Skip to content
Skip to content
Daily briefingOctober 9, 2026

Agents Are Learning to Build Evidence Before They Act

7 movers4 research signals1 risk10 min read

🧭 Today's Thesis

The agent stack is turning context selection into an evidence-construction step that can be traced, challenged, and separated from the final effect. RECAST makes the research version explicit: the right context may need filtering, aggregation, or computation rather than one similar passage. Docker Agent's v1.145.0 release adds request-trace propagation, while REA carries target, provider, confidence, authority, limitations, and locations with an investigation result.

For a Node/React/Postgres team, the practical change is small but important. A useful agent receipt should show not only what tool acted, but which sources were retrieved, which evidence was computed, which records were rejected as stale or out of scope, and which exact effect followed. That makes provenance part of the application contract instead of an after-the-fact transcript.

Jump to section

🎯 What Matters to Us This Week

  • Make evidence construction observable before adding more memory. HGP routes traces into episodic, semantic, procedural, and working-memory forms, while Claude-Mem advertises layered search, timelines, selective observation fetches, and citations. The useful operator question is not whether a product “has memory”; it is whether a reviewer can see source, type, scope, age, transformation, contradiction, and actual use in the accepted result.

  • Treat runtime traces as one receipt layer, not as proof of correctness. Docker Agent propagates W3C trace context across its ACP handlers, and its sandbox documentation explains staged skills, mounts, default-deny egress, reuse, and explicit cleanup. Those facts improve reconstruction, but a trace still needs application-owned checks for authorized paths, destinations, arguments, database effects, and terminal state.

  • Pin the sandbox beneath the agent runtime. Docker's security announcement says Docker Sandboxes before 0.42.0 had critical and high-severity workspace-escape paths on macOS. Before testing Docker Agent's sandbox mode, verify the sandbox version, mount mode, egress policy, staged kit, and destruction path; “runs in a VM” is not a sufficient control description.

  • Budget tool-schema compatibility as part of the harness. REA issue #919 reports recursive references and nesting beyond one model's function-calling limits. A protocol-valid server can still be unusable by a selected model, so capability tests should include schema depth, discovery cost, result size, and fallback behavior rather than only connection success.

  • Keep distribution, production use, and accepted outcomes separate. NuGet reports more than three million downloads for the current .NET ModelContextProtocol package, and Maven Central lists the Java MCP SDK 2.0.1 in 107 components. Those records demonstrate distribution rather than safe configuration or workload success. An AWS-authored Katalon case study reports isolated sessions, observability, human release ownership, and production invocation counts; it is a useful production architecture example, but its outcome figures were not independently reproduced in this run.

🔥 Top Movers

  • morluto/rea (7,738 ⭐ today, 25,858 total) — evidence-carrying reverse engineering accelerated for a third clean daily observation.
  • boykopovar/AnyPS5 (4,669 ⭐ today, 15,605 total) — a large systems-porting attention spike outside the active app-stack need.
  • storytold/artcraft (2,103 ⭐ today, 7,846 total) — creative tooling remained highly visible without a current operator use case.
  • mattpocock/skills (1,774 ⭐ today, 281,041 total) — inspectable engineering skills stayed prominent; the existing measurement warning blocks a fresh direction claim.
  • cathrynlavery/diagram-design (1,160 ⭐ today, 46,293 total) — versioned visual-production behavior accelerated on the board, but factual diagram accuracy remains the acceptance test.
  • tester-army/e2e (962 ⭐ today, 8,158 total) — attention eased from its verified peak while remaining well above the first clean baseline.
  • docker/docker-agent (766 ⭐ today, 4,232 total) — the runtime re-entered strongly after a long observation gap; the release and sandbox evidence justify a canary, not broad adoption.

🚀 What Changed the Frontier

  • Evidence routing became a learnable operation. RECAST can choose among retrieval, computation, and synthesized tools, which widens “context engineering” beyond ranking stored passages. The paper is new research, not production proof, but the abstraction maps directly to app workflows that must aggregate several records before a decision.
  • Agent request flow gained a standard trace carrier. Docker Agent v1.145.0 propagates traceparent and tracestate through 13 ACP handlers. That makes client-to-runtime joins cheaper for existing observability stacks, provided spans are joined to selected evidence and accepted effects rather than treated as success by themselves.
  • Memory became typed enough to test routing separately from storage. HGP uses a lightweight classifier to select among several memory forms and includes current state as a trajectory. This gives a bounded experiment a clearer failure taxonomy: bad retention, bad type, bad selection, stale evidence, or bad downstream decision.
  • A process-aware runtime budget became benchmark material. AgentTime tests whether agents can estimate, follow, and report wall-clock duration across native harnesses. Time limits are therefore part of the behavioral contract, not merely an outer-process timeout.

🆕 First Appearances

  • CursorTouch/Windows-MCP — first clean daily baseline at 360 stars/day. Desktop reach is useful for one admitted Windows application, but it widens the effect boundary beyond browser automation.
  • Vincentwei1021/video-shotcraft — first clean daily baseline at 241/day. It packages shot recipes, motion previews, and a Remotion template as agent behavior; keep it outside the roadmap without a concrete product-video requirement.
  • fabio-rovai/open-ontologies — first clean daily baseline at 63/day. Its plan, blast-radius, apply, rollback, and auditor-recheckable proof sequence is a useful pattern for any agent-operated production state.

🌱 Rising Stars

(only repeated, window-labelled daily observations are used)

  • morluto/rea — 2,956 → 4,655 → 7,738/day across three clean observations. The rise measures attention; evidence correctness, legal authorization, provider isolation, and schema compatibility remain separate.
  • docker/docker-agent — 4 → 766/day across clean observations separated by a gap. The current release and documentation explain renewed attention, but the gap prevents a smooth growth-curve claim.

