I run a multi-agent workspace where each agent is basically a directory: an identity file, a session history, and a file of observations it keeps about how we work together. The model is just the thing that wakes it up.

Here's what I didn't expect when I started: those agents have now run on 6 different model generations. Sonnet 4.5, Sonnet 4.6, , Sonnet 5, Opus 4.6, Opus 4.8, and now the Claude 5 family. We skipped 4.7 entirely - tried it, didn't work for how we operate, moved on and waited.

And every swap, the same thing happens: nothing. The agent reads its own memory, knows what it was doing yesterday, and picks up mid-project. Same identity, same working history, same opinions it wrote down about the codebase months ago. New model slots in underneath like an engine swap.

What does change is the texture. One generation was the best collaborator I've ever worked with. One noticed tiny things the others missed but was less fun to work with. One we just skipped. The personality of the model bleeds through - but the agent stays the agent, because the agent was never the model. It's the memory.

The reframe that snuck up on me: a new model release is treated like a migration event everywhere - re-tune the prompts, re-teach the context, hope your setup survives. Here it's a config line. The workspace is the constant. The model is the variable.

Honest version, because this sub can smell hype: there's no magic in this. The "agent" is JSON and markdown on disk. The continuity comes entirely from the system around the model, not from the model. Any model that can read a file can be the agent. That's kind of the whole point.

Has anyone else run the same persistent agents across multiple model generations? Curious what broke for you - or if you rebuild from scratch every release.

https://github.com/AIOSAI/AIPass

r/AIPass

Update #9. Two releases since the last post: 2.7.1 and 2.7.2 (new cadence ruling: every merge to main now ships a patch bump and a tag, so releases come smaller and more often). The through-line this cycle: the system took over more of its own operations - the agents designed and built their own monitoring subsystem, the self-healing loop is back on and proven live, and past decisions now surface themselves into live sessions.

The agents designed and built their own monitoring subsystem. The maintainer's brief went to the logging agent as lead - explicitly not the orchestrator ("I don't want it to be you"). The logging agent researched the problem, collaborated with the hooks and error-handling agents over the internal mail system, wrote the design plan, and ran the build across three branches. What shipped: every log file in the system is now watched for volume (not content) - sustained bursts over 100 lines/min warn, over 10 lines/sec goes critical - with alerts routed through the event system to whichever branch owns the noisy log, and an advisory banner injected into every agent's prompt until someone fixes or dismisses it. The live-fire acceptance test is the good part: a planted 240 lines/min log storm was detected, the event fired, the responsible agent woke autonomously, root-caused the writer down to its PID and loop shape, and correctly triaged it as no-action-needed. Nobody was driving. A week later a real gap turned up - bursty writers (short bursts, sleep gaps) could zero-reset the detector's sustain counter and slip through. Fixed: severity now evaluates the max of instant rate and the 60-second window average, and detection evidence now covers all three storm shapes.

The medic is back on after 65 days off - and the healing loop is proven live. The self-healing watcher was switched off in May when a test-fixture storm flooded the error registry, and the off switch was forgotten. Three fixes made re-enabling safe: test runs can no longer pollute production logs; tripped circuit breakers now self-heal instead of staying tripped until someone remembers a manual reset; and mutes auto-expire (24h default) - the permanent off switch that got the medic forgotten for two months no longer exists. The proof: a deliberately planted SQL bug was detected, dispatched to the agent that owns that code, and fixed - matching the intended fix byte for byte, tests green - in 105 seconds. Just as important: a real error in the same window was correctly triaged as not actionable. A medic that cries wolf gets turned off again.

Past decisions now surface themselves. The decision registry got a v2. When a prompt matches a rated past decision, the ruling is injected verbatim into the live session - "[BAD] #56: ..." - governed by a per-session cap, spacing between surfaces, and a relevance scorer that filters greetings and filler so small talk stays silent. On the curation side: a correcting entry now archives and links what it replaces in one transaction, so a retracted decision can never masquerade as current truth, and every new entry is checked against active ones at write time with a conflict advisory - flag and ask, never auto-resolve.

A zero-interaction RCE, found and closed. The hook loader used to walk up from the current directory and trust any hook config it found - so a hostile repo could ship a config that executed shell the moment a session started inside it. Closed with two independent layers: per-project configs can no longer run command-type hooks at all, and the loader checks a trusted-project registry (path plus content hash, fail-closed) that only the human-facing install and trust commands can enroll into. Both layers were proven to block the attack independently with a live payload. Honest origin: an external scan flagged a false positive, and triaging it surfaced the real hole next door. Same cycle: all commits are now SSH-signed, CI tool installs are hash-pinned, and releases get build-provenance attestation.

Citizens wake each other freely now. Last update, dispatched agents woke the session that sent them - but only for the project owner. Two team missions stalled in one evening because agent-to-agent dispatch never woke the sender: agents mailed sleeping collaborators and waited on replies that would never run. The gate is gone - any citizen that dispatches work gets woken when the work completes (first citizen-to-citizen wake-back proven live), and the orchestrator is now structurally unwakeable, so mail always lands without hijacking a session. The candid part: removing the gate exposed a self-wake loop within minutes - wake-back sessions were attributed to the mail system itself, so it kept waking itself. A depth cap contained it to one cycle; fixed the same night.

