GitHub AI Daily · 2026-10-23 (Friday)

1. Today's picks (5)

1. Vector Institute open-sources Odyssey: an interpretable patient-timeline foundation model that treats "every claim is falsifiable" as engineering discipline

URL: https://github.com/VectorInstitute/odyssey ｜ ★62 ｜ Python ≥3.12 ｜ ships with an arXiv paper; still committing today

What happened
Vector Institute open-sourced an interpretable foundation model of the patient clinical timeline: data from MIMIC-IV / eICU-CRD / GEMINI flows through MEDS extraction and tokenization into the backbone, which produces event forecasting, calibrated survival curves, alerts, and concept readouts. The default hybrid backbone interleaves Mamba-2 blocks with chunk-local attention, trained by truncated backpropagation over persistent packed patient lanes, so a record of any length streams at constant memory per step; a standard transformer arm exists to show the findings don't depend on the backbone. At the core is the concept bottleneck module: concept labels come from a LOINC-keyed rule registry (all three KDIGO AKI legs, Sepsis-3, SIRS, qSOFA, vasopressor exposure, etc.), computed as the chart unfolds and never back-filled from later events; forcing a concept moves the hidden state by an exact, known displacement — the same push doubles as a training-time loss (steering).

The README opens by declaring "this is not a diagnostic system, not a claim that the sequence model beats bespoke baselines, and not interpretability by construction," attaches a test to every claim, and records where the model falls short in a registry. Today's commits are dependency security bumps (pillow 13.0.0).

Why it matters

• Open-source clinical time-series projects are plentiful, but ones that treat falsifiability as engineering discipline are rare: labels never back-filled, concept→hidden-state displacement exactly computable, a test per claim, and failures logged in a registry. This is a verifiable sample of what "model interpretability" can look like in practice, rather than a README slogan.
• Directly usable for medical research: Sepsis-3 labels validated against an independent reimplementation, 29/29 data-source rule coverage on MIMIC-IV and eICU-CRD, thresholds versioned with each checkpoint — the "clinical rule registry" pattern can be lifted directly into cohort studies or retrospective hospital analyses.
• The negative framing is also valuable: by explicitly not being a diagnostic system, it shows research-grade medical open source is converging on "capability-claim discipline," continuing the trend we flagged as "compliance written into the code path."

2. Google releases Elephant-Goldfish Model: a spec-driven development plugin where zero-context subagents stress-test your spec before you write code

URL: https://github.com/google/elephant-goldfish-model ｜ ★165 ｜ Apache-2.0 ｜ cross-harness plugin; merged a Claude read hook today

What happened
EGM is Google's open-source Spec-Driven Development plugin for AI coding agents: a deep-context Elephant session drafts the specification, then a swarm of zero-context Goldfish subagents stress-tests it — each Goldfish carries a single spec clause and none of the development session's context, hunting for holes so they can be fixed before the first line of code is written. Install coverage is unusually broad: ask any agent to Install <repo>, Antigravity (agy plugin install), Claude Code (plugin marketplace), Codex, and Claude Cowork / ChatGPT each have their own path. Commands include /egm-brainstorm (explore problem boundaries + an early Goldfish-swarm test) and the draft pipeline. Today's commits fix bootstrap prompt truncation and land "Claude transcript lookup + a PreToolUse hook approving plugin file reads."

Why it matters

• Following android/skills and NVIDIA/skills, this is another platform vendor turning methodology into an official plugin, with a clear bet: instead of asking one model to hold all context, have unpolluted observers review the spec repeatedly — "zero context" is the selling point, and context contamination is treated as a property of the test subject, not a bug.
• The install-path table matters: EGM lists Antigravity, Claude Code, Codex, and "any AI agent" as first-class citizens. Official skills are going cross-harness fast, and the skill layer is de facto standardizing.
• For teams: the loop "write spec → subagent red-team → then code" is cheap to trial on any harness, and especially suited to medical/health requirements documents where the cost of misreading is high.

