DEV Community

Fenju Fu
Fenju Fu

Posted on

Astron Open Source · Bi-Weekly Report (Aug 10 – Aug 23, 2026)

#opensource #ai #agents #news

🌟 Highlights

  • The four active repositories covered in this report merged 47 PRs: Astron Agent 13 · SkillHub 12 · Astron RPA 4 · Dolphin MCP Pilot 18. The three established core repositories accounted for 29 of them.
  • Two releases landed during the cycle: SkillHub v0.2.17 and the first official Dolphin MCP Pilot v0.3.0.
  • HER Hack-Astron #2 named and merged its Champion contribution: Astron Agent #1607 adds an opt-in, OpenTelemetry-compatible Langfuse path with end-to-end traces, token/cost data, evaluations, privacy-safe defaults, and real self-hosted validation.
  • Astron Agent made workflow packages safer to move between environments, with sanitized dependency manifests, deterministic resource mapping, unresolved-dependency reports, authorization checks, and execution blocking when imports are incomplete.
  • SkillHub v0.2.17 connected governance metadata to daily operations: immutable compliance declarations are visible in discovery and review, administrators can govern namespace membership and lifecycle, and authorization/scan delivery received targeted fixes.
  • Astron RPA added an explicitly scoped RISC-V path for the Java 21 resource-service, while Dolphin MCP Pilot moved to a stateless MCP 2.0 server without dropping MCP 1.x or stdio compatibility.

👥 Top 10 Active Community Contributors

Based on message volume across 44 exported open-source discussion-group records. Automated Q&A responses and obvious automated welcome messages were excluded; display-name aliases were normalized and nicknames anonymized. Thank you to everyone who answered questions, asked questions, and built alongside us 🙌

Top 10 Active Community Contributors

📦 Release & Development Highlights

🤖 Astron Agent — production Langfuse observability and portable workflows

Astron Agent merged 13 PRs during the reporting window.

  • 🏆 HER Hack-Astron #2 Champion — end-to-end Langfuse traces: #1607, contributed by @whyiug and @MittaPei, uses an OTLP/HTTP bridge rather than adding a Langfuse SDK dependency to core. It correlates Workflow, Agent, generation, retriever, tool, and evaluator observations; propagates signed W3C trace context across services; records canonical token/cost inputs; and supports trace-level scores. The integration is disabled by default, input/output capture is separately opt-in, sensitive fields are filtered, and exporter failures are isolated from request execution. Validation used a real self-hosted Langfuse v4.6.0 stack with synthetic data.
  • 📦 Dependency-aware YAML import/export: #1612 and #1615 export a sanitized dependency manifest, map resources by original ID or a unique compatible contract, preserve schema identities and references, and report mapped, ambiguous, or unresolved dependencies. Incomplete imports are blocked from execution; authorization checks and failed-import compensation protect cross-environment moves. Follow-up refactoring extracted a dedicated portable YAML parser (#1620).
  • 🔌 A documented public integration boundary: the new bilingual guide explains how an external application calls a published workflow over HTTP/SSE, including authentication, request fields, streaming events, interrupt/resume, production safeguards, and runnable cURL, Python, and Node.js examples (#1596).
  • 🛡️ Community and content-safety documentation improved through a security/privacy policy update and a clearer Code of Conduct contact path (#1616, #1613).

🧰 SkillHub v0.2.17 — compliance visibility, namespace governance, and safer delivery

SkillHub merged 12 PRs and published v0.2.17 on Aug 21. The release has no known breaking change and no new Flyway migration.

