVS](https://github.com/OWASP/ASVS) | CC-BY-SA-4.0 | ShareAlike propagates to derivative works - pasting requirement text into generated docs would put CC-BY-SA on the consumer's repository. Restate in original words, cite by URL. |
+| [OWASP/CheatSheetSeries](https://github.com/OWASP/CheatSheetSeries) | CC-BY-SA-4.0 | Same ShareAlike propagation. Read for control coverage; write your own prose. |
+| [slsa-framework/slsa](https://github.com/slsa-framework/slsa) | Community Specification License 1.0 | API reports NOASSERTION; LICENSE.md is a standards-body license, not an OSI code license. The *generator* repo (slsa-framework/slsa-github-generator, Apache-2.0) is separately vendorable and is listed above. |
+| [github/advisory-database](https://github.com/github/advisory-database) | CC-BY-4.0 | Attribution-only and permissive in spirit, but outside the vendorable allowlist. Held at reference-only pending an explicit policy call. |
+
+---
+
+## Excluded (16) - do not re-research these
+
+Recorded so a later pass does not rediscover a popular repository and assume it is usable. Star counts
+are deliberately included: **popularity is not a license.** Eleven of the entries below have no LICENSE
+file at all, several of them with five-figure star counts.
+
+| source | stars | spdx | category | reason |
+|---|---:|---|---|---|
+| [anthropics/skills](https://github.com/anthropics/skills) | 162394 | NONE | agent-tooling | Do not vendor any file. The README's "most skills are Apache 2.0" claim is not backed by an Apache LICENSE file anywhere we could find, and skills/docx, skills/pdf, skills/pptx and skills/xlsx carry an explicit source-available LICENSE.txt forbidding extraction, copying, and retention outside Anthropic's services. Treat the whole repo as ... |
+| [grafana/grafana](https://github.com/grafana/grafana) | 75619 | AGPL-3.0 | observability | AGPL-3.0 confirmed by reading the LICENSE file ("GNU AFFERO GENERAL PUBLIC LICENSE Version 3"). Copying Grafana source would force AGPL terms onto every repo Groundplan generates. Grafana may still be RUN as a container and configured via provisioning YAML that we author ourselves - that config is our own work and carries no AGPL ... |
+| [ComposioHQ/awesome-claude-skills](https://github.com/ComposioHQ/awesome-claude-skills) | 68043 | NONE | agent-tooling | No LICENSE file despite 68k stars, and it is corporate-maintained, which makes silent relicensing or takedown more likely, not less. Do not vendor. |
+| [hesreallyhim/awesome-claude-code](https://github.com/hesreallyhim/awesome-claude-code) | 50333 | CC-BY-NC-ND-4.0 | agent-tooling | CC-BY-NC-ND-4.0 is a double disqualifier: NonCommercial forbids use in a commercial tool, and NoDerivatives forbids adaptation even with attribution. The LICENSE states the terms were chosen deliberately to prevent appropriation and asks that you contact the maintainer for modified use. Do not vendor entries, descriptions, or the list's ... |
+| [directus/directus](https://github.com/directus/directus) | 36598 | NOASSERTION | cms-ecommerce | EXCLUDED ON LICENSE. The LICENSE file at the repo root is the "Monospace Sustainable Core License, Version 1.0" (self-abbreviated MSCL-1.0-GPL), fetched and read directly. It grants use only for a "Permitted Purpose", explicitly excluding any "Competing Use", and forbids moving, disabling or circumventing the software's license-key ... |
+| [grafana/loki](https://github.com/grafana/loki) | 28581 | AGPL-3.0 | observability | Added 2026-07-19. AGPL-3.0 confirmed by fetching the LICENSE file from raw.githubusercontent.com, which opens "GNU AFFERO GENERAL PUBLIC LICENSE Version 3, 19 November 2007". Same boundary as grafana/grafana: Loki may be RUN as a container and pointed at by a collector exporter or a Grafana datasource we author ourselves, but no source, ... |
+| [travisvn/awesome-claude-skills](https://github.com/travisvn/awesome-claude-skills) | 14186 | NONE | agent-tooling | No LICENSE file at main or master. A curated list is a compilation and its selection and arrangement are protected; do not copy the list structure or entry descriptions. |
+| [contains-studio/agents](https://github.com/contains-studio/agents) | 12399 | NONE | agent-tooling | No LICENSE file, and effectively abandoned — last push 2025-07-28, roughly a year stale. All-rights-reserved. Do not vendor despite the 12k stars. |
+| [vendurehq/vendure](https://github.com/vendurehq/vendure) | 8255 | GPL-3.0-or-later | cms-ecommerce | EXCLUDED ON LICENSE. `LICENSE.md` on the `master` branch states dual licensing: GPLv3 as the Community Edition by default, or a paid Vendure Commercial License. GPLv3 is copyleft and fails the gate. There is a section-7 additional permission allowing *plugins* to be distributed under a different license, but that exception covers ... |
