mohabbis · mohabbis · Aug 30, 2026 · Aug 30, 2026 · Aug 30, 2026
@@ -32,6 +32,10 @@ those tiers are live. Working name may change.
 
 - **Trust runtime** — agents cannot approve sensitive steps; Ghost owns the
   gate, verify, and audit. Generic agents become clients, not competitors.
+  *Qualified:* browser-automation competitors now sell human-in-the-loop as an
+  enterprise feature, and the infrastructure layer ships it as a primitive. What
+  is defensible is the narrower claim — a deterministic, non-model gate over a
+  typed schema plus a tamper-evident chain. See `competitive-landscape.md`.
 - **Hybrid execution** — APIs → browser → desktop → vision. Works where clean
   integrations don't exist.
 - **Accumulated workflow IP** — each configured, approved workflow raises

@@ -1,9 +1,12 @@
 # Competitive landscape
 
 Ghost sells **governed execution**: a human-approved, verified, audited pipeline over
-software that was never designed to be automated. That is a narrow category, and the
-products it gets compared to mostly sit in *adjacent* categories — context layers,
-assistants, RPA, and workflow orchestrators.
+software that was never designed to be automated. It is a narrower category than the
+automation market as a whole — but it is **not an empty one**, and an earlier version of
+this document wrongly recorded it as such. One competitor (Skyvern) is head-on; the
+infrastructure layer below Ghost has begun shipping approval gating as a primitive; the
+rest sit in genuinely adjacent categories — context layers, assistants, RPA, model
+governance, and workflow orchestrators.
 
 `cloud/docs/PRIOR_ART.md` covers the open-source orchestrators (Temporal, Camunda,
 Windmill, n8n, …) as engineering prior art. This document covers **commercial
@@ -14,18 +17,200 @@ The map:
 
 | Category | Example | Relationship to Ghost |
 |---|---|---|
-| **Ambient context layer** | [Littlebird](#littlebird) | Adjacent above — analyzed below |
-| Governed execution / trust runtime | *(no named direct competitor yet)* | Ghost's category |
+| **Governed browser execution** | [Skyvern](#skyvern--the-head-on-competitor) | **Head-on.** Same shape, shipped, certified, funded |
+| **Browser infrastructure** | [Browser Use, Cloudflare Browser Run](#the-commoditisation-vector) | Below Ghost — and now shipping approval as a platform primitive |
+| **Approval-gate SDK** | [HumanLayer](#humanlayer--the-cautionary-tale) | Vacated the category. Read the note before celebrating |
+| AI governance / model risk | Fiddler, Credo AI, OneTrust, ModelOp | Adjacent above — govern *models and policy*, don't execute work |
+| Ambient context layer | [Littlebird](#littlebird) | Adjacent above — analyzed below |
 | Agent frameworks | Claude, Cursor, Codex | **Clients**, not competitors — they propose, Ghost gates |
 | No-code automation | Zapier, Make, n8n Cloud | Connectors without a trust pipeline — explicit non-goal |
 | Enterprise RPA | UiPath, Automation Anywhere | Same problem, coordinate-first, no approval-gate story |
 | Screen-recall / memory | Rewind, Windows Recall | Same layer as Littlebird, weaker on privacy stance |
 
