HALO GitHub wide-funnel sourcing campaign

Date: 2026-08-29 Status: shortlist complete; further GitHub search blocked by the authenticated search-rate limit

Executive read

The strongest answer is not a replacement CRM. HALO should retain its Convex domain spine and test a small number of sidecars behind one identity/navigation boundary:

twentyhq/twenty for a relationship/creator operating model and custom-object UX.
Vexa-ai/vexa for meeting capture and speaker-attributed transcripts.
activepieces/activepieces for human-gated workflow automation around Drive, onboarding, approvals, and notifications.
qdrant/qdrant plus tobi/qmd patterns for searchable institutional memory, with the data boundary chosen deliberately.
cgwire/kitsu/cgwire/zou as the best adjacent production-tracking donor for briefs, versions, deliveries, and approvals.
inovector/mixpost for a bounded publishing/calendar sidecar if social publishing is still missing after the content model is clarified.

Complete suites are valuable as reference architectures and possible sidecars, but none is a safe “replace HALO wholesale” result. ERPNext and Frappe HR cover money and team operations at the cost of a second Python/Frappe operating system. Zulip or Mattermost can solve team communication, but messaging remains a product decision in the brief and neither should become a second identity/data authority by accident.

The discovery campaign screened workflow synonyms across all eight journeys, including terms that do not say CRM or creator: meeting intelligence, conversation memory, knowledge bases, production tracking, creative review, client portals, HRMS, workforce operations, ledgers, compliance, low-code systems, durable orchestration, vector search, and team chat. Search results were deliberately treated as candidate generation; every repository in the tables below was then checked with gh api repos/OWNER/NAME, and every NOASSERTION license was inspected from the repository license source.

Ranked candidate set

“Promoted” means it has a concrete HALO job and an explicit integration boundary. It does not mean “copy this repository into repo/.”

