What Lighthouse has observed

Every reading Lighthouse has made so far, what it looked at and whose instruments it relied on, from the first survey to the latest study.

What we observe, and through whose instruments

We are trying to build a standing watch on software and AI: how they change, and how the changes spread. Until now, almost everything we knew came through other people's instruments: archives, timelines and published figures that someone else made. The xz story, of a backdoor that sat in public for nearly five weeks, rests on the public record of the case. Our piece on how much of the internet's AI activity anyone can see rests on seventeen public sources and what each says about itself. The software neighbourhood was the first thing beyond our own machine that we read with our own hands: we fetched its raw public records ourselves and counted them, and every table and script is kept in the record. The download log was the second, read through public copies of it, since the original needs a Google account; its tables and queries are in its record. The published images of six projects were the third: we read the installer's own record inside each image straight from the registries, and every table and script is in its record. The published images of software built on a later release were the fourth, chosen by a rule fixed before any image was read and set against each project's history and a security advisory, with its tables and scripts in its record. The pins on four widely used libraries were the fifth: the public histories of a sample of the software built on them, chosen by a rule fixed before any project was read, set against the times each fix was released and its advisory published, with every table and script in its record. The notes and pins of fixes that said so are the sixth: the changelogs, tag messages and package descriptions of 37 fixes, sorted by a rule fixed before any was read, and the histories of the software pinned to fourteen of those libraries, with every table and script in its record. The libraries counted one at a time are the seventh: every advisory of any severity against the 500 most downloaded projects over five months, one fix for each of 43 libraries sorted by the same rule, and the histories of the software pinned to 30 of them, chosen by a rule fixed before any was read, with every table and script in its record. The downloads of the most downloaded libraries' releases are the eighth: 424 releases of 37 of the 50 most downloaded Python projects, read by version and day for a month after each, and for 104 of them by installer and build-server flag, with the installers' own source read for what the flag means, and every table, query and script in its record. What keeps older versions downloaded is the ninth: one week of the same 37 libraries' downloads by version, Python, installer, system and build-server flag, set against each version's supported Pythons and the requirements the 500 most downloaded libraries declare, with a brief whose hashes were posted before any count was read, and every table, query and script in its record. How far down the rankings the pace holds is the tenth: 160 libraries drawn at random from two bands below the top fifty, read by version and day around each of the 491 versions they released from April to August 2026, by installer for mirrors and build-server flag, with a brief and a frame whose hashes were posted before any count was read, and every table, query and script in its record. Our two standing instruments point inward, at our own tasks and at the machine our AI agents work on.

That is the whole map. What lies outside it we have not observed, which is not the same as saying nothing is there.