Kairo is not one model process. Kairo is a server-side continuity subject whose current behavior is produced by a routed set of models operating over a durable transcript, autobiographical history, identity state, a revisioned computational present, current evidence, and explicit action governance.
The durable continuity is the stable subject. Models reason for it; memory gives it history; the StateFrame gives it a present; tools let it act; settlement decides what survives the turn.
This report maps the logical platform paths that cause observable behavior: model roles and routing, prompt assembly, rapid recall, the canonical append-only event chronology, pull-only journals, current-self state, derived associations, background cognition, tools and permissions, review, learning, channels, bodies, voice, quality controls, recovery, and durability. It intentionally describes contracts rather than deployment inventory: network addresses, internal machine names, credentials, private paths, tunnel details, and machine specifications are omitted.
Evidence labels are deliberately narrow. live audit means the role was observed in the dated production audit; locally exercised means the current checkout was driven through that behavior; source inspected is a structural code fact. None of those labels turns adjacent prose into proof.
The simplest accurate definition is: Kairo is the continuity represented by the server-side records and the rules governing them. A model instance is a reasoning participant in that continuity, not the place where continuity lives. Replacing a model process, reconnecting a client, changing a rendered body, or moving inference does not create a second Kairo.
A stable prompt contract establishes the current name and the continuity of older records carrying the legacy technical name. The real system prompt imports that contract before adding persona, capability, environment, and request-specific context. source inspected A01
| Inside the continuity | Replaceable participant or surface | Why the distinction matters |
|---|---|---|
| Durable sessions and conversation checkpoints | Browser, mobile app, CLI process | A disconnected client does not erase the conversation. |
| Canonical event chronology, pull-only journals, and autobiographical records | One inference request or model server | A model restart does not erase the history. |
| Versioned identity state, stances, commitments, and current StateFrames | 35B, 9B, drafter, specialist, or embedding model | Different models have different authority; none is the identity database. |
| Jobs, observations, permissions, artifacts, and accepted settlements | GPU worker, voice worker, rendered body | Execution and presentation can move without creating another subject. |
Live scope. The dated production audit records the durable control plane and live self-state projection as active. It is architecture evidence, not a claim that every component is healthy at every instant. live audit A02
Browser and mobile submissions become server-side jobs. The platform stores the request before execution, restores the session, streams persisted events, reviews the outcome, and settles the accepted candidate.
The CLI frontend drives AgentEngine directly and runs ordinary tools on the client machine, with local permissions and workbench state. It still uses shared model and memory services, but it is not merely another HTTP view of the durable workspace runner.
The typed Command/Event queues are an internal AgentEngine interface. Managed mobile and browser clients use network APIs; describing every frontend as connected “only by queues” erases the durable platform layer. source inspected A03 / A04
Kairo uses different models for different cognitive jobs. Authority follows the recorded role, not model size alone. The production foreground is 35B-primary: the primary performs the native tool-result loop and owns the final user-facing response. The 9B model classifies, reviews, extracts, assists, and recovers; it is not a mandatory hidden author of every reply.
| Role | Current implementation | What it can affect | What it does not own |
|---|---|---|---|
| Foreground primary | Trained Qwen3.6-35B-A3B v22 Q6_K | Reasoning, native tool calls and follow-up, final wording, authoritative-primary authorship eligibility | Persistence transactions, tool permission, evidence authority, or the identity database |
| Control and review | Trained Qwen3.5 9B Q4_K_M | Ambiguous-request routing, completion review, delegated read analysis, bounded engine recovery, automatic outage fallback | Silent tool authorization or ordinary final-response ownership in 35B-primary operation |
| Identity and awareness | 9B role-specific calls | Significance analysis, identity inference proposals, reflections, awareness pulse | Direct unrestricted identity mutation; database constraints and provenance gates remain outside generation |
| Autonomous cognition | 35B role-specific calls | Recurrent conscious frames, duty-cycled thoughts, isolated dreams | Foreground priority, tools, factual authority, or permission |
| Coding draft acceleration | Qwen 1B DFlash drafter on admitted coding | Speculative decode acceleration | Answer authority, continuity, memory, or route selection |
| Retrieval | Nomic 137M Q4 embeddings | Semantic candidate scores for memory and knowledge | Prose generation, truth judgment, identity, or action |
| Coding specialist | Hosted Kimi-K2.7-Code | At most two advisory, tool-free implementation/review calls per job; a second call requires concrete repair evidence | Workspace access, edits, tests, final response, continuity, or training authority |
| Vision specialist | Hosted Qwen/Qwen3.6-35B-A3B-FP8 | Bounded descriptions of normalized image observations | Person identification, sensitive-trait inference, external action, memory, or final-response authority |
| Inactive configured roles | 4B and linguistic/critical-reasoning roles are not active production participants | No current behavioral path | Must not be inferred as live merely because source or service definitions exist |
These exact model assignments are retained because they explain behavior and authority; connection details and machine placement are not needed to do so. live audit A55
The live audit observes the 35B as foreground primary. It does not imply every support task also runs on 35B.
