What changed in our agent research. Each entry tracks new findings, updated systems, and refined analysis.
Monthly deep code analysis of the 9 source repos (31-day window to 2026-11-01). Real architectural movement in 4 systems: Cline (227 commits/32 authors), Graphify (652/120), NemoClaw (368/26), HOME23 (118/3). Five were quiet: ElizaOS, Milady, OpenClaw, Hermes (the Nous repo) — 0 commits — and smolagents (1 trivial doc-workflow pin). The convergent theme is credential and authority boundaries extended to new surfaces: NemoClaw pushes the keys-stay-host-side model from inference into web search; Cline gates cloud computer-use and routes artifacts only through signed URLs; HOME23 adds a one-shot owner-authority preflight before any learned conduct is written. This integration pass also folds in each system's prior-month deltas that the July entry had deferred to a reviewed edit — the four pages now reflect current state.
71a312ee). The new surface is a hosted cloud-session plane: CloudSessionsService + CloudSessionHost dial a sandbox Hub through the api.cline.bot proxy (1932d5dc); /cloud hands a local transcript to a cloud sandbox to continue (9188238f). The SDK now exposes one RuntimeHost boundary with three implementations (Local/Hub/Remote) so ClineCore runs the same loop local or remote without branching (sdk/ARCHITECTURE.md).CLOUD_COMPUTER_USE, default off; injected only when the model supports images and the rollout gate passes), scoped to the sandbox's Xvfb/Chromium, with screenshots exfiltrated only via a publish_artifacts tool (a4744871). Artifact publishing uses a per-batch signed upload policy — Zod schema forbids key/file field names, enforces keyPrefix/maxBytes/expiry — and rejects files mutated after selection (07ce8b83, 46996c99).scopeGeneration counter, and serviceId+expectedAccountId validation so a command can never straddle an account switch; the daemon throws on mismatch and gets a scoped child-only env (1facdca6). True multi-user separation lives in the opaque Cline Cloud backend.apps/examples/ (cli-agent, code-review-bot, multi-agent, the desktop app itself) exercises @cline/core + hub + cloud end to end; every npm publish requires a governed PublishNPM approval.path, explain and get_neighbors now render [INFERRED 0.75] off a discrete rubric {0.55…0.95} instead of a bare tag (13260e3); a path reports its weakest hop and, on ties, prefers the route whose weakest hop is weakest; collapsed duplicate edges keep the weaker copy's evidence in also_seen (3304de1).indirect_call, package-level var-initialiser calls credited to the file; Python module.func values in dispatch-table literals now resolve instead of dropping (fdd25f7, 61e864a, 948938a).docs/how-it-works.md), benchmark auto-run on any corpus over 5,000 words; the repo itself states reduction scales with corpus size (structural clarity, not compression, at ~6 files). Nearly every fix landed with a regression test; no new benchmark claims.api.tavily.com, while shared gateway credentials stay available to sibling sandboxes and identity is re-checked mid-operation (a2fc95199). Switching to a custom OpenAI-compatible endpoint now refuses when the retained base policy's IP pins conflict (444ce08ac).config.yaml, its own initial Landlock policy; the two are genuinely separate per-sandbox runtimes (NemoClaw stopped writing OpenClaw's POLICY.md into Hermes sandboxes, 1204c3d63).127.0.0.1 independently and refuses to retire a wildcard listener without proving identity + endpoint ownership (85a3a8b29); Hermes's Landlock policy gained read-only /sys/class/drm for GPU identity checks, no writes (81fe4746e).test/e2e — a hardware/runtime qualification matrix (Spark 64 GB, GB300, OpenShell 0.1.5, OpenClaw 10.5, Ubuntu 26.04, Node 24.22.1); the Tavily e2e was made credential-free in hosted CI, retaining the skip reason in uploaded artifacts.LearningDecisionObserved event; owner feedback is written back as a lesson bound to that exact decision, scoring four conduct axes (engagement/initiative/continuity/depth); the model proposes 2-3 complete candidate replies with no score and the committed Seed contribution picks the text, within the live context budget (1ea695b8, ebf93ced, 078300ec).preflightLearning() gate re-reads the Seed before spending the one-shot correction token — feedback scope/cell/tags must exactly match a retained decision, invented/broadened tags are rejected, "an agent note cannot mint owner authority," and operator-trial / verification-harness phrasing on the owner channel is refused conduct authority (f4ce0ff9, 078300ec). New read-only inspection: sandbox runs typed bounded-intent reads with no shell/write/schedule/message/network (e24e132d); paired apps mint per-household tokens instead of holding the house key (6c5ef174).test:seed-learning, test:conversation-learning, wired into posttest). The design states plainly that one example establishes one effect, not general improvement, and labels delivery receipts as intent, not owner value.ElizaOS (develop idle), Milady, OpenClaw, Hermes (NousResearch repo) — 0 commits/31d; smolagents — 1 trivial doc-workflow pin. Pages remain current from the prior pass. (Note: NemoClaw's new "Hermes" profile is unrelated to the Nous Hermes repo — a name collision.)
