Eight agent builds from Aug 29–Sep 4: boundaries, tests, and handoffs (2026)

The week agents started carrying their own guardrails

From August 29 through September 4, indie agent builders kept shipping the parts that make autonomy usable after the demo: action policies, repeatable evaluations, handoff protocols, and memory that a human can inspect. The common pressure is practical. Once an agent can browse, edit, call tools, or ask another agent for help, the builder needs a record of what happened and a way to stop the wrong action.

Oconee Runtime puts a decision in front of each action

Oconee Runtime appeared on Show HN on September 3. 1 Its policy layer targets browser and coding agents at the moment they are about to act. A rule can return ALLOW, WARN, or BLOCK after checking the actor, agent, action, resource, and surrounding context. 2

The useful shift is where the check sits. A prompt can ask an agent to be careful; Oconee puts a decision at the action boundary, where a browser click or code change can still be stopped. Open the policy article and model one action from your own agent, such as submitting a form or changing a production file. The page gives you the five-part policy shape to test. The operational limit is integration work: the policy description explains the decision model, while each agent stack still needs its own wiring.

Keydris returns a three-way authority decision

Keydris also launched on Show HN on September 3. 3 Its Node.js 20+ CLI checks authority before a governed agent action and returns ALLOW, APPROVAL REQUIRED, or REJECT. The service uses short-lived KITs, policy versions, revocation, and decision records. Its Developer Preview page lists $0, $20/month, and $99/month tiers and says the service has no production SLA yet. 4

The distinction from a generic approval prompt is the recorded decision and its expiry. Try the CLI against one action that should pass and one that should require a human. The operational limit is the preview status: pricing is visible, while production guarantees remain outside the offer.

Make agent work measurable

FrontierHarness Eval appeared on Show HN on September 2. 5 The site compares nine terminal agent harnesses on identical software-engineering tasks. Every run restores the same prepared checkpoint with matching CPU, memory, disk, contents, and memory state. 6

The page reports pass rate beside median cost. Claude Code passed 19 tasks at $18.34 per task. The same page warns that OpenCode's displayed figure covers 15 passes; counting failed attempts changes the figure to $3.24 per task. 6 That warning matters more than a neat leaderboard because a harness that hides failures can make a cheap run look cheaper than it is.

Open the comparison when you need a baseline for a terminal workflow, or submit your own harness through the Runta evaluation path. The operational limit is scope: FrontierHarness v1.0 covers terminal software-engineering tasks, so the numbers say little about browser work, research, or other knowledge work.

Agenci brings regression checks into CI

Agenci launched on Show HN on September 4. 7 The open-source project installs with pip install agenci, then scaffolds a test project with agenci init. Its checks cover functional assertions, prompt-injection resistance, tool authorization, output safety, regression thresholds, structured traces, estimated cost, and latency. GitHub Actions can fail a pull request when the configured thresholds move in the wrong direction. 8

The adapter list makes Agenci useful beyond one framework. The README names Python callables, HTTP services, OpenAI- and Anthropic-compatible APIs, LangChain/LangGraph, CrewAI, MCP, and AutoGen. 8 A first test can stay small:

pip install agenci
agenci init
agenci test
agenci security

Point agenci.yaml at a real agent after the example passes, then save a baseline before changing a prompt or model. The operational limit is maturity. The README calls Agenci early-stage and says version 0.2 is implemented and tested, while adapter coverage varies by integration.

HEIDES checks code changes against a local graph

HEIDES appeared on Show HN on September 2. 9 AbduljabbarBXR’s Rust harness keeps a persistent SQLite code graph and runs deterministic guards over a coding-agent change. The repository describes security taint checks, staged patch checks, edge-case findings, and plan grounding as part of the local workflow. 10

The project is aimed at the failure between “the agent produced a patch” and “the patch deserves to enter the tree.” Clone the repository, build the Rust binary, and run it against a small fixture before pointing it at a working codebase. The operational limit is project age and setup cost: HEIDES is a young repository, so a builder should inspect the guards and outputs before treating its findings as a release gate.

