Browse the agentic landscape by category. Each card names the flagship's one orthogonal trick — and what it has versus what it deliberately lacks.
Twenty-plus systems dissected · Last updated: 2026-06-15
Source-level analysis of agent systems. Each brings exactly one orthogonal component nobody else has — the rest is filler. The useful patterns are small; the accidental complexity is enormous. A few examples of the one-thing-each pattern:
Cross-sectional: each page compares how every system handles the same problem.
Each orthogonal component shapes tool design. smolagents skips schemas — the LLM writes Python because training data IS the API. Stripe cuts the network, not the filesystem. More code ≠ more security (430K lines vs 24 files).
ElizaOS pgvector: only horizontal scaling. OpenClaw hybrid (vector + BM25): catches exact keywords. Human-editable substrates (files.md, LLM Wiki, IWE): differ on write safety and sync. All converge on markdown.
Subagent design reveals each system's orthogonal bet. OpenClaw force-injects results (no message bus). NanoClaw puts each child in its own container (proxy bus). Muaddib rejects subagents entirely (VMs prioritize multi-user). Swarm does it in ~50 lines. Six trust models compared.
Stripe ships 1,300 PRs/week from Slack messages — zero human interaction during execution. OpenClaw requires 3 typed commands for one PR. The autonomy spectrum maps to isolation: more autonomous agents need stronger boundaries.
How six production company-brains (Stripe Minions, Notion 3.3, Anthropic Managed Agents, ChatGPT Enterprise, Agentforce, Glean) externalize org knowledge into governed stores the stateless agent queries — which is what lets the model swap freely.
The synthesis pages — systems mapped side by side, patterns distilled across all of them.
6 patterns every agent must solve. 5 systems, 3 lineages. Each system's orthogonal contribution mapped against multi-tenancy capability and audience reach.
13 patterns distilled from real codebases. Source credibility rated: production-proven vs niche. Doom loops, harness engineering, network isolation, blueprints.
Multi-user deployment systems. Each page covers what's orthogonal — the one contribution nobody else makes.
Orthogonal: 24+ channels, one process, no bus. Binding-based routing, 24 hook types, 6 queue strategies. The audience-scale champion with no isolation muscle.
✓ 24 channels from one process, no message bus · ✗ zero compute isolation by default
Orthogonal: NVIDIA-native stack — OpenShell container runtime, declarative blueprint lifecycle, Landlock + seccomp + netns sandboxing, CUDA/TensorRT-LLM tuning, NIM microservices, and an agent mesh with resource quotas. Sandboxes the whole bot, not per-user.
✓ Landlock+seccomp+netns + transparent inference proxy (keys host-side) · ✗ sandboxes the whole bot, not per-user
Orthogonal: Two-DB-per-session, exactly-one-writer-per-file — the entire host↔container IPC. Plus the on_wake column + onExit callback that close the dying-container race, and a 64-line command-gate.ts pre-container classifier (pass/filter/deny) that doesn't burn a turn on admin slashes.
✓ DB-as-IPC, exactly-one-writer, container-default · ✗ single-user; group-safe, not per-user
Orthogonal: Orchestrator–runtime split modeled on Anthropic's Managed Agents shape (Agent / Environment / Vault / Session). 5-method ContainerRuntime contract + 5-assertion test suite; JSONL one-writer-only event log with SSE+Last-Event-ID resume; container adoption on orchestrator restart; egress-proxy sidecar with 9-outcome E2E matrix.
✓ open re-impl of Anthropic's Managed Agents shape, multi-model, restart-safe · ✗ no deployed customers; ~6wk quiet
Orthogonal: The only horizontally-scalable system (PostgreSQL) — character.json ecosystem, 35+ plugin marketplace (action/evaluator/provider architecture), pgvector RAG, WorldEngine multi-agent coordination, Web3-native (EVM/Solana/TEE). April 2026: 2680 commits shifted focus to isolation hardening (AccountPool, Docker, vault credentials).
