aigent-OS

Least privilege is documented: the installer avoids sudo, does not touch user-level ~/.claude config, refuses writes through symlinks, and confines writes to the target (2). Not full marks because hooks run with user OS permissions and the authority matrix is explicitly doctrine, not enforcement. User confirmation exists via --dry-run and backups, but a default install appends to ~/.bashrc, edits PATH and creates shortcuts, so consent granularity is coarse (2). Data-flow transparency is the strongest area: README and install-security enumerate npm, Hugging Face model download, vault git push, optional bridge and Codex, and warn that a cloned-folder origin points at the public repo (3). Sensitive data handling includes credential redaction, a confidential deny list and a persisted-text render boundary, but all are self-described defense in depth over plaintext markdown (2). Dependency security uses npm ci --ignore-scripts with lockfiles, but no SBOM or vulnerability-scan evidence is present (2). External effects include automatic /clear, git commit/push and PATH wiring, all documented with rollback, but auto-push and auto-clear are high-impact (2). Rollback is thorough: backups, quarantine, uninstall steps, doctor diagnostics (3). Source attribution: MIT names Will Gwyn and README links theaigent.xyz and a companion paper, but publisher identity is unverified by the registry and releases are unsigned, so 1.

Self-consistency: docs proactively disclose the rc.1 clear-step defect, a known ACTIVE_STATE path split, and a corrected earlier doc error, which is honest but shows live inconsistencies (2). Dependency availability: Node 18+, bash, optional Python3, lockfiles and three-OS CI install tests support it, but node-pty needs local rebuild and the embedding model downloads on first run (2). Failure messages: doctor.sh, --dry-run, [quarantine]/[skip] lines and DEGRADED/UNKNOWN exit semantics are documented, but DEGRADED exits 0 and requires parsing the terminal string, an easy misuse trap (2).

Audience and scenarios: aimed at single-seat long-running Claude Code users, with FAQ covering compaction comparison, Windows, cost and data egress (2). Capability boundaries: a table marks each capability On by default / Opt-in / Experimental / Roadmap and states plainly that the authority matrix is not enforced and the injection scan does not block, which is unusually clear (3). Trigger precision: configurable 80% threshold and an exact acknowledgement gate, but rc.1 ack edge cases (#90/#91 fixed on master, unreleased) leave a gap (2). Environment fit: Windows needs Git Bash, macOS has the least live mileage, CI covers three platforms, so breadth is good but maturity is uneven (2).

Information architecture: README sections are clear and docs/ splits getting-started, install-security and security with a full state-layout diagram (3). Install notes: dry-run, --target, --no-deps, --trust-existing, operator-owned declarations and checksum-pinned install are all detailed (3). Naming stability: /open and /close are retired but files remain, and the ACTIVE_STATE path split shows legacy naming debt (2). Examples and FAQ: rich FAQ with a runnable injection-scan test and full uninstall steps (3). Known limitations: a dedicated Evidence and limits section lists single-seat evidence, rc.1 defects and unverified bridge (3). License: full MIT text in repo (3). Versioning/changelog: README cites v1.1.0-rc.1 and v1.0.0, but no CHANGELOG is in the evidence and the Latest tag lags the rc, which is confusing (2). Maintenance responsibility: SECURITY.md states individual maintenance, non-SLA targets and a not-yet-enabled private channel, clear but thin (2).

Output usability: capsules are readable, diffable markdown in git, operator-friendly (2). Marginal value: explicit checkpoint instead of model summary is a real trade-off, but the author declines to claim superiority over compaction and 11/11 single-seat evidence is thin (2). Cost-benefit: free MIT, but each cycle spends tokens writing and reading a capsule and requires Node/npm/node-pty plus a first-run model download, so value depends on long sessions (2).

Claim traceability: README ties 11/11 evidence to a companion paper and case study and cites specific PR/issue numbers (2). Cross-source corroboration: CI workflows match documented install and daemon tests, but core Auto-Refresh behavior has no public reproducible test evidence beyond a single-seat self-report (2). Fact/inference separation: docs repeatedly distinguish shown, not-claimed and roadmap, and label the demo as a scripted illustration rather than a recording, which is done well (3).