Proof, probability or a person: decide which one gates each agent action.

OpenShell (Apache-2.0, Rust, 9,923 stars, 978 of them on GitHub trending today, 1,558 commits, 99 contributors, created February 24, v0.1.0 on Friday and v0.1.2 on Monday) runs each agent in its own sandbox and enforces a declared policy at the kernel: which files it can touch, which system calls it can make, and which hosts every outbound connection may reach. Agents never hold real credentials; the gateway adds them only to requests bound for approved endpoints. curl -LsSf .../install.sh | sh installs the CLI and a local gateway on Linux, Apple-silicon macOS or WSL 2 (experimental), and openshell sandbox create gives you a minimal Ubuntu image with no agent in it. The first-agent tutorial runs OpenCode against a free OpenRouter model.

The proof part is the policy prover. When a request is blocked, the optional policy advisor lets the agent propose a narrow network rule (host, port, binary and, for HTTP, method and path). Before the proposal reaches you, the prover compares what the sandbox could reach with and without the rule and flags added risk, such as cloud metadata addresses or a new destination for a credential. A separate boundary check, openshell-prover, verifies that a policy grants nothing beyond a maximum policy you write, so a parent agent can check the policy it hands a subagent. The docs are careful about the limits. The guarantees cover only the policy features the prover models. The two checks answer different questions, so passing one does not imply passing the other. And proposals can only add network rules, not change filesystem or process settings.

Reach for it if your agents need real credentials and real network access and you currently grant both by editing an allowlist when something breaks; it replaces that loop with proposals you approve and a solver's read on each. Delete the --dangerously-skip-permissions alias. Tradeoffs: v0.1 is a week old and the project ships stable releases weekly, with Experimental interfaces free to change in a patch; anonymous telemetry is on by default (OPENSHELL_TELEMETRY_ENABLED=false turns it off); the quick install is curl | sh; and Sentry, the hardware half of Nvidia's announcement, runs on BlueField-4 DPUs, so outside Nvidia's own racks you get the software half.

OpenAPPA (MIT, Rust, 37 stars, 676 commits, 11 contributors, created August 18, v0.28.0 on Monday, labeled "preview and RFC") sits between an agent and its tools and answers one question before every call: is this data allowed to go to this destination? Instead of allowed and blocked tools, a TOML policy describes data sources, audiences, trust levels and authorities. Everything the agent reads adjusts a label on the session: reading a private repo narrows who may see the output, and reading an unvetted web page lowers trust. Every outbound call is checked against that label before dispatch. The engine is a pure function of the event log with no IO, so it embeds in-process from Rust or Python or runs as a sidecar. "Batteries" run a program as part of a decision; the authors' example checks through the GitHub API whether a repo is public before its contents can go to Slack.

The pitch is aimed at two neighbors. Blocklists fail because blocking curl just teaches the model to push to a git remote, and a second model judging each call is probabilistic and can be prompt-injected itself. OpenAPPA's answer when a call is blocked is a remedy plan so the agent can finish another way, which is how the authors claim utility stays high. Their own benchmark reports 88–90% task completion with 0% attack success across three models, against about 40% completion and around 30% attack success for Microsoft's FIDES, plus 0 of 720 attacks on the UK AISI's AgentThreatBench. All of those numbers are the authors' own, and at least three people in the Show HN thread (23 points) are authors or work at Archestra, the company behind it. The most useful outside comment named what's new: it treats agent security as an information-flow problem instead of classifying prompts.

Reach for it if you run agents over medical, financial or private-repo data and your current guardrail is either an LLM judge or a regex list; it replaces both with a label you can audit. Delete the regex that blocks rm -rf /. Tradeoffs: the README says config and wire formats may break; the Claude Code plugin is "a playground for the model, not the product," and fresh policies fall back on a fail-closed Claude annotator for MCP tools they do not name yet, so there is a model in the loop until you write those contracts; claude --resume starts an unprotected session, so you have to use clappa --resume; and three releases shipped Monday.

Jeff (MIT code, Apache-2.0 weights, Python, 827 stars, 7 commits, one contributor, created Monday) is a set of Qwen3.5 0.8B and 2B and Gemma 4 E2B fine-tunes that accept the same request format as TypeSafe's Jev, without being affiliated with it. You describe a situation and list options in plain words, and one forward pass returns a probability for each option, with no generated text to parse. Question types are choice (up to 26 options), noul (yes/no) and score. uv run hf download a checkpoint and uv run jeff-serve starts a local server, with an MLX backend for Macs. The author reports 22 ms per decision on an RTX PRO 6000 and 28 ms on an M4 Max, and everything was trained at home: one workstation GPU, synthetic data written by an open model on two DGX Sparks, no closed-model output in the training set.

