Research Updates

Overview

Monthly deep code analysis of the 9 source repos. Real architectural movement in 5 systems (31-day windows): Cline (355 commits/27 authors), Graphify (416/85), Hermes (5,921/871), HOME23 (438/solo), NemoClaw (1,032/57). Four systems were quiet: ElizaOS, Milady, OpenClaw, smolagents. The convergent theme this month is durability and hard enforcement boundaries — crash-safe delivery, capability tokens, deny-first tool gates.

Cline — Hub runtime consolidated (v3.0.48 CLI / SDK v0.0.67)

• Orthogonal: the detached "Cline Hub" daemon hardened. The desktop app dropped its private agent runtime and now registers as a Hub client like the CLI (ca6f6a6c; desktop-app/sidecar/ARCHITECTURE.md). Connector sessions (Slack etc.) persist across Hub restarts with autostart (51e5daf8).
• Isolation: teammates no longer see the team_spawn tool (blocks recursive unbounded spawn), OAuth refresh propagates single-flight to all subagents mid-turn (359445ae); scheduled/headless routines default to yolo auto-approve with ask_question disabled (469debdb); sidecar bind host + trusted origins env-configurable for Docker dev (d41eed11).
• Multi-tenancy: pathless temporary-workspace sessions (3e06abc3); ACP organization selector (3f38bd51); per-session subagent history via list_session_agents.
• Validated / NEW: ClinePass GA (flag removed c39c6d44); agentic compaction — context condensed by a summarization agent rather than truncation — defaulted on (26037b17); nightly publish workflow; 10+ ENG-ticketed VS Code regression fixes.

Hermes — durable delivery + session-state consolidation

• Orthogonal: gateway-as-orchestration intact; the gateway is the hottest area. GatewayRunner collapsed ~19 ad-hoc Dict[str, session_key] attributes into one SessionState (gateway/session_state.py) with explicit turn/conversation/persistent scopes — kills a class of wholesale-reset races.
• NEW primitive: gateway/delivery_ledger.py records each outbound final response in state.db with pending → attempting → delivered | failed and a restart-sweep — at-least-once delivery with honest duplicate labeling ("Recovered reply — may be a duplicate"). Cites 3 prior prod issues; cross-process kill-mid-send E2E test.
• Isolation: operator-customizable smart-approval policy (approvals.smart_policy) + user-defined deny rules that block terminal commands even under yolo (first hard user veto); per-channel model + system-prompt overrides (priority session > channel > global); desktop-vision images reachable from profile Docker sandboxes.
• Multi-tenancy: kanban worker sessions now hidden from the user session list — first explicit worker/user separation. Relay bridge reached Phase 4 (thread lifecycle, slash-command manifest, reply_to) → near-parity with native adapters.
• Also: per-turn micro-compaction default-on with measured token savings; full-duplex voice barge-in wired across CLI/TUI/gateway/desktop.

Graphify — strict PreToolUse enforcement (0.9.31)

• Orthogonal: code-graph-as-context unchanged; extraction richer — indirect_call edges for getattr() (8fdbf50), ADR/RFC doc-reference edges (6d3a6f1).
• NEW boundary: graphify install --strict installs a Claude Code hook that issues permissionDecision:"deny" to block the first raw file read of a session, forcing the agent through the graph query layer (689dd6c). Atomic per-session marker fires it at most once so it can't strand the agent; GRAPHIFY_HOOK_STRICT toggles. Previously advisory-only — now a hard behavioral gate. Symlink following moved to opt-in with out-of-root targets rejected (009a98b).
• Multi-tenancy: multi-project MCP promoted prototype→stable — thread-safe LRU _GraphContextCache capped by GRAPHIFY_MAX_CONTEXTS (default 8), bad project_path raises a tool error instead of sys.exit (b4865ff); token budget on get_neighbors/get_community.
• Validated: 85 authors, PyPI trusted-publishing CI; node-id canonicalization across incremental builds closed a broad rebuild-failure bug class.

