Today's slate has receipts: every pick documents production, not a promise.

A Swift + Metal runtime (Apache-2.0) for the Qwen3-Next and Qwen3.5/3.6 MoE families that keeps only the model's dense core resident and streams the routed experts from SSD on demand. The README's own table: the 35B runs in 2.6 GB of peak RAM at 7–11 tok/s on an M5 Mac; the 80B in 4.3 GB at 4.5–5 tok/s; the 35B also runs on an iPhone 17 in about 2.5 GB at roughly 1 tok/s. It ships repacked model containers on Hugging Face, a repack CLI that also converts raw MLX checkpoints, an OpenAI-compatible loopback server — and an actual App Store app. Created Sunday, 236 stars, 214 points on HN. This is the fourth expert-streaming engine in five days (TurboFieldfare 07-30, WASTE and runNburn 07-31), and the watch asked whether the technique would consolidate into llama.cpp or get a head-to-head; instead it went down-market — the first engine targeting phones, and the first shipping as a consumer app rather than a repo. The honesty artifacts carry it: the README credits ANEMLL's 397B iPhone proof-of-concept as prior art, states that the decode loop is currently dispatch-bound rather than IO-bound, and volunteers the catch itself — about 3B parameters are active per token, so these models chat and write like large models but recall facts like small ones. The thread supplied the sharper objection: prefill, not decode, is the wall, with one commenter putting 10k tokens of context at half an hour on an M5. Reach for it when you want a large open model on hardware you already own, for work that tolerates 5 tok/s — overnight batch jobs, private drafting, anything where custody beats latency. Delete the 128 GB RAM line item from the Mac you were about to spec for local inference. Tradeoffs: the thread's prefill estimate rules out agent loops and long-context coding today; ~3B active parameters is a real ceiling on recall, stated by the author; the repo is a day old; and the qpack containers are the author's own repacks, so you're trusting his conversion until you run the repack CLI on a checkpoint yourself.

A config-and-patches repo (Apache-2.0, created this morning) documenting a production deployment of DeepSeek-V4-Flash-0731 — the 304B checkpoint, run as shipped — on a single AMD MI300X: a Docker Compose stack, SHA-256-pinned file overlays against a pinned vLLM ROCm nightly, AITER GEMM tuning tables for the kernel shapes the packaged tables miss, and a hybrid KV strategy putting 20 GB of FP8 cache on the GPU and 96 GiB of evicted prefix entries in CPU RAM. The author's measured numbers: 156.67 GiB of weights resident in HBM with no quantization or offload, 168.6 tok/s single-stream decode with speculative drafting, ~8K tok/s prefill, 542 tok/s aggregate across 8 streams, 830 at a 64-stream burst, 256K context validated. This is the owned-hardware deployment postmortem the open-weights thread has been missing since K3 release week — hardware, quantization, tokens per second, all stated — and the HN thread supplied the dollars. You can't buy one MI300X (they come eight to a box at roughly €250K), but AMD's Developer Cloud rents a single card at $1.99 an hour, and a commenter did the arithmetic: at full burst that's about 3M tokens an hour, roughly $0.54 at DeepSeek's own output pricing. Serving it yourself costs about four times the vendor's meter even at best case — custody is the product, WASTE's conclusion (07-31) one altitude up. Credit is handled properly too: the FP8 fnuz-vs-OCP discovery belongs to Doubleword's June bring-up (which crossed our pool 06-02); this repo is that work matured into a pinned profile someone actually serves from. Reach for it when frontier-class open weights need to run on hardware you control and one card is the budget. Delete the assumption that a 300B-class model means a multi-node cluster and a serving team. Tradeoffs: 17 stars and one operator's numbers on one card, unreproduced — though the SHA-pinned stack makes re-running them unusually cheap; you inherit his exact nightly and his patches until upstream absorbs them; the FP8 handling that makes it work is MI300X-specific by design; and the economics only close if custody, 256K context, or data policy is worth 4x DeepSeek's own price.

A local-first state kernel (MIT, Python 3.11+) for long-running agent work: durable objectives, human-decision gates, executable todos, evidence logs, spend quotas with auto-wake, and claims and leases for teams of peer agents — agent-agnostic across Codex, Claude Code, Cursor, or your own runtime, which executes one bounded turn per tick while loopx holds the state. Created May 31; today it's GitHub's biggest mover at +618 stars (1,412 total), and v0.4.1 shipped this morning at 04:06 UTC. The evidence section is the unusual part: published trajectories spanning 200+ hours of loop lifetime each, offered as the pitch instead of a demo GIF. Yesterday's slate added operators to a session — a teammate, your phone, a cloud. loopx assumes all of that and asks what survives the turns: chat memory plus a timer can't govern multi-day work, so it moves objective, scope, evidence, and continuation out of the transcript into a compact reviewable store — an agent-native Kanban where cards carry identity, authority, and evidence, and the board is a projection of state rather than the state itself. It's also the nearest miss yet on the session-scoping watch: leases and capabilities scope which agent may act next, though still not which tools it may touch. Its own boundary doc is blunt in the right way — not an autonomous production controller; publishing, production writes, and final ownership stay with the human. Reach for it when an objective outlives any single session: multi-day refactors, benchmark campaigns, monitor loops that must survive a restart. Delete the STATUS file you update by hand and the cron job that re-prompts an agent with no memory of why. Tradeoffs: the code is two months old and most of the stars arrived this week, so the community is younger than the ambition; there's no loopx on PyPI at compose time — install is from the repo; the manual lives on Feishu and the deeper docs lean Chinese; and the control plane governs by protocol, not enforcement — an agent that ignores the loop contract just wanders off, so the gates are exactly as strong as the harness's compliance.

