2026-11-08 · GitHub AI Daily

Window2026-11-07 10:30 to 2026-11-08 10:35 Beijing time, corresponding to default-branch commits with `committer-date >= 2026-11-07T02:30:00Z`. This issue collects **158** entries, of which 5 are featured picks. The four categories break down as ① 46 / ② 41 / ③ 22 / ④ 49.

CoverageAI Coding / coding agents and the skill ecosystem · Medical and clinical research AI and agent skill libraries · Health management, nutrition and food AI · Model foundations and agent infrastructure

De-duplicationEvery entry was compared against the twenty issues published from 10-16 to 11-07 (`grep -ho "https://github.com/[^/]*/[^/]*"` was used to extract the **full set of 1049 historical repos**, and the comparison was done case-insensitively so that case variants could not slip through). All **158 entries this issue are first appearances, with zero repeats**; all 5 featured picks are also first-time entries. This round collected 6128 `search/repositories` candidates (92 single-word queries combined with a `pushed:>2026-11-06` date filter), which yielded 5755 non-historical candidates after de-duplication; the top 1500 by a four-line keyword score then went through per-repo commit verification, **keeping 1261 repos with real commits inside the window**, from which 158 were selected after manual curation for information density. **Any repo whose `pushed_at` looked updated but whose per-repo verification placed its commits outside the window was dropped — `pushed_at` alone is never grounds for inclusion**; entries whose only in-window commits were meaningless (pure auto-generated READMEs, translation-only commits) were dropped as well. `GeiserX/OwnGenome` appeared in the previous issue (a consumer-hardware whole-genome analysis pipeline); the related `GeiserX/OwnHealth` in this issue is a separate repository and a first-time entry, and the relationship between the two is spelled out in the body.

VerificationEvery "has movement today" entry was verified against real commit records. **Screening was done with `search/commits` in batches (20 `repo:` qualifiers per batch), and any repo missing from a batch response — or any batch whose items hit the 100-item ceiling — was re-checked one by one against the core endpoint `GET /repos/{o}/{r}/commits?since=&per_page=1`**, because a single response returns at most 100 items and silently drops repositories. **The exact commit counts quoted in this report always come from the core endpoint's `Link` header `rel="last"` page number** (with `per_page=1` the page number is the total); `search/commits`' `total_count` was measured to disagree — this issue `Rul1an/assay` reported 1 in the batch query while the core endpoint showed 16 — **so search results are never trusted for commit counts**. **Stars and licenses are a live snapshot from the GitHub API** (as of 10:35 Beijing time on 2026-11-08). **Licenses are recorded from the actual LICENSE file text read via the core endpoint `GET /repos/{o}/{r}/license`; the API's `spdx_id` is only a hint** — this round `umutkeltek/healthsave-observatory` reported `NOASSERTION` while the file text is **Elastic-2.0** (commercial use restricted); `alphanumericslab/medorama` is **PolyForm** (not for commercial use); `marko1olo/dental-crm` and `moxno/privacyscrubber-mcp` carry **all-rights-reserved / custom commercial terms**; `databricks/databricks-agent-skills` uses a **custom Databricks license**. Nine further entries were individually confirmed by the core endpoint to have **no LICENSE file at the repository root** (`chenhg5/cc-connect`, `jamesruga/afya-triage`, `shay-dan/scientific-rag`, `genmnz/jean-by-melad-labs`, `Jayant-Chaudhary/medBrief`, `juanjosejimenezcatalan-boop/hl7-radiology-workflow-lab`, `sachin-11/dawai-saathi`, `Hafsa-Anwar65/Rx-Read`, `mustafaeeeuu-cell/NutriVerse-Coach`); these are marked "undeclared" in the tables — **"undeclared" does not mean there are no terms, but it must be checked before adoption**.

1. Today's picks (5)

1. nicolaguglielmi/lights-out: turning "let AI write the code" into a lights-out factory — eight numeric gates judge every PR, every ticket gets its own perimeter, a bad canary rolls itself back, and the last step always needs one human GO

URL: https://github.com/nicolaguglielmi/lights-out ｜ ★6 ｜ Apache-2.0 ｜ Shell ｜ The full guardrail system for AI coding agents: a spec gate, eight numeric gates, per-ticket perimeters, a canary that rolls itself back, and a single human GO

What happened

61 commits inside the window (11-07 02:30Z to 11-08 00:50Z), whose thread is turning "trust the agent" into "have numeric gates judge every layer". The README opens bluntly: "The safety system for a dark factory of AI coding agents. A lights-out factory runs in the dark because its safety systems are trusted."

⭐ Eight gates, each printing one line of GO or NO-GO with the reason: risk, secrets, weakened tests, dependencies, static analysis, tests, mutation, and test-proof. The test-proof gate is the most interesting definition: "a test the change adds must fail on the base" — in other words it does not check whether the tests pass, but whether the test has any power at all. The README also states that every threshold says where it comes from, and that "A PR is judged by its base's policy, never its own" — a PR is judged by the baseline branch's policy, never by the policy it introduces itself.
⭐ A perimeter per ticket: the diff must stay inside the files the ticket declares, checked before a PR even exists; a ticket whose files another open ticket holds waits at assignment. This turns "the agent quietly touched something else" from a habit into a structural constraint.
⭐ A canary that rolls itself back with nobody paged: each merge produces a signed image that first takes 5% of real traffic, then 25%, compared against stable on errors and p95 latency; a bad number rolls it back on its own. The README puts it precisely: "A bad number rolls it back with nobody paged."
⭐ The single human gate follows one rule: "One human gate — the step to 100% waits for a person's GO. Silence never promotes." In other words silence is not a promotion — an absent human does not push the rollout to full traffic.
⭐ Main stays green without a queue: a PR whose perimeter did not move merges without a second judgment; after merging, main is judged again, and a red main is bisected and the culprit reverted, sending its ticket back to rework.
⭐ A remarkably honest boundary statement: the README says "An anchored timeline is not a true one: the check stops invented releases and log lines, not a wrong story about real ones." It can stop fabricated release records and log lines; it cannot stop a distorted account of real ones.
⭐ The engineering details are spelled out too: the container image is 1.8 GB unpacked, and after the first pull doctor, init and gates took 65 s and 72 s; a full demo run takes about 7 minutes (434 s measured on a MacBook with podman), with 3-6 minutes for the first toolchain build; the image is unsigned and its tags are mutable, so pinning requires a digest (LIGHTS_OUT_IMAGE=...@sha256:d647d055...); and the wrapper mounts your repository read-only and never hands the image your engine's socket.

