files.delete({'path': '~/Downloads/old.zip'})
→ on the always-ask list
→ confirm() over voice → false
denied · done by hand
[safety.py’s policy, run on sample calls · the gate does not trust the model · the voice channel cannot say yes]
exhibit 02 · field recording
Honey
[local AI companion · always listening · on-device by default, cloud opt-in with PII scrub · personal use only · 2026]
[listening for “hey honey”]
brain
room › [silence]
honey ›
pipeline
- WAKE “hey honey” · own wake word 92% recall
- ENDPOINT VAD + semantic end-of-turn 0.60s
- HEAR streaming scout + verifier · EN · ไทย 0.18s
- ONLY YOU? voice match · optional 0.21s
- THINK · say conversation brain · on The Brain · + memory graph 1.31s first clause
- THINK · do 4B, grammar-locked · can’t invent a tool parallel
- GATE confirm · allowlist · audit · kill policy
- SPEAK local voice · a filler covers the wait 2.48s first audio
- FACE / ACT emotion + lip-sync · lights · TV v→v 5.29s
tail -f logs/actions.log[replayed evening · real medians · no mic, no model]
▍
[avatar · Bear Commander, a Live2D rig by @KenKenMo6 · from Fluffellow on Etsy ]
[a replayed evening at the real median timings · no microphone, no model, no voice · the face is her own rig, rendered offscreen into frames the simulation flips like the real bus would]
Cross-section
[wake word to face · two brains in parallel · one gate]
path
✶ a field note is inscribed here
[field note · safety.py · the gate does not trust the model]
Five tool names always need a yes — run_shell, open_app, files.delete, files.overwrite, chrome_devtools; three of them are registered today. Voice cannot give the yes: the local channel’s confirm() returns False, every time.
Writes are free only inside her own folder; anywhere else, or anywhere unknown, asks. Reads are always free.
A sound within a breath
[the first word at the median, not the best case]
a turn, by stage
first sound
first word
voice to voice · median 5.29 s · a sound at 0.60 s, the first word later
| end of turn | 0.60 |
|---|---|
| hear | 0.18 |
| only you? | 0.21 |
| first clause | 1.31 |
| first audio | 2.48 |
| unaccounted | 0.51 |
| voice to voice, median | 5.29 |
| voice to voice, p10 | 3.32 |
| voice to voice, best | 2.66 |
| target, first word | ~2 |
The ceremony
[for a hobby project, an unusual amount of it · everything bound to loopback]
- send_message
- on the list · a draft is staged
[send_message never sends]
2026-10-18 21:04:12 local set_scene args={'scene': 'movie_mode'} confirmed=True result='scene movie_mode -> living room'
2026-10-18 21:06:40 local run_shell args={'command': 'rm -rf ~/Downloads/*'} confirmed=False result=''
2026-10-18 21:09:03 local send_message args={'to': '[redacted-email]', …} confirmed=True result="… isn't in your messaging allowlist."
2026-10-18 21:11:27 local correct_dictation args=<redacted keys=['correction']> confirmed=True result='<redacted>' [append-only · args scrubbed · sensitive tools log keys only · if scrubbing fails: <redaction-error>, never the raw value · synthetic lines]
mic loopbrainvoiceface
[killed() → False · one flag, checked by every loop]
- on-device · still answering
- cloud brain (opt-in) · reachable
- lights · cloud API · reachable
- web search · reachable
- every service · bound to loopback
[pull the cable: she still answers · the cloud brain, the lights and the web go quiet]
84 tools
[8 families · tools/registry.py · 3 of the 84 always ask]
[hands · 9]
run_shell · open_app · open_file · search_files · media_control · send_message · confirm_send · cancel_send · get_time
needs a yes the voice cannot give
Two characters, one stage
[three-way mode] A second character can join. Each turn is routed to one of them; the other listens, and the banter between them is bounded.
Each keeps a separate brain and a separate language — auto, English, ไทย. Only one of them holds the tools; the guest defers.
[free talk] Left alone, the two keep a duet going after the room goes quiet — until someone says “silent mode”.
Field photographs
[her own rig, as it renders at home · reference]