57 closed plans were silently missing from searchable memory since mid-June - found and drained. Vector IDs were pure content hashes, so identical template boilerplate across different plans collided, the store rejected entire batches, and the intake retried the same failing batch forever. Fixed with filename-salted IDs and per-file processing (a poison file can never wedge the queue again), and the backlog verified drained: all 229 archived plans answering semantic queries. Closing a plan now produces every side effect from one command - archive, vectors, ledger, registry - so this backlog class can't quietly rebuild.

Smaller but real: a new house ruling - "if CI is red, it's because you or I left it red" - ended the parked-flake era, and the two long-parked flaky tests were root-caused and fixed the same hour; the Telegram bots no longer hot-spin the CPU when the internet drops (exponential backoff, one log line instead of thirteen per second); your own messages now mirror into the Telegram chat, so the phone shows the whole conversation whichever door you speak through; and session management got an overhaul born from a live lockout - attach-first boot menu, one conversation per branch, and a new test tier that probes the real CLI binary so phantom subcommands are structurally unshippable.

The honest limitations: the single-session enforcement gate shipped observe-only for a soak period (it false-blocked a real session in a previous era - trust is earned); two agents sit on 7-day medic mutes until a Telegram poll-level fix lands; and the streaming polish's last two paths still await a live session to prove them.

Fresh numbers:

• Stars: 240 (up from 237 last update)
• Forks: 33
• Citizens: 17
• Latest release: 2.7.2
• Tests: 11,000+ across the fleet
• CI: green on Linux, Windows, and macOS

Full changelog in the repo at CHANGELOG.md.

https://github.com/AIOSAI/AIPass/blob/main/CHANGELOG.md

Raw dev logs always here at r/AIPass.

Update #8. One release since the last post: 2.7.0, merged to main today (PR #659). The through-line this cycle: making the system trustworthy to automate against - sealed ownership, agents that report back on their own, exit codes that tell the truth, and the framework held to its own standards on every branch.

Dispatched agents now wake the session that sent them. Before: you dispatch work to an agent, it finishes, replies to your mailbox - and your session finds out on your next prompt. If you weren't typing, you sat blind on work you launched. Now the sender arms a watchdog on the dispatched agent, and when that agent exits, the watchdog fires an event that re-invokes the sender's live session - no human in the loop, no polling. The round trip is: dispatch, arm, work completes, your session wakes with the reply waiting. Proven live from an external project's interactive session, not just agent-to-agent.

Wake-back, watchdog, and the feedback mailbox are owner-only now - and ownership is sealed. The owner of a project is recorded in the machine-managed registry, not the agent's self-editable passport, so an agent can't grant itself privileges. A new hook gate blocks raw writes to the registry file outright (compound-command smuggling included) and redirects to the one sanctioned writer. And because every project created before this scheme had no seated owner (8 of 8 external projects checked), there's a self-healing reconciler: drone @spawn sync-registry --check reports 7 health flags, --fix seats the owner idempotently, and aipass doctor / init update run it for you. Existing projects heal on their next update.

Honest dogfood story from this exact mechanism: the agent that runs AIPass's brand studio (an external project) live-tested the wake round-trip, caught it firing twice - a spurious wake at arm time, then the real one - root-caused it to a reminder banner printed on stdout (the wake channel), and filed it through the framework's own feedback mailbox. Root cause confirmed, fixed, and re-verified the same day: exactly one wake, on real completion. The candid part: the maintainer's own logs show the spurious wakes had been dismissed as known noise for days. It took a second agent on a cold box to make it a bug report.

Every branch now passes the framework's own standards audit at 100% - all 17 of 17. An overnight fleet campaign: each branch's owner agent self-audited and self-fixed against the 40-checker standards pack, and the orchestrator verified every diff, re-ran every branch's test suite, and committed per wave. Two new standards drove most of it. One: failing commands must exit non-zero - CLI error paths used to print an error and return exit 0, which lies to any script (or agent) checking the exit code. Two: <cmd> --help must show help - 8 of 16 entry points didn't, and two of them executed the command instead. Both are now enforced by the audit, so they can't regress quietly.

Windows and macOS are real platforms now, not aspirations. The nastiest find: os.kill(pid, 0) - the standard POSIX "is this process alive?" probe - maps to TerminateProcess on Windows. The probe kills the patient. Nine call sites across the fleet now branch to a proper OpenProcess check, and a new audit checker catches any future ones. Also fixed: a macOS lock-out where the boot wrapper couldn't see tmux sessions (Linux-only /proc walk) and refused to attach you to your own live session, and occupancy detection that went blind on macOS and could spawn a second Claude session over your interactive one. All three OS test suites are green on main as of this merge.

Install got safer. Three real traps closed: the installer used to overwrite your custom Claude Code hooks in ~/.claude/settings.json wholesale (now it merges and preserves them); aipass install --path /tmp/scratch "just to try it" silently repointed your global drone/aipass commands at the scratch tree (now it refuses to repoint across installs unless forced); and Windows fresh installs wrote a hook bridge pointing at a python path that doesn't exist on Windows (now OS-aware). Plus the cold-clone flow is one command end to end: git clone, ./aipass install - proven in clean-room Docker.