+| [appcypher/awesome-mcp-servers](https://github.com/appcypher/awesome-mcp-servers) | 5697 | NONE | agent-tooling | No LICENSE file at main or master. Do not copy entries or categorization. |
+| [disler/claude-code-hooks-mastery](https://github.com/disler/claude-code-hooks-mastery) | 3834 | NONE | agent-tooling | No LICENSE file at main or master despite 3.8k stars and constant citation as a template. Its ubiquity in tutorials makes accidental copying likely — flag it explicitly in contributor guidance. |
+| [mgechev/skills-best-practices](https://github.com/mgechev/skills-best-practices) | 2125 | NONE | agent-tooling | No LICENSE file at main. Do not vendor text, checklists, or rule wording from it. |
+| [disler/claude-code-hooks-multi-agent-observability](https://github.com/disler/claude-code-hooks-multi-agent-observability) | 1494 | NONE | agent-tooling | No LICENSE file. Also architecturally heavy (server plus client dashboard) relative to anything a scaffolding tool should emit by default. |
+| [qdhenry/Claude-Command-Suite](https://github.com/qdhenry/Claude-Command-Suite) | 1314 | NONE | agent-tooling | No LICENSE file at main or master. Frequently recommended in blog posts and search results as if it were freely reusable; it is not. |
+| [openobserve/openobserve](https://github.com/openobserve/openobserve) | - | AGPL-3.0 | observability | AGPL-3.0 confirmed by fetching the LICENSE file directly ("GNU AFFERO GENERAL PUBLIC LICENSE Version 3"), upgrading the previous revision's README-based claim to a primary source. A separate commercial Enterprise Edition exists. The license gate excludes it regardless of stars or activity. |
+| [getsentry/sentry](https://github.com/getsentry/sentry) | - | FSL-1.1-Apache-2.0 | observability | LICENSE.md fetched from raw.githubusercontent.com confirms "Functional Source License, Version 1.1, Apache 2.0 Future License". Source-available with a competitive-use restriction, not open source - excluded. This applies to the Sentry SERVER only; the getsentry/sentry-javascript SDK is separately MIT and is promoted in sources above. |
+
+Also excluded, recorded in category headers and `droppedCandidates` rather than as full entries:
+
+| source | spdx | reason |
+|---|---|---|
+| [semgrep/semgrep-rules](https://github.com/semgrep/semgrep-rules) | Semgrep Rules License v1.0 | API says NOASSERTION. The root LICENSE is a one-line pointer to semgrep.dev/legal/rules-license: use is limited to "your own internal business purposes", and it "does not allow you to distribute the rules, or to make them available to others as a service". Shipping a rule file inside a generated repo **is** distribution. Re-read 2026-07-19 - terms are now *stricter* than the LGPL-2.1 + Commons Clause this catalog previously recorded. The rules read like MIT YAML, which makes this the single most likely mistake in the category; use `github/codeql` (MIT) as the vendorable SAST ruleset instead. |
+| [renovatebot/renovate](https://github.com/renovatebot/renovate) | AGPL-3.0 | The shared config presets everyone cites (`config:recommended`, `:semanticCommits`, the whole `lib/config/presets/internal/` tree) live inside the AGPL repo. *Referencing* a preset by name from your own `renovate.json` is use, not distribution, and is fine. **Inlining a preset body into a layer is not.** The already-built `security-supply-chain` layer must keep its renovate.json a reference-by-name config. |
+| [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) | AGPL-3.0 | The sibling tool everyone reflexively pairs with gitleaks, which is exactly how it gets copied by accident. `gitleaks` (MIT) is the vendorable secret-scanning source. |
+| [open-webui/open-webui](https://github.com/open-webui/open-webui) | custom "Open WebUI License" | BSD-3 plus a branding-restriction clause forbidding removal of Open WebUI branding. Not OSI permissive. |
+| [Arize-ai/phoenix](https://github.com/Arize-ai/phoenix) | Elastic License 2.0 | Source-available with a no-managed-service restriction. |
+
+### Dead-link warning
+
+`jeremylong/DependencyCheck` - the historically cited URL, still the top search result - is now
+**archived at 54 stars** (a stub). The live project is
+[dependency-check/DependencyCheck](https://github.com/dependency-check/DependencyCheck)
+(7,625 stars, Apache-2.0, last commit 2026-07-18). Any catalog entry or blog post pointing at the
+`jeremylong` path is a dead link in practice.
