A durable supervisor for work that outlives the browser.
Sleep Mode sits above coding agents without replacing them. It normalizes progress, lets a schema-constrained planner propose the next turn, applies deterministic policy, and dispatches bounded interventions through a local companion.
Core invariant Sleep Mode can request more authority, but it cannot grant itself more authority.
Cloud coordination. Local enforcement.
The control plane owns durable state and remote approvals. The companion retains local filesystem access, provider sessions, and the last word on whether a command is inside policy.
One coordinator per run
A SQLite-backed Durable Object serializes live state, WebSocket clients, timers, budgets, and the event cursor.
One typed proposal per cycle
AI Gateway supplies reasoning, while strict schemas, run-bound targets, immutable ceilings, and signed commands retain authority.
Workflows for the long wait
Durable steps survive failures, retry safely, and pause at approvals without keeping compute awake.
D1 for cross-run queries
Organizations, projects, policies, approvals, and audit metadata remain relational and searchable.
Signed evidence snapshots
D1 preserves exact morning-brief artifacts, signatures, historical public keys, and links to every underlying claim.
Autonomy is the intersection of five policies.
The effective permission for an action is the intersection of organization, project, device, provider, and run policy. Deny wins. A response level describes behavior, but never overrides a denied capability.
Designed for hostile output and imperfect agents.
Repository content, logs, tool output, and model suggestions can all contain prompt injection. Authorization is deterministic and executed outside the model context.
- The permission ceiling is immutable once a run is armed.
- Every remote command is typed, signed, expiring, and idempotent.
- Agent output is untrusted data—not authorization input.
- The local companion performs the final policy check before execution.
Credentials stay close to the work. The browser never receives agent tokens. Device keys are scoped, revocable, and used for short-lived command leases.
Native event streams over screen scraping.
Codex App Server · Observe · Nudge · Operate · One-time approvals
Structured process protocol · Observe · Nudge · Operate · One-time approvals
Structured stream JSON · Observe · Nudge
Agent Client Protocol v1 · Observe · Nudge
Agent Client Protocol v1 · Observe · Nudge
Agent Client Protocol v1 · Observe · Nudge
Signed GitHub webhooks · Observe · Operate · Replay protection
Trust grows one capability at a time.
Native Codex and Claude operate paths, five additional Observe/Nudge integrations, durable alerts, one-time approvals, and signed morning briefs.
Atomic macOS, Windows, and Linux packages, automatic updates, SBOMs, provenance, and fail-closed signing gates are release-ready.
Add managed rollback and first-run tray controls without widening the daemon's authority.
Complete independent penetration testing, billing, team roles, SSO, and GitHub App installation.