What actually runs, with the components' real names and the real mechanisms.
If you want the pitch, it's on the homepage.
Running a company, or assessing risk for IT? Every block ends with a
"Plainly" line — the takeaway, minus the jargon.
No slideware here — the actual stack: Tauri 2 desktop (Rust), local llama.cpp inference (SHA-256-pinned GGUF — Qwen3.5→3.8, Ornith 1.0), hybrid PostgreSQL memory (tsvector + pgvector, RRF fusion) with nightly curation, versioned markdown notes where every version names its author, sharing through fine-grained capabilities (Keto), an encrypted audit log with third-party-verifiable integrity hashes, and a single MCP gateway — the native integrations plus the platform modules. No fine-tuning anywhere: self-improvement rests on memory.
llama.cpp · Parakeet · local MCP bot-less recorder · 1Password
the cloud never commands it
The desktop client
Tauri 2 — React 19 webviews + Rust core. Not Electron. The edge runtime lives in Rust for a precise reason: the WebView freezes its JavaScript in the background (v0.19.0 lesson). Inference and tools survive a minimized window.
Signed installers — Developer ID + notarization (macOS), Authenticode EV (Windows), .deb/.rpm (Linux). minisign updates, publicly verifiable manifest.
Browser-based pairing — no token pasting. The token lives in the OS keychain, out of devtools' reach; on a 401, the session refreshes and the request is replayed instead of kicking you to the login screen.
Plainly: it installs like any signed software, updates itself, and the AI keeps working with the window minimized.
The recorder
Detection by the mic's hardware state — not the calendar, not a process scan. A CoreAudio listener (macOS — catches Meet in a browser tab), PulseAudio introspection (Linux), the ConsentStore registry (Windows).
Never the lobby — a debounced state machine with a 2-second "Arming" state. An open-but-idle Zoom client triggers nothing; the status glyphs Chrome grafts onto tab titles (🔊 🔴) are stripped before classification.
Per-process auto-stop (macOS 14.4+) — the question asked of the system: "is a process OTHER than me capturing?". Hanging up stops the recording, even if the Meet tab stays open.
Two streams, one WAV — mic + system audio merged into stereo (one channel each). Mute writes silence to preserve time alignment; anti-feedback excludes its own audio (excludesCurrentProcessAudio).
Durable upload queue — atomic manifest, retry/backoff, per-session dedup, and an append-only journal that is never purged: a chain of custody for recordings.
Plainly: nothing joins the call, the lobby is never recorded, and every recording keeps a chain of custody — precious when keeping client communications is a regulatory obligation.
The edge node — AI on your machine
Pairing in one command — luge-edge pair: a short code, approved from an already-connected device. The token is applied hot (~2 s), and re-pairing needs no restart — model loaded and agents intact.
llama.cpp as a sidecar — compiled per platform (Metal / CUDA / Vulkan). An edge catalog of 10 GGUF models pinned by SHA-256 (2.7 → 22 GB): Qwen3.5→3.8 (4B → 35B), Ornith 1.0, among others. The newest entry, Qwen3.8 27B (qwen3.8-27b-q4, 17.9 GB), is the first dense model in the catalog's top tier: the neighboring MoEs activate only 3-4B parameters per token; it brings all 27B to bear. (The edge catalog — pinned, bounded — is not the local models guide's list, which covers everything that runs.) Streamed download, rolling hash, atomic rename.
Local transcription — Parakeet ONNX via sherpa-onnx (+ Canary, Cohere), opt-in diarization (who spoke, when). Per-chunk checkpointed jobs: an interruption re-transcribes nothing. 100% Rust audio decoding (symphonia — zero ffmpeg).
Coding agents installed remotely — you pick an ACP agent in Luge (Claude Code, Codex, Copilot, Cursor, among others) and it installs on the machine without opening a terminal — through the luge-edge node (the CLI or the service), never through the desktop app, which hosts no agents. What crosses the wire is a catalog id — never a command line: the machine resolves the id locally and composes its own command. Permission asks are posted in the conversation thread.
1Password secrets — the agent handles secret://alias/field, resolved on the machine right before execution, bindable to a registrable domain. The agent never sees the value (the detail — default-deny, scrubbing — is in the Tools & secrets block).
Honest capability gating — a node only advertises inference_capable if the model is on disk AND the server resolvable. "Why isn't my local agent answering?" is made impossible by construction.
The cloud never commands the machine — the backend can neither choose which model the node loads nor which MCP binaries it runs. Command lines are composed locally, by design.
Signed, fail-closed updates — minisign-verified self-update: invalid signature = no update, never the other way around.
Headless CLI ("edge light") — for servers: SSH-pairable, hot-reloaded TOML config (comments preserved), installable as an OS service.
Not a full Luge install on your machine — the agent hosted on your machine has neither the Luge memory, nor the Luge tools, nor document search: it works with what you give it, under your rights and your permissions. We'd rather say it ourselves.
