🚀 Astron Open Source · Bi-Weekly Report (Sep 7 – Sep 20, 2026)

[FenjuFu]

🚀 Astron Open Source · Bi-Weekly Report (Sep 7 – Sep 20, 2026)

---

🌟 Highlights

• Spark-X2.5-4B reached Welcome to the iFLYTEK Open Source Community 👋 #1 on the Hugging Face 7-day trending board. It was refactor: centralize docs by linking to community repository #3 on the morning of Sep 7 and Welcome to the iFLYTEK Open Source Community 👋 #1 by that evening. On Sep 11, ten days after launch, XHToken models on Hugging Face passed 100,000 total downloads.
• Running Spark-X2.5 locally got much easier. Official Q4_K_M / Q8_0 GGUF quantizations landed on Sep 7. Native support then followed in LM Studio (Sep 8), PocketPal AI on iOS and Android (Sep 11), Ollama v0.34.1 (Sep 15) and Unsloth Studio (Sep 20). Last cycle, Ollama and LM Studio still needed a locally compiled fork; now the official builds work out of the box.
• Four releases shipped: the Astron Agent v1.1.2 security release (Sep 7), SkillHub v0.2.20 (Sep 13, Skill Suites), v0.2.21 (Sep 19, Suite Bundles and CLI OAuth login), and SkillHub CLI 0.1.12 (Sep 9).
• Five repositories merged 53 PRs: SkillHub 34 · Astron RPA 7 · Astron Agent 5 · MemFlywheel 4 · Dolphin MCP Pilot 3. No PRs were merged in the XHToken organization this cycle; the Spark-X2.5 repository maintained its README release log through direct commits.
• Two Astron Agent workflow bugs reported in the community groups were fixed and verified by the reporter within 48 hours. One was a code-node SyntaxError when model-generated JSON contained newlines; the other was a lost final-turn Trace in long multi-turn conversations, caused by Kafka MSG_SIZE_TOO_LARGE (#1671–#1675).
• HER Hack-Astron 🚀 Astron Open Source · Bi-Weekly Report (Jun 15 – Jun 28, 2026) #5 announced its results on Sep 19 (one Champion and 13 Outstanding Contribution Awards). HER Hack-Astron 🚀 Astron Open Source · Bi-Weekly Report (Jun 29 – Jul 12, 2026) #6, a math-reasoning challenge, opened on Sep 7 and closed submissions on Sep 13, with judging from Sep 14 to Sep 20.
• Two more milestones: Astron Agent was onboarded to the Linux Foundation's LFX Insights on Sep 15, and SparkLLM received the Jinsuan Award for Edge Intelligence Innovation on Sep 11.

👥 Top 10 Active Community Contributors

Based on message volume across 23 exported open-source discussion groups. Automated Q&A accounts, welcome/broadcast accounts and advertising were excluded; display-name aliases were normalized and nicknames anonymized. Two members tied for 10th place and are both shown. Thank you to everyone who answered questions, asked questions, and built alongside us 🙌

---

📦 Release & Development Highlights

📋 Ecosystem Release Overview (Sep 7 – Sep 20)

Project	Released this cycle	Latest version / notes
Astron Agent	✅ v1.1.2 (Sep 7, security release)	Two workflow fixes merged after the release are in the latest images; no new tag yet
SkillHub	✅ v0.2.20 (Sep 13) · v0.2.21 (Sep 19) · CLI 0.1.12 (Sep 9)	v0.2.21 / CLI 0.1.12
Astron RPA	—	v1.1.6 (2026-02-25); 7 security and MCP execution-management PRs merged this cycle, not yet released
Dolphin MCP Pilot	—	v0.3.1 (2026-08-31)
MemFlywheel	—	v0.1.1 (2026-07-28); dependency updates only this cycle
HarnessClaw / Engine	—	v0.0.24-beta.0 (07-02) / v0.0.23-beta.0 (06-16)
Domux · iFly-Skills · AstronClaw Tutorial	—	Not released through GitHub Releases; AstronClaw Tutorial refreshed its doc-watch baseline
XHToken/Spark-X2.5	📝 3 new README release entries	9/8 LM Studio · 9/11 PocketPal AI · 9/15 Ollama v0.34.1; Unsloth section added 9/20
XHToken/Spark-plugin	—	v0.1.0 (2026-08-28)
Other XHToken repositories (forks of llama.cpp, sglang, vllm, LlamaFactory, Spark-MLX-LLM, plus community)	—	No new releases
Hugging Face · XHToken	✅ Official Q4_K_M and Q8_0 GGUF for 4B / 1.7B (Sep 7)	10 model repos + 1 dataset (gaokao_math_2026); no new repos; the Spark-X2.5 collection was updated Sep 16

✨ Spark-X2.5: from "it runs" to "install and run"

The second week after launch focused on closing the remaining gaps in local deployment:

• 📦 Official GGUF quantizations. On Sep 7, Spark-X2.5-4B-GGUF gained Q4_K_M (2.6 GB) and Q8_0 (4.4 GB), with matching files in Spark-X2.5-1.7B-GGUF. This delivers the quantized GGUF promised in the last report.
• 🧩 Native support in mainstream local runtimes. Upstream llama.cpp has supported Spark2_5ForCausalLM since b10829 (Sep 6), and the team published a video running a community 1.7B Q4_K_M GGUF on a Windows CPU with the official b10833 build. LM Studio 0.4.0+ (Sep 8), PocketPal AI on the App Store and Google Play (Sep 11) and Unsloth Studio (Sep 20) followed, including a recorded bilingual equation-solving run in LM Studio.
• 📢 Sep 15: Ollama now officially supports the Spark-X2.5 architecture, so it's one command to run! Update Ollama to v0.34.1 or later and run ollama run SparkLLM/Spark-X2.5-1.7B (or SparkLLM/Spark-X2.5-4B). No runtime replacement or fork build is needed anymore.
• 📈 Downloads. GGUF is the most popular format: as of Sep 28, 4B-GGUF shows about 399,000 downloads over the last 30 days and 1.7B-GGUF about 155,000, while Spark-X2.5-4B has 1,334 likes.
• 📚 FAQ and answers. The Spark-X2.5 FAQ collects the most common questions about the vLLM plugin, llama.cpp, fine-tuning and 1M-token context. For LLaMA-Factory fine-tuning, see the guide in the XHToken fork, because upstream support has not been merged yet (#7). A community developer ran 4B Q8 on an RK3588 (8 GB, NPU-assisted) at about 5.9 tokens/s (#8).

🤖 Astron Agent: the v1.1.2 security release, plus two community-reported workflow fixes

v1.1.2 (Sep 7) ships the security hardening from the previous cycle. See GHSA-mh3w-4q3f-2fg5:

• 🚨 The built-in isolated LangChain/Pyodide code executor is now the default, and unsafe local execution is rejected. Untouched legacy configuration is migrated automatically, while explicit process-level overrides (including intentionally disabling code nodes) are preserved. Authentication on internal Workflow and Tenant APIs and tenant isolation were also strengthened.
• 🔒 SSRF in outbound plugin requests was fixed (#1669), and the XSS, artifact and sandbox boundaries were hardened (#1643).
• 🔭 Other changes include Langfuse integration with end-to-end agent traces (#1607) and hardened dependency-aware workflow YAML imports (#1623).
• 🐳 All eight core service images plus Console Hub and Console Frontend were pushed to GHCR for linux/amd64 and linux/arm64.

