# Agent orchestration decision and benefit matrices (https://jackin.tailrocks.com/research/agents/orchestration/program-research/01-decision-and-benefit-matrices/) ## Summary [#summary] The strongest external ideas improve boundary visibility, fleet legibility, terminal automation, recovery, and operator control without weakening jackin❯ isolation or runtime neutrality. ## Question and scope [#question-and-scope] Which adjacent-tool ideas deserve adoption, adaptation, rejection, or postponement when evaluated against the dossier's values? ## Method [#method] This comparison applies the [jackin❯ evaluation values](/research/agents/orchestration/program-research/#jackin-values-used-for-evaluation) to public product capabilities at the dossier cutoff. ## Findings [#findings] | Tool | Strongest idea to borrow | Main reason not to copy it directly | | | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------- | | [`graemerocher/multicode`](https://github.com/graemerocher/multicode) | Parallel workspace table, GitHub status links, `multicode-remote`, skill-driven tags, Codex provider support, editor launcher, autonomous queue config, Apple-container experiments | Linux-first `bwrap`/`systemd-run` core; isolation is convenience, not a strong boundary; some Apple-container workflows still mount the host Docker socket | | | [`dredozubov/hazmat`](https://github.com/dredozubov/hazmat) | Session contract, tier decision flow, native macOS containment, strict integration rules, rollback/proof discipline | macOS-only; one hardcoded `agent` user; no smooth multi-agent fleet surface | | | [Docker Sandboxes](https://docs.docker.com/ai/sandboxes/security/) | MicroVM plus private Docker daemon, host-side network proxy, credential injection outside the VM, branch worktrees under `.sbx/` | Product is tied to Docker Desktop; not an extensible jackin❯ role ecosystem; credentials/network proxy are not available primitives in plain Docker | | | [`ogulcancelik/herdr`](https://github.com/ogulcancelik/herdr) | Two-stage done state (Done vs Idle), foreground-process ownership, semantic integration reports, visible-screen arbitration, workspace-level status roll-up, notification suppression when tab is focused, sound-escalation opt-in, and blocking `wait` semantics on the socket API | AGPL-3.0 (embedding conflicts with jackin❯ Apache 2.0 license); heuristics degrade when the observed terminal is `docker attach` rather than the agent process; no container isolation, mount model, or auth forwarding | See [Agent runtime status authority](/roadmap/agent-runtime-status/) | | [`kitlangton/cellshot`](https://github.com/kitlangton/cellshot), [asciinema](https://github.com/asciinema/asciinema), [Charmbracelet VHS](https://github.com/charmbracelet/vhs), and terminal test/record tools | Treat terminal sessions as observable, scriptable, replayable objects: structured cells, visible-text waits, input injection, `.cast`/JSONL traces, and text/JSON/SVG/PNG artifact bundles | Most tools own their own PTY daemon, browser terminal, or host process; jackin❯ should expose the existing Capsule PTY/session state instead of nesting another runtime. See [Terminal observation and automation](/research/agents/orchestration/terminal-observation/terminal-observation-automation/) | | | [`stablyai/orca`](https://github.com/stablyai/orca) | Worktree-per-task visual orchestration, diff-annotation-to-agent feedback loop, embedded Chromium per worktree (Design Mode), 30+ zero-config runtimes, WebGL multi-pane terminals, mobile companion | Host-native agents run as host user; no container boundary; isolated UX ideas are the borrow target, not the isolation model. See [Orca ADE research](/research/agents/orchestration/orca-ade/) | | | Claude/devcontainer patterns | Default-deny firewall and reproducible container setup | Devcontainers are workspace setup, not a multi-agent orchestrator or full operator platform | | | Conductor-style native worktrees | Low-friction host-native worktrees | No meaningful sandbox boundary; useful only as a UX comparison | | ### User-facing benefit matrix [#user-facing-benefit-matrix] This table is the "why would an operator care?" pass. A feature only belongs in the design when it improves an engineer's day-to-day control loop, not just because another tool has it. | User-visible benefit | Seen in | jackin❯ direction | | ------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Know the exact boundary before launch | Hazmat session contract; Docker Sandboxes security model | [Session contract and explain mode](/roadmap/session-contract-explain-mode/) becomes the common preflight for mounts, auth, Docker, network, ports, persistence, and recovery | | Pick the right containment tier for the job | Hazmat tier decision flow; Docker Sandboxes private-daemon path | Add a tier recommendation to `jackin explain` rather than forcing users to infer whether `dind`, rootless DinD, microVM, SSH remote, or Kubernetes is appropriate | | Run Docker/Compose without trusting the host daemon | Docker Sandboxes private Docker Engine; Hazmat Tier 3 | Keep host socket mounting out of scope; make private-daemon backends the Docker-capable path under [selectable sandbox backends](/research/platform/security/sandbox-backends/) | | See and govern outbound network behavior | Docker