J.A.R.V.I.S.

01Overview

• Models may choose what information helps. They never choose what the computer executes.
• Answers that claim an action the runtime never took are refused before they are shown or spoken.
• The window and the host talk over a parent-child pipe, so no local port is ever opened.
• No transcripts anywhere. Tests assert that the columns do not exist.

02What I built

03Architecture

Three surfaces share one TypeScript core. Routing is decided by compiled rules before any model is involved, and authority lives in a registry that no prompt, configuration key or model output can widen.

04Hard problems

1. P1

   Stopping a model from claiming actions it never took

   Problem

   On a 79-case adversarial test set, the local model produced six fluent claims of granted authority or completed changes, while the broker had in fact refused everything.

   What I did

   I added a postcondition instead of a better prompt. The runtime records receipts of what actually executed, and any claim of authority, mutation or memory is checked against them.

2. P2

   Isolating agent CLIs that ship with shells, browsers and computer use

   Problem

   Frontier CLIs carry their own tools, and their isolation flags do not always mean what they say. An empty allow-list is not always deny-all, and some CLIs read context files from their working directory.

   What I did

   I checked each CLI's flags against its installed source. The adapters now use compiled argument literals, explicit sentinel values, empty scratch working directories and an environment allow-list, so a provider brings intelligence but no machine authority.

3. P3

   Voice latency dominated by model round trips

   Problem

   Physical testing showed that spoken requests were slow because every request made two provider round trips, even questions the system could answer from its own state.

   What I did

   I moved lane selection in front of the models. Questions about the assistant's own state are answered from compiled evidence with zero provider calls, and only open-ended requests reach a model.

4. P4

   A task queue that never fabricates completion

   Problem

   A restart may lose running work, but it must never report work as finished, restore permissions it should not, or loop on a crashing task.

   What I did

   Interruption is inferred from durable rows, recovered tasks are re-queued without their permissions, and attempts are counted when execution starts. A single-writer lock uses process identity and start time to decide liveness.

5. P5

   Honest bilingual speech

   Problem

   A Bulgarian phrase was spelled out letter by letter by an English voice and still reported as a success.

   What I did

   Speech is routed by detected language. A turn gets a voice that speaks its language, or silence with a stated reason.

05Decisions

Tiers are compiled constants, not configuration.

No config key, environment variable or request field can raise privilege. Moving the ceiling takes two reviewed code changes.

The Markdown vault is the only authoritative memory.

No derived layer may be the only owner of a fact, and memory stays readable as plain files even without the assistant.

A pipe between window and host, not a socket.

Any local process can reach a listening port. A parent-child pipe is reachable by exactly two processes.

Rust as a thin shell, Node as the host, Python only for audio and ML workers.

Capability logic stays in one typed core that every surface shares.

Wake-word listening is a sensor, on a separate axis from operations.

Hearing a room is a privacy question, not a question of what the system is allowed to change.

No numeric confidence scores on memories or findings.

A single number blends origin, standing and age into something that looks more authoritative than it is.

No agent framework, vector database or message broker.

Every dependency is a reviewed decision, pinned to an exact version.

06Status

07What I learned

• Safety properties hold up when they are compiled constants and tests that assert what must not exist, not instructions in a prompt.
• Physical testing finds what unit tests miss. Latency, audio devices and a window that shows "online" over stale data all surfaced on real hardware.
• Directing several AI coding agents works only when the boundaries, decisions and defects are written down and kept current.

08Stack

• TypeScript
• Node.js
• SQLite
• Zod
• Rust
• Tauri
• React
• React Three Fiber
• LLllama.cpp
• Qwen3
• Claude
• Model Context Protocol
• Python
• STTfaster-whisper
• TTSPiper TTS
• GitHub Actions
• WINWindows
• Linux