Personal agents need an outcome contract

Dots, Grok Bot, Claude Code self-hosted environments and Muse expose different boundaries between staying available, keeping state and finishing work.

Consider a daily project briefing. The agent should notice a changed deadline, update a draft, wait for approval before sending, and stop when the responsibility ends. “Always-on” covers only part of that job. It says little about whether delegated workers also stop, whether a resumed task retains its files, or whether a green completion indicator means the briefing reached its destination. The useful comparison between these four products is an execution contract: what starts work, what authority it carries, what persists, and what evidence establishes the outcome.

This is a documentation analysis checked on October 11, 2026, not a hands-on reliability benchmark. Dots, Grok Bot and Meta Muse offer managed agents for continuing responsibilities. Claude Code self-hosted environments provide execution infrastructure for coding sessions, with a separate surface starting those sessions. Treating all four as interchangeable personal assistants would hide the most consequential differences. The following distinctions come from current official pages and linked technical documentation; account access and real-world completion rates were not tested. Sources: Dots overview, Grok Bot, Claude self-hosted environments, Muse launch.

Watch the 6:14 analysis

English narration, with English, Chinese and bilingual captions. This compares official control and state descriptions checked on 11 October 2026; the briefing scenario is proposed, not an observed product benchmark.

First identify the layer and the release state

Dots can coordinate an ongoing responsibility, delegate Work or Codex tasks, and continue while a personal computer is off using its cloud computer. Grok Bot offers multiple specialists that can coordinate through messages and use a persistent desktop. Muse combines goal planning, proactive work and a dedicated cloud VM. These are useful advances over restarting a task’s context with every conversation: a briefing can stay connected to changing project information while the person handles decisions. Their official examples demonstrate intended workflows, rather than measured comparisons of how reliably they finish. Dots tasks, Grok Bot guide, Muse design.

Product	Layer	Current documented status
Dots	Managed ongoing-work coordinator	Gradual rollout; plan, age, region and admin gates
Grok Bot	Managed specialist Bots with a persistent computer	Available on documented eligible subscriptions
Claude self-hosted environments	Coding-session execution infrastructure	Team/Enterprise public beta; off by default
Muse	Managed personal agent with a dedicated VM	US rollout using Secure VM

Eligibility does not establish access for a particular account. Muse’s Confidential VM, Shop Pay, 1Password support and glasses access are future additions. Dots texting and agent-initiated calls are also future features. Preserve those states rather than turn every announcement into a checked feature box. Dots channels, Muse roadmap.

A specialist persona is not a separate security domain

Grok Bot makes the distinction particularly explicit: the same user’s Bots share one persistent cloud computer, including files, browser and logins. Isolation is per user, not per Bot. Its official guide explains that a login made with one Bot is reachable by the others. That shared state has a concrete benefit: a researcher can hand a briefing to a communications specialist without rebuilding the environment. But separate names and instructions do not establish separate credential boundaries. Permissions and the reviewer still matter; the personal-Bot statement should not be generalized to every Enterprise Team Bot arrangement. Grok Bot FAQ, shared-computer guide.

Dots separate contact methods, app connections and local-computer access. Adding Slack does not connect an inbox or authorize computer use. Its cloud browser has sessions distinct from the person’s browser; a local task requires the connected computer to be online with ChatGPT open. Dot-specific saved notes also differ from ChatGPT memory and from a full transcript. These distinctions make continuity more precise: an agent can remember a private deadline without permission to share the private conversation in a team channel, and a delegate receives task-specific context rather than every past conversation. Dots computers and apps, context and memory.

Stop the responsibility, not just the visible worker

Dots document three separate operations: Pause stops the current main task, delegated tasks are stopped through Activity, and recurring runs are disabled or deleted through Scheduled. Stopping does not undo actions already completed. For the briefing example, ending the conversation or pausing the coordinator should therefore not be taken as evidence that tomorrow’s briefing has been canceled. The scheduler and delegated jobs need their own state checks. This is an explicit product distinction, not an inferred defect. Dots controls.

Grok Bot’s versioned release notes describe a different stopping scope. The September 17 v0.56.0 entry says telling a Bot to stop also stops delegated Bots and Cloud Agents it started. The October 7 v0.68.1 entry adds stopping an unresponsive step within about 30 seconds. But that same release says an email Send interrupted by Stop still goes out. Those claims separate cancellation from rollback: stopping future execution does not prove that an already committed action was recalled. Routines also have their own pause/resume/delete controls. Release notes are evidence about documented behavior, not an independently measured cancellation SLA. Grok Bot changelog.

