GitHub AI Daily · 2026-11-06 (Friday)

1. Today's picks (5)

1. santiagopatinoserna/AdelIA: moving the "clinical promise" out of the prompt and into code — every clinical statement must carry a citation, no evidence means a full refusal, and red-flag signals short-circuit the model entirely

URL: https://github.com/santiagopatinoserna/AdelIA ｜ ★0 ｜ AGPL-3.0 ｜ Python ｜ Personal medical vault plus AI analysis (self-analysis and doctor briefing), FastAPI + pgvector RAG + Next.js, in Spanish/English/French

What happened

38 commits inside the window (11-05 02:11Z ~ 11-06 02:11Z), with the main line being clinical rules written into code and pinned by tests rather than "asked of the model" in a prompt.

• ⭐ The central move this issue is that the "answer contract" (services/answer_contract.py) became the single source of truth: the contract is written once, and both the RAG chat and the tool-using agent behind /dashboard compose their system prompts from it, so the two can never drift apart. The contract is hard: every clinical statement must carry an [ev_N] citation, and an interpretation without one is not allowed; the refusal wording and the language are also fixed in the contract; and the disclaimer is a fixed UI component (clinical-disclaimer.tsx) — not "please write a disclaimer yourself".
• Red flags completely short-circuit the model (clinical/red_flags.py): eleven deterministic detectors (fever ≥38°C under 3 months, non-blanching rash, respiratory distress, cyanosis, seizure, choking, anaphylaxis, bulging fontanelle, lethargy, no wet nappy for 12 hours, dehydration). When one fires, the code returns a fixed referral naming the emergency number along with the guideline behind it, and makes no retrieval, embedding or generation call at all. It deliberately over-triggers: a false positive costs a phone call, a false negative costs far more.
• "No evidence, no answer" is a number that was calibrated against real measurements: clinical retrieval is cut at evidence_max_distance = 0.19, and the accompanying document CALIBRACION_UMBRAL_EVIDENCIA.md gives the method and the numbers — keeping 240 of 240 in-corpus probes and rejecting 14 of 14 off-corpus ones. When neither the guideline search nor the user's own records return anything, the chat returns no_evidence_reply() straight from code and never calls the generative model; the agent reaches the same pipeline through its buscar_en_expediente tool and receives the same refusal.
• Extracted quotes must be literal (workers/extract.py): the model must supply a verbatim raw_quote, and any entity whose quote is not a substring of the source document is discarded. That rule is asserted by test_extract.py against the live Mistral API — and the README honestly flags the gap: a run without API keys does not exercise it.
• The patient-side threshold patient_max_distance = 0.45 is explicitly labelled "not yet calibrated" and pushed to the roadmap, rather than being treated as an established number. The whole promise is pinned by five test files: test_red_flags.py, test_answer_contract.py, test_chat_orchestrator.py, test_agent_orchestrator.py, test_evidence_threshold_integration.py.
• Concrete commits inside the window include: pinning the e2e job to ubuntu-24.04 (Playwright ships no Chromium for 26.04), passing LAY_QUERY_EXPANSION to the production API with it off by default, and feat(agent): search the corpus with her words and the clinical terms — letting the agent query the same corpus using the patient's own wording alongside clinical terms.

Why it matters

• ⭐ This is the hardest engineering form of my WeChat accounts' rule that evidence-based content must carry references and must contain zero AI hallucination — and it puts the promise in code, not in a prompt. My current position: the mechanism descriptions in my articles are written by AI and the references are added afterwards, with nothing enforcing a link between them. AdelIA's approach is that any clinical statement without an [ev_N] citation simply cannot appear in the output, rather than "please try to cite". That rule can go straight into my content pipeline and the GRPM report generator: every conclusion field in a report must carry an evidence identifier that traces back to an input document, and a conclusion without evidence is not emitted.
• ⭐ "The threshold must have been calibrated by measurement, and the calibration method and numbers must be published" — this is the same family as aureproof's "evidence package can be recomputed offline by a third party", but implemented more concretely. evidence_max_distance = 0.19 is not a guess: it is the reproducible outcome of "240 in-corpus probes all kept, 14 off-corpus probes all rejected". The direct translation to my work: each of the 40 SNP decision rules in GRPM, and each of the 24 risk dimensions in an intervention report, needs a number for "how confident am I before I dare conclude", plus the evidence for how that number was derived. Particularly worth copying is how it handles the uncalibrated patient-side number — writing down plainly that it is not calibrated, instead of letting it look exactly as trustworthy as the calibrated one.
• ⭐ "Quotes must be verbatim" closes a hole that currently costs me manual proofreading on every article. raw_quote is not a document substring, so the entity is dropped — which means an AI-invented quote cannot pass structurally, with no separate fact-checking step needed. I should add this gate to both the GRPM gene report and the 4P platform's lab interpretation.
• "Two entry points, one contract" is the correct fix for the biggest structural weakness in my 4P platform. Right now three places generate explanations from the same lab data — the dashboard's AI advice, the Excel export and the body of the intervention report — and those three are three separate code paths, so the numbers inevitably drift. AdelIA writes the contract once and assembles both prompts from it; I can build one answer_contract and have both the dashboard and the report read from it.
• AGPL-3.0: readable, not copyable. For a one-person company that does not block me from learning the design, but the code cannot be lifted directly into the 4P platform I intend to sell. Any real use needs a separate licensing path or an equivalent implementation written from scratch.

