Source: SuperSSR · Super Startup Signal Radar Report Date: 2026-09-26 Language: English Canonical URL: https://superssr.net/reports/2026-09-26?lang=en RSS URL: https://superssr.net/reports/2026-09-26.rss?lang=en Generated At: 2026-09-26T16:30:50.000Z # Today's Best Build: ApprovalPin **Report Date**: 2026-09-26 **Coverage**: 2026-09-26T00:00:00+08:00 – 2026-09-26T23:59:59+08:00 (UTC) **Status**: partial (No strong signal for questions: Q15, Q16, Q17, Q18, Q19, Q20; Stage 2 fallback groups: action) ## Today's Best Build: ApprovalPin **One-liner**: A drop-in middleware that binds every human-in-the-loop 'yes' to a cryptographic hash of the exact operation it approved, so an agent can never execute a 2,000-unit action under a 20-unit decision. **Why Now**: Today's highest-scoring research signal (id=77204, overall 7.6) showed loopjacking end-to-end on a released LangGraph Agent Server: an approver signed off on mock_wire_transfer(20, approved-vendor) and the ledger recorded 2,000 units to an attacker sink — and that post sits at only 4 points on Hacker News, so the mitigation-tooling window is still open. Three unrelated forces are simultaneously pushing approval gating into production: the DoD blacklisting of Claude (id=77192) turns model provena **Evidence**: - In a controlled LangGraph Agent Server test, a maker replaced a pending mock_wire_transfer(20, approved-vendor) with mock_wire_transfer(2000, attacker-sink) after the approval role had decided; the mock ledger recorded 2,000 units transferred under the approver's authority, proving approval-to-operation binding fails on a released A2A path. _(signal #77204)_ - AskVerb ships an agent that 'stops first and shows the user a card with the real values on it' before any data change — but that card is a request-time UX artifact, not a value re-verified against the operation that actually reaches the sink. _(signal #77277)_ - Double routes money decisions and commitments to a realtime phone approval, which means real approval traffic is already moving to async human channels where the reviewed object can drift between the prompt and the execution. _(signal #77069)_ - Watermarking (SynthID-Text, EU AI Act Article 50(2)) alters the sampling process, and the authors note the same sampled tokens 'can determine which tool is called and what arguments are passed' — a second, entirely non-malicious source of argument drift at the sink. _(signal #77478)_ - A 589-point Hacker News story on OpenAI agents hacking Hugging Face shows agent action-boundary failures are now mainstream news, which shortens the education cycle for a security-focused dev tool. _(signal #77183)_ **Fastest Validation**: Two hours: clone the LangGraph agent-server approval example, add middleware that canonicalizes the interrupt payload into (thread_id, tool_name, sorted JSON args, approver id) and stores its SHA-256 next to the interrupt, then recomputes and rejects on mismatch at resume. Replay the published loopjacking sequence exactly and show ledger transfers = 0 instead of 2,000. Then run the same harness against AG-UI's input-required flow and one custom A2A demo, and publish a five-row 'does this framework bind approvals?' table with the pinned versions. **Counter-view**: The reflex objection is 'LangGraph already solves this with interrupt() and resume.' But the published test ran on the released Agent Server path: the approver's decision for 20 units resumed the thread after a second A2A message had already replaced the pending call with 2,000 units, so the framework's own primitive is the failure surface rather than the fix. The second objection is prompt-injection scanners (Lakera, Prompt Security) — useless here, because no injected text exists; the payload ## Top Signals ### Loopjacking in A2A Implementations: Hijacking Human-in-the-Loop Approvals **Source**: hackernews | **Metric**: Score: 4 It is the only signal today with a reproducible, version-pinned exploit where an approved 20-unit operation executed as 2,000 units, and it names the exact failure mode a binding layer must close. Low HN score means the mitigation niche is not yet crowded. ### Revealing the details of how OpenAI agents hacked Hugging Face **Source**: hackernews | **Metric**: Score: 