Three years is a serious commitment for a fork. The drop-in compatibility story is what makes this viable — the biggest adoption barrier for any requests replacement is the migration cost across existing codebases.
Curious how you're handling the cases where people rely on requests internals directly — things like custom HTTPAdapter subclasses or session-level hooks. Those are usually where drop-in replacements start breaking in the real world.
The language-agnostic angle is the right reason to resurrect this. The original gym HTTP API was underrated for exactly that — being able to drive environments from Go or Rust without fighting Python interop was genuinely useful.
Curious whether you're handling the render/visualize endpoints via server-sent events or polling. Streaming frame data over HTTP for visualisation can get messy fast, especially at higher framerates.
The JSONB approach for time-series is pragmatic for this scale. The 90-day sleep query concern is real though — have you considered a partial index on the timestamp field within the JSONB, or is the aggregation layer from Terra making that unnecessary?
Also curious about the MCP server design: are you streaming responses back to Claude or returning complete payloads? For trend analysis over 90 days that could be a meaningful difference in perceived latency.
The SQLite comparison is the right framing. The embedded graph DB space has been missing something you can just drop into a process without ops overhead — Neo4j is great until you're building a CLI or serverless function and don't want to provision a server for it.
The 27ms cold start is compelling for serverless. Curious how the traversal performance scales with graph size — is the lag on 1-hop/2-hop paths a fundamental architecture constraint or something you expect to close with query planner work?
The structured audit report output is the most useful part for teams — raw diagnostic output is fine for individuals but useless in a compliance or incident review context without formatting.
Curious about the threat model here: is this designed for self-diagnostics by end users, or for IT teams auditing multiple endpoints? The GUI suggests the former, but the network detection features feel more like the latter. Knowing which one would help frame what the tool is actually optimising for.
CSP headers are one of those things that look simple until you actually audit them. The bypass detection is the useful part — I've seen plenty of Laravel apps with a CSP that looks reasonable until you notice it allows unsafe-inline because someone needed a quick fix three years ago and nobody noticed.
Does it handle report-uri vs report-to differences? The migration between those two has caught a few teams I've worked with off guard.
The pytest decorators are the most immediately useful part for me — @skip_linux and @unless_macos solve something I've hacked around with pytest.mark.skipif(sys.platform != ...) more times than I'd like to admit.
The CI and AI agent detection is interesting. Curious how you handle cases where multiple agents are running in the same environment — does it return the first match or all of them?
Interesting approach, but the sandboxing story worries me. An agent that rewrites its own modules at runtime is essentially arbitrary code execution — what stops a hallucinated module from doing something destructive?
Nice work — the Rich-based CLI with real-time updates without spamming console history is a good pattern. I used a similar approach in a CLI I built recently (Typer + Rich) and the Live context manager in Rich is underrated for exactly this kind of use case.
One thing I'd be curious about: how are you handling the FastAPI stream engine under load? Concurrent test runs from multiple clients hitting the same backend could skew results if the server itself becomes a bottleneck. Did you consider running the payload tests client-side only?