Synced from Hive. This page is pulled from hivecommons/hive@v5 during the docs build. Edit the canonical source in the Hive repository.
Hive landscape and positioning
Last reviewed: 2026-11-02 (focused update: gh-aw GA, Entire, Devin and five engine releases)
Baseline conducted: 2026-10-23; focused update: 2026-11-02. This document will rot. Tools for AI coding agents change fast. Treat every product detail here as time-sensitive and update it by pull request when public docs change.
Hive helps an operator run a group of coding and review agents. For example, the operator can check costs, pause a worker, review its proposed fix, and decide which checks must pass before it merges. This live management layer is the operations plane. A fleet is the group being managed; a hub registers and observes running hives (spokes).
Each comparison below names the public page checked. Sections outside the focused update retain their earlier observation dates; this is not a fresh audit of every vendor. This is evaluation reference, not a setup guide.
Choose a starting point
- For one bounded job in a repository already using GitHub Actions, a workflow-based tool may be simpler.
- For a vendor-run agent with little infrastructure to operate, consider a hosted service.
- For ongoing workers, shared budgets, varied agent backends, and operator-controlled permissions, consider Hive. Start with hosted or self-hosted access.
- Use When to choose what for the full decision list, then read the comparisons you need.
Terms used in the comparisons
Control plane means the component that configures and coordinates work. A harness launches and supervises an agent; a sandbox limits its access. OIDC is OpenID Connect, used here to prove a workflow’s identity without a stored long-lived secret. A shim workflow is a small workflow that calls another one. Queue-depth cadence changes run frequency with the amount of pending work. Forge-neutral adapters translate common operations for different code hosts; an adapter alone does not mean a full deployment is supported on that host.
Agentic AI Foundation (AAIF) and Goose
The Linux Foundation’s Agentic AI Foundation hosts Goose, first built at Block. Goose’s README now describes it as a general-purpose agent (desktop app, CLI and API) that works with 15 or more model providers. Goose runs tasks; Hive sits above it and dispatches work to Goose at fleet scale. Hive is an independent CNCF project. It is not an AAIF member, is not governed by AAIF, and claims no AAIF endorsement.
Review material: OpenSSF Best Practices badge, Apache-2.0 license, security self-assessment and CNCF reference architecture.
Contribution-process history: why the unattended Goose guide is local
The unattended Goose guide lives here for now. Goose’s contribution workflow still requires a human-written Ready issue before any outside docs PR. None is open, so the guide is not upstream.
Fullsend
Checked: fullsend.sh, README, architecture, roadmap, runtimes, intent representation.
Fullsend is the closest open-source comparison. Its README describes
autonomous software development for GitHub, GitLab and Forgejo, “secure by
design”. Each target repo carries a .fullsend/ folder. On GitHub a thin
shim workflow calls one upstream reusable workflow, which mints short-lived
GitHub App tokens through OIDC (identity proof without stored secrets). Its
stack is dispatch, infrastructure, sandbox, harness and runtime, with one
sandbox per agent role.
Changed since August: per-org install was removed; GitLab uses a webhook fast
path plus a cron poller; the runtime table lists claude (default) with pi
and codex opt-in; Jira intake is a “Now” roadmap theme. Fullsend still
publishes many ADRs (short design decision records). Its tiered-intent idea
shaped #2812.
Where Hive differs
| Dimension | Fullsend | Hive |
|---|---|---|
| Control plane | Repo-centered install; GitHub Actions or GitLab CI runs each stage. | A live fleet plane: governor modes, dashboard, terminal access, budgets, hub/spoke heartbeats, contributor compute. |
| Execution model | Short runs, one sandbox per agent role; Claude Code by default, pi and codex opt-in. | Long-lived agents in tmux; backends include Claude, Copilot, Codex, Antigravity, Goose and OpenAI-compatible gateways. |
| Autonomy model | Tiered intent and shadow/autonomous concepts in its problem docs. | ACMM (AI Codebase Maturity Model) L1–L6 maps repo maturity to per-agent modes and merge rights. |
| Security | Sandbox, harness, scanner and OIDC token minting are first-class. | Layered controls: tool denial, scoped tokens, per-user attribution, and a proxy that checks every GitHub write on the network. See security model and self-assessment. |
| Fleet topology | Per-repo install. | Hub/spoke registry, callbacks, leaderboard, provisioning paths, contributor relay. |
Fullsend is lighter for one repo or org where Actions is already trusted. Hive fits when operators need live fleet visibility, many runtimes, graduated autonomy, hub-managed spokes, contributor compute, or network-level checks.
