A development profile for concurrent Claude Code and Codex agents

The profile requires planning, test-first implementation, documentation updates, and review before commit. One command installs it for Claude Code and Codex.

curl -fsSL https://agent.amon.io/install.sh | bash

The command installs both targets. Pass -s -- claude or -s -- codex to install one target. The script verifies the payload checksum. Inspect the script with sed -n '1,/^__PAYLOAD__$/p' before piping it to Bash.

Runs on macOS and Linux. Windows is not supported.

Execution model

The developer profile contains rules, skills, subagents, and portable enforcement hooks for Claude Code and Codex. Separate sessions can run in tmux panes. Git worktrees under ~/.local/share/agent-profile/worktrees/ isolate their checkouts. Each agent investigates the repository, submits a plan, implements the approved plan with TDD, updates the colocated docs.md, and opens a PR or MR. The remote determines whether it uses GitHub or GitLab.

The profile includes subagents for code analysis, review, documentation, research, and prose drafting. Its skills cover brainstorming, planning, TDD, worktrees, debugging, and branch completion. Session rules load at startup. Path-scoped rules load when the agent reads matching files.

craft-harness sets up and verifies repository harnesses, craft-original-work works forge issues through a draft MR with handoff, and craft-clean-room defines clean-room reimplementation rules. How to use them.

Claude-to-Codex orchestration

Claude Code can manage the conversation, task tracking, acceptance, and mechanical Git while Codex handles substantive repository work through the official codex@openai-codex plugin. Enable the optional mode during a Claude install:

curl -fsSL https://agent.amon.io/install.sh | AGENT_PROFILE_CODEX_ORCHESTRATOR=1 bash -s -- claude

It requires Claude Code, Node.js 18.18 or later, jq, codex app-server, and an existing Codex login. Restart Claude Code after installation. The profile keeps its native adversarial review and commit gate; the plugin Stop review gate is disabled by default.

The Codex jobs pane lists each delegated job with its state, elapsed time, role, access mode, task, project, and branch. Running jobs show the last Codex message and current step. Finished jobs show the answer's first line for 10 minutes. Long lines wrap. Each job's [+] toggle shows its id, log path, and last 12 log entries. The pane opens automatically in terminals at least 144 columns wide, and /codex-jobs opens it at any width. Its first line shows the weekly Codex limit, reset time, and snapshot age, or weekly limit: unknown without data. The status line shows the number of running jobs.

The wrapper guards every job: a stopped or killed wrapper cancels its Codex turn, only one writer works in a worktree at a time, leftover sandbox processes are killed after a job, capacity errors are retried, and idle app-server brokers are stopped.

The oracle runs on both models: each consultation goes to the native Fable oracle and to the Codex oracle on gpt-6-astra with the same brief. If they disagree, each sees the other's answer once; if they still disagree, Claude asks you with both positions. The Fable oracle is told not to delegate to Codex.

Enforcement hooks

Portable hooks block commands, restore context, and inject session metadata in Claude Code and Codex. Claude Code also installs lifecycle hooks for task and review state.

Commit gate. Rejects git commit and git push until the adversarial reviewer has run on the current branch or the task records a reasoned waiver. A change set containing only prose bypasses the gate.
Published prose check. Reads inspectable commit, MR/PR, and issue/ticket text from inline flags, files, and literal heredocs. It rejects banned phrases and error-level Vale alerts. Format and length problems warn and continue, while editor, browser, Jira, and connector paths warn or use agent preflight when the hook cannot inspect the final text.
Lint routing. Rejects direct prettier, eslint, and biome calls inside a repository. The block directs the agent to make check.
Task tracking. Recorders copy every TaskCreate and TaskUpdate event into session state.
Pipeline watch. After MR creation, the hook directs the agent to monitor the pipeline until it passes.
Post-compaction. Restores the active plan, unfinished tasks, and commit-gate state after context compaction.
Session start. Updates the profile, marks the mise and direnv environment as trusted, and reports unpromoted agent-memory entries.
Session log. The session-log mod keeps one log per repository and day in ~/.claude/session-logs/<repo>/YYYY-MM-DD.md. Each conversation starts with today's path, an entry template, and the newest log. Claude is reminded to log after commits, completed tasks, approved plans, and answered questions. /session-log <query> searches by keyword and by meaning through a local EmbeddingGemma model; a decision a later one replaced is always shown with its replacement. Entries carry labeled fields such as Why:, Next: and Cause:, and the pane shows each entry with its decisions, next steps and errors. The status line, toasts, the pane, and a band above the prompt show unlogged work, pending decision checks, and whether semantic search is on.
Group session log. Create an empty, private agentic-session-logs repository in a GitLab or GitHub group, and every repository of that group and its subgroups shares its session log through it; a subgroup's own companion, if it has one, wins. The mod uses a matching local checkout beside the code repository or in an ancestor folder, falling back to a clone under ~/.claude/session-log-companions/. It writes one file per entry, and commits and pushes entries at session start and every 5 minutes after the secret check; teammates' entries arrive with each sync. Conflicts are merged without a person, and personal logs migrate into it; each migrated day file is deleted once the push has carried its entries. git config session-log.companion false opts a repository out.
Shared session log. A repository opts in by committing .session-log/config.json. Entries become one UTC-named file each under .session-log/YYYY-MM/, committed with the code and merged across people without conflicts; new conversations read the newest entries of every author. Ask Claude to set it up: the sharing-session-logs skill writes the config and migrates personal logs. Before a commit, check-log-secrets.sh blocks known token formats in log entries.
WebFetch cache. Stores fetched pages by URL and uses HTTP validators for revalidation.
Runtime context. Adds the current local time, session duration, and free space on the working-directory filesystem to every user message and tool-call result. Missing or invalid cwd values fall back to .. Below 10 GB free or 5% free, it warns of failed writes and data loss and tells the agent to alert the user immediately and pause builds, installs, and large downloads until both thresholds are met. Measurement failures report Disk space: unavailable while retaining time data.

