v0.26.0 - say what the registry already thinks it is

stable arrived in the review queue with a picker offering every tool in the registry and no indication which one to choose. Answering it required knowing that Warp names its macOS binary after a release channel — which is not something an operator should have to research about their own estate.

The platform already knew

A process candidate is raised from a finding whose tool has already been resolved from the domain it reached:

main.py:3696   canonical = _DOMAIN_TO_TOOL.get(f.tool.lower())   ← app.warp.dev → warp
main.py:3714   _note_process_candidates(f)                       ← asks "what is stable?"

Eighteen lines apart. At the moment it asked the question, f.tool said warp — and the candidate threw it away.

What it does now

The candidate carries the suggestion. The card reads:

stable process
DNS lookup for app.warp.dev (via stable)
looks like Warp — it reached a host the registry knows as that tool, confirm or change below

…and the picker opens on Warp, so confirming is one click.

It stays a suggestion

curl reaching api.anthropic.com resolves to claude, and curl is not Claude — it is a script somebody wrote, which is the entire signal the Agentic view exists for. Applying this automatically would delete the finding this week has been about.

So the card says what the registry thinks and still waits for a human. Same trade discovery makes when it classifies an unknown domain with Claude and still queues it.

A tool the registry doesn't have is not suggested at all — the picker couldn't offer it, and the card would name something that doesn't exist.

Checked by rendering, not by reasoning

The row template was pulled out of the page and run against a stable, a curl and an MCP server:

stable: looks-like Warp    : true      curl : looks-like Claude  : true
stable: Warp preselected   : true      curl : Claude preselected : true
stable: evidence shown     : true      mcp  : no picker offered  : true

Not checking what a widget renders from is exactly what shipped an empty dropdown yesterday.

Suites: registry 23, portal 630, scanner 210, receiver 308. Plus collector parity and the identifier guard.