✓ plugin marketplace + only horizontally-scalable; v2 sandboxes remote plugins · ✗ core still runs in-process
Orthogonal: QEMU micro-VMs where API keys physically cannot enter the guest. 3-tier markdown chronicles. Host/guest tool split is the cleanest privilege model. But web tools bypass it all.
✓ QEMU micro-VM, keys can't enter guest; v2.4 default-deny network · ✗ ~8 concurrent cap; web tools historically bypass
Orthogonal: ElizaOS wrapped in an Electrobun desktop shell — local-first PGLite (embedded Postgres), progressive SSE streaming, native BNB Chain integration. Character-driven personalities with privacy-first local storage.
✓ ElizaOS as a local-first consumer product, TEE-derived keys · ✗ none/prompt isolation by default
Orthogonal: Self-improving skills — auto-generation plus 3-tier progressive disclosure. Also: 16 messaging platforms, model routing on cheap-model heuristics, parallel tool execution (8 workers), trajectory persistence for RL training. ~574KB agent loop, zero isolation.
✓ self-improving skills + RL training + multi-surface platform · ✗ zero isolation
Orthogonal: Installable AI OS with a living brain — 20k+ self-expanding knowledge nodes, continuous think-dream cognitive loops, autonomous remediation, multi-modal understanding (vision/audio/code), one-command PM2 install. The agent is permanent; conversations are ephemeral.
State that survives crashes, restarts, and model swaps. The agent is a pure function; durability lives in the log.
Orthogonal: Absurd-style durable workflow engine (ctx.step checkpoint/replay) paired with an iron-proxy credential firewall — the agent never holds API keys. Kernel/userspace split, one Slack thread = one K8s sandbox pod, all state in 7 Postgres tables. By Paradigm + Tempo.
✓ durable ctx.step replay + iron-proxy credential firewall · ✗ heavy infra (Postgres + a K8s pod per thread)
Orthogonal: The log is the agent — the graph is a deterministic projection re-computable by replay, with fork-and-diff at any historical event as a first-class primitive. Relation-behaviors put logic on the edge. Nakajima's BabyAGI successor (arXiv:2605.21997).
✓ event-sourced; fork-and-diff any run at any past event · ✗ substrate, not a batteries-included framework; small community
Orthogonal: Orchestrator-less durable execution as an embedded library — Postgres is the only dependency. Workflows/steps checkpoint to Postgres tables and resume exactly where they crashed; no broker or control plane (vs Temporal's server cluster).
✓ durable execution as a library, Postgres the only dependency · ✗ no agent-specific tooling; you wire the loop
Orthogonal: Event store as a queryable causal-decision record for AI explainability — not fault-tolerance. CQRS/DDD (command→event) captures the full causal chain around inference, exposed via MCP, making audit/governance an architectural property. Axon Framework, 70M+ downloads.
✓ event store as a causal-decision record for explainability · ✗ JVM/CQRS learning curve; not agent-native
The 2026 isolation frontier — and the system that argues you should watch, not wall.
Orthogonal: fork() for microVMs — boot one warm parent VM, then clone each child as a copy-on-write Firecracker microVM in milliseconds. The only system that collapses {cheap spawn, strong isolation}; also BRANCH a live VM mid-execution. Apache-2.0, ~2.4k stars.
✓ microVM isolation at fork() speed (warm-snapshot CoW) · ✗ Linux/KVM only; young project
Orthogonal: Per-agent dedicated kernel via a Rust-hardened Type-1 Xen hypervisor (“zones”), drop-in for container runtimes — below the host kernel, stronger than shared-kernel containers, lighter than full VMs. One rung past Muaddib's Type-2 QEMU (arXiv:2501.04580).
✓ per-agent dedicated kernel (Type-1 Xen), drop-in for containers · ✗ infra layer, not an agent framework
Orthogonal: Observe, don't contain — eBPF boundary tracing (SSL uprobes + syscall tracepoints) makes observability the security posture, inverting the sandbox premise. Detect-after-the-fact at ~2.9% overhead instead of building a wall. arXiv:2508.02736.