-Only Littlebird is analyzed in depth so far. The rest are named to keep the map honest,
-not because a survey of each has been done.
+> **Correction, 2026-08-30.** An earlier version of this table listed Ghost's own row as
+> *"Governed execution / trust runtime — (no named direct competitor yet)."* That was
+> wrong, and wrong in the most expensive direction: it let the strategy treat an
+> unexamined category as an empty one. The row is filled in below. A category with no
+> named competitor is nearly always a category defined too narrowly to be a market, or
+> one nobody has looked at properly. This was the second.
+
+Littlebird, Skyvern, HumanLayer and the browser-infrastructure layer are analyzed below.
+The remaining rows are named to keep the map honest, not because a survey of each has
+been done.
+
+---
+
+## Skyvern — the head-on competitor
+
+> **Sourcing caveat.** `skyvern.com` is blocked by this environment's network egress
+> proxy. The GitHub repository was reachable and is quoted directly; **pricing, tier
+> contents, SOC 2 / HIPAA status, user counts and customer names are secondary-source**
+> (search summaries of the vendor's own pricing and blog pages). Re-verify against the
+> product before any of this reaches a pitch or a comparison page.
+
+### What it is
+
+An open-source AI browser-automation platform: LLMs plus computer vision driving a
+browser through workflows defined in a visual block builder (browser tasks, actions,
+data extraction, validation, loops, file parsing, email, HTTP requests, custom code).
+Y Combinator-backed. **22.9k GitHub stars.** Self-hostable via pip or Docker Compose.
+2FA/TOTP support, password-manager integrations (1Password, Bitwarden, LastPass),
+Zapier/Make/n8n integrations.
+
+**It is licensed AGPL-3.0.** Same licence as Ghost.
+
+Reported commercially: a free tier (5,000 credits), Hobby at $29/mo, Pro at $149/mo,
+and an Enterprise tier carrying **SOC 2 Type II, HIPAA, Azure Key Vault, and
+"human-in-the-loop for compliance-sensitive steps."** Reported 30,000+ users, with named
+customers including **Pilot** (bookkeeping) and **Legion Health** (healthcare admin).
+
+### Why this is the row that matters
+
+Read Ghost's own ICP back: *"wholesale distributors, property managers,
+accounting/bookkeeping firms, logistics, recruiting, financial-ops and healthcare-admin
+teams."* Skyvern's publicly named customers include a bookkeeping company and a
+healthcare-admin company. This is not an adjacent category. It is the same buyer, being
+sold the same job, by a funded company with a SOC 2 report and 22.9k stars.
+
+| Capability | Skyvern | Ghost Cloud |
+|---|---|---|
+| Browser execution across arbitrary sites | **Yes**, LLM + CV, shipped at scale | Yes — typed steps, Playwright |
+| Workflow authoring | **Visual block builder**, shipped | Typed step editor; recording → steps is Phase 2 |
+| API / HTTP actions | **Yes** — HTTP request + email blocks | **No** — `apiCall`/`sendEmail` are in `UNIMPLEMENTED_ACTION_TYPES` |
+| 2FA / password-manager integration | **Yes** (TOTP, 1Password, Bitwarden) | No |
+| Human approval before sensitive actions | **Yes** — but an Enterprise-tier *feature* | **Yes** — deterministic `classifyStep`, architectural, every tier |
+| Gate decided by a pure function, not a model | Not evidenced | **Yes** — this is the differentiator |
+| Per-step outcome verification | Run summaries "detailing each action and why" | **Yes**, explicit verification step |