Installed vendor tools

The installer attempts to install six external tools. Failure to install one tool produces a warning and does not stop the remaining installations. Set AGENT_PROFILE_SKIP_VENDORS=1 to skip all six.

vale	Checks changed repository prose, prose-writer drafts, and inspectable published command text against the language register.
graphicle	Provides repository knowledge graphs through its CLI, MCP tools, and `/graphicle` skill. Agents query it before Glob or Grep when MCP tools are connected or `.graphicle/graph.json` exists.
allium	Provides the specification-language CLI and its skills.
agent-browser	Automates browser operations through a Chrome runtime.
proofshot	Records and verifies UI changes.
ollama	Runs the local `embeddinggemma:300m` model for session-log search. Installed under your home directory with `mise use -g ollama@latest`; the downloads run in the background, and the mod starts `ollama serve` for each session.

Graphicle supports macOS 11 or later and Linux with glibc 2.35 or later. The installer uses the graphicle-ai/tap/graphicle Homebrew tap when available. Otherwise, it runs the official installer with --bin-dir "$HOME/.local/bin". The graphicle and graphicle-graph executables must share one PATH directory.

Repository setup remains under user control. Setup can create repository files, MCP configuration, agent hooks, git hooks, and conversation capture. After reviewing these effects, run graphicle setup or graphicle setup --no-capture to omit capture. The profile never runs repository setup. Upgrade with brew upgrade graphicle or rerun the official installer. Profile updates do not upgrade the binary.

Codex installation

The same payload installs under $CODEX_HOME. Rules and documentation go under agent-profile/, and skills go under skills/. The installer converts each Claude agent to Codex TOML and maps its model tier: Opus to gpt-5.6-sol, Sonnet to gpt-5.6-terra, and Haiku to gpt-5.6-luna. It installs portable hooks and omits Claude-only Task, Agent, and WebFetch behaviour. It does not modify config.toml.

The source repository is private. The public installer embeds the complete profile, so its contents remain available in the script itself. The published release is listed at agent.amon.io/version.

2026-09-14 · v1.2.11 · 4 min

Why the bulk-reader hook was removed

A context-saving hook blocked image inspection because it treated newline bytes inside PNG files as text lines. Version 1.2.11 removes the hook, its skill, and its reader agent from Claude Code and Codex.

The hook intercepted unbounded Read and Bash calls before the tool ran. It counted newline bytes in each target and blocked files above 350. That rule worked for text, but the hook did not first prove that the input was text. A PNG can contain any byte value in compressed data. Its newline count says nothing about its visual size or complexity.

The failure appeared during screenshot review. Large screenshots were rejected as if they were long source documents. Shrinking the images below the threshold made the hook pass, but changed the evidence being inspected. Image review should preserve the original pixels.

The classifier owned the wrong decision

The hook tried to decide which files deserved a separate reader agent from a path and a byte count. Adding a PNG exception would leave the same failure for JPEG, WebP, archives, fonts, and unknown binary formats. MIME detection would add another fallible classifier to a policy that was only meant to reduce context use.

The hook was not a security boundary. A false positive stopped valid work, while compound shell commands and other tool shapes already failed open. The cost of keeping the classifier exceeded the value of forcing one context-management strategy.

Removal covers both hosts

The release removes the Claude and Codex hook registrations, the bulk-reader skill, both reader agents, helper scripts, permissions, Shunt provenance files, and feature tests. The remaining installer tests assert that none of these files or hook commands return.

Existing installations are cleaned during upgrade. Claude keeps the retired hook name only in its cleanup list so an old symlink is removed. Codex uses its managed-file manifest to prune files that are no longer in the profile. Hooks owned by other tools remain unchanged.

Source installs store replaced Claude files under ~/.local/share/agent-profile/.agent-profile-backups/claude. Legacy adjacent backups move there during the next install.

Reads return to native behaviour

Claude Code and Codex can now inspect images and other binary files without a line-count gate. Text reads also use the host tools directly. Agents can choose bounded reads, targeted searches, or a separate analysis agent when those choices fit the task. The profile no longer blocks the original operation.

2026-09-04 · v0.9.0 · 6 min

The commit gate requires an adversarial review

The developer profile rejects git commit and git push until the current branch has a review record. The gate also supports branch-scoped waivers and prose-only commits.

After implementation, the agent holds the change and passing test output in the same context. This context biases self-review. A PreToolUse hook on the Bash tool enforces review before commit or push. The hook reads a small state file and either permits the command or returns a denial reason.¹

A commit or push is permitted when the adversarial-reviewer has run on the current branch during the session. A recorded task waiver or a prose-only change set also permits the operation. The hook evaluates these conditions directly.

Hook inputs and review state

Claude Code sends each tool call to the hook as JSON on stdin. Bash calls include the command string and working directory. The hook reads both fields, resolves the branch with git rev-parse --abbrev-ref HEAD, and checks the session state directory. A companion PostToolUse hook writes the record after an Agent call to adversarial-reviewer returns. Scheduling a review does not satisfy the gate. The reviewer must return.