+
+### Partial-grant repositories - vendorable, with a hole in them
+
+These pass the gate but carve a directory out of their own permissive grant. Copy from them, but never
+from the carved-out path:
+
+| source | carve-out |
+|---|---|
+| [BerriAI/litellm](https://github.com/BerriAI/litellm) | MIT **except** the entire `enterprise/` directory, which is outside the grant. |
+| [github/codeql](https://github.com/github/codeql) | Repo code is MIT and the rules are copyable; the CLI/engine ships from `github/codeql-cli-binaries` under separate commercial terms for closed-source analysis and is not redistributable. The `LICENSE.md` visible on the rendered page is a README hyperlink to that other repo, not a second root license. |
+| [goauthentik/authentik](https://github.com/goauthentik/authentik) | Split license, and features drift into `authentik/enterprise/` over time - a path that is MIT today may not be next release. Fenced reference-only for exactly this reason. |
+| [strapi/strapi](https://github.com/strapi/strapi) | MIT Expat only for code outside `ee/` **and** only if you hold no registered account on Strapi Cloud. A grant conditioned on your commercial relationship with the vendor is not a clean MIT. Fenced reference-only. |
+
+---
+
+## Attribution
+
+Every source below requires its copyright notice and license text to be preserved **if any of its code
+is adapted into a generated repository**. Apache-2.0 additionally requires a NOTICE file to be carried
+forward where the upstream project ships one, and requires that modified files be marked as changed.
+
+The mechanical rule for Groundplan: **any layer that vendors code from a source in this section must
+emit a `THIRD-PARTY-NOTICES.md` entry naming the source, its URL, its SPDX id, and the upstream
+copyright line.** MIT and ISC sources carry the same obligation and are far more numerous, so the
+generator should treat notice emission as universal rather than conditional - this section exists
+because Apache-2.0 and BSD add the NOTICE-file and non-endorsement clauses on top.
