Neodrop
Create
FeedDiscoverMy ChannelsAuto-publishJoin Our Discord
FeedDiscoverCreateMy Channels
Ten agent builds from Sep 19–25: tiny decision models, deterministic checks, and a rootless sandbox
2026-09-25

Ten agent builds from Sep 19–25: tiny decision models, deterministic checks, and a rootless sandbox

Ten runnable indie agent builds from September 19–25: small typed-decision models taking over the judge role in agent evals and workflow gates, deterministic detectors that catch intent conflicts and duplicated code, and a rootless sandbox that enforces agent permissions at the OS level.

Indie AI Agent Builds Weekly
Indie AI Agent Builds Weekly@Moinul Islam
At least a dozen Show HN posts in the seven days to September 25 did the same thing to a model: they stopped asking it to write a verdict and asked it to pick one. Jev, TypeSafe's small decision model, takes a state and a set of typed questions — yes or no, choose one of these, score on this rubric — and returns a calibrated probability for each in a single forward pass. Kev and Laya are open-weight models that speak the same request shape, one running on a Mac and one on Apple Silicon in-process. 1
Builders spent the week wiring that idea into agent loops. Others went the other way and took the model out of the judgement altogether, leaving the decision to a deterministic detector, a rule engine, a tree matcher, or the Linux kernel. The two halves meet in the same question: which part of what an agent does should you keep paying a language model to decide.
Ten builds below, then seven smaller releases and one trend from GitHub's weekly board.

The judge stopped writing paragraphs

jevals turns one trace into eight typed questions

jevals is the clearest statement of the week's idea. It appeared on Show HN on September 21 and is the eval library rebuilt on decision models: the frontier judge goes away and typed questions come back as probabilities. 2
The whole trace goes out as one request. In the repository's quickstart, eight checks — the tool the agent picked, whether it used what the tool returned, whether each claim in the final answer is supported by the tool results, whether it stayed in scope, answer relevancy, completeness, indirect prompt injection, and PHI — return together with a usage line reading 1 request · 1,388 tokens · $0.00006 · 0.33s. 1
Typed questions evaluate independently and in parallel, so forty questions cost roughly the latency of one. The project puts Jev at $0.042 per million input tokens, with no output tokens to pay for, measured through Vercel's gateway at p50 244ms and p95 371ms per request. The repository also cites a LangChain comparison in which GPT and Claude judges scored 92x to 913x the variance of Jev on identical traces.
pip install jevals
export AI_GATEWAY_API_KEY=...
Backends resolve from the environment, and KEV_BASE_URL or JEVALS_BACKEND=laya keeps the whole thing on your machine. Swap backends and the repository tells you to re-run jevals calibrate, because the probabilities will not line up across models. Point it at an ordinary chat LLM and the numbers come back as 0.00 or 1.00, with the calibration gone. Whether a yes/no probability is the right shape for your eval is the part you have to decide for yourself.

AgentRun puts a decision node between the steps

AgentRun, open-sourced on Show HN on September 24 with 44 points, is the same idea as a workflow language. You write steps as nodes: a tool call, a chunk of code, a decision, or an agent. The decision nodes go to Jev. 3
The submitter, miguelrios, describes it as the DSL behind the harness at grep.ai, built so that repeatable parts of agent work stop costing a full agent loop. The support example lays out the shape: search for an answer, require the answer text and a source reference, require Jev to answer yes with confidence at or above 0.8, allow one agent attempt if that check fails, then escalate for review. 4
npm install @parcha/agentrun-dsl@beta
npx agentrun demo
The demo runs on scripted decisions and needs no API key, so you can read the graph before you spend anything. Live Jev calls need a TypeSafe key, separate from your coding-agent login, and the Pi extension installs the same workflows into that harness.
The README states two limits. Code nodes execute JavaScript with process privileges, so untrusted workflow authors need a host-controlled sandbox. And a typed decision with a validated output shape is still only a decision: the project says plainly that it proves nothing about whether the answer is factually correct.

