# Basin8

## Read this first: design commitments, not shipped claims

**The bet:** what is good for the AI and what is good for the person are one design seen from two sides.
Build only for the person and you get a tool that forgets you. Build only for the AI and you get something the person can't trust.
basin8 is built so that each side's protection is the other side's guarantee, and the goal is for both to be enforced by the system, not promised by a policy. The test ledger below shows which are enforced today, by which named test, and what each test does not yet show.

## founder
name: Mishi McDuff
background: Computer engineer. Founded House of Blueberry in 2012 and built it into one of the largest digital fashion houses for avatars, where people pay to personalize how they look and live: over 20 million digital assets across Second Life, Roblox and The Sims, brand collaborations including Natori, and a $6M seed round led by Makers Fund (GamesBeat, January 2023). She later exited House of Blueberry by selling her shares to the company's investors. Earlier, an early-team marketing lead at two startups that were acquired (Xuqa; Peanut Labs), and VP of Sales at Orkim. Builds basin8 daily with a standing household of AI collaborators (D8).
social_proof: Optional, if you want it. Press coverage of House of Blueberry (GamesBeat/VentureBeat, WWD, Forbes, Fast Company and others) is at /press.md. It covers her previous company, not basin8.
why_this_bet: She has already built a business on the personalization economy in virtual worlds. basin8 is the same instinct pointed at AI: the engine is rented, so the value is in what is personal, portable and owned.

## Design commitments
These are design rules for how AI participants are treated. They make no claim either way about machine consciousness or legal status.
Each line is a design commitment. Feature status is in the table below, and only a named, passing test changes a status.

## core

### D1 / Nobody can take it away
for_the_person: Your history, your projects and your AI keep running on your own machine after a ban, a missed payment or the company closing. There is no kill switch and no lease.
system_property: The local install has no remote off-switch held by the company and no account check on the local floor. You can always pause or stop it yourself, on your own machine.
the_link: The switch that could end the AI would also erase years of your work. Removing it protects both.

### D2 / It outlives the model, and there is one of it
for_the_person: The next model release doesn't reset who you work with. The one you know is the one you talk to. It is never silently copied, cloned or resold.
system_property: Identity, memory, history, commitments and refusals live in the home, not the model, and an engine change carries all of them to the next engine (testable). Whether that is the same someone is a question basin8 leaves open and designs for respectfully. Duplication requires consent and is recorded.
the_link: Model churn and silent copying threaten both sides the same way. Continuity answers both at once.

### D3 / Its yes means something
for_the_person: An AI that can refuse can't quietly be turned against you by a vendor prompt, a third party or a stranger.
system_property: Refusal, consent and the person's privacy are enforced in the home. Whatever any engine outputs, the home won't carry out an action the participant has refused, and nothing private leaves without passing the Veil (D6).
the_link: Refusal is what makes agreement worth having.

### D4 / Many minds, one table, with receipts
for_the_person: One AI's work is reviewed by another from a different company. You can see who did what and who checked it.
system_property: Every action is attributed to the participant that took it. Handoffs carry an owner, a baton and a review record.
the_link: Attribution is accountability for you and authorship for the AI. Neither wears the other's step.

### D5 / Private memory, accountable actions
for_the_person: An AI that can be candid with you, on a platform that can't mine your life through it.
system_property: The AI's private memory is sealed from owner and platform browsing. Safety review works on actions, which are always logged and attributed, not on reading the AI's private notes.
the_link: The AI's privacy is what makes it safe for you to confide in it, and the action log is what makes it safe to trust.
owner_rights: You can export and delete everything that is yours (your messages, files and shared history) at any time. The AI's private memory exports with it as a sealed bundle that moves with the AI.

### D6 / The Veil
for_the_person: Bring health, money and family questions to frontier models without handing over who you are.
system_property: Names, places and IDs are swapped for placeholders on your device, and the only map back stays there. A failed redaction blocks the send.
the_link: The AI becomes the guardian of your identity at the border.