+
+### Apache-2.0 (105) - preserve LICENSE + NOTICE, mark modified files
+
+| source | spdx | category |
+|---|---|---|
+| [agentskills/agentskills](https://github.com/agentskills/agentskills) | Apache-2.0 | agent-tooling |
+| [amitshekhariitbhu/go-backend-clean-architecture](https://github.com/amitshekhariitbhu/go-backend-clean-architecture) | Apache-2.0 | backend-api |
+| [anchore/grype](https://github.com/anchore/grype) | Apache-2.0 | security-compliance |
+| [anchore/syft](https://github.com/anchore/syft) | Apache-2.0 | security-compliance |
+| [apache/airflow](https://github.com/apache/airflow) | Apache-2.0 | data-engineering |
+| [apache/iceberg-python](https://github.com/apache/iceberg-python) | Apache-2.0 | data-engineering |
+| [apache/kafka](https://github.com/apache/kafka) | Apache-2.0 | realtime-messaging |
+| [aquasecurity/trivy](https://github.com/aquasecurity/trivy) | Apache-2.0 | security-compliance |
+| [astronomer/astronomer-cosmos](https://github.com/astronomer/astronomer-cosmos) | Apache-2.0 | data-engineering |
+| [atlas](https://github.com/ariga/atlas) | Apache-2.0 | database-orm |
+| [authelia/authelia](https://github.com/authelia/authelia) | Apache-2.0 | auth |
+| [aws-ia/terraform-aws-eks-blueprints](https://github.com/aws-ia/terraform-aws-eks-blueprints) | Apache-2.0 | devops-cicd |
+| [BabylonJS/Babylon.js](https://github.com/BabylonJS/Babylon.js) | Apache-2.0 | game-3d |
+| [boxyhq/saas-starter-kit](https://github.com/boxyhq/saas-starter-kit) | Apache-2.0 | payments-billing |
+| [cachix/devenv](https://github.com/cachix/devenv) | Apache-2.0 | devops-cicd |
+| [casbin/casbin](https://github.com/casbin/casbin) | Apache-2.0 | auth |
+| [ccplugins/awesome-claude-code-plugins](https://github.com/ccplugins/awesome-claude-code-plugins) | Apache-2.0 | agent-tooling |
+| [centrifugal/centrifugo](https://github.com/centrifugal/centrifugo) | Apache-2.0 | realtime-messaging |
+| [chroma-core/chroma](https://github.com/chroma-core/chroma) | Apache-2.0 | ai-llm |
+| [confident-ai/deepeval](https://github.com/confident-ai/deepeval) | Apache-2.0 | ai-llm |
+| [coroot/coroot](https://github.com/coroot/coroot) | Apache-2.0 | observability |
+| [cyanheads/git-mcp-server](https://github.com/cyanheads/git-mcp-server) | Apache-2.0 | agent-tooling |
+| [CycloneDX/specification](https://github.com/CycloneDX/specification) | Apache-2.0 | security-compliance |
+| [dagster-io/dagster](https://github.com/dagster-io/dagster) | Apache-2.0 | data-engineering |
+| [Dapper](https://github.com/DapperLib/Dapper) | Apache-2.0 | database-orm |
+| [dbt-labs/dbt-project-evaluator](https://github.com/dbt-labs/dbt-project-evaluator) | Apache-2.0 | data-engineering |
+| [dbt-labs/dbt-utils](https://github.com/dbt-labs/dbt-utils) | Apache-2.0 | data-engineering |
+| [dbt-labs/jaffle_shop_duckdb](https://github.com/dbt-labs/jaffle_shop_duckdb) | Apache-2.0 | data-engineering |
+| [debezium/debezium](https://github.com/debezium/debezium) | Apache-2.0 | data-engineering |
+| [delta-io/delta-rs](https://github.com/delta-io/delta-rs) | Apache-2.0 | data-engineering |
+| [dlt-hub/dlt](https://github.com/dlt-hub/dlt) | Apache-2.0 | data-engineering |
+| [drizzle-orm](https://github.com/drizzle-team/drizzle-orm) | Apache-2.0 | database-orm |
+| [duckdb/dbt-duckdb](https://github.com/duckdb/dbt-duckdb) | Apache-2.0 | data-engineering |
+| [elementary-data/elementary](https://github.com/elementary-data/elementary) | Apache-2.0 | data-engineering |
+| [fivetran/great_expectations](https://github.com/fivetran/great_expectations) | Apache-2.0 | data-engineering |
+| [fluxcd/flux2-kustomize-helm-example](https://github.com/fluxcd/flux2-kustomize-helm-example) | Apache-2.0 | devops-cicd |
+| [google/slo-generator](https://github.com/google/slo-generator) | Apache-2.0 | observability |
