A single-user personal AI: a two-stage router hands each request to one of nine specialist agents, and every consequential action has to match what the owner actually said.
A personal assistant that can read notes, send messages, and change data is only useful if it can act, and only safe if nothing it reads can make it act. Web pages, documents, and another agent's output can all carry instructions, so the harness cannot rely on the model to tell data from orders. It also holds the owner's private data, so which model sees a turn matters as much as what the model does with it.
01
Every page and API route sits behind an owner session; Telegram and WhatsApp answer only the owner's own chat or number, behind the platform's secret header or signature. Input is stripped of control and invisible characters, capped at 4,000 characters, and checked for injection attempts.
02
Everyday phrases are answered at once from templates in English, Tamil, or Tanglish. Pattern rules catch obvious intents and follow-ups next, which is fast and free. Anything else goes to a small LLM dispatcher that must return a schema-validated agent name, falling back to the knowledge agent.
03
Each agent sees only the tools for its domain. A function-calling loop runs at most six steps with a per-run tool budget, and the answer passes an output guard that redacts keys and blocks prompt leaks before it streams with numbered sources.
04
Agent turns hold the owner's data, so the gateway only sends them to providers marked private-safe: Groq with an eight-second timeout, then a local Ollama model. Gemini, NVIDIA, and OpenRouter serve only turns that are allowed to leave that chain.
05
Every provider has a circuit breaker: three failures in a row open it, one test call runs after a cool-down that doubles up to ten minutes, and success closes it again. Breaker state is shared across server instances, every change lands in a healing log, and if every provider is down the owner still gets one calm reply in their language.
06
An agent can ask one colleague for help, one level deep. Delegated runs, routine steps, and Autopilot can never call destructive tools, because a colleague's instructions may contain text from the web.
07
A consequential tool (delete, message, call, update, web task) only runs when the owner's own words in this turn ask for that action. Each of the 106 tools has a risk level set on the server (47 read, 39 write, 8 send, 12 delete), not chosen by the model.
08
A send or delete parks as a confirm card with a one-time ID that expires in ten minutes; the model only learns that approval is waiting. Approving a delete also needs a fresh second factor on the device, so Telegram and WhatsApp hand deletes back to the app. Every approve, decline, or refused token writes an audit row with tool and argument names only.
09
Answers cite numbered sources from a pgvector store, and fall back to multilingual word search, Tamil included, when embeddings are unavailable. Every outbound fetch blocks private addresses, pins DNS, and rechecks each redirect.
Prompt rules alone can be talked around. The deciding check is deterministic: a consequential action needs a match in the owner's own message for this turn, so instructions hidden in a web page or a document cannot trigger it. Even then, a send or delete only parks a confirm card for the owner to approve.
One agent can consult another, but only one level deep and never with destructive tools, so a chain of agents cannot launder an action the owner never asked for.
Each provider in the gateway catalog is marked private-safe or not, and private turns are filtered to the safe ones before any fallback runs. A faster or free model that might keep prompts is never in the chain for the owner's data.
Voice replication is off by default. Enabling it requires recording a sample together with the provider's fixed consent sentence, and the voice ID is stored server-side.
Next.js 16 · React 19 · TypeScript · Supabase + pgvector · Groq + local Ollama (private turns) · Gemini key pool · Telegram + WhatsApp webhooks · zod · Vitest · Playwright