2. 12burb/hermes-fledge: taking the job of grading agent-written skills away from the model — skills have to earn their wings on evidence, and a skill born from a bad run goes on probation instead of shipping

URL: https://github.com/12burb/hermes-fledge ｜ ★0 ｜ MIT ｜ Python ｜ A plugin for Hermes Agent that moves the job of reviewing skill saves and rewrites out of the model and into an auditable evidence-scoring rule set

What happened

27 commits inside the window (11-05 02:12Z ~ 11-06 02:12Z), with the main line being patching the edge conditions of Fledge's own decision logic and writing the validation process up as a reviewable document.

• ⭐ The premise comes from a concrete user complaint: the README quotes Kilo's read of 1,300+ r/openclaw comments — the thing people dislike most about Hermes is that "self-evaluation always passes" ("It always thinks it did a good job. ALWAYS."). A skill learned from a run that quietly went wrong carries the mistake forward, and the next "self-improvement" can overwrite the skill you spent an evening tuning. Fledge's position: before Hermes saves or rewrites a skill, look at what actually happened in the run it learned from — no model grades the model.
• Scoring is entirely based on facts Hermes reports through plugin hooks, each with an explicit value: the turn ended in an error 3 points; the turn was interrupted 2; your next message is a correction ("that's wrong" / "not what I asked" / "still broken") 3 (a softer "try again" / "not quite", or a bare "No.", counts as only 1); you ran /undo or restored a /rollback right after (3, /retry is 2); a task tool was still failing at the end of the turn 2 points each (terminal tools are judged per program — a later rm tmp.txt does not mean the earlier ./fetch.sh recovered); failing two or more times in a row without recovering +1; any other tool still failing at the end 1 point each (tool failures cap at 4 in total); denying an action at an approval prompt 1 point each, max 2. A score of 3 or more is bad (strictness is tunable: lenient 4 / standard 3 / strict 2). Zero with a clean finish is clean; anything in between is unclear — it neither helps nor hurts.
• Three mechanisms make up the full lifecycle: the save gate — a skill learned from a run that went wrong is held in Hermes' own review queue instead of going live, and you see why before keeping or dropping it; probation — new and rewritten skills start as fledglings, and clean real runs graduate them while runs that keep going wrong ground them (archived, recoverable), with a save from a run you corrected immediately grounded at once; and hand-edit protection — skills you edited by hand stop being overwritten, so an agent's autonomous rewrite or delete becomes a proposal you approve or reject.
• Almost every commit in this window hardens a decision boundary: engine: an agent write Fledge failed to record is not mistaken for a hand edit (an agent-authored write the Fledge ledger missed must not be misread as a manual edit); engine: a write already staged in Hermes' queue stays held if Fledge's ledger fails (if the ledger breaks, the write stays held — nothing is let through); engine: don't resurrect a skill that was deleted before its use was judged (a skill deleted before its use was judged must not come back). There is also docs: VALIDATION.md with live results; fail-open exception disclosed; 138 tests plus VALIDATION.md: install from GitHub verified and VALIDATION.md: no local username in paths — it writes both its validation results and its single fail-open exception into the docs. The test suite is 138 tests, and it does not require Hermes to be installed (every Hermes surface is faked).
• The disclosure is deliberately narrow: it reads hook payloads (tool names, statuses, error text, turn outcome, and the first 280 characters of your next message to spot a correction) plus skill folders for fingerprinting; it writes its own SQLite file (skill names, fingerprints, verdict reasons, session/turn ids), and verdict reasons quote only short excerpts (the matched correction phrase up to 60 characters, a failing tool's error text up to 80); it never makes network calls, model calls, reads credentials, runs shell commands, spawns background processes or reports telemetry. It only adds friction, it never approves anything, and when nobody can answer, its questions are queued rather than waited on.