Why it matters

⭐ This is very nearly the complete answer to something I have been looking for over the past two years. My 4P precision nutrition platform is Flask + SQLite, where the AI recomputes an entire intervention plan and writes it to the database; the GLP-1 nutrition companion is a Python recipe engine that directly emits a morning and evening formula; GRPM reports are structured conclusions produced by an LLM. All three places currently lack a runtime layer that decides "on what grounds may this conclusion be stored." lights-out's eight gates are exactly that layer in executable form. The test-proof gate is the one I intend to copy directly: every risk dimension in my intervention report should ship with a test that must fail against the old data, otherwise that risk dimension is decoration.
⭐ "A PR is judged by the base's policy, never its own" hits precisely the bug type that hurts me most. In my intervention report pipeline, if a change happens to loosen one validation, the next report is judged by the loosened rule — and once the rule has been broken, every later output is laundered, with nobody noticing. Putting the validation rules into a versioned policy file separate from the generation logic, and requiring rule changes to go through their own review, should become a hard rule in the 4P platform.
⭐ "Silence never promotes" is the line I most want to copy into content production. In my current workflow, if I am away for three days without looking, AI-generated and AI-published content is by default already published. lights-out's approach is: without a human GO, it stops at 25% — no rollback, no promotion. That maps exactly onto the hard red line I keep for myself — never claim medical credentials — which in engineering terms means "without human confirmation, nothing goes public."
⭐ The canary compares "error rate + p95 latency", and that metric choice transfers directly. When I ship a new version of my platform, what should be watched is "lab-report OCR extraction failure rate" and "report generation p95 latency", not "test pass rate" — the latter barely moves once there is an AI fallback.
⭐ The sentence about anchored timelines not being true timelines should be copied into the footnote of every report I publish. My most common error in evidence-based writing is not fabrication but stretching one real but isolated piece of evidence into a stronger claim than it supports. A tool can block fake citations; it cannot block over-extension — those are two different things that must be declared separately, which is the same principle as the "association must not be upgraded to causation" rule I recorded in an earlier issue.
Apache-2.0, readable, modifiable and commercially usable, and it runs on your own machine (podman or docker; no account, no API key, no cloud). MIT and Apache-2.0 account for 130 of this issue's 158 entries; AGPL-3.0 accounts for 6 (OwnHealth, get-based, OpenMontage, dental-crm is all-rights-reserved, SuperMedicalDoctor and others) and can be read but not copied — that row has to be read before you choose a base.

2. Rul1an/assay: an offline-recomputable evidence profile for privileged tool calls — it states plainly that "a tool returning success is the provider's assertion, never proof", and grades claims into four tiers

URL: https://github.com/Rul1an/assay ｜ ★16 ｜ MIT ｜ Rust ｜ A policy-enforcement and evidence layer at the MCP tool-call boundary: Enforce / Prove / Stay honest, with claims graded verified, self-reported, inferred or absent

What happened

16 commits inside the window, whose thread is the v6.22.3 release (11-07 08:22Z), described in one line: "Deterministic policy enforcement, canonical evidence, and reviewable trust artifacts for AI agent systems."

⭐ Its reason for existing is stated plainly: "Agents got real tool access through MCP — and tool poisoning, rug pulls, and confused-deputy OAuth came with it." So it sits at the tool-call boundary and does three things, in a fixed order.
⭐ Enforce: in enforcement mode, the proxy decides tools/call requests before forwarding them, and gives the precise reason for every allow or deny. On supported Linux hosts there are separate controls: cgroup eBPF IPv4/TCP connect filtering and Landlock TCP-connect port allowlisting; assay sandbox --enforce refuses to start when the backend is unavailable or the filesystem policy conflicts, unless --allow-audit-fallback is explicit; --enforce-net requires --enforce, and even with audit fallback enabled, active Landlock network enforcement still rejects policies it cannot express as TCP port allowlists.
⭐ Prove: configured producers can record decisions and bounded observations for export into offline-verifiable, tamper-evident evidence bundles (tar.gz) that CI can consume directly; assay evidence prepare-incident-package turns a decision log into an incident package that verify-incident-package accepts, and the verifier derives the surface grade itself.
⭐ Stay honest is the part most worth copying. Trust Basis classifies supported claims as verified, self_reported, inferred or absent, and its gates check whether the declared claim boundaries have been crossed. The README's own wording: "A tool returning 'success' is the provider's assertion, never proof." And: "Assay ships no single safety score; read each artifact's source, coverage and non-claims before relying on it." It refuses to output one overall score and requires you to read the artifact's source, coverage and non-claims first.
⭐ It also states, in a dedicated list, what it can and cannot prove: the evidence package is not a count of all calls, not proof of capture completeness, not proof of what the server did, and an allow is not proof that a human accepted.
⭐ Installation and supply chain are hardened too: the one-liner installer verifies the selected archive against its published SHA-256 sidecar before extraction; setting ASSAY_REQUIRE_PROVENANCE=1 additionally requires GitHub artifact provenance, while the default reports provenance_not_requested and a strict success reports provenance_verified. The README adds the crucial caveat: a checksum proves byte equality with the published sidecar, not producer identity; provenance identifies source and build, not runtime safety or semantic correctness.
⭐ The release cadence is dense: v6.22.3 (11-07), v6.22.2 (11-06), v6.22.1 (11-05) — one release per day for three consecutive days, evidence of sustained engineering rather than a one-off demo.

Why it matters

⭐ "A tool returning success is the provider's assertion, never proof" should become the literal precondition for writing to my 4P platform. My lab-report OCR pipeline currently decides "extract succeeded, write it; extraction failed, skip it" — which is exactly equivalent to treating "the extractor says it read a value" as "that item is really on the lab report." The correct shape, per assay, is that every extraction must carry a four-tier claim (verified = read from a checkable position on the page; self_reported = the OCR engine's own assertion; inferred = derived from context; absent = never obtained), and absent is not normal. That is structurally identical to the "a check that was not performed is recorded as unknown, never as normal" rule I recorded in an earlier issue — but assay turns it into machine-readable schema.
⭐ "Refusing to output a single safety score" is the design judgment I most want to take away from this issue. In an earlier issue I recorded Calibrate replacing a single score with a 2x2 dependency matrix; this issue's assay achieves the same thing with "four claim tiers plus no overall score." Applied to my GRPM reports: a risk conclusion for an SNP must never be "risk score 72"; it must be a chain that can be audited piece by piece — "this site is variant XX (verified, source: Sanger report, page 3, column 2) → judged as XXX under GRPM rules (self_reported) → this site was not tested in this individual (absent)". Readers may see a score, but the copy in the database must be tiered.
⭐ The "non-claims" concept can become a fixed chapter in my content production. What I most often lack in evidence-based articles is an explicit statement of what the evidence cannot say — assay writes that into the artifact itself. Applied to GRPM's SNP interpretation: "the evidence linking this site to folate metabolism is moderate strength; it cannot be used to predict your actual dose response to folate supplementation" — one sentence kills most over-extension.
⭐ Its implementation of "a third party can recompute the evidence offline" is the same thread I recorded with aureproof, but this time the verifier itself also supplies the coverage grade — meaning "what this evidence covers and does not cover" is produced by the verifying side rather than declared by the generating side. That is the concrete form of the "GRPM reports must be independently recomputable offline" requirement I noted earlier.**
⭐ MIT, commercially usable. The cost is that it is implemented in Rust, so integration takes some engineering. But it exposes a standard CLI and a CI Action (Rul1an/assay-action@v3), so in my case the far more likely usage is "run the verification once in CI" rather than embedding the proxy into the runtime — a much lower barrier.

3. rootstudioyaml/sprag: turning "which model should do this job" into a recomputable rule — the same 12 requests cost $1.83 instead of $6.68, and every rule comes with a replay case you can open

URL: https://github.com/rootstudioyaml/sprag ｜ ★7 ｜ Apache-2.0 ｜ JavaScript ｜ A model-delegation layer for Claude Code and Codex: each task goes to the model and effort that fits it, every rule backed by replays you can open

What happened

66 commits inside the window, whose thread is a run of releases: v3.105.0 (11-07 15:40Z) → v3.106.0 (11-07 23:51Z) → v3.106.1 (11-08 00:04Z) — three versions in one day, the v3.106.1 commit title being the version number itself, followed by a fix: "fix(brief): a 1M-by-default model borrows another session's reported window" (a model defaulting to a 1M context borrows another session's reported window).

