Shannon

The deciding trait is hard token budgets set per task and per agent. Not a warning, not a dashboard you check afterwards, a ceiling the run cannot cross. If you have ever discovered an agent's cost by reading an invoice, you will understand why that single feature outranks most of what this category advertises.

The price is setup: this is a stack you deploy, not a package you import. Pick it when agents already cost you money. Pick VoltAgent when you are still finding out whether they will.

The containment is genuine and it constrains what the agent can usefully do. WebAssembly execution cannot reach the host directly, so the class of task this safely covers is computation rather than operations, and anything touching real infrastructure has to leave that boundary through a path the documentation does not fully describe. The guarantee is precise; its coverage is not.

What it does right is degradation. Model fallback is automatic, so a provider outage produces a slower answer rather than a failed workflow.

1. This is the most defensible design decision on the board. Because the orchestration layer records and replays deterministically, a failed run can be re-executed to the exact step that went wrong, which is the property every other agent system substitutes logs for. 2. It also survives model changes, since the replay concerns control flow rather than generation.

2. No evaluation is published, and the architectural claim does not require one, because reproducibility is verifiable by using it.

The engineering here is more sophisticated than the commercial position, which is a familiar and slightly sad combination. Nothing is sold, so nothing funds maintenance beyond whatever the authors want to do, and a stack this ambitious carries real ongoing cost in dependency upgrades alone.

Moat: none commercially; the design is the reputation asset. Likely path: an acqui-hire of the authors by an orchestration or observability vendor, or a slow freeze. Position: deploy it with your eyes open, budget for maintaining it yourself, and treat every upstream release as a bonus rather than a plan.

Tenancy separation expressed as policy, rather than as a convention engineers are asked to respect, is what lets one deployment serve sixty developers across teams without me writing the separation myself. Approval steps for consequential actions are built in, so the control I would otherwise bolt on is already part of the workflow definition.

Licence cost is nothing and it executes unattended, so it can carry scheduled work with records attached. The gap is a supplier: support is a repository. Approved with conditions: my platform team owns the deployment and the upgrade path.

Three local serving options named explicitly is a serious commitment rather than a checkbox, and it means I can run this air-gapped with the models I already have on disk. MCP servers attach, so the tools I maintain come along. Permissive licence, so the fork is mine and stays mine.

The Rust enforcement layer is the part I would read first, because that is where the interesting decisions live and it is small enough to actually read. This is the rare project where the security design was not an afterthought bolted on for a launch post.