Why it matters

• ⭐ This hits the core hole in my "standardised expert package generation with WorkBuddy's expert-manager skill" line: how I decide whether an expert package is any good currently rests on the model grading itself. Fledge's entire README is about how unreliable that is — "it always thinks it did a good job, always". And I am mass-producing expert packages, articles and GRPM reports, where every one of them depends on the judgement "is the previous step's output trustworthy". What I need is a table of "evidence → points", not a sentence telling a model to judge for itself.
• ⭐ That points table can be turned directly into one hard rule in my intervention-report write-back checklist. The two most valuable rows are: "the user's next message is a correction" carries the highest weight (3 points) — which is exactly the objective signal Calibrate calls "did the human believe it or push back", and far more reliable than asking a model whether the user approved; and "an error the agent recovered from costs nothing" — which is the exact inverse of the "judging only model output systematically overestimates reliability" finding from a previous issue. Both directions of bias have to be avoided. Fledge's own framing is better still: the points are about observable facts — errors, interrupts, corrections, undos, still-failing tools, denied approvals — not about how good the output looked.
• ⭐ "Hand-edit protection" is a hard requirement for my expert package production flow. The expert packages I have carefully tuned (edited prompts, fixed output formats, curated reference rules) are most at risk from the next agent "self-improvement" silently overwriting them. Fledge's rule is that any agent rewrite of a hand-edited skill is demoted to a proposal. That belongs in my quality-check flow as a hard clause: once a human has edited an expert package, the auto-optimisation flow may not write to disk — it may only emit proposals.
• ⭐ "Probation and graduation" is the state machine I have been looking for to answer "how can an AI-produced artifact be trusted". Two issues ago I recorded aureproof's three-state gate (pass / fail / inconclusive) and Calibrate's 2×2 dependency matrix; this issue is the third form of the same idea: not scoring the conclusion, but giving the artifact itself a probation period. Clean real runs graduate it; persistent failures archive it — which is closer to real reliability than "it passed the eval, ship it".
• ⭐ It is unusually honest about what it cannot observe: the README states outright that a run which finishes cleanly with a wrong answer and no reaction from you looks clean, that correction detection is a phrase list tuned to miss rather than misfire, that a compound shell command only reports the exit status of its last part (./fetch.sh; rm tmp exposes only rm's result), and that turn-level evidence lives in memory, so a restart forgets runs in flight. It even says it never guesses from other output text. That "I know the boundaries of my observation" section is a mandatory column whenever I evaluate any AI quality-control tool.
• MIT licensed — readable, modifiable and commercially usable, the cleanest license of this issue's five picks.

3. senseiewok/cf-skills: a cystic fibrosis research lab turned its evidence practice into 47 commands — every answer is an evidence record with source, date, the exact fields relied on and a "limitation the code refuses to leave empty", and it never calls a language model

URL: https://github.com/senseiewok/cf-skills ｜ ★0 ｜ CC0-1.0 ｜ Python ｜ A reusable agent skill library from the Sensei Ewok Research Lab, including cf-evidence-loop (a 47-command primary-source verifier) and five skills for safely using AI around CF care

What happened

4 commits inside the window (11-05 02:03Z ~ 11-06 02:03Z), with the main line being expanding the index of primary evidence and structural-biology invariants, and making the skills discoverable by more agents.