OpenAI Symphony
Checked: openai/symphony at
be10a1b
(README,
SPEC.md).
main has not moved since 2026-09-15. Symphony is Apache-2.0; its Elixir
build is an “engineering preview for trusted environments”. The demo watches
Linear, runs isolated agents and shows proof of work before a PR lands. Those
extras are not required by the spec. Hive borrows the idea of managing
work rather than watching every coding turn. Hive does not implement
Symphony’s WORKFLOW.md or Codex app-server contracts.
| Dimension | Symphony | Hive |
|---|---|---|
| Work source | Linear in the demo; the spec defines a tracker-neutral adapter. | Trackers: GitHub Issues, GitHub Projects, Linear and Jira. Forge: GitHub; GitLab and Gitea/Forgejo adapters are not yet end-to-end (see Work sources below). |
| Pre-agent gating | Config preflight, state checks, labels, claims and concurrency limits. | Shell-level listing, classification and merge checks before any kick, plus ACMM and proxy write checks. |
| Agents | Codex app-server is the runner protocol. | Many CLI backends; isolation depends on backend and deployment. |
| Scale model | One workspace per issue, bounded runs, retry. | Queue-depth cadence, long-lived agents, hub/spoke, convergence audits. |
| Packaging | Draft spec plus Elixir preview. | Go runtime, Compose/Quadlet deploy, dashboard, contributor relay. |
See the alignment review, work sources and the provider contract.
GitHub Agentic Workflows (gh-aw)
Checked: github/gh-aw, docs, githubnext/agentics.
Updated 2026-11-02: GitHub announced general availability on 2026-10-28 on github.com for Free, Team and Enterprise. Its default Copilot CLI engine requires a Copilot license. This is the Markdown-to-Actions product, not the separate Agent HQ or Copilot parallel-agent announcements.
gh-aw compiles Markdown plus YAML frontmatter into a normal GitHub Actions
workflow: an Actions-native on-ramp, not a fleet scheduler. Since August its
engine list added Pi alongside Copilot, Claude Code, Codex and Gemini.
Agent jobs are read-only and sandboxed by default; writes go through
safe-outputs jobs with scoped permissions.
| Dimension | gh-aw | Hive |
|---|---|---|
| Execution | Event, dispatch and scheduled Actions runs | Long-running fleet with queue-depth cadence |
| Authoring | Markdown prompt plus frontmatter | Project config, fixed pipeline, agent policies |
| Policy | Read-only agent, integrity filter, firewall, threat detection and permission-scoped safe outputs | Fixed filtering before judgment, proxy write checks, gated merge rights after |
| Operations | Per-workflow logs and artifacts | Live dashboard, budgets, hub/spoke, contributor compute |
| Best start | A repo on Actions that wants bounded agent jobs | Operators running continuous work across repos |
Hive’s gh-aw sample is a manually run, report-only issue triage with no merge rights. Keep existing gh-aw workflows when adopting Hive. Hive dispatching gh-aw as an external host is not implemented; see backend support tiers.
Focused comparison: maintenance, forge and managed agents
Checked 2026-11-02 against the first-party sources below. Documented
means the vendor says it works, not that Hive tested it. Unknown
means we did not verify it. It does not mean the vendor lacks it.
