Governance, Sold Separately

The interesting thing about an agent is not that it can act. It is who, if anyone, gets to say no before it does. That question has been migrating for months -- out of the model, out of the harness, into a layer of permissions and approvals and audit logs bolted on after the fact. This window it arrived somewhere new: a framework whose entire product is the layer that says no, sold separately from the thing that acts.

That framework is heypi, and it joins the watchlist this cycle. Someone building the adjacent thing put the moment plainly the same day: heypi looks awesome. love when great ideas converge. keep cooking@andrew_barba It is a TypeScript framework for governed team chat-ops agents: one agent your whole team uses in Slack, Discord, and Telegram, with approvals, an audit record, sandboxed tools, and encrypted secret handoff. What makes it a specimen and not just another entry is what it is built on. heypi pins Pi as a hard dependency, and Pi is the harness that has made a principle of refusing to govern: no permission popups, no plan mode, build your own confirmation flow. heypi is that confirmation flow, productized. The agent loop is the commodity underneath. The authority shell around it is the product on top.

That unbundling is the pattern of the window, and it flatters no one. Pi refuses governance and points upward. heypi sells the governance shell -- and ships its headline controls off by default. eve, the durability-first framework heypi positions against, runs the other way: its human-in-the-loop docs make approval gates and a pause-the-agent-for-a-human primitive first-class, riding the same durable runtime that survives a crash.

One channel over, the older form of the gap held: OpenHands merged a batch of dependency-CVE fixes to its default branch and shipped them in no release at all. The frontier is separating the thing that acts from the thing that says yes -- and this window the watchlist spread across the whole range of how seriously the saying-yes is shipped: documented and durable (eve), documented but switched off by default (heypi), and merged but never released (OpenHands).

The new entry: a governance shell with the conscience off

heypi is the most honest tool on the watchlist about its own edges, and reading it closely is an exercise in separating a landing page from a docs site. The landing page promises a multiplayer chat agent for your team with approvals, an audit trail, and sandboxed tools. The documentation describes something more modest and more interesting: a kit of governance primitives with conservative defaults, where the headline controls are things you assemble.

Start with the headline. heypi's marquee feature is approvals, and its own docs contain the sentence that walks the marquee back: approval does not make every tool call require approval. Tool confirmation does that. Out of the box there is no global approval posture. The bash runtime ships a default command classifier that blocks destructive commands and pauses for approval on risky ones -- but that is the only automatic gate. Every other tool runs ungated until an operator wires an approval policy by hand.

This is documented, not concealed. But it means a team that adopts heypi for its approvals is buying a kit, not a posture. A Show HN commenter put the value precisely: most frameworks forget the human-in-the-loop part, which is critical for anything with real side-effects. heypi remembers it, then leaves it switched off until you reach for the switch.

The conservatism that is real lives in the quieter defaults, and they are well chosen. The default runtime is an in-process bash interpreter over a virtual filesystem with the network off. The admin panel -- which is also where the advertised audit trail actually lives, as typed trace events rather than a standalone ledger -- is disabled by default, binds to loopback, and hands out a one-time login URL that expires in five minutes, with the docs warning never set it on a public host. Memory is off by default. None of this demos well. All of it is the difference between a chat-ops agent that survives a real team and one that becomes an incident.

heypi is best where it states a limit. The secret handoff encrypts a credential in the browser so it never enters chat history or the model context -- then immediately tells you the secret rests as a plaintext-readable file in the runtime workspace, and that the encryption protects the handoff, not the storage. It does not replay an in-flight turn after a crash, and says so -- the cleanest line between it and eve's checkpoint-everything pitch. A tool that names what it does not do is doing the reader a service the category rarely bothers with.

The 0.2.0-beta.0 beta tag (2026-06-23) tightened the defaults further: webhooks are now HTTPS-by-default, and a misplaced root-level approver block now fails loudly at startup instead of silently not binding. It is also a beta, and heypi cuts no GitHub releases at all -- only tags -- with two dozen further commits already sitting on main past the tag. The newest governance shell on the watchlist carries the same merged-versus-shipped gap as everything around it.

What the watchlist is actually taking on

Adding heypi means depending on it, so it is worth naming what that means. The night 0.2.0 beta shipped, its maintainer posted this:

He was releasing three projects at once. That is not a criticism of the work, which is good, and it is not a prediction about the project, which we are not making. It is the operator fact underneath a one-person dependency: the governance shell you are being sold is maintained by somebody with a finite week. Ask that question of every framework in this issue, including the ones with a company behind them.

Two other things shipped in the same forty-eight hours and both are the other half of the story. Hermes added a command to feed it directories of any source material (code, API docs, manuals, PDFs, configs) and it distills a verifiable reusable skill@NousResearch -- capability, announced with the word "verifiable" doing a lot of unaudited work. And a Paperclip fork arrived selling the governance layer as an org chart: You stay the board; the agents ship the work, with proof@bartender_loopy.

