diff --git a/CHANGELOG.md b/CHANGELOG.md
index dbd1dbc..bb72bdc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,7 @@
 
 - Wave 7: agent **`tls`** + skill **`tls-lab`**. Runtime TLS (`lib/tls.sh`, `SSL_CERT_FILE`, Kali CA, doctor probe, clock-skew). Overlay still writes the install-time `/etc/tls` symlink. `grokhunter tls` launches the agent. Never print certs.
 - Wave 8: agent **`net`** + skill **`net-lab`**. HTTPS reachability (`lib/https-probe.sh`, `http_code` 000 vs 403/401, guest DNS). CA stays `tls`. `grokhunter net` launches the agent. Offline lab is still OK for local coding.
+- Wave 9: scoped specialist **`tookie`** + skill **`tookie-osint`**. Authorized public username lookup via Tookie-OSINT (`brib.py -sC`). `grokhunter tookie` launches the agent. Not a product default. Hits are leads, not identity. CLI stays upstream (do not vendor `brib.py`).
 
 ## [1.0.10] — 2026-08-25 — Desktop recovery + Coding Team Wave 6
 
diff --git a/CREDITS.md b/CREDITS.md
index 4662c2c..344abad 100644
--- a/CREDITS.md
+++ b/CREDITS.md
@@ -92,6 +92,7 @@ Support: [x.ai](https://x.ai) · [x.ai/cli](https://x.ai/cli)
 |---------|--------|
 | **Aider** | Optional git-native pair tool — [aider.chat](https://aider.chat) |
 | **Astral uv** | Used by the Aider install path for managed Python — [astral.sh/uv](https://github.com/astral-sh/uv) |
+| **Tookie-OSINT** | Optional scoped username lookup (`tookie-osint` / `brib.py`) — [github.com/Alfredredbird/tookie-osint](https://github.com/Alfredredbird/tookie-osint) |
 
 ---
 
diff --git a/agents/HANDOFF-TEMPLATES.md b/agents/HANDOFF-TEMPLATES.md
index 7fd4ba7..2320770 100644
--- a/agents/HANDOFF-TEMPLATES.md
+++ b/agents/HANDOFF-TEMPLATES.md
@@ -335,3 +335,16 @@ overlay | desktop | toolchain
 ## Commands
 ## Verify (doctor x.ai — never print bodies)
 ```
+
+---
+
+## Tookie card (tookie)
+
+```markdown
+## Username
+## Authorization
+## Command
+## Hits
+## Uncertain
+## Next public checks
+```
diff --git a/config/completions/bash/grokhunter.bash b/config/completions/bash/grokhunter.bash
index 54b1991..9a3de1b 100644
--- a/config/completions/bash/grokhunter.bash
+++ b/config/completions/bash/grokhunter.bash
@@ -7,7 +7,7 @@ _grokhunter_completions() {
   cur="${COMP_WORDS[COMP_CWORD]}"
   prev="${COMP_WORDS[COMP_CWORD-1]}"
 
-  local cmds="status doctor binds proot-binds setup sync boot ensure models skills agents team coding-team scout benjamin lucas harper review fix desktop overlay ship docs modeler ci aider session host mcp plugin flow storage editor hook shell github secrets toolchain tls net menu git-identity credits ai-smoke smoke install plan help version"
+  local cmds="status doctor binds proot-binds setup sync boot ensure models skills agents team coding-team scout benjamin lucas harper review fix desktop overlay ship docs modeler ci aider session host mcp plugin flow storage editor hook shell github secrets toolchain tls net tookie menu git-identity credits ai-smoke smoke install plan help version"
   local model_sub="install status force --force help"
   local skills_sub="install status help"
   local agents_sub="status list help"
diff --git a/config/completions/zsh/_grokhunter b/config/completions/zsh/_grokhunter
index 35c0514..2b4c2a0 100644
--- a/config/completions/zsh/_grokhunter
+++ b/config/completions/zsh/_grokhunter
@@ -43,6 +43,7 @@ _grokhunter() {
     'toolchain:Launch apt/compiler agent'
     'tls:Launch TLS/CA agent'
     'net:Launch HTTPS/DNS agent'
+    'tookie:Launch Tookie-OSINT agent'
     'benjamin:Launch benjamin architect agent'
     'lucas:Launch lucas builder agent'
     'harper:Launch harper reliability agent'
diff --git a/skills/PLAYBOOKS.md b/skills/PLAYBOOKS.md
index 6af530a..db62a99 100644
--- a/skills/PLAYBOOKS.md
+++ b/skills/PLAYBOOKS.md
@@ -72,6 +72,7 @@ grokhunter models install
 grokhunter git-identity set
 grokhunter tls
 grokhunter net
+grokhunter tookie
 grokhunter ai-smoke
 bash scripts/ci-unit.sh
 nh-x11                    # legacy drawing on; NH_X11_LEGACY=0 to disable