Conducted: 2026-10-23. This document will rot. Tools for AI coding agents change fast. Treat every product detail here as time-sensitive and update it by pull request when public docs change.
Hive is an operations plane for fleets of AI agents. One operator-controlled system runs many coding and review agents, applies fixed rules before and after the model's judgment, and shows status, cost and hub/spoke health on one dashboard. Each claim below names the public page checked on the date above.
The Linux Foundation's Agentic AI Foundation hosts Goose, first built at Block. Goose's README now describes it as a general-purpose agent (desktop app, CLI and API) that works with 15 or more model providers. Goose runs tasks; Hive sits above it and dispatches work to Goose at fleet scale. Hive is an independent CNCF project. It is not an AAIF member, is not governed by AAIF, and claims no AAIF endorsement.
Review material: OpenSSF Best Practices badge, Apache-2.0 license, security self-assessment and CNCF reference architecture.
The unattended Goose guide lives here for now. Goose's contribution workflow still requires a human-written Ready issue before any outside docs PR. None is open, so the guide is not upstream.
Checked: fullsend.sh, README, architecture, roadmap, runtimes, intent representation.
Fullsend is the closest open-source comparison. Its README describes
autonomous software development for GitHub, GitLab and Forgejo, "secure by
design". Each target repo carries a .fullsend/ folder. On GitHub a thin
shim workflow calls one upstream reusable workflow, which mints short-lived
GitHub App tokens through OIDC (identity proof without stored secrets). Its
stack is dispatch, infrastructure, sandbox, harness and runtime, with one
sandbox per agent role.
Changed since August: per-org install was removed; GitLab uses a webhook fast
path plus a cron poller; the runtime table lists claude (default) with pi
and codex opt-in; Jira intake is a "Now" roadmap theme. Fullsend still
publishes many ADRs (short design decision records). Its tiered-intent idea
shaped #2812.
| Dimension | Fullsend | Hive |
|---|---|---|
| Control plane | Repo-centered install; GitHub Actions or GitLab CI runs each stage. | A live fleet plane: governor modes, dashboard, terminal access, budgets, hub/spoke heartbeats, contributor compute. |
| Execution model | Short runs, one sandbox per agent role; Claude Code by default, pi and codex opt-in. |
Long-lived agents in tmux; backends include Claude, Copilot, Codex, Antigravity, Goose and OpenAI-compatible gateways. |
| Autonomy model | Tiered intent and shadow/autonomous concepts in its problem docs. | ACMM (AI Codebase Maturity Model) L1–L6 maps repo maturity to per-agent modes and merge rights. |
| Security | Sandbox, harness, scanner and OIDC token minting are first-class. | Layered controls: tool denial, scoped tokens, per-user attribution, and a proxy that checks every GitHub write on the network. See security model and self-assessment. |
| Fleet topology | Per-repo install. | Hub/spoke registry, callbacks, leaderboard, provisioning paths, contributor relay. |
Fullsend is lighter for one repo or org where Actions is already trusted. Hive fits when operators need live fleet visibility, many runtimes, graduated autonomy, hub-managed spokes, contributor compute, or network-level checks.
Checked: openai/symphony at
be10a1b
(README,
SPEC.md).
main has not moved since 2026-09-15. Symphony is Apache-2.0; its Elixir
build is an "engineering preview for trusted environments". The demo watches
Linear, runs isolated agents and shows proof of work before a PR lands. Those
extras are not required by the spec. Hive borrows the idea of managing
work rather than watching every coding turn. Hive does not implement
Symphony's WORKFLOW.md or Codex app-server contracts.
| Dimension | Symphony | Hive |
|---|---|---|
| Work source | Linear in the demo; the spec defines a tracker-neutral adapter. | GitHub Issues, GitHub Projects, Linear and Jira (see Work sources below). |
| Pre-agent gating | Config preflight, state checks, labels, claims and concurrency limits. | Shell-level listing, classification and merge checks before any kick, plus ACMM and proxy write checks. |
| Agents | Codex app-server is the runner protocol. | Many CLI backends; isolation depends on backend and deployment. |
| Scale model | One workspace per issue, bounded runs, retry. | Queue-depth cadence, long-lived agents, hub/spoke, convergence audits. |
| Packaging | Draft spec plus Elixir preview. | Go runtime, Compose/Quadlet deploy, dashboard, contributor relay. |
See the alignment review, work sources and the provider contract.
Checked: github/gh-aw, docs, githubnext/agentics.
gh-aw compiles Markdown plus YAML frontmatter into a normal GitHub Actions
workflow: an Actions-native on-ramp, not a fleet scheduler. Since August its
engine list added Pi alongside Copilot, Claude Code, Codex and Gemini.
Agent jobs are read-only and sandboxed by default; writes go through
safe-outputs jobs with scoped permissions.
| Dimension | gh-aw | Hive |
|---|---|---|
| Execution | Event, dispatch and scheduled Actions runs | Long-running fleet with queue-depth cadence |
| Authoring | Markdown prompt plus frontmatter | Project config, fixed pipeline, agent policies |
| Policy | Engine judgment with declared tools and safe outputs | Fixed filtering before judgment, gated merge rights after |
| Operations | Per-workflow logs and artifacts | Live dashboard, budgets, hub/spoke, contributor compute |
| Best start | A repo on Actions that wants bounded agent jobs | Operators running continuous work across repos |
Hive's gh-aw sample is a manually run, report-only issue triage with no merge rights. Keep existing gh-aw workflows when adopting Hive. Hive dispatching gh-aw as an external host is not implemented; see backend support tiers.
