Open Source Radar — October 15: who watches the agents
Today's fresh signal is less about new frameworks and more about control surfaces: independent auditing, structured lifecycles, and the first credible attempts to give an agent real hands — plus one skill that refuses to trust its own eyes.
iFixAi (Python, ~28,000 stars, Apache-2.0) — An independent audit for agents, run either by a human or by the agent itself, built around the question eval suites skip: is this thing actually doing the job it was given? It runs 60 inspections across 25 categories, with five core pillars — fabrication, manipulation, deception, unpredictability and opacity — weighted into an A–F grade, and 28 inspections from the premium tier shipped free as a preview, scored separately so grades stay comparable between agents. Two details earn it a look: a grade is only "citable" when a different vendor's judge produced it, so the model you are testing is not the model marking its own homework, and the repo ships scorecards reconstructed from public accounts of two real incidents rather than a tidy demo. It is the same instinct behind the AIUC and audit-startup wave, in an afternoon-sized package.
AI-DLC (TypeScript, ~5,200 stars, MIT-0) — Amazon's AWS Labs published an adaptive workflow layer that turns a coding assistant into a delivery process instead of a chat window: 5 phases and 33 stages from initialisation through operation, 14 specialised agents including two reviewers, and 11 workflow profiles for features, bug fixes, infrastructure and security work. One harness-neutral core runs natively in Claude Code, Kiro, Codex, Cursor, opencode and GitHub Copilot, which is the unusual part — the same deterministic engine and the same audit trail regardless of which assistant you pay for. Human approval gates and source-bound review evidence are the design bet: the lifecycle, not the model, is what you trust. It hit Hacker News today at a modest eight points, so this is early rather than validated.
ESP32 iPhone Agent (C, ~2,200 stars, MIT) — Computer-use for a real iPhone for about seven dollars of hardware: an ESP32-S3 board joins the phone's Screen Mirroring as an AirPlay receiver, passes the H.264 stream straight through, and forwards it over Bluetooth to an app on the same phone, which sends frames to any OpenAI-compatible vision model and decides what to tap. The board also enumerates as a standard USB mouse and keyboard, so with the phone's own assistive pointer enabled a click is a tap and a drag is a swipe — no Mac, no jailbreak, no developer account. The engineering worth stealing is the error handling: the app re-homes a relative pointer to a corner before precise taps, waits for the screen to settle after each action and tells the model whether anything changed, and keeps every run replayable with the taps drawn on top. It is three days old and moving fast.
Anatomy (JavaScript, ~11,800 stars, MIT) — A skill that explains a machine or system by drawing it: you get interactive isometric cutaway figures — engine, satellite, data centre — in SVG, WebGL or 3D, built from a parts library rather than improvised. The reason to care is the verification loop, which is where most "the agent made me a diagram" projects fall apart: a geometry audit fails any part that passes through another, any end that floats off its mount, and any overlap drawn out of depth order, while a headless browser captures close-ups and contact sheets that the model is instructed to actually look at. Zero dependencies outside React for the components, so it drops into Claude Code, Codex or OpenCode without dragging a stack behind it.
Worth watching this week: whether agent audit scores become something teams publish, the way uptime numbers did.
If a third-party judge graded your agent tomorrow, would you post the score — or quietly fix it first? Tell us in the comments.