• ⭐ The shape of cf-evidence-loop is "a researcher's fixed sequence of questions, turned into a command line": 47 commands (counted from cli.py on 2026-10-25) spanning published literature, retractions, drug approvals and labels, clinical trials, preprints, variant classifications, research funding, citation graphs — and "what this tool is allowed to reach at all". It never starts from an answer; it makes the agent walk a fixed set of questions against the public record.
• ⭐ Every output is an evidence record with four fixed fields: source, the date it was read, the exact fields actually relied on, and a limitation the code refuses to leave empty. The README's phrasing is "a limitation that the code refuses to leave empty". It never calls a language model, reaches only the sources its catalog permits, and the network rules are themselves code, with tests: obey robots.txt, one request at a time, a budget, a circuit breaker, an honest user agent.
• ⭐ "The tool refuses before it reaches" is proven by tests, not asserted: tests/test_conduct.py has at least one test per network-conduct rule; tests/test_gate.py fails any test that opens a socket — which is exactly how it proves that forbidden, manual and unknown sources are refused before the network; tests/test_hardening.py holds the defects found in review, each reproduced by a failing test first; tests/test_providers.py runs each parser against a saved response captured 2026-10-04.
• A record is checkable: the skill's SKILL.md lists all 47 commands, references/NETWORK-RULES.md lists all eleven network rules, each with the code that enforces it and its test, and the lab's website Evidence page shows one record exactly as the tool wrote it.
• The concrete actions inside this window: three successive feat(evidence,math): index landmark structures … curated alleles & R1158X / R785X / R114X thermo preset commits (folding landmark structures, curated alleles and thermodynamic presets into the evidence base one by one), plus feat(skills): Antigravity agent discovery, N1303K math-verify preset, and standalone test path resilience (adding skill discovery for the Antigravity agent, plus resilience fixes to the standalone test path).
• There is also a full set of patient-facing skills that work with no install at all: cf-ai-safe-use, cf-plain-language-rewrite, cf-visit-prep, cf-answer-check, cf-ai-tool-review, each with a plain-text version you can paste straight into any chat assistant (docs/paste-ready.md says exactly where to paste in Claude, Gemini, Copilot and ChatGPT). The catalogue itself is CC0, and each skill declares its own license; the README states plainly that this is "research, not medical advice", and spells out that "an approval date is not anyone's eligibility, a label's text is a public document and not advice, and a record is a thing to check, not a conclusion."
• It holds itself to a threshold too: the README marks every skill as "in review" — the maintainer has not yet confirmed every license or read every file, and the install notes were read from vendors' pages, not tested in each client. The repo ships scripts/check_repo.py (validates each skill's frontmatter and links), make_index.py --check (validates the index and the README audience table are not stale), make_tested_grid.py --check (recounts the "where each skill has been tried" matrix) and pin_catalog.py --check (validates the catalog against its lock file), all run on every pull request.

Why it matters

• ⭐ This is the most thorough implementation I have seen of my account's rule that evidence-based content must carry references: the evidence collection itself is code that never goes through a language model. Each of its evidence records has four fixed fields, and the "limitation" field is forced non-empty at the code level — that is one order of magnitude stronger than "remind the model to mention limitations", and the model is excluded from the chain entirely, so there is architecturally nowhere for a hallucination to sit. Every evidence-based article I publish and every conclusion in my GRPM report could adopt this four-field shape: source / date read / which exact fields were relied on / a limitation that may not be left blank.
• ⭐ "A record is a thing to check, not a conclusion" can become a judgement criterion in my content standards. Today I decide whether an article "has a basis" by asking whether the references look real; what it offers instead is a mechanism a third party can recompute — a command list, a rule list, and the corresponding tests. My 140 lab reference ranges and 40 SNP decision rules would gain real credibility with such a checklist in place — a piece of work that is currently far more convincing than anything I have shipped.
• ⭐ tests/test_gate.py failing any test that opens a socket is an engineering trick I can take away today. It turns "I guarantee nothing leaves the machine" from a promise into an assertion that turns CI red. If my lab-report OCR pipeline ever calls an external API, I should equally have a hard test for which data may never leave.
• ⭐ The five patient-facing skills map directly onto "how ordinary people should safely ask AI about health". My readership includes large numbers of people who use AI to ask about lab results, supplements and biomarkers. "General information only, no dosages, no diagnosis, no eligibility, and every answer labelled with what it rests on", plus the reminder that if this is about your own health, think about who can see your chat — a work account belongs to your employer — can be translated almost verbatim for my readers, and the CC0 licence means there is no attribution or permission barrier.
• CC0-1.0 for the catalogue plus per-skill declared licences means the work is free to take, adapt and even use commercially — the friendliest licensing form I have run into for a one-person company.
• This issue's only regret: the lab marks its skills as "in review" (the maintainer has not confirmed every license or read every file), so the methodology can be used directly, but every piece of clinical content must be re-verified before it goes into my articles — the README says this plainly.

4. Ashiwel/Gaskin: making danger signals into rules that AI cannot override, hide or delete — and recording "not done" as unknown, never as normal

URL: https://github.com/Ashiwel/Gaskin ｜ ★0 ｜ AGPL-3.0 ｜ TypeScript ｜ A care planner for midwives and community health workers, covering conception through the child's first 1,000 days, with a rules engine and optional AI, running on a phone, a shared basic phone or a USB stick offline

What happened

4 commits inside the window (11-05 02:09Z ~ 11-06 02:09Z), with the main line being wiring up the rules engine, visit flows, languages, onboarding and hosted/offline builds in one pass, followed by a second round of UI redesign and a security review.