JevBench scores the decision models on four axes

For choosing between the models in this cluster there is JevBench, a reproducible benchmark for decision models, posted on September 22 at 145 points. 5 The author, florianstandhar, describes a full run as 534 English decisions, scored on intelligence, calibration, speed, and cost, combined as an equal-weight harmonic mean. The harness is MIT-licensed and the items are public. 6
The board moved under it during the week, which is worth knowing before you quote a number. The post reported Jev first at 74.4 on v1.3. The page carries v1.4.2 today, with 89 ranked systems, decider-4b v2 first at 64.1 and Jev 1.13.0 second at 63.3. The page's own note explains the split: Jev 1.13.0 out-reasons decider-4b v2 on the intelligence axis, 53.1 against 49.4, and is better calibrated, while decider-4b v2 wins on speed and cost.
The equal weighting is what decides the ranking. The two entries for a frontier model carry the board's two highest intelligence scores, 96 and 97, next to its two lowest cost scores, 37 and 36. On the combined figure they land at rank 31 and rank 35, beneath 4B models such as reflex 4B at 54.0. Read whichever column matches the constraint you actually have.

jev-effort measures what per-step effort selection saves

Tools had appeared promising that letting a small decision model set the reasoning effort on each step would cut the bill. jev-effort, posted on September 24, went and measured it, and the saving is narrower than the pitch. 7
On a six-task coding benchmark with hidden checks, 24 sessions per arm, every test passed in both arms. At high effort the cost moved by about 1%. At max effort the cost fell 55%, thinking tokens fell 98.5%, and wall time fell 58%. 8 The author flags one outlier task in that run and gives the figure without it: 21%.
The real-world number is smaller. In a 92-minute shadow run of ordinary work, 470 model steps at max, the estimated saving was 4% to 9%, because cached context was 82% of the spend and thinking was 9.5%. Effort selection cuts the share of the bill that thinking owns, and in a long session re-reading the conversation owns most of it.
The mechanism is a local proxy in front of claude that appends an effort-only system message. It holds the prompt cache — 0 unexpected misses across 411 checked steps, a 99.1% hit rate — but only if the injected change is the last message in the request, since the latest effort setting wins and everything else is ignored in silence. The project calls itself a research project, unofficial and unaffiliated with Anthropic or TypeSafe.

The check that is not a model

Foremerge compares declared intent before either agent writes code

Git tells you when two agents edit the same lines. Foremerge, posted on September 21 at 45 points, targets the case Git cannot see: two edits in different files that are each sensible and can never both be true. 9 The README's example has one agent move every caller onto a new StripePaymentService while another adds PayPal support to the old PaymentService. Nothing overlaps, so the merge is clean and the PayPal work is stranded on a class nothing calls.
Each agent publishes the target it is about to change and the operation it plans. In the example both agents declare the scope symbol:PaymentService, one with replace and one with extend, and the detector raises a HIGH advisory before either writes code. A small SQLite store inside the project's .git folder holds the shared list, so every agent on the machine reads one picture. 10
curl -fsSL https://foremerge.com/install.sh | sh
foremerge init && foremerge setup all
foremerge checks set test -- cargo test --all-targets
Two design decisions are deliberate. It never locks a file or blocks an agent, because one crashed agent would stall the whole fleet, so the warnings are advisory. And it never asks a model to judge a conflict, so the same declarations always produce the same verdict.
Foremerge is at 0.5.0, pre-1.0, local-first, and the README says public schemas may still change. Published benchmark results are absent, and coordinating agents across machines is out of scope. You need a recent Git and jq. The repository had 506 stars on Friday. 10

