Landscape (M12) — design

Why a survey first

Every milestone so far was driven by what broke on this machine. That produced a daemon nobody else has, and it also produced blind spots: the things people reach for first (a statusline, a plan-quota meter, an OpenTelemetry endpoint) are not things that break, so they never made the list. Before choosing M12, four research passes graded what the field ships against what Swarm ships. This doc keeps the result, ranks the gaps, and proposes the milestone. The full matrices are in the appendix.

Method: each tool's own README, docs or pricing page fetched on 2026-09-06; GitHub stars and last push read the same day; anything a vendor page did not confirm is marked unverified. Categories: usage monitors for local coding agents (19), control planes and orchestrators (22), LLM and agent observability platforms (20), runtime guardrails and sandboxes (22).

Where Swarm stands

What no surveyed tool has, in one place or at all:

• The combination. Lease ledger, hook-enforced rules, transcript cost and a port/process registry in one daemon. The pieces exist apart: Gas Town and Symphony hold leases, Paperclip holds budgets, Xum and Multica count cost, Vibe Kanban and Superset allocate ports, Claude Code agent teams lock task files.
• Outcomes and trials. Merge rate, lead time and cost per merged PR per model and agent; A/B trials where an arm wins only if every gate passed. Elsewhere only hints: GitHub's Impact dashboard, Codex and Jules multi-attempt.
• Incidents that become rules. An incident feed with acknowledgement, codify into .swarm.toml plus a CLAUDE.md lesson, and dry-run of a whole session's tool calls against a rule set. The closest are single-command checks (nah test, cupcake eval).
• Rules nobody else writes. Kill-by-pattern refusal and port ownership as first-class rules.
• A signed org policy. Claude Code, Codex, Cursor and Docker deliver managed policy unsigned and call it a client-side control.
• Resume where it died, rule effectiveness, waiting-on-human time, and file heat as CLAUDE.md candidates.

The market moved under the survey: Bloop (Vibe Kanban), Terragon and Crystal shut down in 2026, Ona went to OpenAI, Helicone is in maintenance. The vendor dashboards that replaced them (Anthropic Agent View and Console, Codex cloud, Copilot Agents tab, Cursor cloud agents) are each single-agent. Multi-agent, repo-agnostic, local observation stayed an open-source lane (Emdash, Superset, Agent Orchestrator, Multica) and none of those carry a ledger or rules.

The gaps, ranked

Ranked by how many categories the gap recurs in, then by how much of it Swarm's existing data already covers.

Gaps 1–3 are distribution: they put Swarm's data where people already look. Gaps 4–7 are the guard story catching up with the observation story. Gaps 8–10 are the Observatory paying off further. Gap 11 stays out (below).

Proposed milestone: M12 — Reach

Goal: Swarm's data shows up where people already look (their APM, their terminal, their plan meter), its rules hold on every agent it observes, and the Observatory turns from fixed detectors into ones the user writes. Three batches, each shippable on its own, in the order the gaps rank.

M12a — Interop

M12.1 OTLP export. daemon/src/otel.ts turns the ledger into OpenTelemetry: one trace per session (gen_ai.conversation.id = session id, the schema W&B and the OTel GenAI semantic conventions use), a span per tool call from the PreToolUse → PostToolUse pair core/src/mcphealth.ts already builds, a blocked_on_user span per waiting pair, a swarm.claim / swarm.incident / swarm.gate span event per ledger record, and swarm.cost.usage / swarm.token.usage metrics per turn. Config [otel] endpoint / headers / protocol = "http/protobuf"; off unless an endpoint is set so the no-telemetry promise holds. Attributes carry project, agent, model, task and rule; never prompt or reasoning text unless [otel] content = true. Verified against Grafana Cloud's Claude Code dashboard and one OTLP collector. Decides OQ-20.

M12.2 Statusline. swarm statusline reads the JSON Claude Code passes to a statusLine command on stdin and prints one line: model, context %, session cost, and from the daemon the held task, lease left, budget state, open incidents and whether the session is waiting on someone. Same contract as the hook shim: 400 ms budget, fails open to the local fields, never starts the daemon. swarm install --statusline writes statusLine into ~/.claude/settings.json only when none is set; uninstall removes exactly ours. Verify the statusline payload fields against current Claude Code docs before building — the same rule as for hook schemas.

M12.3 Plan quota windows. Read the 5-hour and 7-day usage percentages the statusline payload carries (verify: they were added in 2026 and may be behind a version), store them per user as quota samples, and show on Spend and on the statusline: window %, reset time, burn rate and time-to-limit at the current rate. [budget] window_warn_at = 80 opens a budget incident at the threshold, the same path daily/weekly dollars use. Swarm has no account, so the OAuth usage endpoint the monitors poll is out of scope; the statusline is the only source. Decides OQ-23.

M12b — Guard on every agent

M12.4 Rules for Codex, Gemini CLI and Cursor. Each agent's pre-tool hook payload is mapped onto the ToolRequest that core/src/rules.ts already evaluates; core/src/rules.ts itself does not change. swarm install registers the shim in Gemini CLI's BeforeTool hook and policy tier, Cursor's hooks.json, and Codex's hook surface (verify Codex exposes a pre-command hook; if not, Codex gets requirements.toml command rules generated from the rule set instead). doctor reports rule coverage per agent, and the Rules view shows which agents each rule holds on.