✓ eBPF observability as the security posture, ~2.9% overhead · ✗ observes, doesn't prevent — detect-after-the-fact
Orthogonal: Capability-escalation via human approval baked into the image — agents start minimal, file a request for a package/network/tool, and on approval the image is rebuilt with the capability and the agent resumes. gVisor + Temporal underneath. The request→approve→rebuild→resume loop is unique.
✓ capability request→approve→rebuild-image→resume, gVisor-backed · ✗ human-in-loop adds latency; early/small
Orthogonal: A network data plane for the three agent protocols — one Rust proxy that routes AND governs MCP tool calls, A2A hops, and LLM traffic, with RBAC + OPA policy on every hop. The only entry here whose unit is a hop, not an agent: it gates the wire between components, where the others wall the process. Solo.io → Linux Foundation (AAIF), Apache-2.0, 1k+ stars.
✓ per-hop RBAC/policy + per-team budgets across MCP/A2A/LLM · ✗ governs reach not compute; mandatory choke point; perf claims vendor-only
Individual developer tools. Different problem space — interactive, single-user, human-in-the-loop.
Orthogonal: Vendor-neutral per-task-type model routing — auto-selects backend by route category (planning→Qwen, coding→Claude, exploration→GPT) with health/cost/context/privacy awareness + fallback chains (src/model_routing.rs). Local Rust assistant; new Telegram/Discord gateway. v0.6.0.
✓ vendor-neutral per-task-type model routing · ✗ none/prompt isolation; no production proof
VSCode extension for autonomous coding, native to the IDE — 30+ tools, streaming diff view, 40+ LLM providers via OpenRouter, MCP marketplace, approval flow for dangerous operations, persistent task history.
✓ multi-client Hub daemon + embeddable layered SDK · ✗ developer tool — single-user, in-editor trust
Reverse-engineered internals. 13 tools, 8-level permission hierarchy, bwrap sandbox, 5 typed subagents.
Single-purpose mechanisms — one sharp idea each, portable across systems.
Knowledge graphs for codebases and documents — tree-sitter (25 languages) + Claude vision build a queryable graph at 71.5x token efficiency. Leiden clustering finds natural modules; multimodal extraction (code/text/PDF/images) feeds query-guided retrieval. Semantic queries instead of reading 30 pages.
✓ local AST→graph, 71.5x token cut, offline · ✗ a retrieval skill, not an agent runtime
HuggingFace-native agent framework with a lightweight core — CodeAgent writes Python (30% fewer tokens), ToolAgent uses JSON tool calls, 11 model backends (OpenAI, Anthropic, HF Inference, local), and a Hub tool marketplace for community sharing.
✓ code-first agents, ~1K-line core · ✗ Wasm sandbox removed; isolation now Docker or none
Orthogonal: Self-healing batch loop via git-as-database + Haiku-scores-Opus quality gate + reactive triggers. Category repair playbooks, cluster-first triage, regression hunter. 121 skills, 24h cooldown, GitHub Actions runtime.
✓ self-healing batch loop, git-as-database, GitHub Actions runtime · ✗ batch, not interactive; no isolation
Disk + read tool beats inline base64. Three patterns compared.
How agents steer LLMs. Prompt assembly, doom loops, model routing.
How the parts fit together — plugins, shipping pipelines, and our own reference builds.
13 official plugins, 20+ commands, 16 agent types, 11 skills.
6-phase shipping pipeline. 5 parallel reviewers, 80% confidence filter.
Telegram bot dispatching coding agents to repos. Python plugin overlay, project routing, live deploy.
✓ multi-engine Telegram bridge, worktree-per-branch · ✗ no sandbox of its own — relies on the host engine
Multitenant Claude agent router, self-hosted. Go daemons · SQLite WAL · MCP over unix socket · Docker per group. Same code from solo/inbox to a whole company.
TypeScript proof-of-concept (v0.1.2). Config-driven routing, credential middleware, Telegram · Discord · WhatsApp. Patterns extracted into ARIZUKO.
The raw material — cloned source, research notes, architecture sketches.