The README says where the probability stops being useful. On classification and grounding (Financial PhraseBank 96%, RAGTruth 86–89%) Jeff matches or beats Jev's published figures, which were measured on a different sample of the same benchmarks. On reasoning (BBH 64–68% against Jev's 94%, about 50% on JevBench's hard tier against 73%) it is well behind. "Reason in code, decide with Jeff." The HN thread (518 points, 196 comments) supplied the counterweight. One commenter got 70% against Jev's 94% on their own task, and another found the 0.8B useless on job-ad classification with the 2B still missing job type. A third posted a gist where plain embeddings plus logistic regression reached 93% on Banking77. The author's answer is a fine-tune: half an hour on one GPU took a voice-navigation task from 31.7% to 95.8% held-out.

Reach for it if you have routing or triage decisions currently paying for a frontier-model call each, and you have labeled examples to check it against; it replaces the call with a local forward pass and a threshold you own. Delete the prompt that asks a large model to "respond with only the category name." Tradeoffs: zero-shot accuracy on your task may be far below the panel, so measure first; options past position 26 are effectively never chosen and the server refuses them; the 2B plays the games worse than the 0.8B and the author does not know why yet; English text only; and a one-day-old repo from one author.

TalkToMe (MIT, Python and Electron, 6 stars, 38 commits, two contributors, created September 22, Show HN today) is a macOS menu-bar app with no window to start a conversation. The agent starts it. You ask a session to "call me with TalkToMe," it runs talktome call with its session ID, a ring appears on screen, and you answer. Your speech goes into the session as a message and the reply is spoken back, while the agent keeps its model, tools, files and history. Codex replies are read from the session automatically; Claude Code and other hosts run talktome listen and talktome reply, which exchange files with the app, so they work even when a sandbox blocks local network access. Speech is local by default: Whisper for recognition, the system voice or Kokoro for replies, and a small model called Smart Turn to decide when you have finished talking. ElevenLabs is optional.

This is the person gate, and it only works if the person is reachable. The server listens on 127.0.0.1:8765 behind a generated token, and an experimental remote bridge lets an agent on another server ring your laptop. The author says Codex is "tested extensively" and Claude Code "not tested heavily." The thread has 4 points and no outside testing reports yet.

Reach for it if your agents already stop and wait for you while you are away from the terminal; it replaces the unread "waiting for input" notification with a phone-style ring. Delete the habit of checking back every twenty minutes. Tradeoffs: Apple silicon and macOS 14+ only; the README tells you to download a disk image from Releases, but none has been published, so today it means building from source with Node 22, uv and the Xcode tools; the app is not notarized; it defaults to port 8765, the same port Jeff's quickstart uses, so pick another for one of them; and one week of history.

Also on the desk. A seven-node ESP32-S3 cluster runs a 0.4B BitNet model at 1.58 bits per weight, split across boards over an SPI daisy chain (109 points on HN). It is a demo rather than a tool, but it shows how far down the hardware ladder ternary weights reach.

Verification notes: star, fork, commit, contributor and release data are from the GitHub API on 2026-09-29. Commit totals use the per_page=1 Link-header last-page trick, and contributor counts exclude bot accounts. OpenShell's enforcement model, install and telemetry are from its README; the prover and advisor limits are from docs.nvidia.com/openshell (Policy Prover, Policy Advisor, Support Matrix, v0.1.2). The Sentry and BlueField-4 details are from Nvidia's developer blog post and CNBC's Monday report. OpenAPPA's policy model, benchmark tables, Claude Code caveats and status are from its README and openappa.com; the benchmarks are the authors' own. Jeff's benchmarks, timings, caveats and fine-tune figure are from its README; the user reports and the embeddings baseline are from HN item 49883844. TalkToMe's call flow, speech stack, port and requirements are from its README; the testing note is the author's Show HN post (item 49887154), and the missing release is from the GitHub releases API (0 published). HN points are from the Algolia API (items 49879883, 49877515, 49883844, 49887154, 49884625). Pipeline health: today's pool held 86 rows, up from 82 on Monday, against the ~280 the compose prompt assumes. Reddit returned zero rows again, 143 days since the last nonzero day on May 9. github:trending returned 9 rows (all 5, python 1, rust 2, typescript 1, go 0).