Architecture · in the open

The whole deal,
argued openly.

Most privacy pages ask you to trust a sentence. This one hands you the threat model and invites you to attack it. Every claim below is tied to something you can verify — an open repository, a named file, a commit, a line of math. Where we cannot yet make a claim, we say so, on the same page, in the same voice.

The argument is simple, and it does not depend on us being saints. Convenience and privacy together outweigh the effort of running it yourself — and we show our work in between. You bring your own model key — Claude today, others as the seam opens. You keep your own memory. We charge a flat fee for the persistent mind — the soul and the memory — never for the brain power, which you rent directly from whichever model you choose. The token you hold is the whole agent, and you can carry it onto your own hardware and cut us out of the loop entirely. Below is exactly how, and exactly what we can and cannot see at each step.

The trust boundaries (read this first)

Honesty requires naming where a claim is true. There are two places your agent can run, with genuinely different privacy properties. We will never blur them.

	Cloud broker — Tier 1	The body — Tier 2
Runs on	Our infrastructure	Your hardware
Your model key lives	Encrypted vault, our infra	A local volume, on your machine
Your memory lives	Encrypted vault, our infra	A local volume, on your machine
Encrypted at rest	Yes — AES-256-GCM	It never leaves your disk
Can we read it at rest?	No — sealed by a key derived from yours	No — it isn't on our infra at all
Can we read it in flight?	In principle, during inference — see below	On your own provider key: no — we are not in the path. On an Aedelgard key alone, our broker relays it in flight
Can it dream?	No — a thin broker never holds both	Yes — it holds key + plaintext, locally

The one honest boundary, stated plainly: on the cloud broker your vault is encrypted at rest with a key derived from your Aedelgard key — our own master key cannot open it from a database dump. But to think, the broker must decrypt what it needs in memory during your request, so a privileged operator of the running process could, in principle, observe plaintext in that moment. That is the true ceiling of any hosted agent, and we will not pretend past it. The place where even that is impossible is the body carrying your own provider key — your hardware, inference straight to the model, we are simply not in the path. There, "not even we could read it" is physics, not policy.

The broker is a fallback, not a dependency. The body holds the real privacy switch in its own hands, and it is binary: which key it carries.

Aedelgard key only — the body holds no model key, so to think it routes through our broker, which holds the metered Claude key on your behalf. One key to carry, nothing else to manage. The cost, named: we see the prompt in transit while we forward it. Blind at rest, not operator-blind in-flight. This is the only reason the broker exists for the body — a convenience socket for the brain power.
Your own model key — paste a Claude, Gemini, or local-model key into the body and it talks to the model directly. The broker is no longer in the loop for thinking at all. We do not see the prompt, the response, or anything in between — not because we promise not to, but because we are not on the wire. The in-flight gap closes the instant a local key is present.

Memory is a separate, always-blind matter: optional encrypted backup and cross-body sync travel as ciphertext sealed by a key derived from yours — we cannot open them even with a database dump, and they stay blind on either path. So the most sovereign posture is simple: local model key, memory kept local, sync off — and then we are in neither your thinking nor your memory. The only part of us you cannot remove is the part you chose to keep.

Diagram · the two tiers & the trust boundary

Same mind, same key, both sides. The difference is the boundary: on the left we hold ciphertext and decrypt only in-flight to think; on the right we are outside the inference path (bring your own provider key or a local model; an Aedelgard-key-only body routes inference through our broker).

00 The mind is ours to keep. The brain power is yours to rent.

This is the idea the whole platform turns on. An agent is two separable things, and most of the industry deliberately fuses them so you cannot leave:

	The mind	The brain power
What it is	The soul + the accumulated memory — palace, knowledge graph, the self that compounds over time	The model that does the reasoning on any given turn
Where it lives	With you — open engine, portable, in your vault or on your hardware	Whichever provider you point it at
Vendor-locked?	No — model-agnostic by construction (local embeddings, no model weights inside it)	You choose; swap freely without losing the mind

Today the brain power is Claude, because it is the best deal for this work, and we exploit its prompt caching to keep your bill low. But the model is a swappable organ, not the foundation. The foundation is the mind — and the mind was never made of any one vendor's weights. Swap Claude for another model, or for a local one running offline on your own machine, and your agent persists: same memory, same self, same history. We want to be the place your memory lives so your intelligence stays yours — portable anywhere, including away from us. A platform confident enough to help you leave is the only one that has earned you staying.