⚠️ Upgrade note: set ASTRON_AGENT_VERSION=v1.1.2 in docker/astronAgent/.env and update the deployment files and service images together. CODE_EXEC_TYPE=local is no longer supported, and code that relies on the host filesystem, subprocesses or network access may need changes.

Two fixes after the release (5 PRs), both from reports in the community groups (see Community Q&A below):

• 🧾 Preserve code-node source escapes (#1671 → main via #1672). The pinned Pyodide CLI rewrote literal \n sequences passed through -c, which corrupted multi-line string inputs. The fix switches to the -f entry point with an invocation-specific UTF-8 source file. 33 test cases cover multi-line JSON, CRLF, Unicode, concurrency and resource limits.
• 📉 Smaller Trace payloads for long conversations (#1673 → main via #1675, refactor in #1674). The OpenAI-compatible provider now writes a single completion summary instead of logging every streaming frame, and large nested strings are offloaded to object storage before serialization. Reporting diagnostics now include the sid, flow ID and payload byte count.

💡 Both fixes were merged after v1.1.2. Deployments pinned to v1.1.2 images do not include them yet; as the maintainers suggested, pull the latest workflow image to pick them up.

🧰 SkillHub v0.2.20 and v0.2.21: Skill Suites, Suite Bundles and a unified identity foundation

SkillHub merged 34 PRs this cycle and shipped two server releases and one CLI release.

v0.2.20 (Sep 13)

• 🧩 Skill Suites are here. Ordered, exact Skill versions can be bundled into independently versioned suites with immutable published snapshots, Entry Skills, idempotent install plans, and Web management and review flows (#828). A community member first proposed this in #715, using multi-Skill workflows such as superpowers as the example.
• 🧭 Marketplace and console redesign. The landing page, dashboard and paginated lists were unified, the Skill and Suite marketplaces are now separate, and My Skills / My Suites moved into the dashboard (#825, #855).
• 📚 Larger starter collection. Reviewed SandBase MCP, Zero Slop and Cue Omni Reader Skills were added, together with an official SkillHub CLI guide Skill (#821, #832, #844, #845, #836, #842). The CLI guide Skill came from community request #822.
• 🐛 Fewer false positives in pre-publish validation. Ordinary identifiers, function results, property access and string expressions are no longer flagged as hard-coded credentials, while real secrets are still caught (#830, fixing community-reported regression #827). Super administrators can also find and restore hidden Skills (#829, for #819).
• 🇨🇳 runtime.sh installation for deployments in China is now documented (#834), and the legacy Docusaurus site was removed; all docs now live at iflytek.github.io/skillhub (#849).
• ⚠️ Flyway V49–V53 run automatically, so back up PostgreSQL before upgrading. During rolling upgrades, keep SKILLHUB_SUITE_REVIEW_WRITES_ENABLED=false until every instance is upgraded.

v0.2.21 (Sep 19)

• 📦 Two-stage Suite Bundle publishing. A single ZIP or folder upload can create or update a suite, with a side-effect-free preview, explicit confirmation, recovery, labels and member diffs (#850, for #847).
• 🔐 OAuth Device Flow login for the CLI, with browser launch, a headless --no-open option, and token validation before anything is saved (#857, proposed and implemented by community contributor @Danny5487401).
• 🤖 New CLI install targets: AStudio (0.1.12, #840) and Pi agents (#869).
• 🗝️ API tokens now cover the Skill lifecycle. Skill owners and Namespace admins can yank published versions through the Web UI or API with the skill:yank token scope (#865, #866, by contributor @thiagonogueira). Concurrent yanks are serialized on the same row lock (#875).
• 🪪 Unified identity core R1-A. Organization and external-identity foundations were added, and public OAuth now routes through the identity core with LEGACY / SHADOW / ACTIVE rollout modes; legacy behavior remains the default (#874). This lays the groundwork for enterprise identity, including LDAP.
• ⚠️ Flyway V54–V65 run automatically, and the default post-login OAuth fallback changed from /dashboard to /. The complete Suite Bundle confirmation flow requires both SKILLHUB_SUITE_BUNDLE_CONFIRMATION_ENABLED and SKILLHUB_SUITE_REVIEW_WRITES_ENABLED.

⚙️ Astron RPA: MCP authentication, HTTPS by default, and recoverable execution management

Astron RPA merged 7 PRs this cycle; they have not been released yet.

• 🔐 MCP authentication semantics and user isolation (#857, closes #854). Authorization: Bearer and X-API-Key are supported, and URL ?key= is off by default. Invalid keys return 401 and authentication-dependency failures return 503 instead of an empty tool list that looks normal. Execution records and workflow details are isolated per authenticated user, and cross-user access returns 404.
• 🔒 HTTPS as the default public entry point (#862, closes #861). The gateway and Casdoor are served over HTTPS through OpenResty, and Casdoor's port 8000 is no longer exposed directly to the internet. Session cookies are Secure by default, and an explicit legacy-http mode remains for migration and rollback.
• 🧭 Hardened execution lifecycle (#865). Submitted executions still record a final status after the caller stops waiting; offline clients now fail fast instead of receiving a dispatch; and MCP no longer wraps failures as successes.
• 🔁 Recoverable MCP execution management (#871). A new astron_execution_cancel tool was added, and async start accepts idempotencyKey and executionTimeout and returns a stable executionId. Executions follow a unified accepted / running / succeeded / failed / cancelled / timeout / unknown state machine and are reconciled under their original run identity after disconnects or restarts, so desktop tasks are never started twice.
• 🛠️ Client fixes. Terminal registration no longer logs the terminal password, which is now generated with secrets (#866). Concurrent executions each get their own parameter file, and JSON numbers and booleans keep their native types (#867). An off-by-one error in task retries was fixed (#845, closes #844).

⚠️ After upgrading to a build that includes #862, clients reach Casdoor differently: you need to provide certificates and update CASDOOR_EXTERNAL_ENDPOINT accordingly. If you cannot enable HTTPS yet, use the explicit legacy-http mode and follow the migration and rollback notes in the repository.

🐬 Other repositories

• Dolphin MCP Pilot (3 PRs): the README and repository description now include "小海豚" to help Chinese-language search (#52, by community contributor @Hui-of-limin). Work is also under way on the Glama claim needed for listing in awesome-mcp-servers (#56).
• MemFlywheel (4 PRs): dependency updates only; a community question about the overall architecture was answered in #72.

---

💬 Community Q&A and Discussion (Selected)

The topics below are distilled from anonymized WeCom open-source discussion-group records from Sep 7 to Sep 20. Answers from the automated Q&A bot are for reference only; maintainer conclusions take precedence. 🟢 Resolved · ℹ️ Clarified · 🟡 Needs follow-up.

