A lighter week on the conference calendar, but a solid set of stories — agent infrastructure, open source governance, and two developer conversations worth your time. Here's what mattered.
Coding agents broke Git's scaling math. GitHub is rebuilding to keep up.
GitHub processed 7.38 billion commits in September 2026 — five times the volume from a year earlier. Pushes are up 4.9x. Actions runs are up 4x. The driver isn't a surge in human developers. It's agents, and they use Git differently. A developer pushes a few times a day. An agent might run dozens of commit cycles in the same window, often in parallel, often across multiple repos at once. The single-writer-per-repo model that Git has run on for 20 years doesn't hold up under that pattern. GitHub is addressing it with a new storage backend that benchmarks at up to 35x write throughput improvement in internal testing, a rewrite of its replication layer to reduce latency and improve durability under load, and intelligent caching that treats agent-generated and human-generated traffic differently. The engineering post is a useful read for anyone whose pipelines are already feeling the pressure.
Read more
Ask your IT team how many AI agents are running in your org. Watch the pause. HYCU's aiR Graph is now generally available and free to any organization. It connects read-only to Microsoft Entra ID and Okta, maps every agent's OAuth scopes and write access, and ranks agents that can reach systems with no backup highest. The scoring is deterministic — no LLM in the chain, which means two runs on the same tenant produce the same answer, and every finding traces back to an identity field. HYCU's CPO Anant Chintamaneni put it directly: "Run it twice on the same tenant, and you get the same answer." That matters when you're taking the findings to an auditor. The tool also surfaces something easy to miss: agents that have been retired while the account behind them stays live. A working credential with no one watching it.
Read more
A developer named Anji Xu built a floating status card for Claude Code that lives above the terminal prompt. It shows context window usage, five-hour and seven-day rate limits with countdown timers, running session cost, current git branch, and GitHub Actions status for the active branch — updating every 10 seconds while a run is live. It uses Claude Code's new mod system, which is still early access. The tool itself is a personal gauge. The idea behind it points somewhere bigger: as agents run longer jobs, the person at the keyboard needs the same telemetry they already expect from build systems and production services. The bigger job for platform teams is getting that data into shared systems, not just one developer's terminal.
Read more
Open Source Summit Europe: 311 hours per release and a kernel sandbox for AI agents
Three numbers from Prague worth holding onto. Forty-eight percent of organizations maintain private open source forks. Those that do spend an average of 311 hours per release cycle patching 9.5 forks. And the EU Cyber Resilience Act's mandatory reporting requirements took effect in September — which is starting to make that math uncomfortable. Ericsson's response: eliminate the forks, push 1,400-plus fixes upstream. The broader summit news included nono, a kernel-enforced sandbox for AI agents from Sigstore creator Luke Hinds. When an agent tries to open a file or reach the network, the kernel checks it against a policy written in code. The model can't talk its way around it. Six months in, nono has 328,278 installs. The through-line from Prague: enforcement is moving down the stack.
Read more
Developer Spotlights this week
Anders Dahl Rasmussen works as a supervisor at Oslo Airport. At night, he builds AI products. "I'm not technical at all," he said. He's built 14 tools, reviews every AI-generated page before it goes live, and has one standing rule for anyone starting out: set "some hard rules with your AI because AI makes mistakes." His framing for the division of labor: "I take all the shot calling and he builds." A useful conversation for anyone thinking about where the human check belongs.
Watch the conversation
Kevin Martínez, software architect and frontend chapter lead at Orbitant, makes a point that's easy to understate: "now it's super easy to code but it's harder to choose what's the right code or what's the right test." His take on AI adoption without agreed team workflows: it's going to "increase the chaos in the team." His answer is deterministic tests, which he says "solved problems before AI and can continue solving problems with AI." He also created TWD, an open-source tool that runs frontend tests in the browser.
Watch the conversation
The through-line this week: the tooling for agent governance is arriving, and it's moving from the prompt layer down to the kernel and the identity provider. From HYCU mapping agent permissions to nono enforcing them at the OS level to GitHub rebuilding its infrastructure to absorb what agents generate — the shift is real and it's picking up pace.
See you next Friday.
Developer Weekly Briefing is published every Friday on Coder Legion. Written by Tom Smith.