v1.0.0 — Self-maintenance and zero-leak lifecycle

The first 1.0. aigent-OS now maintains itself on a cadence, enforces its own routing rules in code rather than convention, and stops losing your work at the edges of a session.

Nightly self-maintenance

/nightly sequences the maintenance verbs the Roadmap already named — /dream, /reconcile, /sweep-now, /digest — plus a /system-check gate and a ledger-review pass over the measurement layer, into one evidence-gated pass over your own vault.

Every leg is gated by the cadence its own skill documents, so a leg with nothing to do is skipped and recorded as skipped rather than run redundantly. Human-gated legs stay exactly as human-gated as they are standalone: dream and digest propose and stage only, and the ledger leg resolves a claim only when confirming evidence already exists in your vault, never by guessing.

Manual, cron, and Windows Task Scheduler recipes are in docs/nightly-self-maintenance.md.

Zero-leak lifecycle

Three hooks close the crash windows the Stop-hook capsule writer cannot cover on its own:

• A write-ahead utterance journal puts your raw prompt on disk before the model sees it, so a crash between submit and Stop never loses what you said.
• A SessionEnd flush covers clear, logout, and exit — paths where Stop never fires, so without it a session's final delta died with the process.
• A PreCompact flush writes the last delta and injects a table of contents of the active capsule, so the compactor's summary carries pointers into your vault instead of swallowing the content.

Fail-soft by default, per the operator-sovereignty doctrine. LIFECYCLE_PRECOMPACT_STRICT=1 opts into blocking compaction over a capsule known to be stale. Design notes in docs/zero-leak-flush.md.

Model-tier routing, enforced in code

system/09_subagent_manifest.md's "Model: Fast/Mid/Frontier" field has always been a convention for the operating Claude to follow. It is now read at dispatch time: a PreToolUse hook resolves each sub-agent dispatch against its installed agent definition and checks the requested model against the declared tier.

Advisory by default — it prints a named correction and never blocks, matching this repo's suggest-don't-block hook doctrine. AIGENT_MODEL_GUARD=enforce opts into a hard block.

A second executor

daemons/codex-adapter.sh routes one bounded, mechanical task class to the Codex CLI's non-interactive mode: the first working non-Claude executor in this repo. It never commits and never pushes. Every run writes its output, a working-tree diff, and a status file for review under the same gate as any sub-agent diff.

Deliberately scoped to a single task class. Routing by task class and additional CLIs behind the same interface are on the Roadmap, not in this release.

Security

Install-path hardening closes five findings from an external review: symlink-escape refusal inside the target directory, quarantine of pre-existing files in trusted trees (hooks/, daemons/, skills, agents, rules) instead of silently keeping them, --ignore-scripts on the optional dependency install, explicit-remote fetch in the web installers to close a rogue tracking-config path, and a documented checksum-pinned bootstrap as the recommended alternative to curl | sh.

Full detail, including everything omitted here, is in CHANGELOG.md.

v0.9.0 — The Two-Verb Lifecycle

The session lifecycle is now automatic. The manual /open + /close bookends are superseded by two verbs the OS runs for itself:

• capsule — checkpoint: reconcile live state and write a resume-ready capsule (absorbs the old /close).
• resume — load that capsule, re-ground against current reality, and act (absorbs the old /open).

Background daemons + Claude Code hooks drive both, so aigent-OS checkpoints and resumes itself across session boundaries, context compaction, and clears — you don't have to remember to run anything. A fresh session picks up exactly where the last one left off, on its own.

Also in this release

• Statusline context writer — the context-refresh sensor is now live out-of-the-box on a fresh install (writes the contract the lifecycle reads). Delegation-preserving if you already run a statusline command.
• Zero-leak flush legs — SessionEnd, UserPromptSubmit WAL, and PreCompact flushes close the crash windows where in-flight state could be lost on an abrupt exit.

Thanks to Mike's team (ATLAS) for the statusline writer and flush legs.

Still markdown + shell. No database, no build step. MIT, free, open source.