← Zulu Assistant · Release · v1.0.0 · October 31, 2026

Zulu Assistant 1.0: a human gate and a receipt for every irreversible agent action

Agents are good at work you can undo. The trouble starts with the steps you can't: a merge, a push to main, a deploy, a message sent to a customer. Until now, Zulu Assistant asked agents to escalate those steps, and they usually did. In 1.0, the first stable release, the system enforces it.

Guardrails

A hook in every Claude Code and Codex session checks each command before it runs. These no longer run when an agent tries them: merges, pushes to protected branches or public remotes, deploys, secret changes, a guarded script's --commit/--apply run (a dry run is required first), outbound sends, store writes through MCP, deletes outside the working tree, schedule changes and edits to the gate itself.

The command waits for you on the ledger task, showing the exact command, folder and agent. You approve that exact call on the board, your phone or your own terminal. It runs once, on a single-use grant that never leaves the board, and the task keeps a receipt of the attempt, your decision and the run. A task can't close while a gate is still open.

• Fails closed. If the board is down, gated calls are denied. Calls that aren't gated pass in milliseconds.
• Your policy. The classes live in policy.json, rendered into POLICY.md, with an observe mode for trying it out before enforcing it.
• A program go when you want one. Approve a task's plan once, and its routine merges into private repos and local service loads run without a tap, each with a receipt. You can revoke it from the board, and it ends when the task closes.
• Decide anywhere. A pinned WAITING ON YOU strip on the board, the Dock and the phone, a count in the tab title and the phosphor sidebar, and task.sh gate in your own terminal. Each receipt records where you decided.
• Approvals reach the agent. The notice is delivered even into a busy session, and the agent's sidebar row says the approval is waiting to be run.

The default policy enforces this for every agent in your cmux fleet. Sessions outside it are logged rather than held, unless you opt them in. Turn it on once with scripts/guardrails-install.sh --apply (add --codex for Codex), then restart your agent sessions. Want to watch first? mode: "observe" logs what would have been held without blocking anything. The Guardrails guide covers the classes, the rollout and how it fails.

The honest limit: Guardrails stops your agents' own mistakes. It doesn't stop a hostile program running as your user. The security model spells out what is trusted, what the gate stops and what it doesn't.

Context autopilot

Agents that run out of context get cut off by the CLI's own auto-compact, often mid-thought. The board now steps in first. At 70% it asks the agent to save its state file. At 80%, once the save has landed, it types /compact at the agent's next idle moment, then tells it to re-read its state and carry on. At 90% it compacts even without a save and tells Mission Control. It never types into a busy pane, a dialog or a half-typed draft. It's off by default (SETTINGS.contextAutopilot, with an observe mode).

Backup and restore

zulu backup writes your ledger, state and config to one tarball with a hash for every file. It's lean by default, and secrets stay out unless you ask for them. zulu restore shows what would change, checks every hash and takes a safety backup before it writes. Secrets stay out of a restore too unless you add --with-secrets.

Try it, or upgrade

curl -fsSL https://zuluassistant.com/install | bash

Just looking? ./install.sh --demo runs a synthetic board, gate included, with Node only. Nothing on your Mac is touched.

Already on a beta? 1.0 upgrades by hand: git pull in your clone, re-run ./install.sh (it adds new example files and never overwrites yours) and restart the board. The exact steps are in the install guide, §7b, and the release notes list the settings to copy into your config. Tested versions are in VERSIONS.md. One-click upgrades from the board are coming in 1.1.

Full notes: the v1.0.0 release and the changelog. Questions and install reports are welcome in Discussions.