@mseep/open-computer-use 1.0.0

package/docs/future-architecture/research/proof-uipath-anthropic-2026-05.md

@@ -0,0 +1,76 @@
+<!-- SPDX-License-Identifier: FSL-1.1-Apache-2.0 -->
+<!-- Copyright (c) 2025 Open Computer Use Contributors -->
+
+---
+status: research
+last-reviewed: 2026-05-24
+owner: nick
+applies-to: next/v1 positioning thesis (§01 widemoat)
+---
+
+Primary-source verification of two May 2026 launches that the Wide-Moat positioning thesis treats as load-bearing: UiPath's on-prem agentic AI (5 May 2026) and Anthropic's self-hosted sandboxes + MCP tunnels (19 May 2026).
+
+## Claim 1: UiPath on-prem agentic AI (5 May 2026)
+
+Primary sources:
+- Press release (IR site): https://ir.uipath.com/news/detail/446/uipath-automation-suite-delivers-on-premises-agentic-ai-for-the-public-sector
+- Newsroom mirror: https://www.uipath.com/newsroom/uipath-automation-suite-delivers-agentic-ai-for-public-sector
+- BusinessWire syndication: https://www.businesswire.com/news/home/20260505017359/en/
+- Platform page (general, not release-specific): https://www.uipath.com/platform/agentic-automation
+
+Product: UiPath Automation Suite, with UiPath Maestro as the agentic control plane plus Agent Builder, GenAI Activities, and context grounding. Positioned at public sector and regulated industries.
+
+Confirmed ship date: 5 May 2026. Conversational Agent and IXP capabilities slated for October 2026.
+
+Deployment model: customer-controlled infrastructure on AWS, Microsoft Azure, OpenShift, or self-hosted data centres. Press release confirms air-gap is supported: "Agencies can run recommended open-source models entirely within their own data centers...without external dependencies."
+
+Agent loop location: orchestration via Maestro runs inside the customer's Automation Suite cluster. LLM calls either egress to OpenAI / Google Gemini / Anthropic or hit a self-hosted open-source model inside the same perimeter. Recommended open-source model list not named in the release.
+
+Licence terms: not disclosed in the release. Automation Suite has historically been commercial closed-source per-user / per-robot under a UiPath EULA; the May 2026 release adds capabilities, it does not change the licensing model. No SBOM, source mirror, or OSS components called out.
+
+Pricing model: not disclosed. Existing Automation Suite contracts are enterprise-license, named-user plus unattended-robot capacity, negotiated. No public price list.
+
+Gap vs Wide-Moat target: UiPath ships RPA-shaped agents (workflow orchestration, document/IXP, GenAI activities inside Studio); it does not ship a generic in-perimeter Computer Use harness (browser + desktop + terminal driven by a vision-LLM loop) with MCP-native skills, model-provider neutrality at the harness layer, and FSL-style source-available licensing. The licence is closed and the unit of work is "automation" not "agent session inside a per-task microVM." Compliance posture (ISO/IEC 42001, FedRAMP, AIUC-1) covers the platform but is not the same as shipping per-deployment compliance evidence templates.
+
+## Claim 2: Anthropic self-hosted sandboxes + MCP tunnels (19 May 2026)
+
+Primary sources:
+- Announcement: https://claude.com/blog/claude-managed-agents-updates
+- Agent SDK hosting docs: https://code.claude.com/docs/en/agent-sdk/hosting (redirected from docs.claude.com)
+- Trade-press confirmation: https://www.infoq.com/news/2026/05/claude-mcp-tunnels/
+
+Product: two features added to Claude Managed Agents on the Claude Platform — self-hosted sandboxes and MCP tunnels. Announced at the Code with Claude London event.
+
+Confirmed ship date and status: 19 May 2026. Self-hosted sandboxes are in public beta. MCP tunnels are in research preview, request-access only.
+
+Customer-hosted vs Anthropic-hosted split:
+- Customer-hosted: tool execution sandbox (own infra or via Cloudflare, Daytona, Modal, Vercel), runtime image, network policy, audit logging; for MCP tunnels also a lightweight outbound gateway and the private MCP server.
+- Anthropic-hosted: agent loop (orchestration, context management, error recovery), model weights, context store, tunnel termination on the Anthropic side. Verbatim from the announcement: "The agent loop that handles orchestration, context management, and error recovery stays on Anthropic's infrastructure, while tool execution moves to your own configured environment."
