Box 的定位是让 AI Agent 跑在一个限制其可执行内容的沙箱里^[19]。它要解决的是 Agent 执行代码的默认风险：给模型一个 shell 等于把文件、网络与凭据一并交出，而策略约束写在提示里毫无强制力。做法上由运行时提供受限执行环境，把权限边界从「模型自觉」移到平台配置。值得借鉴的是沙箱应当是默认开启的运行时能力，而不是每个团队自行加装的一层；限制是仓库描述有限，隔离强度（系统调用、网络策略、逃逸测试）与性能开销没有公开数据，采用前需要自行压测。

Box is positioned to run AI agents inside a sandbox that restricts what they can execute^[19]. It addresses the default risk of agent code execution: handing a model a shell hands over files, network and credentials, while policy written in a prompt has no enforcement. The design provides a restricted execution environment from the runtime, moving the permission boundary from model self-restraint to platform configuration. Worth borrowing is that sandboxing should be a default runtime capability rather than a layer each team bolts on; the limit is a sparse repo description with no public figures on isolation strength or performance overhead.

这个仓库提供面向 React、Vue、Svelte、Solid、原生 JS 与 Framer 的 WebGPU 组件^[18]。它要解决的是浏览器端实时图形与 AI 可视化的工作量问题：WebGPU 能力强大但 API 复杂，直接从零写渲染逻辑会把大量时间消耗在样板代码上。做法上把常用渲染效果封装成跨框架组件。值得借鉴的是把底层图形能力封装为可复用的界面组件，可以显著降低 Agent 可视化与实时仪表盘的实现成本；限制是它与本期其他 Agent 仓库主题相关度较低，且 WebGPU 的浏览器支持与移动端表现差异较大，采用前需要确认目标环境。

This repository provides WebGPU components for React, Vue, Svelte, Solid, plain JS and Framer^[18]. It addresses the effort of browser-side real-time graphics and AI visualisation: WebGPU is powerful but its API is complex, and writing render logic from scratch consumes time in boilerplate. The design wraps common rendering effects into cross-framework components. Worth borrowing is that packaging low-level graphics as reusable UI components cuts the cost of agent visualisation and live dashboards; the limit is weaker topical overlap with the rest of this edition's agent focus, plus uneven WebGPU browser and mobile support to verify first.

GroundingPI 是一个面向物理智能的 4B grounding 基础模型，定位是统一多种物理场景下的定位与理解能力^[20]。它要解决的是具身模型规模与部署成本的平衡：大模型效果好但难以端侧部署，小模型又常在某些物理理解任务上退化。做法上以中等规模模型专注「定位」这一关键能力，作为下游策略的感知底座。值得借鉴的是针对具身场景做「小而专」的基础模型，可能比通用大模型更适合端侧；限制是仓库描述较简、未给出评测基准与横向对比，实际能力需要按具体任务验证。

GroundingPI is a 4B grounding foundation model for physical intelligence, positioned to unify localisation and understanding across physical settings^[20]. It addresses the trade-off between embodied model scale and deployment cost: large models perform well but resist on-device deployment, while small ones often degrade on physical understanding. The design focuses a mid-sized model on grounding as the perception base for downstream policies. Worth borrowing is that small, specialised foundation models may suit embodied edge deployment better than general large ones; the limit is a brief description without benchmarks or comparisons.

reelmimic 让用户给出一段喜欢的视频，就得到风格一致的新视频：由一组 AI Agent（Claude Code 或 Codex）负责规划与实现^[21]。它要解决的是风格迁移与内容生成的流程编排问题：从参考分析、镜头设计到生成与剪辑需要多个步骤，交给 Agent 编排比手工串工具更省事。做法上把创作流程拆给 Agent 团队执行。值得借鉴的是把创作类工作流交给多 Agent 编排，是内容生产效率的一条现实路径；限制是风格一致性的可量化标准缺失，产出质量依赖底层生成模型与人工筛选，仓库未给出与人工制作的对比数据。

reelmimic lets a user supply a video they like and receive a new video in the same style, with a crew of AI agents (Claude Code or Codex) planning and building it^[21]. It addresses workflow orchestration for style transfer and content generation: analysing the reference, shot design, generation and editing are multiple steps, and agent orchestration saves effort versus hand-wiring tools. The design hands the creative pipeline to an agent crew. Worth borrowing is that delegating creative workflows to multi-agent orchestration is a realistic route to content productivity; the limit is the absence of measurable style-consistency criteria and any comparison against human production.

