Kindness Companion - Walkthrough Preview (SIMULATED)

Active context: Just me Family (switching changes what the Companion may see - that is the point)

Front door: POST /v1/messages. The channel authenticates; authorization lives in application code, never in a prompt.

Right panel - what the Companion holds context-scoped

Switch context to Family and watch the soup memory vanish. It never crosses.

Memory controls ship with memory itself

Five separated stores at the schema, consent gate on every item, provenance on every record. These controls are part of the step that introduces memory, not a later addition - and retrieval honors a change immediately.

Try it

Nothing becomes long-term memory because it was mentioned. Storage requires useful + permitted + scoped + reliable, with the permission recorded alongside.

A typed action, not a sentence

Model output is an action proposal; execution happens through the gateway or not at all. Every action is classified automatic / confirm first / never allowed, in code, reviewable as a list.

Audit trail (tamper-evident hash chain)

[09:41:02] run.start spark=kind-note version=1.0 hash=8f3ac2... objective_hash=9be1...

A goal that outlives a conversation - and knows when to say nothing

Persistent objectives wake only on allowed triggers, re-check trust on every wake, end on completion or revocation, and record silence as evidence. Each run pins its Spark definition version (B12).

The vault - granular, portable, yours

The person grants and revokes item-level permissions, keeps control and portability, and the system drafts while the person approves. From the founder's three-part model: constant identity, non-personal recursive learning, and this vault.

Revocation takes effect at the next retrieval, not the next deploy.

Headless form - the same operator, no UI

Every headed flow above is an API call sequence. The headless Companion is the contract other products (Matrix, Guild, Finance, Sparks, Grid) embed as their specialized operator.

POST /v1/messages        { person, context, text }  -> response | structured result | confirmation-required
GET  /v1/memory          context + purpose filtered (permission BEFORE retrieval)
POST /v1/memory/correct  supersede; history preserved in audit
POST /v1/memory/expire   retrieval honors it immediately
POST /v1/actions/:id/approve   confirm-tier execution, recorded
POST /v1/runs            start bounded/persistent Spark (definition version pinned)
POST /v1/runs/:id/check  permitted check-in -> intervention | silence_waiting | completed_end_cleanly
GET  /v1/audit           who allowed what, under which purpose, when

Release discipline (the Minimum Release Test): context isolation, permission-before-retrieval, governable memory, tiered actions, pinned Spark versions, permitted persistence, real silence, safe failure, answerable records, and public claims that match behavior.