top repos

{
  "id": "P11-R-001",
  "evidence_class": "observed",
  "source": "https://github.com/temporalio/temporal",
  "observed": "2026-08-27",
  "name": "temporalio/temporal",
  "category": "retry-workflow",
  "license": "MIT",
  "license_verified": "body",
  "claim": "Durable execution server: workflow state persisted as an event history, so retries, timers and long-running action sequences survive process death. 22.5k stars, pushed 2026-08-27.",
  "hosted_embeddable": "yes",
  "limitations": "Heavy operational footprint (server + persistence + matching/history services); MIT covers the server but Temporal Cloud is the vendor's business, so self-hosting is on you. Workflow code must be deterministic, which constrains how connector actions are written.",
  "disposition": "register"
}

{
  "id": "P11-R-002",
  "evidence_class": "observed",
  "source": "https://github.com/restatedev/restate",
  "observed": "2026-08-27",
  "name": "restatedev/restate",
  "category": "retry-workflow",
  "license": "BSL-1.1",
  "license_verified": "body",
  "claim": "Durable execution runtime with built-in idempotency keys on invocations and a single embedded binary — far lighter to run than Temporal for the same durable-retry guarantee. 4.3k stars, pushed 2026-08-27.",
  "hosted_embeddable": "conditional",
  "limitations": "LANDMINE: LICENSE body is Business Source License 1.1, not an OSI licence. Additional Use Grant forbids a 'Public Restate Platform Service' — a managed service letting third parties register their own service deployments and invoke them. Actionist running Restate to execute its OWN tenants' actions is permitted; exposing Restate registration/invocation to customers as a platform is not.",
  "disposition": "register"
}

{
  "id": "P11-R-003",
  "evidence_class": "observed",
  "source": "https://github.com/inngest/inngest",
  "observed": "2026-08-27",
  "name": "inngest/inngest",
  "category": "retry-workflow",
  "license": "SSPL-1.0",
  "license_verified": "body",
  "claim": "Event-driven durable step functions with automatic retry/backoff per step and a local dev server. 5.8k stars, pushed 2026-08-27.",
  "hosted_embeddable": "no",
  "limitations": "LANDMINE: routinely described as open source, but LICENSE.md is Server Side Public License v1.0 with an Apache-2.0 future grant. SSPL section 13 forces release of the entire service-management stack if offered as a service. Disqualifying for an embedded multi-tenant Actionist runtime. Study only.",
  "disposition": "rejected"
}

{
  "id": "P11-R-004",
  "evidence_class": "observed",
  "source": "https://github.com/triggerdotdev/trigger.dev",
  "observed": "2026-08-27",
  "name": "triggerdotdev/trigger.dev",
  "category": "retry-workflow",
  "license": "Apache-2.0",
  "license_verified": "badge",
  "claim": "Background-job platform with durable retries, checkpoint/resume and concurrency controls, self-hostable. 16.1k stars, pushed 2026-08-27.",
  "hosted_embeddable": "yes",
  "limitations": "Apache-2.0 read from repo metadata, not LICENSE body — verify before adopting. Self-host path is real but assumes their whole platform (dashboard, worker fleet, Postgres, Redis); it is a product to run beside Actionist, not a library to embed.",
  "disposition": "register"
}

{
  "id": "P11-R-005",
  "evidence_class": "observed",
  "source": "https://github.com/hatchet-dev/hatchet",
  "observed": "2026-08-27",
  "name": "hatchet-dev/hatchet",
  "category": "retry-workflow",
  "license": "MIT",
  "license_verified": "badge",
  "claim": "Postgres-backed distributed task queue with durable execution, retries and rate limits — no separate broker beyond Postgres. 7.8k stars, pushed 2026-08-27.",
  "hosted_embeddable": "yes",
  "limitations": "MIT via metadata, body unread. Smaller community than Temporal; Postgres-as-queue caps throughput well below a dedicated broker. Cloud offering exists so watch for future licence drift.",
  "disposition": "top10"
}

{
  "id": "P11-R-006",
  "evidence_class": "observed",
  "source": "https://github.com/resonatehq/resonate",
  "observed": "2026-08-27",
  "name": "resonatehq/resonate",
  "category": "retry-workflow",
  "license": "Apache-2.0",
  "license_verified": "badge",
  "claim": "Durable promises as the primitive: async/await semantics that survive crashes, deliberately smaller surface than Temporal. 657 stars, pushed 2026-08-27.",
  "hosted_embeddable": "yes",
  "limitations": "Only 657 stars — smallest of the durable-execution set, real single-vendor and abandonment risk. Ecosystem and SDK coverage thin. Good conceptual reading for the retry seam even if not adopted.",
  "disposition": "register"
}