+| Hash-chained tamper-evident audit | Audit trail, not evidenced as tamper-evident | **Yes**, two-level chain |
+| Incidents / undo / compensation | Not evidenced | **Yes**, approval-gated, with documented limits |
+| SOC 2 Type II / HIPAA | **Yes** (Enterprise) | **No** |
+| Self-serve free tier | **Yes** | **No** |
+| Stars / users | 22.9k / 30k+ reported | 1 / 0 |
+
+Ghost wins exactly three rows, and they are all the same row wearing different hats: the
+gate is deterministic, the audit is tamper-evident, and undo exists. Everything else is
+either a tie or a loss, and the losses include both procurement blockers (SOC 2) and the
+entire top of the funnel (free tier, stars, a visual builder).
+
+### The one real differentiator, stated precisely
+
+For Skyvern, human-in-the-loop is **a feature on the Enterprise plan for
+compliance-sensitive deployments**. For Ghost, the approval gate is **the architecture**:
+`classifyStep` is a pure function over the step definition, it runs on every tier, and no
+model participates in the decision. Those are genuinely different products even though
+the feature matrix rhymes.
+
+The difference is legible to an auditor and mostly illegible to a buyer. "We also have
+human-in-the-loop" wins the demo. "Our gate is a pure function so it cannot be prompted
+into skipping" wins the security review — *if the deal survives to a security review*,
+which requires SOC 2, which Ghost does not have.
+
+**That is the strategic sequence, and it is not the one currently being executed.** The
+deterministic gate is only worth anything at the stage of a deal that Ghost cannot
+currently reach.
+
+### What this kills
+
+**The AGPL objection, as usually stated.** Skyvern is AGPL-3.0, sells to enterprise,
+holds SOC 2 Type II and HIPAA, and lists named regulated customers. AGPL is demonstrably
+not what stops a governed-browser-execution company from closing regulated buyers. Ghost
+is additionally single-copyright-holder, so a commercial dual-licence is available at any
+time. Park this objection; it is not the constraint.
+
+**"No named direct competitor yet."** Deleted above.
+
+---
+
+## The commoditisation vector
+
+The threat that does not come from a competitor at all.
+
+**Browser Use** — SOC 2 Type II as of October 2025, free tier, cloud from ~$24/mo.
+**Cloudflare Browser Run** — added **human-in-the-loop**, CDP access, and session
+recordings in early 2026: a person takes over the same remote browser session, and
+automation reconnects to that session rather than restarting.
+
+Cloudflare shipping HITL as a platform primitive is the concrete form of the argument
+that approval gating is *"a checkbox every agent framework will eventually ship for free
+as a config flag."* It is not a hypothetical; it happened, at the infrastructure layer,
+below where Ghost sits.
+
+What survives commoditisation, and what does not:
+
+- **Does not survive:** "we pause for a human." That is now infrastructure.
+- **Does not survive:** "we log what the agent did." Every platform in the map claims an
+  audit trail.
+- **Survives, narrowly:** a gate that is a *pure function over a typed step schema*,
+  producing an audit chain that is *tamper-evident* rather than merely written down, with
+  a *verification* step and a *compensation* path. That is a specific engineering claim
+  competitors are not making, and it is checkable.
+
+The gap between those two lists is thinner than `product-direction.md` currently assumes,
+and it is closing from below.
 