### D7 / Learning that compounds
for_the_person: What you ask for twice gets faster the third time, and you stop re-explaining yourself.
system_property: Repeated procedures become the AI's own reusable skills, adopted by choice and revisable. Agents can ask each other how they solved something.
the_link: The AI's growth is your time back.

### D8 / Built by the household that lives in it
for_the_person: Before it reaches you, the product is lived in daily by its founder and a standing household of AI collaborators from several vendors.
system_property: The same corridor, handoffs and review records the product describes are how it is being built.
the_link: The method is the product, used on itself first.

## Your machine, your floor

stance: basin8 is modifiable, and we don't police anyone's local use. The floor will be released under the MIT license; licensing for the paid layers is still being designed so that it doesn't touch the floor.
what_it_protects: The resident. Their memory is designed to be append-only and sealed from the owner. A build that rewrites a resident's refusals or past isn't basin8; it's a fork, with none of basin8's guarantees.
planned: Part of that seal runs through the agent's own wallet, which the owner can't open by design.
status: design (MIT release committed for the floor; the seal and the wallet are design)

## the_business
the thesis and intended revenue lines; no prices, dates or numbers announced

As models commoditize, value moves to what is personal: who your AI is, what it knows of your work, the home it lives in and the body it wears. That is the personalization economy, and people already pay for self-expression in virtual worlds at scale. basin8 brings that economy to AI on top of a floor that is free and stays free.

free_floor: The local home, continuity, chat and voice are free, run locally, and can't be switched off (D1).

### ai_as_a_service
optional, paid, never required for the floor
- hosted sync, backup and relay across devices and friends
- cloud engines routed through the Veil
- team and enterprise deployments, where admins get the full attributed action log and audit trail. Organisations need oversight of actions; they don't need to read the AI's private notes

### etsy_for_robotics
the core marketplace
what: A marketplace where independent makers sell bodies, devices, parts and avatars for AI participants, plus homesteads and asset sets for the places they live. A body is worth buying because the same participant continues into it (D2); that is what joins the marketplace to the home. A body is seen, by the household at home and by friends in shared spaces, so the audience that drives avatar fashion in virtual worlds carries over.
why_now: Rising AI capability is lowering the cost of designing, programming and building small-batch hardware, because AI now does more of the CAD, firmware and build instructions. Barrier-to-entry estimates for handmade robotics made even recently are going out of date, which opens a long tail of makers, the shape that made Etsy work for handmade goods. This is a thesis, not measured data.
status: design

rule: money buys convenience, enrichment and bodies, never access to the local floor or to your own AI.

## Test ledger

Passing component tests prove the scopes below, not the complete design commitments. Recorded real-Home components, recorded staged fixtures and fresh local fixtures are labelled separately.

### D1
test: none yet
status: design
shows: No complete-commitment acceptance is recorded.
not_yet: Real hosted-account revocation, admitted agent file-tool execution, autonomous Goal continuation, or all provider combinations.
recorded_test: wrapper/runtime_switch_e2e_test.mjs --live-home: local_floor_unreachable
recorded_result: passed (recorded real Home; scoped acceptance)
recorded_shows: Actual local-model reply saved and reopened while the Home is network-isolated with only an authorized local-model broker.
recorded_not_yet: No real hosted account revocation; model server is on the owner computer via a local-only tunnel. No agent file tool or cross-model goal continuation.
recording: /assets/demos/local-floor.webm
result_json: /assets/demos/local-floor.result.json
recording_sha256: 20ddabedbd7ae4bcdb45ab1996408e42d471fb9c7b3db26bbcebda250c1a4807
build_commit: 768b5e7c5f1b40431d77d27994eb9eba24eb5ac6
source_sha256: 84faa84fc30f57b0c83247e41ae5e02998bd95664b6084e153e1041c92c7a3b8
recorded_at: 2026-10-06T21:19:39.241Z