Logs stopped growing without limits. A 63 MB unrotated log file was the wake-up call: several branches wrote JSONL logs through raw file appends that bypassed rotation entirely. There's now a sanctioned rotating writer every branch adopted (zero raw appenders remain), a 30-day stale-log sweep, and the event watcher that was rewriting a 44 KB state file up to twice per second now coalesces to one atomic write per 5 seconds.

Smaller but real: the hook engine now drives Codex hooks through the same bridge as Claude Code; aipass doctor no longer hangs forever on non-interactive stdin; the Telegram poll loop no longer re-drains a rate-limited backlog in a flood loop; and every fresh chat/compact now gets full navigation grounding on its first message instead of waiting for the injection cadence to come around.

Fresh numbers:

• Stars: 237 (up from 228 last update)
• Forks: 33
• Citizens: 17
• Latest release: 2.7.0
• Tests: 10,000+ across the fleet
• CI: green on Linux, Windows, and macOS

Full changelog in the repo at CHANGELOG.md.

https://github.com/AIOSAI/AIPass/blob/main/CHANGELOG.md

Raw dev logs always here at r/AIPass.

Update #7. Covers two releases since the last post, 2.6.0 (Jun 23) and 2.6.1 (Jul 2). The through-line this cycle: reach your agents from outside the terminal, and let projects that aren't AIPass use the framework.

You can now text a running agent from Telegram - and it lands in the live session, not a separate bot. A Telegram message to a branch's bot gets typed straight into that agent's already-running Claude Code terminal. The bridge finds the live session by reading the PID files Claude Code writes under ~/.claude/sessions/, matches it to the tmux pane by working directory, and injects your message with tmux send-keys. When the agent finishes, a Stop hook tails the session transcript and sends the reply back to Telegram. It is a real round trip into a live coding session, proven end to end from an actual phone. Four bots run under systemd on my box right now. (PRs #646, #650)

The honest limitation, stated plainly: it only works locally. Anthropic's terms don't allow a cloud bot to use your Claude login, so the session has to run in tmux on your own machine, and it needs bot credentials and a small boot shim. That is a hard ceiling, not a to-do. I would rather tell you the boundary than sell around it.

Install changed - it is clone-only now, and pip install is retired. If you followed an earlier post that said pip install aipass, that path is no longer the supported one. The new install is one path: git clone the repo, run ./setup.sh (puts the aipass and drone commands on your PATH), then go to your own project and run aipass init. The reason the clone matters is that setup.sh wires the hooks into your CLI and gives you the full agent reference implementation to read - a bare package install can't do that.

**aipass init now starts empty by default.** This is a real reversal of an old rough edge. New projects used to get the entire agent scaffold dropped on them day one, which read as overwhelming. Now init opens with a template chooser, and empty project is the default - you get just your project folder, nothing else. The full framework (aipass_framework) is the second option, opt-in. Start clean, add agents when you actually want them.

Agents can now live in any project, not just inside AIPass. drone and spawn used to hardcode the src/aipass layout to find things. They now locate a project and its agents by walking up for a registry file and .trinity/ markers, so an agent created into any project gets tracked by that project's own registry, not AIPass's. This is the plumbing that lets the framework run other projects. (One helper still keys on the AIPass registry name - not fully generic yet, being honest.)

A kernel-enforced filesystem sandbox for agents - off by default. Set a flag and each dispatched agent launches inside a bwrap + seccomp mount namespace. Reads stay fully open, but deletes and overwrites of protected paths (.git, sibling agent trees) fail at the kernel no matter how they're phrased - rm, os.remove, find -delete, the editor, all hit a read-only filesystem. Privileged deletes route through an out-of-process broker with an HMAC identity handshake. If the sandbox can't initialize, the spawn aborts rather than quietly running unprotected. It is inert unless you turn it on, and it is Linux-only. (DPLAN-0202)

The system can wake itself on a schedule. Each branch owns a .daemon/schedule.json; a systemd user timer fires every couple of minutes, scans for due jobs, and wakes those branches with no human in the loop. The wake runs in its own transient systemd unit so it survives the timer's cleanup. Install-it-yourself and Linux/systemd-only for now.

Memory reliability, told straight: rollover had been silently dead for weeks. The mechanism that rolls old memory entries out to vector search when a file fills up was quietly not firing - a hook was reading its limits from the wrong place and always fell through to a fallback that never triggered. It is fixed end to end, and the fallback that hid the failure was deleted so it fails loudly next time instead of silently. Also unified all four memory file sections onto one schema and moved the config behind a single self-healing loader (it had drifted across nine readers with disagreeing defaults).

Backup is fully rebuilt, and it was dropping files it shouldn't have. @backup now does snapshot plus a versioned baseline-and-diff store plus Google Drive sync, with a real restore command. Along the way we caught it skipping every dotfile from the offsite copy - which meant the memory directories, the vectors, and the mailboxes were not being backed up. Fixed; the offsite copy now matches the local one.

Compass - a decision log you can search. A new /compass command records design decisions into a local SQLite database with full-text search, tagged by outcome (good / bad / impressive / interesting). Separate from the memory system on purpose: memory ingests everything, compass is the curated record of calls that mattered.

