One agent. Every surface.
A home that thinks for itself.

What makes it feel natural

The voice surface uses the same agent loop as web and Discord. Same memory, same tools, same context. Switch apps with "open the recipes app"; the voice session re-scopes its tools to that app's category set automatically.

Compact alias blocks in the system prompt help the realtime model lock onto callable targets (recipes-app vs. recipes-tool vs. recipe-tool). Wake chimes, tool acks, and TTS all flow through one delivery layer so the audio never overlaps.

The framework

A thinking domain is any responsibility worth running on a clock. Each one registers a handler that follows a strict observe → evaluate → act contract, then runs as its own concurrent asyncio task, independent of chat and independent of every other domain, but sharing the same brain, memory, and tools.

Critically, every cycle returns next_check_seconds. The domain controls its own rhythm based on what it found: busy → faster, idle → slower. Bounds are clamped to 30s through 1h so nothing spins or starves.

What makes it safe to leave running

• Shared 15M-token daily budget across all domains. Standard-priority domains downgrade at 70%; low-priority ones pause at 90%.
• Chat preemption. When you're talking to Skipper, timer domains defer. Your conversation always wins.
• Per-domain locks. A domain never runs two cycles concurrently with itself.
• Persistent state. Working memory and cursors live in Postgres. A crash mid-cycle resumes cleanly on restart.
• Graceful shutdown. Supervisor stops new cycles, lets in-flight ones finish.
• Model-tier selection. Each domain picks cheap / standard / expensive per cycle based on what's needed. Many cycles use the cheap model.

What's in an app package

Every app lives in apps/<id>/ and ships these files. Most are optional. The loader picks up whatever's present.

• manifest.yaml. Id, name, entity types (with ID prefixes), tool category, keywords, behavioral guide pointer.
• routes.py. A FastAPI APIRouter auto-mounted at /api/apps/<id>/.
• tools.py. Every public function with a docstring is auto-registered as an MCP tool.
• handlers.py. Event subscriptions, job handlers, thinking domain registrations.
• migrations/. SQL files run in order against the app's own Postgres schema.
• guide.md. Behavioral prompt the tool router injects when keywords match.
• data.py. Data access layer (convention, not enforced).

Per-app schema isolation

Each app gets its own Postgres schema app_<id>. The loader validates that no cross-schema foreign keys exist. If app A's table tries to FK into app B's table, startup fails loudly. Apps communicate through events and the platform's link registry, never by reaching into each other's tables.

How it routes

Tools are organized into 40+ categories by domain. Reminders, recipes, investments, filesystem, memory, scheduling, and so on. 29 categories ship in the core tool_routes.json; each loaded app contributes another. Every category declares its tools, its keyword triggers, and per-tool acknowledgment templates ("Setting that reminder…") that the voice surface speaks before the call finishes.

Four meta-tools are always present: list_all_tools, request_tools, open_app, restart_agent. If the agent needs something outside the current set mid-turn, it just asks for it.

Behavioral guides in prompts/guides/ load on the same trigger. Talking about reminders? You get the reminders guide. Talking about goals? The goals guide. Nothing else.

From memories to a self-organizing knowledge base.

Memories don't pile up in a flat table forever. Every chat turn and every app-record event drops a job onto the memory_ingestion_queue. A Postgres-backed work queue with entity-keyed dedup (a burst of updates to the same entity collapses to last-write-wins) and crash-safe stale-row recovery for items left "processing" after a restart.

Two thinking domains drain the queue in parallel, each on its own rhythm:

• Memory domain. Dequeues batches of 10, delegates each item to the right digester (chat-turn or app-record), writes the resulting facts. Self-paces 30s → idle.
• Document domain. Every 30 min during active hours, walks new memories with a cursor, filters out operational noise (~90% of rows), and feeds the survivors to an LLM that decides what to write down.

The result: a self-organizing folder tree of auto-documents. Topic indexes, reference cards, running narratives. Created and reorganized by the agent itself, readable by humans, all sitting inside the Folders app. Working memory persists between cycles so the domain remembers what it's already organized.

Embeddings & vector recall

OpenAI text-embedding-3-small (1536-dim). Stored binary-packed as float32 for compact disk + O(1) seeks. Postgres + pgvector for the index. Tag normalization (plurals → singular) means "memories" and "memory" both hit the same rows.

Recall is hybrid: cosine similarity narrows the pool, then tag / entity / author filters refine. On startup, missing embeddings backfill lazily so adding a new field never blocks a release.

Folder & Knowledge intelligence

Drop a document into a folder and a post-processing pipeline runs two passes: (1) chunk + embed for semantic search; (2) LLM fact extraction for structured recall. Web URLs go through the knowledge store with the same treatment.

The dispatcher

job_dispatcher.py is a handler-registry engine. Each job type registers a handler with a per-type concurrency limit. The dispatcher claims pending work from Postgres, runs handlers as asyncio tasks, and gives each one a live JobContext. Its own progress channel and cancellation flag.

A separate 30-second job runner loop polls multiple sources (research, refine, print, PM, schedule-triggered) and dispatches what's due. Five long-running loops total: reminders, jobs, Trello live-sync, thinking, dispatcher.

What makes it good

• Per-type concurrency. Research can run 2 in parallel, investment runs serially. Per-handler ceilings keep CPU and API budgets sane.
• Cooperative cancellation. Handlers poll is_cancelled() and bail cleanly. Mid-pipeline cancels are safe.
• Live progress callbacks. Handlers call update_progress(pct, msg); the SPA streams it.
• Per-job log capture. A custom JobLogHandler uses an asyncio ContextVar so concurrent jobs never leak log lines into each other's job_logs rows.
• Configurable retry. Failed jobs retry per their own policy.
• Graceful shutdown. request_shutdown() stops claiming new work and drains everything in flight.