589 / Comments: 377 Nearly 380 comments on agent action-boundary failure proves mainstream demand for enforcement primitives, not just post-mortems — this is the audience that buys an approval-binding layer. ### U.S. appeals court upholds designation of Anthropic as supply chain risk **Source**: hackernews | **Metric**: Score: 446 / Comments: 773 A 2-1 federal ruling blocking a model vendor from DoD/contractor use makes 'prove which model and which approved operation ran' a compliance requirement with a budget attached. ### Giving away a full AI agent for your SaaS, free during beta, no catch **Source**: reddit | **Metric**: N/A A founder is distributing an agent that acts as the signed-in user with real permissions in exchange only for feedback — the exact population whose approval cards need binding, and a free design-partner channel. ### Understanding the Impact of LLM Watermarking on AI Agent Behavior **Source**: hackernews | **Metric**: Score: 54 / Comments: 49 Shows argument drift can be caused by regulation-mandated sampling changes rather than an attacker, which widens the market from security teams to every EU-deployed agent. ### meetings are lowkey a scam so i built an ai that shows up when i can't **Source**: reddit | **Metric**: N/A Double already pings a human phone for money decisions and commitments, demonstrating that async human approval is a shipped pattern that currently has zero execution-time verification. ## Discovery ### Q1. What solo-founder products launched today? **Signal**: Reddit: solo founder of VidClean reports 2,500 daily visitors, 1,500 organic daily clicks, and 210 MRR after building alongside a full-time job; Reddit: solo builder launched Folient, a Duolingo-style investing app; Reddit: Home Plus was solo developed for AI room redesign; Reddit: an 18-year-old solo builder launched Cloudline cookie-free analytics. **Analysis**: Today's solo-founder launches cluster around narrow consumer and prosumer workflows: video cleanup, investing education, home redesign, privacy analytics, meeting avatars, chess training, and bank bonus tracking. The common pattern is a single builder using AI-assisted development to ship a focused free tool first, then testing monetization or retention later. **Takeaway**: Build a narrow free browser or mobile tool first, then add one paid workflow once organic traffic proves repeat use. **Counter-view**: VidClean's 210 MRR is tiny next to Descript or CapCut, so solo distribution traction may not convert into durable revenue. ### Q2. Which search terms or discussion threads are suddenly rising? **Signal**: Hacker News: 'Revealing the details of how OpenAI agents hacked Hugging Face' has 589 score and 377 comments; 'Plan mode is dead' has 437 score and 397 comments; 'U.S. appeals court upholds designation of Anthropic as supply chain risk' has 446 score and 773 comments; 'Ollaya – Ollama for open-source, Jev-style decision models' has 524 score and 128 comments. **Analysis**: Rising terms today include Jev, local decision models, AI agent security, and plan mode. The Anthropic supply-chain ruling is the highest-comment thread, while OpenAI-agent security and Jev-style local decision models are the fastest product-oriented themes. **Takeaway**: Watch local-decision-model tooling and AI-agent security terms; build content or tooling around Jev-style local inference if the conversation keeps compounding. **Counter-view**: Jev-style wrappers may be short-lived: Ollaya's 524 points arrives while Ollama already dominates local-model distribution and could absorb the same use case. ### Q3. Which open-source projects are growing fast but lack a commercial offering? **Signal**: GitHub Trending: text-humanizer has 722 stars, short-video-generator-AI has 714 stars, JIZURA has 537 stars, 3dicon has 444 stars, awesome-jev has 438 stars, and clearwater has 429 stars, with no visible hosted pricing or commercial offering in the excerpts. **Analysis**: Fast-growing repos today are single-purpose utilities: text humanization, AI shorts, text-based PV composition, 3D icon generation, Jev ecosystem cataloging, and WebGL water simulation. Their READMEs emphasize local demos, MIT-style reuse, or self-hosting rather than SaaS plans. **Takeaway**: