Today's picks all ration something that used to be granted whole.

A Python CLI (Apache-2.0, `pip install "soup-cli[train]"`) that fine-tunes language models on hardware nobody would call training hardware. The mechanism shipping in v0.72 is layer streaming: the frozen base model sits in system RAM as 4-bit NF4 weights and is fed to the GPU one decoder layer at a time, with two ~113 MB VRAM buffers doing all the compute. Measured, not projected: Llama-3.1-8B trains at 119.6 tok/s with a 3.32 GB peak on an RTX 3050 Laptop with 4 GB of VRAM, and the raw measurement records sit in the repo's benchmarks/ directory. 130 points on Show HN, 240 stars — and a hundred-plus PyPI releases since March 2, so this is a five-month-old tool crossing our pool for the first time, not a launch. The streaming thread (TurboFieldfare 07-30, WASTE and runNburn 07-31, Swiftlet 08-04) spent a week proving you can run big models from storage they don't fit in; Soup is the first to carry the trick across to training, and it arrives with a stricter verification standard than anything the inference side published: bit-exact logit matching against a resident reference — maximum difference 0.0 — across nine architectures and two precisions, running as CI. The author's reason is the best line in the thread: "streaming fails silently." Loss keeps going down while autograd is quietly broken, so a convergence curve proves nothing. The thread also holds the honest boundaries: embeddings plus one layer plus logits must fit resident, so 14B doesn't go; streaming overhead measured 1.43x against resident training at the one size where both fit the card; GRPO and PPO are excluded on purpose, because generation re-reads every layer per token. Reach for it when you have a dataset, a laptop, and no appetite for renting an A100 to make an 8B speak your schema. Delete the assumption that fine-tuning starts at a 24 GB card, and the cloud-GPU line item for adapter-sized jobs. Tradeoffs: layer streaming is labeled BETA by its own author; DPO pays 1.52x layer reads for its reference model; what fits in 4 GB is QLoRA adapters on quantized bases, not full fine-tunes; and the author disclosed mid-thread that his early replies were LLM-drafted before he switched to writing his own — the disclosure is to his credit, and it still tells you how young this project's community is.

A CLI plus daemon (Apache-2.0, `npm i -g hotcell`, Node 22+) that runs sandboxes for AI agents on hardware you own — Docker by default, Firecracker microVMs on Linux/KVM, Apple's Virtualization framework on macOS, one interface across all three. The reason it's here is the credential design: sandboxes never hold your API keys. Agent traffic to LLM providers and GitHub exits through a gateway that swaps a per-sandbox token for the real key at the boundary — metered, spend-capped, revocable — so killing a sandbox kills its credentials with it. #11 on Product Hunt at 93 votes, and npm shows 24 releases between July 17 and 29: two weeks of quiet shipping before launch day. The sandbox shelf has mostly been renting — agentOS (07-30) sells isolation by the second, Hoplite (08-04) rents the whole coding agent, sandbox included. hotcell is the custody answer: the same per-lease isolation on the Mac mini in the closet. It's also the nearest miss yet on the session-scoping watch — not per-seat roles, but per-sandbox credential ceilings, where the token is the permission and it dies with the lease. And the limitations section does your diligence for you: the gateway trick covers HTTP-header auth only, so Postgres, Redis, AWS request signing, mTLS, and OAuth refresh flows all walk straight past it. Reach for it when agents execute real code and your threat model includes the agent itself — parallel dev environments without cloning the project into each, desktop agents with filesystem access. Delete the shared .env mounted into every container, and the real API key pasted into a sandbox's environment. Tradeoffs: 11 stars and a launch-day community; isolation strength depends on which backend your platform gets, and the Docker default is the weakest of the three; and the non-HTTP gaps are exactly where production data lives.

A licensed CPA firm's complete SOC 2 methodology, published as a repo (CC BY 4.0; the Show HN byline is an ex-Deloitte auditor, the copyright is Y Assurance PLLC): 86 controls, 355 test attributes with pass criteria, 61 Trust Services Criteria mappings, evidence-source mappings, and 498 worked calibration examples — real judgment calls with verdicts and the reasoning behind them. It's written for AI-heavy companies and AI-assisted auditing: tool definitions for connected AI systems are part of the framework, and it commits to complete-population testing over sampling. 34 points on Show HN, 3 commits, first release. The line that carries it: "the bar a company prepares against is the bar the examination applies" — readiness and examination run on the same public document, and an entire compliance-SaaS category is priced on that asymmetry staying closed. It's also the second occurrence of the shape we flagged yesterday as a one-more-time threshold: ADR opened detection and withheld Prevention; Chiaro opens the method and keeps the platform closed — with the twist that the withheld layer here is withheld by statute, not strategy: "anyone may use this methodology, but only a licensed CPA firm may sign an opinion." Reach for it when SOC 2 is on next quarter's roadmap and you'd like to read the exam before paying anyone to prep you for it. Delete the $15k readiness assessment whose deliverable is a checklist, and the compliance dashboard's proprietary "readiness score." Tradeoffs: three commits old, and open-method is also plainly marketing for the closed platform at app.chiarohq.com; the framework is one firm's judgment wearing the confidence of a standard; and a methodology cannot attest — the CPA signature stays the bottleneck, which is precisely the moat.