  • 🧾 Compliance metadata became reviewable and discoverable: immutable version-level x-astron-compliance snapshots are shown in skill details, search results, and discovery cards; reviewers get a human-readable added/removed/modified declaration diff (#697, #699, #703). The contract documents the boundary between a Skill's declaration and runtime enforcement/trace evidence (#704).
  • 🏢 Administrator namespace governance now covers platform-wide listing, member and role management, ownership transfer, freeze/unfreeze, archive, and restore, while normal /me/namespaces semantics remain tied to actual membership (#707).
  • 🔐 API token authorization gaps were closed for labels, stars, ratings, downloads, and authentication-method discovery. A regression guard now detects accidental drift between session/cookie and API-token policy lists (#729).
  • 🛡️ Security scan tasks are published only after the database transaction commits, preventing workers from racing uncommitted skill_version or security_audit rows and avoiding ghost tasks on rollback (#733).
  • 🐛 Additional fixes restored the private-skill publish event, corrected Aliyun stop commands, and made backend development launchers explicitly use Bash (#738, #698, #721).

⚙️ Astron RPA — scoped RISC-V support and more reliable API endpoints

Astron RPA merged 4 PRs.

  • 🧩 Initial linux/riscv64 backend image support is now available for the Java 21 resource-service only (#846). The build compiles the architecture-neutral JAR on the Buildx host and runs the target image on Eclipse Temurin 21; CI checks image metadata and starts Java through QEMU. This does not claim RISC-V support for the Windows client, automation engine, Python services, Java 8 services, or the full Compose stack.
  • 🔗 Versioned AI API base paths are preserved: model discovery and chat-completions calls no longer drop a prefix such as /v1 when the configured base URL has no trailing slash (#828).
  • 🐍 The script node now returns the Python module result correctly (#836).

🐬 Dolphin MCP Pilot — first release, stateless MCP 2.0, and an evidence-backed recovery case

Dolphin MCP Pilot merged 18 PRs and published its first official release, v0.3.0.

  • 🚀 The first release ships 53+ production tools across projects, workflows/DAGs, schedules, instances, resources, logs, monitoring, version rollback, and task recovery. It supports API-token or username/password authentication, per-request multi-tenant credentials, raw API passthrough for uncovered edges, and development/production Compose profiles.
  • 📦 Multi-architecture GHCR publication and a production-oriented Compose file landed with #10 and #12.
  • 🔌 Stateless MCP 2.0: #22 migrates to the public MCP SDK 2.0 server API, serves the 2026-07-28 stateless protocol at the existing /mcp/ endpoint, isolates credentials per request, and retains MCP 1.29 and stdio compatibility.
  • 🧯 A real failure-recovery case was merged: #38 records an agent verifying a failed release gate, retrieving the task log and exit code, restarting from the failed task, and confirming the same workflow instance reached SUCCESS without rerunning the already-successful upstream task.

💬 Community Q&A & Discussions (Bi-Weekly Picks)

The following themes were distilled from anonymized WeCom support and open-source discussion records for Aug 10–23. Automated responses were not treated as authoritative unless a human resolution or repository evidence confirmed them. 🟢 Resolved · ℹ️ Clarified · 🟡 Follow-up needed.

Astron Agent

  • ℹ️ How should an existing application call a published workflow? Use the supported HTTP/SSE boundary rather than importing internal Python or Java modules as if they were stable SDKs. The new integration guide documents authentication, streaming events, multi-turn interrupt/resume, and production safeguards.
  • 🟡 Why can knowledge parsing take several minutes even when model calls are healthy? One group observed an upload taking roughly eight minutes while normal model requests remained responsive. Treat ingestion as a separate pipeline: capture document size/type, parser status transitions, worker logs, and timestamps before escalating. The record did not establish a final root cause, so this remains a performance follow-up rather than a resolved diagnosis.