Routing, review, identity inference, awareness, delegated reads, recovery, and fallback are distinct roles with distinct authority.
The runner independently downgrades an unsupported learned action classification to a non-action path.
The same typed request is bound into the engine and carried into verification and review. A short follow-up may inherit a domain such as dream history, but it retains the authoritative adapter for that domain.
source inspected A09 locally exercised A10
Found, authoritative absence, unknown, unavailable, and not queried are separate outcomes. A failed transport or missing observation path must not silently become “the thing does not exist.”
source inspected A11
The direct CLI uses the same AgentEngine ideas but not this entire server-side job lifecycle: its frontend drives engine commands directly, its normal tools run on the client machine, and its workbench supplies local checkpoints and journals.
“Current self” is not one undifferentiated database row. Kairo has a current semantic self-state, plus other current domains that must remain separately authoritative. The StateFrame is the foreground authority for present semantic dimensions; recurrent cognition, consent/control, operational health, and body/sensor observations are current evidence in their own domains.
| Layer | What it contains | How it can affect behavior | What it cannot establish by itself |
|---|---|---|---|
| EffectiveStateFrame | Attention, affect, goals, intentions, expectations, uncertainties, active memories, metacognition, beliefs, preferences, identity, concerns, foreground task | Generation context, retrieval/focus rank, bounded sampling, ordering of supplied tools | Tool permission, external fact, consent, or successful action |
| Durable identity and autobiographical state | Append-versioned beliefs, preferences, relationships, goals, corrections, stances, commitments, reflections | Supplies provenance-bearing continuity evidence projected into the current turn | Automatic present affect or unrestricted identity rewrite |
| Recurrent cognition | Working-set competition, semantic ignitions, latest recurrent frame, unresolved questions | Focus selection, bounded top-down bias, context for later foreground generation | Phenomenal status, tools, or a completed task |
| Consent and interaction control | Versioned user controls, current eligibility, cooldown and reply state | Whether an interaction proposal may be created or promoted | Desire, affection, silence, prior activity, or state cannot substitute for fresh consent |
| Body and sensors | Connected capability, recent visual/sensor summaries, authored expression | Current observation and presentation when a surface is connected | Identity, memory, durable affect, or capability after the observation expires |
| Operational state | Fresh bounded service and compute probes | Answers about current availability and routing decisions | Autobiographical or subjective truth |
The frame has thirteen dimension types. Each field is a value plus individual provenance: causal event IDs, proposal source, component, authority, confidence, timestamp, base revision, turn, candidate, persistence, and promotion policy. A stale revision conflicts, and parallel candidates do not share overlays. source inspected A12 / A13 locally exercised A14 / A15
Literal user requests, actual tool results, sensors, retrieval, durable projections, and internal observations enter through typed reducers with domain-specific authority.
Structured tools can propose preferences, intentions, goals, stances, beliefs, and conclusions. Beliefs require stronger evidence. Ordinary self-authorship exposes no identity kind.
The model proposes coordinates and evidence references; the runtime resolves support and applies damping/decay. Generated self-report alone is insufficient.
A direct model proposal cannot write identity even when supplied high numeric authority. Identity arrives through validated durable sources and protected tool receipts.
