Vitto Infrastructure, Competitive Analysis & Strategic Gaps

Purpose: Single source of truth for Vitto's technical position in the 2026 AI agent market. This document informs all future architectural decisions, sprint planning, and investment prioritization. Updated March 17, 2026.

Table of Contents

1. Executive Summary
2. Internal Architecture — What We've Built
   • 2.1 backend-vitto-api (Port 3003)
   • 2.2 backend-ai-api (Port 3001)
   • 2.3 Integration & Data Flow
   • 2.4 Desktop Control Infrastructure
3. Competitive Landscape — 2026 AI Agent Market
   • 3.1 OpenClaw Deep Dive
   • 3.2 Tier 1: Direct Threats
   • 3.3 Tier 2: Partial Overlaps
   • 3.4 Tier 3: Infrastructure Plays
   • 3.5 Master Comparison Table
4. Desktop Control — Detailed Comparison
5. Where Vitto Has No Competition
6. Critical Gaps & Technical Debt
7. Architecture Patterns — Industry State of the Art
8. Strategic Differentiators & Business Moats
9. Phased Roadmap to Jarvis-Parity
10. Key Decisions & Open Questions
11. Reference: Essential Files

1. Executive Summary

Vitto is architecturally ahead of every competitor except Microsoft (Work IQ + Windows 365 + M365 distribution) and Perplexity (hardware-first 24/7 agent). Our unique position is: cloud intelligence + local presence + continuous learning — nobody combines all three.

What We Have That Nobody Else Does

• Intelligence Pyramid: Self-improving learning pipeline (12K+ decisions → 563 patterns → core rules). No competitor has continuous outcome-based learning.
• Smart model routing: 60-90% cost savings by routing simple tasks to cheap models. Circuit breakers + automatic failover across 5 LLM providers.
• 6-phase code generation pipeline with in-browser rspack WASM live preview. Devin is the nearest competitor but has no live preview.
• Multi-channel + Computer Use + Learning in one system. OpenClaw has channels but no CU. OpenAI Operator has CU but no channels. Nobody has learning.

What We're Missing

• Observability: No OpenTelemetry, no eval framework, no LLM-as-judge. We're flying blind on quality.
• Embedding search is broken: isEmbeddingEnabled() returns false — the entire similar-decisions recall falls back to keyword search.
• Desktop presence: Tauri app and Node.js bridge EXIST but aren't shipped as daemon. No voice pipeline.
• Browser session persistence: Every CU session starts fresh. No login state reuse.
• Chat response polling: 200ms polling loop instead of SSE streaming.

Strategic Position

The market is splitting into: (1) Big Tech integrated agents with massive distribution, (2) Specialized startups targeting niches, and (3) Open-source democratizing access. Nobody has nailed the full "Jarvis" vision. We have the deepest technical foundation — we need to ship the local presence and close the observability gap.

2. Internal Architecture

2.1 backend-vitto-api

Role: Supreme orchestrator. Every AI interaction routes through it. Port: 3003 | Database: vitto-mind + vitto-users | Deployment: Railway

Module Inventory (17 modules)

LLM Providers & Routing

Smart Router (SmartRouterService): Routes by complexity — simple (Haiku/Flash/GPT-4o-mini), medium (Sonnet/GPT-4o), complex (Opus/o1). Saves 60-90% on simple tasks.

Resilient Provider (ResilientLLMProvider): Wraps primary with ordered fallback chain. Circuit breaker per provider (5 failures → trip, 60s reset). Failover chain configurable via VITTO_FAILOVER_CHAIN env var.

Per-phase override: VITTO_{PHASE}_MODEL=provider:model lets you use different models for ANALYZE vs EXECUTE.