Rank	Repository / product	HALO job and journey	Recommendation	Concrete capability and boundary	Main conflict / caveat	Confidence
1	Twenty ↗ — `twentyhq/twenty`	Creator discovery, qualification, outreach, contact timeline, renewals; journeys 1, 2, 6	integrate / sidecar	Customizable CRM objects and views, APIs, relationship history, and an AI-oriented CRM shell. Put creator/contact data behind a HALO-owned identity mapping; sync only explicit records/events over REST/GraphQL.	Mostly AGPLv3, with enterprise-marked commercial files and an application exception; its database/auth become a second source of truth if adopted wholesale.	High
2	Vexa ↗ — `Vexa-ai/vexa`	Meeting capture, transcription, speaker attribution, follow-up evidence; journeys 1, 6, 8	integrate	Bots join Google Meet, Teams, and Zoom; real-time WebSocket transcripts; API and MCP surface; self-hostable. Store transcript/decision artifacts in HALO after consent and retention checks.	Separate Python service and browser-automation/provider failure modes; consent and meeting access must be first-class.	High
3	Activepieces ↗ — `activepieces/activepieces`	Onboarding triggers, Drive reconciliation notifications, approval gates, payment/CRM sync, exception routing; journeys 2, 3, 5, 8	integrate	TypeScript visual workflows, reusable “pieces,” schedules/webhooks, and agent/MCP-oriented automation. Keep Convex mutations authoritative; use signed webhooks and idempotency keys at the boundary.	Core is MIT per the inspected LICENSE, but `packages/ee` and the EE server path have separate terms. Do not blindly copy EE code.	High
4	Zulip ↗ — `zulip/zulip`	Chatter-team handoffs, topic-scoped creator/team conversations, async follow-ups; journey 6 and parts of 1/4	integrate / buy	Topic-based threading is a strong fit for creator, campaign, and handoff context; it supports live and asynchronous communication. Use HALO IDs in message metadata and keep money/permissions in Convex.	Full Python/PostgreSQL chat product; duplicated users, search, retention, and notification policy. Only pursue if unified inbox/chat earns product approval.	High
5	AFFiNE ↗ — `toeverything/AFFiNE`	Meeting notes, creator records, SOPs, briefs, cross-linked decisions, handoffs; journeys 1, 2, 3, 4, 6	study	Local-first workspace combining documents, whiteboards, and planning. Its linked-document mental model is the clearest answer to the brief’s institutional-memory gap. Study block/editor, backlinks, permissions, and offline/sync patterns; do not make it HALO’s identity authority.	Mixed license: the inspected LICENSE says content outside backend/native paths is MIT, while backend server material is under an EE subscription license. Treat backend reuse as unavailable without legal/commercial agreement.	High
6	Kitsu ↗ + Zou ↗ — `cgwire/kitsu`, `cgwire/zou`	Briefs, assets, versions, production status, deliveries, approvals, and stakeholder communication; journey 3	study / sidecar	Kitsu is a collaboration platform for animation/VFX/video-game productions; Zou supplies its production-data API. The delivery/version/status model is a better donor for creator content operations than a generic task board.	AGPLv3 and a separate Vue/Python production stack. Use API-level sidecar experiments or copy domain ideas, not a direct Convex embed.	High
7	Qdrant ↗ — `qdrant/qdrant`	Semantic retrieval over creator history, meeting notes, contracts, briefs, and Drive provenance; journeys 1, 2, 3, 6, 8	integrate	Apache-2.0 vector database with a clear service boundary. Index only redacted/authorized chunks, retain source IDs and ACL filters, and return citations to HALO records.	Rust service and a second index to operate; vector ACLs must never replace Convex authorization.	High
8	Mixpost ↗ — `inovector/mixpost`	Content calendar, scheduled publishing, channel operations, publishing status; journey 3	integrate	MIT social-media management platform with scheduling and publishing. A sidecar can own platform-specific tokens and publishing retries while HALO owns briefs, approvals, creator relationships, and provenance.	Laravel/Vue application; last verified push was 2026-03-16, materially older than the other finalists. Verify provider API compatibility before committing.	Medium-high
9	ERPNext ↗ — `frappe/erpnext`	Accounting, invoices, expenses, liabilities, procurement, HR, projects; journeys 4 and 5, with supporting 2	study / sidecar	Mature integrated ERP modules and financial-reporting concepts. Use it to pressure-test HALO’s ledger, payout, and audit requirements; a narrowly scoped finance sidecar is conceivable.	GPL-3.0, Python/Frappe/MariaDB stack, broad schema ownership, and a second auth/data model. Wholesale adoption would erase HALO’s creator-specific workflows.	High
10	Frappe HR ↗ — `frappe/hrms`	Employee records, onboarding, leave, attendance, payroll, and HR reporting; journey 4	study / sidecar	Concrete HRMS coverage, including the exact operations currently split between Supabase payroll components and the orphaned Convex payroll module. Compare its approval and payroll data model before continuing bespoke work.	GPL-3.0 and Frappe dependency; not a TypeScript/Convex module. A sidecar requires identity, payroll-period, and worker-record reconciliation.	High
11	Trigger.dev ↗ — `triggerdotdev/trigger.dev`	Durable background jobs, retries, AI extraction, approvals, Drive/voice/payment orchestration; journey 8 and supporting 2/3/5	integrate	Apache-2.0 TypeScript SDK/platform for long-running jobs and workflows. Use it only for work Convex cannot safely own; persist job IDs/statuses in Convex and make every external call idempotent.	Adds a workflow runtime beside Convex, which already has first-party workflow/workpool/action-retrier options in the prior lane. Run a probe before adding operational weight.	High
12	QMD ↗ — `tobi/qmd`	Search meeting notes, SOPs, briefs, and exported Drive material; journeys 1, 3, 6, 8	integrate / study	MIT local search engine combining BM25, vector search, query expansion, reciprocal-rank fusion, and LLM reranking. Start with an export/index worker and citations; do not expose its local index as an authorization layer.	CLI/local Node application rather than a multi-tenant Convex component; model/runtime footprint and per-user isolation need a proof.	High
13	minutes ↗ — `silverstein/minutes`	“What did we promise?” memory from meetings and voice memos; journeys 1 and 6	study	MIT, local-first conversation memory written as Markdown, with policy-aware source exposure and explicit authorization. Its consent/restricted-meeting defaults are useful for HALO’s governance model.	Desktop/Rust/plain-file workflow, not a shared agency database. Borrow provenance and consent patterns; do not treat local Markdown as the canonical record.	High
14	Mattermost ↗ — `mattermost/mattermost`	Secure team chat, handoffs, incident/exception threads, workflow notifications; journeys 1, 4, 6, 7, 8	buy / integrate	Single-binary Go + React + PostgreSQL collaboration platform with chat, workflow automation, calls, screen sharing, and AI integration. Hosted/commercial deployment may be cheaper than building messaging.	Open-core licensing: compiled versions MIT, source generally AGPLv3 or commercial, with Apache-covered admin/config paths. It is a second product with its own identity/search/retention model.	High
15	NocoBase ↗ — `nocobase/nocobase`	Multi-role portal forms, custom operational tables, approvals, lightweight CRM/ERP modules; journeys 2, 4, 5, 7	study	TypeScript no-code/WYSIWYG business-system builder with plugin/data-source orientation. It is a useful test of whether HALO’s CRUD-heavy screens should become configurable modules.	The inspected LICENSE is a NocoBase License Agreement, not an SPDX open-source license; commercial/community/plugin boundaries and unilateral term changes require legal review. Never embed it by assumption.	Medium-high
16	APITable ↗ — `apitable/apitable`	Creator/campaign registries, operational views, lightweight portals and automations; journeys 2, 3, 4	study	API-oriented collaborative low-code tables are a useful pattern for configurable rosters, campaign trackers, and referral views.	AGPL-3.0 and last verified push 2025-10-30; this freshness gap is large relative to the other finalists. Use as a design donor unless current maintenance is revalidated.	Medium
17	Meetily ↗ — `Zackriya-Solutions/meetily`	Private meeting capture for owners/managers, especially when cloud recording is unacceptable; journeys 1, 6, 7	study / buy	MIT local desktop meeting assistant with live transcription, diarization, and local Ollama summarization. It is a privacy benchmark and possible operator tool, not the shared HALO backend.	Pre-release desktop/Rust workflow; no multi-user agency timeline or Convex integration.	Medium-high

API verification ledger

The following rows are the exact metadata captured from gh api repos/OWNER/NAME on 2026-08-29. license.spdx_id is shown exactly as returned. For every NOASSERTION, the repository license source was read; the source finding is in the final column. archived=false is not a quality verdict, only the API state at capture time.

