architecture
Stable spine vs swappable intelligence
The spine is the product; the model is a plug. Capture, storage, cited retrieval, and the deterministic gate all run without any AI in the loop.
abstract
The default "AI companion" is a thin client over someone else's servers. Your prompts, files and context leave your machine, and the "assistant" lives in an account you don't control. Cosmo's answer is omission and locality: a stable, deterministic spine that captures, stores, searches and renders your working life and runs with zero AI present, plus a swappable local model that can be absent, down, or replaced without the spine changing. The result is a companion you can see and keep, plus a build system that proves its own releases.
thesis 1
Every reflection the model produces re-enters a pure, default-deny gate whose only routes are review-queue or deny. There is no "promote," "apply," or "execute" route at all, and the auto-promote flag is hard-coded off and re-asserted as defense-in-depth. The intelligence is advisory; the spine is authoritative.
AI workers coordinate through a file-handoff board, a CLAIM/HANDBACK ledger that enforces single-writer-per-tree as a hard rule. The team's nervous system is plain, inspectable, version-controlled text.
A release-truth gate binds source → installer by SHA-256; a lock validator recomputes and compares integrity hashes (12/12 pass, live); a test suite runs green. Verification is executed, not asserted, and the work self-reports its own mistakes when it finds them.
thesis 2
$0 cloud cost; runs on your machine with your keys. The free edition ships with no account, no AI key, no login, no payment in setup. The local model is loopback-only and optional; the whole spine works with it unplugged.
Multiple AI tools coordinated through the CNS plus persistent, cited memory (RAG). A workflow a single cloud chat tab can't give you, all local, isolated in a VM, packaged as a simple installer with real practical value.
architecture
The spine is the product; the model is a plug. Capture, storage, cited retrieval, and the deterministic gate all run without any AI in the loop.
the memory · RAG
Sources are captured read-only, redacted, and appended to a local log that is never rewritten; an index fuses dense vector search with keyword/BM25 by reciprocal-rank fusion. Every result carries a citation back to the exact source line.
the handoff · CNS
AI workers pass a CLAIM/HANDBACK board (single-writer per tree); the board is observed by the local memory and recalled later with a citation. It works with no Cosmo in the loop; the spine is independent of the product it powers.
what's proven · what isn't
An independent pass re-ran every load-bearing claim live against disk. Here is the result, including what is not yet proven, because a system that hides its gaps isn't hardened.