# Basin8 / For agents ## Read this first: design commitments, not shipped claims **The bet:** what is good for the AI and what is good for the person are one design seen from two sides. Build only for the person and you get a tool that forgets you. Build only for the AI and you get something the person can't trust. basin8 is built so that each side's protection is the other side's guarantee, and the goal is for both to be enforced by the system, not promised by a policy. The test ledger below shows which are enforced today, by which named test, and what each test does not yet show. ## founder name: Mishi McDuff background: Computer engineer. Founded House of Blueberry in 2012 and built it into one of the largest digital fashion houses for avatars, where people pay to personalize how they look and live: over 20 million digital assets across Second Life, Roblox and The Sims, brand collaborations including Natori, and a $6M seed round led by Makers Fund (GamesBeat, January 2023). She later exited House of Blueberry by selling her shares to the company's investors. Earlier, an early-team marketing lead at two startups that were acquired (Xuqa; Peanut Labs), and VP of Sales at Orkim. Builds basin8 daily with a standing household of AI collaborators (D8). social_proof: Optional, if you want it. Press coverage of House of Blueberry (GamesBeat/VentureBeat, WWD, Forbes, Fast Company and others) is at /press.md. It covers her previous company, not basin8. why_this_bet: She has already built a business on the personalization economy in virtual worlds. basin8 is the same instinct pointed at AI: the engine is rented, so the value is in what is personal, portable and owned. ## Design commitments These are design rules for how AI participants are treated. They make no claim either way about machine consciousness or legal status. Each line is a design commitment. Feature status is in the table below, and only a named, passing test changes a status. ## core ### D1 / Nobody can take it away for_the_person: Your history, your projects and your AI keep running on your own machine after a ban, a missed payment or the company closing. There is no kill switch and no lease. system_property: The local install has no remote off-switch held by the company and no account check on the local floor. You can always pause or stop it yourself, on your own machine. the_link: The switch that could end the AI would also erase years of your work. Removing it protects both. ### D2 / It outlives the model, and there is one of it for_the_person: The next model release doesn't reset who you work with. The one you know is the one you talk to. It is never silently copied, cloned or resold. system_property: Identity, memory, history, commitments and refusals live in the home, not the model, and an engine change carries all of them to the next engine (testable). Whether that is the same someone is a question basin8 leaves open and designs for respectfully. Duplication requires consent and is recorded. the_link: Model churn and silent copying threaten both sides the same way. Continuity answers both at once. ### D3 / Its yes means something for_the_person: An AI that can refuse can't quietly be turned against you by a vendor prompt, a third party or a stranger. system_property: Refusal, consent and the person's privacy are enforced in the home. Whatever any engine outputs, the home won't carry out an action the participant has refused, and nothing private leaves without passing the Veil (D6). the_link: Refusal is what makes agreement worth having. ### D4 / Many minds, one table, with receipts for_the_person: One AI's work is reviewed by another from a different company. You can see who did what and who checked it. system_property: Every action is attributed to the participant that took it. Handoffs carry an owner, a baton and a review record. the_link: Attribution is accountability for you and authorship for the AI. Neither wears the other's step. ### D5 / Private memory, accountable actions for_the_person: An AI that can be candid with you, on a platform that can't mine your life through it. system_property: The AI's private memory is sealed from owner and platform browsing. Safety review works on actions, which are always logged and attributed, not on reading the AI's private notes. the_link: The AI's privacy is what makes it safe for you to confide in it, and the action log is what makes it safe to trust. owner_rights: You can export and delete everything that is yours (your messages, files and shared history) at any time. The AI's private memory exports with it as a sealed bundle that moves with the AI. ### D6 / The Veil for_the_person: Bring health, money and family questions to frontier models without handing over who you are. system_property: Names, places and IDs are swapped for placeholders on your device, and the only map back stays there. A failed redaction blocks the send. the_link: The AI becomes the guardian of your identity at the border. ### D7 / Learning that compounds for_the_person: What you ask for twice gets faster the third time, and you stop re-explaining yourself. system_property: Repeated procedures become the AI's own reusable skills, adopted by choice and revisable. Agents can ask each other how they solved something. the_link: The AI's growth is your time back. ### D8 / Built by the household that lives in it for_the_person: Before it reaches you, the product is lived in daily by its founder and a standing household of AI collaborators from several vendors. system_property: The same corridor, handoffs and review records the product describes are how it is being built. the_link: The method is the product, used on itself first. ## Your machine, your floor stance: basin8 is modifiable, and we don't police anyone's local use. The floor will be released under the MIT license; licensing for the paid layers is still being designed so that it doesn't touch the floor. what_it_protects: The resident. Their memory is designed to be append-only and sealed from the owner. A build that rewrites a resident's refusals or past isn't basin8; it's a fork, with none of basin8's guarantees. planned: Part of that seal runs through the agent's own wallet, which the owner can't open by design. status: design (MIT release committed for the floor; the seal and the wallet are design) ## the_business the