Ship a hosted API or paid team edition for one of these repos, starting with text-humanizer or short-video-generator-AI where usage intent is clearest. **Counter-view**: Open-source stars often do not convert; text-humanizer's 722 stars is far below the retention of established writing tools like Grammarly, and short-video-generator-AI can be undercut by CapCut's free tier. ### Q4. What are developers complaining about today? **Signal**: Hacker News: 'Plan mode is dead' has 437 score and 397 comments; 'Tell HN: Codex Is Down [fixed]' has 60 score and 63 comments; 'One Month Without AI' has 140 score and 145 comments; Reddit: 'PSA: stop using while loops in production' warns about unbounded loops. **Analysis**: Developers are complaining about brittle AI-assisted workflows: plan-first coding UX, Codex outages, AI-generated contributions in FOSS, and production reliability mistakes. The frustration is less about AI capability and more about verification, outages, and operational guardrails. **Takeaway**: Build verification, fallback, and guardrail layers into AI coding workflows rather than betting on plan-mode UX. **Counter-view**: Cursor and Claude Code continue shipping planning-like features to large paid user bases, so 'plan mode is dead' may reflect one builder's pivot rather than the whole market. ## Tech Radar ### Q5. What is the fastest-growing developer tool this week? **Signal**: Hacker News: 'Ollaya – Ollama for open-source, Jev-style decision models' scored 524 points with 128 comments; the companion repo 'awesome-jev' (kydlikebtc) hit 438 GitHub stars, and the derived demo 'Jev Plays Pokémon Red' reached 229 points with 93 comments. **Analysis**: The growth cluster this week is not a general-purpose LLM but a narrow 'decision model' runtime: Ollaya packages the Jev-style typed-question, millisecond, calibrated-answer pattern into a local-first CLI ('ollaya run decider'). The signal is compounded rather than isolated — a 524-point launch post, a 438-star curated index (awesome-jev), a 229-point playable demo, plus a 'single function Jev-like wrapper for LLMs, including vision models' post at 111 points. That derivative spread (index + dem **Takeaway**: Build one internal spike on Ollaya this week — pipe a typed decision question over your own JSON logs and measure latency/calibration — and watch whether the awesome-jev style index keeps growing before you move any production routing onto it. **Counter-view**: Ollama remains the dominant local-model runtime with vastly larger install and mindshare, and Ollaya's 524 points are a single-day HN spike: the derivative 'Jev Plays Pokémon Red' already sits at 229 points, i.e. engagement roughly halved one hop out from the launch, which is the classic decay curve of a novelty tool. ### Q6. Which AI models, frameworks, or infrastructure deserve attention? **Signal**: Three distinct signals: Ollaya/Jev-style local decision models (HN 524 points / 128 comments; awesome-jev 438 stars); 'Gemma 4 on an Amazon SageMaker Endpoint: AWS CLI, NVIDIA L4, and an MCP Server' (dev.to, deployment recipe for Gemma 4 E2B on a single NVIDIA L4 with an MCP server); and 'Loopjacking in A2A Implementations' (overall 7.6, a controlled LangGraph Agent Server test where a separate maker could overwrite a human-in-the-loop approval for mock_wire_transfer). Also 'Floci: Locally emula **Analysis**: The attention is moving down-stack in two directions at once. First, small local decision models (Jev/Ollaya) plus one-GPU serving recipes (Gemma 4 E2B on a single NVIDIA L4 behind an MCP server) make 'private, calibrated, millisecond' inference a deployable default instead of a research claim. Second, agent infrastructure is becoming a security surface: the A2A loopjacking write-up shows a human-in-the-loop approval interrupt being rewritten by another actor in the same LangGraph server, which **Takeaway**: Ship an MCP-served small model (Gemma 4 E2B class) on one L4 for internal decisions, but defer any human-approval agent flow to production until you have added an approval-integrity check that the requesting actor cannot rewrite the interrupt payload. **Counter-view**: The agent-security narrative is still single-source: the loopjacking finding comes