M12.5 Destructive family, secrets, tamper. destructive_git becomes one member of a destructive family with the same ask/deny/off contract: destructive_fs (recursive delete outside the held worktree, move-then-delete), destructive_infra (terraform destroy, cloud instance termination, database reset commands), pipe_to_shell (curl | sh), secrets (Bash that reads or prints a credential file — the list core/src/security.ts already matches on, plus .env* and *.pem writes), and config_tamper (writes to ~/.claude/settings.json, .swarm.toml, ~/.swarm/policy*, the org cache). The [[rules.custom]] DSL promised in the M7 follow-ups lands here so Codify writes a format the daemon reads. Each new rule ships off for one release, observed on the Security view, then flips to ask — the same observe-first order M9.9 set.

M12.6 Sandboxed runs. swarm run --sandbox and [dispatch] sandbox = true wrap the spawned agent in Anthropic's sandbox-runtime (srt, Apache-2.0, same engine as Claude Code's own sandbox): writable paths are the claimed worktree and the agent's own state dir, everything else read-only; egress is [sandbox] allowed_domains, seeded from the hosts the Security view has already seen for that project (Greywall's learn-then-enforce pattern). Sandbox violations arrive in the tool result and are recorded as sandbox incidents. doctor says whether srt is on PATH. Interactive sessions are not sandboxed by Swarm; Claude Code's own settings do that. Decides OQ-21.

M12.7 Reviewer on ask. The permission broker gains [broker] reviewer = "off" | "advise" | "decide". On an ask, a read-only reviewer run (the M7.9 review-gate spawner, with the pending tool call, the rule that fired and the session's last turns) returns allow or deny with a reason. advise shows it on the permission card; decide acts on it, records permission.reviewed with the reason, and stays overridable from the card. Locked org rules are never delegated to the reviewer. Default off. Decides OQ-22.

M12c — Observatory, user-defined

M12.8 Signals and a score. [[signals]] in config: name, match (an FTS5 query over what the session said and did, or a tool-sequence pattern), window. Evaluated on the tick over live sessions, hits open a signal incident and cluster by task and rule on a Signals view. Beside it a per-session efficiency score from inputs the Observatory already has — re-read share (M9.16), failed-tool share (M9.3), waiting share (M9.4), gate outcome (M9.7) — with a week-over-week delta on Stats, and one anomaly alert: tokens per turn above 3× the project's median opens a budget incident.

M12.9 Cost by MCP server, skill and subagent. Transcript tool-use blocks name the server or subagent; attribute each turn's cost to them and add a cost column to the MCP view and a share on the session stats panel. Cache-miss cause stays out: the transcript does not carry it.

M12.10 CI and review back into the run. A workflow pr step gains on_fail = "stop" | "resume": when the forge poll sees the PR's checks fail or a review request changes, resume re-runs the task in the same worktree with the failure text as the prompt, capped by max_attempts, each attempt a dispatch event on the Board.

Not in M12

• A kernel sandbox of our own. srt exists and is the engine Claude Code ships; wrapping it is the whole of M12.6.
• Hosting terminals, browsers or remote SSH hosts. Swarm observes sessions that run elsewhere; the team daemon is the multi-machine story.
• Cloud VMs, multi-account proxying, evals, datasets, prompt management. Different products.
• Jira, GitLab issues, board-as-MCP, mobile. Real gaps, cheap to add later, none of them changes what Swarm is.

Definition of done for the milestone

Each task flips ✅ only with the repo's usual gates green (test, typecheck, lint, smoke, docs:check), a guide page updated, and — for M12.1 and M12.2 — a screenshot of the data arriving in Grafana and in a terminal, since those two exist to be seen elsewhere.

Appendix — the survey

Legend: Y yes · P partial (narrower than the column asks) · N no · ? unverified. Swarm is the first row of each table. Stars and dates as of 2026-09-06.

A. Usage and cost monitors

Live = live session list · Cost = per-session tokens and cost · Cache = cache and thinking tokens · Sub = subagents · Budget = budgets, quota windows · Multi = agents beyond Claude Code · Hooks = enforcement · Git = worktree awareness · OTel = OpenTelemetry export.

B. Control planes and orchestrators

WT = worktree per session · Board = task board with a source · Disp = auto dispatch · Lease = claims · Rules = enforcement · Res = ports and processes · Resume = handoff · Gate = verification · Msg = agent messaging · Outc = outcome analytics.

C. LLM and agent observability platforms

TS = tool spans · CD = cost dashboards and budgets · AG = agent graph · SR = replay · EV = evals · GR = runtime guardrail · HL = human queue · MCP = MCP health · AL = alerts · OT = OTel ingest · CC = first-class Claude Code support.

D. Runtime guardrails, sandboxes and audit

DG = destructive git · KP = kill-by-pattern · PT = ports · WT = writes confined · RP = per-repo policy · ORG = org policy · AD = ask vs deny · DR = dry-run · AU = audit of hosts, packages, credentials · INC = incidents with ack · CR = codify · BU = budget stop · MA = model allow-list · MULTI = several agents.

Source: docs/15-landscape.md · v0.15.1.