4-Phase Agentic Workflow

ANALYZE → Classify request (CONVERSATION / COMMAND / COMPLEX TASK)
        → Recall past decisions from MindService
        → Assess autonomy level
PLAN    → Generate execution plan with ordered steps + tool requirements
EXECUTE → AgentLoopService: LLM ↔ tools loop
        → 17 tool plugin bundles, layer-based access control
        → Stuck detection (breaks repeated identical tool calls)
VERIFY  → QualityGateService validates output
        → Records lessons learned

Cost Guards: Max 40 iterations, 300K tokens, 10 min (configurable). Per-complexity scaling: simple = 25%, moderate = 50%, complex = 100%.

Tool Plugin System (17 bundles)

fileCodePlugin, docsPlugin, webPagePlugin, handoffPlugin, memoryPlugin, systemPlugin, httpPlugin, browserPlugin, screenLocalPlugin, computerUsePlugin, platformPlugin, mcpPlugin, moduleGenPlugin, editPlugin, messagingPlugin, visualEditingPlugin, whistlePlugin

Each plugin = (ctx: ToolPluginContext) => ToolHandler[]. Tools filtered by VittoLayer (layer-based access control). Real-time dependencies (bridge, sandbox) dynamically filtered.

Memory Architecture (Tiered)

Memory types: conversation, task_execution, code_review, decision, learning, user_preference, correction, space_context, documentation, visual_capture.

Time-decay model with decayProtected flag. Consolidation job synthesizes old memories into learning type summaries via Haiku.

Security Layers (6 deep)

1. Prompt injection guard — 50+ regex patterns (warn-only since S159)
2. Credential redactor — strips keys/tokens/passwords from tool output
3. Secret vault — AES-256-GCM, key rotation, scope-based (global/space/skill/user)
4. Hash chain verifier — tamper-evident audit logs
5. Retention policy — GDPR compliance
6. Sandbox layers — Process → Container → Firecracker microVM

2.2 backend-ai-api

Role: AI intelligence data layer. Decision tracking, learning pipeline, chat persistence, computer use. Port: 3001 | Databases: 5 separate MongoDB connections | Deployment: Railway

Module Inventory (18 modules)

5 MongoDB Databases

Intelligence Pyramid (Learning Pipeline)

The full end-to-end pipeline:

1. CAPTURE   → MCP log_decision → DecisionService.create() → MongoDB decisions
2. EMBED     → generateAndStoreEmbedding() (async) → OpenAI embedding → ai-memory
3. EPISODE   → EpisodicMemoryService.storeEpisode() (async) → ai-mcp-dev.episodes
4. TRIGGER   → AdaptiveTriggerService.onNewDecision() → 5 trigger types
5. OUTCOME   → OutcomeDetectorService (cron) → processes pending outcomes
6. MINE      → PatternMiningJob every 6h → groups decisions → upserts learned_patterns
7. PROMOTE   → Patterns ≥3 uses + ≥80% success → CoreRule (daily at 1am)
8. DISTRIBUTE → getPyramidContext(task) → injected into system prompts
9. GOLDEN    → GoldenDecisionService → manually/auto-promoted exemplars
10. CALIBRATE → CalibrationService → agent confidence calibration

Additional intelligence services:

• Code DNA Fingerprinting (CodeDnaService) — structural pattern matching
• Decision Time Machine (DecisionTimeMachineService) — temporal analysis
• Collective Intelligence (CollectiveIntelligenceService) — cross-agent aggregation
• Anonymous Pattern Extractor — privacy-preserving cross-user mining

Conversation Genome

ConversationGenomeService.compile() uses Haiku to extract structured JSON: topics, decisions (what/why/status), facts (fact/confidence/source), userIntent, openQuestions, artifacts. Generates OpenAI embedding. Stored on session document. 10-30x token reduction vs raw history.

Tiered compression: Tier 1 (0-24h) full, Tier 2 (1-30d) summarized, Tier 3 (30d+) memory-extracted. Auto-archival at >100 messages AND >7 days inactive.