Verified 2026-10-23; all were missing from this page. "Backend" means Hive could drive it; "orchestrator" means it competes with Hive's control plane.
GitHub Agent HQ (announced 2025-10-28, rolling out since) adds a "mission control" to assign and track agents from Anthropic, OpenAI, Google, Cognition and xAI inside a paid Copilot plan. Orchestrator, GitHub-only, hosted. Copilot stays a Hive backend.
Claude Managed Agents (2026-04-08, public beta) is Anthropic's hosted harness: state, permissions, scheduled runs, and self-hosted sandboxes, billed per session-hour. Backend or hosting layer, not a work-source orchestrator.
OpenAI Agents API runs persistent agents on OpenAI infrastructure with the Codex harness. Backend or hosting layer; Codex CLI remains a Hive backend.
Jules Action triggers Google's Jules cloud agent from GitHub events. Per-repo orchestrator on Actions, like gh-aw; Jules itself is a possible backend.
Omnigent (Apache-2.0) is an open-source "meta-harness" over Claude Code, Codex, Cursor, Pi and others with policy and sandboxing. Both: a competitor at single-team scale and a backend candidate.
Zeron (MIT) is a local-first control plane for coding agents. Orchestrator for one developer or VPS; no work-source adapters.
| Dimension | Agent HQ | Managed Agents / Agents API | Omnigent, Zeron |
|---|---|---|---|
| Control plane | Hosted mission control in GitHub | Hosted agent runtime, no tracker | Local or VPS app |
| Work source | GitHub issues and PRs | None built in | Chat and terminal sessions |
| Policy | Enterprise controls, agentic review | Scoped permissions, vaults | Omnigent policies; Zeron local |
| Isolation | Vendor-run | Managed or self-hosted sandbox | Omnigent sandboxing; Zeron none stated |
| Role for Hive | Competitor; Copilot backend | Backend / hosting | Both / competitor |
By default Hive agents share one container, separated by Unix user. An opt-in sandbox mode runs each task in its own rootless Podman container or Kubernetes Job with no credentials at all; pushes go through a broker. See sandbox isolation and the security model.
The project is evaluating stronger isolation runtimes. One candidate is NVIDIA OpenShell (Apache-2.0), a "safe, private runtime for fleets of autonomous AI agents" with kernel-level file, syscall and network policy per sandbox. AAIF's OpenSandbox is another. Nothing is decided and no integration exists today.
| Project | Isolation unit | Checked |
|---|---|---|
| Hive (default) | Shared container, per-user separation | this repo |
| Hive (opt-in) | Rootless container or K8s Job per task, no credentials | sandbox-isolation.md |
| Fullsend | One sandbox per agent role, policy in .fullsend/ |
architecture |
| gh-aw | Actions runner, read-only by default | README |
| Symphony | Workspace per issue; not a sandbox by itself | SPEC.md |
| OpenShell | Kernel-enforced sandbox with policy gateway | README |
| OpenSandbox (AAIF) | Sandbox API over Docker or Kubernetes; Firecracker micro-VMs | README |
Hive is work-source agnostic. The governor reads GitHub Issues, GitHub Projects, Linear or Jira through one provider contract; Hive Commons itself runs on it. Symphony is Linear-first; Fullsend, gh-aw and Agent HQ are forge-first. Hive states this as a differentiator: the same fleet, policy and dashboard apply whichever tracker holds the work.
GitHub Copilot coding agent hands one issue to one hosted agent inside GitHub; it is now one of the agents under Agent HQ (below). Devin-class hosted services sell a managed worker with a vendor UX for teams that do not want to run orchestration. SWE-agent and research harnesses are built for benchmarks and single-task repair loops. Hive differs from all three: open-source, self-hosted, fleet-scale, with explicit policy.
- gh-aw or Jules Action: bounded agent jobs in a repo already on Actions, no standing fleet.
- Agent HQ / Copilot coding agent: the quickest hosted path for GitHub issues with no separate policy plane.
- Symphony: spec-first
WORKFLOW.md, Codex app-server, one workspace per ticket. - Fullsend: a few repos, CI as the substrate, repo-visible
.fullsend/config. - Hosted services (Devin-class, Managed Agents): vendor-run autonomy over self-hosted control.
- Research harnesses: evaluation and one-off repair, not operations.
- Hive: operating a live agent fleet across any work source, with many runtimes, ACMM gates, fixed merge policy, hub/spoke provisioning, contributor compute, cost visibility and proxy-level write checks.
- Fleet operations plane: architecture, dashboard.
- Multi-runtime: architecture, agent configuration.
- ACMM: architecture, ACMM matrix.
- Hub/spoke and contributor compute: architecture, manual provisioning.
- Proxy write checks: architecture, ADR-0002.
- Work sources: work-sources.md.
- Isolation: sandbox-isolation.md, security model.