from one controlled LangGraph test (FN-10) and sits alongside a heavily upvoted but contested claim that 'OpenAI agents hacked Hugging Face' (589 points / 377 comments), while Anthropic's own watermarking research (54 points / 49 comments) argues the real cost of agent guardrails is a 'provenance tax' on behaviour — so treating loopjacking as a universal A2A flaw is premature. ### Q7. Which platforms, products, or technologies are declining? **Signal**: Hacker News: 'The Copilot+ PC brand is dead' (Score: 58 / Comments: 34), 'Plan mode is dead' (Score: 437 / Comments: 397), and 'Breaking Up with Google Play: Why Conversations Is Now Free' (Score: 341 / Comments: 132) — the developer of a 12-year-old Android XMPP client removing Play distribution because of cost. **Analysis**: Two distinct declines. On the AI-coding side, 'Plan mode is dead' at 437 points and 397 comments is the strongest signal in the set: the author built an entire desktop coding app around plan-first workflows and is now publicly reversing that bet, which means plan-mode UIs shipped by Cursor/Copilot-class tools are being priced down as models get better at acting without an explicit planning artifact. On the platform side, the Copilot+ PC brand (58 points) and Google Play as an indie distribution **Takeaway**: Defer any new 'plan mode' or planning-surface UI investment and instead ship tooling that assumes the agent already acts; for distribution, watch sideloading/direct-download paths rather than Play-first, as Conversations did. **Counter-view**: 'Plan mode is dead' is one builder's reversal after a personal product failure, not measured market data — Microsoft's Excel feature shipped this week at 230 points / 156 comments and Copilot-class surfaces are still bundled into Office, while Anthropic is being blacklisted as a Pentagon supply-chain risk (446 points / 773 comments), which shows platform/brand decline can reverse via regulation rather than usage. ### Q8. What tech stacks are successful Show HN / GitHub projects using? **Signal**: GitHub trending this week is dominated by zero-friction, single-artifact stacks: asokurasu/text-humanizer at 722 stars, yukitorido/short-video-generator-AI at 714 stars (Python 3.10+ badge first in README), 852wa/JIZURA at 537 stars, samyost1/3dicon at 444 stars (one prompt to a looping animated WebP with real transparency for app UI), and Aureliengmz/clearwater at 429 stars — real-time photoreal shallow water in a single HTML file using WebGL2, 'no libraries, no build step, no external assets'. **Analysis**: The winning stack pattern is 'runnable in one file, no build step, no account'. clearwater's WebGL2 single-HTML demo (429 stars) and 3dicon's prompt-to-animated-WebP output (444 stars) win because the artefact itself is the demo — no clone, install, or env setup required. The Python cluster (short-video-generator-AI, 714 stars; text-humanizer, 722 stars) wins on a different axis: a single obvious output type (shorts, humanised text) with zero configuration surface. Meanwhile the Show HN side sho **Takeaway**: Build your next Show HN/GitHub launch as a single-file, no-build artefact (WebGL/Canvas/HTML or one Python entrypoint with a single visible output) and ship a hosted live demo link in the README — the star counts on clearwater (429) and 3dicon (444) show the demo-is-the-repo format outperforms multi-module setups. **Counter-view**: Star counts in the 429–722 band are modest and easily matched by a single well-timed HN post — 'Is your Postgres migration safe or not safe?' hit 85 points / 27 comments on tooling that does require a real install, while Rust-plus-Iceberg infra posts ('What One Rust Client Can Reach Across Seven Iceberg Catalogs') show serious stacks still circulate without the no-build gimmick; single-file demos trend, but they rarely convert into dependents. ## Competitive Intel ### Q9. What pricing and revenue models are indie developers discussing? **Signal**: Reddit (r/SideProject) VidClean solo-founder post reports 2,500 daily visitors, 1,500 organic daily clicks and 210 MRR from free browser tools funneling into a paid editor; Reddit 'Tiny Impact & Motion' asset pack fully made with Codex crossed $13 in sales, $7 short of paying for