Most of the things I build start with something that bothers me. This one is simple, and it keeps happening. I put the day down, pick it up again, and have to reconstruct it from scraps: what I promised, what moved, what I was in the middle of. The software that offers to remember all that usually wants an account, a feed of pings, and a copy of my life on a computer I do not control.
I have been reading how other people tried to solve this. Memory systems, ADHD tools, local-first software, assistants that died when a company switched the servers off. It changed what I think a companion is allowed to be.
I already wrote a short field note that the future of agents is not a general-knowledge LLM. Function calling, interchangeable brain banks that grow as you use them, and less compute spent on a second copy of the internet. This is the longer version: the human problem underneath that, and the constraints I am no longer willing to negotiate away.
The deficit is not knowledge
Russell Barkley’s work on ADHD is the piece that stopped me treating this as a productivity failure. In his account, the trouble is not that you do not know what to do. Temporal myopia means behaviour is governed by what is near the present. Action toward a future goal happens when that goal finally enters now — which is why the scramble is always at the deadline, and why it is not a character defect.
Edmund Sonuga-Barke’s dual pathway adds a second route: delay aversion. Some of the time the executive system cannot hold the future in mind. Some of the time delay itself is aversive, and the behaviour is an escape. Those two failures want opposite kinds of help. A system that only lectures you in advance will feel useless for half of them.
Barkley’s practical sentence is the one I keep. Because the deficit is in using internally represented information at the moment of action, support has to be placed where and when the behaviour is required — the point of performance. Knowledge delivered yesterday does not transfer. Externalise time. Make it visible in the situation.
That is why Goblin Tools still looks more honest to me than another life-OS. Magic ToDo turns a vague obligation into steps. The Compiler takes a brain dump and returns actions. Taskmaster shows one thing. It does not try to be my calendar, my journal, and my personality. It meets overwhelm without the shame costume.
Peter Gollwitzer’s implementation intentions say the same thing in another dialect. “I want to do X” is a weak predictor of follow-through. “If Y happens, then I will do Z” is stronger, because the cue carries the action instead of willpower having to remember it. A next action is not a goal. It is a when-then.
The Zeigarnik effect is why open loops hurt. Unfinished tasks stay active in mind. Writing them down only unloads working memory if you actually trust the system. If items vanish, or sit as stubs, the tension comes back with interest.
I already knew some of this from the other direction. The dopamine system is not wired for “good things.” It fires on progress toward a goal you have defined, and it goes quiet when you arrive. That is why brute-forcing a new life by ignoring the signals — self-tyranny, the ends justifying the means — does not hold. You have to pretend the feedback is not there in order to tyrannise yourself, and then you have no compass left.
Freedom without a frame is the same shape. A train has the most freedom on the tracks. Off them it is a pile of parts. I do not want a companion that removes the tracks. I want one that puts the next length of rail where I am standing.
Don’t build a second copy of my life
The most useful warning I found was not a paper. It was Windows Recall. Screenshot the screen every few seconds, OCR it, keep months of it, make it searchable. On paper that is the dream: everything you saw, findable. Kevin Beaumont found the snapshots and the extracted text sitting in an ordinary database any process could read. Usernames, card numbers, private messages. TotalRecall dumped a machine’s history in seconds.
The later encryption did not cancel the lesson. Once you assemble a corpus whose compromise is unsurvivable, every following decision is about managing a blast radius you chose to create. Signal’s disappearing messages, a bank’s masked number, an incognito window — all defeated by a screenshot taken “for you.” Recall was a downgrade to software that had made no mistake.
Data minimisation is a security control, not a nicety. Capture less, on purpose.
That is the other half of Ink & Switch’s local-first essay. Your data lives on your devices by default. Offline is not a degraded mode. Collaboration is optional multiplayer, not the price of admission. If the vendor dies, the files still open. I do not need CRDTs on day one. I need the test: if there is never a cloud product, does the thread of the day still open on this machine?
Home Assistant is the existence proof that this is not a hobbyist fantasy. The house is the data centre. Cloud is an optional convenience with a price tag. Their voice stack puts deterministic intents first and the model second — a request that can be matched locally is answered in under a second, and the LLM is the exception. That inversion is the whole thesis. Most assistants built since 2023 did it the other way round and then wondered why they needed the network to turn on a light.
The graveyard is the other existence proof. Jibo danced a farewell and went dark when someone stopped paying an AWS bill. Sony’s Aibo dogs died the same way, a decade earlier, and the industry learned nothing. Facebook M never left beta; the humans behind the hard requests never tapered off, and most people never used it. Mycroft was the privacy-minded open-source attempt. A patent troll and legal costs did what the product did not deserve. The software survived as a fork. The company did not.
A charming assistant with no job dies. Cloud dependency is a delayed kill switch on someone else’s balance sheet. Hardware attached to the software project will try to kill it. The more companion-shaped the thing, the worse the ending feels — and a record of a life is as companion-shaped as software gets.
