LearnHarness vs NanoClaw

LearnHarness

The in-app agent reads files but cannot change them or run commands, and a bundled skill gives other agents a documented read-only view of sessions and the knowledge graph. The project is 14 days old at 0.4.0, its file reads reach the whole home directory without approval, and it has no security policy.

NanoClaw

Each session runs in an unprivileged Docker container and API keys stay in a credential gateway on the host, so a manipulated agent cannot read them. Inside the container the agent runs with permission prompts off, network egress is open by default, and it can message any chat it is wired to without approval.

LearnHarness

1. Use the bundled skill (skills/learnharness/SKILL.md) to read a learner's record. It needs Python 3.10 or later and writes nothing
2. Pass --format json before the subcommand, for example python3 -B scripts/graph.py --format json propositions
3. Treat stored answer keys and teacher prose as model-authored. A proposition in the graph is not evidence the learner understood it
4. Do not read auth.json, which sits one folder above the data folder and holds provider keys in plain text
5. Close the app or re-read when a stable snapshot matters. The readers do not lock files while the app writes

NanoClaw

1. Install with git clone and bash nanoclaw.sh. There is no registry package, and setup needs Docker, Node 22 or later and a Claude or Codex credential
2. Set NANOCLAW_EGRESS_LOCKDOWN=true before giving an agent credentials or an audience of strangers. The default leaves egress open
3. Put chats with different audiences in separate agent groups. Every session of a group shares one read-write workspace and memory tree
4. Turn on per-request approval for a secret in the gateway when its use should wait for a person. It is off unless configured
5. On OneCLI installs, move the gateway to 1.42.0 by the upgrade guide before updating to 2026.10.0. The updater stops until that is done