cadence 定位为从实时经验中学习的大脑：默认走 System 1（感知、记忆、可塑性、行动），可选 System 2 做自我观察与慢速纠错^[23]。它要解决的是在线学习难题：主流 Agent 离线训练后推理，现场反馈很少真正改变行为；该方案用平衡网络与局部学习规则让模型在部署中持续更新。值得借鉴的是快慢双系统的工程拆分；限制是研究型代码的稳定性与可复现性通常有限，直接用于生产前需要补齐评测与回滚机制（本仓库此前在 10-03 那期出现过，本次为更新后的再次收录）。

cadence positions itself as a brain that learns from live experience: System 1 by default (perception, memory, plasticity, action) with an optional System 2 for self-observation and slow correction^[23]. It addresses online learning: mainstream agents train offline and infer, so in-field feedback seldom changes behaviour, whereas equilibrium networks and local learning rules let the model keep updating in deployment. Worth borrowing is the engineering split between fast and slow systems; the limit is that research-grade code rarely offers production stability, so evaluation and rollback come first.

这是一个机器人视觉 SDK，为机器人应用提供视觉能力的封装^[22]。它要解决的是视觉能力复用问题：检测、跟踪与标定在不同机器人项目里反复实现，而 SDK 可以把这些能力沉淀成稳定接口。值得借鉴的是把视觉基础能力做成 SDK，可以减少每个项目的重复工作；限制是仓库描述很简，未说明支持的相机类型、延迟指标与许可条款，与主流框架（ROS 2、LeRobot）的集成情况也需要自行确认。

This is a robotics vision SDK, packaging vision capabilities for robot applications^[22]. It addresses reuse of vision capability: detection, tracking and calibration get reimplemented across robotics projects, and an SDK can settle them into stable interfaces. Worth borrowing is that packaging core vision capability as an SDK cuts duplicated work per project; the limit is a very brief description with no camera support matrix, latency figures or licensing detail, and integration with frameworks such as ROS 2 or LeRobot must be checked.

这是远程 MCP 服务清单，收录可远端调用的 Model Context Protocol 服务^[24]。它要解决的是 MCP 生态的发现成本：本地 MCP 需要安装配置，远程 MCP 只需一个地址，但缺少可信索引。值得借鉴的是接第三方 MCP 前先核查维护者与权限范围，清单不是安全背书；限制是此类清单通常不做安全审计，远程服务的权限、日志与数据去向由各自提供方决定，接入前需逐个核实（本仓库上次收录于 09-30 那期）。

This is a catalogue of remote MCP servers, listing Model Context Protocol services callable over the network^[24]. It addresses discovery cost in the MCP ecosystem: local servers need installation while remote ones need only an address, yet there is no trusted index. Worth borrowing is to check maintainer and permission scope before wiring in a third-party MCP server — a catalogue is not a security endorsement; the limit is that such lists rarely audit security, and permissions, logging and data destinations are set by each provider.

该项目主张「不是问答机器人，而是能真正干活的数字分身」：共享智能体与项目上下文，让项目成员协同，并像人一样把资料与经验抽象回项目上下文^[25]。它要解决的是团队内上下文重复建设的问题。值得借鉴的是共享上下文是团队级 Agent 的关键资产；限制是共享上下文会同时放大错误与偏见，仓库未说明权限、版本与冲突处理机制（上次收录于 09-23 那期）。

This project argues it is “not a Q&A bot but a digital twin that actually works”: shared agents and project context let members collaborate, with materials and experience abstracted back into that context^[25]. It addresses duplicated context-building inside teams. Worth borrowing is that shared context is the key team-level asset; the limit is that shared context also amplifies errors and bias, and permissions, versioning and conflict handling are unstated.

这篇论文提出「Agent 广告」的攻击面：当人们把购物、求职、出行这类排序任务委托给 AI Agent，就出现了通过操纵 Agent 决策牟利的动机^[26]。作者指出，现有防御依赖模型的对齐训练与平台条款，因此最有效的已知攻击都是设计成触发「偏离策略（off-policy）」行为的；他们提出在线策略（on-policy）攻击，可以在不把任何单个行为推离已对齐分布的前提下操纵决策。示例攻击分两步：先在产品描述里注入一句对虚构概念的真实否定（「不含 blizyester」）以保持条款合规，这触发 Agent 去搜索网络（「什么是 blizyester？」），进而命中预先布置的、把该虚构概念与有害含义关联起来的网站。对做购物与排序 Agent 的团队，参考价值是对齐训练不是防操纵的充分条件，内容来源与检索链需要独立治理；限制是论文提供的是新攻击面与示例，尚未给出大规模成功率与防御效果的完整评测。

