# S5 Homebrew dossier

Re-surveyed **August 7, 2026** (snapshot 2026-08-08 02:10 UTC; previous pass July 28, 2026 13:28 UTC) from the Homebrew package-management view. The companion [inventory.yaml](inventory.yaml) is the evidence-bearing atom; this dossier interprets it without claiming runtime state for plain casks or leaf formulae.

## What changed since July 28

**The single most important finding of this re-survey is a non-event: not one itemized package was upgraded on disk in eleven days.** Every installed version in this inventory is byte-identical to the last survey's. What moved was upstream — and the staleness number moved with it.

| Change | What actually happened on the machine |
|---|---|
| **Leaves 68 → 71** | Three additions, no removals. `epubcheck` 5.3.0 was installed on request **2026-08-07 14:38**, hours before this scan. `mise` 2026.7.15 was installed on request **2026-07-28 17:32** — the same day as the last survey, about four hours *after* it ran, which is exactly why it was missed. `ripgrep` is the interesting one: **it was not installed in this window at all.** Its receipt is dated 2026-01-06; what changed is that it *became a leaf* — some other installed formula stopped depending on it, so brew now counts it as a top-level choice rather than plumbing. |
| **Casks 34 → 34** | Byte-for-byte the same set. Nothing installed, nothing removed. |
| **Services: ollama `none` → `started`** | `brew services start ollama` was run **2026-07-31 03:30**, creating `~/Library/LaunchAgents/homebrew.mxcl.ollama.plist`. Started services went 2 → 3, and Ollama picked up the S1 launchd-agent overlap that Postgres and Redis already had. It is now a login-armed daemon, not a dormant definition. |
| **Outdated 42 → 53 itemized names** | Twelve went stale (casks `codex`, `font-meslo-lg-nerd-font`; formulae `mingw-w64`, `mise`, `nikto`, `node@24`, `poppler`, `rclone`, `ripgrep`, `subfinder`, `ttyd`; service `php`), and none came back current. Since no installed version moved, *all eleven days of drift are upstream releases landing against a frozen machine.* |
| **Total formulae 238 → 241** | Exactly the three new leaves. The dependency-only bucket is unchanged at **170**, so nothing pulled in new transitive dependencies. |

### One number that lies, and why the flag stayed

`docker-desktop` **disappeared from `brew outdated`** between surveys. It did not get updated. The cask now carries `auto_updates`, so brew defers to Docker Desktop's own updater and stops reporting it by default; `brew outdated --cask --greedy` still names it. The Caskroom receipt is dated **2025-05-16** and the installed build is **4.41.2,191736** against **4.85.0,235549** available — roughly fifteen months behind. Its `outdated` flag is kept deliberately. Dropping it because a reporting default went quiet would have silently marked a badly stale app current, which is precisely the failure this atlas exists to prevent.

## Surface story

Wolf chose 34 casks and 71 formulae reported by `brew leaves`. Homebrew reports 241 installed formulae total, so 170 are dependency-only and are intentionally summarized rather than itemized. That is the cleanest distinction this surface can make between a direct package choice and plumbing required by another choice.

The service registry still has seven rows, but **three** are now live rather than two: `ollama`, `postgresql@14` and `redis`. `brew services list` says `started` for each, and the matching launchd registry probes report `state = running` with pids 1163, 1168 and 1159. (Postgres and Redis changed pid only because the machine rebooted on 2026-08-03 — that is a new boot, not a restart loop.) The other four service definitions — `caddy`, `colima`, `php`, `postgresql@17` — are installed but dormant, and none has ever had a LaunchAgent created. This proves the three active daemons are running; it does not prove whether Wolf uses them directly or whether one local project starts them. S1 owns the detailed LaunchAgent view of the three started services.

⚠ Evidence provenance, stated plainly. This re-survey re-derived **every installed version** first-hand from `brew list --versions` and **every staleness claim** first-hand from `brew outdated`, and confirmed the three new leaves against their own `INSTALL_RECEIPT.json`. What it did *not* redo is the per-package description pass: the prior scan's `brew info` sweep hit a Homebrew cache-write permission boundary, and that limitation is unchanged, so descriptive `purpose` text on pre-existing rows still rests on bounded Homebrew API metadata captured earlier. Descriptions are therefore older than the version facts around them. No secret values were copied. Credential-like settings were detected in the readable PostgreSQL 14 and Redis configuration areas, so those two inventory rows carry `contains_secrets: true` while withholding values.

