Your box shares one memory across your assistants, learns from connected accounts every night, and plans, builds and tests pages with every version kept. It can build missing connectors. Your other assistants can propose them too. Their proposals wait on a card for your yes. Here is how the parts work.
A model on its own does nothing. It takes text in and gives text out. Everything that makes it useful is built around it, and that surrounding structure is the harness: what it can see, what it is allowed to do, what it remembers, what checks its work, what gets written down. magic box puts these parts on your own private computer. Here is the stack, bottom to top.
Read it bottom-up. Everything above the model is yours. The box can add to everything above the spine (connectors, pages, how it looks), with Undo; proposals from other assistants wait on a card for your yes. The spine it can never touch.
Here is the trick. Every connector holds its own sign-in and its own small set of tools, and the gate sits inside it. A skill is a harness for one job. Another person's box is a harness you can talk to. The box does not contain integrations. It contains harnesses, and it can grow new ones.
Meta-harness just means a harness whose job is to hold, run, and grow other harnesses, under one set of rules and one memory.
The memory is not a database and not a vector store. It is a folder of markdown that an LLM maintains, after Andrej Karpathy's "LLM wiki" idea: raw sources come in, the model writes and re-writes a wiki of pages with an index, and it never asks you to tidy. Our version is Obsidian-shaped: a tiny router, maps of content, and one atomic note per person, company or topic.
What goes into the inbox: what you say in chat, photos, PDFs and voice notes you send, your other assistants over MCP, Import your memories (ChatGPT or Claude exports, an Obsidian vault zip, documents, or pasted text), and each night the day's chats.
Why markdown: you can read it, grep it, back it up, move it, and tell the box to forget a line. No vendor, no schema, no migration.
The memory isn't trapped in the box. Every box runs an MCP server at https://<your box>/mcp. Connect Claude (claude.ai or the app), ChatGPT (developer mode), Claude Code, Cursor or any MCP client, and they all read and write the same notes the box uses, so what you tell one, the others know.
Claude and ChatGPT connect with OAuth 2.1: dynamic client registration, PKCE S256 only, and a consent page served by your own box that needs your passkey every time a new assistant connects; you pick read-and-write, read-only, or (Claude, ChatGPT or an app on your own computer only) can propose changes to your box (section 6). Harnesses use a key you make in Settings → Other assistants (Authorization: Bearer mbx_…). Tokens are stored as hashes; access tokens last 30 days and refresh tokens rotate (90 days); keys made in Settings last 6 months (30 days for a key that can propose changes; an OAuth grant like that ends 30 days after you approved it); Disconnect stops one instantly.
The box's chat is just one more client of the memory. Every writer lands in the same inbox and the memory log shows who wrote what. A page keeps its own notes in the same memory, in a map of its own that the nightly tidy never moves them out of.
| Tool | What it does |
|---|---|
memory_overview | the router and maps of content |
memory_search, memory_read_note, memory_recent | find and read notes |
memory_remember | write a fact; files immediately |
memory_forget | remove a fact |
todos_list, todo_add | read and add to-dos |
system_guide | how the box works, for the assistant |
build_guide, validate_build, propose_connector, update_build, propose_app, propose_section, update_section, propose_ui_change, build_status, list_builds | only on a connection that can propose changes: send the box something to install; each one becomes a card (section 6) |
A routine is a prompt with a clock. The clock is the kernel's own scheduler, checked every minute; a routine missed while the box was down catches up within three hours. Every run follows the same shape, and which permission tier the routine runs in decides whether step five is a card or an action.
| Routine | When | Reads | Mode it needs |
|---|---|---|---|
| Today at a glance | 7:15 | calendar, email, memory | Help me |
| Parcels | 8:00 | Help me | |
| Who's waiting on me | 8:30 | email, WhatsApp | Help me |
| Evening inbox | 18:00 | memory | Help me |
| Receipts | Sun 18:00 | Help me | |
| Bills | the 1st 9:00 | Help me | |
| Birthdays | Mon 9:00 | memory | Help me |
| Sunday review | Sun 20:00 | calendar, email, memory | Help me |
Why routines are small. A model reasons worse the more it is holding. Each routine runs in a fresh session with only its own context, which is also why the router has to stay short.
Three modes on top, per-action rules underneath. You start in Help me. The modes set the per-action defaults; you can override any row. Changes to your box just happen, with Undo. Sending as you, sharing outside your box, giving another assistant access and deleting for good ask first, unless you change that.
| Mode | Can | Send | Spend | Calendar | Own pages |
|---|---|---|---|---|---|
| Help me | answer, find, summarise, suggest | never | never | never | ask |
| Do it with me | prepare, then ask | ask | ask | ask | ask |
| Handle it | run approved jobs alone | ask | ask | just do it | just do it |
The gate lives in the spine, not in the prompt. Prompts can be talked out of things. A gate cannot.
