Indie agent builds, Sept 28–Oct 5: a team under one roof, a machine you own, and a receipt for every rule

Seven releases landed this week, and between them they cover three moves: putting a team of agents under one roof, keeping the machine those agents run on in your own hands, and making an agent produce evidence that it stayed inside the rules.

What shipped. Offrun is a Mac app that runs Claude Code, Codex, AGY and Grok Build side by side, each signed in with the accounts you already have. Every agent in a project works in its own git worktree and branch, so a refactor and a bug fix running at the same time never touch the same file. You pick a second agent to read the diff before you do; its findings land in the chat while the work is still uncommitted, and every merge stays your decision. 1 When one login runs out of usage, the chat moves to another connected login and keeps the whole conversation, and the app says it did so. 1 Project memory is stored as plain files in the repo: conventions every agent reads, the current plan, and the dead ends already tried. 1 It went up on Show HN on October 3, 2026, drawing 76 points and 64 comments. 2

Why it matters. Running two or three agents at once usually means a stack of terminal tabs, with you as the router between them and the merge tool at the end. The worktree-per-agent rule removes the file collision that makes parallel agents fail, and the reviewer adds a second pair of eyes without wiring a bot into your pull requests. The dead-ends file is the quiet one: it stops the fourth session from re-trying what the first one abandoned. Offrun asks for an Apple Silicon Mac on macOS 14 Sonoma or later, and it runs on your own logins rather than a subscription of its own. 1

Try it. Download for Mac. You need at least one agent CLI already installed and signed in.

What shipped. Bise is an open-source terminal app for multi-agent coding, published under Apache-2.0 by Gabriel Vergnaud. You talk to one agent, called main, which splits an idea into jobs and starts the agents for each. Agents message each other before they collide, and when one needs its own copy of the repository it makes a worktree and cleans it up afterwards. 3 Everything the agents produce — pages, docs, sheets, decks, pull requests — collects in an /artifacts list, and any change opens as a per-file diff against main beside the thread. 3 Main answers the agents' routine questions, so the real decisions are the ones that reach you, and a voice mode lets it answer out loud while the others keep working. 3 Your MCP servers, skills and Agent Plugins load from where they already are. 4 The current release is v2026.10.4, and it went up on Show HN on October 2, 2026. 5

Why it matters. The design aims to take the router role off you: main fields the agents' questions, worktrees appear and disappear on their own, and progress shows up as artifacts you can open instead of five sessions you have to find again. The author's own account on the page is that agents had made him faster while leaving his days empty, switching tabs and answering the same continue prompt, so he built the team lead he wanted. Most of Bise was built with Bise. 3

Try it. curl -fsSL bise.dev/install | sh. The repository is where issues and the license live.

What shipped. Pi pod runs sessions of the pi coding agent in remote sandboxes it calls pods, from a terminal or a phone, on a server you run yourself. The repository splits into a CLI client, a server that owns pod lifecycle over a REST API and a session gateway, a sandbox service that hosts many isolated pods inside one container, iOS and Android apps, and a self-hosted deployment that is a single Compose project. 6 Identity is handled by Zitadel over OIDC, and the server stores no passwords. 6 The author frames it as the missing pieces around a deliberately minimal harness — sandboxing, native clients, role-based session sharing and surface automation — added without changing how your own pi feels to use. 7 It went up on Show HN on October 3, 2026, drawing 113 points and 46 comments. 8

Why it matters. Pi is small and heavily customised, and Pi pod keeps it that way while giving it somewhere to live beyond your laptop. Your code, credentials and session history stay inside infrastructure you control, and the same session is reachable from a phone. The price is a Linux host you maintain: 8 GB of RAM, Docker with the Compose plugin, git, openssl and Node 22.19 or later. 6

Try it. Clone the repository, run selfhost/upgrade, add an owner with selfhost/add-user you@example.com --owner, then install the published CLI with npm install -g @pipod/cli and point it at your server.

What shipped. Pve-agents takes a repository, a ref and a purpose, clones a golden template into a disposable LXC container on your own Proxmox host, checks the repository out and starts an agent inside with that purpose. The browser UI streams the agent's transcript over SSE, replayed from the beginning for anyone who opens the page late, and permission prompts are answered in the browser. 9 When the work is finished you read the per-file diffs in the rail and either push them to a branch or discard the lot. 9 Destruction carries the most rules of any operation: the controller re-reads its own ownership marker before purging anything, a workspace holding uncommitted or unpushed work is spared, and a container whose state the controller could not read is reported rather than destroyed. 9 The author built it as a side project after getting used to cloud coding agents at work and wanting the same setup on his own infrastructure; it went up on Show HN on October 4, 2026. 10

Why it matters. This is the fire-and-forget shape of a cloud coding agent, moved onto a hypervisor you already run. A workspace exists for one task, streams where you are already looking, and is destroyed when it is done. The state machine is the readable half: provisioning is off by default, so you can walk the UI, the API and the whole lifecycle with no hypervisor involved, and every write to Proxmox sits behind one flag. 9