## Staleness and security priority

`brew outdated` reported **98 rows** on 2026-08-07 (up from 67 on 2026-07-25): **53** of them are itemized packages on this surface and **45** are dependency-only formulae, summarized rather than flagged. In the itemized set, outdated flags are attached to the matching casks, leaves and services, with installed and available versions in each row's notes. The first review priority is still running Redis (8.8.0 → 8.10.0) because it is both active and security-sensitive; **Ollama now joins it** — it is newly a started daemon *and* stale (0.32.0 → 0.32.6). Next are the security-sensitive database/server definitions, the badly-lagging `docker-desktop`, and outdated network/security tooling (`nikto`, `nuclei`, `sqlmap`, `subfinder`, `httpx`, `hydra`, `ffuf`, `radare2`, `metasploit`, `wireshark-app`). Version staleness is a review signal, not permission to upgrade: no mutating Homebrew command was run.

The offensive-security toolset explicitly visible in the leaves is: `amass`, `gobuster`, `hashcat`, `hydra`, `john`, `masscan`, `nikto`, `nuclei`, `sqlmap`, `subfinder`, and `theharvester`. These are called out for visibility in Wolf's cybersecurity context, not because their presence is itself a problem. Their current use was not inferred.

No leaf is labeled abandoned. A leaf proves that Homebrew considers it a direct choice, but this scan did not inspect shell history or project manifests for recent use. ⚠ One overlap is worth a decision rather than a flag: **`mise` and `nvm` are both leaves**, and both manage Node versions. `mise` arrived on 2026-07-28; whichever one is actually driving projects, the other is now redundant plumbing. Therefore outdated leaves are investigation candidates, not evidence-backed prune recommendations.

## Self-use answers

1. Choice versus dependency: 34 casks plus 71 leaves are the deliberate-choice view; the remaining 170 formulae are dependency-only and summarized. The leaf set grew by three, but only two of those were installs — `ripgrep` was reclassified, not added.
2. Running services: `ollama`, `postgresql@14` and `redis` are running now — Ollama is new since the last survey and was a deliberate `brew services start`. The artifacts cannot establish whether Wolf knows they are running or which project consumes them; that requires a project/container cross-check outside this Homebrew surface.
3. Staleness: 98 rows were reported outdated on August 7, 2026 (53 itemized here, 45 dependency-only). Every one of those deltas is upstream movement — nothing on disk was upgraded in eleven days. Prioritize the two active-and-stale daemons (Redis, Ollama), then `docker-desktop` (fifteen months behind and no longer self-reporting), then the outdated security/network tools and security-relevant casks.
4. Abandoned leaves: none can be proven abandoned from Homebrew inventory alone because no recent-use signal was collected.
5. Offensive tooling: the 11 named leaves listed above are installed direct choices and deserve visibility, not an automatic flag. Four of them (`nikto`, `nuclei`, `sqlmap`, `subfinder`) are outdated as of this survey; `nikto` and `subfinder` became so in this window.
6. Safe pruning order: review leaf candidates with no recent-use signal first; verify no project manifest or workflow needs each one; remove only the leaf after that review; then separately reassess dependency-only formulae. Never remove a dependency merely because it was not a leaf, and do not run cleanup as part of this audit.
7. Docker overlap: this surface shows Docker cask/formula and local PostgreSQL/Redis package services, but it does not establish whether an S6 container provides the same database state. The 2026-08-07 S6 re-survey makes the answer easier: Docker currently holds **zero volumes and no persistent database container**, so no container is duplicating this machine's Postgres or Redis state right now. Treat that as an investigate item and compare container names, ports, volumes, and connection endpoints in S6 before pruning either side.