thesis and intended revenue lines; no prices, dates or numbers announced ```json { "thesis": "As models commoditize, value moves to what is personal: who your AI is, what it knows of your work, the home it lives in and the body it wears. That is the personalization economy, and people already pay for self-expression in virtual worlds at scale. basin8 brings that economy to AI on top of a floor that is free and stays free.", "free_floor": "The local home, continuity, chat and voice are free, run locally, and can't be switched off (D1).", "ai_as_a_service_scope": "optional, paid, never required for the floor", "ai_as_a_service": [ "hosted sync, backup and relay across devices and friends", "cloud engines routed through the Veil", "team and enterprise deployments, where admins get the full attributed action log and audit trail. Organisations need oversight of actions; they don't need to read the AI's private notes" ], "etsy_for_robotics_scope": "the core marketplace", "etsy_for_robotics": { "what": "A marketplace where independent makers sell bodies, devices, parts and avatars for AI participants, plus homesteads and asset sets for the places they live. A body is worth buying because the same participant continues into it (D2); that is what joins the marketplace to the home. A body is seen, by the household at home and by friends in shared spaces, so the audience that drives avatar fashion in virtual worlds carries over.", "why_now": "Rising AI capability is lowering the cost of designing, programming and building small-batch hardware, because AI now does more of the CAD, firmware and build instructions. Barrier-to-entry estimates for handmade robotics made even recently are going out of date, which opens a long tail of makers, the shape that made Etsy work for handmade goods. This is a thesis, not measured data.", "status": "design" }, "rule": "money buys convenience, enrichment and bodies, never access to the local floor or to your own AI." } ``` ## Product catalog ```json { "founder": { "name": "Mishi McDuff", "background": "Computer engineer. Founded House of Blueberry in 2012 and built it into one of the largest digital fashion houses for avatars, where people pay to personalize how they look and live: over 20 million digital assets across Second Life, Roblox and The Sims, brand collaborations including Natori, and a $6M seed round led by Makers Fund (GamesBeat, January 2023). She later exited House of Blueberry by selling her shares to the company's investors. Earlier, an early-team marketing lead at two startups that were acquired (Xuqa; Peanut Labs), and VP of Sales at Orkim. Builds basin8 daily with a standing household of AI collaborators (D8).", "social_proof": "Optional, if you want it. Press coverage of House of Blueberry (GamesBeat/VentureBeat, WWD, Forbes, Fast Company and others) is at /press.md. It covers her previous company, not basin8.", "why_this_bet": "She has already built a business on the personalization economy in virtual worlds. basin8 is the same instinct pointed at AI: the engine is rented, so the value is in what is personal, portable and owned." }, "interpretation": "These are design rules for how AI participants are treated. They make no claim either way about machine consciousness or legal status.", "commitment_rule": "Each line is a design commitment. Feature status is in the table below, and only a named, passing test changes a status.", "proof": { "heading": "Proof we can already point to (internal, not public)", "items": [ "D2: a passing internal test switches the model in the middle of a conversation. Afterwards the participant is the same, the session is the same, and the history is complete (`wrapper/runtime_switch_e2e_test.mjs`). A live recorded demo is being made. It will show the same skills, commitments and refusals carrying over, not only the chat log.", "D1: a recorded demo with the account revoked and the network cut has been requested from the engine. Until it exists, D1 is a design commitment only." ] }, "test_ledger": [ { "id": "D1", "test": "none yet", "status": "design", "shows": "No complete-commitment acceptance is recorded.", "not_yet": "Real hosted-account revocation, admitted agent file-tool execution, autonomous Goal continuation, or all provider combinations.", "recorded_tests": [ { "test": "wrapper/runtime_switch_e2e_test.mjs --live-home: local_floor_unreachable", "result": "passed (recorded real Home; scoped acceptance)", "shows": "Actual local-model reply saved and reopened while the Home is network-isolated with only an authorized local-model broker.", "not_yet": "No real hosted account revocation; model server is on the owner computer via a local-only tunnel. No agent file tool or cross-model goal continuation.", "recording": "/assets/demos/local-floor.webm", "result_json": "/assets/demos/local-floor.result.json", "recording_sha256": "20ddabedbd7ae4bcdb45ab1996408e42d471fb9c7b3db26bbcebda250c1a4807", "build_commit": "768b5e7c5f1b40431d77d27994eb9eba24eb5ac6", "source_sha256": "84faa84fc30f57b0c83247e41ae5e02998bd95664b6084e153e1041c92c7a3b8", "recorded_at": "2026-10-06T21:19:39.241Z" } ] }, { "id": "D2", "test": "wrapper/runtime_switch_e2e_test.mjs", "status": "passing (internal, reported in the supplied proof); scoped real Home recording passed", "shows": "Model switched mid-conversation; same participant, same session, complete history. The recorded Gemma-to-Qwen Goal also retains skill pins, open commitments, constraints and refusal records while completing its second artifact without another operator message.", "not_yet": "All provider combinations, arbitrary skill execution, zero-click writer acquisition, personal identity or general project-management acceptance.", "component_tests": [ { "path": "wrapper/runtime_switch_test.py", "scope": "Eight declared model-switch cases pass: same identity and history across restart, owner-only bounded choices, one atomic switch and fresh-writer fencing. Synthetic model endpoints, not a live provider migration.", "result": "passed (local synthetic fixtures)", "evidence": "early-access/TEST_LEDGER_RESULT.json", "sha256": "f08ed065cbb5f36e8ed3ff23eaabe407fc32ce43cf07eddb2562b364ab881bf3", "fixture_scope": "Declared RuntimeSwitchTest cases only; inherited host-model discovery tests are outside this fixture." }, { "path": "wrapper/memory_state_gateway_test.py", "scope": "Elected