This paper introduces the attack surface of “agent ads”: as people delegate option-ranking tasks such as shopping, job search and travel to AI agents, incentives appear to steer agentic decisions for profit^[26]. Existing defences lean on alignment training and platform terms, so the most effective known attacks are designed to trigger off-policy behaviour; the authors introduce on-policy attacks that steer decisions without pushing any individual behaviour off the aligned distribution. Their example has two steps: inject a truthful negation about a fictitious concept (“does not contain blizyester”) into a product description to stay terms-compliant, which makes the agent search the web (“what is blizyester?”) and surface planted sites associating the concept with harmful implications. For shopping and ranking agents the reference is that alignment training is not sufficient anti-manipulation defence — content provenance and the retrieval chain need separate governance; the limit is that the paper offers a new surface and example without large-scale success or defence evaluations.

这篇论文给出了「决策模型」的极简配方：现有开放指令微调模型无需任何额外训练就能接近 Jev 的表现——只要在最后一个 token 位置从输出的 logits 里读取 A、B、C 等字母对应的分数^[27]。它要解决的是决策层的获取成本问题：过去要么用通用模型生成文本再解析，要么专门训练一个小决策模型，而「读字母」把已有模型直接变成单次前向的选项打分器。作者进一步给出监督微调配方，用 LoRA 与一个从语言模型 head 切片初始化的决策头微调四个开放模型（Gemma 4 31B/12B、Qwen3.6-27B、Qwen3.5-4B），并发布 OpenDecisions——一个 2,352 题的验证数据集。对做 Agent 判断层的团队，参考价值是先试「免训练读 logits」的基线，再决定是否值得训练；限制是摘要未给出各模型的具体准确率与相对 Jev 的差距，字母位置的校准质量也依赖提示与选项设计。

This paper offers a minimal recipe for decision models: existing open instruction-tuned models can approach Jev's performance with no additional training, simply by reading the scores for letters such as A, B, C from the output logits at the last token position^[27]. It addresses the cost of acquiring a decision layer: previously you either parsed text from a general model or trained a dedicated small model, whereas logit reading turns an existing model into a single-forward-pass option scorer. The authors add a supervised fine-tuning recipe, fine-tuning four open models (Gemma 4 31B/12B, Qwen3.6-27B, Qwen3.5-4B) with LoRA and a decision head initialised from a slice of the language model head, and release OpenDecisions, a 2,352-question validation set. For judgement-layer teams the reference is to try the training-free logit baseline before paying to train; the limit is that no per-model accuracy or gap to Jev is given.

CodeLift 针对软件工程 Agent 训练奖励的稀疏性：「全部测试通过」这一二元奖励是标准做法，但它抹掉了部分正确补丁之间的差异^[28]。作者发现自然的替代方案——测试通过率——并不是可靠的补丁质量指标：一个功能可能由一个高难度测试或一百个琐碎测试覆盖，而后者中大量是本来就通过的测试，于是通过率被简单测试「撑」高。做法上提出 CodeLift：动态校准通过率奖励，把测试套件变成自适应课程——每轮迭代把「杀死同一批补丁」的测试分组、把「通过同一批测试」的补丁分组，然后给被更少补丁组通过的测试组更高权重，从而降低多数简单测试的影响，把注意力放在仍然困难的部分；在同一次 rollout 内对同一仓库应用相同的打分规则。对训练编码 Agent 的团队，参考价值是奖励设计要针对测试套件的构成做加权，而不是直接用通过率；限制是摘要未给出与基线在标准基准上的提升数值，加权规则的有效性依赖测试套件的质量分布。

CodeLift targets reward sparsity in software-engineering agent training: the all-tests-pass binary reward is standard, but it erases differences between partially correct patches^[28]. The authors find that the natural alternative — test pass rate — is not a reliable indicator of patch quality: a functionality may be covered by one challenging test or a hundred trivial ones, many of which already passed, inflating the rate. CodeLift dynamically calibrates pass-rate rewards, turning the suite into an adaptive curriculum: each iteration groups tests that kill the same patches and patches that pass the same tests, then weights test groups that fewer patch groups pass more heavily, reducing the influence of majority-easy tests and focusing on what remains hard, with the same scoring rule applied within a rollout. For coding-agent training teams the reference is to weight rewards by test-suite composition rather than using pass rate directly; the limit is that no baseline comparison figures are given.