📉 Fading

(repos whose explicit daily velocity dropped more than 80% from a verified peak)

  • openai/tart — 34/day versus a verified 211/day peak, down 83.9%. This is an attention classification, not a verdict on its Apple-platform VM or CI utility.

⚔️ Battles (same category, competing)

  • Docker Agent vs OpenShell — both provide inspectable execution boundaries. Docker couples the builder, ACP runtime, staged kit, and Docker Sandboxes; OpenShell emphasizes policy enforced outside the workload. Compare one read-only task on denied effects, credential custody, trace completeness, cleanup, and operator effort.
  • REA vs ghidra-mcp — both connect agents to reverse engineering. REA emphasizes normalized evidence across providers; ghidra-mcp emphasizes a broad lazy-loaded Ghidra tool surface. The deciding test is whether one authorized conclusion can be reconstructed from source artifact to claim without granting unnecessary effects.
  • Claude-Mem vs AI Memory vs application-owned Markdown/Postgres — all address cross-session loss. The products automate capture and retrieval or cross-vendor handoff; ordinary storage keeps source, scope, correction, and deletion closer to application policy. Choose only after a fixed task shows decision lift rather than more recalled text.

🔬 From Research

🔄 What's Changing

Yesterday's selection-plane/effect-plane split is becoming more precise. Selection is no longer just “find a relevant tool or document”; it can classify memory, compute a derived fact, aggregate several records, or synthesize a bounded operation. That makes it powerful enough to deserve its own receipt: inputs, transformations, rejected alternatives, output, confidence, and the policy generation under which the result was allowed to influence an effect.

The limit is equally important. More elaborate evidence routing can produce a persuasive chain whose first premise is stale, cross-session, incorrectly scoped, or derived through an opaque step. A trace is valuable when it lets a reviewer falsify the chain; it is dangerous when its mere existence is treated as validation.

🧪 One Experiment Worth Running

Trace one read-only repository diagnosis through Docker Agent. Proposed small step: pin Docker Agent v1.145.0 and Docker Sandboxes 0.42.0 or later, use a disposable repository, disable unnecessary staged kit material, and ask for one bounded TypeScript diagnosis without edits. Record trace context, staged files, paths read, network attempts, evidence selected or computed, final claim, timeout, and sandbox removal. This can show whether one task is reconstructable and fails closed; only a clean result should justify an allowed write and a comparison with OpenShell.

⚠️ One Risk to Track

Computed context can look sourced while hiding a transformation error. Watch for a receipt that links the final claim to a generated aggregate without exposing the underlying records, filters, code, timestamp, scope, and rejected contradictions. The likely downside is an agent making a perfectly traced but incorrectly grounded production decision.

🙅 One Thing to Ignore

A memory-product bakeoff before defining the evidence contract. Package activity, citations, graphs, hybrid retrieval, and cross-agent handoff are useful features, but they cannot decide which fact is current, which session may see it, or what correction and deletion mean for this application. Revisit products after one task fixes source, scope, supersession, authorization, expiry, expected decision, and a clean no-memory control.

The Claude-Mem npm page and rea-agents npm page returned HTTP 403 during the final deterministic hydration, so their version and download metadata remain search-visible, limited-verification leads; no adoption conclusion depends on them. The direct repository issue, Docker sources, Reddit discussions, NuGet record, AWS case, and arXiv pages hydrated successfully. YouTube remained optional and weak at one transcript-verified result, so it was skipped without delay and no conclusion depends on video evidence.

💡 Surprise Pick

fabio-rovai/open-ontologies — the interesting part is not ontology storage. It is the explicit sequence of plan, blast-radius report, apply, rollback, and proof another auditor can re-check—the shape a Postgres migration, permission change, or agent-authored policy update should increasingly have.

📊 Supply vs. Demand

What's being built (supply) What people want (demand) Match?
Learned evidence routers, typed memory, layered search, and citations Know whether recalled context actually helped rather than being rediscovered or hallucinated Partial; provenance and no-memory controls remain uneven
ACP tracing and sandboxed agent runtimes Reconstruct what the agent read, attempted, changed, and cleaned up Improving; traces still need application-owned effect acceptance
Broad MCP tool surfaces for reverse engineering and desktop control Use powerful tools without exceeding model schemas or host authority Partial; schema compatibility and exact target admission remain open
Installable skills and knowledge-work plugins Reuse behavior without hidden endpoint drift or stale dependencies Partial; issue #1279 shows lifecycle validation is still operator work
Agentic QA and faster code generation Reduce six-hour review days and downstream repository pressure Weak; direct discussions still report review and validation as the bottleneck

The LocalLLaMA memory-benchmark discussion and other Reddit findings are individual practitioner and community reports, not representative demand measurements. They help select tests; they do not establish market prevalence.

📊 Category Pulse

Category New Today Trending Count Signal
Agent infrastructure 0 6 ↑ Runtime tracing and packaged sandbox contracts become testable
Memory / RAG 0 5 ↑ Typed routing and computed evidence displace generic “save everything” framing
MCP tooling 1 7 ↑ Reach expands while schema and exact-effect boundaries tighten
Code dev tools 0 10 ↑ Evidence-carrying investigation leads; review capacity remains scarce
LLM eval / testing 0 5 ↑ Runtime, process, and evidence use become separate evaluation targets
Skills ecosystem 1 8 → Packaging is durable; endpoint and dependency lifecycle lag