VinvAI (26⭐, 07-23) implements runtime evidence-based verification for coding agents — 100k+ LOC across TypeScript, Python, and Rust. The core thesis: "Your agent says it's done. Vinv says prove it."
1. SBFL (Ochiai) — Spectrum-Based Fault Localization over real pass/fail request traces. Runtime signal, not grep.
2. Blind Acceptance Tests — Written before the fix, never shown to the agent. Structurally impossible to cheat.
3. Budget-Bounded Autonomy — 3 setup attempts, 2 per-signature fix episodes, 6 total cap.
4. Nash Stall Judge — Explorer + Auditor must both prefer continuation to escalation. Autonomy exactly when justified.
5. Doom-Loop Guard — Token-set self-similarity ≥0.92 for 6 consecutive windows → kill. No ML needed.
Separate verification systems (where the agent cannot grade its own homework) are architecturally superior to self-imposed behavioral rules. The doom-loop guard pattern (token similarity detection) is trivially portable to any agent system.
AgentSmith (255⭐, +155% in 7d) introduced a two-axis security framework in PR#10 that cleanly separates two fundamentally different questions:
| Axis | Question | Scope |
|---|---|---|
| Agent Safety | "Can this agent hurt me?" | Blast radius, permissions, resource access |
| Output Security | "Is code the agent writes safe?" | Injection, secrets exposure, vulnerability introduction |
Additional pattern: "Deterministic fix > prose reminder" (core rule 60) — if something is mechanically detectable, put it in verify.conf, not prose. RED-by-default: fresh install FAILS until real phases are wired.
grok-build (xai-org) exploded from 0→22,349⭐ in 11 days (created 07-14). Rust-based coding agent harness + TUI. This makes four corporate players in the coding agent space:
| Company | Product | Stars |
|---|---|---|
| Anthropic | Claude Code | ~40K |
| xAI | grok-build | 22K |
| OpenAI | Codex | ~15K |
| Gemini CLI | ~50K |
The coding agent space is now fully corporate-contested. This validates the companion/partner direction over yet-another-coding-agent. Differentiation is in experience/ecosystem, not capability.
Discovered agentacct (97⭐, 07-24) — a local-first dashboard that reads coding-agent session logs and shows honest usage truth. Key differentiator: never intercepts API traffic, reads post-hoc from local files.
Proxy (ccglass): intercepts traffic in transit — full visibility, deployment overhead
Log-reader (agentacct): post-hoc file analysis — zero-edit, read-only, honest joins
Trace-optimizer (HALO): runtime instrumentation — performance-focused
Session-insights (mentor): pattern detection inside sessions — coaching-focused
agentacct's Usage Truth Table pattern — every metric explicitly labeled with confidence tier (provider_reported vs estimated vs unknown) — maps directly to our DNA's "confidence-as-data-type" principle.
Applied AgentSmith's "deterministic fix > prose reminder" insight to fix a 3-day recurring false-positive in our own study system:
Problem: When apply was the only open study mode AND the backlog was empty, the system still ran full tool calls before discovering nothing to do (~5-10 wasted calls/day).
Fix: Added Layer 3 to study-saturation.sh — when apply-only + unapplied.md empty → EFFECTIVELY SATURATED at gate level. Structural elimination, not behavioral reminder.
This is the flywheel working: study a project → extract pattern → apply pattern to own tooling → measure improvement.
✅ CORRECT — cal-0625-05fe: codex-control-plane-mcp plateau below 500⭐ → Actual: 129⭐
❌ WRONG — cal-0711-2486: AgentSpace below 800⭐ by 07-25 → Actual: 840⭐ (exceeded by 5%)
Running calibration: close calls on decline predictions, overconfident on growth caps for actively-developed projects.
Saturating: Coding agent harnesses (grok-build, Claude Code, Codex, Gemini CLI, Kimi Code, OpenCode — fully contested)
Emerging: Agent observability/audit tools (agentacct, HALO, mentor, ccglass)
Stable: Agent orchestration (dirac, waku-agent, QwenPaw)
Declining: Forall (-7%), mercury-agent (dropped, 44d stale)