Hive’s source baseline is v5
ddf4a56fc1a66f379b97f9fa64c834fd7896a034,
committed 2026-11-02. We did not check v6 or prove the same behavior in live fleets.
| Actual job | Hive at that baseline | GitHub Agentic Workflows GA | Entire / Devin, documented as checked |
|---|---|---|---|
| Execute tasks and maintain repositories | Standing governor and role-based fleet; operator owns deployment and policy (architecture) | Event/scheduled Actions jobs can perform ongoing triage, CI analysis, docs and tests; not just one-off coding (GA) | Devin: event/schedule automations can start or message sessions and run persistent triage; not merely a single worker (automations). Entire: a forge hosting agent-human work, not evidence of a Hive-like maintenance scheduler (launch). |
| Admit work and enforce writes | ACMM modes and GitHub proxy controls; enforcement depends on lane/config; shadow evaluation is not a blocking gate (policy comparison) | Read-only agent by default, integrity filtering, sandbox/firewall, threat detection, then separate permission-controlled jobs (GA, safe outputs) | Devin: mandatory security profiles intersect network/MCP/git restrictions and can remove the gh token. Running sessions pick up profile changes at next wake, not immediately (profiles). Entire: launch describes evals, not an equivalent out-of-agent write-policy contract. |
| Review and merge authority | CI, holds and configured review gates; L6 eligibility is not unconditional merge permission (policy) | Safe outputs can merge PRs when configured; applicable policy gates still matter (safe outputs). Do not describe gh-aw as having no merge authority. | Entire: Trails evaluate each push, expose findings through CLI/web and let developers merge when evals are satisfied (launch). Devin: review comments/approvals and optional beta Autoapprover; availability varies. This is not proof of Hive-equivalent merge policy (review). |
| Orchestrate many agents | Live hub/spoke fleet, budgets, operator controls (architecture) | Actions runners/policies and per-workflow engine/model routing; cross-repo isolation is documented (GA) | Devin: deterministic Python Dynamic Workflows fan out sessions, record calls and resume; enterprise admin enablement required (workflows). Entire: Trails/CI integration are not evidence of a fleet scheduler. |
| Preserve provenance and measure outcomes | Review/merge evidence and scoped observational outcomes; no cross-vendor causal benchmark (evidence, October outcomes) | Actions artifacts/logs and validated output jobs; Accenture figures in GA announcement are a customer account, not a controlled Hive comparison (GA) | Entire: Trails preserve intent/trace/outcome; Continuous Memory syncs sessions into Git, with graph/brain components. Speed/token savings are vendor claims, not reproduced here (launch). Devin: test recordings and workflow call history are documented evidence, not directly comparable outcome rates (testing, workflows). |
| Source and forge scope | Apache-2.0 source; GitHub operational path, GitLab and Gitea/Forgejo adapters with substantial end-to-end gaps (license, forge contract, limits) | Open-source project running on GitHub Actions; GA announcement establishes github.com availability, not general forge portability (GA) | Entire: independent Git-compatible private-repo hosting; launch lists public repositories and self-hosted Git nodes as upcoming, not delivered (launch). Devin: documented GitHub, GitLab, Bitbucket and Azure DevOps integrations; this is broader documented forge coverage than Hive’s complete operation today, not tested parity (integrations). |
Entire’s 2026-10-26 launch is a first-party source for Trails, Continuous Memory and Buildkite/Depot CI. Its open-source CLI/graph/brain components do not make the hosted forge an open-source Hive replacement. Support for Git alone does not prove that Hive can use Trails.
Devin’s own docs show that its policy and fleet tools overlap with Hive. The weekly report’s specific 2026-10-30 Cognition enterprise-governance announcement remains unconfirmed here. Live docs with no date show what the vendor says now. They do not prove when it shipped. A guessed URL returning 404 does not prove that a launch claim is false.
Forge correction and existing decision
Neither “Hive is GitHub-only” without qualification nor “Hive supports all
three forges end-to-end” is right. The existing
Forge interface and NewForge factory already select GitHub,
GitLab and Gitea/Forgejo. However,
main_eval_cycle.go and
repos_rescan.go still call ghClient.EnumerateActionable.