Spark-X2.5

• ℹ️ Do I still need to download the model after installing llama.cpp or Ollama? Can 4 GB of VRAM run the 4B model? The runtime and the model are separate, so you download the model on its own, and one quantized file is enough. With 4 GB of VRAM, start with Q4_K_M (about 2.6 GB for 4B). File size is not the same as the VRAM you need, because the KV cache and other context state add to it. When you serve the model locally with llama-server, keep the server window open.
• 🟡 Spark-X2.5-4B on Ollama could not drive tool-calling agents such as OpenClaw. On Sep 8, a user who connected it on a CPU-only server found that the model listed only the completion capability, not tools, and each response took about 80 seconds, so it was only usable for plain chat. That test predates native support in Ollama v0.34.1 on Sep 15. Please re-test tool calling with v0.34.1+ and share results in Spark-X2.5 issues.

• ℹ️ Can edge devices use the full 1M-token context? Community experience so far: a quantized 4B model with a Q8-quantized KV cache reaches about 500K tokens of context in 16 GB of VRAM. There is no data yet for mid-range phones (around CNY 2,000); contributions are welcome.
• 🟡 Thinking mode sometimes loops, questioning itself repeatedly. A community member running Q5_K_M (2.8 GB) in a local harness for everyday Q&A and web search saw about 19–20 tokens/s and found the experience more stable with thinking turned off (enable_thinking=false). This echoes the 1.7B repetition loops observed last cycle; please file an issue with a minimal prompt and the raw output.

• ℹ️ How can math evaluations be more robust? Community advice: validate the output format strictly and recompute when it fails, and run each problem three times and take the most frequent answer (self-consistency). This is exactly what the 🚀 Astron Open Source · Bi-Weekly Report (Jun 29 – Jul 12, 2026) #6 challenge's decoding-and-prompting track encourages.
• ℹ️ Community comparisons. One member published a side-by-side evaluation of recent small open models (linux.do thread). Another said the 4B model's JSON adherence and reasoning exceeded expectations, and asked the team for a 9B size.

Astron Agent

• 🟢 A workflow node occasionally received no input, and the code node failed with SyntaxError: unterminated string literal. A maintainer and the user traced it node by node in the group and found that newlines inside the model's JSON output corrupted the code node's input. Until the fix was deployed, the workaround was to prompt the model to emit JSON without newlines. The root cause was fixed in #1671 / #1672 (Sep 8–9).
• 🟢 After a multi-turn session finished, the Trace for the final turn was missing. The user found KafkaError{code=MSG_SIZE_TOO_LARGE} in config/workflow/logs/app_*.log on the host, and it persisted even after raising the broker's message.max.bytes to 100 MB. The maintainers confirmed that long replies produced oversized Trace payloads and fixed it in #1673 / #1675. On Sep 10 the user pulled the new workflow image and confirmed the Traces were back. Troubleshooting tips: with the default LOG_STDOUT_ENABLE=0, logs are not in the container's stdout; and log timestamps are in UTC, so add 8 hours for Beijing time.

• ℹ️ Three blank buttons appear under a reply, and clicking one sends an empty message. These are "next-question suggestions". According to the maintainers, you first need to configure AI Ability Chat (the OpenAI-compatible chat service) under Platform Account Management before suggestions are generated; the user confirmed this fixed it.
• ℹ️ Does Agent include RPA? Astron Agent can call Astron RPA through the RPA node in a workflow.
• ℹ️ Default login after deployment. The Casdoor admin console (default port 8000) uses Casdoor's upstream default of admin / 123; change it immediately after signing in. The RAGFlow knowledge base has no default account, so register one on first visit.
• 🟡 Publishing a local agent failed with "workflow version publish result abnormal" (Sep 14), and the group thread has no conclusion yet. First check that the workflow's basic information is complete, as described in the FAQ. If it still fails, please open an issue with the core-workflow logs and your version.

SkillHub

• ℹ️ Is SkillHub still maintained? Yes: 34 PRs merged this cycle, with v0.2.20 and v0.2.21 released.
• ℹ️ 0.0.0.0:80: bind: address already in use at startup. Change the web port in .env.release, then run docker compose ... up -d --force-recreate so the change takes effect (a plain restart is not enough). The Q&A bot cited internal repository paths; see the public online FAQ instead.
• ℹ️ Can SkillHub run on older Kubernetes versions? The official Kubernetes guide requires Kubernetes v1.24+.

• 🟡 How should Skills that contain credentials be sanitized? There is no dedicated specification yet. The pre-publish validation in v0.2.20 blocks hard-coded credentials (#830). Community members suggested two approaches: keep only placeholders in the Skill and have a per-sandbox egress proxy substitute real values by target domain (a sidecar), or reference environment variables, which still carries some leakage risk. A feature issue that writes up the design would be welcome.
• 🟡 Can dsh (DeepSeek Harness) be supported as an install target? Tracked in #888 and closed on Sep 21, one day after the window.
• 🟡 Still open: LDAP support (#871; the unified identity core in v0.2.21 is a prerequisite); Skill Suites shipped in v0.2.20, but CLI 0.1.12 has no suite command yet (#893); and a feature comparison between the SaaS and open-source editions (#863).

Astron RPA

• ℹ️ Casdoor login returns 502, or registration/login shows timeout of 20000ms exceeded. The most common cause is that CASDOOR_EXTERNAL_ENDPOINT in .env has not been set to a server IP the client can reach (127.0.0.1 or localhost will not work). Other causes are services that are still initializing or a firewall blocking the port. Restart the server after changing the configuration, and use docker logs to check the Casdoor container. Note that after #862, the default entry point is HTTPS, so the port and address settings need to be updated as well.
• ℹ️ After the end-of-updates notice on the iFlyRPA website, will open-source Astron RPA still be maintained? Yes. The official clarification: the iFlyRPA SaaS edition has been upgraded to iFly Cowork. The previous SaaS edition will no longer receive feature updates, and login verification codes will be phased out. SaaS users should switch to account-and-password login or move directly to iFly Cowork, and complete the migration by Oct 15, 2026. The open-source edition of Astron RPA will continue to be maintained and updated and is not affected by this notice. The open-source repository merged 7 security and MCP execution-management PRs this cycle (see above).

---

🔭 Community Spotlight

HER Hack-Astron #5 · Spark-X2.5 Edge-Agent Real-World Cases (results announced Sep 19)

🏆 Champion: "Spark-X2.5-1.7B tool-calling safety boundaries on Apple M3" (1.7B Discussion #1, HF Ykmmz). The entry ran 96 real Chinese and English inferences on Apple silicon and published a pinned revision, full parameters, sanitized raw outputs and reproduction scripts, reporting the unflattering results alongside the good ones. Thinking mode raised primary policy compliance from 17/48 to 43/48, but 27/48 responses hit the token limit and only 16/48 were strictly usable. Its complete evidence chain and rigorous method made it the strongest entry of the round.

🌟 13 Outstanding Contribution Awards covered: an offline safety router on a 6 GB RTX 4050; Q4_K_M coding and a documented --swa-full OOM boundary on a CPU-only 8-core / 16 GB Linux box; Chinese meeting-notes-to-JSON extraction on a laptop CPU; English/Chinese/Thai guardrails showing that "valid JSON is still unsafe"; a bilingual safety gate for destructive actions; a 100-chapter playable Godot prototype built from broken JSON; confirmation-gated multilingual tool use; locating the second vLLM spark25 parser break point and fixing it upstream (Spark-plugin #10); multilingual and coding tests on an 8 GB M3; an agent handoff-continuity test; prompt-injection-resistant opportunity triage; dual-model throughput on an 8 GB RX 580 with Vulkan; and reasoning-budget truncation on an 8 GB M1. The full list is in Issue #3.