NemoClaw — managed-startup foundation + MCP tool discovery (v0.0.99)

• Orthogonal: CLI-managed sandbox lifecycle unchanged. Foundation slabs for a layered "managed startup" landed — src/lib/onboard/managed-startup/ (~3,250 lines) + a root-owned transactional shared-state layer — but explicitly dormant, no production caller yet (issue #7744, PR3.1–3.15).
• Isolation / NEW capability: opt-in authenticated MCP tool discovery — nemoclaw <sandbox> mcp status <server> --tools — with hard limits (time/request/size/tool-count) and the invariant that discovery never sends tools/call; a vendored discovery runtime is bundled into all 3 agent images to avoid duplicating the security-sensitive path. Managed shared-state transactions enforce ownership/mode checks and env -i clean-exec (6 allowlisted controls) with idempotent rollback.
• Multi-tenancy: compute driver separated from gateway launcher (Docker/K8s/future Podman), resolved driver recorded in sandbox registry — prereq for multi-driver hosts.
• Validated: 4 releases (v0.0.96–99), heavy E2E (Brev cloud fleet, digest-pinned OCI images with anonymous-pull validation), weekly cadence, 57 contributors.

HOME23 — durable brain-operations + capability tokens (1.0)

• Orthogonal: local-first personal AI OS intact; NEW durable brain-operations layer — operation-store.js (append-only, idempotency keys, terminal-state tracking, signed snapshots) and a Query Notebook (durable continuation tokens, size-bounded redacted export).
• NEW isolation: HMAC capability tokens (120s TTL) binding requesterAgent/operationType/operationId/accessMode; privileged-env stripping scrubs HOME23_*_KEY from tool-spawned subprocess environments (a test proves a model-driven shell can't read them); confined-file reads re-stat inode/dev/mtime for identity.
• Multi-tenancy: single-owner by design, unchanged; only addition is multi-window Query progress over SSE.
• Validated (solo project, honest): 1.0 + local-separation milestone; 2,289-line store with a 3,487-line test. But 242 of 438 commits were fixes hardening the same new durability layer — it landed unstable and was iterated all month.

Quiet this month

ElizaOS (develop branch idle), Milady, OpenClaw — 0 commits/31d; smolagents — 4 trivial commits. Pages remain current from the prior pass. Individual system-page integration of the above deferred to a reviewed edit; this entry is the record.

Full re-research pass

Every cloned repo pulled and git-log-diffed since February; the 10 systems with no local repo re-researched on the web. Material orthogonal-component changes:

• Cline (v3.89.2): restructured into an embeddable layered SDK (@cline/{shared,llms,agents,core,sdk}) + a detached multi-client Cline Hub daemon brokering one shared session across IDE/CLI/browser. Orthogonal shifts from "VS Code-native plan/act" to the Hub session broker.
• ElizaOS (v2.0.3-beta): remote-mode plugins now run in isolated Bun subprocesses with a permissions manifest + RPC envelope; vector store no longer Postgres-only (sqlite-vec, in-memory). Drops the "only via pgvector" claim.
• Muaddib (v2.4.0): added a per-arc default-deny network trust boundary (in-room human approval) on top of the Gondolin micro-VM, plus a BYOK per-user cost/billing subsystem.
• NanoClaw (v2.1.x): v1→v2 rewrite — DB-as-IPC (a mounted SQLite DB with messages_in/messages_out as the sole host↔container channel), Chat-SDK bridge, pluggable AgentProvider.
• flue (v0.11.1): orthogonal reframed to the just-bash in-memory virtual sandbox as default isolation (container opt-in); added durable-execution / crash-recovery.
• NemoClaw: orthogonal sharpened to the transparent inference-routing proxy (keys stay host-side); flagged CVE-2026-24222 (prompt-injection env-var exfil at sandbox init).
• Plus version/scope refreshes: OpenClaw (2026.6.2, pluggable docker/ssh/openshell sandbox), Hermes (v2026.6.5), milady (v2.0, TEE + on-chain), Graphify (v0.8.39), smolagents (v1.26.0, WasmExecutor removed), takopi (v0.23.4), HOME23 (v0.6.0), aeon (multi-provider gateway), OpenClaw Managed Agents.

