#Cipher

##What it does

It holds a conversation by voice, hands-free, speaking each answer as it is generated rather than after it is finished. Underneath the conversation are 48 tools in nine capability modules. It can:

• read and write files on the machine it runs on
• drive a real browser, navigating, reading pages and filling forms
• read and write the macOS calendar
• run scheduled work in the background, and raise something unprompted
• spawn sub-agents to work in parallel

An Electron app in React and TypeScript. Reasoning goes to the Claude API, speech synthesis to ElevenLabs, transcription to Deepgram. The wake word is a local model, so the part always listening never leaves the machine. Browser control is the Chromium DevTools Protocol; calendar access is a native Objective-C++ addon bridging Apple's EventKit.

##How the memory works

Long-term memory is a folder of plain markdown notes in an Obsidian vault. Not a database with a text export. The notes are the memory.

Every index over them is derived and rebuildable from the notes alone. When an index and the notes disagree, the notes win and the index is regenerated, so no index becomes a competing version of the truth. The memory outlives the program, too: the notes stay readable and editable in any text editor, with or without Cipher running.

###A failed write leaves no trace

Every write is transactional. Before a change lands, the affected state is snapshotted and the intent recorded in a journal; if any part of the write fails, the snapshot is restored.

The failure this removes is the one that hurts. A memory missing a change can be retried. A memory half-rewritten cannot be trusted, and nothing downstream can tell the two apart, because a partly applied edit looks as well-formed as a complete one.

###A gate that reads the diff

Before any change is written, a fidelity gate inspects it and blocks it if load-bearing content would be dropped unnoticed: a link, a date, a number, a quotation.

This guards a quiet failure. Ask a model to tighten a note and it usually returns something that reads better than the original: fluent prose, intact structure, citation gone. So the gate does not judge whether a rewrite reads well. It refuses the whole class of edit that sheds specifics.

##Trust and control

Cipher works on its own schedule and starts things unasked, but it stops at the edge of anything consequential. An approval gate stands in front of spending money, sending a message, and publishing anything. It is a design principle, not a temporary safeguard: the boundary is fixed and known in advance.

A cost ledger attributes spend per turn, with hard floors that refuse to begin unattended work when the remaining allowance is below a threshold. Refusing to start is the correct outcome, not an error.

The machine-maintained internal files are not gated. They are unreachable by the model entirely, so the bookkeeping underneath the guarantees is not something an argument can reach.

##How it was built and tested

607

automated checks. They run in seconds and cost nothing, so there is no reason to skip them.

22

integration self-tests against the live system, for behaviour that only appears once the real parts are wired together.

34

build steps shipped, with zero regressions, zero rollbacks and zero reverts.

Every change also ships with a negative control. Once a fix works and its tests pass, the fix is deliberately broken again to confirm the tests fail, then restored.

A green suite proves less than it looks: that the tests pass, not that they would have caught the bug. A test that would have stayed green either way is worse than none, because it reports safety it never checked.