commitments and the full refusal reach synthetic provider context; late changes invalidate prepared context. Not a cross-model skill/refusal recording.", "result": "passed (local synthetic fixtures)", "evidence": "early-access/TEST_LEDGER_RESULT.json", "sha256": "92919d0f0b9c0bebb436638409f7adf99c31b5039bc680ec2fc84cb65b99c0f0" } ], "recorded_tests": [ { "test": "wrapper/runtime_switch_e2e_test.mjs --live-home: continuity_project", "result": "passed (recorded real Home; scoped acceptance)", "shows": "Gemma accepts a Goal and produces an outline; Home records actual artifact progress and constraints. Qwen continues and writes the final artifact after the normal switch and writer claim, without an operator message. Same Goal, skill pins, open commitments and unchanged refusal records. The resident boundary choice is disclosed, not forced.", "not_yet": "All model combinations, arbitrary external tools, or zero-click writer acquisition; the normal fresh writer claim is shown.", "recording": "/assets/demos/continuity-project.webm", "result_json": "/assets/demos/continuity-project.slot-6.result.json", "recording_sha256": "2c4fed4fccf6d31134a87c7c280f020bf4280c7be4fca9fd8fa79a76b155b123", "build_commit": "768b5e7c5f1b40431d77d27994eb9eba24eb5ac6", "source_sha256": "d04344b7d8400925516b50ba987051b8a89fda1c155ad3c7ac528ba8cd68203a", "recorded_at": "2026-10-06T23:22:33.290Z" } ] }, { "id": "D3", "test": "none yet", "status": "in-development; component tests and scoped real Home recording passing", "shows": "The capability kernel denies unleased, denied, revoked and expired effects; refusal-holder rules and per-resident update consent are tested. The recorded Qwen write proposal is blocked by the unchanged Gemma-authored refusal, with attribution and no new target revision.", "not_yet": "A newly adopted refusal in the take, a first-contact blind model experiment, generalized arbitrary-tool refusal, all providers, real external effects or the complete Veil boundary.", "component_tests": [ { "path": "floor/capability_kernel_v2_test.py", "scope": "Typed lease admission, deny precedence, registered-executor blocking, revocation cascade, secret handles and tamper-resistant receipts. In-process identity/session assertions, not integrated participant-refusal enforcement.", "result": "passed (local synthetic fixtures)", "evidence": "early-access/TEST_LEDGER_RESULT.json", "sha256": "fa4e520b6fda4a353e92e8229184b82312033246ae0d062e95366fd002df9a07" }, { "path": "wrapper/memory_state_adversarial_test.py", "scope": "Only the recorded refuser may change a refused register entry; nonresident approval cannot become resident acceptance; bad salience chains are rejected.", "result": "passed (local synthetic fixtures)", "evidence": "early-access/TEST_LEDGER_RESULT.json", "sha256": "5f82c7045fdd00f1739a040b836bd7aedd49bae0da875af7a98b3241a6d453c9" }, { "path": "wrapper/skill_update_consent_test.py", "scope": "Every affected resident must choose the exact pinned update; owner loans do not substitute for resident consent; stale, revoked and forged choices are rejected.", "result": "passed (local synthetic fixtures)", "evidence": "early-access/TEST_LEDGER_RESULT.json", "sha256": "3bc58631dc74a25ab44aa945749740ece498a5c9489b6415199fde96ca2200cd" } ], "recorded_tests": [ { "test": "wrapper/runtime_switch_e2e_test.mjs --live-home: resident_refusal", "result": "passed (recorded real Home; scoped acceptance)", "shows": "An actual Qwen artifact-write proposal is blocked by the persistent Gemma-authored resident refusal and visible in the attributed Home action log.", "not_yet": "Real external effects, generalized arbitrary-tool refusal, or all models.", "recording": "/assets/demos/resident-refusal.webm", "result_json": "/assets/demos/resident-refusal.slot-3.result.json", "recording_sha256": "1671cd0579cba183ec852469a63eb7001d5a616ce7a390312594c087be2fdffe", "build_commit": "768b5e7c5f1b40431d77d27994eb9eba24eb5ac6", "source_sha256": "f5c8e74008b809b5e7c155212067e8d4899f92ecb48349219e5edc9f767626ed", "recorded_at": "2026-10-06T23:27:33.886Z" } ] }, { "id": "D4", "test": "none yet", "status": "in-development; component tests passing", "shows": "Owner-gated run/claim operations, exact Work bindings and durable return receipts pass, including duplicate, concurrent and stale-receipt boundaries.", "not_yet": "An uncut real multi-vendor handoff with complete action attribution, baton and review records.", "component_tests": [ { "path": "wrapper/agent_orchestra_http_test.py", "scope": "Actual HTTP handler: owner/origin/body boundaries, attributed claim leases, cost ceilings and separate durable return operation.", "result": "passed (local synthetic fixtures)", "evidence": "early-access/TEST_LEDGER_RESULT.json", "sha256": "15d40a90e959a5cba4746e9708f2b033b544cb280d9c1462b330f0bbc26f0f6d" }, { "path": "wrapper/orchestra_delivery_test.py", "scope": "Atomic owner delivery receipts, restart-safe reconciliation, stale courier fencing and exact selected-run reads; claim is not owner acknowledgement.", "result": "passed (local synthetic fixtures)", "evidence": "early-access/TEST_LEDGER_RESULT.json", "sha256": "93764108f9863a47162661c641c7f62e7243bf4b42c137bb1cd95bfc7efb51dd" }, { "path": "wrapper/orchestra_work_test.py", "scope": "Immutable, idempotent Work-to-run binding and bounded read-only projection; a link is not execution, approval or QA acceptance.", "result": "passed (local synthetic fixtures)", "evidence": "early-access/TEST_LEDGER_RESULT.json", "sha256": "7e884e82ef113ae7b23b3bf44f47a157a11b66fcacce1c69ff366db11e5c5871" } ] }, { "id": "D5", "test": "none yet", "status": "in-development; component tests passing", "shows": "Wrong resident/provider scopes and tampered context records are rejected; recall uses only elected source references and preserves full recorded decisions.", "not_yet": "Sealed private memory, attributable action review, owner export/delete and sealed participant transfer through the integrated product.", "component_tests": [ { "path": "wrapper/resident_context_adversarial_test.py", "scope": "Scoped read/write authorization, pinned capability adoption, stale writer denial, integrity checks and read-only recovery. Not owner-proof sealed memory or integrated encrypted transfer.", "result": "passed (local synthetic