Issue Nº 05: Don't take the agent's word for it.

Receipts week. A verifier that says YES or NO to a model's zk proof on a plain CPU, a filesystem that refuses a merge when two agents edit the same line, and a cost plugin whose offline suite mostly passes — except one Codex install path that didn't fail closed. We ran all three on Linux on November 5, 2026. Tools 4–10 are the wider edit; each one says whether we ran it.

The Cover

FlashProve

A CPU that can say NO to a fake model receipt. URL: https://github.com/anthropics/FlashProve (opens in a new tab) · docs under docs/quickstart.md. We tested 0.16.0 (public tree 9e2bdd8…, tagged in-repo as the Oct 30 initial public release). What it does: Anthropic's research prototype for zero-knowledge proofs of AI inference. A provider commits to weights, proves a reply came from that commitment, and anyone checks the proof with cp_verify — on a normal CPU, without the weights. Pricing: Free, Apache-2.0. Research artifact; the README says it is not maintained and not accepting contributions. ✅ Tested hands-on: Linux x86_64, g++ 14 / make, no GPU, no model weights, no API key. Routes 1 and 2 from the quickstart only.

Honest proof: built bin/cp_verify in about 63 s (2.8 MB binary). Checking the shipped examples/accepted-proof (4.1 MB proof, synthetic small model) finished in about 1 s: exit 0, last line YES, result-v1 status=0 claim=exact-match for commitment ID 79a5a2bc…eb22183, tokens 61..63.
One flipped bit: XOR'd the middle byte of a copy of that proof. Exit 1, last lines: “an opening does not lead to its root” / NO: proof-refused.
Toy self-test: blocks/first_look.sh in about 40 s made six honest proofs (each ~576–578 KB) and tried 54 altered copies/calls: 0 accepted, 0 honest files refused. Honest copy ACCEPTED; bent copy rejected the same way.
The catch: these CPU routes prove the verifier and the proof library on synthetic/toy statements. They do not prove anything about a model anyone serves. The real Llama 4 Maverick path needs an H100, CUDA 13.2 Update 2, and on the order of hundreds of GB of host memory — we did not have that. For a real check, the commitment ID must come from a party you trust, not from files that arrived with the proof (Anthropic's own docs). We did not test GPU commit/prove, Maverick weights, the Lean soundness library, or run_suite.py. Verdict: If you care whether a “model receipt” can fail closed on a laptop CPU, this is the rare tool that actually rejects a bent proof in front of you. Treat it as a research verifier, not a production attestations product. Skip it if: you need a maintained, supported attestation service, or you only wanted the H100 Maverick demo and don't have the hardware.

Also this week

LayerFS

1.1.0: merge says Conflict; publish can overwrite. URL: https://github.com/Ephemeral-AI-Lab/layerfs (opens in a new tab) · https://layerfs.ai (opens in a new tab) · release v1.1.0 (Oct 24, 2026). JavaScript packages @layerfs/agent, @layerfs/backend, @layerfs/runtime ship as source under api/ (not npm). What it does: A filesystem substrate for coding agents. Each agent works on a Branch over shared committed history in one SQLite Store; Commits are deduplicated checkpoints. Sandboxes mount ephemeral Workspaces for Bash; Store file ops (fs, branch, project) can run in-process on Linux. Pricing: Free, MIT. Source-only release (no public prebuilt binary or npm publish). ✅ Tested hands-on: built the native Node addon with system Rust 1.85.1 (~67 s); stand-in SDK/CLI tests; real Store init/write/merge/publish on ext4. No Docker Sandbox, no FUSE mount.

