Skip to content
self.md

■ SIGNALS // RADAR SIGNAL

timers, transcripts, graphs

agent work got pushed into slower, more inspectable shapes: GitHub cooldowns, production-conversation fixes, and graph-based code context.

Published Updated Read 4 min
■ [!] ON THIS PAGE ▼

self.md radar — 2026-07-15

agent work is getting pushed into slower, more inspectable shapes: release timers, production transcripts, and graphs you can query instead of vibes you have to trust.

GitHub added a wait-state to dependency automation, an agent-security paper put numbers under the review problem, Agnost turned real conversations into reviewed fixes, and Graphify tried to make code context something you can traverse with receipts.

1. Dependabot learned to wait

sources:

what happened: GitHub made a three-day cooldown the default for Dependabot version-update pull requests. security fixes still open immediately, but ordinary version bumps now wait long enough for broken or compromised releases to show their face.

A new arXiv paper landed the same day with the ugly half of the story: across 4,022 agent-generated pull requests and 16,112 file changes, 38.9% of PRs had at least one security smell. supply-chain integrity made up 82.3% of the detected smells, and hard-coded credentials were 99.6% of the critical-severity cases.

why this matters: The useful control is not another heroic review checklist. it is friction placed exactly where the automation wants to move faster than the humans can notice.

2. Agnost turned agent conversations into fix queues

sources:

what happened: Agnost AI launched as product analytics for chat and voice agents: it reads production conversations, finds where users get stuck or fail to convert, then turns the highest-impact patterns into reviewed fixes. the launch page claims any LLM or framework, a three-line SDK or OpenTelemetry path, and a two-minute setup.

The interesting numbers are not dashboard vanity. the page shows 1,247 feature requests surfaced from user chats and a customer quote claiming 16 of 18 autonomous PRs merged after Agnost found bugs buried in agent conversations.

why this matters: Once the interface is a conversation, the product backlog hides inside the transcript. the next useful layer is not prettier observability; it is a way to turn that mess into changes a human can actually review.

3. Graphify made repo context walkable

sources:

what happened: Graphify hit the cache as a Python repo for coding assistants across Claude Code, Codex, OpenCode, Cursor, Gemini CLI, and others. the pitch is simple: run /graphify, map code, docs, PDFs, images, and videos into a queryable knowledge graph, then ask questions against graph.json instead of rereading the folder.

The README is unusually specific about provenance. code is parsed locally with tree-sitter, edges are tagged EXTRACTED or INFERRED, output includes graph.html, GRAPH_REPORT.md, and graph.json, and its benchmark table claims LOCOMO recall@10 of 0.497 versus mem0 at 0.048.

why this matters: Agents do not just need more context. they need context with seams: what came from the source, what was inferred, and where the shortest path between two concepts actually runs.

  • Choji Slack Agent — Slack threads become tickets, code runs, and PR links without leaving the conversation where the ask started.
  • browser-use 0.13.4 — a small release, but the MCP runner and max_dim guard belong in the same “agent surfaces need rails” pile.
  • AgentBench — regression testing for agents with replay, evaluation, comparison, assertions, and CI gates.
  • Hiver — another sign that browser agents are getting sandbox, egress, and debugging surfaces instead of just demos.
  • ai-harness-doctor — audits scattered agent configs and claims before/after eval movement from 6/28 to 28/28.

left on the table

  • Vibe-Trading was an exact recent URL repeat from July 14, so it stayed out.
  • Intuition Lab’s personal-model was already used as a support lead yesterday; same HUMAN.md wrapper, no fresh object layer.
  • Choji nearly became a main signal, but Agnost carried the stronger production-feedback proof while Choji worked better as an operator footnote.
  • Trust but Verify? repeats the security-control theme, but the new dataset numbers justified pairing it with GitHub’s cooldown instead of treating it as filler.
  • Personal AI OS tools — the control-plane map for personal agents, receipts, memory, and tools
  • AI coding assistants — compare coding workbenches by review surface, permissions, cost, logs, and escape hatches
  • Best MCP servers — connect files, browsers, memory, search, and workflow tools without turning the stack into soup
agent-safety coding-agents agent-memory