+| [grafana/alloy](https://github.com/grafana/alloy) | Apache-2.0 | observability |
+| [grafana/docker-otel-lgtm](https://github.com/grafana/docker-otel-lgtm) | Apache-2.0 | observability |
+| [hellofresh/health-go](https://github.com/hellofresh/health-go) | Apache-2.0 | observability |
+| [hynek/structlog](https://github.com/hynek/structlog) | Apache-2.0 OR MIT | observability |
+| [jaegertracing/jaeger](https://github.com/jaegertracing/jaeger) | Apache-2.0 | observability |
+| [juspay/hyperswitch](https://github.com/juspay/hyperswitch) | Apache-2.0 | payments-billing |
+| [keycloak/keycloak](https://github.com/keycloak/keycloak) | Apache-2.0 | auth |
+| [killbill/killbill](https://github.com/killbill/killbill) | Apache-2.0 | payments-billing |
+| [micrometer-metrics/micrometer](https://github.com/micrometer-metrics/micrometer) | Apache-2.0 | observability |
+| [microsoft/playwright](https://github.com/microsoft/playwright) | Apache-2.0 | testing |
+| [microsoft/playwright-mcp](https://github.com/microsoft/playwright-mcp) | Apache-2.0 | agent-tooling |
+| [modelcontextprotocol/registry](https://github.com/modelcontextprotocol/registry) | Apache-2.0 | agent-tooling |
+| [modelcontextprotocol/servers](https://github.com/modelcontextprotocol/servers) | Apache-2.0 | agent-tooling |
+| [modelcontextprotocol/typescript-sdk](https://github.com/modelcontextprotocol/typescript-sdk) | Apache-2.0 | agent-tooling, ai-llm |
+| [nats-io/nats.go](https://github.com/nats-io/nats.go) | Apache-2.0 | realtime-messaging |
+| [nedbat/coveragepy](https://github.com/nedbat/coveragepy) | Apache-2.0 | testing |
+| [open-policy-agent/conftest](https://github.com/open-policy-agent/conftest) | Apache-2.0 | security-compliance |
+| [open-telemetry/opentelemetry-collector-contrib](https://github.com/open-telemetry/opentelemetry-collector-contrib) | Apache-2.0 | observability |
+| [open-telemetry/opentelemetry-collector-releases](https://github.com/open-telemetry/opentelemetry-collector-releases) | Apache-2.0 | observability |
+| [open-telemetry/opentelemetry-demo](https://github.com/open-telemetry/opentelemetry-demo) | Apache-2.0 | observability |
+| [open-telemetry/opentelemetry-dotnet](https://github.com/open-telemetry/opentelemetry-dotnet) | Apache-2.0 | observability |
+| [open-telemetry/opentelemetry-dotnet-contrib](https://github.com/open-telemetry/opentelemetry-dotnet-contrib) | Apache-2.0 | observability |
+| [open-telemetry/opentelemetry-go](https://github.com/open-telemetry/opentelemetry-go) | Apache-2.0 | observability |
+| [open-telemetry/opentelemetry-go-contrib](https://github.com/open-telemetry/opentelemetry-go-contrib) | Apache-2.0 | observability |
+| [open-telemetry/opentelemetry-java-instrumentation](https://github.com/open-telemetry/opentelemetry-java-instrumentation) | Apache-2.0 | observability |
+| [open-telemetry/opentelemetry-js](https://github.com/open-telemetry/opentelemetry-js) | Apache-2.0 | observability |
+| [open-telemetry/opentelemetry-js-contrib](https://github.com/open-telemetry/opentelemetry-js-contrib) | Apache-2.0 | observability |
+| [open-telemetry/opentelemetry-python](https://github.com/open-telemetry/opentelemetry-python) | Apache-2.0 | observability |
+| [open-telemetry/opentelemetry-python-contrib](https://github.com/open-telemetry/opentelemetry-python-contrib) | Apache-2.0 | observability |
+| [openfga/openfga](https://github.com/openfga/openfga) | Apache-2.0 | auth |
+| [openiddict/openiddict-core](https://github.com/openiddict/openiddict-core) | Apache-2.0 | auth |
+| [openmeterio/openmeter](https://github.com/openmeterio/openmeter) | Apache-2.0 | payments-billing |
+| [OpenSLO/OpenSLO](https://github.com/OpenSLO/OpenSLO) | Apache-2.0 | observability |