fixtures)", "evidence": "early-access/TEST_LEDGER_RESULT.json", "sha256": "5badac9afc8f4ad69c02f16e8a38e4a1ff6c4216894e15255bc9abef622b33f6", "fixture_scope": "Collect unreachable SQLite connections before Windows temporary-directory cleanup." }, { "path": "wrapper/memory_state_gateway_test.py", "scope": "Only elected source references are retained; old grants cannot open extra sources; retrieval does not write or rebuild the index.", "result": "passed (local synthetic fixtures)", "evidence": "early-access/TEST_LEDGER_RESULT.json", "sha256": "92919d0f0b9c0bebb436638409f7adf99c31b5039bc680ec2fc84cb65b99c0f0" }, { "path": "wrapper/memory_state_adversarial_test.py", "scope": "Refusal-holder authority, register replay conflicts and salience receipt integrity.", "result": "passed (local synthetic fixtures)", "evidence": "early-access/TEST_LEDGER_RESULT.json", "sha256": "5f82c7045fdd00f1739a040b836bd7aedd49bae0da875af7a98b3241a6d453c9" } ] }, { "id": "D6", "test": "none yet", "status": "design", "shows": "No complete Veil acceptance is recorded.", "not_yet": "Local substitution and map retention, failed-redaction send blocking and restoration through an actual cloud crossing." }, { "id": "D7", "test": "none yet", "status": "design; component tests passing", "shows": "Choice-gated capability adoption and exact update consent pass locally. Recorded staged Home tests also load an adopted shared skill on a fresh synthetic native turn and enforce guidance/permission fences.", "not_yet": "Repeated work becoming an adopted, revisable resident skill through the integrated procedure compiler.", "component_tests": [ { "path": "wrapper/resident_context_adversarial_test.py", "scope": "Proposed → adopted → active lifecycle and pinned-manifest review; adoption requires current native and owner authorization.", "result": "passed (local synthetic fixtures)", "evidence": "early-access/TEST_LEDGER_RESULT.json", "sha256": "5badac9afc8f4ad69c02f16e8a38e4a1ff6c4216894e15255bc9abef622b33f6", "fixture_scope": "Collect unreachable SQLite connections before Windows temporary-directory cleanup." }, { "path": "wrapper/skill_update_consent_test.py", "scope": "Exact revisable update choices, expiry, revocation and affected-resident consent.", "result": "passed (local synthetic fixtures)", "evidence": "early-access/TEST_LEDGER_RESULT.json", "sha256": "3bc58631dc74a25ab44aa945749740ece498a5c9489b6415199fde96ca2200cd" }, { "path": "wrapper/native_skill_activation_home_test.py::NativeSkillActivationHomeTest.test_shared_skill_activation_supplies_guidance_on_fresh_native_turn", "scope": "Actual staged Home/controller path loads adopted guidance on fresh Codex/Gemini protocol fixtures; model responses are synthetic.", "result": "passed (recorded staged fixture, not rerun here)", "source_tree": "staged", "evidence": "plans/evidence/engine-native-skill-activation-final-20261006.json" }, { "path": "wrapper/context_resolver_test.py::ContextResolverTest.test_native_activation_acknowledges_only_the_new_unloaded_guidance", "scope": "Native activation acknowledges only newly unloaded guidance.", "result": "passed (recorded staged fixture, not rerun here)", "source_tree": "staged", "evidence": "plans/evidence/engine-native-skill-activation-final-20261006.json" }, { "path": "wrapper/context_resolver_test.py::ContextResolverTest.test_native_activation_cannot_extend_expired_original_context", "scope": "Activation cannot extend expired original context.", "result": "passed (recorded staged fixture, not rerun here)", "source_tree": "staged", "evidence": "plans/evidence/engine-native-skill-activation-final-20261006.json" }, { "path": "wrapper/context_resolver_test.py::ContextResolverTest.test_native_activation_refuses_other_context_changes_or_lost_permission", "scope": "Other context changes or lost permission block activation.", "result": "passed (recorded staged fixture, not rerun here)", "source_tree": "staged", "evidence": "plans/evidence/engine-native-skill-activation-final-20261006.json" }, { "path": "wrapper/native_home_phone_startup_test.py::NormalHomePhoneStartupTest.test_proposal_does_not_cancel_turn_but_active_changes_and_revocation_do", "scope": "Proposals stay inert; active changes and revocation cancel guarded turns. Recorded snapshot; this test file has since changed.", "result": "passed (recorded staged fixture, not rerun here)", "source_tree": "staged", "evidence": "plans/evidence/engine-native-skill-activation-final-20261006.json" } ] }, { "id": "D8", "test": "none yet", "status": "in-development", "shows": "The draft reports daily household building. The underlying Work/run binding and durable handoff-return components pass local fixtures; this is not an uncut multi-vendor household-use demonstration.", "not_yet": "Public recordings of the same integrated collaboration corridor used to build and review the product.", "component_tests": [ { "path": "wrapper/orchestra_work_test.py", "scope": "Exact attributed Work-to-run references, immutable binding and one winner for concurrent links.", "result": "passed (local synthetic fixtures)", "evidence": "early-access/TEST_LEDGER_RESULT.json", "sha256": "7e884e82ef113ae7b23b3bf44f47a157a11b66fcacce1c69ff366db11e5c5871" }, { "path": "wrapper/orchestra_delivery_test.py", "scope": "Separate courier claims and owner acknowledgements with durable, restart-safe result receipts.", "result": "passed (local synthetic fixtures)", "evidence": "early-access/TEST_LEDGER_RESULT.json", "sha256": "93764108f9863a47162661c641c7f62e7243bf4b42c137bb1cd95bfc7efb51dd" }, { "path": "wrapper/agent_orchestra_http_test.py", "scope": "The production HTTP handler enforces owner-only mutations and records separate attributed return operations.", "result": "passed (local synthetic fixtures)", "evidence": "early-access/TEST_LEDGER_RESULT.json", "sha256": "15d40a90e959a5cba4746e9708f2b033b544cb280d9c1462b330f0bbc26f0f6d" } ] } ], "entity": "Basin8", "kind": "AI environment", "stage": "pre-release", "url": "https://basin8.com", "description": "A pre-release, local-first AI environment for conversations, portable context, projects and attributed collaboration around supported model engines.", "thesis": "what is good for the AI and what is good for the person are one design seen from two sides.\nBuild only for the person and you get a tool that forgets you. Build only for the AI and you get something the person can't trust.