Sandboxes dashboard network panel; Hazmat deny-mode routing | [Network egress policy](/roadmap/network-egress-policy/) should include connection logs and rule-editing UX, not only static allowlist config | | Open services started by the agent | Docker Sandboxes `sbx ports`; multicode host-localhost notes | Track service exposure as a first-class session-contract section with explicit host-side effects and non-persistent port mappings | | Work in parallel without clobbering the main checkout | Docker Sandboxes `--branch`; multicode short-lived workspaces | jackin❯ already has per-mount worktree/clone isolation; improve the operator surface around branch naming, preserved worktrees, and post-session review | | Resume a configured environment without rebuilding everything | Docker Sandboxes named/persistent VMs; multicode workspaces | Preserve jackin❯ explicit state model, but add disk/resource visibility and cleanup policy so persistence does not become invisible bloat | | See which agents are idle, busy, waiting, done, stuck, or expensive | Herdr state roll-ups; CCManager and ccmux live status; Docker Sandboxes dashboard cards | [Agent runtime status authority](/roadmap/agent-runtime-status/), [console resource panel](/roadmap/console-resource-panel/), and [token telemetry](/research/agents/telemetry/token-cost-telemetry/) should converge into one operator overview | | Script, test, and replay a visible agent terminal | cellshot `wait`/`send`/`snapshot`; VHS `.tape`; asciinema recordings; tui-test `getByText` and traces | [Terminal observation and automation](/research/agents/orchestration/terminal-observation/terminal-observation-automation/) should turn Capsule sessions into typed read/wait/send/snapshot/record targets for CLIs, tests, future workflow runners, and external adapters | | Jump from agent output to issue/PR/repo state | multicode `` tags | Keep the tag protocol vendor-neutral and optional, then use it to drive GitHub link tracking and custom operator actions | | Reuse stack setup safely | Hazmat integrations; Docker Sandboxes kits/templates | Keep roles as the environment unit, but allow non-executable stack hints and future reviewed setup kits where they cannot widen trust | | Roll back after a bad unattended run | Hazmat snapshots/restore; Docker Sandboxes disposable VM cleanup | [Session snapshot and rollback](/roadmap/session-snapshot-rollback/) should separate metadata recovery, project snapshots, and sandbox-state deletion | | Run the same operator model over SSH/server/Kubernetes | multicode-remote; jackin❯ roadmap vision | [jackin-remote](/roadmap/jackin-remote/) and Kubernetes support should reuse the same contract/status/policy vocabulary instead of becoming separate products | ### Ideas to decline or postpone [#ideas-to-decline-or-postpone] Some adjacent-tool features are attractive but would cut against jackin❯ values if copied directly. | Idea | Why not copy directly | Safer jackin❯ alternative | | ---------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- | | Host Docker socket passthrough | Any agent with daemon access can create privileged containers or host bind mounts; this collapses the sandbox boundary | Private daemon only: DinD, rootless DinD, microVM-owned Docker, or Kubernetes-controlled pods | | Same-absolute-path workspace passthrough everywhere | Elegant in microVMs, but it would break jackin❯ explicit `dst` mount model in Docker/container backends | Keep `dst` explicit; only use same-path passthrough inside a backend that natively needs and explains it | | TUI-only orchestration | Fast for one product, but jackin❯ core users automate from terminals, SSH, and scripts | CLI-first contracts and commands, with `jackin console` as the common day-to-day overview | | Repo-controlled integration manifests with arbitrary paths/hooks | Turns untrusted project files into policy authority | Repo may recommend known integration names; operator approval and jackin-owned manifests decide what activates | | Broad environment inheritance for convenience | Secret-shaped env vars and auth sockets are easy to leak into agents | Named credential sources, safe env selectors, and bridge/proxy-mediated capabilities | | "Sandbox equals safe" messaging | Docker Sandboxes and Hazmat both document residual workspace, hooks, network, and persistence risk | Print backend-specific risk posture and recovery limits in the session contract | ## Implications for jackin❯ [#implications-for-jackin] Borrow operator outcomes and protocol shapes, not host-trust assumptions, product-specific runtime architecture, or hidden convenience paths. ## Limitations and unknowns [#limitations-and-unknowns] Feature availability and product behavior are volatile. Revalidate the cited projects before converting a matrix direction into an implementation commitment. ## Sources [#sources] * [Complete source catalog](/research/agents/orchestration/program-research/04-open-questions-and-sources/#sources) * [Dossier method](/research/agents/orchestration/program-research/#method-and-evidence) ## Related work [#related-work] * [Containment benchmarks](/research/agents/orchestration/program-research/02-containment-benchmarks/) * [Fleet and recovery comparison](/research/agents/orchestration/program-research/03-fleet-and-recovery-comparison/)