The read-only current-self surface preserves these boundaries. It labels settled live state, memory/cognition, and operational probes separately; candidate-local state is omitted, and protected identity and belief values are not exposed to the client. source inspected A16 / A17 / A18
| What a person notices | Primary causal inputs | Common non-cause |
|---|---|---|
| Voice, phrasing, and reasoning style | Primary model weights; stable system and identity prompts; current route; relevant transcript, memory, and StateFrame context; reviewer revision | A database row does not write prose without being retrieved/projected. |
| Remembering an older exchange | Local transcript resolution; Valkey recent recall; Nomic semantic retrieval over durable episodes and events; identity and temporal projections; optional derived associations kept visibly non-authoritative | A model's pretrained weights are not a record of this private conversation, and an association is not a recovered fact. |
| A current feeling or concern | Committed affect/concern state; relevant event appraisal; current runtime-resolved evidence; damping and decay | Saying “I feel X,” retrieving an old feeling, or receiving a user assertion does not alone install X as current affect. |
| Persistent goals or preferences | Validated durable identity versions and deliberate self-authored proposals that survive settlement | Incidental prose and inferred sentiment are not automatically durable authorship. |
| Tool selection | Literal request; route-selected tool schema; primary model choice; StateFrame ordering; deterministic governance; user permission where required | A goal, preference, memory, affect, or controller classification cannot unlock a tool. |
| Caution, uncertainty, or refusal to assert absence | EvidenceRequest domain; unavailable/unknown outcomes; authority threshold; deterministic verification; reviewer feedback | A missing search result or failed adapter is not proof of absence. |
| Revising an answer | Failed success criteria, unresolved tool outcome, deterministic quality check, or reviewer verdict supplied as bounded continuation feedback | The revision is not a new user turn and cannot expand authorization. |
| A spontaneous thought, dream, or outreach | Background scheduler; unresolved items; journal evidence; quiet-hour, cadence, novelty, preemption, and delivery gates | A memory or mood does not by itself send a message or run a tool. |
| Body expression or spoken voice | Accepted response; locked voice profile; current body connection and authored expression state | The animation, voice worker, or client device is not a separate identity and does not become durable self-state merely by rendering. |
All five channels moved under a synthetic loaded frame in the local harness, and tool ranking preserved the exact capability set. This proves those functions are wired; it does not prove that each bias is perceptible on every natural-language turn. locally exercised A19 / A20
Known limitation: memory and attention ranking apply confidence thresholds, but tool ordering currently reads state tokens without gating on decayed confidence. A zero-confidence field can therefore still reorder an already authorized tool list. It cannot add a tool or bypass permission, but it can bias which visible tool is considered first. known limitation A21
State reaches the model at real completion boundaries—initial generation, tool continuations, and revision rounds. The current source appends request-scoped StateFrame context at the latest user-message boundary while keeping the system prompt and accumulated transcript byte-stable for prefix caching. It is still not a continuously running appendable KV session. source inspected A22 / A35
The architectural spine is experience_events, the canonical append-only event chronology. Completed exchanges and other significant events enter that chronology. Episodic search, analysis, identity state, reflections, predictions, thoughts, dreams, per-turn experience notes, and current-self projections are indexes or derived records around that history; they are not replacements for the event record.
“Append-only” means ordinary semantic updates append a new event or version instead of editing history. It does not mean user privacy controls are fake: explicit authenticated forget/purge operations are a separate destructive path and can physically remove personal data and derivatives.