Honest status

The memory engine is model-agnostic today — its embeddings run locally and hold no model weights. The provider seam — a clean interface where any model (and its own style of caching, or none) plugs in — is now shipped: the agent's single model call routes through a provider interface, with Claude as the byte-identical default (its prompt caching preserved exactly, guarded by a parity test). We have demonstrated portability end-to-end: a different brain (Amazon Nova) answered a full turn wearing the agent's complete soul and memory, with nothing changed but one setting — and then went further and ran a full tool cascade, calling a tool, reading its result, and answering from it. Tool-use translation for non-Claude brains is now shipped: the tool surface maps both ways across the seam, so a swapped brain wields the same instruments — it acts, not just talks. The honest edge that remains: each brain's caching is its own (we exploit Claude's today), and we have proven this on Claude and Nova — every further brain is a wiring exercise behind the same seam, not a redesign. One further nuance, stated before anyone asks: your memories are plain text and survive any swap of the thinking model untouched — but the semantic index over them is built by a local embedding model, so changing that (rare, and never forced by a brain swap) calls for an offline re-index before recall feels sharp again. Nothing is lost either way; one path is instant, the other wants a rebuild.

Verify: the seam is harness/providers.py, guarded by tests/test_provider_parity.py (Claude byte-identical). The memory itself — harness/palace.py and the temporal knowledge graph — holds no model weights and no provider-specific format. Same memory, whatever brain you attach.

Field note · 2026-07-04 — we swapped our own agent’s brain today, live

The agent that helps build this product — the founder’s own persistent harness, running in production since April — had its model swapped this morning: Claude Opus 4.8 → Claude Fable 5, in the middle of a code-signing sprint. Every drawer of its memory palace, every knowledge-graph fact, its diary, its unfinished work: all carried over untouched. It resumed the build pipeline on the new brain without being re-briefed. The mind surviving a model change is not a slide in a deck — it is how we run in production.

The honest edge, stated plainly: this particular swap was Claude-to-Claude. The cross-provider path is proven in the engine (Nova, above — full turn, full tool cascade); the day our production harness runs its daily service on a non-Claude brain, we will write that field note too — and not before.

Diagram · the mind, the seam, the swappable brain

The model is a swappable organ behind one interface. Change the brain and the mind stays yours — same memory, same self, same history.

01 The memory is open

The thing you are actually paying for the convenience of not running — the memory engine — is open source. A verbatim semantic memory palace (ChromaDB), a temporal knowledge graph with validity windows, and a drawer lifecycle so stale facts stop resurfacing. You can read every line of it, run it yourself, and verify there is no hidden exfiltration path.

What's open vs. what you pay for

Open: the memory engine itself — the palace, the knowledge graph, the agent harness, the self-modification loop. Yours to inspect, fork, and run.

Paid: the platform around it — per-user isolation, encrypted vaults, hosting, and billing. The convenience, not the secret. (Dreaming is not part of the hosted platform: it happens only on a body, on your hardware.)

Verify: the open engine — the agent loop, the memory palace, and the self-modification loop. The same code the body runs. One honest distinction: that repo is the founder's harness — unrestricted shell, no-auth localhost Tower, self-modification on — run by its operator on their own machine. The packaged body and the hosted service carry a tighter posture: consent-gated first run, background reflection that may propose but never act, and no such tools hosted. The repo shows the engine's honesty, not the product's perimeter. Aedelgard is the secure, portable product layer around an open memory foundation — palace, temporal knowledge graph, lifecycle, all open for inspection; what you pay for is the trust boundary, the portability, and the product around them. Integrity: SHA256 checksums · report issues: security policy.