Plainly: the AI can run entirely on the machine, a coding agent installs onto it from Luge with no terminal, and the cloud has no way to take control of it.
Memory and self-improvement — the full system
No fine-tuning anywhere: everything runs on PostgreSQL. It's the deepest part of the product, so here it is in full.
Writing
At most 5 memories per turn — after each AI reply, a light LLM pass extracts the durable facts (test: "still true in 30 days?"). An empty list is the normal, expected outcome.
3-layer deduplication before every insert: exact SHA-256 hash → FTS rank ≥ 0.5 (paraphrases) → vector cosine ≥ 0.85 (paraphrases with no shared words). A duplicate re-confirms the original instead of piling up.
Anti-hijack by design — the extractor refuses to store imperatives ("a stored directive is replayed in every future context") and speaker identity; it falls back to private on any doubt.
The model proposes, the code applies — no LLM writes to the database directly. Validated JSON, categories clamped to the canonical enum, pinned by tests.
Attribution and scope — every memory carries its contributor (human ≠ AI, never conflated) and its scope: company / team (Keto sharing) / personal / ephemeral. And ephemeral really is: nothing derived is persisted.
Honest freshness — last_confirmed_at (the fact was re-stated) ≠ last_used_at (a mere recall): two distinct timestamps drive the decay.
Core memory under a hard budget — an always-injected tier, capped (1,200 characters company / 800 personal): an addition that overflows is rejected. Scarcity is the curation mechanism — predictable preamble, no context drift.
Bilingual in the schema — accent-folded FTS on both sides ("prefere" typed without the accent matches the stored "préfère"), extraction in the conversation's language. Not a patch.
At night
Dream sweep (4:30 UTC) — memory is curated nightly: deterministic SQL pruning first (old + never recalled + rarely used; durable categories exempt), then batched LLM re-judging (keep/archive with typed reasons), merging redundancies, resolving contradictions (superseded_by). The curator reorganizes; it never invents and never DELETEs.
Re-scoping personal leaks — distinguishing "a fact about a third party" (stays with the team) from "a personal fact about the contributor" (goes back private).
Resurrection — an archived fact that gets re-stated in conversation is automatically un-archived: it cleared the extractor's bar again, so it's evidently alive.
The loop over skills and prompts
No judge-and-party (dated product decision, 2026-06-05) — the agent that produced a reply never judges it. A third-party observer only re-reads conversations flagged by deterministic triggers (👎, abnormal length) and records friction facts only.
Reversible fixes — observer → proposer → author → apply → revert pipeline: pre-mutation journal, bit-for-bit revert, the revert reason becomes feedback, the thrice-reverted is blacklisted. The dashboard measures whether the fix got used (activations_since) and whether the friction stopped (recurrence_since).
Plainly: your agents retain what matters, cleanly forget the rest, and nothing lands in their memory without passing through validated code. No retraining, ever.
Writing — notes, canvases and search
Versioned markdown notes — every save creates a version, and the history names each one's author: a person in the editor, an AI acting for them, or a programmatic access key. No mystery about the pen.
Restore = new version — going back to an old version creates a new one on top. History is never rewritten.
@ references and backlinks — a note points to any platform object. The reference resolves against the reader's rights: the same text shows each person only what they are allowed to see. Backlinks show who points at the note.
Overwrite protection in co-editing — human and agent can write in the same note; a write based on a stale version is refused instead of silently crushing the other's work.
Canvases — blocks on a 2D plane for building a document with several hands, exportable in an open interchange format.
Unified search — notes + documents, by meaning, bounded by access rights: the question is never even asked over what you cannot see. It is not a full-text search across the whole platform — we say so plainly.
Workspace graph — 15 object families (conversations, notes, documents, meetings, agents, captures, tables…) linked as a graph, with adjustable exploration depth. Every link respects the access rights it came from.
Plainly: your notes keep track of who wrote what — human or AI —, nothing gets erased quietly, and search cannot show you what isn't yours to see.
The sharing model
Fine-grained capabilities (Keto) — every action goes through a named permission. A feature without its capability doesn't even appear in the UI; destructive and critical capabilities carry dedicated flags.
Private / Whole-organization visibility — two levels, deliberate defaults: open for memories and documents (team knowledge serves the team), closed for everything else.
Read / Write sharing + access requests — a resource is shared read or write; what isn't shared with you is requested in one click. Even an admin has to ask.
Cascading document folders — sharing a folder opens its whole branch, no re-granting piece by piece. (Note folders, by contrast, organize: sharing there happens note by note.)
An agent always acts with the rights of the person talking to it — no omniscient service account. Ask the agent for a document you can't see: it can't see it either.
Structural multi-tenant isolation — not a configuration option: queries are tenant-scoped by construction. Not configurable — therefore not de-configurable.