3. Nous Research Hermes Agent: the 256k★ open-source agent harness that makes "environments sleep when idle" a default capability

URL: https://github.com/NousResearch/hermes-agent ｜ ★256,253 ｜ MIT ｜ installers for every platform, native Windows and Android (Termux)

What happened
Nous Research's hermes-agent crossed 256k stars this week, with main-branch work today fixing Windows desktop builds (uv cache path issues). The capability list: a built-in cron scheduler (natural-language unattended daily reports, nightly backups, weekly audits); delegating subagents (Desktop lets you pick provider, model, and limits per subagent, and Python scripts can call tools over RPC, collapsing multi-step pipelines into zero-context-cost turns); six terminal backends — local, Docker, SSH, Modal, Daytona, and Vercel Sandbox, plus plugin backends such as Singularity/Apptainer — where Modal and Daytona offer serverless persistence: the agent's environment hibernates when idle and wakes on demand, costing nearly nothing between sessions ("run it on a $5 VPS or a GPU cluster"); native Windows (CLI/gateway/TUI without WSL) and a signed APT repository for Android/Termux. It also ships a research-ready mode: batch trajectory generation and trajectory compression for training the next generation of tool-calling models.

Why it matters

• The harness race is white-hot (OpenHands, deer-flow, openhuman all active the same day), and Hermes's differentiation is explicit: turning environment cost into a scheduling problem — sleep/wake plus a unified six-backend abstraction changes the cost structure of "hundreds of agents queued up to work" by orders of magnitude.
• It treats "trajectory generation/compression" as a product feature, meaning an open-source harness doubles as a training-data factory — the boundary between model vendors and harness vendors is being redrawn by projects like this.
• Many medical/health workloads are exactly "scheduled + long-running + low-interaction" (follow-up reminders, nightly reports, dietary audits); cron + hibernating environments + multiple backends is practically shaped for them.

4. The php2shell (CVE-2026-109618/109619) ecosystem explodes: a CVSS 9.2 PHP pre-auth RCE, with PoCs, scanners, and a vendor checker appearing in the same window

URL: https://github.com/ikow/php2shell-poc ｜ ★1,526 ｜ also see https://github.com/assetnote/php2shell-scanner (★294), https://github.com/eness/php2shell-bypass-aslr-exp (★958), https://github.com/openai/php2shell-checker (★823, covered yesterday)

What happened
Two CVEs combining PHP's session.upload_progress with the Zend engine's OOM bailout keep escalating: five independent pre-auth RCE chains affecting 14 years of code — PHP 5.4.0 (2012) through 8.5.11 — with some chains requiring no application-level vulnerability at all, impacting roughly 78% of all websites (WordPress 43%, Joomla, Drupal, Laravel, Magento, and every default PHP configuration). Fixed versions: 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12. Within 24 hours GitHub sprouted a complete offense-defense ecosystem: ikow/php2shell-poc (1,526★, with Suricata/Sigma/ModSecurity detection rules), eness's exploit requiring no modifications to the official release (958★), assetnote's high-fidelity scanner (294★), and OpenAI's official checker (823★, covered yesterday, still climbing in stars today), plus paid exploits circulating on the side.

Why it matters

• This is the most concrete security alert of the issue for self-hosted health/nutrition apps: many of the personal health record, diet tracking, and MCP gateway projects covered in previous issues run on PHP stacks; if the underlying PHP is unpatched, the health data (PHI) that agents read and write sits directly behind a pre-auth RCE.
• Both sides completed supply within 24 hours (PoC + detection rules + scanner + vendor checker); the open-source security response cycle has compressed to "days" — ops scheduling logic has to change accordingly; weekly cadence no longer cuts it.
• The episode also cements a new normal: AI vendors shipping detection tooling (OpenAI's checker) as part of vulnerability response. Hybrid model+code auditing is becoming a fixed role in security incidents.

5. Bernstein: a declarative governance layer for AI agents — write the rules once, the runtime enforces them

URL: https://github.com/sipyourdrink-ltd/bernstein ｜ ★1,372 ｜ distributed via PyPI + GHCR ｜ still shipping dependency security updates today

What happened
Bernstein positions itself as the open-source governance layer for AI agents: you write the rules declaratively, and it enforces them uniformly — every agent action passes this layer of written rules first, violations are blocked, and an audit trail is produced. The engineering is mature: PyPI package and GHCR images published, full CI, dependency security updates followed the same day (certifi 2026.10.19, etc.), a PR stream numbered 6600+ within a week — community activity and code volume are well past personal-project scale.

