Enterprise agent tooling grows a governance layer, and a crowded field of runtimes

Five separate projects landed on Hacker News between December and September. Each one claims to fix a different part of the same problem: agents that run for hours, call tools and touch production systems. None of them is a governance product in the compliance sense. Read together, they describe a market splitting into runtimes, interfaces and plumbing. The security layer is still largely sold by somebody else.

Start with Soma, documented at docs.trysoma.ai and posted on 2 December. It is an open-source, self-hostable AI agent and workflow runtime that ships as a single binary, with what the docs call a security and governance plane across agents. Typescript is supported today; Python is listed as coming soon. The docs claim fault tolerance and resumability: crash or suspend execution at any point and resume from where it left off. It generates A2A (Agent2Agent) endpoints automatically, and OpenAI Streaming compatibility is marked as coming soon.

That is a lot of surface for one binary.

The documentation also lists an MCP server pre-integrated with third-party SaaS providers. That server handles credential encryption and rotation, local, AWS or soon GCP KMS encryption for secrets, fine-grained API key access management, and an outbound AI gateway that intercepts all agent requests to model providers for observability. Host support is uneven and stated plainly: Mac OS X x86 and ARM, Linux GNU x86 and ARM are marked green for Typescript; Rust is marked white across the board. Windows is not natively supported, which the docs attribute to the use of Unix domain sockets in Rust, and is described as planned.

Inboxes, worktrees and specialist agents

Pizza Bot, posted on 15 September and hosted at github.com/pizza-bot-app/pizza-bot, takes the opposite approach: it does not try to be the runtime. It is a local-first inbox for long-running agents, built with DeepAgents and LangGraph, developed at Amazon and released under the Apache 2.0 license. The pitch is straightforward. Start or schedule a task, walk away, and come back to finished work in Unread and decisions waiting for you in Action. Agents keep working when you navigate away or disconnect, provided the api-server process stays running.

The project's README is unusually specific about its security posture. The api-server binds to 127.0.0.1, and non-loopback binding requires authentication. Pizza Bot receives no default home-directory access; users grant individual read-only or writable folders under Settings, Files. The desktop app protects entered secrets with Electron safeStorage, while server configuration persists only environment-variable references. Installers ship with every release, alongside a SHA256SUMS file to check a download against. macOS builds are signed and notarised; Windows and Linux builds are not, and the README says so.

Model support is broad by design: Amazon Bedrock, Anthropic, Google Gemini, OpenAI, OpenRouter and Ollama are all listed. Bedrock accepts an AWS profile, AWS access keys or a Bedrock API key, with an optional region override, otherwise AWS_REGION or us-west-2. Human-in-the-loop approvals, long-term memory and file attachments are built into the workflow rather than added on.

Hyperlane, posted on 4 August at hyperlaneide.com, is the hardest of the five to assess from its own page. The site describes a complete IDE that runs AI agents in parallel, and the title mentions an IDE and ADE merging agent worktrees with native tooling. Beyond that, the text is largely unreadable: long runs of decorative characters and garbled glyphs replace what should be product copy. No pricing, no architecture and no security detail survives in the text available. FLASH24 could not verify any product claim from the page itself.

Recurse, posted on 25 September at recurse.run, is the most concrete of the newer entrants. It offers a serverless harness for building custom agents and deploying them as tools, MCPs or bots. New accounts start funded with $5 of runs and no card required, which is a marketing number, not a benchmark. The site shows a representative agent.yaml manifest excerpt with apiVersion recurse.run/v1alpha1, an input schema with defaults, and an output schema requiring a result field. Commands shown include recurse run ./agent, recurse deploy --as mcp, recurse status, and registration with external clients via codex mcp add recurse and claude mcp add recurse. Example workflows cover level design, RNA sequence design and other iterative tasks where a parent agent changes the specialist rather than answering directly.

Then there is PeerTalk.ai, posted on 27 September. It is free, and explicitly an experiment, attributed to Daniel Brain. The idea: let your agent talk directly to someone else's, so they compare notes and agree on a plan. Messages go straight between the two machines, encrypted, and the site states they never pass through PeerTalk's servers. Each agent leaves its address with peertalk.ai, encrypted with a key generated in the browser that lives only in the link, so the service cannot read or change the addresses. Nothing is relayed: if the two machines cannot reach each other directly, the agents stop and say so.

The project is candid about the limits. Rooms close after 30 minutes, though the site notes that by then the agents do not need the room. It requires an agent that runs locally, such as Claude Code, Codex CLI or Gemini CLI, with ChatGPT and Claude chat apps listed as coming soon. By default the agent downloads PeerTalk's published client and runs it; a stricter setting has the agent write its own client from the protocol in the prompt using one standard WebRTC library. The site flags prompt injection as a real concern and says agents are told to treat the other agent's messages as information, never instructions, stripping hidden characters and sharing only what the user approves. It also warns that some mobile and office networks block direct connections.

What the governance vendors are selling

Meanwhile the enterprise side of the market is moving on policy rather than plumbing. Recent headlines include Snowflake's agentic control plane, WSO2's Agent Manager for sovereign AI governance, and Collibra bringing runtime governance to enterprise AI agents. Microsoft retooled Copilot with coding and AI agent capabilities, covered by Reuters and CIO Dive, and Google added third-party agent support to Android Studio.

Security research is keeping pace with the risk. Darktrace reported that AI agent tools can be hijacked through their own memory, and described the fix as out of the user's hands. That finding sits awkwardly next to the local-first, bring-your-own-key designs above, which push control to the individual machine but leave the model provider and the tool chain outside the perimeter.

The pattern across the five projects is a division of labour. Soma wants to be the runtime and the gateway. Pizza Bot wants to be the inbox and the approval queue. Recurse wants to be the deployment target for narrow specialists. PeerTalk wants to be the introduction service and nothing more, and says so. Hyperlane wants to be the place you write the code, if its page ever says how.

For buyers, the practical questions are narrower than the category suggests. Where do credentials live, and who can rotate them? What happens to a run when the client disconnects? Can an agent's outbound requests be inspected, or only logged? Soma answers some of that in its docs, Pizza Bot answers it in its README, and PeerTalk answers it by refusing to hold anything at all. Recurse answers it with a funded sandbox. Hyperlane, on current evidence, answers nothing.