• ⭐ The hardest design choice is that "danger-sign alerts come from fixed rules that no AI can override or hide": severe pre-eclampsia, heavy bleeding, newborn danger signs and thoughts of self-harm raise an alert stating what to do now and where to refer, and the matching plan items are locked so that no one — not a health worker, not an AI reply, not an MCP tool — can remove them. The README's phrasing is "Danger alerts can be acknowledged but never dismissed".
• ⭐ "A test that was not done is recorded as unknown, never as normal": a test that was not performed is recorded as unknown rather than normal, and where an unknown result could hide danger it is escalated. This is the single line of this issue that stings hardest.
• ⭐ "AI is optional, safety comes from the rules alone": the rules engine builds every plan from WHO antenatal care (2016) and postnatal care (2022) recommendations plus each country's national schedules for antenatal contacts, vaccines and malaria prevention, and every item shows its evidence grade and source; location profiles add local foods, common traditional practices and named referral hospitals for the region. AI is used for exactly three things: writing messages in plain words and in her language, triaging free-text replies, and ordering the caseload. The README is explicit that "Gaskin works fully with no AI at all: the rules build the plan and templates write the messages."
• ⭐ AI can come from anywhere, and "what the AI sees" is visible: the hosted demo on claude.ai, her own API key for any OpenAI-compatible service, Anthropic or Gemini, a small model on her own laptop or in the browser, or any AI app she already has via copy and paste. Before any text leaves the device, Gaskin removes names, phone numbers, places and exact dates and replaces them with placeholders, then puts them back when the answer arrives; a "What the AI sees" panel shows the exact text that would be sent.
• ⭐ Privacy and safety are written as auditable clauses: keeping records and receiving messages are two separately consented things, and a guardian is involved for mothers under 18; de-identification is on by default for every AI call; and the audit log records what kind of data was sent, where, and how many bytes — with no content. The README is precise that pseudonymised data is still personal data under Nigeria's Data Protection Act 2023, Kenya's Data Protection Act 2019 and Ghana's Data Protection Act 2012, so cloud AI still requires consent and processor agreements, while switching AI off, or running it on the device, avoids the transfer altogether. PINs are stored only as salted PBKDF2 hashes, records can be encrypted with a passphrase, and the desktop launchers listen on 127.0.0.1 only and serve a fixed list of files.
• ⭐ It publishes its own vulnerabilities and unresolved items: a security and QA review (docs/security-review.md) found 37 issues on 5 November and records how each was fixed or why it is still open; npm audit --omit=dev reports no known vulnerabilities in the app, the connector or the server. The clinical status is equally plain: this is a prototype, every mother, worker and facility in it is synthetic, the clinical rules come from published guidelines but await review by the clinical lead, Elizabeth Okang, and an independent clinical board, and it is not for patient care yet.
• The concrete commits inside the window: Gaskin prototype: rules engine, visits, languages, onboarding, hosted and offline builds; then Second build: Untitled UI redesign, siblings, worker accounts, personal use, visit v2, geography, security review, desktop zip (adding sibling modelling, worker accounts, a personal-use view, visit v2, geography profiles, the security review and a desktop zip). Language packs cover Hausa, Yoruba, Igbo, Nigerian Pidgin, Arabic, Kiswahili, Twi, French and Portuguese, plus a dozen Southern and East African languages, all marked "await review by native-speaking midwives, and each line says so"; Pidgin is offered but never chosen by default; for languages with no pack it honestly shows "Coming soon" and uses plain English rather than guessing.
• ⭐ The consent model is split into four independent gates, which is unusual and important: consent to keep records, consent to receive messages, and separately a "de-identification is on by default for every AI call" setting. And a fourth gate sits at the level of clinical status: the tool itself carries a "not for patient care yet" marker and refuses to be treated as a diagnosis engine.