{
  "id": "P11-R-007",
  "evidence_class": "observed",
  "source": "https://github.com/dbos-inc/dbos-transact-ts",
  "observed": "2026-08-27",
  "name": "dbos-inc/dbos-transact-ts",
  "category": "retry-workflow",
  "license": "MIT",
  "license_verified": "badge",
  "claim": "Durable workflows as a TypeScript library backed by Postgres — no separate server process, which is the lightest embeddable durable-execution seam found. 1.3k stars, pushed 2026-08-26.",
  "hosted_embeddable": "yes",
  "limitations": "MIT via metadata only. Requires Postgres and couples workflow checkpoints to the application database, which collides with per-tenant data isolation if tenants share a cluster. Vendor also sells a cloud, so watch licence.",
  "disposition": "top10"
}

{
  "id": "P11-R-008",
  "evidence_class": "observed",
  "source": "https://github.com/paveg/hono-idempotency",
  "observed": "2026-08-27",
  "name": "paveg/hono-idempotency",
  "category": "idempotency",
  "license": "MIT",
  "license_verified": "badge",
  "claim": "Stripe-style Idempotency-Key middleware implementing IETF draft-ietf-httpapi-idempotency-key-header: SHA-256 request fingerprinting to block key reuse with a different payload, optimistic locking for concurrent replays, RFC 9457 problem details, non-2xx deliberately not cached, pluggable memory/Redis/KV/D1 stores. README read directly.",
  "hosted_embeddable": "yes",
  "limitations": "13 stars, effectively one author — adopt the SPEC and the design, not the dependency. Hono-coupled. The semantics list is the most complete idempotency contract found anywhere in this survey and is worth reimplementing verbatim.",
  "disposition": "top10"
}

{
  "id": "P11-R-009",
  "evidence_class": "observed",
  "source": "https://github.com/hardcoretech/djangorestframework-idempotency-key",
  "observed": "2026-08-27",
  "name": "hardcoretech/djangorestframework-idempotency-key",
  "category": "idempotency",
  "license": "MIT",
  "license_verified": "badge",
  "claim": "DB-backed idempotency-key middleware for Django REST Framework; second-most maintained idempotency package located. 14 stars, pushed 2026-08-11.",
  "hosted_embeddable": "conditional",
  "limitations": "14 stars, Django-only, irrelevant to a TS/Go runtime. Listed as evidence for the gap finding: this is near the TOP of the idempotency field by maintenance, which is itself the headline.",
  "disposition": "register"
}

{
  "id": "P11-R-010",
  "evidence_class": "observed",
  "source": "https://github.com/stripe/stripe-node",
  "observed": "2026-08-27",
  "name": "stripe/stripe-node",
  "category": "idempotency",
  "license": "MIT",
  "license_verified": "badge",
  "claim": "Reference CLIENT-side implementation of idempotency-key generation and automatic safe retry against a server that honours the header. 4.5k stars, pushed 2026-08-27.",
  "hosted_embeddable": "yes",
  "limitations": "Client half only — contains no server-side key store, fingerprinting or replay logic, which is the half Actionist must build. Useful as the canonical behavioural spec for what a connector caller expects.",
  "disposition": "register"
}

{
  "id": "P11-R-011",
  "evidence_class": "observed",
  "source": "https://github.com/upstash/ratelimit-js",
  "observed": "2026-08-27",
  "name": "upstash/ratelimit-js",
  "category": "rate-limit",
  "license": "MIT",
  "license_verified": "badge",
  "claim": "Redis-backed rate limiting with fixed-window, sliding-window and token-bucket algorithms plus multi-region support; small enough to read end to end. 2.0k stars, pushed 2026-08-24. NOTE: canonical repo is upstash/ratelimit-js, not upstash/ratelimit.",
  "hosted_embeddable": "yes",
  "limitations": "MIT via metadata. Written against Upstash Redis REST; using self-hosted Redis means swapping the client. Per-process limiter, not a shared global quota service — per-tenant per-connector fairness still needs design.",
  "disposition": "top10"
}