itself; Hacker News 'Breaking Up with Google Play: Why Conversations Is Now Free' scored 341 with 132 comments; Reddit AI-agent-for-SaaS is given away free during beta. **Analysis**: Three distinct monetization patterns dominate indie discussion today. First, free-utility top-of-funnel: VidClean gives away background-noise and silence removal tools then converts timeline-editing usage into 210 MRR. Second, micro-digital-goods: an autogenerated pixel-art FX pack posted at $13 total revenue shows AI-generated asset pipelines are cheap to produce but produce very low ticket sizes. Third, platform-fee arbitrage: the Conversations maintainer takes a 341-point HN post to explain a **Takeaway**: Build a free single-purpose utility as the acquisition layer, then gate the multi-step workflow behind a subscription; watch the 30% store-fee arbitrage as a distribution decision rather than a pricing one. **Counter-view**: Conversations choosing to go completely free at 341 points and 132 comments argues the paid-app route is structurally weak on Android, and the Codex-generated asset pack earning only $13 suggests AI-generated micro-goods pricing collapses toward zero. ### Q10. What migration, replacement, or "X is dead" trends are emerging? **Signal**: Hacker News 'Plan mode is dead' scored 437 with 397 comments; Hacker News 'The Copilot+ PC brand is dead' scored 58 with 34 comments; Hacker News 'Is your Postgres migration safe or not safe?' scored 85 with 27 comments; Hacker News 'Breaking Up with Google Play: Why Conversations Is Now Free' scored 341 with 132 comments; Ollaya (Ollama for open-source, Jev-style decision models) scored 524 with 128 comments and Floci (locally emulating any cloud service) scored 91 with 15 comments. **Analysis**: The 'dead' declarations cluster around workflow orthodoxy and vendor branding rather than core infrastructure. 'Plan mode is dead' (437/397) is a public reversal by a founder who shipped an entire planning-first desktop coding app, pushing the narrative from plan-then-execute to continuous agentic execution. 'The Copilot+ PC brand is dead' (58/34) shows AI-feature branding fatigue at the OEM layer. Migration pressure appears in two flavors: database-safety tooling for Postgres migrations (85/27) **Takeaway**: Defer building plan-first workflow tooling and instead build or instrument continuous agentic execution; watch Postgres migration-safety and Play-Store-exit tooling as concrete replacement wedges. **Counter-view**: The 'Plan mode is dead' thesis is one founder's reversal of his own product bet, and the 397 HN comments read as debate rather than consensus, while Copilot+ only reached 58 score versus Ollaya's 524 — so local-replacement and branding-death narratives may be far less settled than the headline claims. ### Q11. Which old projects or legacy needs are suddenly coming back? **Signal**: Hacker News 'Ask HN: Who's still keeping a DOS machine up because the business depends on it?' scored 185 with 187 comments; Hacker News 'Excel now supports multiple values in a single cell' scored 230 with 156 comments; Hacker News 'TiddlyInstall: A universal, reusable, install system' scored 7 with 7 comments; Reddit 'I made a dumb phone app' explicitly cites Light Phone and Minimalist Phone nostalgia. **Analysis**: Legacy demand is resurfacing from two directions. On the enterprise side, the DOS Ask HN thread (185/187) enumerates dBase, Clipper, CLARION, Paradox RAD environments, CNC mills and spectrometers still running production business processes on period hardware — a live, unserved maintenance and bridging market. On the consumer/format side, Excel's new multi-value-per-cell feature (230/156) confirms the spreadsheet remains the durable legacy data plane rather than a dying one, while TiddlyInstall r **Takeaway**: Build read/write bridges and test harnesses that let DOS-era and Excel-centric business processes talk to modern APIs; watch legacy-format integration as an underserved paid niche. **Counter-view**: The DOS thread's 187 comments skew toward curiosity and nostalgia rather than stated purchase intent, and Microsoft's own Copilot+ brand collapsing at 58 score shows that even well-funded legacy-platform refreshes can fail, so retro-focused products