Monthly deep code analysis of the 9 source repos. Real architectural movement in 5 systems (31-day windows): Cline (355 commits/27 authors), Graphify (416/85), Hermes (5,921/871), HOME23 (438/solo), NemoClaw (1,032/57). Four systems were quiet: ElizaOS, Milady, OpenClaw, smolagents. The convergent theme this month is durability and hard enforcement boundaries — crash-safe delivery, capability tokens, deny-first tool gates.
ca6f6a6c; desktop-app/sidecar/ARCHITECTURE.md). Connector sessions (Slack etc.) persist across Hub restarts with autostart (51e5daf8).team_spawn tool (blocks recursive unbounded spawn), OAuth refresh propagates single-flight to all subagents mid-turn (359445ae); scheduled/headless routines default to yolo auto-approve with ask_question disabled (469debdb); sidecar bind host + trusted origins env-configurable for Docker dev (d41eed11).3e06abc3); ACP organization selector (3f38bd51); per-session subagent history via list_session_agents.c39c6d44); agentic compaction — context condensed by a summarization agent rather than truncation — defaulted on (26037b17); nightly publish workflow; 10+ ENG-ticketed VS Code regression fixes.GatewayRunner collapsed ~19 ad-hoc Dict[str, session_key] attributes into one SessionState (gateway/session_state.py) with explicit turn/conversation/persistent scopes — kills a class of wholesale-reset races.gateway/delivery_ledger.py records each outbound final response in state.db with pending → attempting → delivered | failed and a restart-sweep — at-least-once delivery with honest duplicate labeling ("Recovered reply — may be a duplicate"). Cites 3 prior prod issues; cross-process kill-mid-send E2E test.approvals.smart_policy) + user-defined deny rules that block terminal commands even under yolo (first hard user veto); per-channel model + system-prompt overrides (priority session > channel > global); desktop-vision images reachable from profile Docker sandboxes.reply_to) → near-parity with native adapters.indirect_call edges for getattr() (8fdbf50), ADR/RFC doc-reference edges (6d3a6f1).graphify install --strict installs a Claude Code hook that issues permissionDecision:"deny" to block the first raw file read of a session, forcing the agent through the graph query layer (689dd6c). Atomic per-session marker fires it at most once so it can't strand the agent; GRAPHIFY_HOOK_STRICT toggles. Previously advisory-only — now a hard behavioral gate. Symlink following moved to opt-in with out-of-root targets rejected (009a98b)._GraphContextCache capped by GRAPHIFY_MAX_CONTEXTS (default 8), bad project_path raises a tool error instead of sys.exit (b4865ff); token budget on get_neighbors/get_community.src/lib/onboard/managed-startup/ (~3,250 lines) + a root-owned transactional shared-state layer — but explicitly dormant, no production caller yet (issue #7744, PR3.1–3.15).nemoclaw <sandbox> mcp status <server> --tools — with hard limits (time/request/size/tool-count) and the invariant that discovery never sends tools/call; a vendored discovery runtime is bundled into all 3 agent images to avoid duplicating the security-sensitive path. Managed shared-state transactions enforce ownership/mode checks and env -i clean-exec (6 allowlisted controls) with idempotent rollback.operation-store.js (append-only, idempotency keys, terminal-state tracking, signed snapshots) and a Query Notebook (durable continuation tokens, size-bounded redacted export).requesterAgent/operationType/operationId/accessMode; privileged-env stripping scrubs HOME23_*_KEY from tool-spawned subprocess environments (a test proves a model-driven shell can't read them); confined-file reads re-stat inode/dev/mtime for identity.ElizaOS (develop branch idle), Milady, OpenClaw — 0 commits/31d; smolagents — 4 trivial commits. Pages remain current from the prior pass. Individual system-page integration of the above deferred to a reviewed edit; this entry is the record.