⭐ It solves a real hard limit: Claude Code and Codex cannot switch models per prompt, so sprag takes the only route that works — rules in the main session hand work to sub-agents pinned to a model and an effort. Lookups, status checks, builds and test runs drop to Haiku; while work a cheaper run would silently miss actually goes up: a lookup spread over many files runs on Sonnet at high effort and open web research runs at xhigh — "because replays showed the default medium effort missing both."
⭐ The rules are derived from your own session logs, each one requires your approval, and every delegated run writes its price difference into a ledger.
⭐ The hardest-won rule of all: "Every rule is checked against replays you can open." sprag proof re-runs real delegations under several model and effort settings and grades them blind; the same table ships with the npm package and grows as new cases are analysed. That is what turns "model routing" from guesswork into a recomputable experiment.
⭐ The numbers it reports can be checked: the same 12 requests in two terminals, $6.68 → $1.83 (−72.6%), priced at public list rates; a second chart gives a 14-day figure (2026-10-17 to 10-31, one dev machine, 83 delegations) of $216.38 saved, with no delegation counted as a loss.
⭐ Delegation thresholds tighten as quota tightens: below 70% of the 5-hour / 7-day / LiteLLM limit delegation proceeds as usual, from 70% it delegates when in doubt, and from 90% it also delegates multi-step work; design, security and deploys always stay on the main model.
⭐ It incidentally solves a context-cost problem: documents reach the context as compact Markdown — a 540k-token deck becomes 23k tokens — and the status line shows what each session spent and saved, with a warning chip when cache, context or a rate limit needs attention.

Why it matters

⭐ This thread picks up directly from skill-diet last issue, and supplies the half that was missing. Last issue skill-diet solved "how do you slim down one skill"; this issue sprag solves "how do you run the same task correctly on a cheaper model." Together they form a complete cost ledger: tokens are a cost, model choice is a cost, and "did it come out right?" is the precondition for saving anything. sprag states it exactly: "a lookup spread over many files runs on Sonnet at high effort … because replays showed the default medium effort missing both" — without replay verification, cost reduction is a gamble.
⭐ "Every rule has an openable replay case, graded blind" should become the second stage of my expert-package QA flow. My current expert-package iteration is "edit the description, then manually run it once and see" — but my own judgment is biased, and I only ever test on the strongest model. sprag's approach turns "does this rule hold?" into something a third party can re-run. Applied to my public-account articles and GRPM reports: every class of conclusion should carry a replay case describing the conditions under which it fails.
⭐ "Design, security and deploys always stay on the main model" is a hard-coded exception that maps exactly onto what my 4P platform needs. For me it should be extended into: diagnosis and risk judgment stay on the main model, while formatting, extraction, translation and deduplication may be downgraded. sprag's value is not the $4.85 saved, but that it writes "which jobs must not be downgraded" as a non-negotiable rule.
⭐ The 1M-context bug is worth recording on its own: a model will borrow another session's reported window. This is classic state bleed — the same family of bug as the yantrikdb note I recorded on 11-02, where opening the same SQLite file from a second library inside one process silently corrupts storage. My platform is Flask + SQLite with multiple sessions; if I keep runtime state such as context or quota in process-level globals, concurrent users will cross-contaminate. This is a prompt to go audit my globals.
⭐ Apache-2.0, commercially usable, and the npm package is sprag-cli (npm i -g sprag-cli) with no per-project configuration. But it is a delegation layer specific to Claude Code and Codex, so if I want model routing for my content pipeline I should copy its method — rules → replays → blind grading → ledger — rather than adopt the package directly.

4. GeiserX/OwnHealth: making "your own health record" queryable by an agent — each token sees only what it was granted, every answer carries a source, and "not assessed" and "withheld" are two separate fields

URL: https://github.com/GeiserX/OwnHealth ｜ ★2 ｜ AGPL-3.0-or-later ｜ Python ｜ A self-hosted health data layer: labs, records, wearables and genome in one store, MCP scoped per person and per token, with evidence, limitations, not-assessed and withheld fields in every response

What happened

9 commits inside the window, whose thread is the 0.1.0 release (the first version you can actually run) plus the security design document. The most telling commit title is: "docs: stop genome lookups and page reads from revealing withheld findings, and match re-derivation to the shipped code".

⭐ It writes "no diagnosis" into the product positioning rather than into a disclaimer. The README's "Intended purpose" section says outright: "It is information, not diagnosis. It does not tell anyone what to take or stop; pharmacogenomic results quote the published guideline and link it." The last line of every response envelope is fixed at "notice": "Information from your records, not a diagnosis."
⭐ There is no model and no chat agent inside it: "There is no chat agent and no AI model inside OwnHealth. The agent is yours, and it sees only what its token allows."
⭐ Permission granularity is a three-way intersection of token, person and category: each token carries its own language, unit preference (as_reported / si / conventional) and identity mode (full / pseudonymous / minimal); scopes split into read:summary, read:labs, read:vitals, read:wearables, read:records, read:genome, read:genome_raw, read:sensitive, read:documents_text and write:propose. The rule is "what the token allows ∩ what you granted on that profile − whatever that person locked", and "A token without read:genome sees no genome tool and no genome fact anywhere." It sees neither the tool nor any genomic fact, not even indirectly.
⭐ The response envelope splits "I don't know" into three independent fields: besides evidence and limitations, there is not_assessed (never evaluated) and withheld (deliberately not disclosed) — and the latter is structured: {"sensitive": 0, "by_scope": [], "minor_rule": 0}. "Not done" and "not shown" are two different fields, which is the cleanest design decision in this issue.
⭐ Free text is explicitly downgraded in trust: any text coming from a document, FHIR record, person or agent arrives as {"trust": "untrusted_text", "origin": "pdf_text_layer", "text": "…"} — a PDF text layer is treated as untrusted input, which is both a prompt-injection defence and a provenance marker.
⭐ Every fact carries src, resolvable back to the document, page and box it came from via get_source; a budget field reports estimated tokens and truncation; and state_hash stays the same across all tokens (so changing token does not change the content hash).
⭐ The agent gets the right to propose, not to write: the only write entry point is write:propose, and proposals land in a review queue; lab PDFs are parsed with generic table rules plus one template (a fictional LabNorte lab), and the LOINC set is a curated subset of 202 codes, so any test outside it waits in the review queue.
⭐ The security document enumerates "four lines that cross a trust boundary and carry most of the risk": imported documents into the store (any PDF, email, FHIR note or OCR output is attacker-controlled text), store into the agent (every byte an MCP tool returns enters a model context and leaves the self-hoster's network), store into backups (backups leave the machine and outlive deletions), and store into a share (SMART Health Link is the only path designed for data to reach a third party). It classifies genome data as a permanent asset that identifies relatives and cannot be rotated.
⭐ It is an explicitly non-commercial common good: "OwnHealth is a non-commercial, common-good project: no hosted version, no paid tier and ever no company behind it", and the author uses this to argue they are not a controller under GDPR and that OwnHealth is not placed on the market "in the course of a commercial activity" under the EU MDR — the document itself marks that legal point unverified. The license is AGPL-3.0-or-later.