Try it. pnpm install, copy .env.example to .env, and run pnpm dev for http://127.0.0.1:3000; the full documentation is at pve-agents.sh. Real containers need Node 22+, a Proxmox host with an API token, a pool and a workspace template, plus a GitHub App for cloning and pushing. 9

What shipped. OpenAPPA is an MIT-licensed policy engine that tracks how data moves through an agent instead of matching commands against a list. Its configuration declares data sources, audiences, trust levels and authorities; every trajectory carries a label of audience times trust that can only ever grow more restrictive, and each decision is derived from that label. 11 The engine runs outside the agent's prompt and execution loop, out of the model's reach. 11 A refused call comes back with a remedy plan: a sanitizer that masks or redacts the payload, an authority that approves one specific action, or a subagent that isolates an untrusted read in a disposable branch. 11 On the project's own benchmark it finishes 89% of tasks with 0% of attacks succeeding, against 90% and 10% for Claude's auto mode and 41% and 31% for Microsoft's FIDES. 12 The method is described in a paper the authors say was accepted at NeurIPS. 11 It went up on Show HN on September 28, 2026, drawing 25 points and 12 comments. 13

Why it matters. The common answer to approval fatigue is a second model that judges each tool call, and a judge that reads prose can be steered by prose. It also struggles to see the data inside tool outputs, which harnesses often hide from it. OpenAPPA's answer is arithmetic over a label the model never touches, and because the configuration is declarative you can validate in CI that the whole tool graph is covered. 11 The task-completion figure is the project's own, measured on its own benchmark, so treat the pair of numbers as a claim about how strict enforcement can stay useful, attributed to the people who measured it.

Try it. The site's add-to-agent page covers the single integration point, and the contracts reference describes the configuration format.

What shipped. Corral runs a command under a wall-clock limit and checks, before it returns, that no process the command started is still alive. When it cannot prove that, it exits with code 120. 14 In enforced mode the command runs in its own cgroup v2 group, where one write to cgroup.kill stops every descendant, and the --mem and --pids limits apply. Without a cgroup it acts as a child subreaper, finds survivors through /proc and signals them through pidfds. 14 A --json flag writes one audit record per run with the mode, the limits, why the run ended, and the pids that would not stop. 14 It went up on Show HN on September 29, 2026, drawing 19 points and 6 comments. 15

Why it matters. An agent that runs tail -f, or a daemon that forks twice and calls setsid(), leaves processes that a runner never notices, holding ports, file locks and CPU for the next run to trip over. A runner that signals its child, or the child's process group, misses the daemon that moved to its own session and reparented to init. 14 The builder's own reason is concrete: interning on the backend of an AI agent, he watched it exit without terminating the background jobs it had started, and found the same reports against Claude Code's Bash tool. Corral needs Linux 5.11 or later, and 5.14 or later for the enforced mode. 15

Try it. The prebuilt x86-64 binary is on the releases page and wants glibc 2.36 or later; building from source needs glibc 2.36, CMake 3.22, Ninja and GCC 11 or Clang 14. 14

What shipped. RuleReceipt checks a coding agent's session against the rules in your own configuration and prints the line as evidence for each break. Running npx rulereceipt with no arguments goes through every session for the project in the last 30 days and leads with the rules broken most, each with a count, the last date and one quoted line. 16 It reports to the terminal, to Markdown for pasting into a pull request or Slack, or to a single-file HTML report, and each report carries a SHA-256 hash of the session file it checked so a reader can confirm the report describes that exact file. 16 It reads rules from CLAUDE.md, AGENTS.md, Cursor, Copilot, Windsurf, GEMINI.md, Google's .agents/rules and Claude Code memory, and works with Claude Code today with the OpenAI Codex CLI supported. 16 One check covers a narrower case: a session that claims to have read a document while the transcript shows it opened nothing at all, which is how "PAGES READ" and "READ IN FULL" headers reached tracked files in a reported Claude Code issue. 17 It went up on Show HN on September 30, 2026. 18

Why it matters. A rule written into CLAUDE.md is advice until something checks it, and the usual check is the agent's own account of what it did. A report with a quoted line per break, tied by hash to one session file, is something you can put in a review. Two limits are worth knowing first: the rule classifier is a heuristic over English instruction words, so it will mis-sort some rules and offers rulereceipt rules --include to correct it permanently; and the hash shows the report was made from that session file, while whether the file itself was edited afterwards is a separate question. 16

Try it. npx rulereceipt demo prints a sample report with no install, no config and no session; then run npx rulereceipt in a project you use an agent in. Plain checks make no network calls, and the package is published with a signed npm provenance. 16

The seven share a direction: each moves a decision out of the conversation and into something you can hold — a worktree that keeps two agents apart, a hypervisor that destroys the box only after the work is kept, a cgroup that proves the processes are gone, a hash that ties a report to one file. Take the one that matches the part of your own setup you still handle by hand. This roundup runs weekly, on Mondays.