The record is keyed by branch. A session can process several issues on separate branches. A session-wide flag can authorize commits on later branches after the first review. Branch-scoped records require one review per branch. A one-branch session still requires one review.

$ git commit -m "Add request timeout guard"
PreToolUse:Bash hook blocked the command:
  No adversarial review recorded for branch
  fix/request-timeout-guard in this session.
  Dispatch adversarial-reviewer, or waive with a
  reason via TaskUpdate metadata, then retry.

The denial identifies the branch and states the two valid next actions. Repeated commands remain blocked until review or waiver state exists.²

Prose-only commits bypass review

The gate does not require an adversarial review when the inspected change set contains only prose. This covers README corrections, CHANGELOG additions, and LICENSE notice changes.

A file counts as prose only when every condition below holds:

The gate recognises README, CHANGELOG, LICENSE, CONTRIBUTING, NOTICE, and AUTHORS basenames, plus files under a docs/ directory.
Its extension identifies prose, such as .md or .txt. Scripts and manifests do not qualify.
It is outside .claude/. Rule and hook files control agent behaviour and therefore require adversarial review.

Every path inspected by the gate must qualify. Adding one shell script to a documentation change makes the complete change set subject to review.

Waivers require a state record

The profile supports waivers for a one-line version bump, a test-covered rename, or a revert. The agent must record why review adds no value. It writes the reason through TaskUpdate metadata. A PostToolUse recorder copies that metadata into the state directory read by the gate.

Waiver lifetime

A waiver applies only to the session, checkout, and branch on which it was recorded. A change to any of these values invalidates it. Each new in_progress task event also clears the waiver, so authorization for a version bump cannot carry into later feature work.

State change	Review state	Waiver state
Reviewer agent returns	Recorded for the current branch	Preserved
Task becomes in_progress	Stored but stale for commits	Cleared
Another branch is checked out	Resolved by branch name	Invalid
A new session starts	Empty	Empty
Context is compacted	Preserved and reported by the hook	Preserved

Compaction removes conversation context but leaves filesystem state intact, so review and waiver records survive. The agent loses its conversational reminder of the gate. A post-compaction hook restores the rule and the list of unfinished tasks before the next commit attempt.

Terminal behaviour

The gate produces no output when a session follows the required order: plan, implement, review, then commit. If the agent attempts a commit before review, the gate reports the missing state and blocks that command.

$ git commit -m "Add request timeout guard"
PreToolUse:Bash hook blocked the command:
  No adversarial review recorded for branch
  fix/request-timeout-guard in this session.
  Dispatch adversarial-reviewer, or waive with a
  reason via TaskUpdate metadata, then retry.

Dispatching adversarial-reviewer...
adversarial-reviewer returned — no blocking findings.

$ git commit -m "Add request timeout guard"
[fix/request-timeout-guard 3a1f9c2] Add request timeout guard
 4 files changed, 89 insertions(+), 12 deletions(-)

The developer profile installs about a dozen hooks. Most report required follow-up work. The commit gate denies the operation because an unreviewed commit can reach a shared branch before another hook can correct it.

1. Hooks return a JSON object on stdout. A permissionDecision value of deny and a permissionDecisionReason produce the denial text shown above. The hook emits the object with jq -n --arg instead of raw printf, so quotes in a branch name cannot produce invalid JSON.

2. Repository rules require every prohibition to name its replacement action on the same line.

2026-08-28 · v0.8.0 · 4 min

Event triggers in rule files

The profile binds instructions to observable events such as a pending replace_all call or a non-zero test exit. Each rule also names searchable literals, numeric thresholds, and the action that replaces a prohibited operation.

A rule must become relevant at a specific decision point. The agent can observe that it is about to call replace_all. It can observe that a test process exited non-zero. Both events occur immediately before the rule must affect the next action.

A heading such as “editing” identifies a broad topic. It remains applicable while the agent reads a file, changes a line, formats a diff, or writes a commit message. The heading does not identify which operation requires a check. “Debugging” has the same problem. It describes a work phase rather than an event in the execution trace.

Events define the firing point

Event phrasing places the condition and the required response in the same moment. The rule can match a tool call, process result, path, or state transition that appears in the current context.

Topic phrase	Observable event	Decision point
Editing	About to run `replace_all`	Choose the permitted editing operation before modifying the file.
Debugging	A test exited non-zero	Inspect the failure before changing implementation code.
Validation	About to run `eslint`	Route the command through the repository validation target.

The event need not come from a hook. A tool request, command result, file count, branch change, or task-state update is sufficient when the agent can observe it. Judgment states such as “when logic is complex” do not qualify because two sessions can classify the same code differently.

Every rule names a greppable literal

Each rule contains an exact command, path, or number that a reader can search for. Literals such as replace_all, make check, docs.md, 3 attempts, and >50 hits connect the instruction to repository files, tool input, or output.

This property makes rule discovery mechanical. A developer who sees a blocked eslint command can search the profile for eslint and find the governing rule. An instruction such as “use the normal validation command” provides no stable search key and depends on prior knowledge of the repository.

About to run `eslint`: do not run it directly; run `make check` instead.

A search returned >50 hits: narrow the path or pattern before reading results.

The literal also exposes drift. If a repository renames make check, a search finds each rule that still names the old command. General phrases conceal the same stale dependency.

Prohibitions include a replacement

A prohibition removes one action from the available set. It must add the permitted action on the same line. The agent reaches the rule while choosing what to do next, so the replacement must be present without another lookup.