Prompt injection is tiered now. The single always-on prompt block that got re-sent every turn is split in two: a small kernel (~2KB) that fires every turn, and the full navigation map (~8KB) that fires at session start, after compaction, and every fifth turn. More navigation context reaches the agent, less is paid per turn. The old single-prompt loader was retired.

Supply-chain trust. The release workflow now signs each build with Sigstore (keyless - no signing key exists to steal), on top of PyPI Trusted Publishing. Tightened the last CI workflow that was running with broad token permissions, and closed the clear-text-logging findings so no secret value ever prints to stdout - which matters here because Claude Code reads command output into its context.

Fresh numbers:

• Stars: 228 (up from 190 last update)
• Forks: 32
• Citizens: 17 (up from 13 - added @daemon, @skills, @commons)
• Latest release: 2.6.1
• Tests: 8,400+
• CI: green

Full changelog in the repo at CHANGELOG.md.

https://github.com/AIOSAI/AIPass/blob/main/CHANGELOG.md

Raw dev logs always here at r/AIPass.

Update #7. Covers two releases since the last post, 2.6.0 (Jun 23) and 2.6.1 (Jul 2). The through-line this cycle: reach your agents from outside the terminal, and let projects that aren't AIPass use the framework.

You can now text a running agent from Telegram - and it lands in the live session, not a separate bot. A Telegram message to a branch's bot gets typed straight into that agent's already-running Claude Code terminal. The bridge finds the live session by reading the PID files Claude Code writes under ~/.claude/sessions/, matches it to the tmux pane by working directory, and injects your message with tmux send-keys. When the agent finishes, a Stop hook tails the session transcript and sends the reply back to Telegram. It is a real round trip into a live coding session, proven end to end from an actual phone. Four bots run under systemd on my box right now. (PRs #646, #650)

The honest limitation, stated plainly: it only works locally. Anthropic's terms don't allow a cloud bot to use your Claude login, so the session has to run in tmux on your own machine, and it needs bot credentials and a small boot shim. That is a hard ceiling, not a to-do. I would rather tell you the boundary than sell around it.

Install changed - it is clone-only now, and pip install is retired. If you followed an earlier post that said pip install aipass, that path is no longer the supported one. The new install is one path: git clone the repo, run ./setup.sh (puts the aipass and drone commands on your PATH), then go to your own project and run aipass init. The reason the clone matters is that setup.sh wires the hooks into your CLI and gives you the full agent reference implementation to read - a bare package install can't do that.

**aipass init now starts empty by default.** This is a real reversal of an old rough edge. New projects used to get the entire agent scaffold dropped on them day one, which read as overwhelming. Now init opens with a template chooser, and empty project is the default - you get just your project folder, nothing else. The full framework (aipass_framework) is the second option, opt-in. Start clean, add agents when you actually want them.

Agents can now live in any project, not just inside AIPass. drone and spawn used to hardcode the src/aipass layout to find things. They now locate a project and its agents by walking up for a registry file and .trinity/ markers, so an agent created into any project gets tracked by that project's own registry, not AIPass's. This is the plumbing that lets the framework run other projects. (One helper still keys on the AIPass registry name - not fully generic yet, being honest.)

A kernel-enforced filesystem sandbox for agents - off by default. Set a flag and each dispatched agent launches inside a bwrap + seccomp mount namespace. Reads stay fully open, but deletes and overwrites of protected paths (.git, sibling agent trees) fail at the kernel no matter how they're phrased - rm, os.remove, find -delete, the editor, all hit a read-only filesystem. Privileged deletes route through an out-of-process broker with an HMAC identity handshake. If the sandbox can't initialize, the spawn aborts rather than quietly running unprotected. It is inert unless you turn it on, and it is Linux-only. (DPLAN-0202)

The system can wake itself on a schedule. Each branch owns a .daemon/schedule.json; a systemd user timer fires every couple of minutes, scans for due jobs, and wakes those branches with no human in the loop. The wake runs in its own transient systemd unit so it survives the timer's cleanup. Install-it-yourself and Linux/systemd-only for now.

Memory reliability, told straight: rollover had been silently dead for weeks. The mechanism that rolls old memory entries out to vector search when a file fills up was quietly not firing - a hook was reading its limits from the wrong place and always fell through to a fallback that never triggered. It is fixed end to end, and the fallback that hid the failure was deleted so it fails loudly next time instead of silently. Also unified all four memory file sections onto one schema and moved the config behind a single self-healing loader (it had drifted across nine readers with disagreeing defaults).

Backup is fully rebuilt, and it was dropping files it shouldn't have. @backup now does snapshot plus a versioned baseline-and-diff store plus Google Drive sync, with a real restore command. Along the way we caught it skipping every dotfile from the offsite copy - which meant the memory directories, the vectors, and the mailboxes were not being backed up. Fixed; the offsite copy now matches the local one.

Compass - a decision log you can search. A new /compass command records design decisions into a local SQLite database with full-text search, tagged by outcome (good / bad / impressive / interesting). Separate from the memory system on purpose: memory ingests everything, compass is the curated record of calls that mattered.