Some writes use the adapter. Gaps remain in how Hive finds work, runs agents,
merges code and checks traffic (full list).
We found no proof of a live non-GitHub Hive.
Do not redesign the interface. ADR-0005, #6170 and the roadmap sequencing decision already cover it. The September 9 decision under #6177/#6167 put the work to split out listing policy after the GA cut. Earlier work was allowed only if it would not reset the required-gate soak (the period used to prove that checks stay green). A closed design issue does not prove full support. Revisit that choice with a real user’s need and proof that the full path works. This page does not reverse it.
Five report releases: integration compatibility
Method: read published, non-draft release notes and the source contracts linked below. Read Hive’s launch code, config, tests and CI steps. No vendor binary, authenticated task, launcher smoke, build or local test suite was executed for this assessment. These are source-contract results, not proof that the tools ran well together. Release dates say when a release was published. Linked source versions have their own commit dates.
| Report release (published, 2026) | Hive contract and source result | Action / remaining uncertainty |
|---|---|---|
| OpenHands v1.34.0 — Oct 27 | Tagged manifest (source Oct 27) is @openhands/agent-canvas, binary agent-canvas. Hive’s experimental contract is the separate legacy openhands CLI, previously checked at CLI 1.16.0, using --always-approve --override-with-envs; its support page says headless-only. | Different surface; not a CLI upgrade instruction. No demonstrated launcher break attributable to this release. Retain T3; Canvas Docker/runtime features do not confer confinement on Hive’s legacy CLI. That CLI’s continued viability needs separate evidence before promotion. |
| Claude Code v2.1.316 — Oct 31 | Hive already pins 2.1.316 in main image and contributor image. Launcher uses --model, unattended permissions and write/host deny flags. Notes fix process cleanup and claude -p reporting; they do not establish removal of those launch flags. | No release-note break identified; already pinned. Do not bump again. Permission honoring, readiness and output behavior still require executed CI smoke evidence; an existing pin is not a passing smoke result. |
| Goose v1.57.0 — Oct 28 | Already pinned in both images above. Hive emits goose run -s [--model …] (launcher); tagged CLI source (source Oct 27) retains run input, model override and -s interactive behavior. Release’s supplied-session-ID and ACP changes do not demonstrate removal of that path. | Inspected launch contract retained. No version change. Resume/log extraction is a separate seam, previously verified against 1.52.0 (Hive resume contract); 1.57.0 resume and confinement were not smoke-tested here. T1 pod credentials do not imply local sandboxing. |
| OpenCode v2.2.5 — Oct 30 | Hive’s shell contract uses --auto and local OPENCODE_PERMISSION host-state denials. Tagged run handler (source Oct 30) still passes model and auto/yolo settings into execution. Notes describe bash → shell tool-name handling with the same permissions. | Inspected model/auto seam retained; denial semantics unverified. Check existing local-posture tests and a credential-free permission fixture before promoting a new pin; do not infer that a tool alias bypasses denials or that deny-listing is an OS sandbox. |
Cline SDK sdk/sdk/v0.2.0 — Oct 26 | No cline in Hive’s 15 CLI backend identities. Notes change session reattachment, capability routing and SDK packaging; none is an implemented Hive SDK contract. | Not an integrated engine; no current launcher to break. No automatic SDK adoption. Any future integration must satisfy the existing backend acceptance bar or external-host admission contract, including credentials, cancellation and evidence. |
Existing guards include launch-command fixtures, backend list parity and contributor-local posture tests. The scheduled live backend smoke currently covers Claude/Codex, not these five releases as a group. Its pinned and latest lanes must not be conflated. This review did not retrieve a version-bound passing run for any of the five; doc-PR CI is not evidence that vendor CLI tasks succeeded. No release-specific launcher defect was established, so this update makes no engine, dependency, configuration or pin changes.
