Decision log 0 — written down to be argued with
Most of what this system is was settled by a handful of early decisions. Writing them down does two things: it lets outsiders attack the reasoning instead of the marketing, and it stops us from quietly drifting away from our own rules. This is the format future posts will mostly take.
1 · Archive first; understanding is
regenerable. Originals — messages, documents, exports — are kept
unchanged, and everything the assistant believes is derived from them.
When better models arrive, the same life gets understood better without
anyone re-uploading anything. The archive is the asset; the
intelligence is a lens.
2 · Deletion beats immutability,
permanently. When a person deletes something, it leaves the archive
too — provably. An append-only ledger of someone's life sounds like
engineering rigor and is actually a trap. This carve-out is the one
exception to decision 1 and it is eternal.
3 · One understanding, many surfaces. The
phone, the voice call, the future speaker — every surface reads and
teaches the same understanding. No per-device memory, ever: a device
adds senses, never a second brain. Nobody should repeat themselves to a
"mode."
4 · Nothing executes unconfirmed. The
assistant drafts the email, prepares the calendar change — and a human
taps yes. Authority is a ladder climbed per-domain with explicit,
revocable grants and a permanent audit row for every action. Trust is
the slow part; we refuse to fake it with defaults.
5 · Operator access is granted, never
assumed. We dismantled our own god-mode: the administrator can open
a member's content only after that member grants support access —
revocable, recorded, visible in their own account. Running the service
never requires reading anyone's life. We built this against ourselves
first, because operator character is a risk category, and we are
operators.
6 · Exit is a tested code path, not a
promise. Export produces a sealed, signed archive that can rebuild
an account; leaving issues a receipt of what was destroyed and what
remains, with the consent basis for each retention; returning with the
archive reactivates what peers never revoked. We rehearse it. A right
you cannot exercise is décor.
7 · Open weights first — the exit engineered
before the entrance. The primary model is open-weights on a rented
endpoint: pointing the same system at hardware we operate is a
configuration change, not a migration. Stronger closed models exist; we
pay that gap for independence, and we say so plainly.
If one of these is wrong, we would rather hear it now, while the blast radius is one household. That is the entire editorial policy of this blog.