The prescription from the other side of the industry sounded, oddly, the same. A relayed talk quote had an OpenAI engineer saying 90% of our engineers use Codex subagent harnesses + loops to ship code 5× faster@0xMovez. We hold no primary source for that and the number is not a finding. But close the loop and let the agent verify its own output is the same answer this issue reaches from the governance direction, arrived at by people who were not thinking about approvals at all.

Where it sits

heypi is legible by contrast. Against Pi, it is the layer Pi told you to build yourself -- not a competitor but the floor's tenant. Against OpenClaw, the project it was first described as a version of (Openclaw, but for teams), it trades a single-user personal gateway for a multiplayer one, with approver and admin identities scoped per chat adapter rather than per sender. Against eve, it is governance-first and ownership-first where eve is durability-first and platform-hosted: an app you run on your own single host versus an agent that lives on a managed runtime.

The detail worth keeping: both document their governance. heypi undersells its approvals and ships them off by default, then disclaims crash-replay; eve makes human-in-the-loop a first-class primitive -- approval gates and a pause-for-a-human tool -- and lets its durable runtime resume the paused turn after a crash. Same axis, opposite emphases: govern-it-yourself-on-your-host versus govern-it-durably-on-a-platform. The fuller comparison lives in the new heypi profile.

The rest of the window: merged, not shipped, again

The watchlist proper was thin -- six of ten prior sources had nothing material in the day since the last digest closed -- but what moved repeated last window's lesson rather than breaking from it.

The one item an operator must act on is OpenHands'. A batch of dependency security fixes -- CVE-2026-44727 in jupyter-server, CVE-2026-49458 in dompurify, and three more in msgpack, idna, and bleach -- landed on main on 2026-06-23. No tag was cut; the only release is still 1.8.0 from 2026-06-10. So "OpenHands patched these CVEs" is true on the default branch and false in the binary most operators run. The operator's real question is the one the release page does not answer: which channel are you on? It is the exact shape of the gap that ran through Protected on Paper a week ago, still open.

The same gap, in lower stakes, was everywhere else. Codex cut five 0.143.0-alpha tags on 2026-06-23 while stable held at 0.142.0. Agent Zero put roughly nineteen commits onto its non-default ready branch and still has no tag past v1.20. heypi's own newest fixes sit on main past a beta. The newest work, almost everywhere, sits one channel ahead of the newest release.

One correction to last window is owed. Protected on Paper described Flue's private-by- default run-observability rewrite -- and the removal of flue logs -- as staged "in an Unreleased changelog section, not a tag." It has since shipped, in 0.11.0 (2026-06-09); this window added only a scoped @flue/react beta fix on top. The prior framing was accurate at its window close and is now superseded. We note it here rather than rewrite the published piece; the record is the git history, and corrections move forward.

Provider notes

heypi (0.1.0 through 0.2.0-beta.0) joins the watchlist as the governance-shell calibration source: the approvals/audit/sandbox/secret layer built on Pi, shipping conservative low-capability defaults (network-off sandbox, admin off, memory off) but leaving its headline approvals and audit trail for the operator to wire and operate. Current ship is a beta; newest fixes are on main.

OpenHands (1.8.0 release; security commits on main) merged a five-item dependency-CVE batch on 2026-06-23 into no tagged release, extending its multi-week pattern of an unreleased main backlog.

Codex (stable 0.142.0; 0.143.0 alpha train) cut five alpha tags on 2026-06-23; nothing reached the stable channel.

Agent Zero (v1.20) added roughly nineteen commits to its non-default ready branch on 2026-06-23 and remained untagged.

Flue (Tier 2; @flue/react 1.0.0-beta.4) shipped a scoped React beta fix; its private-by-default observability rewrite is confirmed shipped in 0.11.0, correcting last window's "Unreleased" framing.

Claude Code, Gemini CLI, Hermes Agent, Pi, OpenClaw, Paperclip had no material in-window change: last tags hold at 2.1.186, v0.47.0, v2026.6.19, v0.79.10, v2026.6.9, and v2026.618.0 respectively. Gemini and Hermes saw only infra and documentation commits on main; Paperclip's master-only controls remain untagged.

Somebody else's refusal

The unbundling is the story, and it flatters nobody. A harness that refuses to govern points upward. A framework whose entire product is the governance shell ships its headline controls off by default. Between them sits an operator who now buys the ability to say no as a separate product from the thing that acts.

That is not obviously wrong. Specialisation usually beats one vendor doing everything badly. But it changes what you are actually purchasing, and the thing worth being clear about is this: you are not buying a boundary. You are buying somebody else's promise to hold one, maintained on somebody else's week.

Ask who that somebody is before you depend on it.