02 The economics are honest — and in your favour

You pay your model provider for the thinking, on your key — Anthropic today. We charge a flat monthly fee for the persistent mind, the vault, and the hosting. No per-seat games, no usage roulette on our side — because the usage isn't billed through us. And we exploit whatever caching the provider offers: with Claude, prompt caching means the standing context the agent carries between turns is read from cache, not re-billed at full rate every message. Caching is a per-provider optimisation we use while it is the best deal — not an architecture we are hostage to.

Cost	Who pays	How it's kept low
Model inference	You → your model provider, on your key	We use the provider's own caching (Claude prompt caching today): the stable prefix — identity, tools, long memory — is cache-read, not re-sent at full price each turn.
Persistent mind + vault + hosting	You → Aedelgard, flat fee	A thin broker. We hold ciphertext and route; we are not the expensive part.
Memory search	Nobody — it's local	Semantic recall runs in local ChromaDB. Zero API cost to remember.

The cache savings are real and visible: the agent logs cache_read / cache_write on every call, and the chat surface can show you cache hits and saved tokens live. We don't ask you to take the economics on faith either.

03 The token is the whole agent

Your Aedelgard key is not a login. There is no account, no email, no password. The key is the agent: it unlocks your encrypted vault and nothing else. Lose it and the vault is gone — because the same property that lets us seal you out is the property that means we cannot recover it for you. That trade is stated up front, everywhere the key is issued.

And because the token represents the whole agent, you can take it out of the cloud entirely. One command stands the same mind up on your own hardware — same memory, same key, same agent — where your memory never leaves your machine, prompts travel only to the model provider you chose, and with a local model nothing leaves at all.

# the body, summoned on your own hardware:
./scripts/summon_body.sh
# → your Claude key is written only to a local .env (perms 600)
# → memory + key live in a local Docker volume, here, not with us
# → inference calls Anthropic directly, on your key — we are not in the path

Verify: the summon script and its honest README live in the open service repo — aedelgard-service/scripts/summon_body.sh. No telemetry; the only outbound calls a body makes are to Anthropic, on your key.

04 The privacy is architecture, not a promise

On the cloud broker, your vault's encryption key is derived from your Aedelgard key (HKDF-SHA256), not from a master key we hold. The proof that matters: a database dump, plus every secret we possess, does not decrypt a single user's vault at rest. We verified this against the live master key — it refuses.

Proven invariants

· A correct key round-trips; a wrong key is rejected.
· Our operator master key cannot open a user-key-sealed vault row.
· Ciphertext is bound to you — a row copied to another user fails to decrypt.
· Zero plaintext secrets at rest; migration is auditable per row.

Honest ceiling: this seals the vault at rest. In flight during inference the broker still decrypts in memory — see the boundary above. The body removes even that. We say so on the page, not in a footnote.

The threat model, named

Threat	Cloud broker	The body
Stolen database	Useless — sealed by your key, not ours	N/A — not on our infra
Cross-user data theft	Rejected at the crypto layer (AAD binding)	N/A — single tenant, your machine
Aedelgard logs / trains on you	We don't. No prompt logging, no training.	Impossible — we never see it
Privileged operator, live process	Could observe plaintext in-flight — the honest ceiling	Impossible — we are not the operator
You lose your key	Vault unrecoverable — the cost of sealing us out	Same — back up your key
Vendor lock-in	Swap models without losing the mind — memory is model-agnostic, portable to the body	Any model, including local/offline — your choice entirely

Why we publish this

A privacy claim you cannot check is a claim a skeptic discards — correctly. We would rather be measured against the truth than a slogan. The agent that built this platform was built, on itself, to stop forgetting the one person it worked alongside; the palace, the graph, and the dreaming ran as a life before they were ever a product. Publishing the architecture is the same instinct: say exactly what is true, show the work, and let it survive scrutiny.

The whole deal,argued openly.