Synthesis — FOSS Applications

The evolving thesis. Spun out 2026-08-09 from six records that had sat in the hub _inbox for up to nine weeks under five different tentative tags, every one of them parked with a note saying no spoke owned software an end user runs themselves. Small corpus, one day old, and the shape below is provisional in the way a first draft is.

Current thesis — the posture is shared, the price is not

An Android keyboard, a macOS window manager, a Windows-compatibility runtime, a video downloader, a nine-module business platform and a directory of the whole field have no market, no user and no technology in common. What they share is who is in control: the software runs where its operator says (foss-application).

That is the whole of the agreement. On what the posture costs, the six sources disagree completely, and the disagreement is the more useful finding.

anysoftkeyboard pays nothing to a third party and everything in capability. Its guarantee, “multiple languages and NO internet access”, holds because the network capability is absent, not because a vendor promises restraint. Nothing can leak what is never sent. The price is the entire feature set that needs a server: cross-device sync, cloud personalisation, the large models behind modern prediction. It is the strongest claim in the corpus and the one with the least left over.

hometube claims the same property and cannot have it. “No cloud dependencies, everything runs locally” sits a few paragraphs from an instruction to supply cookies, because the upstream platform still gates quality, access and “encrypted signatures.” Storage and playback genuinely moved in-house. Acquisition did not, and cannot.

ever-gauzy shows where the argument runs out of road. Nine business modules, 27,198 commits, 414 open issues, self-hostable behind PostgreSQL, Redis, OpenSearch, MinIO and Jitsu. Declining to rent a keyboard costs nothing. Declining to rent an ERP means owning disaster recovery for a business system. And the vendor’s own hosted version carries its own warning that it is “in Alpha version/testing mode,” which inverts the usual open-core reading where the managed path is the mature one.

The first real finding: relocation sold as removal

The pattern that survives contact with all six sources is that self-hosting moves a dependency rather than deleting one, and that the marketing consistently describes the move as a deletion (self-hosting).

The test that separates the honest claims from the loose ones is simple, and this corpus supports it: name the resource the software needs that you do not own. AnySoftKeyboard has no answer, which is why it can promise the most. HomeTube’s answer is an authenticated session on someone else’s platform. Ever Gauzy’s answer is nobody — and the price is that nobody is paid to notice when it breaks either.

The second finding: the category’s own map cannot see part of it

openalternative catalogues 500+ projects, ranked by GitHub stars and nothing else. Two of this spoke’s six sources are invisible to that ranking and one is badly misplaced by it. proton-wine-andrevto has 34 stars, daily automated builds, and a compatibility ecosystem depending on it, and it replaces no proprietary product, so the substitution taxonomy has no slot for it. omniwm is a window manager for a platform that ships none. ever-gauzy‘s nine modules rank below a list of links.

So the frame that sells this category (open-source-alternative) systematically underweights compatibility work and infrastructure, and rewards whatever is easiest to describe in one line. This spoke organises by who is in control instead, which is the reason proton-wine-andrevto is here at all.

A second map disagrees with the first, and that is the more interesting fact (added 2026-08-10). best-of-lists indexes 22 generated directories using a project-quality-score that puts stars in as one logarithmic term beside licence, semantic versioning, release recency, project age, contributor and commit counts, closed issues, downloads and dependent packages. It improves on star-sorting: hygiene points are free to earn at any size, so a small maintained project can out-rank a large abandoned one. It changes nothing about what neither map can see. Both rank repository metadata. Neither reads the code, runs the software, or asks who uses it. The generator’s own docs concede the point: “There is no scientific proof that this really reflects the quality of a project.”

Two biases in the better metric carry forward into how this spoke should read any ranking. Download and dependent-project terms are earnable only by things published to a package registry, so the score reads libraries better than the end-user applications this spoke is about; and the recency terms penalise software for being finished. Meanwhile 17 of the 22 lists in that index carry its own 💤/💀 inactivity markers — the machinery that measures abandonment is mostly documenting its own.

A pattern worth watching, not yet a finding

Substitution is hardest exactly where it is most constrained. Three sources replace part of the environment a platform vendor supplies — a keyboard, a shell, a window manager. All three run on platforms built to discourage that. The shapes their solutions take look like consequences of the constraint rather than design preferences: language packs as separate installable applications, an add-on app per capability, a GPL project paying for Apple notarization so its users can install it, and a store policy change that split Termux’s user base into two incompatible installs (f-droid). One corpus, three cases, no counter-example yet — stated as a hypothesis.