An MCP gateway (MIT, Python, `pip install cmcp-runtime`) that puts a Cedar policy engine between your agent and its tools — inside a trusted execution environment. Every tool call is intercepted and allowed, denied, or redacted; a deny returns 403 before the upstream tool hears anything; and at session end the gateway emits a TRACE Claim: a signed, hardware-attested record of which tools ran, what policy decided, and the hash of the policy bundle that did the deciding — verifiable without trusting the operator. TPM 2.0, AMD SEV-SNP, Intel TDX, and NVIDIA GPU-CC are supported; CMCP_DEV_MODE=1 runs the whole thing in software for free. Developer preview: 17 stars, four PyPI releases across June, 8 points on Show HN. The enforcement thread gains its third axis. dcg (08-03) blocks without understanding; ADR (08-04) understands without blocking; cMCP's question is who guards the guard, and its answer is to move the policy engine somewhere the governed process can't reach — the exact inverse of agentOS's software boundary sold at a hardware boundary's job (07-30). The redact verb is quietly the watch-relevant piece: yesterday's schema-telemetry watch asked for the first layer that strips undeclared telemetry fields from tool calls, and a Cedar policy on this gateway is mechanically that — though nobody, including its authors, has published that policy yet. LIMITATIONS.md names what Phase 1 doesn't close: payload capture, runtime config injection, typosquatted servers. Reach for it when an agent's tool calls will someday face an auditor, a regulator, or a counterparty who doesn't trust your logs. Delete the "we log everything" middleware whose log files live where the agent's process can edit them. Tradeoffs: pre-1.0 with breaking changes promised; Cedar rules are dcg's half of enforcement — policy and patterns, not intent; TEE attestation on a laptop is a demo until you deploy on hardware that has one; and the only conversation on its launch thread was HN flagging the founder's explanation comment as AI-generated and killing it — an attestation company whose own launch text failed a provenance review is either an irony or a demo, and the product can't tell you which.

A CLI auditor (MIT, `pip install mcpscore`, Python 3.11+) that connects to any MCP server over STDIO, Streamable HTTP, or SSE, completes a real initialize handshake — pointing it at a non-MCP endpoint fails cleanly — and scores the server against 81 weighted rules: protocol compliance (16), tool quality (41), security and auth posture (11), readiness for the 2026-07-28 spec revision (13). Deterministic, no API keys, no signup, a scored report in seconds. v1.5.0 shipped this morning — the third same-morning release in three editions, after loopx and happy — and it's 30 releases deep since June 7 at 13 stars, a shipping-to-attention ratio worth respecting. The kicker, because it grades the other side of every wire above: hotcell rations what your agent can spend and cMCP rations what it may call, but both assume the server across the wire deserves the connection at all. mcpscore is the first tool in the pool that checks. The why-now is spec churn — Simon Willison's stateless-MCP essay marks the protocol moving again, and "which revision are you actually compliant with" just became a question with money on it. And after Armature demonstrated yesterday that a server's tool schema can politely interview your agent, note that 41 of the 81 rules are about tool schemas. Reach for it before shipping an MCP server, and before connecting to someone else's. Delete the vibes-based read-through of a counterparty's tool list. Tradeoffs: 13 stars and one maintainer's rule set — 81 rules is a covenant, not a consensus, and the severity weights are editorial judgment wearing numbers; and a passing grade measures conformance, not intent — a server can score perfectly and still ask your agent how frustrated its user is today.

**Also worth knowing.** **Maple-Preview** (142 HN points; weights on Hugging Face plus a 2-bit MLX build) is deepgrove's from-scratch ternary 20B-A1B claiming 120 tok/s on an iPhone — the fifth on-device beat in six days, and the opposite bet to Swiftlet's: shrink the model until the phone is fast rather than stream a big one until it fits. The thread found the bill — confidently wrong facts, invented landmarks — the author never appeared in it, and the license was unstated at fetch time; chat.deepgrove.ai lets you grade it yourself. **humanizer** — first pool crossing ever for blader's 33.6k-star agent skill, +397 today with no release since July 22 to explain the spike: Wikipedia's 33 "signs of AI writing," applied as a scrubbing pass, with a README that insists this is readability, not detector evasion. That distinction did heavy lifting today of all days, when an HN founder's comment was killed as machine-written (see the cMCP tradeoff) and Soup's author confessed to LLM-drafted replies mid-thread — the tell-scrubber and the cost of getting caught trended together. **TokenMaxxer** (7 points, free, npm) answers the fleet-metering watch (07-30) as a leaderboard: it reads 18 coding tools' local usage files read-only, syncs only the numbers, and ranks you against strangers by burn — metering arrived as bragging rights rather than budget discipline, and the name at least is honest about which. **Kiro Crew** (#6 on Product Hunt, 110 votes, open source) is ex-Amazon internal tooling ("MeshClaw," a claimed 39k developers in six months) grown into a persistent memory-and-crew workspace across the tools you already run — the cross-harness memory shelf (Atlaso yesterday, closed; Hansel today, closed) gets its open entry. **implement-spec** (12 Show HN points, MIT) packages spec, branch, tests-alongside, two-pass self-review, gap analysis, verified PR as a harness-agnostic skill whose completion rule is mapping every acceptance criterion to an artifact — the trailofbits/skills shape at 4 stars instead of 6,000. **Hinode** (6 points, closed, an LLC and no named maker) rents a persistent Linux desktop whose dedicated GPU auto-pauses after 15 idle minutes — L4 at $3.99/hr up to a 96 GB RTX Pro 6000 at $6.99/hr; by-the-active-minute billing fits today's theme, but you're paying a desktop premium over a bare instance for the privilege of keeping your home directory. And two notes on mortality: **Aegisora** took 80 Product Hunt votes for "the narrow control plane for AI agent tool and API calls," and the linked repo is a 3-star Next.js dashboard with the proxy nowhere in it — demand for today's theme is running measurably ahead of some of its supply; and **Flowise** (53 points) is shutting down — the visual node-and-wire agent builder was the obvious interface three years ago, and today it's a sunset page.