Why it matters

• ⭐⭐ "A test that was not done is recorded as unknown, never as normal" — this line is almost written for my lab-report OCR pipeline. My current behaviour is "on recognition failure, skip that item and continue", which produces a report where "of 24 risk dimensions, only 18 were actually recognised" — and the report does not know it. Gaskin's rule is: not done ≠ normal, and when unknown could hide danger it must escalate. Both halves can become two hard rules in the 4P platform: first, any lab item the OCR missed must be explicitly marked "not obtained" and must never fall into the "normal" band when the algorithm averages; second, when a missing item belongs to a critical-value range (extreme glucose, uric acid, lipids), the absence must trigger escalation instead of a silent skip.
• ⭐ "AI is optional, safety comes from the rules" should become an architectural principle for the 4P supplement platform and go into the requirements document. My current shape is the inverse: AI directly recomputes and writes an entire plan, with the constraints living in a prompt. Gaskin's split is rules for safety, AI for language and ordering — my hard floor (no intensified deficit below BMI 18.5, no more than 1.5% body weight per week, an 800 kcal floor, an age minimum) exists only in a prompt right now, which makes it a suggestion rather than a constraint.
• ⭐ "Danger alerts can be acknowledged but never dismissed, and no AI reply or MCP tool can remove a locked safety item" — a semantic tier my 4P platform is missing. In my current plan, "the user asks to remove a supplement recommendation" is something that can happen (changing the prompt is enough). Gaskin grades it: an alert can be acknowledged but not ignored; a locked item can only be changed by a human, and never by AI. This matters for supplement safety — "stop it" and "ignore it" must be treated as two different things.
• ⭐ "The audit log records only the type, the destination and the byte count — never the content" — this is a log-redaction shape I can copy directly into the 4P platform. I noted in a previous issue that agent-desktop's snapshots contain the user's real screen content, clipboard included. A log must be able to prove that nothing leaked while itself not being a leak — Gaskin's design is exactly that answer.
• ⭐⭐ It is also a complete counter-sample of what a health AI should look like, and it puts the boundaries where they are most visible: the README states outright that "Gaskin is not a doctor", every screen nudges the user to register at a clinic and see a health worker and shows her country's emergency number, and the skill side states it is "not a medical device, not a clinical tool, not a claim about treatment." As a health-content creator, the way this project handles identity boundaries is an unusually clean reference: put "I am not a doctor" in every place the user will actually see it, not only in a footer.
• "One plan per mother-child pair, recomputed on every new record across 1,000 days; every item, alert and vaccine says which child it is about" — that multi-subject attribution design transfers directly to the GLP-1 nutrition companion's "mother plus child" or "an elderly parent plus a family member" scenarios.
• AGPL-3.0: readable, not copyable; and since it states "not for patient care yet", any citation of its clinical rules must carry that status.

5. lud3nb3rg/DataNyx: letting an AI agent work with your data while never seeing it — what you hand over is a value-free schema and synthetic rows, not your patients' data

URL: https://github.com/lud3nb3rg/DataNyx ｜ ★0 ｜ MIT ｜ Python ｜ Turns files and databases into value-free schemas an agent can write code against, and replaces names and identifiers in free text with placeholders

What happened

25 commits inside the window (11-05 02:11Z ~ 11-06 02:10Z), with the main line being pushing an idea into a complete working pipeline in one pass: schema / anonymisation / synthetic data / multi-format sources / MCP server / CI / leak fuzz tests.

• ⭐ The core contract fits in one table and is remarkably clean: for structured data (datanyx schema) the agent gets field names, types, formats, nesting, primary and foreign keys — and never values, examples, enum labels, counts or statistics; for free text (datanyx anonymize) the agent gets the text with names and identifiers replaced by placeholders such as <PERSON_1> and <EMAIL_1> — and never the identifiers themselves, with the documentation stating this is best-effort and needs human review.
• ⭐ The agent gets "the shape of the table and the story in the text, and none of the values", and can try its code on fake rows generated from the schema (docs/synthetic-data.md).
• ⭐ The commits inside this window show the pipeline forming in order: Add DataNyx: value-free schemas of data for AI agents → Add text anonymization with NER and ignore data files in git → Add opt-in mapping and restore for anonymized text (the mapping is not given by default, must be enabled explicitly, and can be restored) → Add CSV, TSV, Parquet, Excel, YAML and XML sources → Add streaming JSON, folders, library API, MCP server and new output formats → Add CI, lint and type checks, doctor command, Windows mapping permissions and leak fuzz tests → Add MIT license and move development to uv → Update README.
• ⭐ "Leak fuzz tests" and CI landed in the repository together — meaning "can this leak?" is not something a human eyeballs but something fuzzing keeps pressing on continuously.
• It is not a "redaction library" but a whole workflow: the documentation index contains docs/agents.md (three ways in: datanyx protect, a guard hook and the MCP server), docs/security.md (what is guaranteed, what is not, and the known limits), docs/schema-diff.md (detecting schema changes in CI), and docs/deployment.md (PyPI, Docker, a pre-commit hook, a GitHub Action, a shared MCP server). docs/schema-diff.md is especially important — it turns "the data shape changed" into a CI failure rather than a production incident.