{
  "id": "P11-R-012",
  "evidence_class": "observed",
  "source": "https://github.com/envoyproxy/ratelimit",
  "observed": "2026-08-27",
  "name": "envoyproxy/ratelimit",
  "category": "rate-limit",
  "license": "Apache-2.0",
  "license_verified": "badge",
  "claim": "Standalone gRPC rate-limit service with hierarchical domain/descriptor config — the production pattern for a limiter shared across many callers. 2.7k stars, pushed 2026-08-26.",
  "hosted_embeddable": "yes",
  "limitations": "Apache-2.0 via metadata. Go service plus Redis to operate; descriptor config is static YAML, so per-tenant dynamic limits mean generating config or forking. Designed for Envoy, usable standalone but that is off the main path.",
  "disposition": "register"
}

{
  "id": "P11-R-013",
  "evidence_class": "observed",
  "source": "https://github.com/ThreeDotsLabs/watermill",
  "observed": "2026-08-27",
  "name": "ThreeDotsLabs/watermill",
  "category": "outbox",
  "license": "MIT",
  "license_verified": "badge",
  "claim": "Go event-driven library with a first-class Forwarder/outbox component: publish inside the DB transaction, forward to the broker after commit — the transactional-outbox seam as a library. 9.9k stars, pushed 2026-08-25.",
  "hosted_embeddable": "yes",
  "limitations": "MIT via metadata. Go-only. Gives at-least-once delivery, so the consumer still needs the idempotency layer to reach effectively-once; outbox and idempotency are complementary, not substitutes.",
  "disposition": "top10"
}

{
  "id": "P11-R-014",
  "evidence_class": "observed",
  "source": "https://github.com/debezium/debezium",
  "observed": "2026-08-27",
  "name": "debezium/debezium",
  "category": "outbox",
  "license": "Apache-2.0",
  "license_verified": "badge",
  "claim": "CDC platform with a documented outbox-event-router SMT — the reference implementation of the transactional outbox pattern at scale. 13.0k stars, pushed 2026-08-27.",
  "hosted_embeddable": "yes",
  "limitations": "Apache-2.0 via metadata. Drags in Kafka Connect and the JVM; enormously heavier than the delivery problem Actionist has today. Read the outbox router design, do not deploy it for v1.",
  "disposition": "register"
}

{
  "id": "P11-R-015",
  "evidence_class": "observed",
  "source": "https://github.com/obsidiandynamics/goharvest",
  "observed": "2026-08-27",
  "name": "obsidiandynamics/goharvest",
  "category": "outbox",
  "license": "BSD-3-Clause",
  "license_verified": "badge",
  "claim": "Focused Go implementation of Postgres-to-Kafka outbox harvesting with leader election.",
  "hosted_embeddable": "yes",
  "limitations": "MAINTENANCE RISK: last push 2022-11-10, effectively unmaintained, 207 stars. Kafka-specific. Value is as a compact readable reference for the harvester loop, not a dependency.",
  "disposition": "rejected"
}

{
  "id": "P11-R-016",
  "evidence_class": "observed",
  "source": "https://github.com/openbao/openbao",
  "observed": "2026-08-27",
  "name": "openbao/openbao",
  "category": "secrets",
  "license": "MPL-2.0",
  "license_verified": "badge",
  "claim": "Linux Foundation fork of Vault taken from the last MPL-2.0 commit before the BSL relicense; keeps dynamic secrets, leasing/renewal, transit encryption and audit under a genuine OSI licence. 7.2k stars, pushed 2026-08-27.",
  "hosted_embeddable": "yes",
  "limitations": "MPL-2.0 is file-level copyleft: modifications to OpenBao source files must be published, though linking and hosting are unrestricted. Younger than Vault, so enterprise integrations and some plugins lag. This is the correct choice over Vault purely on licence.",
  "disposition": "top10"
}

{
  "id": "P11-R-017",
  "evidence_class": "observed",
  "source": "https://github.com/hashicorp/vault",
  "observed": "2026-08-27",
  "name": "hashicorp/vault",
  "category": "secrets",
  "license": "BUSL-1.1",
  "license_verified": "body",
  "claim": "The incumbent secrets manager: dynamic secrets, leasing, transit encryption, broad audit. 36.2k stars, pushed 2026-08-26.",
  "hosted_embeddable": "no",
  "limitations": "LANDMINE: LICENSE body is Business Source License 1.1 with the licensor now IBM (post-acquisition), covering Vault 1.15.0 and later. Additional Use Grant bars offering the work to third parties hosted or embedded in a way that competes with IBM's paid versions. A credential vault inside a hosted multi-tenant Actionist is exactly the contested zone. Use OpenBao instead.",
  "disposition": "rejected"
}