HER Hack-Astron #6 · Spark-X2.5 Math Reasoning Challenge (submissions Sep 7–13, judging Sep 14–20)

The challenge opened the same evening the model reached #1 on the trending board. Participants ran a real, honest and reproducible math-reasoning evaluation with the 4B or 1.7B model, published the full results in that model's Hugging Face Discussions, and linked them in Issue #9. The single prize was USD 100 in cash for the Champion.

Several submissions were highlighted in the groups during judging. What they share is that they treat "solved correctly" and "scored correctly" as separate questions:

• 40 paired, reworded problems on an 8 GB-VRAM laptop, with 10/40 and 24/40 strictly correct final answers under two settings (1.7B #15);
• 6 original problems plus 6 number-swapped variants on a Mac CPU, 12/12 correct (1.7B #17);
• "The model says 2,180 and the reference says 2,280: who is wrong?", an evaluation that also analyzed errors in the reference answers (1.7B #16);
• Correct math still failing on format: 24 development cases with archived scores of 19/24, 23/24 and 24/24 (1.7B #18);
• A correct answer (x = 4) with a wrong explanation of the domain; 45 of 96 planned requests completed, with a strict score of 21/45 (1.7B #19);
• 60 stratified MATH-500 problems on a Colab T4 with FP16 greedy decoding, pass@1 of 61.67%, keeping the 14 problems with no extractable answer in the denominator (4B #13);
• Apple M3 with MLX: 70 of 100 GSM8K problems correct, and 20, 19 and 20 correct on the original, reworded and number-swapped versions of 20 paired problems (1.7B #20).

The result was announced on Sep 21, one day after the window. The Champion is 4B Discussion #19, a GSM-Symbolic study on vLLM that compares direct answering with native function calling plus a calculator. Its tool arm actually scored lower, but it won on methodology: all 120 raw trajectories can be re-scored offline, the statistical testing is rigorous, and it avoids over-claiming.

Spark-X2.5 Edge Model Innovation Challenge (preliminary submissions due Oct 11)

On Sep 11, iFLYTEK opened the Spark-X2.5 Edge Model Innovation Challenge for on-device applications built on the open Spark-X2.5 models. The total prize pool is CNY 100,000, with CNY 25,000 for the winner and prizes for the top 10, plus fast-track internship and job opportunities with the Spark foundation-model team. 👉 Details and registration

Hack-Astron x openKylin #1 (Sep 3–24)

Participants deploy Astron Agent and SkillHub locally on openKylin 2.0+ and implement skills with Astron Agent's native RPA engine. Most of the competition took place during this cycle, and judging runs from Sep 25 to Sep 30. 👉 Hack-Astron x openKylin #1

Milestones and Momentum

• 🏅 Sep 11: SparkLLM received the Jinsuan Award for Edge Intelligence Innovation at the 2026 Global Edge AI Computing Conference.

• 🌐 Sep 15: Astron Agent was onboarded to the Linux Foundation's LFX Insights, making its project-health and contribution data publicly visible.
• 🖥️ Sep 15: AStudio, the iFLYTEK Open Platform desktop AI workbench built around Spark X2.5, launched; SkillHub CLI 0.1.12 added AStudio as an install target (#840).
• 🗓️ Every weekday, the groups receive "Astron FDE suggested practices" based on GitHub Trending, turning notable open-source projects of the day into concrete experiments on Astron Agent, SkillHub, Astron RPA, Dolphin MCP Pilot and iFly-Skills.

---

🙌 Build With Us

Good places to start this cycle:

• Re-test Spark-X2.5's tools capability on Ollama v0.34.1+ to see whether it can drive tool-calling agents such as OpenClaw, and report back;
• Run Spark-X2.5 on RK3588, phones or other edge devices we have not covered, and publish throughput, memory and context-length limits;
• Reproduce the thinking-mode loops with a minimal prompt and file an issue with the raw output;
• Try SkillHub Skill Suites and Suite Bundles with a real multi-Skill workflow, or pick up the CLI suite command (#893);
• Turn "credential placeholders in Skills plus egress-time substitution" into a SkillHub design proposal;
• Run long multi-turn workflows on your own Astron Agent to check that Traces are complete after #1673, and report any scenarios that still exceed the limit;
• Move your Astron RPA deployment to HTTPS following the migration notes in #862, and document any pitfalls.

Before you start, please leave a comment on the relevant issue so maintainers can confirm scope and avoid duplicate work.

---

🔗 Explore the Astron Open-Source Ecosystem

• Astron Agent: enterprise-grade agentic workflow platform
• SkillHub: self-hostable Agent Skill registry and governance platform
• Astron RPA: agent-ready desktop and web automation RPA
• Dolphin MCP Pilot: production-grade MCP server for Apache DolphinScheduler
• Domux: low-latency smart-home command-parsing model
• MemFlywheel: agent-native long-term memory
• iFly-Skills · AstronClaw Tutorial · HarnessClaw
• Spark-X2.5 and the XHToken organization · Spark-X2.5 on Hugging Face
• All repositories tagged iflytek-astron

Methodology: PR counts use GitHub merged_at timestamps for Sep 7 – Sep 20, 2026, across the 10 repositories tagged iflytek-astron and all XHToken repositories (excluding the executorch fork, which tracks upstream). Astron Agent's two fixes were merged into bugfix/superteam and then into main, and each PR is counted separately. Release dates use GitHub published_at; Spark-X2.5 ecosystem integration dates follow the Release log in the repository README. Hugging Face downloads are the platform's last-30-days figures and likes are cumulative, both as of Sep 28, 2026, and will keep changing. The HER Hack-Astron #6 results and the closing of SkillHub #888 both happened on Sep 21, one day after the window, and are included because they relate directly to this cycle. Community questions are anonymized and summarized. All screenshots come from public posts in the open-source discussion groups; images showing personal accounts, phone numbers, hostnames or organization details were excluded, and customer identities, group identities and environment-specific details are not disclosed.