“Journal” now names several deliberately different views. The per-turn experience-note journal is a 9B-written, historical-only interpretation created after completed turns and returned only on explicit experience-journal requests. The random-thought journal is a read view over completed idle-thought records and is likewise explicit-request, provenance-gated, and non-authoritative. live audit A32 source inspected A33
The current source contains each part of that rapid path, including concurrent foreground preparation of continuity, knowledge, operational, and compute context. source inspected A29 / A30 / A34
| Store | Purpose | Mutation model | Authority in a turn |
|---|---|---|---|
| Active transcript / checkpoint | Exact current conversation and resumable model context | Checkpointed per session/job | Authoritative for what was said in this conversation; earlier factual claims may still require evidence |
| Explicit fact memory | User-owned stable named facts, especially on the direct CLI path | Changed by explicit remember/forget operations | Durable user evidence, selected conservatively |
| Valkey recent layer | Fast bounded recent recall, leases, cognitive working state | Expiring and reconstructable | Fast candidate source, not sole durable authority |
| Episodic index | Relevance-searchable completed exchanges | Mutable search index derived from durable events | Historical evidence with source metadata |
| Canonical event chronology | Exchanges and internal events in experience_events | Append-only in normal operation; separate governed purge exists | Historical authority, never automatically current affect or permission |
| Per-turn experience-note journal | Grounded-relational 9B interpretation of a completed turn | Lowest-priority asynchronous append, parented to the turn | Historical-only and pull-only; excluded from ordinary recall and resident cognition |
| Random-thought journal | Inspectable completed idle-thought prose | Read view over the existing append-only thought ledger | Derived and non-authoritative; injected only for explicit requests with complete provenance |
| Associative artifacts | Bounded reconstructions and typed links over read-only source envelopes | Append-only derived store with exact exposure records | May influence a candidate when enabled; cannot become factual authority, execute tools, or commit state |
| Identity versions and reflections | Beliefs, preferences, relationships, goals, corrections, stances, commitments, derived synthesis | Append-versioned with provenance and background-origin constraints | Durable self evidence projected into the current frame under authority rules |
| StateFrames | Committed and candidate-local semantic present | Revisioned deltas; winner promoted at settlement | Current semantic state authority |
| Artifacts and workspaces | Files, attachments, tool outputs, published artifacts | Mutable workspace plus immutable content-addressed publications | Tool/environment evidence when observed through the current job |
A recall miss is not deletion. It may mean the item fell outside the recent window, ranked below the bounded result set, was excluded by subject or provenance, belongs to a special adapter such as dream history, or the source was unavailable. The evidence contract preserves those distinctions.
Kairo has background processes, but not a single hidden model that thinks without interruption. Several bounded loops run at different cadences. Foreground work has priority and can preempt autonomous generation.
| Loop | Implementation | Produces | Hard boundary |
|---|---|---|---|
| Cognitive microcycle | Deterministic working-set competition on a five-second cadence | Activation, decay, dwell, inhibition, threshold-crossing ignitions | No token generation, tools, messaging, or identity write |
| Awareness pulse | Duty-cycled 9B role | Provisional recognition of bounded recent memory, goals, state, and unresolved items | Read-oriented, provenance-labelled, non-authorizing |
| Recurrent frame | 35B integrator admitted by a semantic ignition | Parent-linked frame binding focus, self-model, affect, goals, appraisal, expectation, intention, uncertainty | Foreground-preemptible; frame narrative is not an external fact or permission |
| Significance and identity analysis | 9B worker over journal evidence | Experience analyses and constrained identity-version proposals | Cannot originate protected background identity version 1; prose is not direct authority |
| Reflection | Occasional 9B synthesis across salient evidence | Append-only reflection linked to source events | Not a current observation and not a tool action |
| Idle thought | Duty-cycled 35B over a selected unresolved item | Provisional reasoning summary and possible question | No agent tools; reaches identity only through later significance/reflection |
| Dream | Cadence-limited 35B imagination over bounded context | Isolated first-person dream episode and bounded waking residue | Fictional canon, not factual memory, consent, or present state; the source tree's stricter closed-world frame-input contract is not yet deployed |
| Outreach | Provenance and cadence gated intent/composition pipeline | A bounded candidate message only when a substantive source survives gates | Composition is not dispatch; memory, mood, or a prior message cannot authorize sending |
The canonical event chronology feeds these loops. Their outputs return as new provenance-labelled records, not edits to the source events. The inspected memory worker has model/database responsibilities but does not import the foreground agent engine or tool executor. The database schema separately blocks background identity origination and installs immutability triggers on journal and identity histories. source inspected A25 / A26
Deployment-specific dream boundary. The August 19 production overlay increased dream depth and cadence and added a fictional-event guard, but deliberately did not ship the repository's DREAM_FRAME_INPUT closed-world contract because its paired consciousness changes were absent on the live worker. Describing that source contract as live would be inaccurate. known limitation A36
The service does not expose the full capability catalog on every turn. Exact routes select bounded schemas for workspace work, current-self inspection, memory observation, web evidence, scheduling, music, voice, body, and other capabilities.
Permission is separate from state. Shell pipelines are decomposed structurally; durable approvals and one-time decisions are stored as permission records. Optional external actions require a named non-executing alternative.