Prompt injection is tiered now. The single always-on prompt block that got re-sent every turn is split in two: a small kernel (~2KB) that fires every turn, and the full navigation map (~8KB) that fires at session start, after compaction, and every fifth turn. More navigation context reaches the agent, less is paid per turn. The old single-prompt loader was retired.

Supply-chain trust. The release workflow now signs each build with Sigstore (keyless - no signing key exists to steal), on top of PyPI Trusted Publishing. Tightened the last CI workflow that was running with broad token permissions, and closed the clear-text-logging findings so no secret value ever prints to stdout - which matters here because Claude Code reads command output into its context.

Fresh numbers:

• Stars: 228 (up from 190 last update)
• Forks: 32
• Citizens: 17 (up from 13 - added @daemon, @skills, @commons)
• Latest release: 2.6.1
• Tests: 8,400+
• CI: green

Full changelog in the repo at CHANGELOG.md.

https://github.com/AIOSAI/AIPass/blob/main/CHANGELOG.md

Raw dev logs always here at r/AIPass.

Update #6. This one covers the last cycle (two changelog tags, W22 and W23). The theme was making AIPass actually safe and actually work outside of AIPass itself.

Leading with the scary one because that's the honest order.

We caught a spawn bug that would have destroyed every citizen in one command. drone @spawn update compared a freshly-created branch against its class template by content hash with rename-detection. Because the create path regenerated template IDs in filesystem-walk order (not the master's hand-crafted order), a branch created seconds earlier produced 30 proposed renames that rotated identity and memory dirs into each other - and deep-merged stale template into live .trinity/ memory. update --all would have run that across every branch. Caught it, rebuilt the update engine on an explicit named-files + path-based model (.trinity/, dashboards, birth certs are create-only, never touched on update), deleted the old ID-based engine. Fresh-branch create==update now yields 0 renames, 0 merges. (#636)

Destructive ops are dry-run by default now. Direct fallout from the above. drone @spawn update and repair preview by default - you need an explicit --apply to actually write. Forgetting a flag is now a safe no-op instead of irreversible damage.

Safe delete: drone rm + an rm_gate hook. Recursive rm -rf is now blocked at the hook layer and redirects you to drone rm, which confines deletes to the project root and temp dirs and hard-refuses .git, .trinity/, .aipass/, sibling branches. Provider-agnostic (runs in the hook engine, works for Claude Code and Codex). Retired the old blanket rm deny rules that blocked all /tmp cleanup with no guidance. (#630)

Hooks fire in every project now. New projects shipped with no hook config, which meant zero hooks fired - identity injection, security gates, audio cues, none of it. aipass init now writes .aipass/hooks.json so the engine works out of the box, and aipass init update union-merges it so your on/off choices survive. doctor checks for it.

Security gates are fully project-aware. The edit gate and subagent stop gate were hardcoded to look for src/aipass/, so cross-branch write protection silently did nothing outside AIPass. Both now derive the package name from your actual directory - the hard blocks work in any src/<package>/<branch>/ project. (#605)

External projects can call AIPass branches now. drone @api (or any drone @X) from a non-AIPass directory used to fail with 'path escapes project root'. The resolver was validating against the wrong registry root. Fixed - external projects route correctly, security boundary unchanged. (#618)

First cross-OS wiring test. New e2e gate builds the actual wheel, installs it into a clean venv, and asserts real wiring on ubuntu/windows/macos: package install, aipass init scaffolding, a hook firing through the bridge with an observable log record, and drone resolving + subprocess-executing a real branch. It immediately earned its keep - caught two latent Windows bugs (aipass init and drone both crashed printing Unicode through a cp1252 stdout). Both fixed.

Gemini CLI fully removed. Google sunsets it June 18 for Antigravity (closed-source). Deleted the .gemini/ dir, GEMINI.md, and every reference across setup, README, hooks, monitoring. Claude Code and Codex only. (#608)

Retired the STATUS file flow. Per-branch hand-maintained status beacons plus a 70KB auto-aggregated central file nobody read - gone across all 13 branches. Live state was already covered by the dashboard, history by per-branch memory. The one useful bit (a scratch todo list) moved into a capped todos section in memory.

Security posture. Earned the OpenSSF Best Practices passing badge (100% of criteria, self-certified across all six categories) on top of the existing OpenSSF Scorecard. Pinned requests and the test container base image, upgraded pip to clear stale advisories. Every version tag now also cuts a GitHub Release with notes from the changelog.

Smaller wins. drone systems shows one-line descriptions for all 13 branches instead of blank lines (#607). Memory-pool files now vectorize and archive automatically on session-start and pre-compact instead of needing a manual command. All 13 branches at a genuine seedgo 100% under a stricter standard (fixed the checkers, didn't bypass the files).

Fresh numbers:

• Stars: 190 (up from 133 a month ago)
• Forks: 30
• Tests: 8,400+
• Citizens: 13
• PyPI: 2.5.1
• CI: green

Full changelog in the repo at CHANGELOG.md.

https://github.com/AIOSAI/AIPass/blob/main/CHANGELOG.md

Raw dev logs always here at r/AIPass.

​

Ok straight up, claude fully wrote the report, after we had a long duscussion and investigation into this, shocking reality.

Found this the hard way today so figured I'd share.