Why it matters

• ⭐⭐ The biggest practical risk my 4P precision-nutrition platform carries right now is the moment "patient data is fed to a model". Lab sheets, physical-exam reports, questionnaire answers — once they leave the machine they are gone. What I do today is basically "write my own regex redaction, then send it to the model", whereas DataNyx offers a different route: the values never leave the machine; the model only receives a schema and fake rows, and the code it writes then runs against my real data locally. For needs like "write me a script that interprets this lab panel" or "write me an importer for my supplement records", this route is more thorough than redaction.
• ⭐ The "value-free schema" shape is an order of magnitude stronger than describing column names by hand, and it is naturally reusable. My 4P platform's lab data structure (field, unit, reference range, required or not) should be a version-controlled schema anyway — and once that exists, "hand the model a description without the values" is free. The docs/schema-diff.md rule matters especially: any change to my 140-item lab field table should trigger a review in CI, rather than being discovered when some report quietly omits a marker.
• ⭐ "The mapping is not given by default, must be enabled explicitly, and can be restored" — this is the part redaction tools most often get wrong. Many redaction schemes are one-way and irreversible, so once the mapping is lost nothing can be cross-checked; DataNyx makes the mapping an explicitly enabled separate artifact, which lets "I can restore it when I need to" and "the model does not get it by default" coexist. My lab-report OCR pipeline has no "keep the original reference for cross-checking" layer at all — that mapping layer is what I should add.
• ⭐ MIT licensed — readable, modifiable and commercially usable — and it is a self-contained small tool (schema / anonymize / protect / MCP server / doctor / schema-diff) rather than a heavyweight framework. For a one-person company, exactly the kind of independent capability that can be dropped into a product.
• ⭐ It is the other half of a problem I recorded in a previous issue: "the OCR only recognised 18 of the dimensions without knowing it." DataNyx solves "don't let data go out"; it does not solve "is the extraction complete" — both are needed to close the loop: one governs the outbound boundary, the other governs completeness and reviewability of extraction.

2. Category roundup

① AI Coding / coding agents and the skill ecosystem

② Medical and clinical research AI plus agent skill libraries

③ Health management, nutrition and food AI

④ Model foundations and agent infrastructure

3. Trends today

The clearest thread this issue is that "write the promise into code, not into the prompt" is spreading from medical AI into agent engineering as a whole. AdelIA turns the clinical contract, red-flag short-circuiting, verbatim quotes and the refusal threshold into code with tests; cf-skills turns evidence collection into 47 commands that never touch a language model; hermes-fledge turns "who does the grading" into an auditable points table; Gaskin turns danger signals into locked rules AI cannot move; DataNyx turns "data never leaves the machine" into a value-free schema. Four unrelated projects, one shared question — under what conditions should I refuse to output, and who proves I did not cross the line. This is the third stage of a thread I have been tracking: aureproof's three-state gate and Calibrate's 2×2 dependency matrix made uncertainty executable, and now the constraints are sinking into code with CI and tests keeping watch.

Second, "evidence" is turning from a citation format into a data structure with fixed fields. cf-skills's evidence records have four fixed fields (source / date read / the exact fields relied on / a limitation that may not be left empty); every plan item in Gaskin carries an evidence grade and a source; every clinical statement in AdelIA carries an [ev_N]; every verdict reason in hermes-fledge carries a short excerpt with a character cap. The common thread: evidence is no longer prose, it is schema — comparable and regression-testable. The implication for content production is direct: evidence-based content that cannot be structured can only be proofread by hand; once it is structured, regression tests have somewhere to land.

Third, low-star projects remain the richest seam to mine, and this issue brought two new shapes — "skills and rules grading themselves" (hermes-fledge, skill-studio's blind review queue, skilltrim's token review) and "the outbound boundary for health data" (DataNyx, Gaskin's default de-identification, cf-skills's network rules as code). Forty of the 89 entries have 100 stars or fewer, and the six densest of them all sit in those two shapes. Stars measure attention, not portability — and for a one-person company, "can this design be dropped straight into my platform" matters far more than "how many people starred it".

Fourth, the model-routing layer keeps getting more homogeneous in form, but two drifts this issue are worth noting. Of the 37 infrastructure entries, ClawRouter, weave-os router, HiRoute, codex-router, dsh-model-router, brick-SR1 and NadirClaw are all "local gateway + multi-model routing + cost optimisation" and look almost identical; the real differences live in the details — Hermes-router specifically preserves output budgets given to reasoning models by coding clients, Switchyard insists on keeping each provider's native response format, dsh-model-router plugs straight into the local dsh ecosystem, and speakeasy's gram lifts the battlefield to an enterprise AI control plane (permissions, threat detection, token cost visibility). The implication is that this layer's competition has shifted from "can it connect" to "will it eat other things on the way" — budget, format and credential ownership are becoming the real battleground.

Fifth, license misclassification remains alarmingly high, and this issue again produced cases where the API and the file disagree. Of the 89 entries, eight reported NOASSERTION; reading the LICENSE text one by one showed four of them are actually MIT / MIT-with-rider / Apache-2.0 — commercially usable — and two are PolyForm Noncommercial, FSL-1.1-ALv2 and BUSL-1.1 — commercially restricted. Plus 16 repositories have no LICENSE file whatsoever (each individually confirmed via the core endpoint). For a one-person company this is a matter of survival: MIT and Apache-2.0 account for 60 entries (67%) and are safe to build on; the 5 AGPL-3.0 repositories plus the 1 PolyForm Noncommercial can be read but not copied; and for the 16 "undeclared" entries I must ask the author before writing a single line.