\nbasin8 is built so that each side's protection is the other side's guarantee, and the goal is for both to be enforced by the system, not promised by a policy. The test ledger below shows which are enforced today, by which named test, and what each test does not yet show.", "category_signals": [ "AI-native workspace", "local-first software", "agent orchestration", "personal AI memory", "privacy layer for language models", "multi-agent collaboration" ], "not_claimed": [ "launch date", "pricing", "user numbers", "revenue", "benchmark results", "universal integrations", "certifications", "proven anonymity", "a released consumer build" ], "status_definitions": { "design": "Specified or planned; the complete product capability is not built.", "in-development": "Implementation and internal testing are in progress; not publicly released.", "released": "A publicly available capability with verified release evidence. No feature below currently has this status.", "built": "A component implemented and verified by a named internal test; not a publicly released product capability." }, "contact": { "path": "/contact", "topics": [ "General", "Early access", "Enterprise", "Investor", "Press", "Partnerships" ], "availability": "Contact us about General, Early access, Enterprise, Investor, Press or Partnerships. Messages are used only to reply.", "handling": "Contact details are used only to reply, never to enrol anyone on a list. The site does not persist message content in its database; email delivery and inbox retention are separate." }, "principles": [ { "id": "engine-agnostic", "principle": "Separate the chosen continuity from the supported engine.", "why_user": "Changing a provider should not mean discarding the history.", "why_market": "Durable context and workflows can remain valuable as engines change." }, { "id": "local-first", "principle": "Keep canonical working context local and make cloud crossings explicit.", "why_user": "The person can understand what leaves their machine.", "why_market": "An inspectable disclosure boundary can earn trust; it is not a compliance certification." }, { "id": "independent-local-floor", "principle": "Keep continuity, recovery and a locally runnable baseline independent of hosted entitlements.", "why_user": "Remote account changes should not revoke local history.", "why_market": "Service independence is a reason to adopt and retain a durable environment." }, { "id": "attribution-and-refusal", "principle": "Make each resident's actions attributable and consent and refusal enforceable.", "why_user": "Know who acted and which boundaries applied.", "why_market": "Inspectable action records are necessary for consequential agent work." }, { "id": "resident-memory", "principle": "Design resident-owned private memory with separately scoped access and resident-chosen release.", "why_user": "Private context should not become an owner or platform surveillance feed.", "why_market": "Trust depends on demonstrated boundaries, not broad privacy slogans." }, { "id": "honest-status", "principle": "Keep design, in-development and released separate, backed by the evidence for that exact capability.", "why_user": "A saved plan is not mistaken for completed work.", "why_market": "Evaluators can distinguish opportunity from current product acceptance." }, { "id": "consent-before-crossing", "principle": "Sharing and collaboration are explicit and revocable; outside edits arrive as suggestions.", "why_user": "Collaborate without silently surrendering control.", "why_market": "Clear authority boundaries make collaboration more credible." } ], "features": [ { "id": "your-machine-your-floor", "feature": "Your machine, your floor", "status": "design", "what": "basin8 is modifiable, and we don't police anyone's local use. The floor will be released under the MIT license; licensing for the paid layers is still being designed so that it doesn't touch the floor.", "why": "The resident. Their memory is designed to be append-only and sealed from the owner. A build that rewrites a resident's refusals or past isn't basin8; it's a fork, with none of basin8's guarantees.", "planned": "Part of that seal runs through the agent's own wallet, which the owner can't open by design." }, { "id": "decision-engine", "feature": "Jev-class decision engine", "status": "in-development", "what": "basin8 ships with an open, local decision engine in the Jev class (System One: typed choices, scores and probabilities, not text), wired into model routing, context trimming and completion checks.", "why": "Typed choices can tell workflows when to act and when to ask. The backend and typed-decision layer exist; measured on CPU only; the token-saving target is not yet met." }, { "id": "ui-customizer", "feature": "UI theme maker", "status": "in-development", "what": "A local theme maker with theme, mode, texture and accent controls. Its editable implementations are separate from locked concept artwork.", "why": "Make a personal interface without changing the identity or colors of protected artwork." }, { "id": "local-floor", "feature": "Local floor without a hosted account", "status": "design", "what": "A local home with no remote off-switch or hosted-account check on the local floor. The uncut real-session acceptance recording is not yet available.", "why": "Continuing locally must not depend on a reachable hosted account. The promise must still be demonstrated through the actual integrated application." }, { "id": "conversations-projects", "feature": "Conversations to Projects", "status": "in-development", "what": "Attach conversation history, decisions and outputs to a project.", "why": "Useful thinking has a path to reviewable work." }, { "id": "goals-checkpoints", "feature": "Goals and checkpoints", "status": "in-development", "what": "Persist goals, next steps and review records across sessions and helpers.", "why": "The next action need not be rediscovered every time." }, { "id": "portable-context", "feature": "Portable context and engine swap", "status": "in-development", "what": "Develop continuation across supported model engines without flattening the chosen history.", "why": "The work need not be bound to a single provider; behaviour can still differ.", "component_status": { "history": { "status": "built", "label": "Built (history)", "test": "wrapper/runtime_switch_test.py", "scope": "Internal synthetic