Why it matters

⭐ This is the piece that fits my business best — and it is very nearly written for the "never claim medical credentials" problem. My red line is explicit: no "physician", no "licensed practitioner", only health and nutrition researcher. OwnHealth's approach is to turn that into a machine-readable field attached to every response (notice) rather than a disclaimer parked at the bottom of a page. Applied to the 4P platform: every intervention report JSON should carry a fixed notice field, and every downstream export (Excel, articles, PDF) must include it. That is orders of magnitude more reliable than "remember to add a disclaimer to the copy."
⭐ Splitting "withheld" from "not assessed" is the direct answer to my worst current bug. My OCR pipeline's failure mode is "skip it when extraction fails," so a 24-dimension risk report may actually hold only 18 dimensions — and the report does not know it. OwnHealth's approach: not_assessed explicitly lists what was never evaluated, withheld explicitly lists what was withheld for permission or rule reasons, and limitations explicitly lists the boundary of the conclusion. With all three fields, the report can finally say "I covered 24 dimensions" — a statement that is currently false.
⭐ The guard against aggregation-inference attacks lands squarely on a blind spot in my GRPM work. The newest commit this issue is exactly that: stopping genome lookups and page reads from revealing withheld findings. In my GRPM reports, when an SNP is marked "not applicable to this individual," if another endpoint can still derive it from trend data, then the field is merely hidden, not actually protected. This should become a hard audit item on my platform: for every conclusion marked unusable, confirm it cannot be reconstructed by combining other endpoints.
⭐ The "token x person x category" authorization model addresses the most realistic problem for a one-person company: when I build a bespoke plan for a client, that client's data must not be carried off by the model. OwnHealth's design is that each token carries only its own authorized slice, not even an indirect clue, while state_hash stays consistent across tokens — meaning "same content" and "different visibility" can hold simultaneously. That is exactly the capability I need for white-label nutrition plans for B2B clients: one engine, different tokens, different visible scopes.
⭐ "Always mark free text as untrusted_text" is a directly copyable rule for my lab-report OCR pipeline. My OCR output mixes structured fields (value, unit, analyte name) with free text (reference-range notes, method descriptions, handwritten clinician annotations). Today both carry the same level of trust in my pipeline — they should be split: structured fields may be marked verified, free text is always untrusted.
⭐ But the licensing wall has to be stated plainly: AGPL-3.0-or-later, in the "read but do not copy" bucket. It is deliberately a non-commercial common good with no hosted or paid version ever — the opposite direction from the commercial product I want to build. So the correct use is: copy its design (response envelope fields, scope-intersection model, notice mechanism, trust marking), not its code. This is precisely why I insist on reading the license at selection time — of this issue's 158 entries, 130 are MIT or Apache-2.0, 6 are AGPL-3.0, and there are several each of Elastic-2.0, PolyForm and all-rights-reserved.

5. bryan-basg/samd-starter-kit: making medical-device compliance "already there" with a team of AI agents — IEC 62304 and ISO 14971 broken into a ruleset, 12 specialist agents, 40+ DHF templates and 16 CI workflows

URL: https://github.com/bryan-basg/samd-starter-kit ｜ ★5 ｜ MIT ｜ Python ｜ Scaffolding for building software as a medical device (SaMD) with an AI agent team: a compliance ruleset, 12 layer-specialist agents, a design history file (DHF) and working CI

What happened

20 commits inside the window, whose thread is moving compliance from "a separate sprint" to "default in the flow", plus a batch of security and process tightening.

⭐ Its core is one "Rule 0": "every technical decision is subordinate to SaMD compliance." In practice this becomes four habits the agent team enforces by itself: ① mandatory traceability (§5.1/§5.7 — any clinical, schema or security change must update the DHF in the same PR); ② demonstrable verification (§5.7 — nothing is declared green without running the linked tests and reporting the numbers); ③ explicit fail-safe (ISO 14971 — when something fails it degrades safely and predictably, never silently); ④ impact analysis before fixing (§5.6 — a bug is fixed only after reviewing all consumers of the symbol, not just the file where it was reported).
⭐ The ruleset itself is layered, and that is its cleverest part: five path-scoped rules (backend, clinical UX, testing, CI, docs) load only when that layer is touched, plus two cross-cutting ones (hard execution rules and commands); and what only the main session needs (owner preferences, orchestration, parallel sessions) is kept separately in an output style.
⭐ 12 layer-specialist agents: backend, frontend, clinical-algorithms (validated scales and questionnaires, scoring and severity bands, crisis network, clinical PHI, idempotency), db-architect, cloud-ops, qa-mutation (mutation testing waves, mutant killers, scoped configs, a score ratchet), e2e-integration, security-samd, samd-audit-trace (audits a changeset against IEC 62304 §5.1/§5.7 + ISO 14971 and reports gaps), docs-dhf, i18n-translations (including auditing for "copied but untranslated" text and a pre-certification clinical glossary) and mobile-native.
⭐ Commands and skills each have their place: samd-trace requires impact analysis (§5.6) before anything is declared "fixed", and samd-review is a diff-review workflow across risk dimensions with adversarial verification.
⭐ The hard rules are written down rather than left to agent discretion: nobody commits or pushes without the owner's explicit OK; the mutation engine never runs in parallel with agents writing tests; clinical and security findings must undergo adversarial verification before anyone acts; identity comes only from the token (JWT-only), never a user_id from the client; and errors never expose tracebacks to the user — empathetic wording plus the correct HTTP status code.
⭐ 16 CI workflows, 11 of them inheritable gates: CI, Trivy + Semgrep security scanning, Stryker mutation testing, schemathesis API fuzzing, OWASP ZAP DAST, SBOM, a Postgres tier test, OpenAPI contract-drift checking, project-state audit, stale-PR checks and a deploy template; plus 5 workflows maintaining the kit itself (including a placeholder guard that stops template placeholders from being missed, and a red-main alert).
⭐ It ships not just templates but the scars: startup discipline (compliance before code, avoid over-building before validation, empathetic UX as a clinical decision), production lessons (connection-pool exhaustion masquerading as auth failures, the "green" migration that lies, environment-variable footguns, offline-first discipline, mutation tests as contracts) and the multi-agent engineering method.
⭐ This issue's commits also carry real security remediation, for example "fix(auditoria): JWT con exp obligatorio, guard de secretos cortos, deploy y gates que no podian fallar" (mandatory JWT expiry, a short-secret guard, and deploys and gates that must not be able to fail) and docs(scmp): registrar los 6 checks obligatorios de main (v1.10) (registering the six checks main must pass). MIT licensed.

Why it matters

⭐ "Path-scoped rules load only when that layer is touched" is a cost optimization I can apply directly to my expert packages. I produce expert packages in bulk with the expert-manager skill, and each one is a SKILL.md that must be read in full on every call — while in most expert packages well over half the content (implementation details of one particular layer, the usage of one particular backend framework) is needed by only a minority of tasks. samd-starter-kit's layered rule loading is the "five-layer placement" idea from skill-diet, implemented at file granularity. This should go into my expert-package spec: anything that can be loaded on demand must not be merged into one large file.
⭐ "Analyze impact before fixing" (§5.6) treats an old disease of my GRPM and 4P platforms. When I change an SNP decision rule, I normally verify only the few lines that reference it directly — while the GRPM report output, the Excel export and the public-account article each carry their own copy of code referencing the same fields, and changing one usually leaves the other two unaware. samd's answer is to make impact analysis a skill that must run first, not something the author remembers. This is the same problem addressed by a different method from the "write the answer contract once and assemble both prompts from it" note I recorded last issue: one is structural alignment, the other is process enforcement.
⭐ "Mutation tests as contracts" and the score ratchet are ready-made methods for my supplement formula library. When I change one threshold in my formula logic (say a contraindication rule), no regression test currently tells me that the change altered the behaviour of seven other rules. The Stryker-style approach is to deliberately break the code and see whether your tests catch it — if the tests do not catch it, that rule is effectively untested. This is the same idea as lights-out's test-proof gate (a newly added test must fail on the base), implemented two different ways.
⭐ "Identity comes only from the token, never a user_id from the client" is a rule I must copy. My 4P platform is Flask + SQLite with multiple users; if any endpoint reads user_id from the request body to decide whose lab data to query, that is a ready-made unauthorized-read path. The cost is close to zero — just make "user_id may only be derived from the session or token" a non-bypassable rule and add one test for it.
⭐ Turning "compliance" from documentation into CI gates is a methodology for the vendor-qualification and project-compliance work I am currently doing. My previous approach was to hand a compliance document to the other side; this approach makes each requirement a CI check that can go red — a document can be skipped, a check cannot. Applied to my situation: every security promise my 4P platform and AI assistant make should have a test that can go red, not a paragraph that asserts it.
⭐ MIT licensed and commercially usable, and it says outright that "This repository is not an application. It is the scaffolding and methodology" — it exists to be forked and adapted.