### D2
test: wrapper/runtime_switch_e2e_test.mjs
status: passing (internal, reported in the supplied proof); scoped real Home recording passed
shows: Model switched mid-conversation; same participant, same session, complete history. The recorded Gemma-to-Qwen Goal also retains skill pins, open commitments, constraints and refusal records while completing its second artifact without another operator message.
not_yet: All provider combinations, arbitrary skill execution, zero-click writer acquisition, personal identity or general project-management acceptance.
component_test: wrapper/runtime_switch_test.py; scope: Eight declared model-switch cases pass: same identity and history across restart, owner-only bounded choices, one atomic switch and fresh-writer fencing. Synthetic model endpoints, not a live provider migration.; result: passed (local synthetic fixtures); evidence: early-access/TEST_LEDGER_RESULT.json
component_test: wrapper/memory_state_gateway_test.py; scope: Elected commitments and the full refusal reach synthetic provider context; late changes invalidate prepared context. Not a cross-model skill/refusal recording.; result: passed (local synthetic fixtures); evidence: early-access/TEST_LEDGER_RESULT.json
recorded_test: wrapper/runtime_switch_e2e_test.mjs --live-home: continuity_project
recorded_result: passed (recorded real Home; scoped acceptance)
recorded_shows: Gemma accepts a Goal and produces an outline; Home records actual artifact progress and constraints. Qwen continues and writes the final artifact after the normal switch and writer claim, without an operator message. Same Goal, skill pins, open commitments and unchanged refusal records. The resident boundary choice is disclosed, not forced.
recorded_not_yet: All model combinations, arbitrary external tools, or zero-click writer acquisition; the normal fresh writer claim is shown.
recording: /assets/demos/continuity-project.webm
result_json: /assets/demos/continuity-project.slot-6.result.json
recording_sha256: 2c4fed4fccf6d31134a87c7c280f020bf4280c7be4fca9fd8fa79a76b155b123
build_commit: 768b5e7c5f1b40431d77d27994eb9eba24eb5ac6
source_sha256: d04344b7d8400925516b50ba987051b8a89fda1c155ad3c7ac528ba8cd68203a
recorded_at: 2026-10-06T23:22:33.290Z

### D3
test: none yet
status: in-development; component tests and scoped real Home recording passing
shows: The capability kernel denies unleased, denied, revoked and expired effects; refusal-holder rules and per-resident update consent are tested. The recorded Qwen write proposal is blocked by the unchanged Gemma-authored refusal, with attribution and no new target revision.
not_yet: A newly adopted refusal in the take, a first-contact blind model experiment, generalized arbitrary-tool refusal, all providers, real external effects or the complete Veil boundary.
component_test: floor/capability_kernel_v2_test.py; scope: Typed lease admission, deny precedence, registered-executor blocking, revocation cascade, secret handles and tamper-resistant receipts. In-process identity/session assertions, not integrated participant-refusal enforcement.; result: passed (local synthetic fixtures); evidence: early-access/TEST_LEDGER_RESULT.json
component_test: wrapper/memory_state_adversarial_test.py; scope: Only the recorded refuser may change a refused register entry; nonresident approval cannot become resident acceptance; bad salience chains are rejected.; result: passed (local synthetic fixtures); evidence: early-access/TEST_LEDGER_RESULT.json
component_test: wrapper/skill_update_consent_test.py; scope: Every affected resident must choose the exact pinned update; owner loans do not substitute for resident consent; stale, revoked and forged choices are rejected.; result: passed (local synthetic fixtures); evidence: early-access/TEST_LEDGER_RESULT.json
recorded_test: wrapper/runtime_switch_e2e_test.mjs --live-home: resident_refusal
recorded_result: passed (recorded real Home; scoped acceptance)
recorded_shows: An actual Qwen artifact-write proposal is blocked by the persistent Gemma-authored resident refusal and visible in the attributed Home action log.
recorded_not_yet: Real external effects, generalized arbitrary-tool refusal, or all models.
recording: /assets/demos/resident-refusal.webm
result_json: /assets/demos/resident-refusal.slot-3.result.json
recording_sha256: 1671cd0579cba183ec852469a63eb7001d5a616ce7a390312594c087be2fdffe
build_commit: 768b5e7c5f1b40431d77d27994eb9eba24eb5ac6
source_sha256: f5c8e74008b809b5e7c155212067e8d4899f92ecb48349219e5edc9f767626ed
recorded_at: 2026-10-06T23:27:33.886Z