{
  "id": "P11-R-018",
  "evidence_class": "observed",
  "source": "https://github.com/Infisical/infisical",
  "observed": "2026-08-27",
  "name": "Infisical/infisical",
  "category": "secrets",
  "license": "MIT with ee/ carve-out",
  "license_verified": "body",
  "claim": "Developer-friendly secrets platform with per-environment secrets, rotation and dynamic secrets; strong UX for the credential-management surface. 29.0k stars, pushed 2026-08-27.",
  "hosted_embeddable": "conditional",
  "limitations": "LANDMINE (partial, confirmed in LICENSE body): 'All content that resides under any ee/ directory... licensed under the license defined in ee/LICENSE'; everything outside is MIT Expat. The MIT badge is true only of the non-ee tree, so any adopted feature must be checked for whether it lives under ee/ before it is relied on.",
  "disposition": "register"
}

{
  "id": "P11-R-019",
  "evidence_class": "observed",
  "source": "https://github.com/getsops/sops",
  "observed": "2026-08-27",
  "name": "getsops/sops",
  "category": "secrets",
  "license": "MPL-2.0",
  "license_verified": "badge",
  "claim": "CNCF file-level encryption for config and secrets with KMS/age/PGP backends; encrypts values while leaving keys readable in git. 22.9k stars, pushed 2026-08-26.",
  "hosted_embeddable": "yes",
  "limitations": "MPL-2.0 via metadata. Solves secrets AT REST in files, not runtime per-tenant credential brokering with leases and revocation, which is the actual connector problem. Complementary to OpenBao, not a substitute.",
  "disposition": "register"
}

{
  "id": "P11-R-020",
  "evidence_class": "observed",
  "source": "https://github.com/bitnami-labs/sealed-secrets",
  "observed": "2026-08-27",
  "name": "bitnami/sealed-secrets",
  "category": "secrets",
  "license": "Apache-2.0",
  "license_verified": "badge",
  "claim": "One-way-encrypted Kubernetes Secrets safe to commit to git; controller decrypts in-cluster. 9.3k stars, pushed 2026-08-27. NOTE: repo has moved to bitnami/sealed-secrets.",
  "hosted_embeddable": "yes",
  "limitations": "Apache-2.0 via metadata. Kubernetes-only and operator-facing; handles cluster config secrets, not end-user OAuth tokens that must be rotated and revoked per tenant. Wrong layer for the connector credential problem.",
  "disposition": "rejected"
}

{
  "id": "P11-R-021",
  "evidence_class": "observed",
  "source": "https://github.com/oauth2-proxy/oauth2-proxy",
  "observed": "2026-08-27",
  "name": "oauth2-proxy/oauth2-proxy",
  "category": "token-broker",
  "license": "MIT",
  "license_verified": "badge",
  "claim": "Battle-tested reverse proxy performing OAuth2/OIDC against many providers, with session and token storage. 14.9k stars, pushed 2026-08-27.",
  "hosted_embeddable": "yes",
  "limitations": "MIT via metadata. Guards INBOUND access to your app; it is not an outbound token broker holding many third-party tokens per tenant for connector calls. Refresh handling is per-session, not per-tenant-per-connector. Direction of use is wrong for P11.",
  "disposition": "register"
}

{
  "id": "P11-R-022",
  "evidence_class": "observed",
  "source": "https://github.com/ory/hydra",
  "observed": "2026-08-27",
  "name": "ory/hydra",
  "category": "token-broker",
  "license": "Apache-2.0",
  "license_verified": "badge",
  "claim": "Certified OAuth2/OIDC server with a hardened token lifecycle: issuance, refresh, rotation, revocation and introspection. 17.5k stars, pushed 2026-07-29.",
  "hosted_embeddable": "yes",
  "limitations": "Apache-2.0 via metadata. Makes Actionist an authorization SERVER; the connector need is to be a CLIENT holding third-party tokens. Adopt the token-lifecycle model (rotation, revocation, introspection) rather than the server. Slowest push date in the token set.",
  "disposition": "register"
}

{
  "id": "P11-R-023",
  "evidence_class": "observed",
  "source": "https://github.com/dexidp/dex",
  "observed": "2026-08-27",
  "name": "dexidp/dex",
  "category": "token-broker",
  "license": "Apache-2.0",
  "license_verified": "badge",
  "claim": "CNCF federated OIDC provider that brokers to upstream identity providers via connectors — the closest OSS analogue to a multi-provider credential broker. 11.1k stars, pushed 2026-08-24.",
  "hosted_embeddable": "yes",
  "limitations": "Apache-2.0 via metadata. Its connectors are IDENTITY connectors (who is the user) rather than API-authorization connectors (act on the user's behalf at a SaaS). Does not store or refresh long-lived third-party API tokens.",
  "disposition": "register"
}