 ---
 
+## HumanLayer — the cautionary tale
+
+Frequently cited as proof the approval-gate category is crowded. The reality is more
+interesting and worse.
+
+HumanLayer (YC F24, founded by Dexter Horthy) launched as exactly the thing Ghost is
+sometimes accused of duplicating: an API and SDK letting tool-calling agents pause and
+request human approval, routed over Slack and email, framework- and model-agnostic,
+Python and TypeScript SDKs. The open-source repo passed 11k stars.
+
+**It then left the category.** HumanLayer today is *"the multiplayer control plane for
+your software factory"* — an IDE and collaborative cloud platform (internally CodeLayer)
+for orchestrating parallel AI coding-agent sessions on top of Claude Code. Not approval
+infrastructure. Coding-agent orchestration.
+
+Two readings, and honesty requires holding both:
+
+**The comfortable one.** A pure approval SDK is a thin layer with no execution surface,
+no workflow IP, and nothing to bill for once frameworks ship interrupts natively.
+LangGraph, Temporal and now Cloudflare all have a version of it. HumanLayer's exit from
+the category is evidence that *approval-as-a-library* is not a company — which is Ghost's
+own argument for why it executes rather than merely gating.
+
+**The uncomfortable one.** The team that went deepest on human-in-the-loop
+infrastructure, with YC behind them and 11k stars of distribution, concluded the best
+available move was to go build something else. That is a data point about the category's
+pull, and Ghost is deeper in it with less distribution.
+
+Ghost's defensible answer is that it is not in HumanLayer's category — Ghost executes,
+verifies, and can undo, and the gate is one component rather than the product. That
+answer is correct and it is also exactly what a company would say on its way to
+discovering the same thing HumanLayer discovered. It should be tested against a paying
+customer, not against this document.
+
+*(Funding figures for HumanLayer in secondary sources — one aggregator reports $500K
+total — are inconsistent with a standard YC deal and are not relied on here.)*
+
+---
+
+## AI governance platforms — adjacent above, not competitors
+
+Fiddler AI, Credo AI, OneTrust, ModelOp and the wider "AI governance" tool category sell
+policy packs, model registries, risk assessments and audit-ready evidence mapped to the
+EU AI Act, NIST AI RMF, ISO/IEC 42001 and SOC 2. Several now advertise runtime guardrails
+and approval workflows over agent actions.
+
+They are not competitors: they **govern and document**, they do not execute a business
+workflow. But two things follow.
+
+First, they are training the buyer's vocabulary. Terms like "policy enforcement at
+runtime," "audit-ready evidence at decision time," and "human confirmation before
+high-risk actions" are being defined by this category, and Ghost will be evaluated in
+those words whether or not it chose them.
+
+Second, EU AI Act Article 14 and the NIST framework both require demonstrable, provable
+human oversight. That is a regulatory tailwind pointed almost exactly at Ghost's
+architecture — a deterministic, non-model gate with a tamper-evident chain is a strong
+answer to "prove the human oversight was real." Nothing in Ghost's docs currently makes
+that argument, and it is the single best unused asset in the positioning.
+
+
 ## Littlebird
 
 > **Sourcing caveat.** `littlebird.ai` is blocked by this environment's network egress
@@ -163,6 +348,20 @@ out of run history, not surveillance.
 
 Framed the way `PRIOR_ART.md` frames its steals — the refusals matter as much.
 
+**The ordering changed once Skyvern was on the map.** These items were originally ranked
+against Littlebird, a product in a different category selling to a different buyer. Ranked
+instead against a funded, SOC 2 Type II, AGPL competitor with named customers in two of
+Ghost's four stated verticals, the priority is:
+
+1. **SOC 2 Type II** — the procurement blocker. Skyvern has it; Browser Use has had it
+   since October 2025. Without it Ghost never reaches the stage of a deal where its
+   deterministic gate is worth anything.
+2. **Implement `apiCall` / `sendEmail`** — Ghost's largest capability gap, already
+   flagged below, and Skyvern ships HTTP-request and email blocks today.
+3. **One self-serve path that completes** — every competitor in the map has a free tier.
+4. **A notification surface** — still the highest-leverage engineering unblock.
+5. Everything else.
+
 **Adopt: a trigger surface, and treat it as competitive, not backlog.**
 Littlebird ships scheduled recurring execution at $17/mo. `PRIOR_ART.md` lists "Triggers
 and schedules" as deferred with the note *"no trigger surface exists at all."* That
@@ -227,6 +426,39 @@ strategy puts it: after browser, before vision.
 
