The approval click lost, so the agent is being handed its own computer.

A local-first agent workspace under the Apache Software Foundation, incubating, Apache-2.0, 1,766 stars against 6 watchers, created 27 May. The architectural claim is one line in the README and it is the sharpest thing in today's pool: "Log is the Runtime." Model messages, tool calls, tool results and termination facts all enter a Runtime Event Log, and then "sessions, UI, model context, and recovery are projections over that log." A single Runtime Host owns session, turn, agent lifecycle, continuation, tools and events — the desktop app, the terminal TUI, the non-interactive CLI and the eval harness all execute through it rather than beside it. Local tools are the familiar set: Read, Write, Edit, Bash, Glob, Grep, with schema validation, permission policy, watchdogs and abort. Install is a signed and notarized DMG from Releases, or from source with Node 22.19+, npm ci, npm run dev, plus brew install ripgrep because the Grep tool shells out to it.

The second line is the one that earns the top slot: "Context is not history." Tool-result pruning and compaction change what the next inference sees without treating recorded evidence as disposable context. Every agent harness prunes — you cannot feed a 400-turn session back into a model — but nearly all of them prune the only record that exists, so the thing you could audit afterwards is whatever survived the context window. Maka splits them: the model gets a compacted view, the log keeps the facts, and recovery replays from the log rather than from the transcript. That is the structural version of the argument this newsletter has been making from measurements for a month. You cannot audit a click, because a click is not a record of anything except that somebody clicked. You can audit an append-only event log, including the permission decisions inside it. Maka also ships an eval subsystem — maka eval run <spec> expands declarative multi-arm experiments into task × repetition × subject cells with immutable per-cell attempts and a result kernel covering score, normalized usage, attributable cost, duration and failure reason — and it runs external competitors through generic adapters, which means the project built the apparatus to be measured against things that are not itself.

Reach for it if you run a coding agent daily and have ever tried to reconstruct what it actually did three sessions ago. Delete the habit of treating the transcript as the record, and delete any belief that your harness's compaction step is preserving evidence. Tradeoffs: the desktop build is Apple Silicon only — Intel Macs, Windows and Linux are unsupported, and the Windows x64 build is an unsigned preview that trips SmartScreen, with the docs telling you not to bypass the warning unless the SHA-256 matches the published checksum, which is the correct instruction and one almost nobody will follow; Computer Use is not in this first public build, so the browser/desktop-driving story is absent; the project says outright that data formats and CLI commands may still change; ASF incubation is a governance signal, not a maturity one, and "incubating" means exactly that; there is no published benchmark of the eval harness against anything, so the measurement apparatus is itself unmeasured; and 1,766 stars against 6 watchers is a following that has starred and moved on.

CopilotKit shipped this three days ago and it has 1,079 stars already, which says more about CopilotKit's existing audience than about the code. MIT, alpha by its own badge and its own words. The pitch: AI coworkers that each get a computer of their own — a real browser with its own logins, its own files, only the tools you grant. Docker Compose brings up every part, data sits in your PostgreSQL, no model ships in the box. It is built on AG-UI, the open agent-to-user protocol, so agents written on LangGraph, Mastra, CrewAI, Pydantic AI, Google ADK or by hand all arrive the same way — and, in the README's own framing, "the governance rides the protocol rather than the framework." Requirements are Docker, Bun 1.3+, a model key, and a CopilotKit Intelligence project and license.

The reason this is second rather than fifth is that its install-time architecture document specifies the boundary as a numbered sequence rather than a marketing adjective. The gateway resolves the target from a server-held snapshot, evaluates the policy, writes an audit row for the decision, calls the computer only when the decision forwards, then writes a second row for the outcome — and the doc states flatly that "the computer itself does not decide policy. The server gateway is the action boundary." Each Bot's computer is one container holding its own Chromium, its own logins and its own workspace, built by a supervisor process. Graded against the standard this newsletter set on 08-17 — does the disclosure live in the thing you install, or in a blog post from September — that is a pass. It also passes on an unflattering detail: the compose file defines optional SPIRE services for workload identity and the docs say plainly that start.sh does not start them. Shipping the config for a feature and admitting the default path skips it is the kind of sentence most vendors delete. One thing does not reconcile, though, and it is load-bearing. The README says the whole thing runs on your own machine and inside your own infrastructure; the architecture table lists CopilotKit Intelligence as external, holding durable threads, memory and the realtime gateway. Those are two different claims about where your agent's memory lives, published by the same project on the same day.