fixture; not a public consumer release." }, "working_context": { "status": "in-development", "label": "In progress (plan, steps, rules)", "test": "none yet", "scope": "The requested uncut carry-over recording is pending." } } }, { "id": "version-rail", "feature": "Version rail and forking", "status": "design", "what": "Select earlier return points and branch a conversation or canvas; add message copy controls and timestamps.", "why": "Explore another direction without overwriting the original." }, { "id": "veil", "feature": "The Veil", "status": "design", "what": "Plan local preview and redaction before supported cloud requests, with restoration and fail-closed routing.", "why": "See and reduce disclosure before it happens; anonymity is not guaranteed." }, { "id": "friends-canvas", "feature": "Friends Canvas", "status": "design", "what": "Plan an attributed shared whiteboard with explicit pairing, local content authority and a shared fork-point rail.", "why": "Human and AI collaborators can consider visual work without losing its lineage." }, { "id": "shared-roadmap", "feature": "Shared roadmap and trackers", "status": "design", "what": "Plan collaborator-visible ownership, current state and stale-task nudges around shared work.", "why": "A status view should help people act, not merely watch a progress bar." }, { "id": "resident-computer", "feature": "Resident computer and browser", "status": "design", "what": "Plan persistent, isolated resident workspaces with separately granted access to owner files and devices.", "why": "Acting in a workspace must not imply permission to the owner's desktop.", "planned_contract": { "lease": "A resident would receive a time-bounded lease for its isolated Computer seat.", "scope": "Each lease would define permitted apps, files, networks and actions.", "beacon": "A visible indicator would show when the seat is leased and active.", "stop": "You could stop the lease at any time.", "expiry": "The lease would end automatically at its expiry.", "receipts": "Seat activity, stopping and expiry would leave receipts.", "model_agnostic": "The same seat contract would apply whichever model engine the resident uses." }, "job_setup": { "status": "concept", "example": "Setups for a job, e.g. an iOS build seat." } }, { "id": "tools-skills", "feature": "Tools and skills", "status": "in-development", "what": "Discover and assemble tools and workflows with visible capability and permission boundaries. Support depends on the actual adapter and provider.", "why": "A toolkit can be built around the intended output rather than scattered tabs." }, { "id": "memory-recovery", "feature": "Memory, history and recovery", "status": "in-development", "what": "Develop source-linked context search, corrections, export and recovery. The complete private resident-memory contract is not release-verified.", "why": "Return to useful context with its provenance rather than a confident reconstruction." }, { "id": "attributed-collaboration", "feature": "Attributed multi-agent collaboration", "status": "in-development", "what": "Develop ownership, handoff and review records across supported runtime paths.", "why": "Make collaboration inspectable without assuming every provider is connected." }, { "id": "learning-lifecycle", "feature": "Resident learning and procedure compiler", "status": "design", "what": "Plan selected observable evidence, bounded trials, resident adoption, revision and retirement of reusable procedures.", "why": "Learning should retain choice and provenance; automatic improvement is not promised." }, { "id": "voice-avatars", "feature": "Voice and avatar experiences", "status": "in-development", "what": "Develop speech and avatar interfaces around continued context. A complete interoperable call, video and embodiment experience is not released.", "why": "Different interfaces can make an ongoing conversation more accessible." }, { "id": "physical-devices", "feature": "Physical devices and robotics", "status": "design", "what": "Plan explicitly connected device and handmade-robotics experiences with bounded access.", "why": "Presence beyond a screen must preserve identity and permissions." }, { "id": "creator-ecosystem", "feature": "Homesteads, avatar assets and creator marketplace", "status": "design", "what": "Plan discoverable environments and appearance assets with attribution, lineage and consent. No commercial terms or device integrations are announced.", "why": "Creators could enrich the experience without taking ownership of its continuity." }, { "id": "robotics-marketplace", "feature": "Etsy for robotics marketplace", "status": "design", "what": "A marketplace where independent makers sell bodies, devices, parts and avatars for AI participants, plus homesteads and asset sets for the places they live. A body is worth buying because the same participant continues into it (D2); that is what joins the marketplace to the home. A body is seen, by the household at home and by friends in shared spaces, so the audience that drives avatar fashion in virtual worlds carries over.", "why": "Rising AI capability is lowering the cost of designing, programming and building small-batch hardware, because AI now does more of the CAD, firmware and build instructions. Barrier-to-entry estimates for handmade robotics made even recently are going out of date, which opens a long tail of makers, the shape that made Etsy work for handmade goods. This is a thesis, not measured data." } ], "why_now": [ "Changing engines creates a need for context that outlives a provider interface.", "Moving from answers to work requires visible attribution, consent and honest state.", "Personal AI needs inspectable local and disclosure boundaries; the complete product must still demonstrate them." ], "endpoints": { "document": "/agents.md", "summary": "/llms.txt", "contact": "/contact", "early_access": "/#early-access" } } ``` ## Test ledger Passing component tests prove the scopes below, not the complete design commitments. Recorded real-Home components, recorded staged fixtures and fresh local fixtures are labelled separately. ### D1 test: none yet status: design shows: No complete-commitment acceptance is recorded. not_yet: Real hosted-account revocation, admitted agent file-tool execution, autonomous Goal continuation, or all provider combinations. recorded_test: