Warren

The deciding trait is the spend cap that holds while the work is happening, not a report you read afterwards. Anyone who has left an agent running on a hard problem knows the specific feeling of checking a dashboard the next morning, and a limit enforced during execution is the only thing that removes it.

What you are taking on is a service to operate rather than an application to open, so somebody has to own it. Pick it when runs matter enough to bound. Pick Sandbox Agent for a thinner layer.

Read the recovery features as a defect list, because that is how they were written. Processes go missing. Containers disappear while a run is mid-flight. Teardown arrives before the useful output has been captured. Every one of those has happened enough times to justify a component, and the components mitigate rather than prevent, so the underlying instability is still there.

What it does right is naming them in public. Most projects handle this quietly and let users discover the gap during their own incident.

1. Defining completion as a git reference is the most disciplined choice on this row. A branch exists or it does not, it can be diffed, and it survives the system that produced it, whereas a conversation log requires interpretation to decide whether anything was accomplished. 2. Layering the optional integrations above that guarantee keeps the core contract small enough to reason about when one of them fails.

2. No evaluation is published, which is consistent with a claim about mechanism rather than capability.

Hosted infrastructure offered free by an individual is a cost that grows with adoption and a liability that grows faster. Either it converts into a product with a price, or it gets throttled and eventually withdrawn, and both endings arrive without notice because nobody signed anything.

Moat: none yet; the self-hosted path is the durable one and the hosted instance is the demo. Likely path: a commercial tier around the managed version, or a return to source-only. Position: run your own from the start, and treat the public endpoint as a preview.

Per-run cost and token accounting held in a queryable store is the number I have been asking vendors for all year. It means agent spend stops being a line on a provider invoice and becomes something I can attribute to a team, a repository or a ticket, which is what makes a budget conversation possible at sixty engineers.

What is absent is authentication and authorisation: no directory integration and no user model, so access control is whatever we put in front. Approved with conditions: self-hosted, behind our own gateway, with the accounting exported to finance.

Three interfaces over one contract is the arrangement I want, because it means the graphical layer is a convenience rather than a gatekeeper. Whatever the buttons do, my shell can do, and that is the difference between a product I use and one I can automate around at three in the morning.

Running it on my own hardware keeps the harness credentials and the repository local, and the permissive licence means a fork stays viable. No MCP anywhere, which for a workload runner I mind less than usual.