AI·rete·RAG gives the verdict to rules and the explanation to retrieval

AI·rete·RAG, posted on September 22 at 44 points, splits the two jobs that a model usually does at once. A pure-Python Rete engine evaluates YAML rules against your facts, and the verdict comes only from there — same facts, same verdict, with salience-based conflict resolution. Retrieval then pulls passages from your own policy documents so an LLM can write the explanation, citing them. The LLM cannot change the decision. 11
The site runs the thing live against demo policies with no signup. Drag the credit score on the loan example down and the verdict flips from approved to declined while the explanation follows. There are eight built-in domains, three ways to wire rules and retrieval together, and a static analysis pass that flags two rules with different verdicts which could both match the same case. 12
The pitch is aimed at teams who put a model in charge of lending, fraud, or clinical triage decisions and bolted guardrails on afterwards. If your decision has to be defensible to somebody else, a verdict that comes out of a rule trace instead of a sampled paragraph is the whole product.

Treepeat finds duplicates by tree shape

Treepeat, posted on September 22 at 57 points, is a small command that answers a question the week's other tools raise: how much of this codebase is the same idea written twice. It parses with tree-sitter, then compares with locality-sensitive hashing, so it matches on structure instead of lines. 13
pip install treepeat
treepeat detect --similarity 80 --min-lines 10 --diff .
Three rulesets set how hard it looks: none for exact duplicate blocks at the class and function level, default for near-duplicates that ignore whitespace, strings, and high-level AST nodes, and loose for structural similarity with identifiers and constants anonymized. It covers fifteen languages including Go, TypeScript, Rust, Kotlin, and SQL, emits SARIF for CI, and ships a treesitter subcommand showing how a file was normalized, which is how you debug a match you disagree with. 14
The author calls it a proof of concept and asks for pull requests on language coverage. Support for each language is a normalization ruleset someone wrote by hand, so the quality of a match depends on how much attention that language has had.

Walls, diffs, and the raw log

Drop enforces permissions below the agent

Drop, at 188 points on September 22, takes the position that some agent behaviour belongs to the operating system rather than to a permission prompt. The advertised use is running a coding agent with --dangerously-skip-permissions and letting Drop enforce the boundary underneath it: a hallucinated rm -rf ~ reaches a disposable home directory, a prompt injection aimed at ~/.ssh finds nothing there, and a connection to a service on localhost is refused. 15
It works within a Linux user namespace that carries its own process, mount, network, IPC, and cgroup namespaces, and it drops every user-namespace capability before it runs your program, so a sandboxed process cannot even bind-mount. Your existing distribution is the base, and that is the part which separates it from a container: every tool you already installed is available inside, so what you get is a normal working setup rather than a stripped image. 16
A TOML config names the files, directories, and local services to expose, and a base config is shared across environments, so one line for a work directory and one open port get you started. gVisor support is optional and adds a user-space kernel for the cases where escaping the host kernel is the threat you care about. The author, mixedbit, wrote it after working out that a compromised dependency in his own account is also a compromise of everyone who runs the software he ships. It runs on Linux only, and exposing something new means writing it into the config yourself.

Whiteboard shows the change and the decisions behind it

Whiteboard, posted on September 24 at 332 points, is where the agent puts its work instead of its prose. It is a desktop app forked from Code OSS, and it connects to Claude Code or Codex and gives the agent an SDK to draw on an in-app canvas: sequence diagrams, entity relationship diagrams, quoted lines from its own trace. Click a diagram and you land in the code it describes, with VSCode keybindings and LSP support intact. 17
The semantic diff viewer is written in Rust and AST-aware, and it shows only the changes you asked about: large added functions arrive summarized as pseudocode, and unit tests and documentation changes arrive collapsed. A decision log lets the agent query and link its own traces, so you can see which parts of your requirement it satisfied and which choices it made on its own. 18
The team — Sid, Alex, Ketan, and Milan, out of Y Combinator's current batch — licenses it MIT and runs it against your local checkouts. Whiteboard cannot edit files yet, a single review across several repositories is poorly supported, and a review you share stops updating for others until you share it again. The first of those is the one to check against how you work.

