Detailed Seraph and IronClaw comparison
Comparative, privacy and security wording remains bounded by the strategy claim ledger.
Inspected: 5 October 2026, Europe/Warsaw. Owning request: #954. This research informs the guardian capability roadmap; it does not accept a competing architecture or establish broad superiority.
The shared Seraph baseline distinguishes the inspected develop and main revisions, #899/#953 integration, platform receipts and external-provider evidence. This comparison uses that bounded operator baseline. Historical status entries and benchmark registries are not silently promoted to live modern-provider proof.
Source/version method
IronClaw release v1.4.1 was published 29 September 2026 20:40:32 UTC. Its inspected source commit is b011eb3932a0e1ab8bbe833893599ca9ae4925c5, committer 29 September 18:24:04 UTC. Main b0b999d96781516ee05e6ba961d6f3ead900da96 has committer date 10 September 18:55:51 UTC. Release source was downloaded separately and checked for the material comparison claims below. A newer release date is not substituted for main code identity.
Evidence classes in this document are implementation source, official documented behavior, declared limitation, historical/local receipt and not verified here. They are independent of capability lifecycle states in Seraph's Documentation Contract. “Blocked” describes work/prerequisites; it is not a capability lifecycle label. No IronClaw instance, fresh model call, benchmark, external integration account or TEE client verification was run.
User journey matrix
Lifecycle labels summarize the bounded selected Seraph journeys recorded by STATUS; they are separate from whether this research inspected code, reused a local receipt, or verified an external service. The surrounding platform, account and installed-revision limits still apply. No Partial row implies absent infrastructure or verified human benefit.
| Category / operator journey | Seraph lifecycle for this selected journey | Seraph actual behavior and evidence limit | IronClaw release evidence and limit | Conclusion, uncertainty and action |
|---|---|---|---|---|
| Goals and success measures — Confirm a Goal and run its finite snapshot | Partial | Goals and Work board anchor bounded work. The generic goal-loop seam accepts an injected adapter; its old default/docstring alone does not describe all execution. The separate GoalSnapshotToFileService/adapter is an actual bounded executor used by the Goal API. This does not establish semantic opportunity usefulness. Goals API, goal loop, snapshot executor, current guide. | Routines/heartbeat allow operator standing instructions; no inspected evidence establishes general goal decomposition/outcome superiority. Heartbeat. | Extend fresh Goal/revision evidence and measurable opportunity utility in M2; do not infer capability from goal storage alone. |
| Proactive attention and intervention — Review a changed-source opportunity or stay quiet | Partial | Scheduler/intervention surfaces and evidence receipts exist. A useful proposal must still connect current goals, permitted context, admission, execution, outcome and reviewed learning. Status, goal contracts. | HEARTBEAT.md checklist jobs can notify on actionable findings; 30-minute default documented. These jobs consume model tokens and rely on checklist interpretation. Heartbeat. | Scheduled model calls are mechanisms, not demonstrated helpfulness. M2 needs cited, bounded candidates and quiet non-actionable behavior. |
| Events and scheduling — Schedule a consented watch and inspect its run | Partial | Existing scheduler/workflow jobs and typed task control provide extension points. Generic scheduled machinery does not prove each end-to-end guardian use case. Scheduler tree, workflow runtime. | Cron/event/webhook routines documented. Reborn trigger loop is explicitly in progress; owner pause/resume/delete, atomic fire and one-shot support described, with production readiness/retention/jitter follow-ups. Cron, inventory L677. | Reuse Seraph's existing execution owners for opportunities; no parallel scheduler or new global lane. |
| Memory and personalization — Recall a cited decision and inspect its provenance | Partial | Canonical memory, provenance and evidence working sets support decisions. Procedure preferences require review and exact source binding; selection-only acceptance does not authorize broader behavior changes. Preference code, memory ADR. | Default filesystem-backed memory-native, read/write/search/tree/profile_set, one active memory provider, mem0 alternative. Identity/workspace docs advertise persistent preferences. Memory provider. | Provider swap and memory tools are useful patterns. Neither proves better retrieval or human outcomes; M4 builds on Seraph's review path. |