2. Category roundup

① AI Coding / Coding agents and the skill ecosystem

Project	Stars	License	One-liner
OpenMontageInc/OpenMontage	78,335	AGPL-3.0	Open-source agentic video production system: 12 pipelines, 100+ tools, 700+ agent skills and production knowledge
router-for-me/CLIProxyAPI	57,904	MIT	Wraps Antigravity, ChatGPT Codex, Claude Code, Grok Build and more behind OpenAI / Gemini compatible APIs
QwenLM/qwen-code	29,078	Apache-2.0	Alibaba Tongyi's open-source terminal AI coding agent
lidge-jun/opencodex	18,288	MIT	Universal provider proxy for OpenAI Codex and Claude Code: bring any LLM along
chenhg5/cc-connect	16,276	Undeclared	Bridges local coding agents to IM platforms such as Feishu and DingTalk
mvschwarz/openrig	8,729	Apache-2.0	Build your own network of agents from Claude Code, Codex and Pi: persistent teams, roles and shared context
Gaurav-Gosain/tuios	6,435	MIT	A terminal window manager that knows what your agents are doing: tiling panes, sessions that survive restarts, one inbox per agent
FlorianBruniaux/claude-code-ultimate-guide	6,382	CC-BY-SA-4.0	The most complete Claude Code guide: agentic workflows, hooks, skills, MCP and production-ready templates
awslabs/aidlc-workflows	5,932	MIT-0	AWS adaptive workflow steering rules for AI-DLC, loadable by AI coding agents
elementalsouls/Claude-BugHunter	5,486	MIT	Claude Code bug-hunting skill bundle: 82 skills, 15 slash commands, 681 disclosed-report patterns
agent-of-empires/agent-of-empires	3,743	MIT	Manage several Claude Code / OpenCode agents from a TUI or the web, reachable from a phone
SeemSeam/claude_codex_bridge	3,615	AGPL-3.0	Visible multi-agent CLI workspace mixing Codex, Claude, Gemini, Kimi, Qwen, Cursor and more
happier-dev/happier	2,168	MIT	Web, desktop and mobile client and orchestrator for Codex, Claude Code, OpenCode, Pi, Cursor, Grok and more
ReScienceLab/opc-skills	1,893	Apache-2.0	Agent skill packs for solopreneurs: the path from idea to delivery broken into installable skills
fujibee/agmsg	1,580	MIT	Cross-vendor messaging between CLI coding agents: let Claude Code, Codex, Gemini and Copilot talk in one team
awslabs/cli-agent-orchestrator	1,525	Apache-2.0	Orchestrates AI CLIs such as Claude Code, Kiro and Codex in isolated tmux sessions
first-fluke/oh-my-agent	1,373	MIT	Agent skills and specialist teams for Claude Code, Codex, Cursor and other coding agents: load one skill or a whole domain
917Dhj/DeepPaperNote	1,313	MIT	Agent skill that deep-reads a single paper and produces Obsidian-style research notes
asheshgoplani/agent-deck	1,226	MIT	Terminal session manager for AI coding agents: one TUI for Claude, Gemini, OpenCode, Codex and more
ConardLi/easy-agent	1,024	MIT	Production-ready open-source terminal coding agent: layered readable code, permission rules, OS sandboxing, MCP
DemonDamon/AgenticX	1,011	Apache-2.0	Unified production-ready multi-agent platform: Python SDK + CLI (agx) + Studio server + Machi desktop
guanyang/open-agent-hub	988	MIT	Lightweight zero-dependency CLI to manage and activate capabilities in Claude Code, Cursor, Trae and other AI assistants
EL4CTEO/blender-skills	761	MIT	Professional Blender 5.2 workflows packaged as Agent Skills for Claude Code / Codex / Gemini CLI
opensec-git/Pi-Bolt	753	MIT	Pi compiled ahead of time into one native executable: 10x faster start, 7x less CPU, 4.5x less memory
vincentkoc/tokenjuice	537	MIT	Lean output compaction for terminal-heavy agent workflows, usable as a native CLI or an extension
managedcode/dotnet-skills	509	MIT	One of the largest .NET-focused skill collections for AI assistants, with a catalog, CLI and orchestration agents
agent-sh/agnix	472	Apache-2.0	The missing linter and LSP for AI coding assistants: validates CLAUDE.md, AGENTS.md, SKILL.md, hooks and MCP config
Community-Access/accessibility-agents	438	MIT	WCAG 2.2 AA accessibility review: Agent Skills, an edit gate and accessibility scanners
dsifry/metaswarm	426	MIT	Self-improving multi-agent orchestration framework: 18 agents and 13 skills across Claude Code, Gemini CLI and Codex CLI
databricks/databricks-agent-skills	387	Custom (Databricks)	Official Databricks AI tooling skills and plugins for Claude Code, Cursor, Codex and Copilot
Mng-dev-ai/agentrove	337	Apache-2.0	Self-hosted AI coding workspace orchestrating Claude Code, Codex, Copilot, Cursor, Grok and OpenCode
mll-lab-nu/embodied-first-exam	238	MIT	The first exam for code agents in the physical world: frozen robot tasks, each answered with a program and verified
ThinkFlowLab/agentdescent	203	MIT	Gradient descent where the parameters are agents: a parallel, asynchronous framework for self-evolving skills, prompts and harnesses
godot-fun/gai	202	MIT	A lightweight AI agent and skill workflow framework built with Godot
prime-radiant-inc/evener	191	MIT	A coding agent: give it a prompt and it reads, writes, runs commands and searches code in a loop until the work is done
magnus919/agent-skills	170	MIT	Curated collection of AI agent skills for Hermes and other agent frameworks
mauhpr/agentlint	134	MIT	Local guardrails for AI coding agents: checks proposed file changes and shell commands, blocks risky patterns, returns actionable feedback
moonlight-lupin/agent-skills	120	MIT	Skills and plugins for Hermes Agent spanning research, creative, productivity and devops, each self-contained and testable
KalarisLabs/research-agent-skills	109	MIT	Turn any AI agent into a research co-scientist: 280+ open-source skills for literature reviews, hypotheses and experiment design
supercli-site/scorecard	73	MIT	Project maturity auditor: checks GitHub repos, npm packages and websites, outputs evidence and a remediation list
majiayu000/vibeguard	43	MIT	Rust CLI with scoped review rules, native Bash and Git hooks, and install diagnostics for Claude Code and Codex
existential-birds/daydream	22	Apache-2.0	Agentic code-review CLI that records every review / fix / test trajectory, building a corpus for fine-tuning open-weight models
benchflow-ai/agents	11	Apache-2.0	Minimal coding agents, easy to play with (opencode TUI) and easy to benchmark (ACP on BenchFlow)
rootstudioyaml/sprag	7	Apache-2.0	Model-delegation layer for Claude Code and Codex: lookups drop to Haiku, hard work rises to Sonnet high, every rule backed by openable replays
nicolaguglielmi/lights-out	6	Apache-2.0	The safety system for a dark factory of AI coding agents: eight numeric gates, per-ticket perimeters, a 5% to 25% canary that rolls itself back, one human GO
crocodile-labs/openmoat	4	MIT	Checks every tool call before it runs, so AI coding agents cannot leak secrets or run what they should not