Computer Use Loop

Full Anthropic computer_20251124 observe-think-act loop:

• Max: 75 iterations, 10 min timeout, 20 sessions/user, 50 global
• Actions: screenshot, click (left/right/middle/double/triple), type, key, scroll, mouse_move, drag, hold_key, wait
• Persistent VMs: Snapshot/restore lifecycle (7-day expiry)
• Question handling: 5-min wait for human reply (2FA, CAPTCHA)
• Stuck detection: ComputerUseSupervisorService polls every 10s, score ≥0.8 → corrective prompt

LLM Resilience

• LlmResilienceService: Circuit breaker (5 failures → trip, 60s reset, 2 half-open)
• Exponential backoff retry (max 2)
• Bottleneck rate limiter: 3 concurrent, 60/min, 1000ms min spacing
• ResponseCacheService: Exact-match cache for chat responses

2.3 Integration & Data Flow

Frontend message
  ↓
backend-vitto-api ENGINE (3003)
  → ContextAssemblyService loads:
    - User Dossier + space brief
    - Channel-filtered session history
    - Agent memories from backend-ai-api
    - Persona + behavioral sliders
  → RequestClassifierService → 3-path routing:
    - CONVERSATION → Haiku direct
    - COMMAND → Sonnet
    - COMPLEX TASK → 4-phase pipeline
  → AgentLoopService → 17 tool plugins
  ↓
backend-ai-api WORKLOAD (3001)
  → MCP gateway or module generation
  → LLM calls tracked for cost
  → Episodic memory + outcome feedback
  → Learning pipeline
  ↓
Response → OutcomeFeedback → EpisodicMemory → PatternMining → SkillExtraction

Database Segregation

Rule: No cross-database writes. Vitto → AI handoff is HTTP (idempotent).

2.4 Desktop Control Infrastructure

Three distinct control planes:

Control Plane 1: Remote VM Sandbox (Production Path)

Sandbox Provider Factory (priority selection):

1. SANDBOX_SERVER_URL → SelfHostedProvider (Hetzner Firecracker)
2. E2B_API_KEY → E2BCloudProvider (Firecracker microVMs)
3. Fallback → PlaywrightProvider (headless browser)

Sandbox Orchestrator (APIs/sandbox-orchestrator/):

• Full NestJS API, deployable on dedicated Linux server with KVM
• Firecracker microVM lifecycle: spawn, SSH keypair, TAP networking, VNC
• VM specs: 2 vCPU, 2048 MiB RAM (configurable), max 30 concurrent
• Rootfs: Linux + XFCE desktop + Chrome + VNC + xdotool + scrot + SSH
• Full snapshot lifecycle: create, restore, delete, per-user state
• VNC proxy via WebSocket at /vnc/:sessionId
• All VM interaction over SSH with ControlMaster (2-5ms reuse)

Control Plane 2: Local Machine Bridge

Two existing implementations:

Protocol (LocalBridgeGateway): Socket.IO on /local-bridge namespace. One bridge per user (supersede on reconnect). Timeouts: tool exec 30s, screen capture 15s, page action 10s.

Security: Three-tier model — sandboxed (allowlist: nx, git, yarn, node, etc.), trusted (adds macOS automation), unrestricted (no filtering).

Gap: Neither the Node.js bridge nor the Tauri app are shipped as daemons. No launchd/systemd registration. No heartbeat loop. The Tauri Angular service dies after 10 failed reconnection attempts.

Control Plane 3: Backend Host Desktop

DesktopService executes on the server running backend-ai-api:

• @jitsi/robotjs (native N-API) with xdotool fallback
• Profile-gated: dev (full), standard (limited), restricted (production — blocks screen capture)
• Useless in Railway production. Only relevant for self-hosted deployments.

8 Service Profiles

Each profile has: credentialFields[], systemPromptHint, suggestedTasks[], uiKnowledge (navigation patterns), persistentByDefault.