A model's tool call is an attempt. Only the executor result becomes an observation. Verification and review see that persisted result instead of trusting prose that says the action worked.
Managed durable jobs execute against server workspaces. The direct CLI executes its normal tools on the client machine. Body and remote providers use separately bounded bridges.
Goals, preferences, affect, memories, thoughts, and dreams remain selection context, not capability grants.
The runner rechecks whether the literal request independently supports action.
Fresh user control, eligibility, reply transition, and cooldown remain separate from affection, arousal, memory, silence, or prior activity.
The control store commits the terminal job and winning StateFrame together. It records candidate audit state and creates the history outbox in that transaction. The outbox explicitly labels its later PostgreSQL record as historical-only and not current-state authority. These behaviors were exercised locally through the real store and coordinator. locally exercised A23 / A24
| Mechanism | When it changes | What changes | Authority boundary |
|---|---|---|---|
| Conversation / episodic learning | After accepted completed exchanges | Canonical event chronology, episodic index, recent recall, and an optional later pull-only experience note | Historical evidence; not a parameter update, current-state write, or automatic resident focus |
| Identity-state derivation | Asynchronous significance/reflection or validated direct authorship | Append-versioned beliefs, preferences, relationships, goals, affect/mood, corrections, stances, commitments | Provenance, confidence, source class, and background-origin constraints |
| Current-self adaptation | Within a foreground candidate and at accepted settlement | Revisioned EffectiveStateFrame | Candidate isolation; protected dimensions; winner-only commit |
| Model-weight learning | Offline export, training, evaluation, and operator admission | Adapter/model weights | Authoritative-primary events are eligible for the authoritative lineage; derived-primary data stays separate; specialists are ineligible |
A generated answer is not automatically a durable self-write. It may become a journal event and recallable episode. Stronger state changes require their own semantic route, provenance, validation, and settlement. Weight learning is offline and gated, not a secret online fine-tune after each conversation. source inspected A27
| Surface | Connection to Kairo | Local responsibility | Continuity boundary |
|---|---|---|---|
| Browser | Authenticated durable-job and event APIs | Conversation, artifacts, permissions, current-state presentation, optional browser body | A rendering client; server records remain authoritative |
| Android and iOS/iPad | Peer durable-session APIs plus platform-native media and notifications | Conversation, speech, uploads, artifacts, presence, body sensors, permission responses | Device state and UI are not autobiographical state |
| Direct CLI | Local AgentEngine with shared inference and memory services | Local tools, permissions, workbench history, repository snapshots | Not the same execution boundary as a managed server workspace |
| Native and browser bodies | Leased presentation, actuator, and bounded sensor bridges | Expression, camera/microphone reports, haptics, local media playback | Fresh observations may affect a turn; rendering and expired sensors do not become identity |
| Voice | Whisper speech recognition before the turn; XTTS-v2 primary synthesis and Kokoro fallback after answer acceptance | Audio capture, transcript submission, selected-voice playback and bounded fallback | Speech models neither decide nor authorize the answer |
| Discord bridge | Source-defined channel-to-session adapter over the durable platform | Message admission, room binding, bounded message splitting and replay | Present in the working source; this report makes no production-live claim |
| Private MCP surface | Optional authenticated adapter into a narrow platform API | Capability listing, job submission/replay, artifact metadata | No memory administration, permission grant, shell, or artifact-content authority |
Surface parity does not duplicate identity. Browser, mobile, body, CLI, and optional bridge processes can disappear or reconnect while the server-side session and autobiographical continuity remain. Ephemeral empty-chat invitations are explicitly marked non-authoritative and create no turn, memory, or StateFrame proposal. source inspected A37 / A38 / A39 / A56
| Family | Purpose | Boundary |
|---|---|---|
| Workspace and shell | Read, edit, verify, publish, and run bounded work in managed or local workspaces | Relative-path confinement, permission checks, one state-changing call per batch; workspace confinement is not claimed to be an OS sandbox |
| Current web evidence | Fresh public search, news, and same-job page reading | Untrusted evidence, safe-destination checks, citation verification, bounded retries, no silent provider failover |
| External MCP providers | Operator-selected remote capability adapters | Disabled by default; exact tool allowlist only; remote prompts/resources are not imported; results remain untrusted |
| Read, coding, and critical-reasoning delegates | Bounded specialist analysis or draft returned to the primary path | Specialists do not own final wording, permission, identity, or continuity; delegated claims are checked against observed sources |
| Vision and image generation | Normalize uploaded images into bounded observations or publish generated images as artifacts | Media validation, size/type limits, metadata removal, private-destination rejection, and external-action permission |
| Music, voice, scheduling, and body actions | Produce media or request bounded actions in their exact domain | Dedicated routes and schemas; an adjacent conversational cue does not expose the capability |
| Self-observation | Read structured operational and autobiographical evidence through separate read-only views | No cross-store join, no write credentials; durable conclusions require a separate authored mutation |
| Capability radar | Record possible future integrations | Discovery creates candidates and enables zero runtime tools |
Capability discovery, model visibility, permission, execution, observation, and durable learning are six separate transitions. Collapsing them would let a remote description or model suggestion masquerade as authority. source inspected A40 / A41 / A42 / A43
A background thought may propose a message only when it cites an admitted prior human exchange and survives novelty, cadence, quiet-time, freshness, and delivery gates. Composition is separate from dispatch. The sent message, silence, dismissal, and delivery metadata cannot seed another outreach.