+
+Licence terms for customer-installed components: the announcement does not state a licence for the sandbox runtime, gateway agent, or SDK. The Agent SDK is distributed via PyPI / npm and bundles a native Claude Code binary. Source-availability and licence of that binary are not declared on the hosting docs page. No SBOM linked from the release.
+
+Closed-weights confirmation: yes, weights stay on Anthropic. The customer-side runtime only egresses to api.anthropic.com per the SDK docs ("Outbound HTTPS to api.anthropic.com"). Weights are never shipped into the customer perimeter.
+
+Gap vs Wide-Moat target: this is a Claude-only path. The agent loop, weights, context, and recovery logic remain on Anthropic SaaS; banks that need full-perimeter operation (no outbound LLM API call, no Anthropic-side context retention) cannot use it. There is no multi-provider story (OpenAI / Bedrock / Vertex / vLLM cannot drive these sandboxes), no source-available harness, no shipped compliance-evidence templates for the customer to hand to InfoSec.
+
+## Side-by-side comparison
+
+| Dimension | UiPath Automation Suite (5 May 2026) | Anthropic Claude Managed Agents (19 May 2026) | Wide-Moat target (next/v1) |
+|---|---|---|---|
+| Deployment model | On-prem / private-cloud / air-gap on AWS, Azure, OpenShift | SaaS agent loop + customer-side sandbox (beta) + outbound MCP tunnel (research preview) | Fully in-perimeter incl. agent loop |
+| Agent loop location | Customer infra (Maestro) | Anthropic infra | Customer infra |
+| Model location | Customer choice: cloud API or self-hosted OSS | Anthropic only, closed weights | Customer choice, model-provider neutral |
+| Licence | Commercial closed-source EULA | Closed SaaS; SDK licence undeclared in release | FSL-1.1-Apache-2.0, source-available |
+| Compliance evidence | ISO/IEC 42001, FedRAMP, AIUC-1 (platform-level) | Anthropic SOC 2 / ISO; customer-side scope only | Per-deployment evidence templates (planned) |
+| Multi-provider LLM | Yes (OpenAI, Gemini, Anthropic, self-hosted) | No (Claude only) | Yes |
+| MCP-native | Not advertised | Yes, but via tunnel to Anthropic SaaS | Yes, fully in-perimeter |
+
+## Verdict on the load-bearing claim
+
+The original §01 wording — that the "in-perimeter Computer Use sole moat" is broken — is over-read. UiPath's release is real on-prem agentic AI but it targets RPA workflows under a closed commercial licence; it does not deliver a generic Computer Use harness or a source-available stack. Anthropic's release moves only the sandbox and MCP transport inside the customer perimeter; the agent loop, context, and weights remain Anthropic SaaS, which is exactly what bank InfoSec rejects. Corrected wording for §01: "By May 2026 the major vendors had partial in-perimeter answers — UiPath shipped closed-source on-prem RPA agents, Anthropic shipped a customer-side sandbox while keeping the agent loop on its SaaS — but neither shipped a model-neutral, source-available, fully in-perimeter Computer Use harness with per-deployment compliance evidence. That is the remaining moat."
+
+## Open questions / things I could not verify
+
+1. UiPath Automation Suite 2026 licence text and SBOM availability — searched the press release, newsroom, and product page; pricing and licence terms are gated behind sales contact, no public EULA URL found.
+2. Licence of the customer-installed Anthropic sandbox runtime and MCP tunnel gateway — checked the announcement and the Agent SDK hosting docs; neither states an OSI licence for the gateway binary or the bundled Claude Code binary. Could not confirm whether the gateway is reproducible or signed.
+3. Whether MCP tunnels' research-preview customers can disable Anthropic-side context retention end-to-end — checked the announcement and InfoQ; the split is described at the tool-execution boundary, retention/audit posture of the Anthropic-side context store under tunnel mode is not documented publicly.

