Kyle-approved fleet harvest. Sibling targets (domain/page or open). Runner labels A-D; mapping stays in a sealed key file until scoring.
Go service with /healthz, SSRF guard (parse + resolve-all + Control), exhaustive tests, NixOS module, and Makefile as source of truth for build flags. nix flake check runs make test lint.