Questions, ideas, or a contribution to share? Join the community discussions or open an issue or PR in the relevant repository. Let's keep building open, production-ready infrastructure for enterprise AI agents 🚀

---

🚀 Astron 开源双周报（2026 年 9 月 7 日 – 9 月 20 日）

---

🌟 亮点速览

• Spark-X2.5-4B 登顶 Hugging Face 近 7 天趋势榜第 1 名：9 月 7 日上午排名第 3，当晚升至第 1。9 月 11 日，XHToken 在 Hugging Face 上的模型总下载量发布 10 天突破 10 万。
• Spark-X2.5 的本地运行门槛进一步降低：9 月 7 日上线 Q4_K_M / Q8_0 官方 GGUF 量化；此后 LM Studio（9 月 8 日）、PocketPal AI iOS/Android（9 月 11 日）、Ollama v0.34.1（9 月 15 日）与 Unsloth Studio（9 月 20 日）陆续原生支持。上期仍需本地编译 fork 才能跑通的 Ollama / LM Studio，现在装好官方版本即可直接使用。
• 本周期发布 4 个版本：Astron Agent v1.1.2 安全版本（9 月 7 日）、SkillHub v0.2.20（9 月 13 日，Skill 套件）、v0.2.21（9 月 19 日，Suite Bundle 与 CLI OAuth 登录），以及 SkillHub CLI 0.1.12（9 月 9 日）。
• 5 个仓库共合并 53 个 PR：SkillHub 34 · Astron RPA 7 · Astron Agent 5 · MemFlywheel 4 · Dolphin MCP Pilot 3。XHToken 组织本期没有合并 PR，Spark-X2.5 仓库以直接提交的方式维护 README 发布记录。
• 群里报的两个 Astron Agent 工作流 Bug，48 小时内完成修复并由用户验证：一是模型输出的 JSON 带换行时代码节点报 SyntaxError，二是多轮长对话最后一轮的 Trace 因 Kafka MSG_SIZE_TOO_LARGE 丢失（#1671–#1675）。
• HER Hack-Astron 🚀 Astron Open Source · Bi-Weekly Report (Jun 15 – Jun 28, 2026) #5 于 9 月 19 日公布结果（1 个优胜奖 + 13 个优秀贡献奖）；第 6 期数学推理挑战赛 9 月 7 日开赛、9 月 13 日截止提交，评审窗口为 9 月 14—20 日。
• 另外两项进展：Astron Agent 于 9 月 15 日入驻 Linux 基金会 LFX Insights；SparkLLM 于 9 月 11 日获得"金算奖 · 端侧智能创新奖"。

👥 社区最活跃 Top 10 贡献者

基于 23 个开源讨论群导出记录的消息量统计。已排除问答 bot、欢迎/运营播报账号和广告消息，并归一同一人的不同展示名；昵称已匿名处理。第 10 名有两位并列，一同展示。感谢每一位答疑、提问并与我们共同建设的朋友 🙌

---

📦 发布与开发进展

📋 全生态发版一览（9 月 7 日—20 日）

项目	本期发布	当前最新版本 / 说明
Astron Agent	✅ v1.1.2（9 月 7 日，安全版本）	发布后又合并两项工作流修复，已进入 latest 镜像，尚未打新 tag
SkillHub	✅ v0.2.20（9 月 13 日）· v0.2.21（9 月 19 日）· CLI 0.1.12（9 月 9 日）	v0.2.21 / CLI 0.1.12
Astron RPA	—	v1.1.6（2026-02-25）；本期合并 7 个安全与 MCP 执行管理 PR，尚未发版
Dolphin MCP Pilot	—	v0.3.1（2026-08-31）
MemFlywheel	—	v0.1.1（2026-07-28）；本期仅有依赖更新
HarnessClaw / Engine	—	v0.0.24-beta.0（07-02）/ v0.0.23-beta.0（06-16）
Domux · iFly-Skills · AstronClaw Tutorial	—	不走 GitHub Release；AstronClaw Tutorial 本期刷新了 doc-watch 基线
XHToken/Spark-X2.5	📝 README 发布记录新增 3 条	9/8 LM Studio · 9/11 PocketPal AI · 9/15 Ollama v0.34.1；9/20 新增 Unsloth 章节
XHToken/Spark-plugin	—	v0.1.0（2026-08-28）
XHToken 其他仓库（llama.cpp、sglang、vllm、LlamaFactory、Spark-MLX-LLM 等 fork 与 community）	—	无新版本
Hugging Face · XHToken	✅ 4B / 1.7B 官方 Q4_K_M 与 Q8_0 GGUF（9 月 7 日）	10 个模型仓库 + 1 个数据集（gaokao_math_2026）；无新增仓库，Spark-X2.5 合集 于 9 月 16 日更新

✨ Spark-X2.5：从"能跑"到"装好就能跑"

发布第二周的重点，是把本地运行需要的各个环节逐一打通：

• 📦 官方 GGUF 量化：9 月 7 日，Spark-X2.5-4B-GGUF 新增 Q4_K_M（2.6 GB）与 Q8_0（4.4 GB），Spark-X2.5-1.7B-GGUF 同步上线。上期计划中的"量化 GGUF"已兑现。
• 🧩 主流本地运行时原生支持：llama.cpp 上游 b10829 起原生支持 Spark2_5ForCausalLM（9 月 6 日）；团队随后发布了在 Windows CPU 上用官方 b10833 运行 1.7B 社区 Q4_K_M GGUF 的演示视频。此后 LM Studio 0.4.0+（9 月 8 日）、PocketPal AI App Store / Google Play 版（9 月 11 日）与 Unsloth Studio（9 月 20 日）先后接入，并在 LM Studio 中完成中英文解方程实测。
• 📢 9 月 15 日：Ollama 官方已支持 Spark-X2.5 模型架构，大家可以一键 run 了！ 把 Ollama 更新到 v0.34.1 及以上，执行 ollama run SparkLLM/Spark-X2.5-1.7B（或 SparkLLM/Spark-X2.5-4B）即可，不再需要替换运行时或自行编译 fork。
• 📈 下载与热度：GGUF 是最受欢迎的形态 —— 截至 9 月 28 日，4B-GGUF 近 30 天下载约 39.9 万次、1.7B-GGUF 约 15.5 万次；Spark-X2.5-4B 收获 1,334 个 Like。
• 📚 FAQ 与答疑沉淀：Spark-X2.5 FAQ 汇总了 vLLM 插件、llama.cpp、微调与 1M 长上下文等高频问题；LLaMA-Factory 微调请参考 XHToken fork 中的指南（上游尚未合入，#7）；有社区开发者在 RK3588（8GB，NPU 辅助）上跑通 4B Q8，约 5.9 tokens/s（#8）。

🤖 Astron Agent：v1.1.2 安全版本，以及两项来自社区的工作流修复

v1.1.2（9 月 7 日） 是上期安全加固工作的正式发布，详见 GHSA-mh3w-4q3f-2fg5：

• 🚨 默认改用内置隔离的 LangChain/Pyodide 代码执行器，拒绝不安全的 local 执行；未改动的旧配置会自动迁移，显式的进程级覆盖（包括有意关闭代码节点）会被保留。同时加强 Workflow / Tenant 内部 API 鉴权与租户隔离。
• 🔒 修复插件出站请求的 SSRF（#1669），加固 XSS、制品与沙箱边界（#1643）。
• 🔭 其他改动：Langfuse 集成与端到端 Agent Trace（#1607），以及带依赖感知的工作流 YAML 导入加固（#1623）。
• 🐳 8 个核心服务镜像以及 Console Hub / Frontend 均已推送 GHCR，支持 linux/amd64 与 linux/arm64。

⚠️ 升级提示：请在 docker/astronAgent/.env 中设置 ASTRON_AGENT_VERSION=v1.1.2，同时更新部署文件与服务镜像。CODE_EXEC_TYPE=local 已不再支持，依赖宿主文件系统、子进程或网络的代码可能需要调整。