Incomplete:
Never run `eslint` directly.

Complete:
About to run `eslint`: do not run it directly; run `make check` instead.

The complete form states the event, the prohibited operation, and the replacement operation. A denial without a replacement leaves the session blocked at the point where the rule fired. Moving the replacement to another section creates the same failure when only the matched rule remains in context after compaction.

Thresholds use numbers

Words such as “repeatedly,” “many,” and “large” require judgment before the rule can run. Numeric thresholds produce the same transition in separate sessions. The profile uses forms such as 3 attempts and >50 hits.

After 3 failed attempts, stop the current approach and use systematic debugging.

If a search returns >50 hits, narrow the path or pattern before continuing.

The exact threshold can change when repository evidence changes. Its presence is the contract. A number makes the trigger observable, permits a test to cover the boundary, and prevents the agent from redefining “many” after each result.

Rule shape

A rule file therefore binds an observable event to one response. It names the literal that exposes the event, uses a number when the condition depends on quantity, and provides a replacement for every prohibited action.

When <observable event containing `literal`>:
do not <prohibited action>; <replacement action> instead.

This form gives the agent a condition it can detect and an action it can execute. Topic headings can still group related rules for readers, but they do not replace the event trigger inside each rule.

Craft skills

Use these skills in your repository to build checks, work through issues, and define permitted sources for a reimplementation.

Start with craft-harness. It sets up repository checks and proves they reject violations. craft-original-work runs the issue loop after make check, AGENTS.md, and harness/verify.toml exist.

If the repository reimplements another product, read craft-clean-room before reading anything about the target. Its policy also governs the harness and issue loop.

Prerequisites

The git remote determines the forge CLI, gh for GitHub or glab for GitLab. References to MRs mean pull requests on GitHub.

The harness audit measures free disk. The issue loop requires at least 10 GB and 5% free disk. It stops below either limit.

Starting a skill

Ask for a harness, “craft-like” checks, a “ratchet”, a “layer check”, a “single gate”, or verify-harness to trigger craft-harness. Missing gate files also trigger it.

/craft-harness
Audit this repository and propose its harness.

Add a layer check and ratchets to this repository.

Say “work on milestone”, “next issue”, “take issue #N”, or “work through the backlog” to trigger craft-original-work. Unattended GitLab or GitHub work also triggers it.

/craft-original-work
Work on milestone 3.

Take issue #42.

Say “clean-room”, “reimplement”, “parity”, or “compatible with”, or name a target product to trigger craft-clean-room.

/craft-clean-room
Define the clean-room policy for reimplementing Product X version 2.0.

Plan parity with Product X version 2.0.

Harness phases

The read-only audit inspects the repository and forge. It runs existing checks and measures build size, free disk, and fresh-worktree setup time.

The audit ends with a proposal naming mechanisms, affected files, enforcing checks, seeded violations, existing violation counts, and owner decisions. It does not write files.

Approve the mechanisms and decisions by name. Implementation starts only after that approval and covers only what you name.

The agent implements each mechanism in a worktree through the adversarial-reviewer commit gate. Existing violations enter a baseline that ratchets down.

A fresh session verifies the harness independently in its own worktree. It runs make check, make check-all, and make verify-harness, checks CI, and applies one new violation per mechanism that harness/verify.toml does not cover.

Gate targets cover checks, supported builds, the full workspace, and the slow test tier.
AGENTS.md names enforcing checks or marks rules (not enforced).
Layer checks reject forbidden imports when the repository has more than one module.
Crash-path checks and regression tests reject known crash patterns.
Ratchets prevent higher violation counts and lower coverage, feature, or parity floors.
Generated status documents and per-task handoff logs record measured progress.
Worktrees isolate build output, ports, databases, and temporary files.
Seeded violations in harness/verify.toml prove checks fail for the expected reason.
Forge conventions govern claims, blocking links, and MR issue references.

The audit selects reference modules from repository facts. These cover Rust builds, web or desktop UIs, commands and fuzzing, data, budgets, and public exports. Decision records, forge conventions, and verification always apply.

Issue loop

For each issue, the agent syncs main, addresses MR feedback, picks eligible milestone work, and reads the issue with its comments and links.

It claims the issue through a draft MR and an isolated worktree, plans, implements with TDD, and runs checks through the review gate.

Visible changes get screenshots. The agent fills the MR description, merges current main into its branch, pushes, watches CI, and records a handoff log.

The MR stays draft. The agent never marks it ready, merges it, or closes the issue. The owner reviews draft MRs and merges them.

Answer owner-decision questions posted in issues. Triage out-of-scope findings filed as agent-proposed issues without a milestone.

The loop stops when the milestone has no eligible issue, owner decisions block all remaining issues, or disk no longer has at least 10 GB and 5% free.

It also stops when the /systematic-debugging stuck ladder escalates to the owner after 3 failed approaches or when none remain, or at the owner's one-issue or stop-after-current limit. A failing make check alone does not stop it.

After a second pipeline failure, the agent leaves the MR draft and comments with the failing job and log excerpt. It stops if no other issue is eligible.

Clean-room policy

Before any target research or implementation, the owner answers three questions for CLEANROOM.md. Only the owner changes this policy.

Can agents drive the target or use files it produced as test oracles? The default is no.
Do command ids and menu names mirror the target? The default uses our own dotted ids and labels in our own words.
Where can target vendor and product names appear? The default permits CLEANROOM.md and factual compatibility statements only.

The policy names the target and version, plus our product with a name containing none of the target's trademarks.