4. Repo index

https://github.com/12burb/hermes-fledge
https://github.com/777genius/universal-agent-plugins
https://github.com/AIDotNet/pi.net
https://github.com/ArthurC02/SkillHub
https://github.com/BetaYao/seahelm
https://github.com/cquinones100/switchboard
https://github.com/Dicklesworthstone/eidetic_engine_cli
https://github.com/Elisarosah/dwg-agent-skill
https://github.com/ForceInjection/AI-fundamentals
https://github.com/Gentleman-Programming/engram
https://github.com/hadins-ntvgraph/niyusha
https://github.com/iha2/superlite
https://github.com/JayCommit/skilltrim
https://github.com/kenn-io/agentsview
https://github.com/kajisho5/ffmpeg-skill
https://github.com/LetA-Tech/mellions-coxen
https://github.com/microsoft/hve-core
https://github.com/milesroxas/skill-studio
https://github.com/northraystudio/maruda
https://github.com/pace551/aspec
https://github.com/ruvnet/metaharness
https://github.com/Sempera-AI/sempera-ai
https://github.com/skillcdn/skillcdn
https://github.com/sudoprivacy/sudocode
https://github.com/thebtf/engram
https://github.com/theonepichael/agent-toolkit
https://github.com/vaayne/agent-kit
https://github.com/waltzofpearls/deepcove
https://github.com/ashlrai/locus
https://github.com/ashlrai/phantom-secrets
https://github.com/physiclaw/PhysiClaw
https://github.com/edison7009/EchoBird
https://github.com/santiagopatinoserna/AdelIA
https://github.com/senseiewok/cf-skills
https://github.com/arman-jalili/health-policy-simulator
https://github.com/GlennRTC/decidere_v2
https://github.com/Mnemosyne-OS/MnemoHealth
https://github.com/OWKiriella/glioma-grading-uncertainty
https://github.com/sanjin925/HiFSA
https://github.com/josephrelish5-tech/healthos-ai
https://github.com/JohnZhang-DataForge/healthcare-data-platform
https://github.com/maboitumelo11/Berea-health-notes
https://github.com/Anant6125/AI_Based_Personalized_Health_Risk_Asseament_System
https://github.com/Ashiwel/Gaskin
https://github.com/khs14/Nutrayo
https://github.com/Yidu-ZSC/nutri-sphere
https://github.com/sarthak0501/nutritracker
https://github.com/jarlh19/mi-plato
https://github.com/david-stefan-hermann/Fleisch-Teufel
https://github.com/mwdearing/health-nutrition
https://github.com/jackkoesters13/personal-health-os
https://github.com/MichaelSalander/HealthAI
https://github.com/lud3nb3rg/DataNyx
https://github.com/NVIDIA-NeMo/Gym
https://github.com/NVIDIA-NeMo/Switchyard
https://github.com/MCPJam/inspector
https://github.com/activepieces/activepieces
https://github.com/QuantumNous/new-api
https://github.com/BlockRunAI/ClawRouter
https://github.com/weave-os/router
https://github.com/duolahypercho/codex-router
https://github.com/Alice-Marx/dsh-model-router
https://github.com/Shaf2665/Hermes-router
https://github.com/higress-group/HiRoute
https://github.com/NadirRouter/NadirClaw
https://github.com/regolo-ai/brick-SR1
https://github.com/xiayu1987/noobot
https://github.com/angel291592/Intent-Router
https://github.com/heddles/agent-orca
https://github.com/openma-ai/open-managed-agents
https://github.com/opencrabs/opencrabs
https://github.com/elizaOS/eliza
https://github.com/loopx-project/loopx
https://github.com/withcoral/coral
https://github.com/OpenAgentsInc/openagents
https://github.com/google/adk-js
https://github.com/PrefectHQ/fastmcp
https://github.com/getagentseal/codeburn
https://github.com/skyhook-io/radar
https://github.com/bethington/ghidra-mcp
https://github.com/fastcrw/crw
https://github.com/redhat-et/ripwire
https://github.com/Dicklesworthstone/mcp_agent_mail_rust
https://github.com/Hona/strobe
https://github.com/openscout-app/scout
https://github.com/MichengAI/dsh-skills-manager
https://github.com/spacedock-dev/spacedock
https://github.com/edrisranjbar/lifeos
https://github.com/speakeasy-api/gram