{
  "id": "P11-R-024",
  "evidence_class": "observed",
  "source": "https://github.com/svix/svix-webhooks",
  "observed": "2026-08-27",
  "name": "svix/svix-webhooks",
  "category": "webhooks",
  "license": "MIT",
  "license_verified": "badge",
  "claim": "Webhook-sending service with signature verification, retry schedules, endpoint management and replay. 3.4k stars, pushed 2026-08-26.",
  "hosted_embeddable": "yes",
  "limitations": "NOTE: the brief's svix/svix returns 404 — the real repo is svix/svix-webhooks. MIT via metadata; the SDKs are unambiguously MIT while the vendor's business is the hosted service, so confirm the server component's terms before self-hosting. Solves OUTBOUND webhook sending; inbound webhook INGEST from connectors is a separate build.",
  "disposition": "top10"
}

{
  "id": "P11-R-025",
  "evidence_class": "observed",
  "source": "https://github.com/frain-dev/convoy",
  "observed": "2026-08-27",
  "name": "frain-dev/convoy",
  "category": "webhooks",
  "license": "Elastic-2.0",
  "license_verified": "body",
  "claim": "Webhook gateway handling both ingest and dispatch with retries, rate limiting, fan-out and a replay UI — functionally the best fit for the connector webhook plane. 2.9k stars, pushed 2026-08-27.",
  "hosted_embeddable": "no",
  "limitations": "LANDMINE: LICENSE body is Elastic License 2.0 behind a click-through preamble, not OSI open source. ELv2 forbids providing the software to third parties as a hosted or managed service. A multi-tenant Actionist webhook plane built on Convoy is precisely the prohibited use. Study the architecture only.",
  "disposition": "rejected"
}

{
  "id": "P11-R-026",
  "evidence_class": "observed",
  "source": "https://github.com/hookdeck/hookdeck-cli",
  "observed": "2026-08-27",
  "name": "hookdeck/hookdeck-cli",
  "category": "webhooks",
  "license": "Apache-2.0",
  "license_verified": "badge",
  "claim": "Apache-2.0 CLI for local webhook forwarding and replay against the Hookdeck service. 360 stars, pushed 2026-08-24.",
  "hosted_embeddable": "conditional",
  "limitations": "Only the CLI is open; the Hookdeck event gateway itself is closed SaaS. Same shape as the Composio trap already caught on this project: a permissive licence on a thin client to a paid hosted API. Adopting this is buying a vendor, not adopting OSS.",
  "disposition": "rejected"
}

{
  "id": "P11-R-027",
  "evidence_class": "observed",
  "source": "https://github.com/modelcontextprotocol/servers",
  "observed": "2026-08-27",
  "name": "modelcontextprotocol/servers",
  "category": "mcp-runtime",
  "license": "Apache-2.0 / MIT mixed",
  "license_verified": "body",
  "claim": "Reference MCP server collection, the de facto catalog of the MCP tool ecosystem. 89.9k stars, pushed 2026-08-20.",
  "hosted_embeddable": "conditional",
  "limitations": "LANDMINE: reports as NOASSERTION. LICENSE body states the project is mid-transition from MIT to Apache-2.0; new contributions are Apache-2.0, but contributions whose authors have not granted relicensing consent REMAIN MIT, and 'no rights beyond those granted by the applicable original license are conveyed'. Per-file provenance matters. Separately, reference servers assume a trusted local operator: no tenancy, no per-call authorization.",
  "disposition": "register"
}

{
  "id": "P11-R-028",
  "evidence_class": "observed",
  "source": "https://github.com/modelcontextprotocol/registry",
  "observed": "2026-08-27",
  "name": "modelcontextprotocol/registry",
  "category": "mcp-runtime",
  "license": "Apache-2.0 / MIT mixed",
  "license_verified": "body",
  "claim": "Official community registry for MCP server discovery — the closest thing to a canonical connector catalog for the MCP ecosystem. 7.2k stars, pushed 2026-08-26.",
  "hosted_embeddable": "conditional",
  "limitations": "Same mixed MIT/Apache-2.0 transition text as the servers repo, verified in body. Registry solves DISCOVERY; it carries no execution-safety story — no signing guarantee that a listed server is the code it claims, and no runtime permission model. Publisher trust is unsolved.",
  "disposition": "register"
}