Stand-in suite: 36/36 SDK call cases and 70/70 CLI-vs-SDK tests passed against the fake native binding (no Store).
Init needs root: as uid 1000, LayerFS.init failed: “the Store install runs as user 1000; it must run as user 0, the daemons' user…”. As root, Init of a tiny shop/ tree (tax.py RATE = 0.08) took 20–24 ms; the Store file was 212,992 bytes.
Parallel agents: forked agent-a and agent-b, wrote /tax.py to 0.10 and 0.05 on each. Both writes Committed. Conflict is not on write across Branches.
Merge receipt: branch.merge("agent-a", "agent-b", "merged-ab", …) returned Conflict: 1 file, hunk line 1 RATE = 0.10 vs RATE = 0.05, “nothing was created”.
Publish is different: publishing agent-a's tax commit, then agent-b's diverging tax commit, both returned Added. The second publish reported overwroteCount: 1 (it overwrote agent-a's layer). Last publish won; merge was the call that refused.
The catch, two of them: (1) Init on this release expects the Store install to run as user 0. (2) branch.list_commits("main") returned NoSuchBranch even though list_branches lists main and fs.read("main", …) works — main behaves as a Layer stack, not a commit Branch. Also: only the Disposable Store profile runs (WAL, synchronous=OFF); an OS crash can lose recent history. We did not test Docker Sandboxes, FUSE Workspaces, workspace.exec, Durable mode, macOS/Windows worker, or LayerFS × DSH. Verdict: Worth a hard look if you want multi-agent history without copying trees — and you will run Init as the daemon user and use merge (not only publish) when two agents touch the same path. Skip it if: you can't run the Store install as root/daemon user, or you need crash-safe durability today.

TokenEconomizer

0.1.0: cost control you can unit-test without an agent. URL: https://github.com/microsoft/TokenEconomizer (opens in a new tab) · release v0.1.0 (Oct 26, 2026) · project page https://tokeneconomizer.github.io (opens in a new tab) · arXiv 2610.22732. What it does: A plugin for Claude Code, Codex, GitHub Copilot CLI, and Pi (experimental: Cursor, opencode, Hermes). It learns across sessions in a repository: micro-skills (repo facts), tool pruning (drop unused tools from later sessions), and a loop guard (redirect when a turn looks stuck). No separate API key; model calls ride your agent login. Pricing: Free, Apache-2.0. Paper reports 18.4–30.9% lower mean cost on SWE-Bench across five agent–model combinations — that is the paper's measurement, not ours. ✅ Tested hands-on: Python 3.13 package + pytest + harness smoke test + te CLI. No Claude Code / Codex / Copilot / Pi installed; no live model.

Offline suite: pytest tests → 351 passed, 1 failed, 1 skipped in 6.4 s.
The failure: test_a_codex_install_copy_finds_the_core_in_the_marketplace_it_came_from. With a Codex-style install copy that drops lib/ and a marketplace source pointing at a nonexistent path, te doctor still exited 0. The test expected exit 1 and “core package was not found”. On our run, that broken Codex layout did not fail closed.
Smoke: experiments/scripts/launch/smoke_test.sh → SMOKE PASS in ~4 s (stub agent, no Docker, no keys); aggregated cost_effective_tokens stayed in [3850, 3850].
CLI defaults: te config show — microskills off, toolprune auto (evidence 10), loopguard nudge (judge confidence 0.7). te config set toolprune_evidence=20 wrote the repo config and the next show reported 20.
The catch: without a supported agent on PATH you get status and config, not savings. And the one failing packaging test is exactly about a Codex install copy that used to break hooks in the wild — worth watching before you trust a marketplace install. We did not test a live agent session, real token bills, toolprune writing agent settings, loopguard redirects, or the SWE-Bench reproduction. Verdict: Install it if you already live in Claude Code / Codex / Copilot / Pi on the same repos; verify te doctor after install. Do not take the paper's percent savings as something we re-ran. Skip it if: you don't run one of the supported agents, or you need the Codex marketplace path audited against that failing test first.

4–10. The wider edit

4. Octomind 0.69.0

URL: https://github.com/Muvon/octomind (opens in a new tab) · release 0.69.0 (Nov 3, 2026) · https://octomind.run (opens in a new tab) What: Rust CLI AI coding-agent runtime (interactive, headless, daemon, ACP, workflows, MCP). Pricing: Open source; cloud/hub login for default OctoHub models. ❌ Not tested (agent loop): we downloaded the x86_64-unknown-linux-musl binary; sha256 matched the release; --version printed octomind 0.69.0. A non-interactive run without credentials returned OctoHub 401 (“Missing API key” / run octomind login). No completed agent turn.

