v3.0 — Autonomous always-on agent

One release, four stories: survive the June 15 billing change, become a real agent instead of a pipeline, let the agent run its own schedule, and capture everything you throw at it.

1. Persistent interactive session (the billing story)

From June 15, 2026 claude -p / headless runs bill against a separate paid Agent SDK credit. v3.0 removes claude -p from the runtime entirely: the bot drives one long-lived interactive Claude Code session in tmux — typing prompts into the pane programmatically and extracting replies via line-anchored markers. Interactive usage stays on the flat Pro/Max subscription.

• ClaudeSession: cross-process flock, marker protocol (<<<R:ID>>>/<<<E:ID>>>), state classification (trust prompt / starting / ready / rate-limited / logged-out / onboarding), self-recovery
• Liveness redefined: hung = stuck without visible work, not silence — a long quiet task survives, a wedged pane doesn't (shared is_working() predicate for ask-stall and watchdog)
• scripts/check-no-claude-p.sh guards the invariant in CI and on every install

2. Conversational agent (the autonomy story)

The bot is no longer a one-shot report machine:

• Unified voice + text chat — no debounce, messages route to the session immediately
• Live-turn input: plain text steers the running turn, stop-words interrupt it, anything else queues
• Slash commands split by behavior: /skill-name is a normal model turn (markers work), /clear /compact /model are fire-and-forget control, TUI-only commands get a polite refusal
• Persona with a boot assertion: the brain refuses to start without its identity file (deploy/brain-system.md), and the reply-marker contract is conditional — steered input mid-turn doesn't force HTML wrappers
• autograph (v0.2.0) replaces agent-memory/graph-builder/vault-health as the single typed memory engine: card schema, Ebbinghaus decay, graph health, MOCs, dedup

3. Cron subsystem (the routines story)

The agent manages its own schedule from plain language ("remind me in an hour", "every weekday at 18:30 check my inbox"):

• In-bot asyncio ticker (60s) over jobs.json — the brain edits the file via python -m d_brain.cron (add/list/remove/enable), the ticker hot-reloads it; no RPC, just a flock-guarded file
• Second isolated tmux session for job runs — a firing reminder never blocks your conversation; /clear after every job keeps it stateless
• Schedule union at | every | cron (croniter + IANA tz), one-shots auto-delete after success
• At-most-once semantics: next_run advances and persists before execution; one-shots re-arm a retry slot so a crash mid-run refires instead of bricking
• Self-healing: failed runs recover the session, 3 consecutive errors auto-disable the job and alert the admin with the re-enable command; [SILENT] replies suppress delivery (quiet monitoring jobs)

4. Total capture (the media story)

Voice and text were never the whole life stream:

• Photos, documents, video, audio, animations, video notes — downloaded into the vault, the brain Reads the files itself (images, PDFs natively) and files the takeaways
• Albums arrive as one prompt, not N separate turns (media-group buffering)
• Forwarded posts keep attribution (user / channel / hidden sender)
• Never silent: every unknown message type gets an honest reply instead of a void; error paths are HTML-escape-safe so even failures answer

Breaking changes

Removed entirely (code, deps, skills, units): Todoist integration, weekly digest, router escape-hatch (RouterSession, DBRAIN_MODE), /do FSM flow, photo/forward handlers, skills agent-memory / graph-builder / vault-health / todoist-ai. Input is voice, text, photos, files, albums and forwards.

Upgrade

ssh your-server
cd agent-second-brain && bash upgrade.sh

Idempotent: installs tmux, migrates d-brain-* → dbrain-* systemd units, retires the weekly timer, restarts, health-checks.

Hardening for the public release

Two independent review rounds on top of TDD:

• Deep audit (9 categories, ~70 raw findings, each verified against the code): fixed split_text dropping characters at chunk boundaries on long replies, fragile .env parsing, dependency pins, lint/tooling honesty
• Adversarial review: the pane transcript and ~/.dbrain are now owner-only (0700/0600, repaired on upgrade), user text can never be steered into a maintenance turn (maint- turn tagging), doctor exits non-zero on a red report so OnFailure= alerts actually fire, daily report goes to the first allowed user
• CI: ruff + pytest + the no-claude-p guard on every PR

Verification

• 222 tests green (TDD throughout: red → green → blind-agent review → refactor)
• check-no-claude-p.sh clean, personal-data guard clean
• Deployed and running in production: voice → vault card, media → graph, steering mid-turn, one-shot reminder fired from the second brain session and delivered to Telegram