② Medical and clinical research AI, agent skill libraries

Project	Stars	License	One-liner
poco-ai/Agentero	1,880	MIT	Unified research workspace for humans and agents: PDF Q&A with citations, a vault and writing, closing the human-machine context gap after Zotero
judegomila/OnCo	244	MIT	A public cited knowledge graph of oncology: every fact carries a citation and a plain-English TL;DR, served as a site, JSON API, MCP server and CLI
samply/blaze	231	Apache-2.0	A FHIR server with a built-in fast CQL evaluation engine
evelyyyyynnnnn/2.0-Healthcare-Ai-Systems	225	Apache-2.0	ML and decision-intelligence models for healthcare safety: clinical risk prediction and medical imaging analysis
maju116/rplatypus	136	Non-standard terms	Deep learning for medical images in R: semantic and instance segmentation, object detection, 2D and 3D, DICOM and NIfTI
rvandewater/YAIB	112	MIT	An ICU benchmark: five clinical prediction tasks standardised across MIMIC, eICU and HiRID, with a reproducibility document
openmed-labs/openmed-agent	36	Apache-2.0	Terminal-native agent for clinical workflows: prior auth, coding audit and documentation with reviewable output
product-on-purpose/thinking-framework-skills	25	Apache-2.0	Evidence-graded, agent-executable thinking-method skills: 63 frameworks reduced to their working mechanism and honestly graded
marko1olo/dental-crm	9	All rights reserved	Dental CRM and clinical AI platform: 3D FDI odontogram, DICOM HU CT viewer, ICD-10 diagnostics
OlekBliter/clarity-scribe	5	MIT	An AI copilot for psychiatrists and psychotherapists that analyses patient speech and vocal biomarkers during an appointment
bryan-basg/samd-starter-kit	5	MIT	Scaffolding to build software as a medical device with a team of AI agents: IEC 62304 + ISO 14971 compliance, 12 specialist agents, a full DHF
kik1211/agentic-medclaims-automation	3	MIT	Hospital insurance claims automation: OCR + LLM clinical structuring + ICD-10 / CPT auto-coding and workflow orchestration
moxno/privacyscrubber-mcp	3	All rights reserved	Zero-trust PII and secret redaction MCP server for Cursor and Claude
ptjeong/ONC-CAR-T-Trials-Monitor	3	MIT	Dashboard tracking CAR-T, CAR-NK, CAAR-T and CAR-gamma-delta T clinical trials, sourced from ClinicalTrials.gov
stuthedew/open-anesthesia-sim	3	Apache-2.0	Open-source deterministic simulator of inhaled-anesthetic uptake and distribution, explicitly for education and not clinical prediction
GeiserX/SuperMedicalDoctor	2	AGPL-3.0	A household doctor assistant living in a Telegram group: appointment reminders, medicines and supplements, lab result tracking
Lukecele/spatial-continuum-oncology	2	CC-BY-4.0	Biophysical reaction-diffusion solver for post-ADAURA lung cancer relapse, with a 60 FPS simulator and one-click Colab
jamesruga/afya-triage	2	Undeclared	Emergency Severity Index aligned clinical risk assessment microservice, designed for low-resource deployments
priyalifescience/airmed	2	EUPL-1.2	Ireland's open pharma data: 67 open datasets, 1.7M records, 37 publishers
romeo111/OpenOnco	2	MIT	Free oncology decision support for tumor boards: cited treatment-plan drafts and an Onco Wiki
BerlinTheWall/Pharma_Feature_Extractor	1	MIT	LLM extraction of structured clinical fields from 1,435 Health Canada drug monograph PDFs
CNAG-Biomedical-Informatics/cohortome	1	Apache-2.0	Explore clinical and multi-omics data, build patient cohorts and run analyses, with optional AI assistance
Jayant-Chaudhary/medBrief	1	Undeclared	Health platform connecting patients and clinicians: pre-visit check-ins, OCR lab report extraction and trend charts
MCPServings/paper-mcp	1	MIT	Remotely callable MCP server: paper search, medical evidence via PubMed / Europe PMC, plus LaTeX and PDF tools
genmnz/jean-by-melad-labs	1	Undeclared	The bioinformatics and biotech suite as a remote MCP server: 279 tools to design, simulate, analyse and verify experiments
yeyuan98/bioresearcher-skills	1	Apache-2.0	Agent skills and connectors for biomedical research, with the biomcp-ts MCP server
AnhDuongVo/trial-matcher	0	Apache-2.0	FHIR clinical-trial pre-screening with evidence-linked met / not met / unknown verdicts and explicitly uncalibrated heuristic scores
MichaelEnny/clinical-ai-security-posture	0	MIT	Adversarial testing framework and Security Posture Score for clinical AI inference systems, including FGSM and boundary attacks
Pinnnnnneapple/hl7scrub	0	MIT	Structure-aware HL7 v2 de-identification: deterministic pseudonyms, consistent per-patient date shifting, Safe Harbor policy and PHI scanning
Riscon-AI/iatheon-verified-errors	0	CC-BY-4.0	Verified errors in AI-written oncology summaries, each tied to its PubMed or ClinicalTrials.gov source
asarmah123/ai-health-evidence-monitor	0	MIT	Deterministic, rule-based evidence pipeline integrating regulatory, HTA, clinical trial and market-access information
cosyte/deid	0	MIT	Healthcare de-identification for Node.js and TypeScript: applies a HIPAA Safe Harbor policy to HL7 v2, C-CDA, FHIR R4, X12 and NCPDP
juanjosejimenezcatalan-boop/hl7-radiology-workflow-lab	0	Undeclared	Synthetic HL7 v2 radiology workflow lab with MLLP, ACK handling and validation
mafritzsche/dicom-injection	0	CC-BY-4.0	Study repository of prompt-injection attacks on LLM agents in radiology workflows
mahmood726-cyber/evidence-collider	0	MIT	Maps clinical trial density against global disease burden to surface mismatched research resources
medbrains/medbrains	0	Apache-2.0	Open-source hospital management system: registration, OPD, wards, pharmacy, lab, radiology and billing on one patient record
munimtechnologies/evidence-pack	0	Apache-2.0	Triage generic drug to condition pairs using public clinical evidence from PubMed, ClinicalTrials.gov and openFDA
orevid-org/orevid	0	MIT	Open, evidence-based drug repurposing: a biomedical knowledge graph ranking existing drugs per disease with the evidence shown
ryandelauz/peptide-library-mcp	0	MIT	Peptide research MCP and agent skills: cited research profiles, human vs preclinical evidence, RoB and GRADE evidence quality
shay-dan/scientific-rag	0	Undeclared	Evidence-grounded scientific RAG: PubMed / arXiv retrieval, hybrid retrieval, semantic claim verification and cost-aware orchestration
smritisingh-0401/OASIS	0	MIT	A lightweight, explainable, safety-first mental health support chatbot