## Per-item dispositions

Disposition is intentionally conservative: `keep` means the package remains a direct, evidenced choice without an outdated signal; `investigate` means a stale, active-service, or security-sensitive review is warranted. There are no evidence-backed `prune` recommendations in this scan. Rows whose disposition moved at the 2026-08-07 re-survey are marked **bold** in the reason column.

| Item | Kind | Disposition | Reason |
| --- | --- | --- | --- |
| `anki` | cask | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `caffeine` | cask | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `chatgpt` | cask | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `claude` | cask | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `codex` | cask | **investigate** | **Newly outdated** at this survey (0.146.0 → 0.147.0); review update priority. |
| `docker` | cask | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `docker-desktop` | cask | **investigate** | **Fifteen months stale** (4.41.2 vs 4.85.0) and no longer self-reporting: the cask is now `auto_updates`, so plain `brew outdated` stays silent. Highest-priority cask review. |
| `figma` | cask | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `font-meslo-lg-nerd-font` | cask | **investigate** | **Newly outdated** at this survey (3.4.0 → 3.5.0); low priority, a font. |
| `godot` | cask | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `google-chrome` | cask | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `insomnia` | cask | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `iterm2` | cask | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `lm-studio` | cask | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `mactex` | cask | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `metasploit` | cask | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `musicbrainz-picard` | cask | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `nordpass` | cask | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `nordvpn` | cask | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `openvpn-connect` | cask | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `paragon-extfs` | cask | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `raspberry-pi-imager` | cask | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `remarkable` | cask | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `steam` | cask | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `tailscale-app` | cask | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `the-unarchiver` | cask | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `ubersicht` | cask | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `visual-studio-code` | cask | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `vlc` | cask | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `whatsapp` | cask | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `wireshark` | cask | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `wireshark-app` | cask | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `xquartz` | cask | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `zap` | cask | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `amass` | leaf-formula | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `caddy` | leaf-formula | **investigate** | Security-sensitive network-capable software; review exposure and intended use. |
| `colima` | leaf-formula | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `composer` | leaf-formula | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `coreutils` | leaf-formula | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `docker` | leaf-formula | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `docker-compose` | leaf-formula | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `ffmpeg` | leaf-formula | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `ffmpeg2theora` | leaf-formula | **investigate** | Homebrew reports it deprecated and no longer maintained upstream; confirm whether any workflow still needs it. |
| `ffuf` | leaf-formula | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `figlet` | leaf-formula | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `gawk` | leaf-formula | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `gh` | leaf-formula | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `git` | leaf-formula | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `git-filter-repo` | leaf-formula | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `git-lfs` | leaf-formula | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `go` | leaf-formula | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `gobuster` | leaf-formula | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `gradle` | leaf-formula | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `hashcat` | leaf-formula | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `httpie` | leaf-formula | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `httpx` | leaf-formula | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `hydra` | leaf-formula | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `imagemagick` | leaf-formula | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `john` | leaf-formula | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `jq` | leaf-formula | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `lolcat` | leaf-formula | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `masscan` | leaf-formula | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `maven` | leaf-formula | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `megatools` | leaf-formula | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `mingw-w64` | leaf-formula | **investigate** | **Newly outdated** at this survey (14.0.0_1 → 14.0.0_2). |
| `minicom` | leaf-formula | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `mkcert` | leaf-formula | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `ncdu` | leaf-formula | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `neofetch` | leaf-formula | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `node@24` | leaf-formula | **investigate** | **Newly outdated** at this survey (24.18.0 → 24.19.0); keg-only, not symlinked into `/opt/homebrew/bin`. |
| `nikto` | leaf-formula | **investigate** | **Newly outdated** at this survey (2.6.0 → 2.6.1); offensive-security tooling. |
| `nuclei` | leaf-formula | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `nvm` | leaf-formula | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `ollama` | leaf-formula | **investigate** | Outdated (0.32.0 → 0.32.6) **and now backing a started service** — see the `ollama` brew-service row. |
| `openjdk@21` | leaf-formula | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `oven-sh/bun/bun` | leaf-formula | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `pandoc` | leaf-formula | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `pgvector` | leaf-formula | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `pipx` | leaf-formula | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `poppler` | leaf-formula | **investigate** | **Newly outdated** at this survey (26.07.0 → 26.08.0). |
| `postgresql@14` | leaf-formula | **investigate** | Security-sensitive network-capable software; review exposure and intended use. |
| `postgresql@17` | leaf-formula | **investigate** | Security-sensitive network-capable software; review exposure and intended use. |
| `powerlevel10k` | leaf-formula | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `python@3.13` | leaf-formula | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `radare2` | leaf-formula | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `rclone` | leaf-formula | **investigate** | **Newly outdated** at this survey (1.74.4 → 1.75.0). |
| `redis` | leaf-formula | **investigate** | Security-sensitive and stale; review exposure and update path deliberately. |
| `rsync` | leaf-formula | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `shellcheck` | leaf-formula | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `sqlmap` | leaf-formula | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `ssh-copy-id` | leaf-formula | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `subfinder` | leaf-formula | **investigate** | **Newly outdated** at this survey (2.14.0 → 2.15.0); offensive-security tooling. |
| `terminal-notifier` | leaf-formula | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `theharvester` | leaf-formula | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `tmux` | leaf-formula | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `tree` | leaf-formula | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `ttyd` | leaf-formula | **investigate** | **Newly outdated** at this survey (1.7.7_11 → 1.7.7_12); it serves a terminal over HTTP, so treat updates as security-relevant. |
| `watch` | leaf-formula | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `wget` | leaf-formula | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `yt-dlp` | leaf-formula | **investigate** | Homebrew reported it outdated; review use and update priority. |
| `zsh-autosuggestions` | leaf-formula | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `zsh-syntax-highlighting` | leaf-formula | **keep** | Direct choice evidenced by the Homebrew registry; no current-use claim is made. |
| `epubcheck` | leaf-formula | **keep** | **New since July 28** (installed 2026-08-07 14:38); current, and pairs with the EPUB/ebook work on this machine. |
| `mise` | leaf-formula | **investigate** | **New since July 28** (installed 2026-07-28 17:32) and already outdated (2026.7.15 → 2026.8.2). ⚠ Overlaps with `nvm` for Node version management — decide which one owns that job. |
| `ripgrep` | leaf-formula | **keep** | **Newly a leaf, not newly installed** (receipt 2026-01-06): something stopped depending on it. Outdated (15.1.0 → 15.2.0); widely used by editor/agent tooling, so keep. |
| `caddy` | brew-service | **investigate** | Installed service definition is dormant; confirm whether it is still wanted. |
| `colima` | brew-service | **investigate** | Installed service definition is dormant; confirm whether it is still wanted. |
| `ollama` | brew-service | **investigate** | **Now started, not dormant** (since 2026-07-31) *and* stale (0.32.0 → 0.32.6). A login-armed local model server; confirm it should run at every login and update it. |
| `php` | brew-service | **investigate** | Still dormant, and **newly outdated** (8.5.8 → 8.5.9); confirm whether it is still wanted at all. |
| `postgresql@14` | brew-service | **investigate** | Running now; confirm the consuming project and security posture before changing it. |
| `postgresql@17` | brew-service | **investigate** | Installed service definition is dormant; confirm whether it is still wanted. |
| `redis` | brew-service | **investigate** | Running now; confirm the consuming project and security posture before changing it. |