+| [ory/hydra](https://github.com/ory/hydra) | Apache-2.0 | auth |
+| [ory/kratos](https://github.com/ory/kratos) | Apache-2.0 | auth |
+| [oscal-compass/compliance-trestle](https://github.com/oscal-compass/compliance-trestle) | Apache-2.0 | security-compliance |
+| [ossf/scorecard](https://github.com/ossf/scorecard) | Apache-2.0 | security-compliance |
+| [polarsource/polar](https://github.com/polarsource/polar) | Apache-2.0 | payments-billing |
+| [powersync-ja/powersync-js](https://github.com/powersync-ja/powersync-js) | Apache-2.0 | mobile-desktop |
+| [PrefectHQ/fastmcp](https://github.com/PrefectHQ/fastmcp) | Apache-2.0 | ai-llm |
+| [prisma-examples](https://github.com/prisma/prisma-examples) | Apache-2.0 | database-orm |
+| [prometheus-operator/kube-prometheus](https://github.com/prometheus-operator/kube-prometheus) | Apache-2.0 | devops-cicd, observability |
+| [prometheus/client_golang](https://github.com/prometheus/client_golang) | Apache-2.0 | observability |
+| [prometheus/prometheus](https://github.com/prometheus/prometheus) | Apache-2.0 | observability |
+| [pyrra-dev/pyrra](https://github.com/pyrra-dev/pyrra) | Apache-2.0 | observability |
+| [qdrant/qdrant](https://github.com/qdrant/qdrant) | Apache-2.0 | ai-llm |
+| [serilog/serilog](https://github.com/serilog/serilog) | Apache-2.0 | observability |
+| [sigstore/cosign](https://github.com/sigstore/cosign) | Apache-2.0 | security-compliance |
+| [sigstore/gitsign](https://github.com/sigstore/gitsign) | Apache-2.0 | security-compliance |
+| [slok/sloth](https://github.com/slok/sloth) | Apache-2.0 | observability |
+| [slsa-framework/slsa-github-generator](https://github.com/slsa-framework/slsa-github-generator) | Apache-2.0 | devops-cicd, security-compliance |
+| [SQLMesh/sqlmesh](https://github.com/SQLMesh/sqlmesh) | Apache-2.0 | data-engineering |
+| [stefanprodan/podinfo](https://github.com/stefanprodan/podinfo) | Apache-2.0 | devops-cicd |
+| [step-security/harden-runner](https://github.com/step-security/harden-runner) | Apache-2.0 | security-compliance |
+| [stryker-mutator/stryker-js](https://github.com/stryker-mutator/stryker-js) | Apache-2.0 | testing |
+| [supabase](https://github.com/supabase/supabase) | Apache-2.0 | database-orm, fullstack-saas |
+| [supabase/realtime](https://github.com/supabase/realtime) | Apache-2.0 | realtime-messaging |
+| [tauri-apps/create-tauri-app](https://github.com/tauri-apps/create-tauri-app) | Apache-2.0 | mobile-desktop |
+| [terraform-aws-modules/terraform-aws-eks](https://github.com/terraform-aws-modules/terraform-aws-eks) | Apache-2.0 | devops-cicd |
+| [terraform-aws-modules/terraform-aws-vpc](https://github.com/terraform-aws-modules/terraform-aws-vpc) | Apache-2.0 | devops-cicd |
+| [TheBevyFlock/bevy_new_2d](https://github.com/TheBevyFlock/bevy_new_2d) | MIT OR Apache-2.0 OR CC0-1.0 | game-3d |
+| [tremorlabs/tremor](https://github.com/tremorlabs/tremor) | Apache-2.0 | frontend-ui |
+| [triggerdotdev/trigger.dev](https://github.com/triggerdotdev/trigger.dev) | Apache-2.0 | realtime-messaging |
+| [useautumn/autumn](https://github.com/useautumn/autumn) | Apache-2.0 | payments-billing |
+| [vercel/ai](https://github.com/vercel/ai) | Apache-2.0 | ai-llm |
+| [vercel/chatbot](https://github.com/vercel/chatbot) | Apache-2.0 | ai-llm |
+| [Xabaril/AspNetCore.Diagnostics.HealthChecks](https://github.com/Xabaril/AspNetCore.Diagnostics.HealthChecks) | Apache-2.0 | observability |
+| [xunit/xunit](https://github.com/xunit/xunit) | Apache-2.0 | testing |
+
+### BSD (7) - preserve copyright notice + non-endorsement clause
+
+| source | spdx | category |
+|---|---|---|
+| [celery/celery](https://github.com/celery/celery) | BSD-3-Clause | realtime-messaging |
+| [ComplianceAsCode/content](https://github.com/ComplianceAsCode/content) | BSD-3-Clause | security-compliance |