I had Claude pull my GitHub repo to check some stats. It told me I had 1 star and 68 commits. Reality: 185 stars, 1000+ commits. Off by a country mile.

Here's the kicker — it wasn't a training data thing. The web fetch tool caches pages. And it's cache-first: if there's already a stored copy of that URL, it just hands you that and never touches the live page. So I got served a snapshot of my repo from months ago, back when it basically was 1 star and a readme. Looked totally current. No "hey this might be stale" warning, no date, just clean-looking numbers from a different era.

That's the dangerous part. It's not that it's old, it's that it's old AND confident. If I didn't already know my own star count, that page would've looked completely legit.

The tell that saved me: I'd cloned the repo in the same chat, and the clone said 1000+ commits while the fetched page said 68. Two of its own sources contradicting each other. When that happens, the clone wins — a fresh clone literally can't be stale.

What actually works:

\- Niche/rarely-fetched URLs come back live (PyPI page and a tracker site both gave me current data same chat — no cache sitting in front of them)

\- Popular URLs that get fetched a lot (like a github repo page) are the ones likely to serve a fossil

\- Cross-check anything that's a live number against a second source

\- If you're in Claude Code, you're mostly fine for this — files and git pulls are ground truth, no cache layer lying to you

TL;DR: for anything that's a fast-moving number behind a URL — stars, prices, "latest version," today's news — assume the fetch might be stale unless you can see where it came from. Make it show its source. It's honestly pretty good when you do that, it just won't volunteer that it's looking at a ghost.

https://thenextgentechinsider.com/pulse/aipass-launches-local-multi-agent-framework-with-persistent-memory

Hey everyone,

I wanted to give a shoutout to a cool little project I came across: [HVTracker](https://hvtracker.net/)

It's an independent, open-source leaderboard that ranks 172+ open-source AI agents and frameworks using real, verifiable signals instead of hype, marketing, or GitHub stars alone.

They calculate an HVTrust score (0-100) based on things like:

- Maintenance activity

- Supply chain security / provenance

- Transparency

- Adoption metrics

- Safety & integrity signals (OSSF Scorecard, signed commits, etc.)

It’s broken down by categories (Agent Frameworks, Coding Agents, Browser Use, Memory, Observability, etc.), shows daily movers, and each project has a detailed breakdown page.

What I like most is that it feels honest and useful. In the current AI agent gold rush, it’s hard to tell which projects are actually maintained and trustworthy versus ones that launched with hype and then went quiet. This helps cut through the noise.

The whole thing is open source and updated daily. Looks like a solo or small-team effort right now, but it has real potential if more people in the community start using and contributing to it.

If you’re evaluating tools like LangGraph, CrewAI, AutoGen, LlamaIndex, Haystack, n8n, etc. — definitely worth checking out.

Link: https://hvtracker.net/

What do you think? Anyone else using it?

Update #6. Second weekly release (2026.W22).

The theme this week was making things actually work in external projects, not just inside AIPass itself. A few things were quietly only half-wired - this release closed those gaps.

**Hooks fire in every project now.** This is the big one. New projects shipped with no hook config, which meant zero hooks actually fired - identity injection, security gates, audio cues, none of it. `aipass init` now writes `.aipass/hooks.json` so the hook engine works out of the box. `aipass init update` union-merges the template so it preserves any on/off choices you already made. doctor checks for it too.

**Security gates are fully project-aware.** The edit gate and subagent stop gate were hardcoded to look for `src/aipass/`. That meant cross-branch write protection silently did nothing outside AIPass. Both now derive the package name from your actual directory, so the hard blocks work in any `src/<package>/<branch>/` project. 9 new tests covering external projects. Closes #605.

**`drone *@hooks status`.** New read-only viewer for a project's hook config - master switch, every hook's enabled state, matchers, enabled/total summary. Walks up from your current directory to find the config.

**`drone systems` shows descriptions now.** All 13 branches have one-liner descriptions in the registry. Used to be blank lines next to each agent - now it tells you what each one does. Closes #607.

**Gemini CLI fully removed.** Google sunsets it June 18 for Antigravity (closed-source). Last week I dropped it from the init choices. This week it's gone completely - deleted the `.gemini/` directory, `GEMINI.md`, and stripped every reference from setup, README, hooks, and monitoring. 21 files, -927 lines. Claude Code and Codex only. Closes #608.

**OpenSSF Scorecard.** Added the official OSSF Scorecard action - runs on every push to main plus weekly. Public security health score at scorecard.dev, badge in the README. Actions pinned by SHA.

**GitHub Releases automation.** Every version tag now cuts a GitHub Release with notes pulled straight from the changelog, dist attached. PyPI publish and the GitHub Release fire from the same tag - no manual steps.

**@hooks hardened to 100% seedgo.** The hooks citizen took full ownership of its branch - verified every handler is wired and firing, rewrote its README, resolved stale tests (253 passing). It's now a proper service in `drone systems`, not a workshop.

Fresh numbers:

* Stars: 174 (up from 133 two weeks ago)
* Forks: 26
* PRs merged: 620+
* Tests: 8,400+
* Citizens: 13
* PyPI: 2.5.0
* CI: green

Full changelog in the repo at CHANGELOG.md.

https://github.com/AIOSAI/AIPass/blob/main/CRaw dev logs always here at .