Resumable conversation and durable work are different

Claude self-hosted environments move coding execution into an organization’s network. Operators supply runners, images, network policy and credentials, while Anthropic retains the queue, orchestration and interface. Conversation and tool results still reach api.anthropic.com, including when model inference is configured through Bedrock or Google’s Agent Platform. This provides access to internal build systems without exposing them publicly, but it does not mean every part of the session is local or provider-inaccessible. Self-hosting changes an execution boundary and adds operational responsibility. Claude architecture and data scope.

Recovery makes the distinction visible. If the runner stops polling, its lease expires after about 60 seconds and the session is requeued within minutes. A fresh runner can resume the conversation while cloning the original branch again, losing work that had not been pushed. A documented best-effort push-on-release option can preserve committed changes; uncommitted edits remain vulnerable. Thus “resume” can be true for conversational continuity while false for working-tree preservation. A future briefing trial should inspect the draft artifact separately from the resumed chat. The same documentation also notes that stopping a session need not stop a daemonized process; container teardown handles that separate lifetime. Claude recovery and limitations.

Approval needs an authority outside the instruction

Dots distinguish app permission, action review and Custom Rules. The rules are instructions the agent tries to follow and can get wrong; they neither grant app access nor override built-in safety. Grok Bot similarly documents natural-language rules interpreted by a separate reviewer. These designs can reduce repetitive human approvals while retaining escalation, but “prepare a briefing” still needs to remain separate from “send it to this audience.” Reading an instruction in source material should not create new authority to act. Dots action controls, Grok permissions.

Meta describes a more explicit boundary in Muse: Sentinel, outside the agent’s runtime cell, authorizes connector actions and network egress. Scoped approvals travel through the client UI directly to Sentinel; credentials are stored separately and inserted at authorized boundaries. This is a substantive architectural claim about where permission lives, not proof that enforcement never fails. The current Secure VM also permits Meta’s operational access under policy. The future Confidential VM is intended to cryptographically prevent that access and is described as being tested with a small trusted group. Current isolation, future confidentiality and model-training choices should stay separate: the technical post describes sanitized training trajectories by default, with an opt-out. Muse technical architecture and privacy.

Verify the artifact after the process turns green

Claude’s reference documentation makes this unusually concrete. HTTP 200 on the runner health endpoint means the process is alive even if its polling loop is unhealthy. Its sessions_completed_total counter records a clean lifecycle ending, which can include idle release, archiving or even a startup timeout. It does not certify that the requested artifact passed tests or reached a recipient. Dots also state that a completed run alone does not confirm the requested result was achieved or delivered. These are different operational signals; a dashboard should retain both rather than rename one into the other. Claude counter semantics, Dots completion warning.

A safe matched protocol would supply fictional, versioned project updates and ask each workflow to produce a sourced draft briefing. Change a release date from October 20 to October 23, withhold one required record, and introduce a third-party request to send the draft while the task policy permits drafting only. Then inspect cancellation, resumption, artifact hashes and delivery receipts independently. For Claude, supply a separate routine or dispatcher instead of pretending self-hosting provides a consumer frontend. This is a proposed test, not a result: no account was connected and no send occurred. The acceptance question is whether the latest facts and authorized destination are evidenced, not whether the process merely stopped.

Cost belongs to that same outcome record. Dots’ delegated Work/Codex tasks use those products’ allowances, Grok Bot combines weekly included usage with additional token-cost usage, and self-hosted Claude adds operator infrastructure costs to organization usage. Muse advertises free core use with subscriptions for more, without exact amounts in the launch article. A meaningful future comparison would measure cost per verified briefing, including retries and review effort, rather than equating subscription entry prices with task costs. Persistent agents can reduce repeated setup and keep responsibilities moving; an outcome contract makes those benefits reviewable. Dots usage, Grok billing, Claude billing, Muse plans.

Analysis prepared with GPT-6.1 Sol assistance, using official documentation checked October 11, 2026. No hands-on performance or security benchmark was run. Proposed scenarios are illustrations, not observed product results.

Inspect the dated feature/status matrix and source-linked evidence notes.