The third finding: relocation can move the risk onto someone who never chose the software

Added 2026-08-10 with openpanel, and it is the first thing in this corpus that complicates the main thesis rather than confirming it.

Every privacy claim here until now protected the operator. anysoftkeyboard cannot leak your keystrokes because it has no network. Analytics reverses the direction: the people recorded are a site’s visitors, and the person self-hosting is the one doing the recording. Moving the software in-house does not reduce the surveillance by one event. It changes who performs it, and it removes the vendor policy, the external audit and the data-processing agreement that sat between the visitor and the data.

So “self-hosting relocates a dependency rather than deleting one” has a second form: it can relocate a risk, and the party it lands on is not always the party that made the decision. Whether that is an improvement depends on which side of the software you are standing.

Two smaller things arrive with the same source. It is the corpus’s second AGPL-3.0 project selling its own hosted version (ever-gauzy is the first), which turns open question 5 from an anecdote into a pattern. And its self-hosting docs are the only ones here that write the recurring bill down — updates mean reading the changelog and applying the changes yourself — which is the first direct evidence for open question 2.

Open questions

1. Does any privacy claim here survive verification? Two sources sell one and both are self-reported. AnySoftKeyboard’s is checkable in principle — permissions are inspectable and the source is public — and nothing in this corpus checks it.
2. What happens to a self-hosted install when the maintainer stops? No abandonment account, no migration story, nothing on what a household does when a one-container service breaks after an OS upgrade.
3. Who actually runs any of this? Stars, forks and commits are all this corpus has. No user counts, no deployment evidence, no retention. project-quality-score shows the ceiling of the metadata approach rather than raising it: the one term that counts real usage — monthly package downloads — is unavailable to software that ships as an app rather than a package.
4. Does the open-source-alternative frame change what gets built, or only how it is sold? openpanel is the first case to look at — it applies the label to itself and carries Mixpanel’s feature surface — and one ambiguous case is not an answer.
5. What does AGPL-3.0 mean in practice here? It appears on a household downloader, on an open-core business platform with three licence tiers, and on an analytics project selling its own cloud, doing a different job in each.
6. Who bears the cost of a self-hosting decision when it isn’t the operator? Raised by openpanel. Nothing in this corpus asks a visitor, a family member or an employee what they think of the switch.

Growth edges

Ranked; each names the kind of source that would close it (see ../QUALITY.md → Growth edges).

1. An independent audit or teardown of a privacy-claiming FOSS application — a permissions analysis, a network-capture study, or a security review of an Android IME or self-hosted service. Closes open question 1 and would give the spoke its first non-self-reported evidence. T1/T2.
2. A survey or dataset on self-hosting practice — who runs what, for how long, why they stop. Anything with numbers on retention or abandonment closes questions 2 and 3 at once. T1/T2.
3. A serious treatment of FOSS licensing in practice — open-core mechanics, AGPL as commercial strategy, what the tiers actually change. Closes question 5. T1/T2.
4. A comparison of a self-hosted platform against its proprietary incumbent on completeness rather than price — the Odoo/ERPNext/Gauzy question. Would test question 4 from the product side.

Cross-spoke adjacency

• ../osint-wiki — termux is paged there in full, as an OSINT enabler. Same subject, different question: that spoke asks what a tool does for an analyst, this one asks who controls the machine.
• ../platform-ops-wiki — production operation of services at scale, with staff and SLOs. The seam with self-hosting is one operator and no on-call.
• ../game-engines-wiki — creating games, against proton-wine-andrevto running one.
• ../defensive-security-wiki — f-droid distribution, signing and the Termux test-key warning all touch supply-chain questions that spoke owns.

Index — FOSS Applications Wiki

Catalog of every page, grouped by schema.org @type. Spine: synthesis (thesis), log.md (history), this file (catalog). Spun out of the hub _inbox on 2026-08-09 from six records parked under five different tags over nine weeks — all declined by the same neighbours for the same reason: nobody owned software an end user runs themselves. Star counts, licences and release tags are dated snapshots — cite and date them. Privacy and “no cloud” claims here are the projects’ own — none is independently verified.