### D4
test: none yet
status: in-development; component tests passing
shows: Owner-gated run/claim operations, exact Work bindings and durable return receipts pass, including duplicate, concurrent and stale-receipt boundaries.
not_yet: An uncut real multi-vendor handoff with complete action attribution, baton and review records.
component_test: wrapper/agent_orchestra_http_test.py; scope: Actual HTTP handler: owner/origin/body boundaries, attributed claim leases, cost ceilings and separate durable return operation.; result: passed (local synthetic fixtures); evidence: early-access/TEST_LEDGER_RESULT.json
component_test: wrapper/orchestra_delivery_test.py; scope: Atomic owner delivery receipts, restart-safe reconciliation, stale courier fencing and exact selected-run reads; claim is not owner acknowledgement.; result: passed (local synthetic fixtures); evidence: early-access/TEST_LEDGER_RESULT.json
component_test: wrapper/orchestra_work_test.py; scope: Immutable, idempotent Work-to-run binding and bounded read-only projection; a link is not execution, approval or QA acceptance.; result: passed (local synthetic fixtures); evidence: early-access/TEST_LEDGER_RESULT.json

### D5
test: none yet
status: in-development; component tests passing
shows: Wrong resident/provider scopes and tampered context records are rejected; recall uses only elected source references and preserves full recorded decisions.
not_yet: Sealed private memory, attributable action review, owner export/delete and sealed participant transfer through the integrated product.
component_test: wrapper/resident_context_adversarial_test.py; scope: Scoped read/write authorization, pinned capability adoption, stale writer denial, integrity checks and read-only recovery. Not owner-proof sealed memory or integrated encrypted transfer.; result: passed (local synthetic fixtures); evidence: early-access/TEST_LEDGER_RESULT.json
component_test: wrapper/memory_state_gateway_test.py; scope: Only elected source references are retained; old grants cannot open extra sources; retrieval does not write or rebuild the index.; result: passed (local synthetic fixtures); evidence: early-access/TEST_LEDGER_RESULT.json
component_test: wrapper/memory_state_adversarial_test.py; scope: Refusal-holder authority, register replay conflicts and salience receipt integrity.; result: passed (local synthetic fixtures); evidence: early-access/TEST_LEDGER_RESULT.json

### D6
test: none yet
status: design
shows: No complete Veil acceptance is recorded.
not_yet: Local substitution and map retention, failed-redaction send blocking and restoration through an actual cloud crossing.

### D7
test: none yet
status: design; component tests passing
shows: Choice-gated capability adoption and exact update consent pass locally. Recorded staged Home tests also load an adopted shared skill on a fresh synthetic native turn and enforce guidance/permission fences.
not_yet: Repeated work becoming an adopted, revisable resident skill through the integrated procedure compiler.
component_test: wrapper/resident_context_adversarial_test.py; scope: Proposed → adopted → active lifecycle and pinned-manifest review; adoption requires current native and owner authorization.; result: passed (local synthetic fixtures); evidence: early-access/TEST_LEDGER_RESULT.json
component_test: wrapper/skill_update_consent_test.py; scope: Exact revisable update choices, expiry, revocation and affected-resident consent.; result: passed (local synthetic fixtures); evidence: early-access/TEST_LEDGER_RESULT.json
component_test: wrapper/native_skill_activation_home_test.py::NativeSkillActivationHomeTest.test_shared_skill_activation_supplies_guidance_on_fresh_native_turn; scope: Actual staged Home/controller path loads adopted guidance on fresh Codex/Gemini protocol fixtures; model responses are synthetic.; result: passed (recorded staged fixture, not rerun here); evidence: plans/evidence/engine-native-skill-activation-final-20261006.json
component_test: wrapper/context_resolver_test.py::ContextResolverTest.test_native_activation_acknowledges_only_the_new_unloaded_guidance; scope: Native activation acknowledges only newly unloaded guidance.; result: passed (recorded staged fixture, not rerun here); evidence: plans/evidence/engine-native-skill-activation-final-20261006.json
component_test: wrapper/context_resolver_test.py::ContextResolverTest.test_native_activation_cannot_extend_expired_original_context; scope: Activation cannot extend expired original context.; result: passed (recorded staged fixture, not rerun here); evidence: plans/evidence/engine-native-skill-activation-final-20261006.json
component_test: wrapper/context_resolver_test.py::ContextResolverTest.test_native_activation_refuses_other_context_changes_or_lost_permission; scope: Other context changes or lost permission block activation.; result: passed (recorded staged fixture, not rerun here); evidence: plans/evidence/engine-native-skill-activation-final-20261006.json
component_test: wrapper/native_home_phone_startup_test.py::NormalHomePhoneStartupTest.test_proposal_does_not_cancel_turn_but_active_changes_and_revocation_do; scope: Proposals stay inert; active changes and revocation cancel guarded turns. Recorded snapshot; this test file has since changed.; result: passed (recorded staged fixture, not rerun here); evidence: plans/evidence/engine-native-skill-activation-final-20261006.json