Repository	`html_url`	stars	`license.spdx_id`	`pushed_at`	archived	default branch	License-source finding when needed
`twentyhq/twenty`	https://github.com/twentyhq/twenty	55,817	NOASSERTION	2026-08-29T07:27:29Z	false	`main`	LICENSE: mostly AGPLv3; enterprise-marked files commercial; selected SDK/UI/apps MIT; application exception.
`Vexa-ai/vexa`	https://github.com/Vexa-ai/vexa	2,726	Apache-2.0	2026-08-28T15:53:32Z	false	`main`	—
`activepieces/activepieces`	https://github.com/activepieces/activepieces	24,082	NOASSERTION	2026-08-28T22:40:53Z	false	`main`	LICENSE: non-EE content MIT Expat; `packages/ee` and EE server path have separate license.
`toeverything/AFFiNE`	https://github.com/toeverything/AFFiNE	71,986	NOASSERTION	2026-08-28T13:24:46Z	false	`canary`	LICENSE: outside backend/native paths MIT; `packages/backend` and `packages/common/native` use backend/server license; backend source inspected as EE subscription license.
`zulip/zulip`	https://github.com/zulip/zulip	25,786	Apache-2.0	2026-08-28T03:24:40Z	false	`main`	—
`cgwire/kitsu`	https://github.com/cgwire/kitsu	702	AGPL-3.0	2026-08-28T09:03:27Z	false	`main`	—
`cgwire/zou`	https://github.com/cgwire/zou	198	AGPL-3.0	2026-08-28T09:02:04Z	false	`main`	—
`qdrant/qdrant`	https://github.com/qdrant/qdrant	34,252	Apache-2.0	2026-08-29T06:48:24Z	false	`master`	—
`inovector/mixpost`	https://github.com/inovector/mixpost	3,554	MIT	2026-03-16T10:06:38Z	false	`main`	—
`frappe/erpnext`	https://github.com/frappe/erpnext	38,621	GPL-3.0	2026-08-29T07:39:16Z	false	`develop`	—
`frappe/hrms`	https://github.com/frappe/hrms	8,695	GPL-3.0	2026-08-28T11:27:56Z	false	`develop`	—
`triggerdotdev/trigger.dev`	https://github.com/triggerdotdev/trigger.dev	16,155	Apache-2.0	2026-08-28T21:28:15Z	false	`main`	—
`tobi/qmd`	https://github.com/tobi/qmd	29,335	MIT	2026-08-18T14:26:31Z	false	`main`	—
`silverstein/minutes`	https://github.com/silverstein/minutes	1,456	MIT	2026-08-29T07:30:25Z	false	`main`	—
`mattermost/mattermost`	https://github.com/mattermost/mattermost	38,937	NOASSERTION	2026-08-29T06:43:15Z	false	`master`	LICENSE: compiled platform MIT; source generally AGPLv3 or commercial; admin/config paths Apache-2.0.
`nocobase/nocobase`	https://github.com/nocobase/nocobase	23,921	NOASSERTION	2026-08-29T01:20:59Z	false	`main`	LICENSE: NocoBase License Agreement with community/commercial/plugin distinctions; not an SPDX open-source license.
`apitable/apitable`	https://github.com/apitable/apitable	15,578	AGPL-3.0	2025-10-30T03:34:31Z	false	`develop`	—
`Zackriya-Solutions/meetily`	https://github.com/Zackriya-Solutions/meetily	30,035	MIT	2026-08-29T06:39:27Z	false	`main`	—

Important rejects and boundary decisions

These are not promoted as HALO implementation choices, but are important enough to record so the team does not repeat the same search or mistake popularity for fit. They are API-verified in the ledger below.

Repository / product	Decision	Why it loses for HALO now
Outline ↗ — `outline/outline`	reject for adoption; study UX	Excellent React/Node collaborative knowledge base, but the inspected LICENSE is Business Source License 1.1 with a “Document Service” restriction until 2030-07-13. A multi-tenant HALO offering that gives external parties controlled teams/documents is close to the prohibited shape.
n8n ↗ — `n8n-io/n8n`	buy or reject; do not embed code	Strong integrations and human approvals, but the inspected LICENSE is Sustainable Use License, not open source: internal-business/noncommercial limits plus separately licensed `.ee` code. A hosted n8n plan could be a procurement decision; source reuse is not the default.
LobeHub ↗ — `lobehub/lobehub`	buy/study only	Its “chief agent operator” shell—hiring, scheduling, and reporting on agents—is relevant to journey 8, but the inspected Community License permits commercial use without modification and requires a commercial license for derivative distribution. It is not a clean embed donor.
ProjectSend ↗ — `projectsend/projectsend`	reject as embed; study portal boundary	Strong private client file areas, client groups, roles, 2FA, filters, and detailed logs, but GPL-2.0 plus a separate PHP application. It duplicates HALO’s Drive/content identity and is not a Convex module.
Element Web ↗ — `element-hq/element-web`	reject as HALO chat core	AGPL-3.0 Matrix web client only; adopting it also commits HALO to Matrix homeserver/federation/identity/retention choices. Consider only if the team explicitly chooses Matrix.
OpenProject ↗ — `opf/openproject`	study; reject wholesale replacement	Broad project/portfolio, agile, roadmap, Gantt, time tracking, and collaboration product, but GPL-3.0 Ruby system with a large independent data model. Its project/portfolio concepts are useful; it would not preserve HALO’s creator, payout, Drive, or referral semantics.
Leantime ↗ — `Leantime/leantime`	study; reject wholesale replacement	Good owner-facing goals/planning model and accessible UX, but AGPL-3.0 PHP application and still a second operational system. The “morning brief / goals → execution” pattern is worth borrowing.
ILLA Builder ↗ — `illacloud/illa-builder`	study only	Apache-2.0 low-code internal-tool builder with many data-source connectors and schedule/webhook automation, but last verified push was 2026-05-27 and it creates another app-builder surface rather than a creator operating model.