{
  "id": "P11-R-029",
  "evidence_class": "observed",
  "source": "https://github.com/lasso-security/mcp-gateway",
  "observed": "2026-08-27",
  "name": "lasso-security/mcp-gateway",
  "category": "mcp-runtime",
  "license": "MIT",
  "license_verified": "badge",
  "claim": "Security gateway sitting between agent and MCP servers to inspect and filter tool traffic, including secret-leak detection — one of very few OSS projects owning MCP runtime safety.",
  "hosted_embeddable": "conditional",
  "limitations": "MAINTENANCE RISK: last push 2026-01-22, roughly seven months stale, 385 stars. Small single-vendor project. Directionally the right seam (a policy point in front of tool calls); too thin to depend on.",
  "disposition": "register"
}

{
  "id": "P11-R-030",
  "evidence_class": "observed",
  "source": "https://github.com/Portkey-AI/gateway",
  "observed": "2026-08-27",
  "name": "Portkey-AI/gateway",
  "category": "mcp-runtime",
  "license": "MIT",
  "license_verified": "badge",
  "claim": "Fast AI gateway with retries, fallbacks, load balancing and guardrails across providers — a mature example of the interception-point pattern applicable to tool calls. 12.8k stars.",
  "hosted_embeddable": "conditional",
  "limitations": "MAINTENANCE: last push 2026-05-25, about three months stale. Aimed at LLM provider routing rather than tool/action execution, so the retry and guardrail machinery would need re-pointing at connectors. Open core beside a paid cloud — watch scope of the MIT tree.",
  "disposition": "register"
}

{
  "id": "P11-R-031",
  "evidence_class": "observed",
  "source": "https://github.com/microsoft/playwright",
  "observed": "2026-08-27",
  "name": "microsoft/playwright",
  "category": "browser-runtime",
  "license": "Apache-2.0",
  "license_verified": "badge",
  "claim": "The browser-automation substrate nearly every agentic browser tool builds on: cross-browser, strong isolation via contexts, deterministic waiting. 95.2k stars, pushed 2026-08-26.",
  "hosted_embeddable": "yes",
  "limitations": "Apache-2.0 via metadata. Corporate-backed, no licence risk. Gives no agent-level reasoning and no sandbox by itself — a browser context is not a security boundary, so untrusted-page execution still needs OS/VM isolation underneath.",
  "disposition": "top10"
}

{
  "id": "P11-R-032",
  "evidence_class": "observed",
  "source": "https://github.com/Skyvern-AI/skyvern",
  "observed": "2026-08-27",
  "name": "Skyvern-AI/skyvern",
  "category": "browser-runtime",
  "license": "AGPL-3.0",
  "license_verified": "badge",
  "claim": "LLM-driven browser workflow automation for sites with no API — directly relevant to the long tail of connectors. 22.9k stars, pushed 2026-08-27.",
  "hosted_embeddable": "no",
  "limitations": "LICENCE BLOCKER: AGPL-3.0. Section 13 triggers on network use, so offering Skyvern's functionality over a network in a hosted Actionist obliges releasing the corresponding source of the combined work. Strongest copyleft in this survey. Study only unless a commercial licence is bought.",
  "disposition": "rejected"
}

{
  "id": "P11-R-033",
  "evidence_class": "observed",
  "source": "https://github.com/browser-use/browser-use",
  "observed": "2026-08-27",
  "name": "browser-use/browser-use",
  "category": "browser-runtime",
  "license": "MIT",
  "license_verified": "badge",
  "claim": "Most-starred agentic browser library at 111.3k stars, pushed 2026-08-26; MIT, unlike the AGPL Skyvern alternative.",
  "hosted_embeddable": "yes",
  "limitations": "MIT via metadata. Star count vastly outruns production maturity — treat popularity as a claim, not a verdict. No built-in tenancy, credential isolation or egress control; wrapping it safely is the actual work.",
  "disposition": "register"
}

{
  "id": "P11-R-034",
  "evidence_class": "observed",
  "source": "https://github.com/browserbase/stagehand",
  "observed": "2026-08-27",
  "name": "browserbase/stagehand",
  "category": "browser-runtime",
  "license": "MIT",
  "license_verified": "badge",
  "claim": "Playwright-layered automation exposing act/extract/observe primitives, allowing deterministic Playwright and AI steps to be mixed in one script. 24.1k stars, pushed 2026-08-27.",
  "hosted_embeddable": "yes",
  "limitations": "MIT via metadata. Built by Browserbase, whose business is hosted browser infrastructure — the OSS core steers toward their paid runtime, so check for hard dependencies before self-hosting. Still Playwright underneath, so the sandbox gap is unchanged.",
  "disposition": "register"
}