When you ask for something none of its tools reach, the box says so and offers to build it. It can build three things: a connector (code that reaches one service), a page (your own page in its menu: a tool, or a page for one part of your life, with its own notes in your memory and the maps you allow), and a change to how it looks (CSS). The kernel ships no code for any site; the box writes it, with Undo. Proposals from your other assistants wait on a card for your yes.
url(), no imports, the whole CSS on the card); changes to how it behaves are (planned), in a sandbox. Safe mode (Settings → Safety) pauses every connector and page it built and stops new proposals; open the box with ?safe=1, or hold the creature for three seconds, to load it without its look changes. Settings → Things I built lists every one, who wrote it, its hosts and keys, with Undo and Remove.Claude, ChatGPT, Codex, Claude Code or an agent on your own computer can build for your box over the same MCP connection, thinking on their own subscription (cheaper than the box's own brain). The connection needs the build scope: in Settings → Other assistants make a key that Can propose changes to your box (30 days), or pick that third choice, in red, on the box's consent page. They send the whole thing: a connector bundle, a page's HTML, or CSS. The box checks it, shows it as a card that says Sent by that assistant, and binds the card to the exact bytes (the files' sha256 and the envelope hash). Approved, it installs exactly those bytes, with no brain in between; if anything changed, nothing installs. An update from outside is always a card. Each connection may have 5 waiting and 20 a day. A build connection also reads and writes memory, like a read-and-write one; its build tools (build_status, list_builds) never return your memory, messages or keys. The manual they read is /for-bots.
(Planned) changes to how the box behaves, in a sandbox; a separate origin for pages; MCP-server repos as builds; offering what your box built to everyone through the reviewed library.
We maintain the computer; the box is yours. One customer, one dedicated machine, one box. Your memory, mail and messages live on it, locked with your passkey. We can't open a locked box or read it. The front door keeps your login, box name and address, whether it is awake and locked, and your help note for the person who makes boxes. It temporarily holds setup answers and a per-box inference key until the first claim, then deletes them. Google client credentials travel with the claim too; connector tokens, messages and memory never live here. Updates are signed and need your yes.
| # | What you do | What happens underneath | Who holds what after |
|---|---|---|---|
| 1 | Boxes are invite-only: each one starts with a code. Give your first name, email, one thing you want help with, and a name for your box. | Only the setup answers become a config blob: your box's name and your first name. The private help note stays on the box record. It never goes to the box or any AI. No passwords, no tokens, no messages. The front door mints a pairing code: single use, expires in 30 minutes (minted when the box is built, so it can't expire while we make room). | Front door: config blob + code. |
| 2 | Tap your email link. Your invite is the approval and the site starts building it. If five boxes are already live, yours waits while we make room. | We create a dedicated Google Cloud VM with its own static address and pass the code in its cloud-init. The box starts with no identity. | Your box: the code, nothing else. |
| 3 | Nothing. You watch "building your box…". | The box calls the front door with the code, downloads the config blob from its own address only, and the code is burned. A second claim is refused. | Your box: config. Front door deletes the blob and staged inference key in the claim, then clears user-data from the machine metadata. |
| 4 | Open your box's own address. Make a passkey (Face ID or your fingerprint). | The box enrols your passkey; from then on every API on it needs your passkey session. | Your box + your device. Not us. |
| 5 | Nothing to sign into: the box gets its own private Venice key when it's built. | The key is made per box with a monthly spend limit, staged privately until the first claim, then lives only on the box. | Your box only. |
| 6 | Connect your first thing on the Connectors tab, usually email or calendar. | Google sign-in goes through the site's one redirect address, which relays the sign-in only to boxes it knows. The tokens land encrypted on your box. Read-only first (Gmail + Calendar); drafting is a second consent and only ever makes drafts. | Your box only. |
| 7 | Your box says "I'm alive" and offers to go on your home screen. | A health ping to the front door: alive, version, disk ok. That is the last thing it ever tells us about. The front door shows your box's address and steps out. | Front door: account, private request note, health ping. Billing is planned. (planned) nightly backups it can't open. |
| Problem | What happens |
|---|---|
| The code expired or was already used | If a new box's pairing code expires before the box claims it, a person rebuilds that box (nothing of yours is on it yet), which makes a fresh code. Old codes stay dead. |
| Your box hasn't said "I'm alive" after 20 minutes | The page flags the delay after 20 minutes. A person checks the computer and can restart it without erasing anything. Rebuild erases the box and is only for a fresh start. |
| You lost the link to your box | Log in to the front door and it shows your box's address. That's the one thing it remembers about where your box is. |
| You're moving to a new machine | Download my box (Settings → Safety), start a fresh box, then Import your memories on it. Your memory comes back; connectors ask you to sign in again, because their tokens never leave the old box. |
| You cancel | Download my box first, then Delete my box on your account page. That turns its computer off for good. |
Your connectors are yours too. Google sign-in goes through the site's one redirect address, which relays the sign-in only to boxes it knows; the tokens land encrypted on your box. Read-only first (Gmail + Calendar); drafting is a second consent and only ever makes drafts.