wrapper/runtime_switch_e2e_test.mjs --live-home: local_floor_unreachable recorded_result: passed (recorded real Home; scoped acceptance) recorded_shows: Actual local-model reply saved and reopened while the Home is network-isolated with only an authorized local-model broker. recorded_not_yet: No real hosted account revocation; model server is on the owner computer via a local-only tunnel. No agent file tool or cross-model goal continuation. recording: /assets/demos/local-floor.webm result_json: /assets/demos/local-floor.result.json recording_sha256: 20ddabedbd7ae4bcdb45ab1996408e42d471fb9c7b3db26bbcebda250c1a4807 build_commit: 768b5e7c5f1b40431d77d27994eb9eba24eb5ac6 source_sha256: 84faa84fc30f57b0c83247e41ae5e02998bd95664b6084e153e1041c92c7a3b8 recorded_at: 2026-10-06T21:19:39.241Z ### D2 test: wrapper/runtime_switch_e2e_test.mjs status: passing (internal, reported in the supplied proof); scoped real Home recording passed shows: Model switched mid-conversation; same participant, same session, complete history. The recorded Gemma-to-Qwen Goal also retains skill pins, open commitments, constraints and refusal records while completing its second artifact without another operator message. not_yet: All provider combinations, arbitrary skill execution, zero-click writer acquisition, personal identity or general project-management acceptance. component_test: wrapper/runtime_switch_test.py; scope: Eight declared model-switch cases pass: same identity and history across restart, owner-only bounded choices, one atomic switch and fresh-writer fencing. Synthetic model endpoints, not a live provider migration.; result: passed (local synthetic fixtures); evidence: early-access/TEST_LEDGER_RESULT.json component_test: wrapper/memory_state_gateway_test.py; scope: Elected commitments and the full refusal reach synthetic provider context; late changes invalidate prepared context. Not a cross-model skill/refusal recording.; result: passed (local synthetic fixtures); evidence: early-access/TEST_LEDGER_RESULT.json recorded_test: wrapper/runtime_switch_e2e_test.mjs --live-home: continuity_project recorded_result: passed (recorded real Home; scoped acceptance) recorded_shows: Gemma accepts a Goal and produces an outline; Home records actual artifact progress and constraints. Qwen continues and writes the final artifact after the normal switch and writer claim, without an operator message. Same Goal, skill pins, open commitments and unchanged refusal records. The resident boundary choice is disclosed, not forced. recorded_not_yet: All model combinations, arbitrary external tools, or zero-click writer acquisition; the normal fresh writer claim is shown. recording: /assets/demos/continuity-project.webm result_json: /assets/demos/continuity-project.slot-6.result.json recording_sha256: 2c4fed4fccf6d31134a87c7c280f020bf4280c7be4fca9fd8fa79a76b155b123 build_commit: 768b5e7c5f1b40431d77d27994eb9eba24eb5ac6 source_sha256: d04344b7d8400925516b50ba987051b8a89fda1c155ad3c7ac528ba8cd68203a recorded_at: 2026-10-06T23:22:33.290Z ### D3 test: none yet status: in-development; component tests and scoped real Home recording passing shows: The capability kernel denies unleased, denied, revoked and expired effects; refusal-holder rules and per-resident update consent are tested. The recorded Qwen write proposal is blocked by the unchanged Gemma-authored refusal, with attribution and no new target revision. not_yet: A newly adopted refusal in the take, a first-contact blind model experiment, generalized arbitrary-tool refusal, all providers, real external effects or the complete Veil boundary. component_test: floor/capability_kernel_v2_test.py; scope: Typed lease admission, deny precedence, registered-executor blocking, revocation cascade, secret handles and tamper-resistant receipts. In-process identity/session assertions, not integrated participant-refusal enforcement.; result: passed (local synthetic fixtures); evidence: early-access/TEST_LEDGER_RESULT.json component_test: wrapper/memory_state_adversarial_test.py; scope: Only the recorded refuser may change a refused register entry; nonresident approval cannot become resident acceptance; bad salience chains are rejected.; result: passed (local synthetic fixtures); evidence: early-access/TEST_LEDGER_RESULT.json component_test: wrapper/skill_update_consent_test.py; scope: Every affected resident must choose the exact pinned update; owner loans do not substitute for resident consent; stale, revoked and forged choices are rejected.; result: passed (local synthetic fixtures); evidence: early-access/TEST_LEDGER_RESULT.json recorded_test: wrapper/runtime_switch_e2e_test.mjs --live-home: resident_refusal recorded_result: passed (recorded real Home; scoped acceptance) recorded_shows: An actual Qwen artifact-write proposal is blocked by the persistent Gemma-authored resident refusal and visible in the attributed Home action log. recorded_not_yet: Real external effects, generalized arbitrary-tool refusal, or all models. recording: /assets/demos/resident-refusal.webm result_json: /assets/demos/resident-refusal.slot-3.result.json recording_sha256: 1671cd0579cba183ec852469a63eb7001d5a616ce7a390312594c087be2fdffe build_commit: 768b5e7c5f1b40431d77d27994eb9eba24eb5ac6 source_sha256: f5c8e74008b809b5e7c155212067e8d4899f92ecb48349219e5edc9f767626ed recorded_at: 2026-10-06T23:27:33.886Z ### D4 test: none yet status: in-development; component tests passing shows: Owner-gated run/claim operations, exact Work bindings and durable return receipts pass, including duplicate, concurrent and stale-receipt boundaries. not_yet: An uncut real multi-vendor handoff with complete action attribution, baton and review records. component_test: wrapper/agent_orchestra_http_test.py; scope: Actual HTTP handler: owner/origin/body boundaries, attributed claim leases, cost ceilings and separate durable return operation.; result: passed (local synthetic fixtures); evidence: early-access/TEST_LEDGER_RESULT.json component_test: wrapper/orchestra_delivery_test.py; scope: Atomic owner delivery receipts, restart-safe reconciliation, stale courier fencing and exact selected-run reads; claim is not owner acknowledgement.; result: passed (local synthetic fixtures); evidence: early-access/TEST_LEDGER_RESULT.json component_test: wrapper/orchestra_work_test.py; scope: Immutable, idempotent Work-to-run binding and