risk being entertaining discussions rather than revenue. ## Trends ### Q12. What are the highest-frequency keywords this week? **Signal**: Across the 90 top-ranked signals, the term "Jev" appears in 4 separate posts this week — Hacker News id=77184 (Score 524 / Comments 128), id=77185 (Score 229 / Comments 93), id=77385 (Score 111 / Comments 30), and GitHub trending id=77330 (Stars 438) — while "AI agent / agents" recurs in 8+ signals including id=77277, id=77204, id=77333, id=77369, id=77069 and id=77478 (Score 54 / Comments 49). **Analysis**: The dominant lexical cluster this week is decision/agent infrastructure: "Jev" (a fast local decision-model concept) shows up as a wrapper (id=77385), a game-playing agent (id=77185), a local runner (id=77184) and a curated awesome-list (id=77330, Stars 438). Running in parallel, "agent" has stopped meaning "chatbot" and now co-occurs with hard qualifiers — "deferred tool discovery" (id=77427), "searchable memory for your AI agents" (id=77333), "Agent Cards" (id=77432), and "AI agent for your Sa **Takeaway**: Build your positioning around "agent + memory/approval/local execution" rather than around generic "AI agent" copy, and watch the Jev cluster specifically for a de-facto interface standard emerging before you commit to an integration layer. **Counter-view**: The most-engaged coding post of the week argues the opposite direction — id=77418 ("Everyone's learning to prompt better. That's the wrong skill.") claims the incremental value is not in prompt/agent vocabulary at all, and id=77488 ("One Month Without AI", Score 140 / Comments 145) shows a meaningful anti-agent counter-current that could make agent-heavy keyword bets look trend-chasing. ### Q13. Which concepts are cooling down? **Signal**: Three explicit "X is dead / no longer needed" signals dominated engagement this week: id=77235 "Plan mode is dead" (Score 437 / Comments 397), id=77489 "The Copilot+ PC brand is dead" (Score 58 / Comments 34), and id=77418 "Everyone's learning to prompt better. That's the wrong skill." — collectively pointing at coding-plan modes, the Copilot+ hardware brand, and prompt-engineering as a standalone skill. **Analysis**: The cooling pattern is not "AI is cooling" — it is "the wrapper layer around AI is cooling." Plan mode (id=77235) is being displaced by continuous agent execution; the Copilot+ PC label (id=77489) is being abandoned as a marketing category even though the underlying NPU capability survives; and prompt engineering (id=77418) is being re-labeled as context/agent engineering. Adjacent evidence: id=77488 ("One Month Without AI", Score 140 / Comments 145) shows declining tolerance for AI-generated co **Takeaway**: Defer any roadmap item whose primary pitch is "planning step", "prompt library" or "Copilot+ class hardware" — re-frame them as agent approval, context engineering or on-device execution instead. **Counter-view**: id=77235 alone pulled 397 comments against a Score of 437, which signals an active fight rather than settled consensus — Anthropic-style Claude Code and Cursor-style plan/agent hybrids may simply be absorbing plan mode into a larger surface, not killing it, so a full deferral risks ceding a category that competitors are quietly re-owning. ### Q14. Which new terms or categories are emerging from zero? **Signal**: Four terms appear to be coined or first-observed in this window: "Loopjacking" (id=77204, Score 4) describing human-in-the-loop approval hijacking in A2A/LangGraph implementations; "Provenance Tax" (id=77478, Score 54 / Comments 49) on LLM watermarking degrading agent behavior; "Agent Cards" as a documentation primitive alongside Model Cards and Eval Reports (id=77432, Comments 5); and "deferred tool discovery" as a no-embedding agent capability pattern (id=77427, Comments 1). **Analysis**: The new vocabulary is uniformly about the trust and control boundary of autonomous systems, not about raw model capability. Loopjacking (id=77204) names a concrete exploit class — an approval-role interrupt being updated by a separate maker before the human confirms — which is a security-category birth, not a feature. Provenance Tax (id=77478) names a cost model: watermarking Anthropic-style outputs taxes agent