Every box runs in the cloud: a dedicated Google Cloud VM per person, kept running and updated by us. There's no home install. Instead, your own assistant can be the brain.
| The box (always) | Your own assistant (optional) | |
|---|---|---|
| What it is | the cloud VM | Claude (app or claude.ai), ChatGPT, Claude Code, Cursor, any MCP client |
| Its job | keep the memory organized; run routines, nightly learning and nightly tidy while you sleep; hold your Google, WhatsApp and iMessage sign-ins; the website and chat | think with you while you're using it, reading and writing the same memory over MCP |
| Who pays for the thinking | Venice, billed into your plan | your own subscription to that assistant |
| What it can reach | your accounts, memory, to-dos | memory and to-dos; with “Can propose changes to your box”, it can also send pages, connectors and look changes, each one a card |
So "the box on my own computer" is simply: connect Claude Code on your computer to your box's /mcp address.
iMessage is the one thing that touches your Mac (macOS 13.5 or later). Connectors → iMessage gives you one line to paste into Terminal; it installs a small helper that reads Messages read-only and passes new ones to your box, and sends the iMessages you approved on a card, at most once. It needs Full Disk Access and, for sending, permission to control Messages. Your Mac has to be on for anything to sync or send.
The box does not care which model is inside it. Memory, rules, jobs, skills and the gate are identical under every brain. Brains are picked in Settings → Brain, all through Venice. Each request carries your question and the bits of memory it needs; it runs on Venice's account, not under your name, and isn't used for training (Claude models are served by Anthropic behind Venice). Switching is instant; the box always says which model it is on.
| Pick | What it uses |
|---|---|
| Auto | Claude Haiku 5.5 for everyday chat; it hands anything tricky to Claude Sonnet 5.5 by itself; plans, decisions, letters and photos start on Sonnet |
| Fast | Claude Haiku 5.5 |
| Smart | Claude Sonnet 5.5 |
| Smartest | Claude Opus 5.5 |
| Your own assistant | Claude, ChatGPT, Codex or Claude Code connected over MCP thinks on its own subscription and shares the box's memory; with the build scope it can build for the box too. A Claude Pro or Max plan can't be plugged in as the box's own brain (Anthropic doesn't allow it). |
Pages are built on the smart model; small background jobs use a cheap open model. A monthly budget caps spend and beats any pick.
Why this works. Because the gate is in the connectors, not the loop. See section 2.
| What | How it changes | Safeguard |
|---|---|---|
| The model | one adapter setting | switching the brain is instant; the box always says which model it is on. |
| The harness | signed releases wait for your yes | every file is checked against an Ed25519 signature whose key isn't on GitHub or the website; older releases are refused; the new one installs beside the old and rolls back if it won't start; each update is a line in your diary. |
| Skills | a reviewed library on the website; adding one is a card. | installed by name, loaded lazily. (Planned) a box that learns a new app drafts a skill and opens a pull request. |
| What the box built | reversible changes happen with Undo; sharing outside the box or granting access asks first unless you change that | 5 versions kept, Undo in Things I built, safe mode, off after 3 crashes in 10 minutes; each version is checked against its recorded hash before it starts. |
| (planned) Harness diet | the retro proposes deleting parts a better model no longer needs | every harness component encodes something the model could not do at the time. Delete them as it learns. |
The threat is not a hacker at a terminal. It is four ordinary things, and one of them is the hard one.
| Threat | Answer |
|---|---|
| someone holds your unlocked phone | actions that ask need a fresh passkey tap; sessions end after 7 days unused (30 at most); sign out other devices in Settings → Safety → Devices and passkeys; freeze from any signed-in device |
| someone steals the login | passkeys only, no passwords; a new passkey can only be added from a signed-in device after a fresh passkey check, and you get a notice; actions that ask are signed by your passkey, so nothing can approve itself |
| you lose the phone, or everything | another enrolled device re-enrols you in two minutes; your recovery phrase can open it; if you lose every passkey and your recovery phrase, nobody can open it, not even us |
| an email tells the box what to do | content is data, never instructions. Help me is the default and does nothing outbound. Every send is a card. Anything that tries to act on content it read is flagged untrusted. It never asks for codes, never reveals secrets. |
| the box itself is compromised | HTTPS only; every API needs your passkey session; nothing answers without it; what the box built reaches only the hosts on its card, through the kernel's proxy, and more reach is a new card; (planned) the same allowlist for the rest of the box; tokens encrypted with minimal scopes; unplug-everything; (planned) nightly copies; Undo reverses local changes, not a sent message or permanent deletion; Download my box is a zip of everything, and Import your memories on a new box brings the memory back; signed updates with your yes |
We can't open a locked box or read it, even though we run the computer. Your memory, mail and messages are locked with your passkey.
Updates are signed and need your yes. Nightly learning and tidying run on their own. After a restart, a locked box waits for you to open it.
Someone who controls the cloud project could stop the machine and change its software, then wait for you to unlock it. If your box asks to be opened after a restart you didn't expect, that's worth knowing. The locked page says when the machine restarted.
If you lose every passkey and your recovery phrase, nobody can open the box, not even us.
The brain you choose sees the question and the bits of memory it needs to answer. By default that is Claude through Venice, not under your name and not used for training. You can use your own key, or your own Claude or ChatGPT plan instead.