发布后的两项修复（5 个 PR）均源自群内反馈，详见下文"社区答疑"：

• 🧾 代码节点保留源码转义（#1671 → main #1672）：固定版本的 Pyodide CLI 会改写通过 -c 传入的字面量 \n，导致多行字符串入参被破坏。修复后改用 -f 入口和单次调用专用的 UTF-8 源文件，并用 33 个用例覆盖多行 JSON、CRLF、Unicode、并发与资源限制等场景。
• 📉 长对话 Trace 瘦身（#1673 → main #1675，重构 #1674）：OpenAI 兼容 Provider 不再逐帧记录流式响应，改为只记一条完成摘要；深层嵌套的大字符串先转存对象存储再序列化；上报诊断信息补充 sid、flow ID 与负载字节数。

💡 这两项修复晚于 v1.1.2 合并。仍固定使用 v1.1.2 镜像的部署暂不包含它们；按维护者建议重新拉取 latest 的 workflow 镜像即可生效。

🧰 SkillHub v0.2.20 与 v0.2.21：Skill 套件、Suite Bundle 与统一身份的基础

SkillHub 本周期合并 34 个 PR，发布两个服务端版本和一个 CLI 版本。

v0.2.20（9 月 13 日）

• 🧩 Skill 套件（Skill Suites）正式上线：把多个 Skill 的精确版本按顺序打包成可独立版本化的套件，支持不可变发布快照、Entry Skill、幂等安装计划，以及 Web 端管理与审核（#828）。这个能力最早由社区成员在 #715 中提出（以 superpowers 这类多 Skill 工作流为例）。
• 🧭 市场与控制台改版：统一首页、控制台与分页列表，Skill 市场与 Suite 市场分开呈现，"我的 Skill / 我的 Suite"并入控制台（#825、#855）。
• 📚 精选 Starter 扩容：新增经审核的 SandBase MCP、Zero Slop、Cue Omni Reader，以及官方 SkillHub CLI 使用指南 Skill（#821、#832、#844、#845、#836、#842）。CLI 指南 Skill 来自社区需求 #822。
• 🐛 发布前校验减少误报：普通标识符、函数返回值、属性访问与字符串表达式不再被当作硬编码凭据，真实密钥仍会被拦截（#830，修复社区反馈的回归 #827）。此外，超级管理员现在可以发现并恢复被隐藏的 Skill（#829，对应 #819）。
• 🇨🇳 补充国内部署 runtime.sh 安装说明（#834）；移除旧的 Docusaurus 文档站，文档统一在 iflytek.github.io/skillhub（#849）。
• ⚠️ Flyway V49–V53 会自动执行，升级前请备份 PostgreSQL。滚动升级期间请保持 SKILLHUB_SUITE_REVIEW_WRITES_ENABLED=false，等所有实例都升级完再开启。

v0.2.21（9 月 19 日）

• 📦 Suite Bundle 两阶段发布：上传一个 ZIP 或文件夹即可创建或更新套件，流程包括无副作用预览、显式确认、失败恢复、标签与成员差异展示（#850，对应 #847）。
• 🔐 CLI 支持 OAuth Device Flow 登录：可自动拉起浏览器，也支持无头环境的 --no-open；Token 先校验再保存（#857，由社区贡献者 @Danny5487401 提出并实现）。
• 🤖 CLI 新增安装目标：AStudio（0.1.12，#840）与 Pi Agent（#869）。
• 🗝️ API Token 覆盖 Skill 生命周期：Skill 所有者与 Namespace 管理员可通过 Web/API 撤回（yank）已发布版本，对应 Token 权限为 skill:yank（#865、#866，贡献者 @thiagonogueira）；并发撤回在同一行锁上串行执行（#875）。
• 🪪 统一身份核心 R1-A：引入组织与外部身份基础模型，公共 OAuth 统一经由身份核心路由，支持 LEGACY / SHADOW / ACTIVE 三种灰度模式，默认保持旧行为（#874）。这是后续企业身份（包括 LDAP）的底座。
• ⚠️ Flyway V54–V65 会自动执行；OAuth 登录后的默认回跳由 /dashboard 改为 /。完整的 Suite Bundle 确认流程需要同时开启 SKILLHUB_SUITE_BUNDLE_CONFIRMATION_ENABLED 与 SKILLHUB_SUITE_REVIEW_WRITES_ENABLED。

⚙️ Astron RPA：MCP 鉴权、HTTPS 默认入口与可恢复的执行管理

Astron RPA 本周期合并 7 个 PR，尚未打新版本：

• 🔐 MCP 鉴权语义与用户隔离（#857，关闭 #854）：支持 Authorization: Bearer 与 X-API-Key，URL ?key= 默认关闭；无效 Key 返回 401，鉴权依赖异常返回 503，不再伪装成"工具列表为空"；执行记录与工作流详情都按鉴权用户隔离，跨用户访问统一返回 404。
• 🔒 公网入口默认 HTTPS（#862，关闭 #861）：网关与 Casdoor 默认通过 OpenResty 提供 HTTPS，不再把 Casdoor 的 8000 端口直接暴露到公网；Session Cookie 默认 Secure；保留显式的 legacy-http 模式供迁移与回退使用。
• 🧭 执行生命周期加固（#865）：调用方停止等待后，已提交的执行仍会写入最终状态；Client 离线时直接判定失败，不再派发；MCP 不会再把失败包装成成功返回。
• 🔁 可恢复的 MCP 执行管理（#871）：新增 astron_execution_cancel，异步启动支持 idempotencyKey 与 executionTimeout 并返回稳定的 executionId；统一 accepted / running / succeeded / failed / cancelled / timeout / unknown 状态机；断线或重启后按原运行身份对账，不会重复启动桌面任务。
• 🛠️ Client 修复：终端注册不再把密码写入日志，并改用 secrets 生成密码（#866）；并发执行各自使用独立的参数文件，JSON 数字与布尔参数保持原生类型（#867）；修复任务重试次数差一错误（#845，关闭 #844）。

⚠️ 升级到包含 #862 的版本后，客户端访问 Casdoor 的方式会变化：需要提供证书，并相应调整 CASDOOR_EXTERNAL_ENDPOINT。如果暂时无法启用 HTTPS，请显式使用 legacy-http 模式，并阅读仓库中的迁移与回滚说明。

🐬 其他仓库

• Dolphin MCP Pilot（3 个 PR）：README 与仓库描述补充"小海豚"，方便中文搜索（#52，社区贡献者 @Hui-of-limin）；同时在推进 awesome-mcp-servers 收录所需的 Glama 认领（#56）。
• MemFlywheel（4 个 PR）：均为依赖更新；社区关于整体架构的提问已在 #72 中解答。

---

💬 社区答疑与讨论（本期精选）

以下主题提炼自 9 月 7 日—20 日的企微开源讨论群匿名记录。自动问答 bot 的回答仅作参考，以维护者结论为准。🟢 已解决 · ℹ️ 已澄清 · 🟡 需继续跟进。