③ Health management, nutrition and food AI

Project	Stars	License	One-liner
chrisdoc/hevy-mcp	533	MIT	MCP server for Hevy training data: manage workouts, routines, folders and exercise templates
elkimek/get-based	160	AGPL-3.0	Private local-first health intelligence for labs, 51 curated SNPs, wearables, light exposure and Biology Scores
hhopke/intervals-icu-mcp	121	MIT	Read/write MCP server for Intervals.icu: training data, period planning and structured workout generation
umutkeltek/healthsave-observatory	103	Elastic-2.0	Self-hosted health-data observatory: sync Apple Health, early wearable plugins and Garmin / Samsung imports into a canonical TimescaleDB
mustafaeeeuu-cell/NutriVerse-Coach	55	Undeclared	Fitness coach app bundling healthy meal planning, tasty recipes and a community hub
codelibs/recotem	9	Apache-2.0	Recipe-driven recommender systems: one YAML = one model = one recommendation API, training emits a signed artifact
SilverCrocus/OpenMacro	6	MIT	Open-source nutrition coach for Android: adaptive calorie and macro targets, AI photo logging, 58k foods, data stays on device
davidmosiah/withings-mcp	5	MIT	Unofficial local-first Withings MCP server for AI health, sleep and activity agents
turnnoblindeye/wellness-project-mcp	3	MIT	Connects Apple Health, Fitbit, Oura and Health Connect to Claude and ChatGPT as a hosted fitness MCP server
GeiserX/OwnHealth	2	AGPL-3.0	The health data layer you own: labs, records, wearables and genome in one self-hosted store, MCP scoped per person and per token with a citation behind every answer
GeiserX/supermealplanner-ios	2	MPL-2.0	Today's plates, the week and the shopping list on iPhone, served from your own server
MoleCare/molecare-ml	2	Apache-2.0	Melanoma classification service and training notebooks behind the MoleCare skin-health apps, for research and education only
MoleCare/molecare-skin-llm	2	Apache-2.0	Educational skin-health Q&A model (Llama-3.2-1B LoRA), explicitly not a medical device and does not diagnose
VIVPM/curalink-medical-assistant	2	MIT	Autonomous RAG platform with a seven-stage AI pipeline giving clinicians evidence-based research retrieval
sepehr071/doctoreto-mcp	2	MIT	Unofficial read-only MCP server: let agents search doctors, compare visit fees and find free appointment slots
Hafsa-Anwar65/Rx-Read	1	Undeclared	Snap a prescription and understand the dosing schedule, decoding handwriting with Gemini
AbdulazizShehri/MedScale	0	Apache-2.0	Open-source local-first health intelligence with evidence provenance, currently a synthetic-only engineering preview
alphanumericslab/medorama	0	PolyForm	A unified patient-journey research platform linking multimodal databases
craigbennett1981/body-kaizen	0	Apache-2.0	Log meals, workouts and labs by chatting with Claude: photos become calories and macros, syncing Garmin sleep, HRV and heart rate
faisukhan01/medspas	0	MIT	An all-in-one operating system for medical spas: web command center plus staff and patient mobile apps and AI assistants
pepbank/peptide-research-mcp	0	MIT	MCP server for peptide research: study findings, clinical trials and cited sources for 160+ peptides
sachin-11/dawai-saathi	0	Undeclared	WhatsApp-based AI health assistant for Indian patients: reads prescriptions and lab reports, suggests generic alternatives

④ Model foundations and agent infrastructure

Project	Stars	License	One-liner
mudler/LocalAI	50,245	MIT	Open-source local AI engine: run any model on any hardware, no GPU required
rohitg00/agentmemory	30,191	Apache-2.0	Persistent memory for AI coding agents based on real-world benchmarks
keploy/keploy	19,526	Apache-2.0	Open-source platform for creating safe, isolated production sandboxes for API, integration and E2E testing
lance-format/lance	7,266	Apache-2.0	Open lakehouse format for multimodal AI: convert from Parquet in two lines, 100x faster random access, vector index and data versioning
microsoft/agent-governance-toolkit	6,535	MIT	Microsoft's AI agent governance toolkit: policy enforcement, zero-trust identity, execution sandboxing and reliability engineering
mostlygeek/llama-swap	6,206	MIT	Reliable model swapping for any local AI server
Michael-A-Kuykendall/shimmy	6,012	Apache-2.0	Pure-Rust WebGPU inference engine: OpenAI-API compatible, GGUF native, no Python and no llama.cpp
pydantic/logfire	4,537	MIT	AI observability platform for production LLM and agent systems
bytebase/dbhub	3,803	MIT	Token-conscious database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB and SQLite
NVIDIA/TransformerEngine	3,599	Apache-2.0	Library for accelerating Transformer models on NVIDIA GPUs, including 8-bit and 4-bit FP8 and FP4 precision
scenario-labs/skills	3,507	MIT	Get production-ready images, video, audio and 3D from any AI agent: skills that pick the right model and price before spending
superlinked/sie	3,476	Apache-2.0	Open-source inference server and production cluster for all the models your agent needs
Asymptote-Labs/agent-beacon	3,381	MIT	The cross-harness, self-improving memory layer for AI agents
openlit/openlit	2,962	Apache-2.0	Same agent, smaller bill: the tooling and infrastructure for more work from your AI, fewer tokens, less compute, lower cost
datachain-ai/datachain	2,831	Apache-2.0	The context layer for unstructured data: typed, versioned datasets over S3, GCS and Azure
spec-kitty/spec-kitty	1,717	MIT	Spec-driven development with organizational governance: specs tell AI agents what to build, a charter governs how they build it
ashhart/TensorFold	1,693	Apache-2.0	LLM inference engine for Metal, CUDA and Vulkan
fatwang2/search2ai	1,286	MIT	Self-hosted search gateway for AI agents: unified search, news and page extraction with provider fallback
hanzohanzhe/Grandet	1,182	AGPL-3.0	Find the cheapest API for any model and connect it to your AI agent: a skill plus an anonymous MCP server
chrishayuk/larql	1,174	Apache-2.0	Run, serve, query and edit AI models: a Rust model runtime built on VINDEX3, an executable, inspectable model format
pipelab-org/pipelock	987	Apache-2.0	Open-source AI agent firewall for MCP security and agent egress: scans mediated HTTP, MCP, A2A and WebSocket traffic for exfiltration
simplexai-labs/PolyStrata	914	MIT	Run large AI models on your own PC: Qwen3.8-Flash-Next, GLM 5.3 Flash, DeepSeek V4 Flash and more
microsoft/nvx	828	MIT	Cross-platform micro-VM sandbox for agentic workloads
CHATS-lab/verbalized-sampling	821	Apache-2.0	Verbalized Sampling: a training-free prompting strategy that asks models to report probabilities and mitigates mode collapse
converge-ai-labs/agent-foundation	769	Apache-2.0	Build, run and manage AI agents at scale on your own infrastructure, with a built-in harness and durable execution
framerslab/agentos	685	Apache-2.0	TypeScript AI agent framework: cognitive memory, dynamic personalities, emergent behaviours and self-building designs
agentty-org/agentty	614	MIT	AI pair programming in your terminal: one static binary, sub-ms startup, any model
llmmanorg/llmman	584	Apache-2.0	Run any agent on any model, with models stored as OCI images
Cygnux-Labs/Tracekit	551	MIT	Tamper-evident tracing, policy gates and cross-checks for AI agents: see what the agent did, and why
rderaison/bromure	303	MIT	Proper sandboxing for agentic coding and web browsing
llm4s/llm4s	278	MIT	Agentic and LLM programming in Scala
NodeDB-Lab/nodedb	244	Apache-2.0	The memory and storage database engine for AI agents: multi-model, edge-to-cloud, PostgreSQL-compatible, with graph, vector, array and time series
KbWen/agentic-os	229	MIT	Governance framework for AI coding agents: a five-step workflow of plan, build, review, test and ship where no step counts as done without passing
kstevica/captain-claw	193	MIT	Command a fleet of AI agents: self-hosted multi-agent platform with memory and a coding pipeline
agentfront/frontmcp	148	Apache-2.0	TypeScript framework for MCP servers: shared services, input validation and the access rules you configure
1bye/rake	128	Apache-2.0	Rust framework for GPUI with native and browser apps, runtime inspection and agent control
mstar-project/mstar	112	Apache-2.0	A high-performance, universal serving framework for any-to-any models
tenuo-ai/tenuo	105	Apache-2.0	Task-scoped authorization for AI agents: cryptographic warrants constrain tools and arguments, blocking privilege escalation at every delegation hop
Ta0p1/ResolveLab	104	MIT	Fault-injected tool environments with side-effect grading for evaluating and post-training LLM agents
cognicore-dev/cognicore-env	82	Apache-2.0	Persistent memory, reflection and safety for AI agents: no vector DB and no embedding server, BM25 plus multi-hop retrieval
joslat/agent-memory-dotnet	73	MIT	An independent .NET implementation of a Neo4j-backed memory provider: graph-native persistent memory for Microsoft Agent Framework
Oaklight/ToolRegistry	67	MIT	Protocol-agnostic tool management library: one function-calling format across OpenAI, Anthropic, Gemini, MCP and OpenAPI
tocreator/tostore	67	Apache-2.0	Data engine for AI vector and SQL/NoSQL: KV, embeddings, BM25 full text, hybrid and semantic search
chatvia/chatvia	60	MIT	Open-source platform for AI chat agents answering from your own knowledge base: hybrid RAG in PostgreSQL, MCP and custom tools, guardrails
jamjet-labs/jamjet	23	Apache-2.0	The open-source safety layer for AI agents: block unsafe tool calls, require approval, enforce budgets, audit and replay
Rul1an/assay	16	MIT	Open, recomputable evidence profile for privileged MCP tool actions: Enforce, Prove and Stay honest, with claims graded verified, self-reported, inferred or absent
opensecurainc/openaidr	5	Apache-2.0	Agentic AI detection and response: understand every AI agent and tool across your organization and enforce guardrails centrally
strale-io/strale	5	MIT	A tool market for agents: one connection to a growing library of tools agents can pay for per call
FractalSQLabs/fractalsql-postgresql	1	Apache-2.0	AI database extension for PostgreSQL: vector search, in-database reasoning and production-safe agency beside your data

