Before building ai-coworkers I surveyed the agent runtimes people are running today, looking for one that could hold a job rather than answer a chat. The candidates:
- OpenClaw, the gateway-first personal assistant
- NanoClaw, its 500-line container-isolated answer
- Hermes, Nous Research’s memory-first assistant
- ElizaOS, the providers-actions-evaluators framework
- Vercel Eve, agents as directories
- Block’s Buzz, a workspace where agents are teammates
All six get something right, and none of them is a coworker.
What I mean by coworker
A coworker is not a smarter chatbot. The test I kept applying:
- Do they own a defined slice of work, with responsibilities written down?
- Are there hard limits on what they may touch, enforced somewhere the model cannot talk its way past?
- Can they notice work themselves, without being messaged?
- Do they know the difference between “decide alone” and “ask a human”?
- Can they sit through a quiet afternoon without inventing work or burning tokens?
A person in a job does all five without thinking about it. That last one matters more than it looks: a process that runs all day is idle most of the day, and an agent that treats every tick as an invitation to act is a liability.
OpenClaw: the gateway
OpenClaw is built around channels. It connects an assistant to WhatsApp, Telegram, Slack, and whatever else you live in, and its ClawHub skill registry has more community integrations than anything else in the space. Multi-agent support gives each agent its own channel identity and persona.
Persona is the tell. An OpenClaw agent has a personality, not a role. There is no document that says what it owns, no runtime check on what it may touch, and its default mode is reactive: it acts when a message arrives. The security incidents that pushed people towards NanoClaw came from exactly that shape, a capable assistant with broad access and no boundary layer.
NanoClaw: isolation as the boundary
NanoClaw strips the idea down to roughly 500 lines on the Claude Agent SDK and puts each agent in its own container. That is a real boundary, and it is enforced in the right place, outside the model.
But a container boundary is the wrong granularity for a job. “This process cannot see that filesystem” does not express “you may label tickets in team ILO but must never touch team CS, because that is client data.” Role boundaries are about which actions are yours to take in shared systems, and a container cannot see the difference between two Linear teams behind the same API token.
Hermes: memory without a role
Hermes is built around a learning loop: it stores sessions in SQLite, searches them with FTS5, distils skills from experience, and builds a persistent model of the user. Of everything I surveyed it has the strongest answer to “what did we learn last month?”, and its skills format is one ai-coworkers deliberately reuses.
It is still single-agent and chat-native. Memory tells the agent what happened, and nothing tells it what its job is, so there is nothing to stop a helpful, well-informed assistant from acting outside a lane nobody drew.
ElizaOS: the right loop, aimed at chat
ElizaOS got the internal shape right early: providers assemble context, actions do things, evaluators reflect afterwards. That triple is a clean decomposition and ai-coworkers’ sense-deliberate-act loop is a descendant of it.
The framing around the loop is a character. Character files define voice and personality for agents that live in Discord, X, and Telegram. The loop fires on conversation rather than on a schedule, so an ElizaOS agent has no independent relationship with its own backlog. A character defines how the agent sounds. Nothing defines what it owns.
Eve: the right definition format
Eve treats an agent as a directory of files, instructions, tools, and subagents laid out on a filesystem you can read at a glance. Vercel runs over 100 internal agents on it, so the format is proven at fleet scale. Of the six, this is the piece I lifted most directly.
Two gaps. The runtime under the directory is Vercel’s hosted platform, so you cannot run the fleet on a box you own. And the directory defines capability, not authority: there is a place to say what the agent can do, and no place to say what it must not do, or when it should stop and ask a person.
Buzz: the workspace without the worker
Buzz, launched by Block in July, is the inverse of the others. It does not define agent behaviour at all. It gives agents cryptographic identity in a shared workspace, every action signed and chained, humans and agents as peers in the same channels, with the actual agent brought along via the Agent Client Protocol.
That accountability layer is something coworkers need too, and its agents-as-members framing is the closest thing to my thesis in the wild. But Buzz assumes the coworker already exists somewhere. Plug a chat-native assistant into Buzz and you have a chat-native assistant with a keypair.
The common gap
Line the six up and the missing piece is the same everywhere:
- Nobody models responsibilities. Every framework has personas, characters, or instructions. None has a place to write down what the agent owns and where that ends.
- Nobody enforces boundaries at the action level. Prompts ask nicely and containers are too coarse.
- Nobody escalates. There is no first-class “I am not sure this is mine, asking a human and waiting” in any of them.
- Nobody decides not to act. Every one of these frameworks activates on input. The judgement that a tick contains nothing worth doing, at zero token cost, does not exist.
That gap is the design brief for ai-coworkers. The next post covers what I took from each of these six and what had to be built new.