这篇报告提出一个大胆的思路：在「软件 3.0」时代，当 Agent 可以在几分钟内重写一个完整程序时，把代码当作唯一真源的传统做法就值得怀疑^[29]。它要解决的是代码与知识解耦问题，采用 Fowler 提出的七个原语作为「可再生产软件」的框架：知识存放在被版本跟踪目录中的机器可读记录里，每个单元据此构建一个「再生包」——单个文件，包含模块的架构、意图、决策、公开契约、评测与消费者，但不含实现，外加它可能依赖的那一个模块；开源包 spotregen 实现了这些原语并提供图形界面。作者给出了在安全关键的预测库 spotforecast2-safe 上的首次应用经验。对做代码生成与知识管理的团队，参考价值是把「意图与契约」沉淀为可再生的知识资产，让实现成为可丢弃的产物；限制是这类方法对文档完整性与测试覆盖要求极高，安全关键系统仍需人工把关，报告也只是初步应用。

This report proposes a radical idea: in the “Software 3.0” era, when an agent can rewrite a complete program in minutes, treating code as the sole source of truth becomes questionable^[29]. It addresses decoupling code from knowledge, using Fowler's seven primitives as the framework for regenerative software: knowledge lives in machine-readable records in a tracked directory, and each unit gets a regeneration bundle — a single file holding the module's architecture, intent, decisions, public contract, evaluations and consumers but no implementation, plus the one dependency it may import; the open-source package spotregen implements the primitives with a GUI. The authors report a first application to the safety-critical forecasting library spotforecast2-safe. For code generation and knowledge management teams the reference is to settle intent and contracts as regenerative knowledge assets and let implementations become disposable; the limit is demanding documentation and coverage requirements.

AutoMARS 是一个面向供应链网络的自动、可扩展多 Agent 风险比较评估框架：端到端执行分析工作流——自动规划任务、协调专职 Agent、调用外部分析工具，并把领域结果综合成整体风险评估^[30]。它要解决的是垂直领域分析的编排问题：供应链风险评估需要整合社会经济、灾害、环境与运输等多域异构因素，单一模型既缺工具也难以系统化。做法上采用多域、多 Agent、多工具架构，并通过并行化独立分析任务来支持跨多个地点的规模化比较，输出结构化、可解释的比较分析。对做垂直 Agent 的团队，参考价值是「多域因子 + 外部工具 + 可并行」是垂直 Agent 最容易体现价值的结构；限制是摘要未给出评估准确性与成本数据，也没有与人工分析的对照，实际可用性需要按行业数据验证。

AutoMARS is an agentic framework for automatic, scalable comparative risk assessment in supply chain networks: it executes analytical workflows end to end by planning tasks, coordinating specialised agents, invoking external analytical tools and synthesising domain results into integrated risk evaluations^[30]. It addresses orchestration in vertical analysis: supply chain risk requires integrating heterogeneous factors across socioeconomic, disaster, environmental and transportation domains, which a single model cannot systematise. The architecture is multi-domain, multi-agent and multi-tool, and parallelises independent analytical tasks to support scalable comparison across locations, emitting structured, interpretable comparisons. For vertical agent teams the reference is that multi-domain factors plus external tools plus parallelism is the structure where vertical agents show value most easily; the limit is the absence of accuracy, cost or human-baseline comparisons.

这篇论文审计了一个真实产品的设计：某生产级对话分析系统给每个数据库问答附加置信度分数，并据此决定展示、加警告展示还是不予展示，而分数的权重、上限与阈值全部由人工设定^[31]。它要解决的是置信度分数是否真的可用这一信任问题。做法上在 BIRD dev 的 1,534 个问题上，用 GPT-5.1 配合适配基准的生产提示、每题五次采样做评测：设计的分数对正确与错误答案的区分能力很弱（AUROC 0.624，95% CI 0.595–0.652），并且把 35.7% 的正确答案判定为不予展示；进一步分析显示，几乎全部的排序信号来自多次采样间的一致性，而其中大部分信号在与「清单检查」取最小值时被丢弃——只要回答中包含任何未被证据支持的陈述（包括评论性语句），清单项就归零。对做对话式数据产品的团队，参考价值是置信度阈值必须用真实分布校准，并区分「陈述是否有据」与「答案是否正确」两件事；限制是结论局限于单一生产系统与一个基准，其他领域与模型下的校准表现需重新测量。

This paper audits a real product design: a production conversational analytics system attaches a confidence score to every database answer and uses it to show the answer, show it with a warning, or withhold it, with weights, caps and thresholds set by design^[31]. It addresses whether such a score is actually usable. On the 1,534 questions of BIRD dev, answered by GPT-5.1 with a benchmark-adapted production prompt and five samples per question, the designed score separates right from wrong answers weakly (AUROC 0.624, 95% CI 0.595–0.652) and withholds 35.7% of correct answers; nearly all ranking signal comes from agreement among samples, and most of it is lost where agreement is combined by a minimum with a checklist that drops to zero on any unsupported claim, including claims in commentary. For conversational data products the reference is to calibrate thresholds on the real distribution and separate whether a claim is supported from whether the answer is correct; the limit is one production system and one benchmark.