3. Competitive Landscape

3.1 OpenClaw Deep Dive

What it is: Open-source, self-hosted, local-first AI agent framework. Created by Peter Steinberger (Nov 2025). Renamed from "Clawdbot" → "Moltbot" → "OpenClaw" (Jan 2026). Steinberger joined OpenAI Feb 2026. Project under 501(c)(3) foundation.

Key stats: 302K+ GitHub stars (fastest-growing OSS project ever). 1,075+ contributors. 54,900+ forks.

Architecture

4-layer stack:

1. Channel Adapters — 50+ platforms (WhatsApp, Telegram, Discord, Slack, Signal, iMessage, Teams, Matrix, IRC, LINE, WeChat, etc.)
2. Gateway — Single Node.js process on ws://127.0.0.1:18789
3. Agent Layer — Multiple isolated agents with SOUL.md + AGENTS.md
4. Skill Plugins + Memory — 100+ skills on ClawdHub, file-based SQLite memory

What OpenClaw Does Better Than Vitto

What Vitto Does Better Than OpenClaw

OpenClaw Weaknesses

• Security: CVE-2026-25253 enabled unauthenticated WebSocket → full RCE. Default config has zero sandboxing. 12-20% of ClawHub skills are malicious per security audits.
• Not multi-tenant: Single-user personal assistant. GoClaw (Go port) adds multi-tenancy but is third-party.
• Memory at scale: File-based (SQLite + Markdown). Criticized as "broken" for larger-scale use. No vector DB natively.
• No CU loop: Desktop control relies on community skills (Clawd Cursor, guicontrol). Not first-party.
• Cost control: No built-in cost guards. Token usage spikes during multi-step automation.
• "Star inflation": 302K stars may reflect hype over production usage.

3.2 Tier 1: Direct Threats

OpenAI — ChatGPT Agent (replaces Operator)

• What: Cloud VM browser agent built into ChatGPT. Uses CUA model (GPT-4o vision + RL).
• Architecture: OWL (OpenAI's Web Layer) — isolated Chromium sessions via StoragePartition. Ephemeral by design.
• Benchmarks: 38.1% OSWorld, 58.1% WebArena, 87% WebVoyager.
• Pricing: Pro $200/mo, Plus $20/mo, Team. API: $3/$12 per M tokens.
• Strengths: Massive distribution (ChatGPT user base), self-corrects, combines browsing + deep research.
• Weaknesses: No desktop control, no persistent memory, no multi-channel, session-only, US-first, tasks take 5-30 min.
• Threat to Vitto: Medium. Different target — consumer vs. B2B SaaS. But sets expectations.

Google — Project Mariner + Chrome Auto Browse

• What: Web browsing agent on Gemini 2.0. Up to 10 simultaneous tasks. Chrome Auto Browse uses Gemini 3.
• Architecture: Cloud VMs with scoped permissions. Live view of tasks.
• Benchmarks: 83.5% WebVoyager (SOTA at launch).
• Pricing: $249.99/month (AI Ultra), US-only.
• Strengths: Google ecosystem (Search, Gmail, Calendar, Maps), Chrome distribution (billions of users), Astra's multimodal vision.
• Weaknesses: Very expensive, browser-only, no desktop, Astra is still research.
• Threat to Vitto: Medium-high. Deep Google integration could absorb market. But $250/month limits adoption.

Microsoft — Copilot Studio Computer Use + Work IQ

• What: Agents on Windows 365 VMs. Copilot Vision (observe-only). Work IQ = persistent memory across M365 ecosystem. Copilot Cowork powered by Claude (announced March 2026).
• Architecture: Cloud-based (Windows 365 VMs for CU, M365 for agents). Multi-model (OpenAI + Claude + own models).
• Pricing: M365 licensing (~$30/user/month enterprise).
• Strengths: Deepest enterprise integration (M365), Work IQ (genuine persistent cross-app memory), massive customer base, multi-model.
• Weaknesses: Vision can see but not act, CU in preview (US only), complex licensing, Windows/M365 lock-in.
• Threat to Vitto: HIGH. Work IQ is the closest thing to Vitto's Dossier + Intelligence Pyramid. Microsoft has Fortune 500 distribution.