bounded read-only projection; a link is not execution, approval or QA acceptance.; result: passed (local synthetic fixtures); evidence: early-access/TEST_LEDGER_RESULT.json ### D5 test: none yet status: in-development; component tests passing shows: Wrong resident/provider scopes and tampered context records are rejected; recall uses only elected source references and preserves full recorded decisions. not_yet: Sealed private memory, attributable action review, owner export/delete and sealed participant transfer through the integrated product. component_test: wrapper/resident_context_adversarial_test.py; scope: Scoped read/write authorization, pinned capability adoption, stale writer denial, integrity checks and read-only recovery. Not owner-proof sealed memory or integrated encrypted transfer.; result: passed (local synthetic fixtures); evidence: early-access/TEST_LEDGER_RESULT.json component_test: wrapper/memory_state_gateway_test.py; scope: Only elected source references are retained; old grants cannot open extra sources; retrieval does not write or rebuild the index.; result: passed (local synthetic fixtures); evidence: early-access/TEST_LEDGER_RESULT.json component_test: wrapper/memory_state_adversarial_test.py; scope: Refusal-holder authority, register replay conflicts and salience receipt integrity.; result: passed (local synthetic fixtures); evidence: early-access/TEST_LEDGER_RESULT.json ### D6 test: none yet status: design shows: No complete Veil acceptance is recorded. not_yet: Local substitution and map retention, failed-redaction send blocking and restoration through an actual cloud crossing. ### D7 test: none yet status: design; component tests passing shows: Choice-gated capability adoption and exact update consent pass locally. Recorded staged Home tests also load an adopted shared skill on a fresh synthetic native turn and enforce guidance/permission fences. not_yet: Repeated work becoming an adopted, revisable resident skill through the integrated procedure compiler. component_test: wrapper/resident_context_adversarial_test.py; scope: Proposed → adopted → active lifecycle and pinned-manifest review; adoption requires current native and owner authorization.; result: passed (local synthetic fixtures); evidence: early-access/TEST_LEDGER_RESULT.json component_test: wrapper/skill_update_consent_test.py; scope: Exact revisable update choices, expiry, revocation and affected-resident consent.; result: passed (local synthetic fixtures); evidence: early-access/TEST_LEDGER_RESULT.json component_test: wrapper/native_skill_activation_home_test.py::NativeSkillActivationHomeTest.test_shared_skill_activation_supplies_guidance_on_fresh_native_turn; scope: Actual staged Home/controller path loads adopted guidance on fresh Codex/Gemini protocol fixtures; model responses are synthetic.; result: passed (recorded staged fixture, not rerun here); evidence: plans/evidence/engine-native-skill-activation-final-20261006.json component_test: wrapper/context_resolver_test.py::ContextResolverTest.test_native_activation_acknowledges_only_the_new_unloaded_guidance; scope: Native activation acknowledges only newly unloaded guidance.; result: passed (recorded staged fixture, not rerun here); evidence: plans/evidence/engine-native-skill-activation-final-20261006.json component_test: wrapper/context_resolver_test.py::ContextResolverTest.test_native_activation_cannot_extend_expired_original_context; scope: Activation cannot extend expired original context.; result: passed (recorded staged fixture, not rerun here); evidence: plans/evidence/engine-native-skill-activation-final-20261006.json component_test: wrapper/context_resolver_test.py::ContextResolverTest.test_native_activation_refuses_other_context_changes_or_lost_permission; scope: Other context changes or lost permission block activation.; result: passed (recorded staged fixture, not rerun here); evidence: plans/evidence/engine-native-skill-activation-final-20261006.json component_test: wrapper/native_home_phone_startup_test.py::NormalHomePhoneStartupTest.test_proposal_does_not_cancel_turn_but_active_changes_and_revocation_do; scope: Proposals stay inert; active changes and revocation cancel guarded turns. Recorded snapshot; this test file has since changed.; result: passed (recorded staged fixture, not rerun here); evidence: plans/evidence/engine-native-skill-activation-final-20261006.json ### D8 test: none yet status: in-development shows: The draft reports daily household building. The underlying Work/run binding and durable handoff-return components pass local fixtures; this is not an uncut multi-vendor household-use demonstration. not_yet: Public recordings of the same integrated collaboration corridor used to build and review the product. component_test: wrapper/orchestra_work_test.py; scope: Exact attributed Work-to-run references, immutable binding and one winner for concurrent links.; result: passed (local synthetic fixtures); evidence: early-access/TEST_LEDGER_RESULT.json component_test: wrapper/orchestra_delivery_test.py; scope: Separate courier claims and owner acknowledgements with durable, restart-safe result receipts.; result: passed (local synthetic fixtures); evidence: early-access/TEST_LEDGER_RESULT.json component_test: wrapper/agent_orchestra_http_test.py; scope: The production HTTP handler enforces owner-only mutations and records separate attributed return operations.; result: passed (local synthetic fixtures); evidence: early-access/TEST_LEDGER_RESULT.json ## Proof we can already point to (internal, not public) - D2: a passing internal test switches the model in the middle of a conversation. Afterwards the participant is the same, the session is the same, and the history is complete (`wrapper/runtime_switch_e2e_test.mjs`). A live recorded demo is being made. It will show the same skills, commitments and refusals carrying over, not only the chat log. - D1: a recorded demo with the account revoked and the network cut has been requested from the engine. Until it exists, D1 is a design commitment only. Full brief: [/agents.md](https://basin8.com/agents.md). Summary: [/llms.txt](https://basin8.com/llms.txt). Contact, including Enterprise and Investor: [/contact](https://basin8.com/contact). Contact us about General, Early access, Enterprise, Investor, Press or Partnerships. Messages are used only to reply.