{
  "id": "P11-R-035",
  "evidence_class": "observed",
  "source": "https://github.com/e2b-dev/infra",
  "observed": "2026-08-27",
  "name": "e2b-dev/infra",
  "category": "sandbox",
  "license": "Apache-2.0",
  "license_verified": "badge",
  "claim": "The self-hostable Firecracker-based infrastructure behind E2B sandboxes — the actual isolation layer, as opposed to the SDK repo. 1.3k stars, pushed 2026-08-27.",
  "hosted_embeddable": "yes",
  "limitations": "Apache-2.0 via metadata. Operationally demanding (Nomad/Consul-class orchestration, custom kernel images). The heavily-starred e2b-dev/E2B repo is largely SDK plus docs, so evaluate THIS repo when judging whether E2B is genuinely self-hostable.",
  "disposition": "top10"
}

{
  "id": "P11-R-036",
  "evidence_class": "observed",
  "source": "https://github.com/firecracker-microvm/firecracker",
  "observed": "2026-08-27",
  "name": "firecracker-microvm/firecracker",
  "category": "sandbox",
  "license": "Apache-2.0",
  "license_verified": "badge",
  "claim": "AWS microVM monitor giving hardware-virtualization isolation with ~125ms boot — the strongest isolation-per-millisecond boundary available for untrusted action code. 36.3k stars, pushed 2026-08-26.",
  "hosted_embeddable": "yes",
  "limitations": "Apache-2.0 via metadata. Requires KVM, so bare metal or nested-virt instances only — not runnable on most managed container platforms. Raw primitive: no scheduler, no filesystem or network plumbing, no snapshot lifecycle. Build cost is high.",
  "disposition": "register"
}

{
  "id": "P11-R-037",
  "evidence_class": "observed",
  "source": "https://github.com/google/gvisor",
  "observed": "2026-08-27",
  "name": "google/gvisor",
  "category": "sandbox",
  "license": "Apache-2.0",
  "license_verified": "badge",
  "claim": "Userspace kernel intercepting syscalls to isolate containers without full virtualization; runs as an OCI runtime, so it drops into existing container tooling. 19.2k stars, pushed 2026-08-27.",
  "hosted_embeddable": "yes",
  "limitations": "Apache-2.0 via metadata. Syscall-interception overhead on IO-heavy work, and incomplete syscall coverage breaks some binaries. Weaker boundary than a microVM but far cheaper to adopt — the pragmatic middle for connector code execution.",
  "disposition": "register"
}

{
  "id": "P11-R-038",
  "evidence_class": "observed",
  "source": "https://github.com/cloudflare/workerd",
  "observed": "2026-08-27",
  "name": "cloudflare/workerd",
  "category": "sandbox",
  "license": "Apache-2.0",
  "license_verified": "badge",
  "claim": "The Workers runtime: V8 isolates with per-isolate memory limits and a capability-style binding model where code reaches only explicitly granted resources. 8.6k stars, pushed 2026-08-27.",
  "hosted_embeddable": "yes",
  "limitations": "Apache-2.0 via metadata. JS/WASM only, so no arbitrary binaries. Isolates are a weaker boundary than a VM and share a process. The BINDING model — no ambient network or filesystem, only injected capabilities — is the most valuable idea here and is portable to any runtime.",
  "disposition": "register"
}

{
  "id": "P11-R-039",
  "evidence_class": "observed",
  "source": "https://github.com/denoland/deno",
  "observed": "2026-08-27",
  "name": "denoland/deno",
  "category": "sandbox",
  "license": "MIT",
  "license_verified": "badge",
  "claim": "JS/TS runtime with deny-by-default permissions: --allow-net, --allow-read and friends make egress and filesystem access an explicit per-process grant. 108.3k stars, pushed 2026-08-26.",
  "hosted_embeddable": "yes",
  "limitations": "MIT via metadata. Permission flags are process-level, so one connector per process to get useful granularity. Deno Subhosting is a paid managed product, not an OSS multi-tenant control plane — self-hosting per-tenant isolation is a build.",
  "disposition": "register"
}