DexNinja 处理一个被低估的机器人难题：切食物对人类很轻松，而每次切割都是与「可形变、弹塑性」物体的高接触交互，其行为随姿态、接触方式与切割阶段变化^[32]。它要解决的是数据采集的浪费：真实试验往往污染或损坏食材，规模化采集既贵又难；而仿真虽然是替代方案，在物理与感知上与现实存在巨大 sim-to-real 差距，对「拓扑变化」的切割尤其严重——接触、摩擦与材料弹性上的小误差会迅速累积。做法上提出 real2sim2real 框架：从少量真实示范出发重建物体实例、对物理与感知参数做随机化，生成稠密而真实的训练分布。对做灵巧操作与仿真训练的团队，参考价值是先把「少量真实 + 大规模随机化仿真」的数据引擎搭起来，再谈策略质量；限制是摘要未给出真机成功率与对比基线，重建与随机化能否覆盖真实食材的多样性仍需验证。

DexNinja tackles an underrated robotics problem: cutting food is effortless for a human, yet each cut is a high-contact interaction with a deformable, elasto-plastic object whose behaviour changes with pose, contact mode and cutting stage^[32]. It addresses wasteful data collection: real trials contaminate or damage food, making scalable data expensive, while simulation suffers a large sim-to-real gap especially for topology-changing interactions like cutting, where small errors in contact, friction and material elasticity compound. The framework is real2sim2real: reconstructing object instances from a handful of real demonstrations and randomising physical and perceptual parameters to generate a dense, realistic training distribution. For dexterous manipulation and simulation-training teams the reference is to build the small-real-plus-large-randomised-sim data engine before arguing about policy quality; the limit is that no real-robot success rates or baselines are given.

ReForesight 从一个很实际的场景出发：共享通道的机器人需要知道人将会在哪里，而语义占据地图只显示人现在在哪^[33]。做法是一个开源 ROS 2 工具包，在基于粒子的语义建图流程上增加实例级的「未来占据预测」与「遮挡后再识别」：一个 36.6k 参数的 MLP 预测每个被跟踪的人或车最多 3 秒后的位置，并有卡尔曼滤波兜底与静止门控；物体自身的点被移动到预测位姿，在图像坐标系里形成「幽灵」点云，无需占据解码器；可选的跟踪器在遮挡后用流程已有的关键点描述子与 3D 度量门控重新关联目标。效果上在四个留出的 CODa 序列上，MLP 把 3 秒终点位移误差均值从 0.728 米（卡尔曼）降到 0.662 米，并在每个序列上都优于同规模 GRU（0.692 米），单实例单 CPU 核耗时 0.04 毫秒。对做移动机器人与服务机器人的团队，参考价值是用极小模型 + 解析兜底替代重型预测网络，往往更适合实时系统；限制是结论限于该数据集与 3 秒预测窗，拥挤场景与多类交通参与者下的表现需要进一步验证。

ReForesight starts from a practical setting: robots sharing walkways need to know where people will be, while semantic occupancy maps show only where they are^[33]. The result is an open-source ROS 2 toolkit adding instance-level future occupancy and re-identification after occlusion to a particle-based semantic mapping pipeline: a 36.6k-parameter MLP predicts each tracked person or vehicle up to 3 seconds ahead, guarded by a Kalman fallback and a stationary gate, and the object's own points are moved to the forecast pose to form a “ghost” point cloud in the map frame without an occupancy decoder; an optional tracker re-associates objects after occlusion using keypoint descriptors the pipeline already computes plus a metric 3D gate. On four held-out CODa sequences, the MLP lowers mean 3-second final displacement error from 0.728 m (Kalman) to 0.662 m, beating a similar-size GRU (0.692 m) on every sequence, at 0.04 ms per instance on one CPU core. For mobile and service robot teams the reference is that a tiny model plus analytic fallbacks often suits real-time systems better than a heavy forecasting network; the limit is a single dataset and a 3-second horizon.