research/durable-agent-runtime/analysis.md

Analysis — Durable Agent Runtime

Part of durable-agent-runtime/index Harness/loop analysis moved to harness-engineering/index (2026-08-11).

The three primitive families

Family	Example	Compute primitive	Where state lives	Cold start	Hibernation
Durable objects	celld (Deno)	V8 isolate running Worker bundles	Per-object SQLite, replicated to S3	Fast (isolate)	Idle cells hibernate
Actors	rivet	Lightweight process (Node/Bun/Deno)	In-memory + SQLite/BYO DB	~20ms	Actors hibernate when idle
VM sandboxes	hypeman, E2B	Firecracker/Cloud Hypervisor/QEMU microVM	VM disk (snapshot for standby)	~30s VM / sub-30ms from snapshot	standby = snapshot to disk
Collaborative substrate	Radicle COBs	Signed, CRDT-like Git commit DAGs	Git objects (replicated, self-certifying)	Instant (local git)	Repos persist; nodes sync on demand

(Harness libraries — nanocodex, Codex, pi — moved to harness-engineering/index.)

The industry convergence: compute is disposable, state is durable elsewhere.

• Amp orbs: ephemeral E2B sandbox + durable thread on Amp Server (PostgreSQL). Sandbox destroyed on archive; conversation survives.
• celld: nodes are replaceable; the S3 bucket is the durable source of truth. Object = its own SQLite DB → sharding and blast-radius containment by construction, no consensus.
• rivet: actor state in-memory for 0ms reads, persisted for durability; runs indefinitely, sleeps when idle.
• hypeman: standby = snapshot VM to disk, restore in milliseconds — VM-level hibernation.

The two hard problems everyone solves

1. Cold start latency — the gap between "VM ~30s" and "actor ~20ms" is closed with snapshots (E2B, hypeman standby, celld/rivet hibernation) or pre-provisioned pools. This is why orbs can feel local despite being remote.
2. State checkpointing & recovery — thread JSONL (Amp), SQLite replication (celld), actor state persistence (rivet), VM disk snapshots (hypeman). Everything is replayable; nothing is lost on compute failure.

What this means for hermes-vm (our stack)

Already have (the "durable compute host" layer):

• Persistent remote dev VM (hermes-vm), systemd services, kanban DB, session DBs, herdr panes, tailscale.
• herdr = the "shared tmux + durable agent loop" half of an orb, already built.

Genuine gaps (the "environment contract" layer):

• Per-repo .agents/setup-style bootstrap + AGENTS.md per repo — cheap, ~90% of the reliability win.
• Idempotent dev-server script + ports metadata file + /__dev-style auth bypass for our apps.
• Event-driven wake: Forgejo webhooks → kanban task (self-hosted equivalent of Amp's event-driven orbs).
• Formalize tailscale serve as per-repo portals.

Not worth building on a single box:

• A distributed durable-object layer (celld) or actor platform (rivet) — solves multi-node, multi-region, scale-to-zero billing problems we don't have. One VM = one durable host.
• An E2B-style per-thread VM fleet — same reason. NixOS already gives cheaper isolation: nix develop, rootless podman (already enabled via modules/dev/containers.nix), worktrees, NixOS containers/systemd-nspawn if stronger isolation is ever needed.

Interesting but optional:

• hypeman — if we ever want real per-task VM isolation with snapshot/standby on our own box, hypeman is the lean OSS option (multi-hypervisor, OCI images, ms restore). Watch it; don't adopt yet.

Verdict

Build the environment contracts (setup hooks, AGENTS.md, dev-server skills, event wake) on the existing durable host. Do not build the sandbox platform or a distributed state layer. herdr + systemd + kanban + tailscale already provide the durability; the missing piece is making the environment "assume an agent and tell it where the light switches are."