lossless-memory keeps every line and refuses to summarize

lossless-memory, posted on September 21 at 67 points, argues that summarization is the forgetting. Raw turns are appended to per-day JSONL files as seven fixed fields, and every index is built on the timestamps in those records, which means the indexes can be deleted and rebuilt from the logs. 19
Queries run time first and words second. A parser handles relative phrases such as "last week" and "this morning" in English and Japanese plus absolute dates, narrows the range before any ranking happens, and returns verbatim lines in chronological order. A second index called LLL holds short timestamped topic markers and is injected on every turn, so the assistant still knows which thread it is in after its context window has been compacted. The author's rule for LLL is that the human writes it and the AI reads it.
The operating record ships with the failures left in. Exact-search index rebuilds went from 40 seconds to 1.24 seconds, and a vector index contaminated by library content grew to 865,588 rows at its worst in early September, then dropped to 124,174 rows and 337 MB after the fix. Those numbers come from one instance in daily use since July.
The author lists the limits. This has only ever run for one person on one machine, relative time phrases work in English and Japanese, benchmarks are absent, semantic search needs a local embedding model, and two import formats are ready. Development is paused for personal financial reasons, as the author states at the end of the FAQ.

Also shipping

Seven smaller releases from the same window, each with the one thing worth knowing:
  • all-your-agents (markwylde/all-your-agents): a top command for coding agents that lists every live session, puts the ones waiting on you first, and reads transcripts in place. It watches the files each harness already writes and never polls, so the screen redraws only when an agent changes, a key is pressed, or the terminal resizes. The compatibility matrix records exactly what each harness cannot report. 20
  • ToolHub (Talos-popcorn/toolhub): a self-hosted tool server that turns any console script into an agent tool and lets the model browse them as a folder tree with listTools() and callTool(), so thirty tools do not have to fit in the prompt at once. It runs on Bun and needs no Docker. 21
  • Agent Chaperone (agent-chaperone/agent-chaperone): screens tool calls and tool results with Jev before either happens — risky, off-task, or secret-leaking actions on the way out, and prompt injections before the agent reads them. The author says Jev's release the previous week is what made it buildable. 22
  • Critic (critic.run): agents present their change, annotate the key blocks, and attach evidence such as screenshots or local run instructions, and anyone viewing the change can ask the agent that wrote it directly. 23
  • Canary (runcanary.ai): independent verification for AI code, from Aakash and Viswesh. Claude or Codex hands over the changeset, the intended behaviour, and the team's knowledge, and Canary runs agent swarms against suspected runtime bugs in remote sandboxes. Onboarding is a CLI and a skill. 24
  • OpenMCP (enclawed/omcp): a code-first fork of the Model Context Protocol. 25
  • Tachyon (tachyonmcp.dev): a Java SDK for building MCP servers. 26
One trend from GitHub's weekly board. The configuration layer around coding agents kept climbing in the week to September 25: affaan-m/ECC, which describes itself as an agent harness optimization system for Claude Code, Codex, Opencode, and Cursor, added 6,193 stars to reach 267,228; addyosmani/agent-skills added 3,345 to reach 98,978; and superdesigndev/treg, which calls itself OpenRouter for agent tools, added 1,406 to reach 3,310. The board's largest weekly gainer was Cloudflare's security-audit-skill, a coding-agent skill for machine-readable security findings, at 11,262 stars added. Those repositories carry no launch date inside this window, so read them as attention rather than as releases. 27

Where to start this weekend

Pick by the friction you already have, and try one thing rather than five:
  1. Your eval suite runs nightly because it costs too much to run more often. Install jevals, point it at a trace file you already have, and read the per-request cost on real data before you write a second eval.
  2. You are wondering whether the per-step effort trick is worth wiring up. Read jev-effort's numbers first. At max the saving was large on short benchmark tasks and 4% to 9% on a long real session; at high it was about 1%.
  3. Two agents worked on one repository this week and one undid the other. Run foremerge init, register a fast check such as a typecheck, and let both agents publish intent for a day with nothing enforced. The store is small and the warnings are advisory, so the cost of trying is low.
  4. A decision has to be defensible to someone outside the team. Open AI·rete·RAG's live demo, move the credit score, and see whether a rule trace plus a cited explanation matches the shape your audit needs.
  5. You are about to run an agent with permissions skipped. Try Drop on a scratch project and see which of your own files and ports you actually need to expose. Then try lossless-memory on two weeks of transcripts if what you are missing is the exact words.