Reach for it if you want a browser-using agent with per-agent logins and a record of every action, and you are comfortable running alpha software. Delete the shared browser profile your agents have been taking turns in. Tradeoffs: alpha, three days old, and the maintainers say so — the entire HN thread is one comment, from a maintainer, confirming it; out of the box it runs with OPENBOT_DEV_NO_AUTH, which skips sign-in and admits every request as a single administrator, so the default posture is no authentication at all; it is MIT but requires a CopilotKit Intelligence project and license token, which is a hosted commercial dependency in the critical path of an "open source" install; threads and memory leave your machine despite the README's framing; the shipped proof-of-concept Bot needs an OpenAI key specifically; SPIRE is present but off; and 1,079 stars against 3 watchers on a repo created 17 August is velocity borrowed from a company, not adoption.

Launch HN yesterday, YC S26, 79 points. An agent per employee, each in its own isolated sandbox with a filesystem and a shell, where — in the line that is the entire product — "the only way out is the gateway, so it can reach what you granted and nothing else." Credentials are injected by that gateway at request time and never handed to the agent; you can also wire Bitwarden or 1Password for on-demand injection with nothing stored on the server. Agents provision against your company IdP, each gets its own Slack app with its own name and avatar, and the runner is outbound-only with no inbound ports, so a laptop, a homelab or a VPC behind NAT all work with no ingress and no tunnel. Self-host with git clone, pnpm install, pnpm run setup, then localhost:10254. Apache-2.0, 3,228 stars.

The seen-before check makes this a better story than the launch copy does. OneCLI is on its fourth trip through Hacker News and its second through our pool, and the arc is a pivot with the receipts attached: "Show HN: OneCLI — Vault for AI Agents in Rust" on 12 March (161 points), "NanoClaw Adopts OneCLI Agent Vault" on 24 March (112 points), "OSS credential gateway that keeps secrets out of AI agents" on 23 July (110 points), and yesterday's team harness (79). The README narrates the pivot honestly — they built a credential vault, found the demand was from people running OpenClaw, Hermes and NanoClaw, and concluded that "every autonomous agent out there is built for one person." The founders are blunter in the thread than in the docs. On why they built it: "we built the gateway first because we were afraid of using openclaw the way it came out of the box. we didn't even connect our gmail out of fear." On the crowded market a commenter accused them of standing in: "Honestly, we're not sure yet how we win this space." That thread also named six competitors unprompted — OrcaBot, Nemesis8, Databricks Omnigent, YC's own qm, Infisical's agent proxy, and Grok Bot — which is the most compact evidence available that the box, not the model, is where everyone is now building. And it produced the question this whole edition should be read against, from ezzy-1630: keeping the real credential out of model context is a meaningful improvement, "but the gateway still becomes a confused-deputy boundary. An agent allowed to call a CRM API may still be tricked into exporting the wrong customer or changing a field it should only read," followed by a request to know how those policies are tested against prompt injection. It got no reply. A different commenter asked the narrower version and did get a good answer: policies match on method, path and body rather than host, so GET /calendar/v3/* can be allowed while POST requires approval. That is real granularity. It is not an answer to the confused deputy.

Reach for it if several people at your company are running autonomous agents against real accounts and you currently have no idea which keys are where. Delete the .env file you have been mounting into agent containers, and delete the assumption that "the agent has its own sandbox" means the agent cannot be steered into misusing what the sandbox legitimately reaches. Tradeoffs: the licensing needs reading before adoption and one HN commenter got it wrong in public with no correction — it is Apache-2.0 except four enumerated paths, apps/web/src/ee/, packages/api/src/ee/, apps/gateway/src/ee/ and apps/gateway/src/ee.rs, which fall under a separate enterprise license that is free for development and evaluation and requires a subscription in production, meaning the gateway that is the entire security argument contains commercially licensed code; the copyright holder is ChartDB, Inc. and contributions require a CLA; hosted pricing was quoted in the thread at $499/month for 20 agents excluding API costs; the confused-deputy question is unanswered and there is no published prompt-injection test of the policy engine; a commenter reasonably flagged 3,200 stars against a demo video with 38 views, though the repo has been public since March and a NanoClaw integration explains the base; and points across four HN appearances have gone 161 → 112 → 110 → 79, which is a category getting noisier, not a product getting worse.