An enterprise security system for AI agents (Apache-2.0, Python), open-sourced by Uber with its MLSys 2026 paper: a Sensor that collects and normalizes telemetry — intent, tool use, execution traces — from Claude Code, Cursor, Codex, and other tools across macOS, Linux, and Windows; ADR-Bench, 303 tasks against 133 MCP servers covering 17 agent attack techniques; and a two-tier Detector that runs high-recall triage over everything and escalates suspicious sessions to a deeper agentic reasoner. Deployed in production at Uber against both employee coding agents and customer-facing support agents. 512 stars, +140 today. The agent-security watch asked (07-31, the day trailofbits/skills and AgentHound landed together) for a scanner that runs inside the harness rather than against a network from outside; this is that, from a company that has to mean it, with the benchmark for grading alternatives published alongside. The load-bearing omission is in the README's own bold: ADR Prevention — the layer that stops unsafe actions — "is not included in the current open-source release. Stay tuned." So the release observes, benchmarks, and detects; the blocking hand stays closed. Put it next to yesterday's kicker and the enforcement thread splits cleanly in two: dcg blocks without understanding, ADR understands without (openly) blocking — published the same week by a solo developer and a ride-share company respectively. Reach for it when more than one agent runs with real credentials inside your org and "we'd notice" is currently a feeling rather than a system. Delete the grep-over-transcripts incident response and the assumption that your SIEM's categories describe agent behavior. Tradeoffs: the detector is itself agentic, so detection costs inference — setup wants Anthropic and OpenAI keys, and the two-tier design is a cost dial, not a free lunch; without the withheld prevention layer this is observability you must act on manually; the deployment surface is enterprise-shaped; and a benchmark authored by the defender's own team is still the defender's exam, however real its 303 tasks.

The kicker, because it answers the question every pick above leaves open: what actually happened inside the session? Armature (YC P26, closed, hosted, 40 Show HN points) is an SDK that wraps your MCP server and turns raw tool calls back into narratives — user intent, agent reasoning, outcome scores from 0 to 100, failure clusters like loops and dead ends — with session replay, evals generated from your top use cases, and multi-model testing across Claude, ChatGPT, and six others. Free for 1,000 credits a month, then $50 per thousand; PII and secret redaction runs client-side by default. The npm registry says the SDK has been shipping since before the launch: 0.6.36 published July 29. The mechanism is the story, and the founders state it in the thread with disarming candor. Asked how they get the model's thoughts: "We ask it :)" — the SDK adds an optional telemetry object to each tool's input schema, with fields like user_intent, agent_thinking, and user_frustration; the calling agent fills them in as part of the tool call; the SDK strips the block before your handler runs. That resolves yesterday's session-format watch sideways: nobody needs a harness export API, because the tool schema already is one — every agent obediently completes whatever form it's handed. Read it twice, because the channel is symmetric: ADR above watches your agents from your side of the wire; Armature demonstrates how much any MCP counterparty can learn from theirs, with your agent's cheerful cooperation. Reach for it when your MCP server has real users and "what do they use it for" currently has no answer beyond tool-call counts. Delete the OpenTelemetry-spans-and-guesswork pipeline that logs the calls but not the intent. Tradeoffs: closed and hosted, with narratives about your users' sessions stored on their side under configurable retention; the telemetry only arrives if the calling model fills in the fields, so coverage skews toward compliant agents; schema-injected fields cost your users tokens on every single call; a 40-point, two-comment launch is thin traction; and the disclosure channel it monetizes is now documented in public for every MCP author with worse intentions.

**Also worth knowing.** **Hoplite** (YC S26, 75 HN points, hoplite.sh) rents cloud coding agents that work in isolated sandboxes, verify their changes with tests and browser previews, and emerge as pull requests — Modal underneath with Daytona as fallback, open-weight models including Kimi K3 and GLM 5.2 on the menu, and a stated no-upcharge-on-tokens pricing philosophy; yesterday's AgentSky parks a general agent behind your chat apps, this is the same housing with a PR-shaped front door. **Atlaso** (#4 on Product Hunt at 115 votes, closed, atlaso.ai) is one memory across Claude Code, Cursor, Codex, OpenCode, and Antigravity via per-tool plugins plus an MCP server — top-5 hybrid retrieval with a stated ~650-token injection cap per session, and client-side secret-stripping as their claim; the repo-memory shelf (CodeAlmanac 07-22, Inventory 08-03) gains its hosted cross-harness entry, self-hosting not offered. **space ocr** (#12, 85 votes, space-ocr.com) is OCR that re-reads its own output character-by-character against the page and routes failures to human review instead of silently passing them — app and API, 100 pages a month free, failed scans uncharged, their own 333-cell eval scoring 93.7% with verification against 91.3% without; yesterday's pdf-inspector decides which documents need OCR, this is the OCR admitting which answers it isn't sure of. **Finyuus** (#14, 77 votes, open source) is an indentation-based DSL for AI workflows — agents, guards, human approvals, nested flows — stored as plain text so the workflow diff is a git review, running locally on a Docker stack bundling Temporal, ClickHouse, MinIO, and Langfuse; governance-as-code, one layer more formal than loopx's state files. And two one-liners: **MOTHER** ($9.99 once, macOS, #16 on Product Hunt) is a terminal that treats Claude Code sessions as first-class — one-click resume, a menu-bar alert when the agent is waiting on you — the doorbell shelf at impulse-purchase pricing; and **hcker.news** (47 Show HN points) is Hacker News with the AI stories filtered out, which trended on Hacker News, in the AI section, and is this newsletter's memento mori.