| Learning and skills — Review a procedure preference before adopting it | Partial | Existing reviewed authored/local packages and procedure recommendation/adoption mechanisms retain version/digest/authority. Successful execution can end with explicit no_learning. Current guide, ADR-020, preference code. | SKILL.md parsing/validation, deterministic selection, scoped management and pure distillation/refinement port; execution/trust belongs to higher layers. Skills crate. | M4 asks whether reviewed changes improve usefulness; skill-generation existence is not generalization evidence. |
| Planning and delegation — Run finite research children and adopt verified outputs | Partial | Finite research children, reviewed dependencies, native Work jobs and runtime primitives exist. Plans must preserve budget, permissions and evidence before adoption. Research coordinator, ADR-014. | Subagent task support is recorded; Reborn spawn_subagent is blocking-only, background delivery deferred. Inventory L347. | M3 extends a reviewed bounded plan over existing jobs; avoid equating parallel jobs with durable team coordination. |
| Coding and terminal work — Repair/test a repository and inspect publication evidence | Partial | Finite Python/Node repair and tested repository publication have explicit acceptance profiles. Host-user execution is not OS isolation; Linux optional sandbox readiness has separate proof, macOS native execution limits remain named. ADR-007, ADR-009, guide. | Typed SandboxProcessPlan and scoped persistent per-user Docker shell execution, command cancellation, credential firewall and containment gates. Sandbox README L33. | Both have concrete execution architecture; no comparative coding benchmark ran. Preserve finite profiles and separate platform proof. |
| Browser and desktop context — Attach selected text or execute one reviewed browser action | Partial | Existing browser surfaces include a fixed private Moltbook read and Forgejo transaction. Deliberate Chromium selected-text attachment has Linux receipt, preview/redaction and exact approval; it is not generic screenshot observation or autonomous browser parity. ADR-018, ADR-021, ADR-022. | Release inventory marks browser automation missing; WebUI is a browser interface, not browser control. No native mobile/desktop apps is an explicit project decision. Inventory L241, L901. | Seraph has named narrower context/actions; evidence does not justify blanket browser superiority. |
| Research and citations — Produce a cited finite research result | Partial | Finite durable read-only research, private evidence working sets, child readback and reviewed dependency adoption exist. Fresh usefulness-focused opportunity synthesis remains proposed. ADR-012, research sources. | NEAR MCP web_search integration is recorded as partial, with host-mediated HTTP and scoped credential authority. Inventory L341. | M2 connects current cited research to operator goals; neither tool availability nor source retrieval measures insight quality. |
| Files and document work — Compare one private invoice PDF/CSV pair | Partial | Bounded private PDF/CSV invoice comparison yields cited literal formulas/derived output, not general document understanding or malware certification. ADR-017, guide. | Workspace/files and memory path interfaces plus scoped sandbox mounts are present. No specific equivalent invoice journey was verified here. Sandbox, memory docs. | Compare observable task outcomes, not potential expressibility. Preserve private-input authority and cleanup. |
| Integrations and messaging — Review one exact connected action and recover Unknown | Partial | Paired Telegram task control and exact Gmail reply/owned Calendar reschedule/Forgejo title actions have separate permission and recovery contracts. Lost response remains Unknown; read-only reconciliation cannot replay the write. ADR-016, ADR-019, guide. | WASM/MCP channels/extensions; Telegram voice-note send documented; Slack generic extension route and OAuth binding with broader production hardening pending. Inventory L113, L841. | Integration counts hide setup, ownership and external-effect uncertainty. Keep each adapter's live-account proof separate. |
| Voice/media and reach — Continue a paired conversation and inspect reach status | Partial | Paired voice/media/reach surfaces and historical bounded receipts exist; status explicitly withholds full voice/media parity and always-available reach claims. Status, voice module. | Official release inventory marks realtime voice and listed TTS/STT integrations missing. Voice-note attachment sending is narrower. Inventory L433. | No fresh microphone/audio/transport test ran; do not rank end-to-end voice quality. |