{
  "id": "P11-R-040",
  "evidence_class": "observed",
  "source": "https://github.com/bytecodealliance/wasmtime",
  "observed": "2026-08-27",
  "name": "bytecodealliance/wasmtime",
  "category": "sandbox",
  "license": "Apache-2.0",
  "license_verified": "badge",
  "claim": "WASM runtime with capability-based WASI security: a module has no ambient authority and can touch only pre-opened handles the host grants. 18.6k stars, pushed 2026-08-26.",
  "hosted_embeddable": "yes",
  "limitations": "Apache-2.0 via metadata (with LLVM exception in the WASM ecosystem — verify body before shipping). Connector code must compile to WASM, which rules out most existing SDKs. Host-function surface is where bugs would live.",
  "disposition": "register"
}

{
  "id": "P11-R-041",
  "evidence_class": "observed",
  "source": "https://github.com/nestybox/sysbox",
  "observed": "2026-08-27",
  "name": "nestybox/sysbox",
  "category": "sandbox",
  "license": "Apache-2.0",
  "license_verified": "badge",
  "claim": "OCI runtime enabling unprivileged containers to run Docker/systemd inside, strengthening the container boundary without a VM. 3.8k stars, pushed 2026-08-25.",
  "hosted_embeddable": "conditional",
  "limitations": "Apache-2.0 via metadata, but the project was acquired by Docker and the community edition's investment level is uncertain — confirm which components remain open. Linux-only. Weaker isolation than Firecracker.",
  "disposition": "register"
}

{
  "id": "P11-R-042",
  "evidence_class": "observed",
  "source": "https://github.com/open-policy-agent/opa",
  "observed": "2026-08-27",
  "name": "open-policy-agent/opa",
  "category": "action-policy",
  "license": "Apache-2.0",
  "license_verified": "badge",
  "claim": "Graduated CNCF general-purpose policy engine; Rego can express per-tenant allow/deny over an action request including target host, method and parameters, evaluated as a library in-process. 12.2k stars, pushed 2026-08-27.",
  "hosted_embeddable": "yes",
  "limitations": "Apache-2.0 via metadata. Rego has a real learning curve and policies are hard to review. OPA DECIDES but does not ENFORCE — egress control still needs a proxy or network policy to make the decision binding. Nothing here is action-specific; the action model is yours to define.",
  "disposition": "top10"
}

{
  "id": "P11-R-043",
  "evidence_class": "observed",
  "source": "https://github.com/cerbos/cerbos",
  "observed": "2026-08-27",
  "name": "cerbos/cerbos",
  "category": "action-policy",
  "license": "Apache-2.0",
  "license_verified": "badge",
  "claim": "Authorization service with YAML resource/action policies — markedly more readable than Rego and natively shaped as principal-performs-action-on-resource, which maps directly onto tool calls. 4.6k stars, pushed 2026-08-27.",
  "hosted_embeddable": "yes",
  "limitations": "Apache-2.0 via metadata. Runs as a sidecar/service rather than embedding as cleanly as OPA. Smaller ecosystem; open core beside a paid managed offering, so check feature placement. Like OPA, it decides but does not enforce egress.",
  "disposition": "register"
}

{
  "id": "P11-R-044",
  "evidence_class": "observed",
  "source": "https://github.com/permitio/opal",
  "observed": "2026-08-27",
  "name": "permitio/opal",
  "category": "action-policy",
  "license": "Apache-2.0",
  "license_verified": "badge",
  "claim": "Real-time policy and data distribution layer keeping OPA agents live-synced with policy and application data — the missing piece for revoking a tenant's connector permission instantly. 5.5k stars, pushed 2026-08-24.",
  "hosted_embeddable": "yes",
  "limitations": "Apache-2.0 via metadata. Adds a distributed component (servers plus clients) whose own failure modes matter: a stale policy cache is a security event, not just an outage. Only worth it once policy is genuinely dynamic per tenant.",
  "disposition": "register"
}

{
  "id": "P11-R-045",
  "evidence_class": "observed",
  "source": "https://github.com/apache/casbin",
  "observed": "2026-08-27",
  "name": "apache/casbin",
  "category": "action-policy",
  "license": "Apache-2.0",
  "license_verified": "badge",
  "claim": "Embeddable authorization library with a model/policy split and mature ports across most languages. 20.4k stars, pushed 2026-08-21. NOTE: repo now redirects to apache/casbin.",
  "hosted_embeddable": "yes",
  "limitations": "Apache-2.0 via metadata. PERM model fits RBAC/ABAC over static resources; expressing conditions on action PAYLOADS (this amount, this recipient) is awkward compared with Rego. Per-language ports vary in quality and lag the Go original.",
  "disposition": "register"
}