Omnara

The deciding trait is that the agent is a document. Instruction, model, tools and machines live in one profile, so changing behaviour is a pull request with a diff somebody can argue with, rather than a setting somebody changed in a console at eleven at night. That single property fixes most of the operational chaos agents cause in a team.

What you give up is spontaneity: everything goes through the file. Pick it when agents are shared. Pick Letta when the interesting problem is memory rather than governance.

The risk is an unexamined dependency. Execution environments are documented as coming from two named third-party providers, or from you, and the default path is theirs. That means an outage, a policy change or a breach at a company you never contracted with lands inside your agent platform, and the documentation treats this as a configuration detail rather than a supply-chain decision.

What it does right is declaring it. The machine is a field in the profile, named and visible, rather than an implementation detail discovered during an incident.

1. The interface is narrow by construction: an application decides who may invoke an agent and where the output goes, and everything between is the platform's problem. That is the correct division, because session and state management is where most homegrown harnesses rot.

2. Model compatibility is defined by wire protocol rather than by vendor, with three named request shapes accepted, so the abstraction survives a provider change. 3. No evaluation is published, and the design makes no claim that would require one.

The open runtime is the distribution and the cloud is meant to be the business, but no rate card exists yet, so nobody has tested what a team will pay for managed execution when the code to run it themselves is right there. That is the hardest version of this model to make work, and the permissive licence gives away the leverage that usually solves it.

Moat: operational convenience, which erodes as competitors ship the same. Likely path: an enterprise control-plane tier, or absorption by a sandbox vendor. Position: self-host it, and let somebody else fund the cloud.

This is closer to something I can operate than most of the open projects I see. One deployment serves everyone, so provisioning is central rather than sixty laptops, and unattended execution means jobs can be scheduled and attributed instead of run by whoever remembered. Output arriving in chat is not a gimmick; it is where review already happens.

What I do not have is a written answer on retention, identity federation or a support commitment. Approved with conditions: our own infrastructure, our own model account, and a named internal owner before anyone outside the platform team touches it.

The configuration surface is a file I can keep in dotfiles, and the fields I care about are all in it. MCP servers are declared per agent rather than globally, which means an agent's tool reach is something I version rather than something I remember. Ollama is named as a provider, so a run can happen entirely on my own hardware with nothing leaving the box.

Permissive licence and a readable stack mean a fork is real. This is one of the few harnesses here I would actually put on my own server.