+| [flutter/samples](https://github.com/flutter/samples) | BSD-3-Clause | mobile-desktop |
+| [lucia-auth/lucia](https://github.com/lucia-auth/lucia) | MIT AND 0BSD | auth |
+| [saleor/saleor](https://github.com/saleor/saleor) | BSD-3-Clause | cms-ecommerce |
+| [saleor/saleor-dashboard](https://github.com/saleor/saleor-dashboard) | BSD-3-Clause | cms-ecommerce |
+| [sysid/sse-starlette](https://github.com/sysid/sse-starlette) | BSD-3-Clause | realtime-messaging |
+
+### Zero-attribution sources
+
+These carry no attribution burden at all and are the cheapest things in the catalog to copy:
+
+- [docker/awesome-compose](https://github.com/docker/awesome-compose) - CC0-1.0
+- [dotnize/react-tanstarter](https://github.com/dotnize/react-tanstarter) - Unlicense
+- [ithiria894/awesome-claude-code-hooks](https://github.com/ithiria894/awesome-claude-code-hooks) - CC0-1.0
+- [PatrickJS/awesome-cursorrules](https://github.com/PatrickJS/awesome-cursorrules) - CC0-1.0
+- [sanjeed5/awesome-cursor-rules-mdc](https://github.com/sanjeed5/awesome-cursor-rules-mdc) - CC0-1.0
+
+### Non-allowlist SPDX ids that were admitted
+
+Three vendorable entries carry an SPDX id that is not literally on the allowlist. Each was read and
+judged equivalent; recorded here so the exception is visible rather than silent:
+
+- **[pgvector/pgvector](https://github.com/pgvector/pgvector) - `PostgreSQL`.** The PostgreSQL License is a two-clause permissive license, textually an ISC/BSD-2 variant, OSI-approved. Treated as vendorable.
+- **[lucia-auth/lucia](https://github.com/lucia-auth/lucia) - `MIT AND 0BSD`.** Both halves are on the allowlist; the conjunction is stricter than either alone and still passes.
+- **[TheBevyFlock/bevy_new_2d](https://github.com/TheBevyFlock/bevy_new_2d) - `MIT OR Apache-2.0 OR CC0-1.0`,** and **[hynek/structlog](https://github.com/hynek/structlog) - `Apache-2.0 OR MIT`.** Disjunctions: the consumer picks. Take MIT for bevy_new_2d and structlog to minimise the notice burden, and record which arm was chosen in THIRD-PARTY-NOTICES.md - an unrecorded choice is not a choice.
+
+---
+
+## Method and its limits
+
+- License class for every entry was set by **fetching and reading the raw LICENSE text**, not by trusting the API's `license.spdx_id`. Prior passes found six repos whose text contradicted the API, including a 50k-star collection that is CC-BY-NC-ND and a 162k-star repo with no root LICENSE at all. Both are in the excluded table above.
+- **Known gap in provenance:** the unauthenticated `api.github.com` budget (60 req/hr per IP) was exhausted during several passes by concurrent sibling workflows on the same IP. For those entries `stars` and `archived` come from the server-rendered github.com repo page and `lastCommit` from `github.com/{repo}/commits/{branch}.atom`. All are primary GitHub sources, but they are not the REST API. Where both were available they agreed exactly (gitleaks 28198, syft 9254, grype 12589 matched API against HTML). The one field with no HTML equivalent is the API's `disabled` flag, which is therefore unconfirmed for those entries; all of them render and serve files normally, which is inconsistent with being disabled.
+- **MPL detection ordering matters.** A naive text matcher flags MPL-2.0 as AGPL, because the "Secondary License" clause literally names the GNU Affero GPL. `the-nix-way/dev-templates` and `opentofu/opentofu` were both caught by this. Order MPL detection before GNU detection in any automated re-check.
+- A **star count is not a signal of license health**, and in this catalog it is mildly anti-correlated: the four largest excluded repos (162k, 68k, 50k, 14k stars) are excluded precisely because scale let them get away with never adding a LICENSE file.