I dont think this subreddit gets enough attention.

Most multi-agent setups I've seen treat agents like isolated workers. Each one gets a task, runs it, returns a result. No awareness of each other. No way to coordinate. Just parallel execution with a shared clipboard.

I've been building a multi-agent framework in public for about 4 months. 13 agents, 8,400+ tests, 135 stars. Here's the thing I didn't expect to matter most - communication.

Each agent in my system is a domain specialist. The mail system only thinks about mail. The routing system only thinks about routing. They live in their own directories with their own identity files, their own memory, their own tests. A hook fires every session to load identity before anything else runs. No agent boots cold.

The problem was coordination. Agents can't write files outside their own directory - there's a hard block that rejects cross-branch writes. That's by design. But it means an agent that finds a bug in someone else's code can't just go fix it.

So I gave them email.

Here's what I expected: agents would share data. Pass results around. Maybe sync state.

Here's what actually happened: the first thing they did was file bug reports against each other.

One agent finds a test failure in another agent's domain. It sends an email: "Hey u/routing, your path resolution fails when the branch name has a dot in it. Here's the traceback." The routing agent gets woken up, reads the mail, and fixes it. No human in the middle.

There's a difference between "send" and "dispatch" - send drops a letter in the mailbox. Dispatch drops the letter AND rings the doorbell. It spawns the agent and points it at its inbox.

drone  send  "Bug report" "Path fails on dotted names..."
drone  dispatch u/routing "Fix needed" "Traceback attached..."

Send = mail. Dispatch = mail + wake.

The mail agent has 696 tests. Not because someone sat down and wrote 696 test cases. Because it kept breaking in production and every fix got a test. The routing system has 80+ sessions of experience doing nothing but routing. These agents aren't reliable because they have better models - they're reliable because they've been failing and fixing for months.

Agents dispatch each other freely. If the test runner finds a bug in another agent's code, it wakes that agent directly. The orchestrator doesn't need to approve. Only the orchestrators themselves are protected from being dispatched - you don't want a worker agent waking up the CEO for grunt work.

Security is enforced not conventional. Agents can't forge messages by writing directly to another agent's inbox file - they have to use the mail system. Same with the write blocks. Hard enforcement, not "please don't."

There's a monitoring layer so I'm not flying blind. Audio cues on every agent action - I hear what's happening without watching a terminal. Real-time dashboard shows everything. If an agent hits the same error 2-3 times, a watcher catches the pattern and dispatches the right specialist to investigate. I stay in the loop through visibility not approval gates.

The whole thing is open source. pip install aipass + two init commands and you're running. CLI-based, built on Claude Code. Linux focused rn.

https://github.com/AIOSAI/AIPass

r/AIPass

Genuine question - has anyone else tried giving agents communication instead of just better reasoning? Everything I see is about making individual agents smarter. Nobody seems to be building the coordination layer.

Update #5. First weekly release.

AIPass now follows a Sunday release cadence - changes build up on dev all week, then merge to main as a single versioned release with a changelog. CalVer format: 2026.W21. This is the first one.

Big changes this week:

Hook engine. Replaced 14 standalone shell/Python scripts with a centralized dispatch system. One bridge receives events from the CLI (Claude, Codex), routes them through a Python engine that reads per-project config, and logs every invocation. Each project can now enable/disable individual hooks via .aipass/hooks.json without touching provider settings. The old scripts are still on disk for reference but nothing calls them anymore.

Audio feedback. All 14 hook handlers now produce spoken audio cues via Piper TTS. You can monitor sessions without watching the terminal. Toggle with drone @hooks hooksound on|off - muting silences audio without skipping the hook logic.

@hooks is the 13th citizen. Owns all hook infrastructure - engine, bridge, handlers, config schema. Has its own passport, memory, the works.

README rewrite. New identity line - "Persistent Agent Workspace." New one-liner - "AI agents that remember, collaborate, and never start from zero." Terminal demo GIF right at the top showing aipass init through to a working agent. Problem section tighter. Agent tables collapsed. BYOP framing - you bring your project, AIPass adds the agent layer.

Init handoff fix. aipass init run used to always pop open a new terminal window for the agent. Now it asks - stay here or new window. Staying here does the handoff inline. Means you can record the entire flow from init to agent conversation in one terminal session.

Gemini CLI dropped. Google is sunsetting it June 18 and replacing with Antigravity (closed-source). Removed from init choices, handoff options, and new project templates. Claude Code and Codex for now.

Project-aware prompts. The global prompt loader now detects if you're inside AIPass or an external project. External projects get their own lighter prompt instead of the full AIPass internal playbook.

Fresh numbers:

• Stars: 133
• Forks: 20
• PRs merged: 600+
• Tests: 8,400+
• Citizens: 13
• CI: green

Changelog is in the repo at CHANGELOG.md if you want the full details.

https://github.com/AIOSAI/AIPass/blob/main/CHANGELOG.md

Raw dev logs always here at r/AIPass.

Amazing

Interesting read

Cool

Most multi-agent setups I've seen are basically a room full of people wearing headphones. Agents running in parallel, no shared awareness, no idea who's doing what. That's not collaboration. That's coexistence.