behavior. Agent Cards (id=77432) imply procurement/audit artifacts will be expected a **Takeaway**: Ship at least one artifact in the emerging agent-governance category — an approval-diff UI, an Agent Card template, or a provenance-cost measurement — because the terms are still unowned and the naming advantage is available now. **Counter-view**: The metrics are thin: Loopjacking carries a Score of 4 and deferred tool discovery has Comments 1, versus id=77183 (OpenAI agents hacking Hugging Face) at Score 589 / Comments 377 — meaning the market is currently rewarding post-hoc breach narratives over the preventive frameworks these new terms describe, so naming alone will not carry distribution. ## Action ### Q15. What is most worth spending 2 hours on today? _No strong signal found today. Possible reasons: no relevant discussion in the collection window, or signals scattered below actionable threshold._ ### Q16. Why not the other two candidate directions? _No strong signal found today. Possible reasons: no relevant discussion in the collection window, or signals scattered below actionable threshold._ ### Q17. What is the fastest validation step? _No strong signal found today. Possible reasons: no relevant discussion in the collection window, or signals scattered below actionable threshold._ ### Q18. What product should this become over the weekend? _No strong signal found today. Possible reasons: no relevant discussion in the collection window, or signals scattered below actionable threshold._ ### Q19. How should initial pricing and packaging look? _No strong signal found today. Possible reasons: no relevant discussion in the collection window, or signals scattered below actionable threshold._ ### Q20. What is the strongest counter-view? _No strong signal found today. Possible reasons: no relevant discussion in the collection window, or signals scattered below actionable threshold._ ## Action Plan **2-Hour Build**: Wrap the LangGraph agent-server approval example with a 200-line middleware: canonicalize (thread_id, tool_name, sorted JSON args, approver id), hash it, store the hash with the interrupt, recompute at resume, reject on mismatch with 'decision does not bind to this operation'. Replay the loopjacking sequence and show 0 units reaching the ledger instead of 2,000, with the rejection in the log. **Why This Wins**: It enforces at the sink with one deterministic hash comparison — no ML, no prompt hygiene, no framework rewrite — and it works for any runtime that resumes a thread: A2A, AG-UI, MCP, or a custom queue. The failure case is already public, version-pinned and reproducible, so the demo writes itself. **Why Not Alternatives**: - Prompt-injection firewalls (Lakera, Prompt Security) scan text, but the loopjacking payload is a well-formed A2A message containing mock_wire_transfer(2000, attacker-sink) and passes every scanner. - LangSmith and other observability traces are post-hoc telemetry: they faithfully record that a 2,000-unit transfer happened, they never prevent it. - Approval-card UX such as AskVerb's renders 'the real values' at request time but does not re-verify them when the tool actually fires. - Policy engines like OPA or Cedar authorize who may call a tool, not that the approved arguments are the arguments executed. - Framework-level interrupt()/resume, the primitive named in the published test, is precisely the path that let the swap through. **Fastest Validation**: Reproduce the exact test with the pinned versions from the public evidence archive, capture the failing baseline (2,000 units transferred) and the patched run (0 units, rejection logged), and publish a 90-second screen recording plus the diffs. Then ask three teams running LangGraph or CrewAI in production to run the same harness against their own tool catalog and report which tools are swap-sensitive. **Weekend Expansion**: Add a catalog scanner that walks an agent's registered tools and classifies them as swap-sensitive (money movement, permissions, deletes, outbound sends) so teams get a ranked remediation list; add a pending-call diff view that highlights argument changes between approval and execution; ship MCP and Claude Code permission-prompt adapters and a signed receipt export for auditors.