Twenty-plus systems dissected. Patterns extracted.
Last updated: 2026-06-14
Source-level analysis of agent systems. Each brings exactly one orthogonal component nobody else has — and the rest is filler. OpenClaw has 24+ channels and binding cascades but zero compute isolation. Muaddib has QEMU micro-VMs but max 8 concurrent. ElizaOS has a plugin marketplace but runs everything in-process. Hermes has self-improving skills + a 932-LOC threat-pattern scanner but no isolation. HOME23 has continuous cognitive loops and LLM-synthesized ingestion but federated multi-agent in one install. ContextLattice has write-path optimization but performance gaps on complex workloads. NanoClaw ships two-DB-per-session as the entire host↔container IPC. OpenClaw Managed Agents already ships orchestrator-restart-safe sessions + an egress sidecar with 9-case E2E matrix. The useful patterns are small; the accidental complexity is enormous.
Cross-sectional: each page compares how every system handles the same problem.
Each orthogonal component shapes tool design. smolagents skips schemas — the LLM writes Python because training data IS the API. Stripe cuts the network, not the filesystem. More code ≠ more security (430K lines vs 24 files).
ElizaOS pgvector: only horizontal scaling. OpenClaw hybrid (vector + BM25): catches exact keywords. Human-editable substrates (files.md, LLM Wiki, IWE): differ on write safety and sync. All converge on markdown.
Subagent design reveals each system's orthogonal bet. OpenClaw force-injects results (no message bus). NanoClaw puts each child in its own container (proxy bus). Muaddib rejects subagents entirely (VMs prioritize multi-user). Swarm does it in ~50 lines. Six trust models compared.
Stripe ships 1,300 PRs/week from Slack messages — zero human interaction during execution. OpenClaw requires 3 typed commands for one PR. The autonomy spectrum maps to isolation: more autonomous agents need stronger boundaries.
6 patterns every agent must solve. 5 systems, 3 lineages. Each system's orthogonal contribution mapped against multi-tenancy capability and audience reach.
13 patterns distilled from real codebases. Source credibility rated: production-proven vs niche. Doom loops, harness engineering, network isolation, blueprints.
Multi-user deployment systems. Each page covers what's orthogonal — the one contribution nobody else makes.
Orthogonal: 24+ channels, one process, no bus. Binding-based routing, 24 hook types, 6 queue strategies. The audience-scale champion with no isolation muscle.
Orthogonal: NVIDIA integration with OpenShell container runtime. Blueprint lifecycle (declarative workflows), Landlock + seccomp + netns sandboxing, CUDA/TensorRT-LLM optimization, NIM microservices. Agent mesh for distributed coordination with resource quotas. Sandboxes the whole bot, not per-user.
Orthogonal: Two-DB-per-session, exactly-one-writer-per-file — the entire host↔container IPC. Plus the on_wake column + onExit callback that close the dying-container race, and a 64-line command-gate.ts pre-container classifier (pass/filter/deny) that doesn't burn a turn on admin slashes.
Orthogonal: Orchestrator–runtime split modeled on Anthropic's Managed Agents shape (Agent / Environment / Vault / Session). 5-method ContainerRuntime contract + 5-assertion test suite; JSONL one-writer-only event log with SSE+Last-Event-ID resume; container adoption on orchestrator restart; egress-proxy sidecar with 9-outcome E2E matrix.
Orthogonal: character.json ecosystem, 35+ plugin marketplace with action/evaluator/provider architecture, pgvector RAG, multi-agent coordination via WorldEngine. The only horizontally-scalable system (PostgreSQL). Web3-native with EVM/Solana/TEE. April 2026: 2680 commits shifted focus to isolation hardening (AccountPool, Docker, vault credentials).
Orthogonal: QEMU micro-VMs where API keys physically cannot enter the guest. 3-tier markdown chronicles. Host/guest tool split is the cleanest privilege model. But web tools bypass it all.
ElizaOS wrapped in Electrobun desktop shell. Progressive SSE streaming, local-first PGLite (embedded Postgres), BNB Chain native integration. Character-driven personalities with privacy-first local storage.
Orthogonal: Self-improving skill system with auto-generation and 3-tier progressive disclosure. 16 messaging platforms, smart model routing (cheap-model heuristics), parallel tool execution (8 workers), trajectory persistence for RL training. Multi-instance via profiles. ~574KB agent loop. Zero isolation.
Orthogonal: Installable AI OS with living brain (20k+ knowledge nodes, autonomous expansion). Continuous cognitive loops (think-dream cycles), quantum-aware reasoning, autonomous remediation workflows, multi-modal understanding (vision/audio/code). PM2-managed with one-command install. The agent is permanent, conversations are ephemeral.