3. Trends today

The clearest thread this issue is that constraints are sinking from "requirements written in a prompt" down into "gates that cannot be bypassed at runtime", and the gates increasingly carry three things: where the threshold came from, the reason for the verdict, and a record of the refusal. lights-out's eight gates each print one line of GO/NO-GO and cite the threshold's source; assay gives the precise reason for every allow or deny before forwarding and writes the decision into an offline-recomputable evidence bundle; samd-starter-kit writes "no pushing without explicit consent" into hard rules; OwnHealth uses token scopes so that what you may not see cannot leak even indirectly. Four unrelated projects, all answering the same question: not "what should the AI do", but "when the AI oversteps, how does the system stop it, and is there a trace a third party can re-check afterwards." This is the fifth stage of the thread I recorded with ClawBio's skill-maturity grading and navigator's refusal to end a turn: the first four stages pushed constraints down into code and configuration; this stage pushes them down into the runtime and the supply chain, and demands that the runtime emit auditable evidence.

The second thread is that the unit of cost measurement keeps getting finer, and this time it reaches the level of model choice. Last issue skill-diet reported "70-80% of tokens cut with no drop in test results"; this issue sprag reports "the same 12 requests, $6.68 to $1.83 (−72.6%)", and states explicitly why one task must stay on Sonnet high rather than dropping to Haiku — because replays showed the default medium effort missed it. Together these mean the cost-effectiveness of an AI artifact must now be measured as a triple: on which model, burning how many tokens, passing how many tasks — and the third component needs a recomputable mechanism such as replay plus blind grading, or cost reduction is a gamble. For someone like me who runs the same batch of content-production tasks across several models, the preconditions for replay verification already exist on this machine (WorkBuddy is wired to a single OpenRouter key covering the whole model family); I have simply never used them.

The third thread, and the one that should make me most alert this issue, is that health and medical projects are collectively splitting "I don't know" out of a null value into a set of named fields. OwnHealth's response envelope carries not_assessed (never evaluated), withheld (deliberately not disclosed), limitations (the boundary of the conclusion) and evidence (every item with src); assay grades claims as verified / self_reported / inferred / absent and refuses to emit an overall score; trial-matcher outputs met / not met / unknown and says plainly that its heuristic score is uncalibrated; iatheon-verified-errors ties each verified error in AI-written oncology summaries back to its primary source. This is the fourth stage of the same "structure the evidence" thread: evidence is not prose, absence is not blank, and unknown is not a denial. My OCR pipeline, my GRPM reports and my 4P intervention reports all do "AI produces a structured conclusion, then it is written down" — and in all three places, "we did not get it" is currently written as a null value. That is the first thing I should change.

The fourth thread: licensing continues to evolve from "one LICENSE file" toward "layered + routed + three separate declarations", and the non-commercial category is visibly growing. Of this issue's 158 entries, MIT and Apache-2.0 account for 130 (82%), but there are also six AGPL-3.0, one Elastic-2.0, one PolyForm, two all-rights-reserved, one custom Databricks license, and nine repos confirmed to have no LICENSE file at all. What is most worth noting about OwnHealth is that it does not merely pick AGPL-3.0: it actively uses that license to underwrite its "never a hosted or paid version" non-commercial positioning, and argues from it that it is not a GDPR controller. That is a clear signal — when a project welds its license to its business model, the users it wants and the users it excludes are equally clear. For someone like me who intends to "pick a base and build something sellable", this list belongs on the first line of the selection document.

The fifth thread, and a direct note to Gordon: the five instances of "one bug, five different fixes" I counted in this issue all point at the same unfixed problem — an AI-generated conclusion being treated as a fact that may be written to disk. lights-out's test-proof gate guarantees "a newly added test must fail on the base"; assay requires every claim to state whether it is verified or self-reported; OwnHealth gives "not assessed" and "withheld" a field each and marks every PDF text layer as untrusted; samd-starter-kit refuses to declare anything green without running the linked tests; sprag requires every cost-saving rule to have a replay case you can open. Five teams on five completely different tech stacks, independently, in the same week, all doing the same thing: making the AI's words stand on their own. And my three outputs — the 4P platform database, the GRPM report export, the public-account article — have none of that check today. Concretely, four things are needed: ① every extraction carries a four-tier claim; ② missing items go to not_assessed rather than to a null; ③ read back by primary key after writing and block downstream on mismatch; ④ any claim of "covering N dimensions" must be counted by a script, not asserted by a model. None of these four needs a new framework — only four assertions inside the existing pipeline.

4. Repo index