Simular — OS-Level Desktop Control

• What: Full OS-level Mac agent. Moves mouse, clicks, types across ANY application — not just browsers.
• Funding: $21.5M Series A (Felicis, Nvidia NVentures).
• Strengths: True desktop control (not browser-only). What Vitto's Tauri app could become.
• Weaknesses: Local-only, early stage, Mac-only (Windows coming).
• Threat to Vitto: Medium. Niche (Mac power users) but represents the ideal Vitto local experience.

Perplexity — Computer + Comet Browser

• What: Dedicated Mac mini ($599) that runs 24/7 as a digital worker. Comet = AI-native browser. $200/month Perplexity Max.
• Strengths: "Jarvis as hardware" — always-on, audit trails, kill switch, dedicated compute.
• Weaknesses: Separate machine (not on YOUR computer), expensive ($599 + $200/mo).
• Threat to Vitto: HIGH conceptually. This is the closest to Vitto's vision. But hardware = friction. Vitto's daemon approach (software on existing machine) is better UX.

Rabbit R1 + DLAM

• What: $199 hardware + DLAM (Desktop Large Action Model) — USB tethered desktop control.
• Strengths: $199 with no subscription. DLAM controls any desktop via USB + browser screen sharing. OpenClaw integration.
• Weaknesses: Hardware-dependent, limited ecosystem, initially poor reviews.
• Threat to Vitto: Low. Hardware niche. But DLAM's approach (USB tethered screen sharing) is clever and cheap.

3.3 Tier 2: Partial Overlaps

3.4 Tier 3: Infrastructure Plays (Potential Partners)

3.5 Master Comparison Table

4. Desktop Control — Detailed Comparison

Vitto vs. OpenClaw — Desktop Control Scorecard

Vitto vs. Industry — CU Benchmarks (Where Available)

Action needed: Benchmark Vitto's CU loop against WebVoyager and OSWorld to establish competitive position.

5. Where Vitto Has No Competition

These capabilities are genuinely unique in the market as of March 2026:

5.1 Intelligence Pyramid — Continuous Outcome-Based Learning

No competitor learns from its own outcomes. ChatGPT, Mariner, Copilot, OpenClaw — they all have static memory (store facts, recall facts). Vitto mines decisions into patterns, promotes patterns into rules, and injects distilled intelligence into every future interaction. This is compound intelligence.

Metric: 12K+ decisions, 563 learned patterns, auto-promotion at ≥3 uses + ≥80% success rate.

5.2 Smart Model Routing with Failover

No competitor dynamically routes by task complexity AND has circuit-breaker failover across 5 providers. OpenClaw supports 20+ providers but with manual selection. OpenAI/Google/Microsoft use their own models exclusively.

Metric: 60-90% cost savings on simple tasks. Zero downtime during single-provider outages.

5.3 User Dossier + Job Mastery Tracking

Microsoft's Work IQ is the closest, but it's M365-scoped. Vitto builds a comprehensive user intelligence profile (expertise, patterns, avoidances, job competency progression) that crosses all channels and tasks.

5.4 Conversation Genome (10-30x Token Compression)

Google's Always-On Memory Agent uses simple SQLite. Mem0 uses vector+graph. Nobody uses LLM-driven structured extraction (topics, decisions, facts, artifacts) with tiered compression and automatic archival.

5.5 6-Phase Code Generation + Live Preview

Devin operates in a sandbox with no live preview. GitHub Copilot generates snippets, not full modules. Vitto's pipeline (ENHANCE → ANALYZE → DECOMPOSE → PLAN → EXECUTE → INTEGRATE) with in-browser rspack WASM compilation and ESM SDK is unmatched.