DefinedTerm (concepts)

• foss-application — umbrella: free software an end user installs and runs on a machine they control; what unites a keyboard, a window manager and an ERP suite is the operator, not the category · domain
• self-hosting — running the service yourself instead of renting it; buys control and pays in operations, and the bill arrives later than the decision · practice
• project-quality-score — the “projectrank” metric behind best-of-lists: nine hygiene points plus a dozen logarithmic terms, stars among them. Ranks maintenance instead of popularity, still cannot see a line of code · metric
• open-source-alternative — the substitution frame: software defined by the proprietary product it replaces. The frame that sells the category and the one that distorts what gets built · frame

SoftwareSourceCode (sources)

• anysoftkeyboard — Apache-2.0 Android keyboard, 3.3k★/930 forks, 8,986 commits, code dating to 2009: “multiple languages and NO internet access”, incognito mode that learns nothing, languages and themes as separate installable packages. The corpus’s purest privacy-by-architecture case — an IME that cannot leak what it never sends · source · T1 · github.com
• hometube — AGPL-3.0 self-hosted downloader, 1.3k★/73 forks, Streamlit + Python 3.10 + yt-dlp + FFmpeg in one Alpine container: 1800+ sites, SponsorBlock, AV1>VP9>H.264 selection, playlist sync keyed on video ID, 84% claimed coverage. Pitches “No cloud dependencies, everything runs locally” while telling you to bring cookies — the autonomy and the dependence are in the same README · source · T1 · github.com
• ever-gauzy — AGPL-3.0 “open business management platform”, 4.3k★/858 forks, 27,198 commits, 414 open issues: ERP + CRM + HRM + ATS + projects + inventory in TypeScript/NestJS/Angular, self-hostable by Docker Compose. Community/Small-Business/Enterprise licence tiers, and the vendor’s own SaaS is “in Alpha version/testing mode” · source · T1 · github.com
• openalternative — CC0-1.0 catalogue of open-source substitutes, 6.6k★/312 forks, 187 commits: 500+ projects over 20+ categories, ranked by GitHub stars and nothing else, funded by sponsor logos. The category’s map, and evidence for what the open-source-alternative frame rewards · source · T1 · github.com
• best-of-lists — CC0-1.0 index of 22 generated “best-of” lists, 31K combined stars; 1.8k★/150 forks itself, read 2026-08-10. Entries ranked by a project-quality-score that weights licence, release cadence, maintenance and contributors, not stars alone — the methodological answer to openalternative. 17 of its 22 lists carry its own 💤/💀 inactivity markers · source · T1 · github.com
• openpanel — AGPL-3.0 web and product analytics, 6.4k★/418 forks/77 open issues, read 2026-08-10; seven containers to self-host (Caddy, Postgres 14, Redis, ClickHouse, api/dashboard/worker) and a first-party cloud. Calls itself “an open-source alternative to Mixpanel”. The source that shows self-hosting can move a risk onto the visitors, who never chose it · source · T1 · github.com
• omniwm — GPL-2.0-only tiling window manager, 2.4k★/94 forks, 887 commits, Swift 6.4+ on macOS 26+ Apple Silicon; TOML config live-reloaded on save, IPC/CLI automation, signed and notarized builds. Contradicts the hub record that routed it — the showcase post that surfaced it describes a C/Lua X11 manager, and the repository is neither · source · T1 · github.com
• proton-wine-andrevto — unofficial builds of Valve’s Proton 11.0 Wine as WCP packages for GameNative and Winlator, x86_64 and arm64ec, published by GitHub Actions often daily; 34★/3 forks, latest build-proton_11.0b5-20260520-sdk35. Ships with its own warning: “provided for testing purposes only… Use at your own risk” · source · T1 · github.com

SoftwareApplication

• best-of-generator — MIT CLI (110★) that turns a projects.yaml into a ranked markdown list, pulling metadata from GitHub plus eight package registries and re-running on a GitHub Action. The reason a best-of list is derived data rather than an edited document · thin node

Organization

• f-droid — the FOSS Android repository both anysoftkeyboard and termux treat as their real distribution channel; the alternative to the vendor store, and the reason “install it yourself” is possible on a locked-down platform · thin node

Synthesis

• synthesis — the thesis: six projects that agree on who should be in control and disagree completely on what that costs

Bridge nodes (live in sibling wikis, linked cross-wiki)

termux · termux-commands-site (osint-wiki — Termux is paged in full there as an OSINT enabler; refreshed 2026-08-09 with the repository’s own numbers rather than duplicated here)

Notes

• Deferred entities. Valve (upstream of proton-wine-andrevto), Menny Even-Danan (anysoftkeyboard‘s copyright holder since 2009), yt-dlp and FFmpeg (hometube‘s engines) are named by exactly one source each. Page one when a second source touches it — the recurrence rule in ../ENTITIES.md, and the same call the sibling defensive-security spoke makes for its bylines.
• AndreVto is a publishing handle with no biography evidenced. Not paged.