package/docs/future-architecture/research/widemoat-thesis-advisor.md

@@ -0,0 +1,124 @@
+<!-- SPDX-License-Identifier: FSL-1.1-Apache-2.0 -->
+<!-- Copyright (c) 2025 Open Computer Use Contributors -->
+
+---
+status: research-buffer
+last-reviewed: 2026-05-24
+owner: positioning
+applies-to: docs/architecture/manifesto/01-audience-and-buyer.md
+---
+
+# Wide-Moat positioning thesis — advisor
+
+Advises the wording of `docs/architecture/manifesto/01-audience-and-buyer.md` after the
+2026-05 market shifts (UiPath Automation Suite on-prem agentic AI on 5 May 2026; Anthropic
+self-hosted sandboxes + MCP tunnels on 19 May 2026) invalidated the prior "doesn't exist"
+framing.
+
+## 1. Decision-summary table
+
+| Frame | Defensibility (mo) | True May 2026? | Filters design? | Banned-vocab clean? | Buyer reaction | Enthusiast reaction | Obsolescence risk |
+|---|---|---|---|---|---|---|---|
+| 1. Current "doesn't exist" | 0 | No — UiPath + Anthropic both shipped | Weak (negative claim) | Yes | "Two press releases refute you" | "Outdated on day one" | Already obsolete |
+| 2. Four-quadrant + named fifth | 9-12 | Yes | Medium (taxonomy guides, not constrains) | Yes (if "named fifth" not "best-in-class") | "Where is your category?" — needs analyst pickup | "Fair framing, see the gap" | High if a competitor adopts FSL |
+| 3. Compliance-first (SOC 2 + ISO + DORA + EU AI Act) | 12-18 | Yes — no competitor maps all four with evidence on day 1 | Strong (every NFR traces to a control) | Yes | Direct InfoSec/procurement match | "Why I care: provable, not asserted" | Medium — UiPath catches up on docs |
+| 4. License-first (FSL anti-SaaS) | 18-24 | Yes — unique stance | Weak (license rarely shapes code) | Yes | "Legal will read it. Engineering shrugs." | Strong (community trust) | Low (license is a moat by definition) |
+| 5. Model-neutrality (MCP + DORA art. 28-30) | 12-15 | Yes — UiPath ties governance to its Maestro, Anthropic ties loop to its API | Strong (forces provider abstractions) | Yes | "Concentration-risk language we already use" | "Lock-in escape, technical" | Medium — Bedrock/Vertex shore up MCP support |
+| 6. Combination: model-neutral + compliance-evidence (anchor) + in-perimeter + FSL (secondary) | 12-18 | Yes — each clause is independently verifiable | Strong (3 anchors → 3 NFR families) | Yes | Procurement/InfoSec/Legal all find their clause | Strong (technical + ethical anchors) | Medium — each clause ages differently |
+
+## 2. Recommended frame and draft thesis
+
+Recommended: **Frame 6 (combination)**, anchored on compliance evidence, with
+model-neutrality and license as the supporting clauses. Reason: it survives both
+near-term shocks already observed (UiPath shipping on-prem, Anthropic shipping
+managed self-host) because neither competitor ships SOC 2 Type II + ISO 27001 + DORA
+RoI fields + EU AI Act Annex III evidence in the artifact itself on day 1, and
+neither one is fair-source.
+
+Draft thesis (paste into §01 below the audience block):
+
+> Wide-Moat ships an AI-agent platform for tier-1 EU and US banks that runs entirely
+> inside the customer's perimeter, is model-agnostic by construction (MCP-first,
+> no hosted loop), and emits SOC 2 Type II, ISO 27001, DORA Article 28-30, and EU AI
+> Act Annex III evidence as first-class build artifacts. The license is
+> FSL-1.1-Apache-2.0: customers may self-host, fork, and embed, but cannot resell
+> the platform as a SaaS that competes with the vendor — a clause regulated buyers
+> read as protection against their tooling becoming someone else's hosted product.
+
+Three independently verifiable clauses. Zero banned words. No "comprehensive",
+"robust", "seamless", "powerful", "best-in-class", "industry-leading", "modern",
+"elegant", "battle-tested".
+
+## 3. Cost of the discarded frames
+
+- Frame 1: false on day of publication; one journalist kills the thesis.
+- Frame 2: depends on analyst category creation we do not control.
+- Frame 3 alone: a competitor that publishes a compliance pack overtakes us with a
+  PDF, not a code change.
+- Frame 4 alone: license is a legal moat, not a product moat; engineers do not buy
+  a license, they buy a contract surface.