| Durability, restart and checkpoints — Resume inspectable work without renewing authority | Partial | Existing durable job/workflow/accounting owners retain deadlines/fences, evidence and unknown liabilities; continuity recovery does not renew authority. Guide, ADR-006 accounting. | Single process journal holds identity/lineage/status/checkpoints; supervisor claims, leases, heartbeats and recovery; result precedes terminal status. Process README. | Unified lifecycle ownership is a useful pattern. No new crash/restart experiment ran; no exactly-once or crash-proof claim. |
| Cancel, retry and priority — Cancel a queued job and retain Unknown cost | Partial | Remote admission is bounded and one-active, with authenticated owner, priority, deadlines, cancellation and retry rules. Contacted unknown outcomes retain cost liability. Broker, execution. | Cancellation and lease recovery exist. README advertises priority; inspected Reborn process/scheduler sources do not prove highest-priority-ready/non-starvation behavior. Process README. | Priority guarantee remains uncertain for IronClaw, not declared absent. Preserve Seraph's serial lane and concrete queue tests. |
| Permissions, secrets and sandbox — Inspect/revoke grants and run a supported sandbox profile | Partial | Effective grants, revocation, finite approvals and separate execution-profile gates already exist. Canonical local storage and host execution remain distinct from provider privacy/isolation. Guide, trust contract. | WASM capabilities/host secret injection/leak scans, Docker plans, credential placeholders, private-network managed egress and audit draining. Missing containment fails to no shell. Legacy script lane remains direct docker subprocess debt. Sandbox invariants. | Concrete safeguards do not establish universal prompt-injection resistance or absolute security. Reuse contracts; avoid branding-based comparison. |
| Models, cost, latency and setup — Configure a bounded inference route and inspect cost | Partial | Fixed governed OpenRouter route with consent, capability/upstream policy and finite deployment accounting. Purpose-specific routing is next M1; no current comparative quality/latency benchmark here. Configuration, setup panel. | Installer/onboarding and service setup; multiple providers; embedded local storage by default and PostgreSQL for served use. Token-consuming routines; no independent latency/cost/reliability benchmark here. Release README, storage docs. | M1 should measure selected task quality, latency and held/actual cost within existing accounting; model/provider breadth is not quality. |
| Inference privacy and NEAR TEE — Choose a NEAR upstream and inspect verification limits | Excluded direct route in the active phase | No direct NEAR route or client quote/SPKI/exact-signature verifier in active code. OpenRouter NEAR upstream is technically expressible, operational configuration/live result unverified. | Release NEAR adapter posts ordinary authenticated JSON and logs request body at DEBUG; no verifier/E2EE path found in it. Adapter L369. | Provider choice is not client verification. Conditional M5 uses the official pinned SDK; see trust annex. |
Contradictions and research limits
IronClaw's release sandbox README describes a wired production backend, while its parity row L753 still says no production execution backend is wired. Treat the implementation and owning crate contract as positive source evidence, preserve the contradiction, and require live acceptance before asserting deployment reliability. Its README PostgreSQL comparison is incomplete relative to current embedded-local storage docs. README privacy prose does not establish encryption of every local file or prevent all local debug logging.
Seraph's status contains historical local-Gemma/GPU and stronger-proof inventories alongside the current OpenRouter phase. Those historical entries do not override ADR-006 or prove a current external model route. Optional Linux sandbox and companion receipts do not establish macOS native execution. Local fixtures, implementation source, hosted CI, real account readback, paid model behavior and human usefulness are separate evidence classes.
No benchmark in this comparison supports broad “better,” “safer,” “more autonomous,” or “private by default” claims. Unknowns should produce bounded follow-up evidence, not invented absence or automatic scope expansion.
Roadmap implications
The sequence extends existing Seraph capability owners: M1 purpose-specific inference, M2 fresh goals and cited opportunities, M3 reviewed bounded plans, M4 reviewed usefulness learning, then conditional M5 verified NEAR inference. M5 remains blocked until reviewed architecture/trust prerequisites are fixed. The purpose of M1–M4 is an observable useful guardian journey, not another proof-only registry or competing lifecycle runtime.