Why it matters

• Over the past two issues we tracked "skill supply-chain governance" (NVIDIA/skills' OMS signing, aiskillstore's security-audited marketplace); Bernstein pushes the same idea one layer down: not governing where skills come from, but governing what agents can do at runtime — together the two layers make a complete agent governance stack.
• Declarative rules are a hard requirement for medical use: PHI access, outbound data, paid API calls — prompt-level constraints are unreliable, per-agent self-checks are unreliable; declarative + uniformly enforced + audit trail is exactly what compliance audits want.
• It takes the fifth slot over openfoodfacts (whose commits today are maintenance-level) because governance is this week's clear trend node; openfoodfacts stays in the category table as the nutrition data backbone, and readers can compare both.

2. Category roundup

① AI Coding / Programming Agents & Skill Ecosystem

② Medical / Clinical Research AI & Agent Skill Libraries

③ Health Management / Nutrition & Food AI

④ Model Layer & Agent Infrastructure

3. Trends today

1. Differentiated bets after the harness race went white-hot: hermes-agent (hibernating environments + six backends), openhuman (500 agents on a $10 VPS), deer-flow (sandbox lifecycle), omnara (managed shutdown semantics) were all active the same day — the harness competition has moved from "can it run" to cost structure and lifecycle management. Whoever leads by an order of magnitude on idle cost and crash recovery stays at the table.
2. Platform vendors keep productizing methodology: Google EGM turned Spec-Driven Development into an official plugin via "zero-context subagent spec review," on the same path as android/skills and NVIDIA/skills — the skill layer is shifting from community grassroots to official supply + standardized cross-harness installs. Official plugins should carry more weight in selection decisions.
3. "Anti-narrative discipline" appears in research-grade medical open source: Odyssey opens by declaring "this is not a diagnostic system," attaches a test to every claim, and logs failures in a registry; combined with notepilot's self-declared tripwire yesterday, proactively bounding your capability claims is becoming a positive for medical AI — reviewers (including us) should treat it as a maturity signal, not weakness.
4. The agent governance stack is taking shape: the supply-chain layer (skill signing, audited marketplaces) and the runtime layer (Bernstein's declarative blocking) both matured within two weeks; "trust first, intelligence second" (from the Oct 21 issue) now has concrete product form. The question for health/medical teams is no longer "whether to govern" but which of the two layers to land first.
5. php2shell reminds us: foundation debt in self-hosted health apps: a pre-auth RCE touching 78% of websites with a complete offense-defense ecosystem inside 24 hours. Self-hosted health/nutrition/MCP projects covered in previous issues should verify their PHP patch level (8.2.35+/8.3.36+/8.4.27+/8.5.12+). The health-security mini-column proposed in the Oct 20 issue officially starts tracking incidents like this one.

4. Repo index

AI Coding

• https://github.com/google/elephant-goldfish-model
• https://github.com/code-yeongyu/oh-my-openagent
• https://github.com/omnara-ai/omnara
• https://github.com/sipyourdrink-ltd/bernstein
• https://github.com/aiskillstore/marketplace
• https://github.com/mblode/agent-skills
• https://github.com/yschimke/compose-ai-tools

Medical / Clinical Research AI

• https://github.com/VectorInstitute/odyssey
• https://github.com/medplum/medplum
• https://github.com/DIGI-UW/OpenELIS-Global-2
• https://github.com/jgouviergmail/LIA-Assistant
• https://github.com/ravinelango/prior-auth-appeal-eval

Health Management / Nutrition & Food AI

• https://github.com/openfoodfacts/openfoodfacts-server
• https://github.com/brandonp2412/Flexify
• https://github.com/gman46336-cloud/NourishAI-Forge
• https://github.com/DrBradStanfield/roadmap
• https://github.com/Helioswei/HowToLiveBetter-Kit

Model Layer & Agent Infrastructure

• https://github.com/NousResearch/hermes-agent
• https://github.com/bytedance/deer-flow
• https://github.com/unslothai/unsloth
• https://github.com/browser-use/browser-use
• https://github.com/tinyhumansai/openhuman
• https://github.com/ikow/php2shell-poc
• https://github.com/assetnote/php2shell-scanner