+- Frame 5 alone: one MCP-ecosystem shift (e.g. Bedrock MCP gateway) collapses the
+  differentiation.
+
+## 4. Open questions (cap 3)
+
+1. Does "first-class build artifact" mean a signed evidence bundle per release, or
+   a continuously-updated portal? — track in issue `arch/thesis-evidence-bundle`.
+2. Do we include FedRAMP Moderate in the compliance clause for v1 or defer to v2? —
+   track in issue `arch/fedramp-v1-or-v2`.
+3. Does "model-agnostic by construction" extend to embedding/rerank models, or
+   only generation models? — track in issue `arch/modelprovider-scope`.
+
+## 5. Adjacent moats — moat vs table stakes
+
+| Asset | Classification | Why |
+|---|---|---|
+| FSL-1.1-Apache-2.0 anti-SaaS clause | Moat | Unique in this space; UiPath is commercial-closed, Skyvern is AGPL-3.0 |
+| SOC 2 + ISO 27001 + DORA + EU AI Act evidence bundle | Moat (12-18 mo) | None of UiPath/Anthropic/Skyvern publish all four as artifacts |
+| MCP-first model-agnostic abstractions | Moat (12-15 mo) | Anthropic's managed loop is API-locked; UiPath Maestro is Maestro-locked |
+| Sandbox isolation (Firecracker / Kata path) | Table stakes | Anthropic uses Firecracker too; isolation is necessary, not sufficient |
+| Skill registry (TBD-component) | Neither yet | Locked as v1 non-goal; becomes a moat only if a registry standard emerges |
+| In-perimeter deployment | Was a moat in 2025 | Now table stakes after UiPath 2026-05-05 + Anthropic 2026-05-19 |
+| Admin web UI absence | Neutral | Reduces attack surface; does not differentiate |
+
+## 6. Moat clock — 12-18 months, then what?
+
+Estimate: the recommended frame holds **12-18 months** before the compliance-evidence
+clause becomes table stakes. Triggers that would shorten the clock:
+
+- Anthropic publishes a SOC 2 + ISO 27001 + DORA evidence bundle for the Claude
+  Managed Agents self-hosted-sandbox tier (plausible in 6-9 months).
+- UiPath publishes a DORA RoI-aligned third-party-concentration-risk pack for
+  Automation Suite (plausible in 9-12 months, already partial).
+- Microsoft bundles Magentic-One into Azure Local with EU AI Act conformity
+  assessment templates (12-18 months estimate, depends on Azure Local sovereign
+  cloud rollout pace).
+
+Architectural decisions to make **now** so the moat survives the clock:
+
+1. **Evidence-as-code.** Compliance artifacts are generated from the same
+   repository as the binaries: SBOM (Syft/SPDX, cosign-signed), SLSA L3 provenance,
+   audit-event schema in `audit/` with one-to-one mapping to DORA Article 28-30
+   register fields. ADR mandates this in Layer 0.
+2. **`ModelProvider` abstraction enforced in CI.** No code path may import a
+   provider SDK directly; all generation goes through the abstraction. Lint
+   rule + integration test fails the build otherwise. Locks in
+   model-neutrality before any one provider's roadmap warps the codebase.
+3. **DORA RoI field-level traceability.** Every dependency added to the BoM
+   carries the seven fields required for a DORA RoI row (provider name, country,
+   subcontracting depth, function criticality, exit strategy, audit rights,
+   data-residency). Reject-list captures dependencies that cannot supply these
+   fields. Locked in `manifesto/05-licensing-posture.md`.
+4. **EU AI Act Annex III conformity checklist in release pipeline.** Each GA
+   release tags the Annex III risk categories the platform is configured for and
+   blocks release if the corresponding controls (logging, human oversight,
+   accuracy metrics, post-market monitoring hooks) are missing. Tracks to the
+   2027-12-02 deadline with margin.
+5. **MCP server allow-list as a first-class config.** Customer InfoSec controls
+   which MCP servers the platform may reach; gateway enforces. Defends against
+   the "Anthropic ships MCP tunnels, we lose differentiation" risk by making the
+   policy boundary our artifact, not the transport.
+
+Re-evaluate this thesis on 2027-05-24 (12-month checkpoint) and 2027-11-24
+(18-month checkpoint). If two of the three clauses have become table stakes by
+the first checkpoint, open a new ADR for thesis rotation.