Google-authored, explicitly "not an officially supported Google product," Apache-2.0, Go, 1,283 stars, created 13 May. This is the same idea as the three picks above it moved down a layer to where it becomes an infrastructure problem: a control plane for agent sandboxes with sub-second suspend and resume, supporting microVMs and gVisor under a consistent lifecycle API, built on Kubernetes pods and autoscaling. The insight it is engineered around is a good one and is stated plainly: agent-like workloads "tend to be idle most of the time," so you map a large set of actors onto a small set of ready workers and juggle. The published demo claims ~250 stateful actors multiplexed across 8 physical pods — 30x oversubscription — with volatile RAM and filesystem state preserved across hibernation via full-state snapshots. It is framework-agnostic because it manages OCI containers at the kernel level, and the compatibility list names Claude Code and Codex directly, for "high-density, stateful coding environments that preserve terminal and filesystem state across sessions."

This is the rung where the boxes stop being a security story and start being a bill. Everything above gives one agent one computer, which is fine until an organization has four hundred of them and discovers it is paying for four hundred idle machines. Substrate's answer is that the agent's computer should be a suspended snapshot most of the time, and the honest read is that this is the least mature pick on the list and the most likely to matter in a year, which is why it goes here rather than higher. The project is also the clearest case this quarter of a large vendor publishing something that damages its own narrative — it states that it is in early development, not ready for production, that its APIs are "almost guaranteed to change," and that "everything in this project may be changed." It has been trying to get attention since at least 17 July, when it first crossed our pool, and its best HN showing to date is three points. It is worth noting that this and the next pick are both Google agent infrastructure shipped under a disclaimer that Google does not support them.

Reach for it if you are the person who will have to run other people's agents at scale, on Kubernetes, and you want to read the design before you need it. Delete nothing — this is a read, not an install. Tradeoffs: not ready for production by its own declaration, with no backward-compatibility guarantees; it requires Kubernetes and gVisor or microVM support, so there is no laptop path at all; the 250-actors-on-8-pods figure is the project's own demo and we did not reproduce it, because unlike yesterday's four-minute cold clone this one needs a cluster; it is explicitly not an SDK, so it solves none of your agent-building problems; 1,283 stars against 16 watchers; and the Google disclaimer means no support commitment and no vulnerability-rewards coverage.

Also Google, also "not an officially supported Google product," Apache-2.0, Go, 335 stars and 2 watchers. Sovereign Agent Mesh is the last rung outward: not the box the agent runs in, but the wire between boxes. Nodes discover each other over libp2p and form a self-healing P2P network with no configuration; every connection, node and packet is authenticated; and cryptographic identities are environment-agnostic, so a node keeps its identity moving between cloud, laptop and edge. Three components — sam-control-plane for identity registration and authorization policy, sam-router for libp2p bootstrap and relay, and sam-node as the local client providing mesh transport and MCP sidecar routing. There is a public testnet at bananas.sam-mesh.dev, a Docker or binary quick start, integration guides for Gemini and Claude, plain Kubernetes manifests and a Helm chart for running your own hub.

The MCP sidecar detail is what makes this a pick rather than a curiosity. The current answer to "how does my agent call a tool that lives somewhere else" is an MCP server reachable at a URL, secured by whatever that URL's owner decided, which is the same trust model as a public HTTP endpoint and has been going about as well as that implies. SAM's answer is that tool invocation should ride a mesh where identity is cryptographic and per-packet rather than a bearer token in a header, and that agents should discover each other's tools dynamically instead of being handed a static config. Their advanced demo — one agent fanning a batch of work across a warm pool of reviewer agents — is the shape everyone will want the moment they have more than one agent, and nobody has a good story for today. Set it beside Substrate: the same organization is shipping the scheduler and the network for a world of many concurrent agents, both as unsupported side projects, while the officially supported products remain chat interfaces.

Reach for it if you are already running more than one agent on more than one machine and are currently solving that with a VPN and hope. Delete the hand-maintained list of MCP endpoint URLs, eventually — not yet. Tradeoffs: 335 stars and 2 watchers makes this the least-adopted thing on the list by a wide margin; the same unsupported-Google disclaimer applies, with no vulnerability-rewards eligibility; there is no published benchmark of any kind — no latency numbers for mesh tool invocation versus a direct MCP call, which for a networking layer is the number that decides adoption; zero-trust claims are architectural assertions here and nobody outside the project has audited them; the public testnet is a testnet and naming it bananas is a fair signal of the maturity level; and running your own hub means operating a control plane, routers and a console, which is a real cost to weigh against the URL-in-a-config-file it replaces.

