You cannot audit what you cannot read

A personal agent reads your mail, your calendar, your documents and your relationships, then acts on them while you are not watching. That is more access than any other software you run, and more than most people you know. Running it as a black box is a strange decision that only looks normal because we have got used to it everywhere else.

What “trust the vendor” actually asks of you

Every closed personal-AI product asks you to accept four things you cannot verify.

That the data stays where the policy says. That the model does what the marketing says. That the boundaries described in the documentation are the boundaries in the code. And that all of this remains true across acquisitions, policy updates and a terms-of-service change you will approve by not replying to an email.

None of those are unreasonable to accept from a supplier of something peripheral. They are unreasonable to accept from software that knows what your doctor said.

The three things that have to be readable

Open source is not a licence badge; for an agent it means three specific artefacts are inspectable.

The policy layer. What the agent may do alone, what needs confirmation, what is forbidden. If this is not readable, every safety claim is a marketing claim.

The knowledge. The ontology and the graph — what it believes and where each belief came from. You should be able to look at what your agent thinks about your family and delete a node.

The loop. What triggers the agent, what it does unprompted, what it writes down. The parts that run while nobody is looking are precisely the parts that need to be legible.

Model weights are a separate question. Running open weights locally is better and sometimes you will want a frontier model for a specific job. That is a defensible trade as long as the policy layer decides what may leave the machine — which brings you back to needing that layer readable.

Open source is not the same as trustworthy

Worth saying plainly, because the argument gets overstated. Published source does not mean audited source, most users will never read a line, and “many eyes” is a hopeful theory rather than a guarantee.

What open source actually gives you is narrower and still decisive: the possibility of verification, a fork if the project’s incentives change, and no privileged position for the vendor. Combined with local execution it also gives something a hosted product cannot — the ability to disconnect it from the network and watch what breaks. That single test tells you more than any privacy policy.

The incentive argument

The deepest reason is not technical. A hosted personal agent has a business model, and every business model creates pressure on what the agent does with what it knows: engagement, advertising, data as an asset in the next funding round.

An agent you run yourself has no such pressure, because nobody is monetising it while it runs. Its incentives are yours by construction, not by promise. That is the whole argument, and it is why this project is open source rather than a product with an open-source component.

What we are committing to

The code, the ontology and the policy specification published together — because a policy engine you cannot read is decoration, and a knowledge model you cannot inspect is a black box with extra steps.

The repository opens when there is something in it worth reading. Until then, this blog is the argument, and the argument is meant to be checkable too.