The first 1.0. aigent-OS now maintains itself on a cadence, enforces its own routing rules in code rather than convention, and stops losing your work at the edges of a session.
Nightly self-maintenance
/nightly sequences the maintenance verbs the Roadmap already named — /dream, /reconcile, /sweep-now, /digest — plus a /system-check gate and a ledger-review pass over the measurement layer, into one evidence-gated pass over your own vault.
Every leg is gated by the cadence its own skill documents, so a leg with nothing to do is skipped and recorded as skipped rather than run redundantly. Human-gated legs stay exactly as human-gated as they are standalone: dream and digest propose and stage only, and the ledger leg resolves a claim only when confirming evidence already exists in your vault, never by guessing.
Manual, cron, and Windows Task Scheduler recipes are in docs/nightly-self-maintenance.md.
Zero-leak lifecycle
Three hooks close the crash windows the Stop-hook capsule writer cannot cover on its own:
- A write-ahead utterance journal puts your raw prompt on disk before the model sees it, so a crash between submit and Stop never loses what you said.
- A SessionEnd flush covers clear, logout, and exit — paths where Stop never fires, so without it a session's final delta died with the process.
- A PreCompact flush writes the last delta and injects a table of contents of the active capsule, so the compactor's summary carries pointers into your vault instead of swallowing the content.
Fail-soft by default, per the operator-sovereignty doctrine. LIFECYCLE_PRECOMPACT_STRICT=1 opts into blocking compaction over a capsule known to be stale. Design notes in docs/zero-leak-flush.md.
Model-tier routing, enforced in code
system/09_subagent_manifest.md's "Model: Fast/Mid/Frontier" field has always been a convention for the operating Claude to follow. It is now read at dispatch time: a PreToolUse hook resolves each sub-agent dispatch against its installed agent definition and checks the requested model against the declared tier.
Advisory by default — it prints a named correction and never blocks, matching this repo's suggest-don't-block hook doctrine. AIGENT_MODEL_GUARD=enforce opts into a hard block.
A second executor
daemons/codex-adapter.sh routes one bounded, mechanical task class to the Codex CLI's non-interactive mode: the first working non-Claude executor in this repo. It never commits and never pushes. Every run writes its output, a working-tree diff, and a status file for review under the same gate as any sub-agent diff.
Deliberately scoped to a single task class. Routing by task class and additional CLIs behind the same interface are on the Roadmap, not in this release.
Security
Install-path hardening closes five findings from an external review: symlink-escape refusal inside the target directory, quarantine of pre-existing files in trusted trees (hooks/, daemons/, skills, agents, rules) instead of silently keeping them, --ignore-scripts on the optional dependency install, explicit-remote fetch in the web installers to close a rogue tracking-config path, and a documented checksum-pinned bootstrap as the recommended alternative to curl | sh.
Full detail, including everything omitted here, is in CHANGELOG.md.