5.6 Multi-Channel + CU + Learning in One System

This is the key differentiator. No single competitor combines:

• ✅ 5+ messaging channels (with cross-channel bridge)
• ✅ Full computer use with VM sandbox
• ✅ Continuous learning pipeline
• ✅ Proactive monitoring and digests
• ✅ User dossier with persona adaptation
• ✅ Code generation with live preview

6. Critical Gaps & Technical Debt

6.1 Critical Issues (High Confidence, Real Impact)

GAP-01: Embedding Search Is Broken [Confidence: Certain]

LearningService.isEmbeddingEnabled() in backend-ai-api returns false because setEmbeddingClient() is never called. Embeddings are generated and stored (via DecisionService.generateAndStoreEmbedding()) but never queried semantically. The entire "find similar decisions" falls back to keyword search.

Impact: The Intelligence Pyramid's recall quality is fundamentally degraded. Like building a search engine with only exact string match. Fix: Wire setEmbeddingClient() in module initialization. ~0.5 session.

GAP-02: No Eval Framework [Confidence: Certain]

No golden datasets. No LLM-as-judge. No A/B testing. No regression testing on prompt changes. No quality metrics over time. The Intelligence Pyramid mines patterns from outcomes, but nobody evaluates whether outcomes themselves are correct.

Impact: Every change to prompts, routing, or memory is a coin flip. We can't prove quality is improving. Fix: 50 golden Q&A pairs + nightly Haiku LLM-as-judge scoring + MongoDB storage + regression alerts. ~2 sessions.

GAP-03: Chat Proxy Polling [Confidence: Certain, Severity Revised: Low]

POST /vitto-api/engine/chat uses a 200ms polling loop for up to 60s. However, verification revealed the web UI already uses SSE via POST /engine/message → GET /engine/message/:taskId/stream. The polling loop only affects backend-ai-api's ChatService.proxyToVitto() (feature-flagged via CHAT_USE_VITTO_PROXY=true).

Impact: Low — web UI is unaffected. Only relevant when the ai-api proxy path is enabled. Fix: Replace while loop with lastValueFrom subscription on the existing SSE stream subject. ~0.5 session.

GAP-04: Cost Tracker Shows $0.00 [Confidence: Certain, Root Cause Verified]

Five stacked bugs make cost tracking non-functional (verified 2026-03-17):

1. vitto.controller.ts:356-360 — Controller returns usage without a cost field. Frontend reads response.usage?.cost which is always undefined.
2. cost-tracker.service.ts:104-123 — onModuleInit() loads userBudgets from MongoDB but NOT spendingHistory. After restart, getSpendingStats() returns empty.
3. vitto-engine.service.ts:191-198 — task.cost.provider/model set from static config at creation, never updated after SmartRouter routing. Wrong model in pricing lookup on failover.
4. phase-executor.service.ts:394-430 — handleTeachIntent() hardcodes tokens: {input:0, output:0} and never calls recordSpending(). All skill generation tasks untracked.
5. cost-tracker.service.ts:250-310 — getSpendingStats() reads only in-memory array. Fixed by bug 2's rehydration.

Impact: Frontend always shows $0.00. Daily digest shows $0.00 after restart. Dollar-based budgets are theater. Fix: 5 targeted fixes across 4 files. See spec 2026-03-17-vitto-jarvis-evolution-spec.md §1.2. ~1 session.

GAP-05: Local Bridge Not Shipped as Daemon [Confidence: Certain]

Tauri app and Node.js bridge both exist. Neither has launchd/systemd daemon registration. Neither has a heartbeat loop. Angular bridge dies after 10 reconnection attempts.

Impact: The "Jarvis on your machine" story is architecturally ready but not deployable. Fix (verified simpler than expected): Daemon mode is a 1-line config change ("visible": true → false in tauri.conf.json). Close-to-tray and exit prevention already work. AutoStart via LaunchAgent already registered. Needs: infinite reconnection in Angular bridge (change reconnectionAttempts: 10 → Infinity in vitto-screen-capture.service.ts:74), plus heartbeat service. ~1-2 sessions.

