Agent Loop
Pydantic-validated tool calls, PreToolUse/PostToolUse hook pipeline, permission governance. Works with any model.
Lossless Context Management
DAG-based conversation compression. Every message persisted to SQLite. Old messages summarised into expandable nodes. FTS5 full-text search. Works within 32K context windows.
SENTINEL
Proactive background intelligence. Watches telemetry, sends nudges during idle. AutoDream engine: wiki lint, memory consolidation, telemetry digest, knowledge synthesis. Budget-capped. Never exceeds autonomous trust level.
Wiki Knowledge System
Compounding knowledge base. Memory Extractor runs every 30 min. WikiCompiler builds entity pages with cross-references. Query results file back as new pages. Obsidian-compatible.
Security Gate
Four trust levels: BLOCKED, APPROVE, AUTO, AUTONOMOUS. Configurable deny lists over a floor no mode waives: rm -r at a protected root is refused, and what substring patterns used to catch is left to what actually holds — resource limits and, on Linux, the kernel floor. Workspace boundary enforcement, bash intent analysis, memory security scanning. Token-authenticated REST and WebSocket control plane.
Public Surface Hardening
The chat gateways are the one surface exposed to the internet by design, so they are checked cheapest-and-earliest-first. Per-chat rate budgets under a global ceiling. Declared MIME and the size cap before download — then the download under a hard byte ceiling, because the peer supplied that size and the pre-check believed it. Magic bytes are sniffed after; a declared type that disagrees is refused.
Tokens Redacted Before They’re Kept
Known token shapes become <redacted> before conversation history, memory, telemetry or training data is written. The live conversation is left alone, so a token you paste still works for that session. oara scrub finds what earlier releases kept, and changes nothing until --apply.
Model Adapter Layer
Tool calls that actually work on local models. Validator catches malformed tool calls. Formatter translates between model formats. Enforcer constrains output to valid schemas. Each model runs at a tier: the registry’s, or for a local model it doesn’t know, the one its served chat template implies — and adapter.model_tiers overrides it per model. Retry engine with structured error feedback.
Coding Mode
Point the agent at a coding task and it iterates in a sandbox until the build and tests pass. With LSP enabled, diagnostics feed type errors back into the same loop, so it self-corrects against compiler ground truth. The result is a reviewable diff — nothing touches your branches until you merge.
Fine-Tuning Flywheel
Successful tool-call traces and adapter repair-pairs are captured, stored and mined into an exportable dataset. The data-collection half of a LoRA loop for the local model — training is on the roadmap. Fed by telemetry that never leaves your disk, and one config line turns it off entirely.
Record a Skill
Demonstrate a task once — screen and DOM captured — and the daemon distils it into a reusable skill. Two-tier trust: a recording of the page itself becomes a skill once it passes a quality gate, while one read from the screen alone waits as a draft until you accept it. A screen recording of you doing your job is among the most revealing data you own, and every frame stays on your disk.
Skills That Get Used
The skill tool is offered by default, even in a config setup wrote before it was. Every load is counted: /skills shows when each skill was last used, and the Curator ages skills by real use, never by file date. GEPA — off by default, experimental — proposes improvements from real loads, and nothing changes until a person runs oara gepa promote.
Evals with Judge Provenance
A local LLM judge scores task completion, tool accuracy and hallucination using constrained decoding on your own hardware. Every score records which judge produced it — base URL, model, and whether that model was pinned or auto-detected. Records written before this carry no judge at all: that means unknown, permanently, and they are not compared across paths.
Durable Runtime
Sessions survive daemon restarts. A running turn can be stopped mid-flight. Artifacts produced in chat are downloadable from the session.
Backend Registry
One table of every local inference box you own, probed for the served model, its reported context window, detected vision and latency. A switch is probed first and refused if the box is down; the chat is budgeted at that box's window and the choice survives restarts.