SkillHub

  • 🟢 OpenClaw's UI install could not resolve a namespace—was work blocked? No. The support thread used the clawhub CLI as a temporary installation path while the UI recognition issue was recorded; OpenClaw can invoke the CLI during conversation, so the package workflow remained usable.
  • ℹ️ Does “subscribe” mean a notification for every newly published Skill? Not currently. The exposed subscription APIs are scoped to a specific Skill. A global “notify me when any new Skill appears” feed should be treated as a separate feature request.
  • 🟡 A private OAuth callback reaches SuccessHandler, but the dashboard redirect still looks cross-origin even behind one Nginx—what next? A shared hostname alone does not prove cookie and proxy metadata are correct. Capture the callback response, redirect chain, Set-Cookie attributes, forwarded scheme/host headers, and the first failing browser request; do not conclude “CORS” from the browser message alone. The thread did not contain a verified final fix.
  • 🟡 Why can PostgreSQL fail only on an offline/internal Docker host? The observed errors pointed to write/permission failures in the PostgreSQL data path. Use the repository's runtime.sh so its preparation steps run, then verify volume ownership, mount type, SELinux/AppArmor policy, and the exact Compose/runtime versions. The thread recorded a deployment-specific failure, not a universal database defect.

Astron RPA

  • 🟢 Why did the desktop client stall at the last startup step on a managed Windows PC? In the confirmed case, starting under an administrator account resolved the scheduler/Python startup failure; the user's domain account had restricted permissions. Check account policy and writable data directories before repeatedly reinstalling.
  • ℹ️ Is exporting a workflow the same as exporting a team-market item? No. A YAML workflow artifact, application data, and a team-market listing are distinct objects. The support thread corrected an overly broad automated answer: market sharing/export was not available in the scenario being discussed. Confirm the exact artifact and product version before promising portability.
  • ℹ️ Can SkillHub-style subscriptions notify about every new Skill? This question surfaced in an RPA-heavy group but concerns SkillHub: existing subscription operations target one Skill, not a registry-wide new-publication feed.

🔭 Community Spotlight: HER Hack-Astron #2 results and #3 field cases

HER Hack-Astron #2 completed judging during the cycle. PR #1607 by @whyiug and @MittaPei won the Champion award; #1614, #1610, #1609, and #1608 were recognized as outstanding contributions. The winning implementation was merged on Aug 18.

The community then moved from instrumentation to operations evidence with HER Hack-Astron #3: contributors were asked to use Dolphin MCP Pilot with an MCP host, perform a real DolphinScheduler task, publish a direct public case, and submit reproducible, redacted evidence. The submission window closed Aug 23; judging was scheduled for Aug 24–30, so this report does not pre-announce a winner. The merged release-gate recovery case in #38 demonstrates the expected “claim → evidence → boundary → verified terminal state” standard.

🙌 Build With Us

Good starting points from this cycle include:

  • validate Astron Agent's portable workflow import against your own non-production environment and report ambiguous dependency contracts with a minimal package;
  • exercise the new Langfuse path with privacy-safe synthetic data and contribute deployment notes for another self-hosted topology;
  • test SkillHub compliance declarations and namespace governance with realistic reviewer/admin roles;
  • extend Astron RPA portability one component at a time, keeping architecture claims explicit and evidence-backed;
  • contribute a redacted Dolphin MCP Pilot case that changes real workflow state and verifies the terminal outcome instead of stopping at “submitted.”

Before starting, comment on the relevant issue so maintainers can confirm scope and avoid duplicated work.

🔗 Explore the Astron Open-Source Ecosystem

Methodology note: PR totals use GitHub merged_at timestamps from Aug 10 through Aug 23, 2026 (UTC calendar dates). Dolphin MCP Pilot's total includes five Dependabot PRs; the three established core repositories account for 29 merged PRs. Community activity was parsed from 44 exported msg.htm records containing 909 in-range message headers. Display-name aliases were normalized for the chart; automated Q&A responses and obvious automated welcome messages were excluded. Questions were anonymized and condensed; customer/group identities, phone numbers, meeting links, and environment-specific private details were not published.

Questions, ideas, or a contribution to share? Join the community discussion or open an Issue / PR in the relevant repository. Let's keep building open, production-ready infrastructure for enterprise AI Agents 🚀

Originally published in the iFLYTEK open-source community discussion: https://github.com/orgs/iflytek/discussions/11

Top comments (0)