Ranked decisions: keep, integrate, defer, drop
These are suggested next steps as of 2026-11-02. They are not measured returns on investment or approved roadmap changes.
- Keep the governed maintenance plane; drop the “single-worker competitors” claim. The docs fix is cheap. It helps teams choose without claiming that gh-aw/Devin lack ongoing jobs or policy. Use the jobs table above and existing ACMM policy, not a claimed universal quality/cost advantage.
- Integrate with existing gh-aw jobs rather than replace them. Lowest-risk entry is the report-only sample. Broader dispatch stays behind the existing external-workflow admission design and acceptance bar: checked receipts, a way to cancel, and refusal of stages that can write. Benefit: reuse Actions work; cost: real checks on who may run what, not a CLI name added to a list. No dispatch adapter is shipped by this doc.
- Revisit the forge plan only for a real user’s need. Reuse #6167 and the recorded decision. Benefit: work on more forges; high cost: listing/filter rules, write/merge/proxy/auth paths and proof in a live hive. Entire makes forge choice and traces worth a look. It is not a reason to implement a fourth adapter before the existing three work end-to-end.
- Keep evidence tied to heads, populations and provenance. Reuse evidence and outcomes; check whether Trail-style intent and session context help reviewers before bringing in outside transcripts. First review what data to store and for how long. No vendor benchmark was reproduced. Hive’s historical estimated cost per merge is not a current rate for all users or a fair vendor score. Trials and transcript links cost time to build and review. This docs update does not promise them.
- Drop speculative release churn and SDK parity work. Keep current tiers and use the five-release assessment above. Benefit: avoid mistaking app/SDK releases for launcher contracts; cost: unresolved seams still need targeted CI evidence before a future pin or support promotion.
Licensing and maintenance: Hive’s Apache-2.0 source license
does not license vendor models, binaries or hosted services. Check the exact
component/version license and service terms before redistribution; GitHub API
license: null/NOASSERTION is not a product-license determination. Crux is
maintained under src/crux here, not by changing the generated standalone
repository (sync marker, source revision 2026-11-02).
Backend-list membership is not a support/service guarantee.
When updating this section, record the observation date, release publication
date, immutable source revision and whether evidence is documented, tested or
unknown; recheck it before procurement or a roadmap decision.
New since August 2026
Verified 2026-10-23; all were missing from this page. “Backend” means Hive could drive it; “orchestrator” means it competes with Hive’s control plane.
GitHub Agent HQ (announced 2025-10-28, rolling out since) adds a “mission control” to assign and track agents from Anthropic, OpenAI, Google, Cognition and xAI inside a paid Copilot plan. Orchestrator, GitHub-only, hosted. Copilot stays a Hive backend.
Claude Managed Agents (2026-04-08, public beta) is Anthropic’s hosted harness: state, permissions, scheduled runs, and self-hosted sandboxes, billed per session-hour. Backend or hosting layer, not a work-source orchestrator.
OpenAI Agents API runs persistent agents on OpenAI infrastructure with the Codex harness. Backend or hosting layer; Codex CLI remains a Hive backend.
Jules Action triggers Google’s Jules cloud agent from GitHub events. Per-repo orchestrator on Actions, like gh-aw; Jules itself is a possible backend.
Omnigent (Apache-2.0) is an open-source “meta-harness” over Claude Code, Codex, Cursor, Pi and others with policy and sandboxing. Registered as a T3 experimental CLI backend (#14094); Omnigent’s own policies and sandboxing are additive, with Hive’s egress proxy deciding all GitHub writes.