GAP-06: No Browser Session Persistence [Confidence: Certain]

Every CU session launches a fresh browser. Users must re-authenticate to every service every time.

Impact: Massive UX friction for any CU task on authenticated services. OpenClaw's Extension Relay and Browserbase Contexts API solve this. Fix: Use VM snapshot to preserve browser profile (Chrome user data directory on persistent rootfs). ~1-2 sessions.

GAP-07: No Voice Pipeline [Confidence: Certain]

Voice note upload exists (S216 Gap 9). Whisper transcription deferred (S216 Gap 10). No STT → agent pipeline. No TTS response. No wake word.

Impact: Voice-to-action is a key "Jarvis" UX differentiator. OpenClaw, Rabbit, and Apple Intelligence all have voice. Fix: Whisper API (STT) + ElevenLabs/browser SpeechSynthesis (TTS) + Tauri push-to-talk. ~2 sessions.

6.2 Non-Critical Improvements (Pragmatic, High Value)

GAP-08: No OpenTelemetry [Confidence: Certain]

No distributed tracing across backends. Custom JSON health endpoint, not Prometheus format. Sandbox orchestrator already has Prometheus — backends don't.

Fix: Add OTEL spans on LLM calls, tool executions, memory recalls. Export to Grafana/Jaeger. ~2 sessions.

GAP-09: No Browser Extension Relay [Confidence: Certain]

Can't control existing Chrome tabs with preserved login state. Always requires fresh isolated browser.

Fix: Build Chrome extension (Manifest V3) connecting to LocalBridgeGateway. Attaches Chrome Debugger API to tabs. ~3 sessions.

GAP-10: No Credential Management [Confidence: Certain]

No OAuth delegation, no password manager integration, no human-takeover UX for password entry.

Industry standard: Composio (500+ services), Nango (700+ APIs, self-hostable), 1Password XAM. Fix: Integrate Composio or Nango for OAuth. Add VNC-based human takeover for password entry. ~3 sessions.

GAP-11: No Action Memory for CU [Confidence: Certain]

CU sessions are fire-and-forget. ComputerUseAuditService keeps an in-memory log (10K entries, no DB). No "last time I logged into Gmail, I clicked X then Y" memory.

Fix: Wire CU completion → VittoMemoryService.remember() with type task_execution. ~1 session.

GAP-12: VittoController God Object [Confidence: Certain]

35+ constructor dependencies. Despite refactoring claims in S161-162, still a monolith.

Fix: Split into domain controllers (chat, tasks, monitoring, admin). ~2 sessions.

GAP-13: Health Check MongoDB Stub [Confidence: Certain]

GET /health/components MongoDB check in backend-ai-api is a stub — no actual ping. latencyMs always ~0.

Fix: Add db.admin().ping() call. ~10 minutes.

GAP-14: Only 5 Messaging Channels [Confidence: Certain]

OpenClaw has 50+. We have WhatsApp, Slack, Discord, Telegram, Email. Missing: Teams, Signal, iMessage, Matrix.

Fix: Teams is the priority for enterprise. @libs-api/messaging-core adapter pattern makes each channel ~1 session.

6.3 Nitpicks

• ComputerUseLoopService uses setTimeout internally — violates codebase "no setTimeout" rule
• session_counter collection @Prop() not marked required — migration incomplete
• Pattern mining category mapping is a hardcoded table that misclassifies implementation as angular and bugfix as backend
• VITTO_MASTER_KEY not set = ephemeral encryption key; secrets lost on restart

7. Architecture Patterns — Industry State of the Art (2026)

7.1 Persistent Browser Sessions

Recommendation for Vitto: VM snapshot approach (already have Firecracker infra) + Browserbase Contexts API for lighter-weight persistence.

7.2 Credential Management

Recommendation for Vitto: Tier 2 (Composio/Nango) for API services + Tier 1 (VNC human takeover) for browser-only services.