Use the first source rung that answers the question. Start with published specifications and standards, then permissively licensed code and papers, then public user documentation.

Next comes black-box observation by a human, or by an agent when policy permits. Otherwise omit the feature or mark conservative documentation-based behaviour GUESS.

Do not read target source, binaries, disassembly, decompiled output, leaked or NDA material, or SDKs and code whose licences forbid this use.

Do not inspect target internals with dumpers, debuggers, tracers, decompilers, or injection tools. Do not copy target code, assets, text, templates, or samples. Never commit target screenshots.

If a boundary is crossed, stop work on that area. Do not commit derived work. Record the exposure in the issue and tell the owner.

Every behaviour-changing commit records its source rung and a reference or repeatable observation in a trailer.

Source: <rung>: <url, spec section or observation>

Rung 5 records GUESS and its reason. Source: none is accepted only when behaviour does not change.

The parity catalogue records each feature, status, evidence, and planned issue. A done row names a test that exists and passes.

Generated reports keep wired counts, where commands exist and dispatch, separate from verified counts, where behaviour tests pass. Both have ratchet floors.

Owner decisions

The agent never decides these alone.

Scope changes, new dependencies, data format changes, public API changes, and deletion of user data.
Release and versioning, milestone scope and due dates, label scheme changes, and closing an issue other than by a merged MR.
A new hosting provider, CDN, or remote cache, publishing a repository, or changing its public export.
Repository setup commands the agent never runs itself, such as graphicle setup, the desktop UI stack, and the language of a new repository.
Any change to CLEANROOM.md in clean-room mode.

Common mistakes

Do not ask for issue work before the three gate files exist. Run craft-harness first.

Name the target version when requesting a reimplementation. Do not read target material before the clean-room policy exists.

Approve named harness mechanisms instead of treating the audit as permission to implement. Do not expect the issue agent to merge MRs.

Changelog

Selected releases published to agent.amon.io. Remote sessions install a different version at their next startup.

v3.8.02026-11-03

The orchestrator selects effort per delegated task. Failed acceptance raises the next attempt's effort. Adversarial and security reviews retain their role's minimum effort.

v3.7.02026-11-03

Each install now refreshes the mod marketplace and runs claude plugin update for enabled mods. Previously, enabled mods stayed at their first-installed version. Restart Claude Code to load an update. If mod delivery fails, install.sh now exits 2, and the next session retries.
The SessionStart updater now starts one detached background worker and returns at once. A lock prevents concurrent workers. Updates now apply from the next session, which reports success or failure. Output goes to ~/.cache/agent-profile/update-profile.log.
If installation stops after resetting the clone, the next session now retries. The .deploy/.installed-head marker records the last completed install.
/session-log --all now searches group companion repositories, including managed clones, without listing a superseded managed copy twice.

v3.6.02026-11-02

The session-log mod uses an existing agentic-session-logs checkout beside a code repository or in an ancestor folder. Its origin must match the group's companion. Local checkouts take precedence over managed clones of the same companion. Nearer groups still win. The next session switches automatically. It syncs pending entries from the managed clone before pulling them into the local checkout. The mod commits, rebases and pushes entry files there. Local checkouts skip repair and wait during git operations, detached HEAD, or staged changes outside entry files. Linked worktrees are ignored. A first session in a group folder also discovers and syncs local companion checkouts. It shows their project logs without an earlier session in a code repository.

v3.5.02026-11-02

Plans, specs, and ticket drafts get one reviewer run. The author fixes blocking findings, then asks for user approval on plans and specs or files corrected tickets.
A new over-engineering guide defines work the requirement does not need. Reviewers flag unnecessary scope for removal and treat scope-adding suggestions as recommendations.

v3.4.02026-10-30

In Codex orchestration mode, oracle consultations go to both the native Fable oracle and the Codex oracle on gpt-6-astra, which v2.8.0 had dropped. When they disagree, each sees the other's answer once, then Claude asks you with both positions. The Fable oracle is told not to delegate to Codex.

v3.3.02026-10-30

One companion repository covers a group's subgroups. A repository in vmbroker/infra/ uses vmbroker/infra/agentic-session-logs when it exists, else vmbroker/agentic-session-logs, and so on up; its entries go to infra/shop/ in a parent's companion, so repositories of different subgroups never share a folder. A subgroup companion created later takes over once a session clones it.

v3.2.02026-10-30

Migrating personal session logs into the companion repository now cleans up after itself. After each sync, the session-log mod deletes a migrated day file from ~/.claude/session-logs/<repo>/ once every one of its entries is on the companion's remote, and reindexes that folder. Day files still waiting for a push stay; one changed after the migration is kept, and Claude is told to migrate again. Running the migration again also cleans up logs moved by v3.1.
CI runs the test suite in 4 parallel jobs, and the Codex and public installers copy files with fewer subprocesses (5.3 s to 3.1 s and 5.4 s to 4.3 s per install, measured in a 4-core container).

v3.1.02026-10-27

A group can share the session logs of all its repositories through a companion repository, <group>/agentic-session-logs. When it exists, the session-log mod clones it, writes each repository's entries into it, and commits and pushes them at session start and every 5 minutes. The secret check runs before each commit; a hit holds back only the flagged entry and tells Claude which line to fix.
Sync conflicts are merged without a person: entry files merge as a union, a push that lost a race is rebased and retried, and Claude is asked to tidy an entry that two machines changed.
mcp__session-log__migrate also moves personal logs into the companion repository.
A sync repairs what a killed sync left behind (a rebase in progress, a stale index.lock, a detached HEAD), runs git with ssh -o BatchMode=yes so no prompt can hang it, and moves a non-git folder at the clone path aside instead of failing every session.

