How the Ormus Agent Harness compares to the reference harnesses we studied, on tech stack and on capability. Our column is current-as-built, not aspirational. Click any row for why the dimension matters and how to read the cells.
Safety-kernel-first personal agent runtime. TypeScript, no build, plain files, zero npm deps in the runtime. Private.
The most complete personal-agent gateway in the field: ~29 channels, tiered memory, estop, credential pool. ~580k LOC.
Large multi-channel daemon with 162 extensions and strong state-ownership discipline (writer fencing, state-dir lock). ~16k files.
Wraps other agents in OpenShell sandboxes with manifest-first channels and host-side credentials. Capabilities come from the wrapped agent.
Durable-jobs bot on Postgres with chain and streak caps. Official protocols only.
Markdown-repo-as-brain with an autopilot daemon; files canonical, database as cache. Memory-first, thin on channels.
Also studied, not in the matrix: grok-prompts (a prompt corpus), awesome-openclaw-skills (an index), OpenMausBot and hermes-desktop (Electron clients), hermes-webui (a client surface), and an unofficial Grok Bot reconstruction (read, never executed).
We are the smallest runtime in the field by one to two orders of magnitude, the only one with zero npm dependencies in the runtime (persistence included, via the node:sqlite builtin), and the only one running its own TypeScript with no build or bundler.
| Harness | Language | Runtime / build | Persistence | License | Rough size |
|---|---|---|---|---|---|
| Ormus Agent Harness | TypeScript (strict, erasable) | Node ≥ 22, no build (native TS) | plain files + derived SQLite FTS5 index (node:sqlite) | private | ~13k lines incl. tests, 7 packages, 1.2k tests |
| hermes-agent | Python | asyncio, one gateway | SQLite (WAL, FTS5) | MIT | ~580k LOC |
| OpenClaw | TypeScript | Node daemon, pnpm workspace, build step | SQLite + files | MIT | ~16k files, 23 pkgs, 162 ext |
| NemoClaw | TypeScript | oclif CLI, OpenShell sandbox wrapper | host JSON registry | Apache-2.0 | ~2.9k files |
| rakazo | TypeScript | Node, Graphile Worker durable jobs | Postgres | Apache-2.0 | ~816 files |
| gbrain | TypeScript | Node, minions/autopilot daemon | markdown repo + PGLite/Postgres cache | MIT | ~36k AST nodes |
| OpenMausBot | TypeScript | Electron, four-tier sandbox | local + cloud VM | Apache-2.0 | ~16k AST nodes |
| hermes-desktop | TypeScript | Electron | local | MIT | ~125k LOC |
| Capability | Ormus | hermes | openclaw | NemoClaw | rakazo | gbrain |
|---|
The honest reading: smallest and safest, we own every line, and we stay behind on breadth on purpose rather than inheriting platform sprawl.
The comparison is not a contest; it is a parts catalog. Each mechanism below came from a reference harness with its scar attached and was reimplemented in a form we can hold. The anatomy lists the lineage per organ.
| Concern | Source | Their mechanism | Ours |
|---|---|---|---|
| Emergency stop | hermes-agent | estop.py file sentinel, fail-safe on corrupt | kernel/handbrake.ts |
| Loop containment | hermes-agent | iteration budget, failure-shape guards | kernel/ledger.ts + kernel/guards.ts |
| Credential rotation | hermes-agent | credential_pool with failover | agent/credentials.ts |
| Crash-loop detection | hermes-agent | restart_loop_guard gap-chaining | kernel/restart.ts |
| Deliberate silence | hermes-agent | [SILENT] / NO_REPLY markers | channels/gate.ts |
| Transcript integrity | OpenClaw | activeWriterRunId fencing | agent/session.ts writer claim |
| Single state ownership | OpenClaw | state-dir gateway lock | gateway/lock.ts |
| Exec approval | OpenClaw | approval bound to exact argv/cwd/hash | tools/approvals.ts |
| Config discipline | OpenClaw | fail-closed config, bad reload skipped | gateway/manifest.ts |
| Single channel truth | NemoClaw | manifest-first channels | channels/manifest.ts |
| Default-closed senders | NemoClaw | allowlist, no "open" | channels/gate.ts |
| Host-side credentials | NemoClaw | tokens outside the agent | profile credentials/ dir |
| Chain + streak caps | rakazo | 6-hop bot chain, identical-call streak | kernel/guards.ts |
| Tiered permission | Grok Bot reconstruction | off / shadow / enforce gating | tools/floors.ts pipeline |
| Human-answered budget | OpenMausBot | count only bot messages unanswered by a human | runner bot-streak counter |
| Files as source of record | gbrain | markdown canonical, DB as cache | workspace-as-files |
| Immutable policy block | grok-prompts | marker-delimited policy | floors frozen at construction |
| Budget as law | nobody | — | kernel/ledger.ts: charged before the action, no soft overrun |