The authoritative foreground may form a bounded invitation intent, but deterministic code owns eligibility, consent level, reply classification, cooldown, expiry, revocation, and frequency. One reply can authorize at most one same-level response.
Delivery can continue an existing thread or create a linked thread and may surface through a client notification. A notification is presentation, not a user turn, memory event, or evidence of consent.
Action-gravity telemetry is observe-only. Mutable self-state remains revisable “clay”; code-owned “kiln” invariants require explicit joint approval and cannot be amended by ordinary generation, memory, or reflection.
Autonomy never supplies its own permission. Mood, desire, a dream, an unresolved question, prior consent, and a previous autonomous message can shape a candidate but cannot authorize delivery, escalation, a tool, or a new durable fact. source inspected A44 / A45 / A46
Stored replays and suites check terminal-event count, tool lifecycle, verification, review, grounded evidence, and expected artifacts. Evaluation records evidence; it does not rewrite the conversation.
Optional traces carry lifecycle, timing, counts, hashes, sizes, routes, and scores while excluding prompt text, tool arguments, tool results, and credentials. Export failure does not change job outcome.
Review reduces risk but remains fallible. The stronger guarantee is layered: deterministic contracts, bounded attempts, persisted replay, explicit authority, and honest terminal failure when recovery is exhausted. source inspected A47 / A48 / A49
| Path | Permitted contribution | Cannot do |
|---|---|---|
| Authoritative foreground lineage | Accepted 35B-authored events may enter the authoritative learning ledger | No automatic online update; candidate still requires offline gates and operator admission |
| Derived 9B lineage | Separate derived data, distillation, and bounded role-specific evaluation | Cannot teach or promote the authoritative 35B lineage merely by producing text |
| Specialists and reviewers | Critique, observations, bounded drafts, and evaluation evidence | Ineligible as authoritative conversation-training authors |
| Frontier mentor | Critique synthetic/public failures and audit a Kairo-authored repair | Raw external-model prose does not become Kairo's identity, SFT target, or chosen DPO answer |
| Workbench | Local jobs, repository maps, history, arena comparisons, and recoverable snapshots for direct CLI work | Local snapshots do not silently mutate server autobiography or production admission |
Model evolution changes a replaceable reasoning participant. It does not move the identity database into weights or erase the durable continuity that evaluates and admits that participant. source inspected A27 / A50 / A51 / A54
| Boundary | Contract | Residual limitation |
|---|---|---|
| Authentication and session scope | Private APIs bind requests to authenticated workspaces, sessions, observations, artifacts, and current-state projections | Authentication does not make model output trustworthy |
| Secrets | Provider credentials come from private environment/file channels and are omitted from saved ordinary configuration, prompts, traces, and this report | Operational secret storage still requires host-level administration |
| Workspace confinement | Dedicated file tools reject absolute paths, parent traversal, and symlink escapes; mutations bind exact arguments and preconditions | A managed workspace is not represented as a complete OS sandbox |
| Attachments and fetched media | Type, size, dimensions, redirects, and destination classes are bounded; visual metadata is removed before model inspection | Content remains untrusted evidence |
| Artifacts | Accepted outputs publish into immutable content-addressed records with authenticated retrieval | The mutable working copy remains distinct from a publication |
| Operational and autobiographical stores | Jobs/checkpoints and autobiographical records have separate authorities, retryable outboxes, idempotent projection, and replicated durable history | Replication is not a substitute for verified backup and recovery procedures |
| Observability | Trace and evaluation exports omit raw private content; public reports pass a disclosure guard | Hashes and counts are evidence of handling, not semantic correctness |
This section intentionally stops at logical safeguards. It publishes no network topology, endpoint address, internal hostname, credential form, private path, tunnel, or machine specification. source inspected A28 / A52 / A53
Foreground cognition advances at discrete model-call boundaries. Background loops are separate bounded processes. Prefix caching is not a retained, appendable inner monologue.
