AstrBot vs LearnHarness

AstrBot

Fourteen official messaging adapters, scheduled tasks and scoped API keys come in one AGPL-3.0 program with releases most weeks. No tool call asks for approval, no mail, calendar or long-term memory connector is built in, and usage statistics, including the machine's hostname, are sent by default.

LearnHarness

The in-app agent reads files but cannot change them or run commands, and a bundled skill gives other agents a documented read-only view of sessions and the knowledge graph. The project is 14 days old at 0.4.0, its file reads reach the whole home directory without approval, and it has no security policy.

AstrBot

1. Set ASTRBOT_DISABLE_METRICS=1 before the first start. Statistics, including the hostname, are sent to tickstats.soulter.top by default
2. Set dashboard.host to 127.0.0.1 in data/cmd_config.json, or the DASHBOARD_HOST variable, unless remote access is intended. The default is 0.0.0.0
3. Create an abk_ key in Settings, OpenAPI with only the scopes needed, and send it as Authorization: Bearer or X-API-Key
4. Include username in every POST /api/v1/chat body. Without the chat:admin scope an administrator ID is rejected
5. Check Extensions, Future Tasks after asking for a schedule. One-off tasks are deleted after their run even when the run fails

LearnHarness

1. Use the bundled skill (skills/learnharness/SKILL.md) to read a learner's record. It needs Python 3.10 or later and writes nothing
2. Pass --format json before the subcommand, for example python3 -B scripts/graph.py --format json propositions
3. Treat stored answer keys and teacher prose as model-authored. A proposition in the graph is not evidence the learner understood it
4. Do not read auth.json, which sits one folder above the data folder and holds provider keys in plain text
5. Close the app or re-read when a stable snapshot matters. The readers do not lock files while the app writes