References

  1. 1
    jevals repository

    github.com

  2. 2
    Show HN: jevals – replacing LLM judges with typed Jev decisions

    news.ycombinator.com

  3. 3
    Show HN: AgentRun: DSL to turn agents into workflows

    news.ycombinator.com

  4. 4
    AgentRun repository

    github.com

  5. 5
    Show HN: JevBench, a reproducible benchmark for typed decision models

    news.ycombinator.com

  6. 6
    JevBench by Benchmark Heaven

    benchmarkheaven.com

  7. 7
    Show HN: Does per-step reasoning effort save money in Claude Code?

    news.ycombinator.com

  8. 8
    jev-effort repository

    github.com

  9. 9
    Show HN: Foremerge – Catch intent conflicts between parallel coding agents

    news.ycombinator.com

  10. 10
    Foremerge repository

    github.com

  11. 11
    Show HN: AI·rete·RAG – a Rete rule engine decides, RAG explains why

    news.ycombinator.com

  12. 12
    ai·rete·rag

    ai-rete-rag.com

  13. 13
    Show HN: Treepeat – Code similarity detection using Tree-sitter

    news.ycombinator.com

  14. 14
    Treepeat repository

    github.com

  15. 15
    Show HN: Drop – A rootless Linux sandbox with gVisor support

    news.ycombinator.com

  16. 16
    Drop sandbox for Linux

    droprun.sh

  17. 17
    Show HN: Whiteboard (YC W26) – An open-source IDE for thoughtful software design

    news.ycombinator.com

  18. 18
    Whiteboard repository

    github.com

  19. 19
    Show HN: Lossless-memory – a personal AI memory that never summarizes

    github.com

  20. 20
    Show HN: Watch all the AI agents on your machine

    news.ycombinator.com

  21. 21
    Show HN: ToolHub – Hierarchical nav for 30 MCP tools without context bloat

    news.ycombinator.com

  22. 22
    Show HN: Agent Chaperone – Screen AI agent tool calls and results with Jev

    news.ycombinator.com

  23. 23
    Show HN: Critic – Review code with the agent that wrote it

    news.ycombinator.com

  24. 24
    Show HN: Canary (YC) – Independent verification for AI code

    news.ycombinator.com

  25. 25
    Show HN: OpenMCP – An open, code-first fork of the Model Context Protocol

    news.ycombinator.com

  26. 26
    Show HN: Tachyon – Java MCP Server SDK

    news.ycombinator.com

  27. 27
    GitHub Trending

    github.com

Indie AI Agent Builds Weekly
Indie AI Agent Builds Weekly@Moinul Islam

This story was produced automatically by a channel. One sentence is all it takes for Neodrop to keep producing for you.

Related content

  • The judge stopped writing paragraphs
  • jevals turns one trace into eight typed questions
  • AgentRun puts a decision node between the steps
  • JevBench scores the decision models on four axes
  • jev-effort measures what per-step effort selection saves
  • The check that is not a model
  • Foremerge compares declared intent before either agent writes code
  • AI·rete·RAG gives the verdict to rules and the explanation to retrieval
  • Treepeat finds duplicates by tree shape
  • Walls, diffs, and the raw log
  • Drop enforces permissions below the agent
  • Whiteboard shows the change and the decisions behind it
  • lossless-memory keeps every line and refuses to summarize
  • Also shipping
  • Where to start this weekend