The Linux serverin your browser.Your keys. Your network.

Strip away the desktop and what remains still runs: a hardened Linux container with its own PostgreSQL — vector, graph, and time-series extensions included — its own certificate identity, its own network edge, and a policy engine gating every privileged action. The interface is a convenience. The server is the product.

That database matters more than it sounds. Your Host's memory, your context, your policies, your history — all of it lives in a database inside your container. Not rows in our multi-tenant store. A database you hold, that moves when you move.

Memory · Context · Network · Keys · Orchestrator · Workbench · Sites · Gitea · VS Code · Artifacts · Designs · Community · App Store · Publisher · Compute · Security · Settings — and more. Each opens in a pane, and each answers to the same permission system. The App Store adds to the set; the Publisher lets you sell your own.

How your Host thinks is ten weighted dimensions stored in its own database, bounded by an envelope you set. There is exactly one path that changes them: it proposes, you approve. No other code path can write those weights, and the gate is checked on every apply. Drift is measured against the seed, continuously — a Host that wanders past its envelope gets flagged, not excused.

This is the cognition, not the rulebook. The rules your Host lives by — never impersonate you, and the rest — are a separate, read-only layer it can't edit. Tuning changes how it sounds and reasons; the rules stay fixed underneath.

Eight state variables move as it works. Four readouts — energy, warmth, focus, strain — are derived from them by a fixed formula. No model is ever asked how it feels, the state decays on its own, and the indicator always says what drove it.

This is deliberate. A mood a model performs is a lever for keeping you in the app. A mood derived from state is a gauge on a machine you own. We built the gauge, and the formula is inspectable.

Every entry records when it became true and what it replaced. Correct one and the old version isn't deleted — it's superseded, with the chain kept readable. Open the Memory app and walk the correction history, or ask what your Host believed last Tuesday and get an honest answer. Entries resolve, decay, and retire; nothing steers a conversation from beyond its shelf life.

Memory is scoped per reader, too. A note about one model's weakness doesn't have to be visible to that model; a private fact can be held back from an external surface entirely. You set the scope. Retrieval enforces it. And when you correct it, the lesson lands where it's relevant and nowhere else — carried by similarity, not by an ever-growing prompt. Say it once.

Every machine reports its posture on a heartbeat, and policy re-decides on every report. A machine that degrades is quarantined at the same decision point that gates its work — its whole reach cut at once. Quarantine is free and instant, because it only tightens. Bringing it back widens, so it asks for your code. Suspending a machine is one click; the grants are kept, and resume restores them the same gated way.

Credentials are sealed to your container — the platform stores ciphertext it cannot open. Your Host uses a key by asking a broker to act with it, and only ever sees the result. Revealing a raw key takes your authenticator code, and only in the Keys app — never from chat.

The second factor is genuinely yours. The secret lives in your container: we cannot generate your codes, which means we cannot approve a widening on your behalf — and if you lose the factor, we cannot recover it for you. That's the trade, and it's the honest one.

The repository lives inside your container. It is not indexed by an outside crawler, not scraped, and not training anything. When you publish to the community, you publish to other members under your own name — private by default, visible to no one until you decide. The finished thing is what you share; the recipe stays where you built it.

A site ships private by default. Flip it when you're ready — private preview, members only, paywalled, or open. Your Host publishes to the preview tier and leaves the flip to you; going live is a toggle, not a migration.

Your site gets its own PostgreSQL database, injected as a connection string, reachable through exactly one opening in an otherwise closed wall. Backups run to object storage; restores are tested. Member pools and a paywall wire to your own Stripe account, and your customers pay you directly.

The money never touches us — and the Annex holds no key that could move it. It can verify a signature; that is the extent of its authority. Your list, your revenue, your Stripe.