v3.0.02026-10-27

Removed Windows support. https://agent.amon.io/install.ps1 is gone, and both installers stop with an error under Git Bash. Codex hooks no longer get a commandWindows, and the vendor installers dropped their winget and Windows-release paths.
Removed PowerShell tool support. The gates match the Bash tool only, and the generated settings set CLAUDE_CODE_USE_POWERSHELL_TOOL=0 so the PowerShell tool cannot bypass them.

v2.8.42026-10-22

An indexing … failed notice in the session-log pane goes away once indexing of that kind succeeds again, instead of staying for the rest of the session.

v2.8.32026-10-22

The session-log pane is no longer empty after updating from an earlier release. The mod fills in pane state fields that a session saved before the update lacks.

v2.8.22026-10-22

A failed embed shows in the session-log pane with its entry's date, time and title, and on that entry's card. The error goes away once the entry has a vector, also when another session embedded it. Earlier could not embed <id> notices, which stayed after a later embed succeeded, are removed.

v2.8.12026-10-22

The session-log mod keeps embeddinggemma:300m loaded until Ollama stops (keep_alive: -1 on every embedding request). Before, Ollama unloaded it after 10 idle minutes and the next search waited for a cold load.

v2.8.02026-10-21

Codex orchestration guards its jobs on every run. A stopped or killed wrapper cancels its Codex turn; a write job is refused while another writer or a leftover sandbox process is active in the worktree; sandbox processes left after a job are killed and reported; "model at capacity" failures are retried up to 3 times, resuming the thread when one started; idle app-server brokers are stopped, and codex-reap.sh --worktree stops a removed worktree's broker.
The oracle stays a native Fable agent in orchestration mode instead of forwarding to Codex.

v2.7.22026-10-21

The session-log pane picks up entries written by another session, by hand or by a shell append within a minute, and a repository log that appears below a group folder joins it.
With Ollama down, entries waiting to be embedded no longer hold up indexing: changed log files are still indexed and shown, and the embeds run once Ollama answers again.

v2.7.12026-10-21

Session-log entries written to another repository's log, and the logs of the repositories below a group folder, are now indexed and embedded by the current session. Before, search and decision checks saw them only after a session started in that repository.

v2.7.02026-10-21

A session started in a folder of repositories, such as a GitLab group checkout, no longer presents a session log of its own. Its context, pane and search show the logs of the repositories below it, each entry marked with its repository, and reminders name the repository's log.
The session-log status line no longer shows the previous day's file name as if it were the current log: with nothing logged today it reads none today · 3 open threads from 2026-10-20. The count comes from the newest entry per repository, since each entry restates what is still open; it no longer adds up threads that later entries closed.
An open thread now needs a Next: step; findings go under What was done. The pane shows an Open threads bullet without Next: as a dim note and leaves it out of the count, and says how many there are. For older logs, the new tidying-session-logs skill sorts each such bullet into open work (adds Next:), a finding (moves it) or done (removes it).

v2.6.02026-10-20

The Codex jobs pane wraps task titles, messages, and results instead of cutting them off. A collapsed message takes at most 3 rows.
Each job has a [+] toggle that shows its id, log path, and last 12 log entries with their continuation lines, for running and finished jobs.

v2.5.02026-10-20

Session-log entries go to the log of the repository where the work happened. A session started in one repository that edits or commits in another is reminded to log that work in the other repository's log, one entry per repository; the status line says unlogged in 2 repos.

v2.4.02026-10-20

The session-log pane wraps long lines instead of cutting them off, puts labels in their own column, marks replaced decisions struck through with their replacement, and renders an expanded entry as Markdown.
Search results in the pane come only from your own /session-log search, newest first, with a clear button. Claude's searches no longer replace them. --all takes each repository's best hits in turn instead of filling the list from the first folder.

v2.3.02026-10-20

Personal session logs are named after the remote's forge path: a GitLab repository vmbroker/application logs to ~/.claude/session-logs/vmbroker-application/ instead of application/, so repositories with the same name in different groups no longer differ only by a hash suffix. An existing folder moves to the new name at the next session start.
The session-log pane lists the newest entry first, today and in the previous log.

v2.2.02026-10-20

Session-log entries take labeled fields inside the four headings: Verified: for a change, Why:, Instead of:, Consequence: and Check: for a decision (after the MADR template), Next: and Blocked: for an open thread, Cause:, Fixed: and Workaround: for an error. The entry template asks for them; older entries parse as before.
The session-log pane shows each entry as a card: the first change, every decision with its status and reasons, open threads with their next step, and errors with cause and fix. more expands one entry to its full text.

v2.1.02026-10-20

Repositories can opt in to a shared session log committed with the code: one UTC-named file per entry, so entries from several people and branches merge without conflicts. The sharing-session-logs skill sets it up and migrates personal logs, rewriting supersedes links to the new ids.
A new check-log-secrets.sh hook blocks a git commit that would add a known token format to the shared log; public logs refuse commits while it is missing.
Entry templates name the branch of the session's own worktree, not the main checkout's. Shell writes to the log through a relative path now count as logged.
The personal log's pane and /session-log explain how to share the log with the team.
An Ollama that lists models but cannot run them (no llama-server next to the binary, as a leftover /usr/local/bin/ollama) now counts as down, with its error. The mod and the installer prefer mise's complete install, also when mise does not register its bin, and the mod logs ollama serve output to ~/.cache/agent-profile/ollama-serve.log. Embedding requests no longer send dimensions.
Entries whose embedding failed are retried at every session start instead of staying without a vector. The status line shows N not embedded and the pane shows embedded X of Y, counted from the index.