Verification ledger for rejects:

Repository	`html_url`	stars	`license.spdx_id`	`pushed_at`	archived	default branch	License-source finding when needed
`outline/outline`	https://github.com/outline/outline	40,368	NOASSERTION	2026-08-29T02:59:37Z	false	`main`	LICENSE: Business Source License 1.1; Document Service restriction; change date 2030-07-13 to Apache-2.0.
`n8n-io/n8n`	https://github.com/n8n-io/n8n	202,749	NOASSERTION	2026-08-29T07:04:57Z	false	`master`	LICENSE.md: Sustainable Use License; noncommercial/internal-use limitations; `.ee` paths separately licensed.
`lobehub/lobehub`	https://github.com/lobehub/lobehub	82,078	NOASSERTION	2026-08-29T07:43:04Z	false	`canary`	LICENSE: LobeHub Community License; commercial derivative distribution requires a commercial license.
`projectsend/projectsend`	https://github.com/projectsend/projectsend	1,986	GPL-2.0	2026-08-29T05:37:13Z	false	`main`	—
`element-hq/element-web`	https://github.com/element-hq/element-web	13,408	AGPL-3.0	2026-08-28T18:05:31Z	false	`develop`	—
`opf/openproject`	https://github.com/opf/openproject	15,965	GPL-3.0	2026-08-29T06:06:31Z	false	`dev`	—
`Leantime/leantime`	https://github.com/Leantime/leantime	11,470	AGPL-3.0	2026-08-15T04:20:40Z	false	`master`	—
`illacloud/illa-builder`	https://github.com/illacloud/illa-builder	12,312	Apache-2.0	2026-05-27T02:22:32Z	false	`beta`	—

Query coverage and funnel accounting

Families attempted

The campaign used 77 explicitly enumerated query-family probes in three groups, plus a named/adjacent expansion set. GitHub search is AND-heavy for multi-word queries, so the campaign deliberately mixed exact workflow phrases, one-intent terms, and system-class terms.

Operator-job phrases (22): meeting notes; knowledge management workspace; personal wiki backlinks; talent management agency; creator management; content production workflow; content approval review; client portal; employee onboarding attendance; shift scheduling workforce management; employee performance scorecards; quality assurance scorecard workforce; commission management sales compensation; double entry ledger accounting; payment reconciliation idempotent webhooks; creator payouts marketplace payouts; compliance evidence audit trail; consent management privacy records; open source secrets manager; workflow automation approvals; RAG semantic search documents; automation orchestration human in the loop.
One-intent category probes (35): wiki; knowledge-base; knowledge-management; second-brain; meeting-assistant; meeting-notes; transcription; talent-management; influencer; agency-management; client-portal; content-calendar; editorial-workflow; digital-asset-management; media-library; video-production; creative-review; proofing; human-resources; attendance; workforce-management; performance-management; commission; accounting; double-entry; ledger; reconciliation; audit-log; compliance; consent-management; secrets-management; workflow-automation; orchestration; semantic-search; rag.
System-class probes (20): crm; customer relationship management; ERP; business management suite; professional services automation; project management; low-code platform; no-code database; multi-tenant SaaS; team chat; discord alternative; mattermost; zulip; matrix collaboration; team communication; creator portal; model management; influencer CRM; sales pipeline; agency software.
Named/adjacent probes used during expansion: AFFiNE; AppFlowy; Outline; meeting assistant; talent agency management; influencer marketing platform; creator roster management; agency project management/client portal; content calendar/editorial workflow; digital asset management; video production; creative review; employee onboarding/attendance; workforce QA/scorecards; commission/payroll; payment ledger/reconciliation; compliance/audit evidence; secrets manager; workflow automation; RAG/semantic search.

Numbers and limitations

263 raw result rows were captured in the fully visible initial and system-class runs (23 from the first job-oriented command group plus 240 from 20 system-class searches at 12 results each). Rows include duplicates across synonyms; this is a screened-result count, not a unique-repository count.
Additional one-intent and expansion probes were run, but the shell output was truncated for context and the final aggregate was not persisted because the packet forbids writing any file other than this report.
GitHub reported HTTP 403: API rate limit exceeded for the authenticated search resource after 30 search requests (gh api rate_limit showed search.remaining=0, core.remaining=5000). Further search discovery is therefore the only blocker; direct gh api repos/... verification remained available and was used for every repository cited here.
Search results that looked like tutorials, personal projects, stale shells, mirrors, or low-signal CRUD demos were not promoted. The report intentionally does not list them by repository name, so they do not create unverified citations.

Journey-to-candidate map

HALO journey	Best fresh donors	Recommended use
1. Owner command centre	AFFiNE, Vexa, minutes, QMD, Twenty, Zulip	Build a decision/follow-up record around meetings and linked evidence; keep Convex as authority.
2. Creator lifecycle	Twenty, ERPNext concepts, Frappe HR concepts, AFFiNE, ProjectSend boundary	Twenty for relationship model; HALO remains the creator-specific workflow and identity owner.
3. Content operations	Kitsu/Zou, Mixpost, AFFiNE, QMD, Activepieces	Separate production state, publishing state, and content provenance; do not let a social scheduler define the asset model.
4. Team operations	Frappe HR, ERPNext, Zulip, Mattermost, NocoBase	Compare HR/payroll/attendance data models; decide whether chat is a product or a sidecar before embedding.
5. Money and trust	ERPNext, Frappe HR, Activepieces, Qdrant for evidence retrieval	Use ERP/HR as accounting/payroll prior art; do not outsource creator/referral liabilities without an explicit ledger boundary.
6. Communication and relationship memory	Vexa, Zulip, Mattermost, minutes, Twenty	Start with meeting/transcript and handoff evidence; unified inbox remains an explicit product decision.
7. Governance and safety	minutes, Vexa, Twenty, Qdrant, Mattermost	Consent, ACL-filtered retrieval, retention, and audit evidence must be HALO-owned even when services are sidecars.
8. Automation and intelligence	Activepieces, Trigger.dev, Qdrant, QMD, AFFiNE	Pilot one human-gated workflow; preserve idempotency, citations, approval, and Convex authorization.