State that survives crashes, restarts, and model swaps. The agent is a pure function; durability lives in the log.
Orthogonal: Absurd-style durable workflow engine (ctx.step checkpoint/replay) paired with an iron-proxy credential firewall — the agent never holds API keys. Kernel/userspace split, one Slack thread = one K8s sandbox pod, all state in 7 Postgres tables. By Paradigm + Tempo.
Orthogonal: The log is the agent — the graph is a deterministic projection re-computable by replay, with fork-and-diff at any historical event as a first-class primitive. Relation-behaviors put logic on the edge. Nakajima's BabyAGI successor (arXiv:2605.21997).
Orthogonal: Orchestrator-less durable execution as an embedded library — Postgres is the only dependency. Workflows/steps checkpoint to Postgres tables and resume exactly where they crashed; no broker or control plane (vs Temporal's server cluster).
Orthogonal: Event store as a queryable causal-decision record for AI explainability — not fault-tolerance. CQRS/DDD (command→event) captures the full causal chain around inference, exposed via MCP, making audit/governance an architectural property. Axon Framework, 70M+ downloads.
The 2026 isolation frontier — and the system that argues you should watch, not wall.
Orthogonal: fork() for microVMs — boot one warm parent VM, then clone each child as a copy-on-write Firecracker microVM in milliseconds. The only system that collapses {cheap spawn, strong isolation}; also BRANCH a live VM mid-execution. Apache-2.0, ~2.4k stars.
Orthogonal: Per-agent dedicated kernel via a Rust-hardened Type-1 Xen hypervisor (“zones”), drop-in for container runtimes — below the host kernel, stronger than shared-kernel containers, lighter than full VMs. One rung past Muaddib's Type-2 QEMU (arXiv:2501.04580).
Orthogonal: Observe, don't contain — eBPF boundary tracing (SSL uprobes + syscall tracepoints) makes observability the security posture, inverting the sandbox premise. Detect-after-the-fact at ~2.9% overhead instead of building a wall. arXiv:2508.02736.
Orthogonal: Capability-escalation via human approval baked into the image — agents start minimal, file a request for a package/network/tool, and on approval the image is rebuilt with the capability and the agent resumes. gVisor + Temporal underneath. The request→approve→rebuild→resume loop is unique.
Cross-sectional: How six production company-brains (Stripe Minions, Notion 3.3, Anthropic Managed Agents, ChatGPT Enterprise, Agentforce, Glean) externalize org knowledge into governed stores the stateless agent queries — which is what lets the model swap freely.
Individual developer tools. Different problem space — interactive, single-user, human-in-the-loop.
Orthogonal: Vendor-neutral per-task-type model routing — auto-selects backend by route category (planning→Qwen, coding→Claude, exploration→GPT) with health/cost/context/privacy awareness + fallback chains (src/model_routing.rs). Local Rust assistant; new Telegram/Discord gateway. v0.6.0.
VSCode extension with 30+ tools, streaming diff view, 40+ LLM providers via OpenRouter, MCP marketplace integration, approval flow for dangerous operations, persistent task history. Native IDE integration for autonomous coding.
Reverse-engineered internals. 13 tools, 8-level permission hierarchy, bwrap sandbox, 5 typed subagents.
Knowledge graphs for codebases and documents. 71.5x token efficiency via tree-sitter (25 languages) + Claude vision → queryable graph. Leiden clustering discovers natural modules. Multimodal extraction (code/text/PDF/images), query-guided retrieval. Applied to agent research: semantic queries vs reading 30 pages.
HuggingFace-native agent framework. CodeAgent writes Python (30% token reduction), ToolAgent uses JSON tool calls. 11 model backends (OpenAI, Anthropic, HF Inference, local). Hub tool marketplace for community sharing. Minimal dependencies, lightweight core.
Orthogonal: Self-healing batch loop via git-as-database + Haiku-scores-Opus quality gate + reactive triggers. Category repair playbooks, cluster-first triage, regression hunter. 121 skills, 24h cooldown, GitHub Actions runtime.
Disk + read tool beats inline base64. Three patterns compared.
How agents steer LLMs. Prompt assembly, doom loops, model routing.
13 official plugins, 20+ commands, 16 agent types, 11 skills.
6-phase shipping pipeline. 5 parallel reviewers, 80% confidence filter.
Telegram bot dispatching coding agents to repos. Python plugin overlay, project routing, live deploy.
Go-native orthogonal components for agentic workflows. wire · tap · bus · vault · scheduler. Six packages, one colony. Goddess of the undead ants.
TypeScript proof-of-concept (v0.1.2). Config-driven routing, credential middleware, Telegram · Discord · WhatsApp. Patterns extracted into ARIZUKO.