Zeron (MIT) is a local-first control plane for coding agents. Orchestrator for one developer or VPS; no work-source adapters.
| Dimension | Agent HQ | Managed Agents / Agents API | Omnigent, Zeron |
|---|---|---|---|
| Control plane | Hosted mission control in GitHub | Hosted agent runtime, no tracker | Local or VPS app |
| Work source | GitHub issues and PRs | None built in | Chat and terminal sessions |
| Policy | Enterprise controls, agentic review | Scoped permissions, vaults | Omnigent policies; Zeron local |
| Isolation | Vendor-run | Managed or self-hosted sandbox | Omnigent sandboxing; Zeron none stated |
| Role for Hive | Competitor; Copilot backend | Backend / hosting | Backend (T3) / competitor |
Agent isolation
By default Hive agents share one container, separated by Unix user. An opt-in sandbox mode runs each task in its own rootless Podman container or Kubernetes Job with no credentials at all; pushes go through a broker. See sandbox isolation and the security model.
The project is evaluating stronger isolation runtimes. One candidate is NVIDIA OpenShell (Apache-2.0), a “safe, private runtime for fleets of autonomous AI agents” with kernel-level file, syscall and network policy per sandbox. AAIF’s OpenSandbox is another. ADR-0026 (Proposed) compares both against the sandbox contract and recommends OpenShell, pending a prototype on a hive spoke. No integration exists today.
| Project | Isolation unit | Checked |
|---|---|---|
| Hive (default) | Shared container, per-user separation | this repo |
| Hive (opt-in) | Rootless container or K8s Job per task, no credentials | sandbox-isolation.md |
| Fullsend | One sandbox per agent role, policy in .fullsend/ | architecture |
| gh-aw | Actions runner, read-only by default | README |
| Symphony | Workspace per issue; not a sandbox by itself | SPEC.md |
| OpenShell | Kernel-enforced sandbox with policy gateway | README |
| OpenSandbox (AAIF) | Sandbox API over Docker or Kubernetes; Firecracker micro-VMs | README |
Work sources
Hive is work-source agnostic. The governor reads GitHub Issues, GitHub Projects, Linear or Jira through one provider contract; Hive Commons itself runs on it. Symphony is Linear-first; Fullsend, gh-aw and Agent HQ are forge-first. Hive states this as a differentiator: the same fleet, policy and dashboard apply whichever tracker holds the work.
That claim covers trackers, not forges. Complete Hive operation still
requires GitHub.com or GitHub Enterprise. Hive has GitLab and Gitea/Forgejo adapters
(project.forge) that read, comment, label and hold, and GitLab’s can merge,
but the governor, merge gate and agent gh path are not yet forge-neutral
(#14096). Fullsend
already ships GitHub, GitLab and Forgejo. See Forges.
The integrations page lists every tracker, forge and backend
with its status.
Related projects and vendors
GitHub Copilot coding agent hands one issue to one hosted agent inside GitHub; it is now one of the agents under Agent HQ. Devin also documents ongoing automations, multi-session orchestration and mandatory security profiles; see the focused comparison. SWE-agent and research harnesses target benchmarks and repair loops. Choose on deployment ownership, integration contracts and enforcement needs, not an assumption that hosted services lack fleets or explicit policy.
When to choose what
- gh-aw or Jules Action: bounded agent jobs in a repo already on Actions, no standing fleet.
- Agent HQ / Copilot coding agent: the quickest hosted path for GitHub issues with no separate policy plane.
- Symphony: spec-first
WORKFLOW.md, Codex app-server, one workspace per ticket. - Fullsend: a few repos, CI as the substrate, repo-visible
.fullsend/config. - Hosted services (Devin-class, Managed Agents): vendor-run autonomy over self-hosted control.
- Research harnesses: evaluation and one-off repair, not operations.
- Hive: operating a live agent fleet across any work source, with many runtimes, ACMM gates, fixed merge policy, hub/spoke provisioning, contributor compute, cost visibility and proxy-level write checks. See integrations.md for what Hive works with today.
Hive claims checked against this repo
- Fleet operations plane: architecture, dashboard.
- Multi-runtime: architecture, agent configuration.
- ACMM: architecture, ACMM matrix.
- Hub/spoke and contributor compute: architecture, manual provisioning.
- Proxy write checks: architecture, ADR-0002.
- Work sources: work-sources.md.
- Isolation: sandbox-isolation.md, security model.