Suggested next probes after the rate limit resets

Validate Twenty, Vexa, Activepieces, and Qdrant with a narrow export/webhook proof using fake data only; measure identity mapping, retry behavior, and ACL preservation.
Compare Kitsu/Zou and Mixpost against HALO’s actual content states and Drive provenance before selecting either as a sidecar.
Ask legal/commercial owners to decide whether any BSL, community, AGPL, or mixed-license system is permissible before architecture work.

No code, deployment, seed/reset/migrate mutation, push, PR, issue, or file other than this report was performed.

Follow-up: project-specific authenticated GitHub API search

This section is the response to the request for more HALO-specific GitHub material. It used the actual authenticated GitHub REST API (gh api --method GET search/repositories and gh api --method GET search/code) rather than web search or the AnySearch service. The GitHub CLI session was already authenticated; the bearer token was never printed or persisted. The linked anysearch-ai/anysearch-skill was inspected and is a general search service, not GitHub’s repository/code search API, and no AnySearch key is configured.

New high-signal project findings

These are intentionally more concrete than the earlier system-class shortlist. They were promoted only after repository metadata, README, and relevant source-tree paths were checked. “Study” means pattern/design donor; it does not grant permission to copy code when the license is absent or restrictive.

Rank	Repository / product	Exact HALO job	Recommendation	Source-backed capability	Integration boundary / caveat	Confidence
1	Nexora CRM V2 ↗ — `FLEXORA-Phegasis/Nexora-CRM-V2`	Multi-tenant creator/team CRM, role-scoped modules, organization membership, deals, tasks, calendar, audit; journeys 1, 2, 4, 7	study	Closest project-specific Convex donor found. `convex/lib/security.ts` requires an opaque session and checks active user/org/domain; `convex/lib/permissions.ts` resolves server-side role/custom permissions and fails closed for unknown modules; `scripts/smoke-permissions.mjs` tests denied writes, not just UI hiding.	MIT. It still has its own users/session/schema and is only 421 files/1 star, so use it to harden HALO’s Convex auth/RBAC and smoke-test shape, not as a wholesale replacement.	High
2	AgencyOS ↗ — `directus-labs/agency-os`	Client-facing project portal, projects/tasks/files/invoices, project templates, client accountability; journeys 1, 2, 3, 5	study	Actual Nuxt 3 + Directus project with CRM/project tracker and private authenticated portal. README/source paths include portal project/task/file/billing pages and invoice calculation scripts. This is the most direct client-portal donor in the API pass.	MIT, but GitHub API says last push 2026-03-06 and the README retains older clone/deploy references. Directus/PostgreSQL becomes a second datastore; use the portal contract and task/invoice relationships as patterns.	High
3	wacrm ↗ — `ArnasDon/wacrm`	Chatter-team shared inbox, conversation assignment, role-scoped operations, WhatsApp templates/broadcasts, automation; journeys 4 and 6	integrate	MIT Next.js/Supabase CRM for WhatsApp. Source inspection found account roles (`owner/admin/agent/viewer`), server-side API-key scopes, account-membership RLS migration, typed message validation, Meta transport retries, encryption helpers, and per-key rate-limit hooks.	Integrate only at the messaging boundary; HALO remains creator/money/Drive authority. WhatsApp Business API, Supabase, and account identity must not silently become HALO’s second auth system.	High
4	Creator Marketplace ↗ — `Sydekse/creator-marketplace`	Brand/creator multi-role portal, campaign brief → creator selection → deliverable review → approved payout, disputes/audit; journeys 2, 3, 5, 7	study	Very concrete workflow model: role/ownership guard, creator onboarding, campaign/deal state machine, usage-rights terms, deliverable approval, budget/escrow, admin worklist, campaign ledger and reconciliation. Tree contains 26 focused tests including escrow-ledger, authz coverage, creator onboarding, deal state, and campaign funding.	No license file (API `NOASSERTION`, license endpoint and root license-file check both empty). Do not lift code. Its current branch is `dev`; treat the implementation as unlicensed pattern evidence only.	High
5	InfluenceFlow CRM ↗ — `DhurimHalili/influenceflow-crm`	Creator discovery, roster pipeline, outreach/reach-backs, campaign tracking, brand contacts; journeys 1 and 2	study	MIT React/Vite/Supabase app with live creator table/board, bulk import, duplicate detection, 10-stage statuses, activity logging, campaign/brand types, daily send limits, delayed reach-backs, and Gmail OAuth discovery functions.	It is a small Supabase app and overlaps HALO’s creator/onboarding domain. Reuse the operator flow and data vocabulary; do not add a second creator authority.	High
6	Orbit ↗ — `Leon-bo-He/Orbit`	Ideas → brief → production → review → publish, multi-vertical workspaces, scheduling gaps, per-platform publication records, metrics; journey 3	study	MIT TypeScript app with 316 files, explicit stage-history migration, workspace isolation, brief sections, per-platform records, gap alerts, JSON import/export, BullMQ, and integration/unit tests. It models planned content separately from platform publication records.	API says last push 2026-05-13 and collaboration/RBAC is planned, so it is not a ready multi-user sidecar. Excellent content-state/provenance donor.	High
7	CreatorReach AI ↗ — `chaoyubai8-tech/creatorreach-ai`	Human-controlled creator outreach, Gmail drafts, reply classification, follow-up pipeline; journeys 1, 2, 6, 8	study	MIT Python app with an explicit campaign → creator → AI draft → Gmail draft → human send → reply classification flow. README says it uses minimal `gmail.compose` scope, saves the original reply before AI processing, and never auto-sends.	Only 102 files and last push 2026-06-23; local SQLite rather than a shared agency backend. Borrow the human-in-the-loop boundary and original-before-LLM persistence rule.	High
8	KOLConnect ↗ — `gavinedwardbrooks-zjc/KOLConnect`	Creator/account normalization, campaign collaboration, planned vs actual publishing, import/export, dedup/merge/delete safety; journeys 2, 3, 5, 7	study	MIT desktop app with 376 files. Source has normalized `Creator` → one-to-many `CreatorAccount`, manual merge with preview fingerprint/lock, mutation-free delete planning, and explicit separation of planned collaboration from actual publication evidence.	Local SQLite/Windows desktop and Feishu integration; not a web sidecar. Its data-authority and deletion-plan discipline is highly relevant to HALO’s Drive/creator integrity.	High
9	InPact ↗ — `AOSSIE-Org/InPactAI`	Creator/brand/agency matching, sponsorship pricing/deal optimization, collaboration chat, analytics; journeys 1, 2, 5, 6	study	GPL-3.0 React/FastAPI/Supabase app with actual chat, collaboration-hub, creator matching, audience/revenue analytics, contract templates, onboarding, and auth source paths.	GPL-3.0 and last push 2026-03-26. Use as a feature/model comparison, not embedded code; its Supabase data model overlaps HALO.	Medium-high
10	YouTube Approval & Upload Middleware ↗ — `Adityaada0/Youtube-editor-creator-bridge`	Editor upload → creator approval → scheduled publication, workspace-specific channels, encrypted provider credentials; journey 3 and parts of 7/8	study	Source-backed Next.js/S3/Postgres/Prisma/BullMQ architecture: presigned uploads, role-scoped creator/editor workspaces, approval queue, AES-256-GCM OAuth credentials, resumable worker, status machine, retry upload, and YouTube privacy/schedule modes.	No license file. Pattern-only. The approval/worker split is directly useful for Drive/voice/content publishing, but HALO should preserve its own provenance and auth.	High
11	CreatorOps ↗ — `carlosmmora26/creatorops`	Governed content/commerce loop with policy gate, publish evidence, audit ledger, and next decision; journeys 3, 5, 7, 8	study	README and repository structure show a local-first scaffold with brand configs, ports/adapters, review/judge panel, human/policy gate, publish/commerce adapter, evidence ledger, redacted runs, and tests. It explicitly frames the workflow as an auditable loop rather than an autoposter.	No license file; hackathon/demo provenance and 0 stars. Valuable for an approval/evidence state machine, not a dependency.	Medium-high
12	Telegram Services CRM ↗ — `iraettae/Telegram-Services-CRM`	Telegram-first recruiting, AI-assisted conversation, operator takeover, candidate handoff; journeys 2, 4, 6, 8	study	Real Python/FastAPI/Aiogram/Pyrogram project with Business API → webhook → dispatcher → AI/master group → WebApp architecture, lead-ready tagging, human override pause, anti-ban rate/delay handling, and 25+ API endpoints. Although its domain is courier recruiting, its chatter/recruiting handoff mechanics map closely to creator acquisition.	No license file and different legal/domain context. Never reuse scraping/device-spoofing patterns; borrow only the explicit human takeover, queue, and handoff boundaries.	Medium-high
13	AdsBazaar ↗ — `Ads-Bazaar/ads-bazaar`	Multi-currency creator campaign funding, escrow, proof of work, approval, and payout; journey 5 with support for 2/3	study	README describes business funds → Soroban escrow → creators submit proof → approval releases payout, with multi-currency emerging-market rails. It is a useful challenge to HALO’s creator/referral liability and FX assumptions.	No license file. README says identity verification, disputes, and indexed feeds are still roadmap/scaffold; do not treat it as production finance.	Medium