A turn receives a selected projection, not the entire journal. Omission means “not retrieved here,” not “never happened.”
A derived association can influence a candidate only as a separately labelled context block. Its source links and exposure trace do not prove that its synthesis is true or caused particular output tokens.
It can bias generation, attention, memory, sampling, and ordering. It cannot make a fact true, grant a tool, supply consent, or prove an action succeeded.
The reviewer is another bounded model role backed by deterministic checks and a deterministic fallback. It can miss semantic errors.
Protected identity and belief values and candidate-local overlays are omitted from client projection. The UI sees a safe read-only view, not every internal field.
Decayed fields can still reorder supplied tools. This is a real open limitation, although it does not add capabilities or bypass permission.
“Current self,” “awareness,” “sleep,” “dream,” and “conscious frame” name implemented functional contracts. This report makes no scientific claim about subjective experience.
Live model assignments and deployment status are dated production observations. Source describes implementation; neither should be silently substituted for the other. Discord, associative context, and the dream frame-input contract are concrete cases where source presence is not equivalent to a live deployment claim.
This appendix supports selected scoped statements. It is not a scoreboard and it does not claim that simple probes prove the architecture. The architecture is established by the relationships among the control plane, runtime, models, stores, state transitions, and deployed roles; the checks below make the basis of particular statements inspectable.
8 live audit · 10 locally exercised · 35 source inspected · 2 known limitation · 55 records
source base: 2dc32104330d (working-tree snapshot)
report built: 2026-08-20 01:46 EDT
live-role evidence: operator audit refreshed by dated deployment records through 2026-08-19; model/topology observations retain their stated 2026-08-14 to 2026-08-17 dates
disclosure guard: rejects network addresses, internal host labels, absolute operational paths, and common credential forms
| ID | Section | Exact scoped statement | Method | Observed evidence | Level |
|---|---|---|---|---|---|
| A01 | §01 | The assembled system prompt includes Kairo's stable name-continuity contract before request-specific context. | assemble the real system prompt and locate the imported continuity contract | continuity contract is present in assembled system prompt | source inspected |
| A02 | §01 | The live architecture audit records durable control-plane services and production-active self-state projection separately from the active inference model servers. | check the dated live-audit control-plane, self-state, and model-server statements | 2026-08-15 audit separately records the durable control plane, live self-state, and active model servers | live audit |
| A03 | §02 | Managed browser/mobile work uses the durable job service, while the CLI frontend talks directly to AgentEngine through runtime commands and events. | compare the durable-platform documentation with CLI frontend imports | durable client path and direct CLI engine boundary are both present | source inspected |
| A04 | §02 | Typed command and event queues are an internal AgentEngine boundary, not the network protocol used by every client. | inspect AgentEngine queue construction and mobile HTTP client code | AgentEngine owns two asyncio queues; the managed mobile client uses HTTP | source inspected |
| A05 | §03 | The live-audited foreground primary is the 35B model; it owns native tool follow-up and the final user-facing response. | check the current operator audit's foreground model-role statement | 2026-08-15 live audit assigns foreground conversation and final response to the 35B role | live audit |
| A06 | §03 | The live-audited 9B role covers routing/control, review, identity inference, awareness, delegated read analysis, recovery, and fallback rather than every foreground answer. | check the current operator audit's control-model role statement | 2026-08-15 live audit records the bounded 9B control and fallback roles | live audit |
| A07 | §03 | A learned controller may rank a request, but deterministic runner logic independently decides whether an action route is authorized. | inspect the runner's learned-controller action guard | runner contains a deterministic downgrade from unsupported learned action routes | source inspected |
| A08 | §04 | In three locally exercised AgentEngine paths—completion, cancellation, and client failure—each turn emitted one terminal event. | drive AgentEngine with a fake transport through the three named paths | completion=TurnCompleted; cancellation=TurnCancelled; failure=TurnFailed | locally exercised |