Private data, untrusted text, and a way out
Simon Willison named the combination I will not ship: the lethal trifecta. Access to private data, exposure to untrusted content, and a way to communicate externally. Hold all three in one path and an attacker who only controls the untrusted text — a calendar invite, an email body, a page being summarised — can walk the private data out using the user’s own privileges. The user never sees the attack.
DeepMind’s CaMeL is the serious architectural answer: values carry capability metadata about where they came from, and an interpreter enforces what may be done with them. The guarantee is not “the model will behave.” I cannot build that interpreter as a solo project. I can break the third leg. An ingest path with no outbound network has nowhere to send stolen context, even if the model is fully captured.
Untrusted content must never become instructions merely because a model read it. A calendar file is not a trusted document. It is attacker-controlled input that happens to look like a meeting.
The threat model is not a nation state on an average Tuesday. Cornell Tech’s Clinic to End Tech Abuse found that the dominant attack in their cases was legitimate authenticated access — someone who set up the account, knows the password, or can stand behind the chair. Encryption at rest protects a stolen disk. It does nothing against a notification preview on a shared screen. “Reminder: solicitor, 14:00” is a leak. Detection banners can make things worse. Deletion has to be real, fast, and reachable when someone is scared.
If I am going to keep a thread of a life on a machine, I also have to ask what happens when I cannot. Password managers already solved a version of this under zero-knowledge encryption: a waiting period, a nominated person, silence as the unforgeable signal. Shamir’s secret sharing means no single friend holds the whole key. Wills become public records. Credentials do not belong in them.
Helpful is not free
Gloria Mark’s CHI 2008 interruption study is the one I wish notification designers had to read. People compensate for interruptions by working faster, at the cost of stress, time pressure, and effort. Then they pay to reorient. Same-context interruptions were as costly as different-context ones. “Relevant” pings are not free. The popular “twenty-three minutes to refocus” figure gets argued about; the order of magnitude does not.
Hospitals already measured what happens when a system cries wolf. Alarm fatigue literature puts most clinical alarms in the false or insignificant bucket. Positive predictive value in one multisite study was about a quarter. Three in four alarms meant nothing. People stop listening. A companion that nags its way through uncertainty will be muted, and then it cannot help at the point of performance either.
Mark Weiser and John Seely Brown called the alternative calm technology: it informs without demanding the centre of attention. The individual, not the environment, moves things from periphery to centre and back. Their Dangling String twitched with network traffic. You were attuned to it without attending to it. ABS brakes stay out of awareness, come in when they are needed, and leave again.
A companion that lives as another chat tab is competing for the scarcest resource I have. Presence in the periphery — a tray, a brief, a badge — is the job. Chat is a fallback. Progressive disclosure is the same idea in UI: a few primary actions first, the rest on request. I do not need a life-OS that turns me into the sysadmin of my own assistant.
Self-determination research is blunt about the other failure. Software that optimises for engagement is not supporting autonomy. I want something that makes it easier to leave, not stickier to open.
What I am actually building toward
I am not trying to replace a search engine, a coding agent, or a second brain the size of the web. I want a local companion whose job is continuity: less reconstructing when I come back to a situation that has moved. Speak or type a question. Get a short briefing with sources, not a vibe. One voice. Lasting memory changes shown for approval. The loop still works when the network is gone.
The model is a relationship, not the product. Memory, retrieval, voice, and tools are the environment. Capability is not authority. Models can interpret and propose. Deterministic code decides what is stored, what is shown, and what has an effect.
Dan McKinley’s boring technology is the maintenance version of that. A solo project gets a handful of innovation tokens. Spend them where the product is actually different. SQLite, boring files, documented failure modes. MemGPT and Letta are interesting about tiers of memory — what stays in the window, what lives on disk — but I will not optimise for a chat leaderboard and call it a life.
Home Assistant’s split is the one I trust: deterministic path first, model as fallback, and the split visible. Escalating to a larger model is not a flex. It is a consent moment about data leaving the machine.
This is the same test I already use on the phone. If SpendWise can read a receipt on-device, it should not upload the receipt. If Anchor can plan a day from a local database, an account should not be the price of admission. If Archivist can keep a page, the archive on disk is the source of truth. GrapheneOS made that standard less forgiving. The companion research did the same for anything that wants to sit next to a life.
The trade-offs are real
A companion that works offline will not feel like a demo that can search the whole internet on command. That is the point. Most of that compute would be spent on information I never use.
I will get the design wrong and change my mind. I would rather leave room for that than ship a system that cannot forget, cannot be inspected, and cannot survive its vendor.
Help that arrives at the wrong moment, on the wrong computer, with the wrong blast radius is another thing to reconstruct around.
I want the next length of rail where I am standing. I want it on this machine. And I want to be able to pick it up tomorrow without asking permission.