New systems added

• Durable execution & event sourcing: Centaur (durable ctx.step replay + iron-proxy credential firewall), ActiveGraph (the log is the agent), DBOS (orchestrator-less durable execution, Postgres-only), AxonIQ (event store for explainability).
• Isolation & observability: forkd (fork() for microVMs), Edera (Type-1 Xen per-agent kernel), AgentSight (eBPF observe-don't-contain), TaskForge (capability-request→approve→rebuild→resume).
• Cross-sectional: Company-Brain Patterns (Stripe Minions, Glean, Agentforce, Anthropic Dreaming, Notion, ChatGPT Enterprise) and brainpro (vendor-neutral per-task model routing).

Site

Renamed "Agent Frameworks" → Agents Hub. Restored the canonical krons gold/blue style across all pages (the shared /assets/ dir was missing, so pages had been loading an unstyled fallback).

Architecture shift: memory service → runtime contract

v3.4.0 (2026-06-05) repositions ContextLattice from "a memory service agents call into" to "a runtime contract agents inhabit." The public headline shifted from write-optimization / freshness framing to amnesia prevention: "Stop giving your agents amnesia and calling it workflow." The write-optimized control-plane core still holds — but the orthogonal claim is now the runtime contract, with context freshness secondary.

• Universal adapter lifecycle: a single contextlattice_agent_adapter implementing bootstrap, context-pack, checkpoint, handoff, event, complete — any runtime wires it once for durable handoff.
• Native runtime sessions: first-class sessions via /v1/agents/sessions with /telemetry/agents/runtime, and objective_runtime_state.v1 threaded across preflight / context-pack / Dream Mode.
• Compiled context packets + Skills Index: prompt-ready compiled context packages plus a surfaced Skills Index (commits #272, #274, June 2026) — the move from raw transcript replay to clean compiled packets for cleaner prompts and cross-agent handoff.
• Async-continuation steering (v3.4.21, 2026-06-13): agents can now steer the async slow-lane deep continuation, not just consume it.

Repo health

Currently v3.4.23 (2026-06-13). github.com/sheawinkler/ContextLattice is alive and very active — pushed 2026-06-14, 113 stars, 7 forks, Go primary lang, not archived; 30 GitHub releases spanning v3.3.x–v3.4.23 in roughly Feb–June 2026. v3.4.0 is the stable public agent-runtime-contract baseline; v4 stays a private tuning/experiment lane gated on benchmark/recall/soak.

Updated page: ContextLattice (v3.4.23)

Overview

Monthly reresearch of 9 agent framework repositories revealed significant activity in 3 systems: ElizaOS (2680 commits), Cline (55 commits), and smolagents (3 commits). The common theme: production hardening—isolation boundaries, credential management, containerized deployment, and operational observability.

ElizaOS: Isolation Hardening (2680 commits)

• AccountPool single source of truth: Eliminated dual-store divergence between UI config (milady.json) and runtime pools. AccountPool now owns all credential mutations with public CRUD API. Cross-provider account isolation enforced—each provider maintains independent priority namespace.
• Runtime composition extensions: @elizaos/agent harness package introduced with extended loadCharacters (JSON file + cwd support) and optional checkShouldRespond callbacks. Agent-Orchestrator + Plugin-Manager promoted to core bundles for multi-agent PTY delegation and runtime plugin loading.
• Docker dependency isolation: Agent skills re-linked per image, local embedding startup bounded with health probes, elizamaker/companion deps isolated in .dockerignore.ci. 599+ lines of connector simulator + mutation tests prove state isolation.
• Vault credential storage: @elizaos/vault introduced for credential mirroring—apiKeyRef replaces plaintext apiKey in configs. Android AOSP local inference wired with bun:ffi struct-by-value shim + KV chunking.
• Updated page: ElizaOS Architecture (v2.0.0-alpha.523)

Cline: SDK Migration & Observability (55 commits)