7.3 Always-On Agent Architecture

Recommendation for Vitto: Heartbeat daemon (Tauri app with launchd) + cloud-side proactive monitoring (ProactiveModule already exists).

7.4 VM Snapshot Technology

7.5 Memory — Industry Convergence

Two camps:

1. Vector + Graph hybrid (Mem0, Zep) — 26% accuracy boost, 91% lower latency. Production standard.
2. LLM-driven over simple storage (Google's SQLite, Manus filesystem) — simpler to operate.

Vitto's position: Closer to camp 1 (vector embeddings in MongoDB) but without graph layer. Adding knowledge graph edges (Vitto already has KnowledgeGraphService) could match Mem0.

7.6 CDP Is Universal

Every browser agent uses Chrome DevTools Protocol: OpenClaw, Browserbase/Stagehand, Chrome DevTools MCP, Nanobrowser. The protocol question is settled.

7.7 Auth Delegation Is Mandatory

Raw credential handling by agents is a non-starter for production. The pattern: OAuth flow handled by platform → tokens in encrypted vault → agent gets reference ID → platform executes on agent's behalf.

Emerging standard: Cross App Access (XAA) — extends OAuth, moves consent to Identity Provider.

8. Strategic Differentiators & Business Moats

8.1 Compound Intelligence (Deepest Moat)

Every Vitto interaction makes future interactions better. This is a network effect at the individual user level and a data advantage at the platform level. No competitor has this.

How to deepen: Close the outcome loop (fix embedding search → improve recall → better pattern mining → stronger core rules → better decisions → better outcomes → repeat).

8.2 Cost Efficiency via Smart Routing

60-90% savings on simple tasks by routing to cheap models. As LLM costs decrease, this advantage compounds — we're always using the cheapest model that's good enough. Competitors using single-model approaches (OpenAI, Google) pay full price for every query.

8.3 Multi-Channel Convergence

User sends a WhatsApp message → Vitto responds with awareness of their web chat history, their CU session on Gmail, and their space context. No competitor bridges channels with shared intelligence.

How to deepen: Cross-channel genome — unified memory that spans WhatsApp + web + desktop interactions for the same user.

8.4 Code Generation Pipeline

Platform generation (NL → full Angular application with CRUD, routing, theming) is a category of its own. No competitor generates and deploys full platforms. Devin writes code in a sandbox; Vitto builds businesses.

8.5 Proactive Intelligence

7 cron-driven monitoring services + space intelligence + anomaly detection + daily digests. Add heartbeat daemon + user-facing proactive actions, and Vitto becomes an always-aware assistant that surfaces insights before the user asks.

8.6 Business Model Advantage

OpenClaw is free (MIT). ChatGPT Agent is $20/mo. Mariner is $250/mo. Vitto can position as:

• For individuals: Cheaper than Perplexity ($200/mo) or Mariner ($250/mo) with more capabilities
• For teams: Cheaper than Copilot ($30/user/mo) with learning + code gen
• VWU (Vitto Work Unit) pricing: Pay per meaningful action, not per token — aligns cost with value

9. Phased Roadmap to Jarvis-Parity

Phase 1: Ship What Exists (1-2 weeks, 3-4 sessions)

Phase 2: Persistent Desktop Agent (2-3 weeks, 5-6 sessions)

Phase 3: Jarvis Parity (4-6 weeks, 8-10 sessions)

Phase 4: Moat Deepening (Ongoing)

10. Key Decisions & Open Questions

Decisions Made (This Analysis)

Open Questions (Need Verification)

11. Reference: Essential Files

backend-vitto-api (Orchestration Brain)

backend-ai-api (Intelligence Layer)

Sandbox Orchestrator

Desktop Client

Architecture Documentation

Last updated: 2026-03-17, Session S225.4 Next review: After Phase 1 completion Owner: Engineering (fguijarro)