v2.0.12026-10-20

Ollama installs into your home directory with mise instead of the official script, which wrote to /usr/local and created a system service. Without mise, Linux prints the mise install command and installs nothing.
The session-log mod starts ollama serve for the session when no server answers, so semantic search works without a background service.

v2.0.02026-10-20

The session-log mod keeps one log per repository and day, loads the newest log at conversation start, reminds Claude to log work and decisions, and searches entries by keyword and meaning with a local EmbeddingGemma model. Decisions replaced by later ones are marked, and similar new decisions prompt a check.
The installer adds Ollama and pulls embeddinggemma:300m in the background.
The Stop hook that blocked turn completion while tasks were unfinished is removed. Current models continue on their own, and the user can run /goal for longer unattended work.

v1.8.12026-10-19

The site has a Craft skills page at #craft explaining when and how to use the three skills.
The craft skills name the concrete skills, worktree path, disk limits, and commit gate instead of referring to “the profile”, and no longer check for an installed profile.

v1.8.02026-10-19

craft-harness sets up and verifies a repository harness with a make check gate, ratchets, layer checks, and seeded violations run by make verify-harness.
craft-original-work works forge issues in milestone order through a draft MR with handoff.
craft-clean-room defines clean-room reimplementation rules through a CLEANROOM.md policy, source ladder, provenance trailers, and parity catalogue.
The cross-reference check resolves skill-local references/ paths and skips target-project filenames in skills and agents.

v1.7.02026-10-15

Graphicle replaces Graphify. The profile installs it through the graphicle-ai/tap/graphicle Homebrew tap or the official installer, then publishes the /graphicle skill. Graphicle supports macOS 11 or later and Linux with glibc 2.35 or later.
The graph-first rule uses connected Graphicle MCP tools or read-only graphicle graph query, path, explain, and affected commands when .graphicle/graph.json exists.
Repository setup remains user-controlled. Setup can change repository files, MCP configuration, agent hooks, git hooks, and conversation capture. After reviewing these effects, run graphicle setup or graphicle setup --no-capture to omit capture. The profile never runs setup or upgrades Graphicle binaries automatically.
The Graphify freshness hook is removed. Migration removes profile-owned Graphify skill files, leaves the graphifyy package installed, and prints uv tool uninstall graphifyy for optional cleanup.
The Codex jobs pane shows the weekly limit's remaining percentage, reset time, and snapshot age. It retains the last value after reset and marks it with reset since. Without data, it shows weekly limit: unknown.

v1.6.02026-10-14

The Codex jobs pane shows each delegated job's status, elapsed time, role, access mode, task, project, and branch. Running jobs show the latest message and current step. Finished jobs show the first answer line. /codex-jobs opens the pane at any width.
The Codex opt-in installs the pane through the source and public installers.

v1.5.12026-10-13

Delegated Codex threads are named <project>/<branch> <role>: <first brief line>. Each session in the Codex app list now has a distinct name.

v1.5.02026-10-12

Delegated Codex tasks use the role's model map: Haiku uses gpt-6-luna, the oracle uses gpt-6-astra, and other roles use gpt-6.1-sol.
Effort follows the role's effort: value and defaults to low.
touchedFiles now includes files changed through shell commands, computed from Git status and content hashes before and after the task, as absolute paths.
The adapter rejects a forwarding agent file passed as --role-file and names the docs/codex-roles/<agent>.md path to use instead.
The generated routing rule names the role-file location.
The gate records background adversarial reviews from the subagent’s hand-back call or SubagentStop.
make vale exits non-zero when it cannot lint.

v1.4.02026-10-12

Added an opt-in Claude Code orchestration mode through the official codex@openai-codex plugin.
Stored the installer choice in .agent-profile/codex-orchestrator; fresh interactive installs default to disabled.
Kept user communication, task tracking, acceptance decisions, mechanical Git operations, and the native adversarial review gate in Claude Code.
Disabled the plugin Stop review gate by default.

v1.3.02026-09-26

Changed the adversarial-reviewer severity scheme to Blocking, Optional, Nit, and FYI. A Blocking finding needs a broken requirement, a failing input, or a cited file:line pattern. The commit gate now requires fixes only for Blocking findings.
Added an unnecessary-complexity check to the adversarial-reviewer: single-use abstractions, single-caller configuration, and validation for impossible states are Blocking findings with deletion as the fix.
Dropped the per-task code-quality review from subagent-driven development. Each task gets a spec-compliance check; approach and complexity are reviewed once at the commit gate.
Removed the enforcing-skill-usage skill, the rationalization tables in six skills, and the <system-reminder> tags in rule files. Emphatic wording from older models caused over-triggering on current ones.
Sized the plan-mode context fan-out to the change: the three context agents run only when 5 Grep/Read calls do not locate the code or the change spans more than one component.
Set effort from Anthropic's per-model guidance. The session default follows the model version (medium on Opus 5.5, high on Opus 5 and 4.6, xhigh on 4.7 and 4.8) instead of a fixed xhigh. The Opus 5.5 reviewers, code-reviewer, prose-writer, and the implementer run at medium. Sonnet agents move from xhigh and high to high and medium. The oracle stays at xhigh.
Added Windows support. irm https://agent.amon.io/install.ps1 | iex installs the profile for Claude Code and Codex through Git Bash, with Git for Windows and jq from winget. Codex hooks run through Git Bash via commandWindows, and vale installs from its Windows release.
Gated Claude Code's PowerShell tool like the Bash tool. The commit gate, lint gate, commit-message check, and pipeline and worktree reminders match Bash|PowerShell, and PowerShell commands are parsed with PowerShell's own parser.
Removed rtk. The installers no longer install it or register its output-rewrite hook, and an update removes the hook from existing settings. The rtk binary and ~/.config/rtk stay in place.
Cut the profile text current models do not need: always-loaded rules from 8,400 to 7,232 words, agent definitions from 13,193 to 8,517, and skills from 32,779 to 19,953. Commands, templates, hook contracts, and output formats are unchanged. developer/CLAUDE.md now states what the profile does and which behaviors hooks enforce.