Every cloned repo pulled and git-log-diffed since February; the 10 systems with no local repo re-researched on the web. Material orthogonal-component changes:
@cline/{shared,llms,agents,core,sdk}) + a detached multi-client Cline Hub daemon brokering one shared session across IDE/CLI/browser. Orthogonal shifts from "VS Code-native plan/act" to the Hub session broker.messages_in/messages_out as the sole host↔container channel), Chat-SDK bridge, pluggable AgentProvider.Renamed "Agent Frameworks" → Agents Hub. Restored the canonical krons gold/blue style across all pages (the shared /assets/ dir was missing, so pages had been loading an unstyled fallback).
v3.4.0 (2026-06-05) repositions ContextLattice from "a memory service agents call into" to "a runtime contract agents inhabit." The public headline shifted from write-optimization / freshness framing to amnesia prevention: "Stop giving your agents amnesia and calling it workflow." The write-optimized control-plane core still holds — but the orthogonal claim is now the runtime contract, with context freshness secondary.
contextlattice_agent_adapter implementing bootstrap, context-pack, checkpoint, handoff, event, complete — any runtime wires it once for durable handoff./v1/agents/sessions with /telemetry/agents/runtime, and objective_runtime_state.v1 threaded across preflight / context-pack / Dream Mode.Currently v3.4.23 (2026-06-13). github.com/sheawinkler/ContextLattice is alive and very active — pushed 2026-06-14, 113 stars, 7 forks, Go primary lang, not archived; 30 GitHub releases spanning v3.3.x–v3.4.23 in roughly Feb–June 2026. v3.4.0 is the stable public agent-runtime-contract baseline; v4 stays a private tuning/experiment lane gated on benchmark/recall/soak.
Updated page: ContextLattice (v3.4.23)
Monthly reresearch of 9 agent framework repositories revealed significant activity in 3 systems: ElizaOS (2680 commits), Cline (55 commits), and smolagents (3 commits). The common theme: production hardening—isolation boundaries, credential management, containerized deployment, and operational observability.
milady.json) and runtime pools. AccountPool now owns all credential mutations with public CRUD API. Cross-provider account isolation enforced—each provider maintains independent priority namespace.@elizaos/agent harness package introduced with extended loadCharacters (JSON file + cwd support) and optional checkShouldRespond callbacks. Agent-Orchestrator + Plugin-Manager promoted to core bundles for multi-agent PTY delegation and runtime plugin loading..dockerignore.ci. 599+ lines of connector simulator + mutation tests prove state isolation.@elizaos/vault introduced for credential mirroring—apiKeyRef replaces plaintext apiKey in configs. Android AOSP local inference wired with bun:ffi struct-by-value shim + KV chunking.SdkController split into SdkMessageCoordinator, SdkSessionFactory, SdkSessionLifecycle, mode-specific handlers. Plan/Act mode switching triggers session rebuild with preserved history.toolPolicies. Follow-up message queueing prevents "already in progress" races. Subagent spawn events filter by parentAgentId to prevent parent chat flooding.RipgrepError + error_reason proto fields (CLINE-1814) for structured diagnostics. Workspace unavailability, ripgrep spawn failures surface via telemetry with individual enums.--heapsnapshot-near-heap-limit=1. CVE-2026-41242 protobufjs pinned to 7.5.5.allow_pickle=False in remote executors reduces arbitrary object deserialization risk.LocalPythonExecutor is NOT a security sandbox—mandate external sandboxes (E2B, Docker, Modal) for untrusted code.OpenClaw, NemoClaw, Milady, Hermes, HOME23, Graphify had 0 commits in April 2026. Pages remain current from April 16, 2026 analysis.
Cloned all 9 system repositories to /workspace/agent-research-sources/ and launched parallel deep code analysis using Explore subagents. Updated all research pages with current state findings integrated into existing orthogonal sections (not as "Recent Updates" sections).
~/.hermes/profiles/, pluggable context engine with compression supportplugin.json capabilities/hooks declaration, Pi framework details (@mariozechner/pi-coding-agent, not Claude Code wrapper), involuntary subagent injection mechanics (child results force-injected into parent without consent)System capability summaries on main hub page updated to reflect current state. All pages now document current implementation, not historical updates.