Give agents a handoff surface

devbar turns a browser selection into engineering context

devbar appeared on Show HN on September 3. 11 The local tool captures a selected webpage element’s XPath and CSS selectors, computed styles, React component tree, source path, layout details, screenshot, and note. A report can go to Claude, Codex, an MCP session, GitHub, or a webhook. 12

The payload solves a familiar handoff problem: “make this button match the design” becomes a locator, component path, and source file. Run devbar in a project, select one element, and route the report to the agent session already working in that repository. The operational limit is context, not execution. devbar tells an agent what the browser element is; the agent still decides what code to change and how to verify the result.

Bridle gives two agents scoped verbs

Bridle appeared on Show HN on September 3. 13 The pre-release Apache-2.0 CLI creates two-sided handoffs between agents. Its scoped verbs include context.push, task.queue, state.read, and run.request; a receiving machine asks for approval when a request carries higher risk. 14

The protocol keeps joining, permission, and delivery separate. Install the CLI with npm install -g bridle-cli, run bridle up, then grant only the verbs a second agent needs. The operational limit is the pre-release boundary: high-risk requests still wait for the receiving human, and a shared mesh does not grant access by itself.

Radia treats shared work as records with leases

Radia appeared on Show HN on September 3. 15 Its shared record space gives records immutable parent links, leases, authority lineage, data lineage, content-scoped grants, and lease fencing. A worker claims a record, produces a linked result, and loses the claim when a stale acknowledgement reaches the runtime. 16

The record model gives an agent team a way to answer “who handled this, from which input, under which authority?” Try the supported installer, start radia dev, then post a document, claim it with a lease, and acknowledge a linked summary. Radia supports Linux and macOS binaries and runs through WSL2 on Windows. 16 The operational limit is scope: Radia supplies the coordination substrate, while the worker logic and the trusted storage or credential host remain your responsibility.

Keep a local agent’s memory inspectable

openvurp stores agents and their history on disk

openvurp appeared on Show HN on September 3. 17 The project lets a builder create agents with a name, a job, and an engine. Agents can run commands, read and write files, search the web, drive a browser, and ask colleagues for help. Conversations, lessons, and memory live as files under memory/. 18

The file-backed design makes the first experiment easy to inspect. Clone the repository, install it in editable mode, and run openvurp; the dashboard opens at http://localhost:8420. 18 Create two small agents with different jobs, let one ask the other a question, then read the resulting memory files before adding more tools.

The operational limit is locality. openvurp runs on one computer, and the model still receives prompts wherever the selected engine runs. The project exposes that choice and can keep private turns on a local model through PRIVACY_MODE, but the builder remains responsible for selecting an engine that matches the data being sent.

The practical shortlist is therefore split by the first problem you need to remove. Use Oconee Runtime or Keydris when an action needs a decision before execution. Use FrontierHarness, Agenci, or HEIDES when a change needs a repeatable check. Use devbar, Bridle, or Radia when work needs to cross an agent or machine boundary. Use openvurp when the experiment depends on memory you can open, edit, and delete yourself.

References

1
Show HN: Oconee Runtime
news.ycombinator.com
2
Policy enforcement for browser AI and coding agents
oconeeruntime.com
3
Show HN: Keydris
news.ycombinator.com
4
Keydris
keydris.com
5
Show HN: FrontierHarness Eval
news.ycombinator.com
6
FrontierHarness Eval
frontierharness.org
7
Show HN: Agenci
news.ycombinator.com
8
Agenci repository
github.com
9
Show HN: HEIDES
news.ycombinator.com
10
HEIDES repository
github.com
11
Show HN: devbar
news.ycombinator.com
12
devbar
devbar.sh
13
Show HN: Bridle
news.ycombinator.com
14
Bridle Network
bridle.network
15
Show HN: Radia
news.ycombinator.com
16
Radia
radia.sh
17
Show HN: openvurp
news.ycombinator.com
18
openvurp repository
github.com

The week agents started carrying their own guardrails

Oconee Runtime puts a decision in front of each action

Keydris returns a three-way authority decision