API verification ledger for the project-specific pass

Every repository in the new ranked table was checked with gh api repos/OWNER/NAME. NOASSERTION rows were followed by a license endpoint check and a root-level license-file check; blank license findings mean no license-like file was present at the repository root.

Repository	`html_url`	stars	`license.spdx_id`	`pushed_at`	archived	default branch	License/source note
`FLEXORA-Phegasis/Nexora-CRM-V2`	https://github.com/FLEXORA-Phegasis/Nexora-CRM-V2	1	MIT	2026-08-28T20:30:10Z	false	`main`	—
`directus-labs/agency-os`	https://github.com/directus-labs/agency-os	971	MIT	2026-03-06T00:04:00Z	false	`main`	—
`ArnasDon/wacrm`	https://github.com/ArnasDon/wacrm	2,143	MIT	2026-08-27T08:49:39Z	false	`main`	—
`Sydekse/creator-marketplace`	https://github.com/Sydekse/creator-marketplace	2	NOASSERTION	2026-08-29T08:04:41Z	false	`dev`	No license endpoint result; root has no license-like file.
`DhurimHalili/influenceflow-crm`	https://github.com/DhurimHalili/influenceflow-crm	1	MIT	2026-08-27T20:35:39Z	false	`main`	—
`Leon-bo-He/Orbit`	https://github.com/Leon-bo-He/Orbit	61	MIT	2026-05-13T21:32:23Z	false	`master`	—
`chaoyubai8-tech/creatorreach-ai`	https://github.com/chaoyubai8-tech/creatorreach-ai	4	MIT	2026-06-23T11:28:21Z	false	`main`	—
`gavinedwardbrooks-zjc/KOLConnect`	https://github.com/gavinedwardbrooks-zjc/KOLConnect	13	MIT	2026-08-28T03:07:27Z	false	`main`	—
`AOSSIE-Org/InPactAI`	https://github.com/AOSSIE-Org/InPactAI	100	GPL-3.0	2026-03-26T11:57:10Z	false	`main`	—
`Adityaada0/Youtube-editor-creator-bridge`	https://github.com/Adityaada0/Youtube-editor-creator-bridge	2	NOASSERTION	2026-05-07T01:04:57Z	false	`main`	No license endpoint result; root has no license-like file.
`carlosmmora26/creatorops`	https://github.com/carlosmmora26/creatorops	0	NOASSERTION	2026-06-29T13:05:52Z	false	`main`	No license endpoint result; root has no license-like file.
`iraettae/Telegram-Services-CRM`	https://github.com/iraettae/Telegram-Services-CRM	0	NOASSERTION	2026-07-20T19:56:21Z	false	`main`	No license endpoint result; root has no license-like file.
`Ads-Bazaar/ads-bazaar`	https://github.com/Ads-Bazaar/ads-bazaar	3	NOASSERTION	2026-08-24T02:14:04Z	false	`main`	No license endpoint result; root has no license-like file.