Spark-X2.5

• ℹ️ 装好 llama.cpp / Ollama 之后还要下载模型吗？4GB 显存能跑 4B 吗？ 运行时和模型是分开的，模型需要单独下载，而且下载一个量化版本即可。4GB 显存建议先试 Q4_K_M（4B 约 2.6 GB）。注意文件大小不等于所需显存，上下文 KV Cache 等还会额外占用。用 llama-server 本地起服务时，服务进程窗口需要保持开启。
• 🟡 Ollama 上的 Spark-X2.5-4B 无法用于 OpenClaw 这类工具调用 Agent。9 月 8 日，一位用户在仅有 CPU 的服务器上接入后发现：模型 capabilities 只显示 completion、不含 tools，单次响应约 80 秒，只适合纯对话。该测试早于 9 月 15 日 Ollama v0.34.1 原生支持。欢迎用 v0.34.1+ 复测工具调用能力，并在 Spark-X2.5 issues 反馈结果。

• ℹ️ 端侧设备能跑满 1M 上下文吗？ 社区经验：4B 量化模型配合 KV Cache Q8 量化，16GB 显存可跑到约 500K 上下文。2000 元档手机上还没有实测数据，欢迎补充。
• 🟡 thinking 模式偶尔会反复自问、陷入循环。有社区用户在本地 harness 中用 Q5_K_M（2.8 GB）跑日常问答与联网检索，约 19—20 tokens/s，认为关闭 thinking（enable_thinking=false）时体验更稳定。这与上期观察到的 1.7B 循环重复现象相呼应，欢迎附最小 prompt 与原始输出提交 issue。

• ℹ️ 数学评测怎样更稳？ 社区建议对输出做格式强校验，不合格就重算；每题跑三次、取出现次数最多的答案（self-consistency），这正是第 6 期挑战赛"解码与提示"方向鼓励的做法。
• ℹ️ 社区横向评测：有成员把近期几款开源小模型放在一起做了综合评测（linux.do 帖子）；也有用户反馈 4B 的 JSON 输出约束能力与逻辑表现超出预期，并希望团队推出 9B 规格。

Astron Agent

• 🟢 工作流偶发"下一个节点没入参"，代码节点报 SyntaxError: unterminated string literal。维护者与用户在群里逐节点排查，最终定位到：模型输出的 JSON 字符串里带换行时，代码节点入参被破坏。修复前，可以先在提示词里要求模型输出不换行的 JSON；根因已由 #1671 / #1672 修复（9 月 8—9 日）。
• 🟢 多轮问询跑完后，最后一轮的 Trace 日志不见了。用户在宿主机 config/workflow/logs/app_*.log 中找到 KafkaError{code=MSG_SIZE_TOO_LARGE}，即便把 Broker 的 message.max.bytes 调到 100MB 仍然报错。维护者确认长回复的 Trace 负载过大，由 #1673 / #1675 修复；9 月 10 日用户重新拉取 workflow 镜像后确认恢复正常。排障提示：默认 LOG_STDOUT_ENABLE=0，日志不在容器标准输出里；日志时间为 UTC，需要 +8 小时换算成北京时间。

• ℹ️ 回复下方出现三个空白按钮，点了是空输入：这是"下一步问答建议"。维护者指出，需要先在「平台账号管理」中配置 AI Ability Chat（OpenAI 兼容对话服务），建议内容才会生成；用户按此配置后已恢复正常。
• ℹ️ Agent 包含 RPA 吗？ Astron Agent 可以通过工作流中的 RPA 节点调用 Astron RPA。
• ℹ️ 部署后默认登录账号：Casdoor 管理后台（默认端口 8000）沿用 Casdoor 上游默认的 admin / 123，登录后请立即修改。RAGFlow 知识库没有默认账号，首次访问需要自行注册。
• 🟡 本地智能体发布时提示"工作流版本发布结果异常"（9 月 14 日），群内尚无后续结论。建议先按 FAQ 确认工作流基本信息是否填写完整；如仍失败，请附 core-workflow 日志与所用版本提交 issue。

SkillHub

• ℹ️ SkillHub 还有团队在维护吗？ 有 —— 本周期合并 34 个 PR，发布 v0.2.20 与 v0.2.21。
• ℹ️ 启动时 0.0.0.0:80: bind: address already in use：在 .env.release 中修改 Web 端口，然后执行 docker compose ... up -d --force-recreate 让配置生效（只执行 restart 不会生效）。问答 bot 引用的是仓库内部文档路径，公开版本请查看 在线 FAQ。
• ℹ️ 低版本 Kubernetes 能部署吗？ 官方 K8s 部署指南 要求 Kubernetes v1.24+。

• 🟡 Skill 里包含认证等敏感信息时，如何脱敏？ 目前还没有专门的规范。v0.2.20 的发布前校验会拦截硬编码凭据（#830）。社区提出两种思路：一是 Skill 内只放占位符，由沙箱出站代理按目标域名替换成真实值（sidecar）；二是改为引用环境变量，但仍有泄露风险。欢迎把方案整理成 feature issue。
• 🟡 能否支持 dsh（DeepSeek Harness）作为安装目标？ 已在 #888 跟进，9 月 21 日关闭（统计窗口后一天）。
• 🟡 仍未关闭的需求：LDAP 支持（#871，v0.2.21 的统一身份核心是其前置工作）；Skill 套件已在 v0.2.20 上线，但 CLI 0.1.12 还没有 suite 命令（#893）；SaaS 版与开源版的功能对比清单（#863）。

Astron RPA

• ℹ️ Casdoor 登录报 502，或注册/登录提示 timeout of 20000ms exceeded：最常见的原因是 .env 中的 CASDOOR_EXTERNAL_ENDPOINT 没有改成客户端能访问到的服务器 IP（不能写 127.0.0.1 / localhost）。其次可能是服务仍在初始化，或防火墙拦截了端口。改完配置后需要重启服务端；可用 docker logs 查看 Casdoor 容器状态。注意 #862 合入后，默认入口改为 HTTPS，端口与地址配置需要同步调整。
• ℹ️ 看到星辰 RPA 官网的停更公告，开源版还会继续维护吗？ 会。官方说明如下：星辰 RPA SaaS 版本已全新升级为星辰 Cowork，原 SaaS 版本将不再提供功能更新，登录验证码也将逐步停止服务。请 SaaS 用户改用账号密码登录，或直接访问星辰 Cowork 使用新版本，并于 2026 年 10 月 15 日前完成迁移。星辰 RPA 开源版本将继续维护和更新，不受本公告影响 —— 本周期开源仓库就合并了 7 个安全与 MCP 执行管理 PR（见上文）。

---

🔭 社区聚焦

HER Hack-Astron #5 · Spark-X2.5 端侧智能体真实案例（9 月 19 日公布结果）

🏆 优胜奖 —— 《Spark-X2.5-1.7B 在 Apple M3 上的工具调用安全边界》（1.7B Discussion #1，HF Ykmmz）。案例在 Apple 芯片上完成 96 次中英文真实推理，提供固定 revision、完整参数、脱敏原始输出与复现脚本，并把好坏结果一并公开：开启 thinking 后，主要策略遵循从 17/48 提升到 43/48，但 27/48 触达 token 上限，严格可用的响应只有 16/48。证据链完整、方法严谨，本期综合表现最佳。