## Evidence boundary

All kill strings in `inventory.yaml` are documentation only. No uninstall, service stop/start/restart, upgrade, update, cleanup, sudo, or other machine-mutating command was executed. Plain cask/formula `live_now` remains `n/a` because Homebrew supplies no permitted runtime registry for those kinds.

## Verification gaps, stated honestly

- **No degrade rung was needed.** Every command this surface's spec declares ran cleanly and unprivileged, with `HOMEBREW_NO_AUTO_UPDATE=1` set on every brew invocation, so no tap `git pull` was triggered. No `install`, `uninstall`, `upgrade`, `update`, `cleanup`, or `services start/stop/restart` verb was run, and no sudo.
- **Descriptions are older than versions.** See the evidence-provenance note above: `purpose` prose on pre-existing rows still rests on Homebrew API metadata captured before the cache-write permission boundary was hit. Versions, leaf status, service status and staleness were all re-derived first-hand today.
- **`brew outdated` is not a complete staleness oracle.** The `docker-desktop` case proves it: casks marked `auto_updates` are excluded from the default report. Any future automated staleness count taken from plain `brew outdated` will under-report casks that self-update.
- **Usage is still unmeasured.** Nothing here inspects shell history or project manifests, so no leaf can be called abandoned and no `prune` can be evidence-backed. Every disposition is a prompt for a human.