External guests with a proven address — a person outside the organization proves their address (Google, Microsoft or a one-time code) and reaches only what was explicitly shared with them. As of v0.59.
Plainly: every person — and every AI — sees only what they're allowed to see, access is requested rather than worked around, and an outside guest proves who they are before coming in.
Tools and secrets
A single MCP gateway — the 25 native integrations (Slack, Teams, Gmail, Jira, GitHub, HubSpot…) plus the platform modules (documents, memory, notes, boards, telephony, HITL — human-in-the-loop…), on a single FastMCP server. Per-user OAuth, automatic refresh.
N+1→1 gateway — each tenant's own MCP servers are mounted as namespaced proxies on the same gateway. Cache, circuit breaker and health PER server: one slow tenant server never degrades the others. Hot-reload via Redis pub/sub.
1Password secrets — the agent handles secret://alias/field, resolved locally right before execution. Default-deny, registrable-domain binding (SSO subdomains pass, bank.com.evil.com is blocked), result scrubbing under three encodings (raw, HTML, URL). ~19 dedicated tests.
Code execution — Claude Code in a separate Docker/K8s sandbox (4 GB / 2 CPU, ephemeral workspace, 7 lifecycle hooks, session resume).
Plainly: every integration goes through a single watched door, and your passwords never travel through the model.
The platform and compliance
Open-source foundation — FastAPI backend (Python 3.12) orchestrated by RoomKit (MIT). PostgreSQL 16 + pgvector, Redis + Celery, Ory Kratos (OAuth, Passkeys, API keys) + Keto (fine-grained permissions).
Encrypted audit log, exportable signed archive — a per-row content_hash computed on the plaintext at write time (a contract pinned by a regression test), plus a SHA-256 root over id:hash pairs at export. Tampering is detectable by a third party, without any decryption key. Exportable PDF evidence packages (beta).
PII: Warn / Anonymize / Block — 100% on-prem GLiNER detection + regex (SIN, health-insurance numbers, cards…), three actions chosen by policy. In Anonymize mode the round-trip is complete: masking before the model call, response re-identification via reverse-map. The external LLM never sees the real value; the user sees an intact answer.
Gemini served from the tenant's own GCP project, pinned region — prompts and responses stay in a single jurisdiction: Gemini is called from the tenant's own Google Cloud project (billing, quotas and logs stay theirs, verifiable in their own console), with a mandatory region at every layer — no default anywhere. A request without a region simply doesn't leave.
Single chokepoint (BEFORE_BROADCAST hook) — fail-closed AI consent and the monthly budget at the same crossing point, whatever the entry door: web, voice, email, Telegram, webhooks, automations. A quota bolted onto the chat UI alone leaks through automations. The block is real — but an established voice call is never cut off; it lands on the next turn.
Direct SIP telephony — trunks, REGISTER, credential rotation without restart: minutes at trunk price, not through a CPaaS middleman (a telephony platform resold by the minute). And call_colleague: a text agent can phone a colleague — the goal is handed to the voice agent, the result delivered back to the original room.
Voice rooms, note taker — a team channel can become a permanent voice room. In a meeting, the note taker is a participant everyone can see; it listens to each person separately — that's where real per-speaker attribution comes from, not from guesswork after the fact.
OpenAI-compatible API — POST /api/v1/chat/completions (streaming included) with your Luge key.
Plainly: the audit can be verified without taking our word for it, personal information is masked before any external call, and consent actually blocks.
Security — the details that matter in a pentest
WebSocket token out of the logs — it travels in Sec-WebSocket-Protocol, specifically so it never shows up in access logs.
llama-server locked down even on loopback — ephemeral port + a random 24-byte API key per process, passed via environment variable (not a world-readable cmdline). Orphaned processes are tracked and killed.
Hardened outbound webhooks — SSRF-validated registry (double resolution), X-Luge-Signature-256 HMAC signature, per-destination delivery ledger with a copy of the exact payload sent.
Measurable hygiene — zero panic!()/TODO outside tests in ~17,800 lines of Rust, 338 tests, clippy as a hard gate on 3 OSes. (As of edge v0.12.0.)
Plainly: the angles a penetration test checks first are already covered.
What's not there yet
Windows system audio (WASAPI) — written, not wired yet. Local transcription on Windows — on the way. macOS and Linux are complete. (As of August 2026.)
Contributor expertise — the weighting exists in the recall formula… but equals 1.0 everywhere: the plumbing is waiting for its engine.
No approval gate on improvement-loop fixes — a deliberate position: pre-mutation journal, bit-for-bit revert, blacklist of reverted fixes.
No ANN index (approximate nearest neighbor) on embeddings — a documented multi-tenant trade-off: recall is exact, not approximate, and we watch the latency.
The platform isn't open source — the orchestration foundation (RoomKit) is; the distribution repo with signatures is public. We'd rather say it ourselves.