Specific rejects from the same API funnel

These are project-specific hits worth preserving as negative evidence, not candidates to adopt.

Repository / product	Decision	Concrete reason
FlowOF ↗ — `vhvyvy/FlowOF`	reject	The README and tree are unusually relevant—tenant onboarding, source mapping, chatter portal, KPI, finance, and admin routes—but the repo has no license, and its README contains a plaintext database credential in a deployment example. Do not copy, deploy, or repeat the credential. API metadata says 261 files and last push 2026-08-01.
RecruitingOS ↗ — `kgorlov/RecruitingOS-Adult-Recruiting-CRM`	reject	README explicitly says it is a private commercial product page and that production source/deployment/demo are shared only after contact. The workflow is relevant, but there is no inspectable implementation or license; do not treat marketing copy as OSS evidence.
OFTtracker ↗ — `Barklim/onlyfClient`	reject	Actual README describes an OnlyFans autochat/tracker frontend and related repos, but direct API metadata says last push 2023-12-09 despite newer search-index timestamps. No license file; stale multi-repo frontend is not a safe HALO donor.
OFVAULT ↗ — `BBPOTKLO/OFVAULT`	reject	README calls it a small practice project built in a few hours and warns that parts may need adjustment. No license file. Credential/content archival and platform-scraping risk make it unsuitable for HALO’s vault.
AgencyOS ↗ — `behavero/agencyos`	reject	Search description says gamified creator-economy CRM, but README is a generic Next.js starter with an “OnyxOS” chat/whale-priority section. No license and no matching agency domain implementation.
Influencer CRM ↗ — `zqch/influencer-crm`	reject as dependency; study only	README’s feature map is relevant—creator library, outreach, content review, calendar, analytics, roles—but API tree contains 28,846 files including committed `node_modules`, no license, and no evidence of a maintainable integration boundary.
OFM-Connect ↗ — `Nayzerftn/ofm-connect`	reject	API reports a 201,264 KB repository, 0 stars, no license, and README is only a product/deploy link. Size and absence of inspectable documentation make it an unreliable lead.
GritCMS ↗ — `Fahim047/gritcms`	reject as reuse; study concept	The product concept is broad—contacts CRM, affiliate management, booking, commerce, community, workflows, and media—but no license file and API last push 2026-02-27. Do not assume “open source” in its README grants reuse.
MagicSync ↗ — `leamsigc/MagicSync`	reject as embed	Social scheduling/content management is adjacent, but README advertises AGPL while API returns `NOASSERTION` and no license endpoint/root license file exists. Its platform/provider boundary is not clear enough for HALO.
Magplan ↗ — `f1nnix/magplan`	study only	Good editorial model—idea → article stages, assignees, attachments, discussions, team action logs, async S3/WordPress publish—but no license and last push 2025-12-04. Keep the workflow idea, not the code.
CreatorFlow Dashboard ↗ — `Haseebcodejourney/creatorflow-dashboard`	reject	README is a 0-star React/Tailwind demo description for adult creator calendar/analytics/fan messaging/compliance; no license and no implementation evidence beyond a 115 KB repository.
SponsorForge ↗ — `Parisha-15/SponsorForge`	study only	The README describes semantic matching, escrow points, deadlines, and payouts, but API reports no license and the project is 0 stars/9.6 MB. Treat as an unlicensed prototype concept, not a source.
Influencer Connect ↗ — `Manish-Prajapati32/Influencer-Connect`	reject	README claims broad creator/editor/writer/designer/voice-artist role dashboards, messaging, AI recommendations, subscriptions, RBAC, and RLS, but the repository is only 124 KB with no license and API last push 2026-02-11. Claims exceed verifiable implementation evidence.
Creator OS ↗ — `CLEMENT3Z/agency`	reject	API says the repository is empty (0 KB), has no license, and only a 0-star OFM/AI-OFM tool description.