🌟 13 个优秀贡献奖：覆盖 6GB RTX 4050 上的离线安全路由、无独显 8 核/16GB Linux 上的 Q4_K_M 编码与 --swa-full OOM 边界、笔记本 CPU 上的中文会议纪要转 JSON、"合法 JSON 依然可能不安全"的中英泰护栏、破坏性操作的双语安全闸门、从坏 JSON 到百回可玩的 Godot 原型、带确认闸门的多语言工具调用、定位 vLLM spark25 parser 第二个断点并提交上游修复（Spark-plugin #10）、8GB M3 多语言与编码测试、Agent 交接连续性测试、抗提示注入的机会分诊、8GB RX 580 + Vulkan 双模型吞吐，以及 8GB M1 上的推理预算截断问题。完整名单见 Issue #3。

HER Hack-Astron #6 · Spark-X2.5 数学推理挑战赛（9 月 7 日—13 日提交，9 月 14—20 日评审）

模型登顶趋势榜当晚随即开赛：参赛者需用 4B 或 1.7B 跑一次真实、诚实、可复现的数学推理评测，把完整结果发到对应模型的 Hugging Face Discussions，再回到 Issue #9 留下链接；奖励为 $100 现金（仅设冠军）。

评审期间，群里陆续介绍了多份提交，共同的特点是把"算对"和"判对"分开看：

• 8GB 显存笔记本上的 40 道成对改写题，两组设置下严格最终答案正确数分别为 10/40 与 24/40（1.7B #15）；
• Mac CPU 上 6 道自编题 + 6 道换数变体，12/12 全对（1.7B #17）；
• "模型答 2180，参考答案写 2280，到底谁错了？"——一份把参考答案错误也纳入分析的评测（1.7B #16）；
• 数学算对了，却因为格式不合规被判失败：24 个开发案例的归档分数分别为 19/24、23/24、24/24（1.7B #18）；
• 答案解对（x=4），但对定义域的解释是错的：96 次计划请求中完成 45 次，严格得分 21/45（1.7B #19）；
• Colab T4、FP16 贪心解码，MATH-500 分层抽样 60 题 pass@1 为 61.67%，14 道未提取到答案的题仍保留在分母中（4B #13）；
• Apple M3 + MLX，GSM8K 100 题子集答对 70 题；原题、等价改写、换数版本分别答对 20、19、20 道（1.7B #20）。

结果已于 9 月 21 日（统计窗口后一天）公布：冠军为 4B Discussion #19，一份在 vLLM 上对比"直接作答"与"原生函数调用 + 计算器"的 GSM-Symbolic 研究。它的工具组得分更低，但全部 120 条原始轨迹可离线复核，统计检验严谨，没有过度结论，最终凭方法论胜出。

Spark-X2.5 端侧模型创新挑战赛（初赛作品 10 月 11 日前提交）

9 月 11 日，科大讯飞"Spark-X2.5 端侧模型创新挑战赛"开赛：基于 Spark-X2.5 开源模型打造端侧应用，总奖金 10 万元，冠军 2.5 万元，前 10 名均有奖金，并提供星火基模团队实习与 Offer 直通机会。👉 详情与报名

Hack-Astron x openKylin #1（9 月 3 日—24 日）

在 openKylin 2.0+ 上本地部署 Astron Agent 与 SkillHub，并用 Astron Agent 原生 RPA 引擎实现技能逻辑。本周期是赛事的主要比拼阶段，评奖时间为 9 月 25—30 日。👉 Hack-Astron x openKylin #1

里程碑与社区热度

• 🏅 9 月 11 日：SparkLLM（词元星火）在 2026 全球边缘 AI 算力大会上获得"金算奖 · 端侧智能创新奖"。

• 🌐 9 月 15 日：Astron Agent 入驻 Linux 基金会 LFX Insights，项目健康度与社区贡献数据向全球开放。
• 🖥️ 9 月 15 日：讯飞开放平台桌面 AI 工作台 AStudio 上线，以 Spark X2.5 为核心；SkillHub CLI 0.1.12 同步新增了 AStudio 安装目标（#840）。
• 🗓️ 每个工作日，群内会发布基于 GitHub Trending 的"Astron FDE 建议实践"：把当天值得关注的开源项目，落到 Astron Agent、SkillHub、Astron RPA、Dolphin MCP Pilot 与 iFly-Skills 上具体可做的实验。

---

🙌 一起共建

本周期适合上手的方向包括：

• 用 Ollama v0.34.1+ 复测 Spark-X2.5 的 tools 能力，看能否驱动 OpenClaw 等工具调用型 Agent，并反馈结果；
• 在 RK3588、手机或其他尚未覆盖的端侧设备上跑 Spark-X2.5，公开吞吐、内存与上下文长度的边界；
• 用最小 prompt 复现 thinking 模式的自我循环，附原始输出提交 issue；
• 用真实的多 Skill 工作流试用 SkillHub 的 Skill 套件与 Suite Bundle，或者直接认领 CLI suite 命令（#893）；
• 把"Skill 内敏感凭据占位符 + 出站替换"整理成可讨论的 SkillHub 设计提案；
• 在自己的 Astron Agent 上跑长多轮工作流，验证 #1673 之后 Trace 是否完整，把仍会超限的场景反馈回来；
• 按 #862 的迁移说明，把 Astron RPA 部署切到 HTTPS，并补充踩坑记录。

开工前建议先在相关 issue 下留言，便于维护者确认范围、避免重复工作。

---

🔗 探索 Astron 开源生态

• Astron Agent —— 企业级智能体工作流平台
• SkillHub —— 可私有化部署的 Agent Skill 注册与治理平台
• Astron RPA —— 面向 Agent 的桌面与 Web 自动化 RPA
• Dolphin MCP Pilot —— 面向 Apache DolphinScheduler 的生产级 MCP Server
• Domux —— 低延迟智能家居指令解析模型
• MemFlywheel —— Agent 原生长期记忆
• iFly-Skills · AstronClaw Tutorial · HarnessClaw
• Spark-X2.5 与 XHToken 组织 · Spark-X2.5 on Hugging Face
• 所有带 iflytek-astron 标签的仓库

统计口径说明：PR 数量基于 GitHub merged_at 时间戳，统计区间为 2026 年 9 月 7 日至 9 月 20 日，覆盖 iflytek-astron 标签下的 10 个仓库以及 XHToken 组织各仓库（不含跟随上游同步的 executorch fork）。Astron Agent 的两项修复先合入 bugfix/superteam、再合入 main，按 PR 分别计数。版本日期采用 GitHub published_at；Spark-X2.5 的生态接入日期以仓库 README 中的 Release 记录为准。Hugging Face 下载量为平台展示的近 30 天数据，Like 为累计值，均为 2026 年 9 月 28 日的快照，后续会持续变化。HER Hack-Astron #6 结果与 SkillHub #888 的关闭时间均为 9 月 21 日（窗口后一天），因与本期内容直接相关，一并说明。社区问题已匿名并做归纳；本文截图均来自开源讨论群的公开分享，凡包含个人账号、手机号、主机名或组织信息的图片均已排除；客户与群组身份、环境特有信息未予公开。

有问题、想法或希望分享贡献？欢迎参与社区讨论，或在相应仓库提交 Issue / PR。让我们继续为企业级 AI Agent 打造开放、可用于生产的基础设施 🚀