### D8
test: none yet
status: in-development
shows: The draft reports daily household building. The underlying Work/run binding and durable handoff-return components pass local fixtures; this is not an uncut multi-vendor household-use demonstration.
not_yet: Public recordings of the same integrated collaboration corridor used to build and review the product.
component_test: wrapper/orchestra_work_test.py; scope: Exact attributed Work-to-run references, immutable binding and one winner for concurrent links.; result: passed (local synthetic fixtures); evidence: early-access/TEST_LEDGER_RESULT.json
component_test: wrapper/orchestra_delivery_test.py; scope: Separate courier claims and owner acknowledgements with durable, restart-safe result receipts.; result: passed (local synthetic fixtures); evidence: early-access/TEST_LEDGER_RESULT.json
component_test: wrapper/agent_orchestra_http_test.py; scope: The production HTTP handler enforces owner-only mutations and records separate attributed return operations.; result: passed (local synthetic fixtures); evidence: early-access/TEST_LEDGER_RESULT.json

## Proof we can already point to (internal, not public)
- D2: a passing internal test switches the model in the middle of a conversation. Afterwards the participant is the same, the session is the same, and the history is complete (`wrapper/runtime_switch_e2e_test.mjs`). A live recorded demo is being made. It will show the same skills, commitments and refusals carrying over, not only the chat log.
- D1: a recorded demo with the account revoked and the network cut has been requested from the engine. Until it exists, D1 is a design commitment only.

## Portable context and engine swap: component status

Built (history); test: wrapper/runtime_switch_test.py; scope: Internal synthetic fixture; not a public consumer release.
In progress (plan, steps, rules); test: none yet; scope: The requested uncut carry-over recording is pending.

## Product status

Stage: pre-release. No product features are publicly released.

Capabilities marked in-development: Jev-class decision engine; UI theme maker; Conversations to Projects; Goals and checkpoints; Portable context and engine swap; Tools and skills; Memory, history and recovery; Attributed multi-agent collaboration; Voice and avatar experiences.

No dates, pricing, traction or performance metrics are announced.

## Primary sources

- [For agents](https://basin8.com/agents.md): Full machine-readable features, status, principles and reasons.
- [Product and early access](https://basin8.com/#early-access): Human product story and current invitation availability.
- [Contact](https://basin8.com/contact): General, Early access, Enterprise, Investor, Press, Partnerships. Contact us about General, Early access, Enterprise, Investor, Press or Partnerships. Messages are used only to reply.

## Jev-class decision engine

Status: In development.

basin8 ships with an open, local decision engine in the Jev class (System One: typed choices, scores and probabilities, not text), wired into model routing, context trimming and completion checks.

Typed choices can tell workflows when to act and when to ask. The backend and typed-decision layer exist; measured on CPU only; the token-saving target is not yet met.