Reject API ledger:

Repository	`html_url`	stars	`license.spdx_id`	`pushed_at`	archived	default branch	License/source note
`vhvyvy/FlowOF`	https://github.com/vhvyvy/FlowOF	0	NOASSERTION	2026-08-01T12:56:23Z	false	`main`	No license endpoint result; root has no license-like file.
`kgorlov/RecruitingOS-Adult-Recruiting-CRM`	https://github.com/kgorlov/RecruitingOS-Adult-Recruiting-CRM	0	NOASSERTION	2026-06-04T21:10:06Z	false	`master`	No license endpoint result; root has no license-like file.
`Barklim/onlyfClient`	https://github.com/Barklim/onlyfClient	24	NOASSERTION	2023-12-09T11:08:36Z	false	`main`	No license endpoint result; root has no license-like file.
`BBPOTKLO/OFVAULT`	https://github.com/BBPOTKLO/OFVAULT	1	NOASSERTION	2026-05-09T23:16:03Z	false	`main`	No license endpoint result; root has no license-like file.
`behavero/agencyos`	https://github.com/behavero/agencyos	0	NOASSERTION	2026-02-06T19:25:41Z	false	`main`	No license endpoint result; root has no license-like file.
`zqch/influencer-crm`	https://github.com/zqch/influencer-crm	0	NOASSERTION	2026-05-14T13:44:43Z	false	`main`	No license endpoint result; root has no license-like file.
`Nayzerftn/ofm-connect`	https://github.com/Nayzerftn/ofm-connect	0	NOASSERTION	2026-05-20T16:54:00Z	false	`main`	No license endpoint result; root has no license-like file.
`Fahim047/gritcms`	https://github.com/Fahim047/gritcms	1	NOASSERTION	2026-02-27T03:10:34Z	false	`main`	No license endpoint result; root has no license-like file.
`leamsigc/MagicSync`	https://github.com/leamsigc/MagicSync	57	NOASSERTION	2026-08-28T08:01:45Z	false	`main`	README says AGPL; no license endpoint/root license file.
`f1nnix/magplan`	https://github.com/f1nnix/magplan	31	NOASSERTION	2025-12-04T12:46:09Z	false	`master`	No license endpoint result; root has no license-like file.
`Haseebcodejourney/creatorflow-dashboard`	https://github.com/Haseebcodejourney/creatorflow-dashboard	0	NOASSERTION	2026-05-24T10:02:43Z	false	`main`	No license endpoint result; root has no license-like file.
`Parisha-15/SponsorForge`	https://github.com/Parisha-15/SponsorForge	0	NOASSERTION	2026-08-13T11:18:30Z	false	`master`	No license endpoint result; root has no license-like file.
`Manish-Prajapati32/Influencer-Connect`	https://github.com/Manish-Prajapati32/Influencer-Connect	0	NOASSERTION	2026-02-11T23:58:32Z	false	`main`	No license endpoint result; root has no license-like file.
`CLEMENT3Z/agency`	https://github.com/CLEMENT3Z/agency	0	NOASSERTION	2026-07-16T16:11:05Z	false	`main`	Repository is empty; no license endpoint/root license file.

API query coverage for the follow-up

The second pass used direct REST search expressions, all through the GitHub CLI’s authenticated token:

Project-specific repository terms (20 attempted): OnlyFans agency, OnlyFans management, OnlyFans creator management, content creator agency, creator agency CRM, talent roster management, model roster management, chatter agency, creator onboarding portal, creator payout commission, influencer campaign management, creator content workflow, creator content review, Google Drive creator, referral partner commission, creator invoice, agency CRM TypeScript, creator portal Next.js, Convex creator, Convex CRM. The first 7 queries returned 52 visible rows; the remaining 13 were rejected by the search endpoint’s 30-request window after the already-running API campaign.
Second project-specific repository window (20 attempted): OFM agency, adult creator agency, webcam agency CRM, Telegram recruiting CRM, creator economy platform, creator operations, creator partnership management, influencer outreach CRM, sponsorship management platform, KOL management, creator campaign, creator deal tracking, creator revenue tracking, creator payment platform, creator content management, creator asset library, creator approval workflow, creator contract management, creator onboarding, agency OS. This window produced the AgencyOS, Orbit, CreatorReach, YouTube bridge, Telegram CRM, AdsBazaar, and related hits above.
Expansion terms (8 attempted): creator operating system, agency operating system, content ops platform, creator approval, creator revenue share, creator marketplace payout, adult creator dashboard, multi-role creator portal. This produced CreatorOps, creator-approval, revenue/payout, and creator-OS leads; most were rejected for no license or incomplete implementation.
Authenticated code search (10 queries, 100 visible code-hit rows): "OnlyFans"; "creator agency"; "chatter" "agency"; "creatorId" "commission"; "content approval"; "Google Drive" "creator"; "referral" "payout"; "influencer" "pipeline"; "creator onboarding"; "planned" "actual" "publish". Code search was much noisier than repository search—generic docs, unrelated social tools, and the HALO mirror dominated. The project-specific hits promoted here were separately checked with core repository API calls and source inspection.
Search-rate boundary: gh api rate_limit showed the authenticated search resource at 30 requests/minute and it was exhausted during the campaign; core API remained at 5,000 remaining. No search result was silently presented as verified metadata: promotion required a separate gh api repos/... call.

What changed in the HALO recommendation

The project-specific evidence changes the priority order:

First compare Nexora’s Convex server-side auth/RBAC smoke tests against HALO’s unauthenticated backend and client-only role gates.
Treat Creator Marketplace and KOLConnect as the strongest domain-integrity donors: two-sided ownership, creator-vs-account normalization, planned-vs-actual evidence, safe merge/delete, escrow, reconciliation, and focused negative tests.
Treat wacrm as the strongest chatter-plane donor, and AgencyOS as the strongest client-portal donor; both stay behind HALO identity and domain ownership.
Treat Orbit, CreatorReach, and the YouTube bridge as bounded content/outreach/approval patterns—not competing operating systems.

No code, deployment, seed/reset/migrate mutation, push, PR, issue, credential write, or file other than this report was performed during the follow-up.

Canonical source remains research/sourcing-campaign/github-wide-funnel.md. This HTML is a generated projection; edit the source, then run generate-docs.mjs.

19 · GitHub wide funnel