5. Vercel Security Review (public beta)

URL: https://vercel.com/blog/vercel-security-review (opens in a new tab) (Nov 2, 2026) · docs https://vercel.com/docs/agent/security-review (opens in a new tab) What: Diff-scoped vuln scans on every push to connected GitHub repos; findings in Security dashboard + PR comments (private/internal); optional one-click fixes via Vercel Agent. Pricing: Pro/Enterprise; free until Nov 10, 2026, then Agent rate + $0.25/M tokens (Vercel's blog). ❌ Not tested: needs a Vercel project + GitHub. Our notes: https://readmodelmag.com/stories/vercel-security-review (opens in a new tab)

6. Anthropic Message Threads (Messages API beta)

URL: https://claude.com/resources/articles/message-threads (opens in a new tab) · API beta header message-threads-2026-08-12 What: Create/continue threads so long Claude Code-style sessions can replay context; Anthropic cites ~35% median TTFT improvement on 500k–1M-token Claude Code requests. Tokens and pricing unchanged; 5-minute idle expiry; not for ZDR/HIPAA. Pricing: Standard Messages API token pricing (unchanged per Anthropic). ❌ Not tested: no API key on this box. Our notes: https://readmodelmag.com/stories/anthropic-message-threads (opens in a new tab)

7. OpenAI Pando (internal Git backend)

URL: https://openai.com/index/scaling-git-at-openai (opens in a new tab) (Nov 2, 2026) What: Git-compatible backend OpenAI built for monorepo agent load; claims nearly 80% lower median push latency, >57 TB in a single hour, >99% cache hit rates. Not a public product. Pricing: N/A (internal). ❌ Not tested: not available outside OpenAI. Our notes: https://readmodelmag.com/stories/openai-pando-git-backend (opens in a new tab)

8. OpenAI acquires Pierre

URL: https://openai.com/index/openai-to-acquire-pierre (opens in a new tab) (Nov 4, 2026) What: OpenAI will acquire Pierre Computer Company (Code Storage + open-source developer tools). Codex already uses Pierre Trees + Diffs; Code Storage fold-in is planned after close. Terms not disclosed; companies separate until close. Pricing: N/A. ❌ Not tested. Our notes: https://readmodelmag.com/stories/openai-acquires-pierre (opens in a new tab)

9. Rystic (local API simulators)

URL: https://www.rystic.ai/ (opens in a new tab) · YC F26 What: Local stateful simulators (Slack, GitHub, Stripe, Linear, …) you point SDKs at on localhost. Pricing: Pro trial (account + card per install docs); Enterprise offline option. ❌ Not tested: install requires a Rystic account and network check-in while simulators run; we did not open a trial.

10. SoL-Pi (NVIDIA NVlabs) / DevBox (RudderStack)

URL: https://github.com/NVlabs/SoL-Pi (opens in a new tab) · https://github.com/rudderlabs/devbox (opens in a new tab) What: SoL-Pi extends the Pi coding harness for cheaper auto-research loops. DevBox is RudderStack's MIT autonomous engineering harness (Linear → plan → PR). Pricing: Both open source (MIT); both need a model endpoint / Pi (or similar) to do real work. ❌ Not tested: no Pi install / no model keys for a meaningful harness run this morning.

Tools we tested and use

Affiliate link: MODEL may earn a commission if you sign up or buy through the link below, at no extra cost to you. It never affects our picks, our ranking or our verdicts, and nothing in this issue's Top 3 has an affiliate link. Disclosure (opens in a new tab)

Bolt.new: build a web app prototype from one prompt in the browser. We tested it on the free plan (Oct 15): one prompt gave a working newsletter signup page in about 3 minutes. The catch: it added extras we didn't ask for and invented reader stats, so rewrite the copy. Try Bolt (opens in a new tab) (Affiliate link)

Everything we've tested, with pros and cons: readmodelmag.com/stack (opens in a new tab)

Reply with the tool we should test next.

— MODEL Editors