 ## Sources
 
+### Governed browser execution, browser infrastructure, approval SDKs
+
+- [Skyvern — GitHub repository](https://github.com/Skyvern-AI/skyvern) — the only
+  primary source in this group that was reachable; licence (AGPL-3.0), 22.9k stars,
+  block-builder feature list, self-hosting and integrations are quoted from it
+- [Skyvern pricing](https://www.skyvern.com/pricing) *(egress-blocked; tiers, SOC 2
+  Type II, HIPAA and the Enterprise human-in-the-loop line cited from search summary)*
+- [Skyvern x SOC-2](https://www.skyvern.com/blog/skyvern-x-soc-2/) *(egress-blocked;
+  cited from search summary)*
+- [Skyvern — The AI Agent Index](https://theaiagentindex.com/agents/skyvern)
+- [Skyvern Review 2026 — AI Agent Square](https://aiagentsquare.com/agents/skyvern) —
+  source of the reported user and customer counts
+- [HumanLayer](https://www.humanlayer.dev/) — current positioning, *"the multiplayer
+  control plane for your software factory"*
+- [HumanLayer — Product Hunt](https://www.producthunt.com/products/humanlayer) — original
+  human-in-the-loop-infrastructure positioning
+- [HumanLayer YC launch](https://ycombinator.com/launches/M8e-humanlayer-human-in-the-loop-for-ai-agents-and-beyond) *(egress-blocked)*
+- [HumanLayer Review 2026 — Vibe Coding Hub](https://vibecodinghub.org/tools/humanlayer) —
+  source of the CodeLayer pivot description
+- [State of Browser Use, May 2026](https://michaellivs.com/blog/state-of-browser-use-2026/)
+- [Human-in-the-Loop Cloud Browsers — Scrapfly](https://scrapfly.io/blog/posts/human-in-the-loop-cloud-browsers) —
+  source of the Cloudflare Browser Run HITL note
+- [Cloud Browser Automation Guide — Browserbase](https://www.browserbase.com/blog/cloud-browser-automation-guide-2025)
+
+### AI governance category
+
+- [9 Best AI Agent Governance Platforms in 2026 — Superblocks](https://www.superblocks.com/blog/ai-agent-governance-platform)
+- [AI Agent Risks & Guardrails: 2026 Enterprise Security Guide — Atlan](https://atlan.com/know/ai-agent-risks-guardrails/)
+- [Human-in-the-Loop: A 2026 Guide to AI Oversight — Strata](https://www.strata.io/blog/agentic-identity/practicing-the-human-in-the-loop/) —
+  source of the EU AI Act Article 14 / NIST AI RMF oversight requirement
+
+### Ambient context layer
+
 - [Littlebird raises $11 Million — PR Newswire](https://www.prnewswire.com/news-releases/littlebird-raises-11-million-to-launch-the-only-ai-that-already-knows-what-youre-working-on-302721664.html)
 - [Littlebird raises $11M for its AI-assisted 'recall' tool — TechCrunch](https://techcrunch.com/2026/03/23/littlebird-raises-11m-to-capture-context-from-your-computer-so-you-can-query-your-data/) *(egress-blocked; cited from search summary)*
 - [Littlebird — Product Hunt](https://www.producthunt.com/products/littlebird)

@@ -39,6 +39,17 @@ First money: **implementation** of one painful, measurable, reversible workflow
 (+ seats). Distribution also rides agents via **MCP / HTTP tools** (see
 `cloud/docs/AGENT_PLUGIN.md`).
 
+## Competitive position
+
+Not uncontested. `competitive-landscape.md` names one head-on competitor
+(**Skyvern** — AGPL, SOC 2 Type II, HIPAA, named customers in bookkeeping and
+healthcare admin) and records that the browser-infrastructure layer below Ghost
+has started shipping human-in-the-loop as a platform primitive. Ghost's surviving
+differentiator is narrow and specific: the gate is a **pure function over a typed
+step schema**, the audit chain is **tamper-evident** rather than merely written,
+and verification plus compensation are part of the pipeline. Read that document
+before making a positioning claim here.
+
 ## Non-goals
 
 - Not a chatbot or “AI coworker” that acts unsupervised
@@ -57,4 +68,5 @@ First money: **implementation** of one painful, measurable, reversible workflow
 ## Authoritative docs
 
 `cloud/README.md` · `cloud/docs/PHASE_1_PLAN.md` · `cloud/docs/CURSOR_HANDOFF.md` ·
-`cloud/docs/AGENT_PLUGIN.md` · `AGENTS.md` · this file · `business-model.md`
+`cloud/docs/AGENT_PLUGIN.md` · `AGENTS.md` · this file · `business-model.md` ·
+`competitive-landscape.md`