Tencent's Zhuque Lab ships the red-team counterpart to everything above: an AI security scanner covering agent scanning, MCP server and Agent Skills scanning, AI infrastructure vulnerability scanning, OpenClaw deployment scanning, and jailbreak evaluation. Apache-2.0, Python, 4,757 stars, 471 forks and 38 watchers — by a distance the most-adopted and most-watched project in today's edition. It has been in development since December 2024, ships as a Docker image, and carries a Black Hat EU 2025 Arsenal listing, which is the only piece of third-party validation anywhere on today's slate.

It closes the edition because the previous five picks all make the same structural bet and none of them tests it. A sandbox, a gateway, a policy engine and an audit log are load-bearing security claims, and the entire history of this newsletter's last three weeks is that security claims which nobody measures turn out to be worth about a tenth of their headline. AI-Infra-Guard is the category of thing that would produce the missing number — pointed at an MCP server or an agent deployment, it is designed to answer "what does this actually expose" rather than "what does the README say it prevents." The scope is genuinely broad, and the breadth is also the reservation: a platform doing infrastructure CVE scanning and MCP auditing and skills auditing and jailbreak evaluation is doing four different jobs, and the README does not publish a detection rate or false-positive rate for any of them. It is also, and this is worth saying in a newsletter with this one's habits, the most self-promotional document in today's pool — it asks for a star twice, once as a rendered badge, and dangles a reward for filling in a feedback survey with a valid email address. Everything else on this list disclosed a limitation before it asked for anything.

Reach for it if you are about to expose an MCP server or an agent deployment to anything you do not control, and you would like a second opinion that is not the vendor's README. Delete the assumption that your agent sandbox is sound because its documentation is well written. Tradeoffs: no published accuracy, coverage or false-positive numbers for any of its five scanners, which is precisely the gap this edition exists to name, and it applies to the auditor as much as to the audited; the scope is wide enough that depth in any one area is unproven; documentation quality across the non-Chinese translations is uneven; running a jailbreak evaluation bills model tokens with no cost-per-run figure published; a scanner is a tool for finding known problems and will tell you nothing about the confused-deputy question that OneCLI's thread raised; and the star solicitation and email-for-reward survey are a tone worth pricing in when you read its own claims about itself.

Also on the board. OpenLogi was the biggest honest mover in the pool by a mile — 11,067 stars, 1,225 of them today, Apache-2.0, Rust, a local-first Logitech Options+ replacement that remaps buttons, DPI and SmartShift over HID++ with "no account, no telemetry." It has nothing to do with agents and it is the best-executed thing we read today. • The actual top of the github:rust feed was amadeusprotocol/node at 4,992 stars and +1,397 today, with no license and no description. We did not open it further and neither should you. • Magnitude (1,425⭐, Apache-2.0) is an open-source agent with local models built in, "fully private and offline" — a sixth answer to today's question that arrived without enough evidence to rank. • ODS (4,553⭐) turns a PC into an AI server and lists a Discord invite as its homepage, which is a choice. • android-remote-control-mcp (523⭐, MIT) is the anti-rung to this entire edition: an MCP server running on your phone with no root and no ADB, driving your real apps with your real logins, PII redacted locally. No sandbox, because the point is the un-sandboxed device. • And the most enjoyable engineering of the day was lucasartsifier (152 points), which finds softlocks in 1990s Sierra adventure games by abstract interpretation of decompiled SCI scripts, derives guards, verifies them and recompiles them back into the game. It is static analysis with a real correctness argument, aimed at the walking-dead state in King's Quest, and it is off-vertical in every direction that matters.

Verification note: star counts, licenses, watcher counts and creation dates above come from the GitHub API on 2026-08-20, not from the trending page or the scout, whose star figures continue to run one to three orders of magnitude low. OneCLI's four HN appearances were resolved through the Algolia API. No pick was independently reproduced today — the one reproducible claim on the slate, Agent Substrate's 250-actors-on-8-pods demo, requires a Kubernetes cluster with gVisor rather than yesterday's four-minute cold clone, and we did not run it. That makes today a return to unreproduced picks after exactly one edition of the opposite, and the honest place to record it is here rather than in a watch list.