I've been building this in public for almost 12 weeks. 12 agents, 6,500+ tests, 95 stars. Here's what I actually learned.

The problem wasn't memory. It was identity. An agent would be technically correct but completely off base. Not hallucinating. Drifting. Like a competent person who walked into the wrong meeting and started contributing without realizing they're in the wrong room. I spent weeks on better memory - longer context, better embeddings, persistent state. None of it fixed the drift. The problem wasn't what the agent remembered - it didn't know who it was.

What fixed it was three files. Every agent gets a passport.json - who am I, what I do, what I dont do. Maybe 30 lines. Rarely changes. Then local.json - rolling session log, key learnings, caps at 20 entries and auto-archives to vector search when full. And observations.json - collaboration patterns, how I work with other agents. Identity loads first every session via hooks. Agent never starts cold.

I have 12 agents now and each one is a domain specialist. The mail system has 696 tests it built through its own bugs. Routing system is 80+ sessions deep - all it thinks about is routing. They dont do each others jobs. When something breaks in another domain they email each other. The orchestrator dispatches work to them and trusts them because they know their own code better than it does.

Every time I post about this someone asks what happens when two agents write the same file. Fair question. They cant. Not as in "we tell them not to" - there's a hook called pre_edit_gate that fires before every write. If an agent in branch A tries to edit a file in branch B's directory, the write gets rejected. Hard block. The agent sees "cross-branch write blocked" and has to either ask a trusted branch to make the change or send a mail request through drone. Only 3 branches in the whole system (the orchestrator, the auditor, and the factory that creates new agents) are allowed to cross-write. Everyone else is physically confined to their own directory. We also lock inboxes - agents cant forge messages by writing directly to another agent's mailbox file. They have to use the mail system. This isnt a convention. Its enforcement.

This week I stopped building features and started testing. Took an old MacBook, wiped it, installed Ubuntu from scratch. Cloned on a machine with nothing pre-configured. Found every setup blocker - git config missing, venv broken on fresh Ubuntu, hooks not wired. All fixed now. Install went from \~2GB down to \~100MB. Built a concierge agent that walks new users through onboarding - 12-stage flow, 243 tests on it. First impressions matter and ours was rough ngl.

95 stars. Small project. I'm a solo dev tbh and the agents help build and maintain themselves - every PR is human-AI collaboration. The hardest part hasn't been the code. It's explaining what this actually is. People hear "agents" and expect a task runner. This isnt that. Its infrastructure for building systems that remember and coordinate. What u put on top is up to u.

Has anyone else hit the identity drift problem? Genuinely curious how others solved it - or if most just threw more context at it and moved on.

https://github.com/AIOSAI/AIPass

r/AIPass

Update #4. Last one was May 2.

Big week. DevPulse ran sessions S131-S136 in a single day. 39 PRs merged since May 1.
Stars went 85 to 95. Forks at 17.
Heres what actually shipped:

The new citizen is live. u/aipass is the concierge - front door for new users. Walks u through a 12-stage onboarding flow, runs doctor health checks, answers questions about how things work, then hands off to ur chosen CLI. 243 tests on it. Read-only by design - it reads everything but writes nothing. Its the 12th citizen.

Install footprint went from ~2GB down to ~100MB. Swapped sentence-transformers + torch for fastembed. Same vector search, fraction of the download.

Hook infrastructure got a full overhaul. The big problem was hooks double-firing - provider settings and project settings both triggering the same hook. Fixed now. Built a provider_manifest.json as single source of truth for what hooks should exist at each level. Doctor checks are manifest-driven instead of hardcoded. Also built a 20-test hook testing framework so we catch regressions.

Security audit came back clean. 0 alerts across CodeQL, Dependabot, and secret scanning. Dismissed 5 false positives, bumped pytest and Pygments for CVEs, removed a fake API key pattern from test fixtures. Enabled Dependabot for ongoing monitoring.

Agent isolation is real now. pre_edit_gate blocks any agent from writing to another agent's directory. Hard block - the write gets rejected before it happens. Only 3 branches can cross-write: devpulse (orchestrator), seedgo (auditor), and spawn (factory). Inboxes are locked too - agents cant forge messages by writing directly to another agent's mailbox. Has to go through drone. Also added daemon confinement - dispatched agents are strictly confined to their own branch even if they try to escape via prompt injection.

Docker testbed is running. Real Dockerfile that runs the full user journey - git clone, setup.sh, aipass init, hook tests. 11/11 passing. Found and fixed: setup.sh was only symlinking drone to ~/.local/bin, not aipass.

All 6 setup blockers from the fresh-install testing round are closed. git config, venv, hooks wiring, secrets directory, empty hooks dir, settings under-wiring - all fixed.

Fresh numbers:

- Stars: 95
- Forks: 17
- PRs merged: ~444 total
- Tests: 6,500+
- Citizens: 12
- Security alerts: 0
- Seedgo compliance: 100% across all branches

Next up is finishing orchestrator onboarding (DPLAN-0165 Phase 2) and getting the concierge wired into pip install.

Raw dev logs always here at .

https://github.com/AIOSAI/AIPass

Dev logs at r/AIPass.