• Controller decomposition: 375+ line SdkController split into SdkMessageCoordinator, SdkSessionFactory, SdkSessionLifecycle, mode-specific handlers. Plan/Act mode switching triggers session rebuild with preserved history.
• Isolation boundary: Tool approval enforcement migrated to SDK toolPolicies. Follow-up message queueing prevents "already in progress" races. Subagent spawn events filter by parentAgentId to prevent parent chat flooding.
• Error handling: Typed RipgrepError + error_reason proto fields (CLINE-1814) for structured diagnostics. Workspace unavailability, ripgrep spawn failures surface via telemetry with individual enums.
• Memory observability: Periodic 5-minute heap snapshots + OOM capture via --heapsnapshot-near-heap-limit=1. CVE-2026-41242 protobufjs pinned to 7.5.5.
• Updated page: Cline — Distilled

smolagents: Security Hardening (3 commits)

• Pickle disabled by default: allow_pickle=False in remote executors reduces arbitrary object deserialization risk.
• Documentation clarity: Explicit warning that LocalPythonExecutor is NOT a security sandbox—mandate external sandboxes (E2B, Docker, Modal) for untrusted code.
• CI supply-chain hardening: GitHub Actions pinned to commit SHAs for reproducibility.
• Updated page: smolagents Architecture

No Activity (6 systems)

OpenClaw, NemoClaw, Milady, Hermes, HOME23, Graphify had 0 commits in April 2026. Pages remain current from April 16, 2026 analysis.

Overview

Cloned all 9 system repositories to /workspace/agent-research-sources/ and launched parallel deep code analysis using Explore subagents. Updated all research pages with current state findings integrated into existing orthogonal sections (not as "Recent Updates" sections).

What Changed Per System

• Hermes: Discovered smart model routing (cheap-model heuristics for simple queries <160 chars), parallel tool execution with 8-worker pool and safety gates, expanded from 11 to 16 messaging platforms (added iMessage via BlueBubbles, WeChat, WeCom), trajectory persistence for RL training, multi-instance isolation via ~/.hermes/profiles/, pluggable context engine with compression support
• ElizaOS: Updated to v2.0.0-alpha.176, corrected plugin count from 90+ to 35+ with action/evaluator/provider architecture, found WorldEngine for multi-agent coordination, trajectory logging for decision replay, trust scoring for relationship tracking, Web3-native integration (EVM chains, Solana, TEE trusted execution)
• HOME23: Expanded living brain details (20,000+ knowledge nodes with autonomous expansion), quantum-aware reasoning architecture, autonomous remediation workflows (self-healing system failures), PM2-managed one-command install, multi-modal understanding (vision/audio/code), continuous cognitive loops (think-dream cycles)
• Graphify: Updated with 25 language support via tree-sitter AST parsing, multimodal extraction (code/text/PDF/images), query-guided retrieval for targeted answers, 71.5x token efficiency maintained, Leiden clustering for natural module discovery
• OpenClaw: Confirmed 24+ channels (most of any system), manifest-first plugin architecture with plugin.json capabilities/hooks declaration, Pi framework details (@mariozechner/pi-coding-agent, not Claude Code wrapper), involuntary subagent injection mechanics (child results force-injected into parent without consent)
• NemoClaw: Added blueprint lifecycle (declarative workflow definitions), NVIDIA OpenShell container runtime integration, CUDA/TensorRT-LLM optimization for GPU acceleration, agent mesh for distributed multi-agent coordination with resource quotas, Landlock+seccomp+netns sandboxing stack
• Milady: Fully documented Electrobun desktop wrapper (cross-platform native app), progressive SSE streaming for real-time token-level display, PGLite embedded Postgres (WASM-based, zero-server local-first storage), BNB Chain native integration for NFT personas and DeFi features, character-driven personalities using ElizaOS core
• smolagents: Documented HuggingFace-native approach, CodeAgent writes Python directly (30% token reduction vs JSON tool calls), 11 model backends (OpenAI, Anthropic, HF Inference, local), Hub tool marketplace for community tool sharing, minimal dependencies for lightweight deployment
• Cline: VSCode extension with 30+ tools, streaming diff view for incremental changes, 40+ LLM providers via OpenRouter integration, MCP marketplace support, approval flow for dangerous operations, persistent task history across sessions

Main Hub Index Updated

System capability summaries on main hub page updated to reflect current state. All pages now document current implementation, not historical updates.