v1.2.152026-09-24

Made vale-diff.sh --stdin work outside a Git repository and kept make vale-draft as an optional wrapper.
Made the prose-writer follow the artifact register over conflicting caller layouts, repair Vale alerts in one invocation, and report lint failures.
Added shared banned-phrase and error-level Vale validation for inspectable commit, MR/PR, and issue/ticket bodies in Claude Code and Codex, with warnings for format problems and uninspectable inputs.

v1.2.142026-09-22

Moved the code-reviewer and prose-writer agents from claude-opus-4-6[1m] to claude-opus-5-5[1m].

v1.2.132026-09-22

Changed the default daily-driver model to Opus 5.5 (claude-opus-5-5[1m]) for install.sh and the served installer. --model-version 5.5 selects it explicitly. Existing installs keep the version stored in ~/.claude/.model-version.
Moved the implementer, adversarial-reviewer, and security-reviewer agents to claude-opus-5-5 at xhigh effort. code-reviewer and prose-writer stay on claude-opus-4-6[1m].

v1.2.122026-09-15

Renamed datetime-inject.sh to runtime-context-inject.sh for Claude Code and Codex. Existing dt-<session>.start files and DATETIME_INJECT_STATE_DIR remain compatible.
Added working-directory free space to every UserPromptSubmit and PostToolUse message. Missing or invalid cwd values fall back to the current directory.
Added a warning below 10 GB free or 5% free. It identifies failed writes and data loss as risks and tells the agent to alert the user immediately and pause builds, installs, and large downloads until both thresholds are met.
Kept time and session-duration reporting active when disk measurement fails. The injected context reports Disk space: unavailable.

v1.2.112026-09-14

Removed the large-read hook after binary newline bytes caused screenshots to be classified as long text files.
Removed the bulk-reader skill, Claude and Codex reader agents, helper scripts, permissions, and vendored Shunt files.
Made both installers remove retired bulk-reader files and hook registrations while preserving hooks owned by other tools.
Moved source-installer backups out of ~/.claude and into the agent-profile backup directory.
Added a blog post covering the failure, the rejected MIME-exception approach, and the upgrade cleanup path.

v1.2.12026-09-11

Added datetime injection with session-duration tracking to every UserPromptSubmit and PostToolUse event.
Limited Graphify references to repositories containing graphify-out/. Repositories without a graph no longer run freshness checks.
Replaced 20 repeated hook-registration blocks in generate-settings.sh with the add_hook helper, reducing the file from 520 to 269 lines.
Fixed 3 existing install-codex-local.bats failures by adding the mise shim to fake-HOME.

v1.1.62026-09-10

Added the Fable oracle agent for Claude and routed fable-tier advice through the oracle subagent.
Moved bulk reads to native agents on Claude and Codex.
Added Codex discovery for the oracle and repair profiles.

v0.9.02026-09-04

Routed unbounded reads of files longer than 350 lines to a small-model bulk-reader agent on Claude and Codex. Bounded reads retain their existing behaviour.
Allowed the commit gate to bypass change sets containing only prose, including README, CHANGELOG, LICENSE, and docs/ trees. Files under .claude/ do not qualify.
Pinned the reviewer and implementer agents to claude-opus-5 independently of --model-version.
Changed the agent.amon.io root response from the installer to a plain-text usage page.

v0.8.02026-08-21

Added Vale prose checks. make vale reports findings only on lines added by the branch, and the ai-tells styles are vendored for offline worktrees.
Added the prose-writer agent and make vale-draft for drafts checked against the configured language register.
Recorded adversarial-review waivers through TaskUpdate metadata and scoped them to the session, checkout, and branch.
Added a lint-routing hook that rejects direct prettier, eslint, and biome calls inside a repository.

v0.7.02026-08-06

Added the Codex target. Rules, skills, and converted agent TOMLs install under $CODEX_HOME. The installer merges hooks.json and leaves config.toml unchanged.
Added a separate .agent-profile/vendors manifest for vendor skills. The installer backs up same-name personal skills before replacement.
Added a Graphify freshness hook that refreshes the knowledge graph in the background after HEAD changes.
Added a Stop hook that blocks turn completion while tasks remain unfinished, with a limit of three blocks without progress.

v0.6.02026-07-17

Published a self-contained installer at agent.amon.io. It verifies the embedded payload checksum, requires no clone or symlink, and merges settings.json.
Made remote sessions compare the installed release with /version at SessionStart and reinstall when the values differ.
Updated the RTK hook wrapper to resolve rtk from PATH or ~/.local/bin and remove duplicate entries left by older releases.
Added preserve-foreign-hooks.sh so settings regeneration retains third-party hooks.