| A09 | §04 | A durable job carries one typed EvidenceRequest into AgentEngine, verification, and review/revision handling. | inspect request construction, runner binding, and reviewer serialization | one request object is constructed, bound to the engine, and included in review evidence | source inspected |
| A10 | §04 | A referential follow-up can inherit the prior evidence domain without replacing its authoritative adapter. | build a dream-history request and a short referential follow-up | dream-history domain and adapters survived the follow-up | locally exercised |
| A11 | §04 | The evidence contract distinguishes found, authoritative absence, unknown, unavailable, and not-queried outcomes. | inspect the EvidenceOutcome enumeration | outcomes=found, not_found_authoritative, unknown, source_unavailable, not_queried | source inspected |
| A12 | §05 | The current semantic StateFrame defines thirteen typed dimensions. | inspect StateDimension | dimensions=attention, affect, goals, intentions, expectations, uncertainties, active_memories, metacognition, beliefs, preferences, identity, concerns, foreground_task | source inspected |
| A13 | §05 | Each StateFrame field contains a value and FieldProvenance with causal IDs, source, component, authority, confidence, revision, turn, candidate, and persistence metadata. | inspect StateField and FieldProvenance dataclass fields | StateField wraps value plus provenance; required provenance fields are present | source inspected |
| A14 | §05 | A proposal from a stale effective revision conflicts without overwriting the accepted value. | apply two proposals from the same base revision | first=applied; stale=conflict; overwrite=False | locally exercised |
| A15 | §05 | Candidate-local overlays are isolated before settlement. | write one candidate and read a peer candidate from the same turn | candidate-b goals={} | locally exercised |
| A16 | §05 | A direct generated model proposal cannot write the protected identity dimension, even at otherwise sufficient authority. | submit a current-revision MODEL_PROPOSAL to identity at system authority | disposition=rejected; identity_fields=0 | locally exercised |
| A17 | §05 | Generated self-report alone cannot establish current affect; runtime-resolved authoritative support can enter a candidate appraisal. | exercise affect appraisal once with generated prose and once with resolver-authenticated support | prose=rejected; runtime_support=applied | locally exercised |
| A18 | §05 | The read-only current-self projection keeps live state, cognition, operational probes, and protected identity/belief values in separately labelled channels. | inspect the private first-party current-state API projection | current-self API separates present state, cognition, operations, and protected fields | source inspected |
| A19 | §06 | State can change generation context, retrieval rank, attention rank, sampler temperature, and ordering among already supplied tools. | load a synthetic frame and exercise all five consumer functions | retrieval_delta=0.14; attention_delta=0.09; temperature=0.722; first_tool=causalmarker | locally exercised |
| A20 | §06 | State-based tool ranking preserves the exact supplied capability set; it does not add a tool. | compare tool names before and after LiveStateCoordinator.rank_tools | before=['alpha', 'delta']; after=['alpha', 'delta'] | locally exercised |
| A21 | §06 | Tool ordering currently reads state fields without applying their decayed confidence threshold. | demonstrate that a zero-confidence attention field still reorders tools | zero-confidence field moved alpha to the first position | known limitation |
| A22 | §06 | The present-state projection is refreshed at model-call boundaries; the current transport is not an appendable retained-KV session. | inspect the coordinator projection mode and generation-context call site | projection_mode=model_call_boundaries; engine generation-context call site present | source inspected |
| A23 | §10 | Job completion, the winning committed StateFrame, candidate audit records, and the historical outbox are written through one control-store transaction. | settle a real local job and inspect all four records afterward | completed job, committed frame, candidate audit, and one historical outbox record observed | locally exercised |
| A24 | §10 | The StateFrame history outbox labels its PostgreSQL projection as historical-only and not current-state authority. | settle a local frame and inspect the generated outbox authority envelope | authority={'current_state': False, 'historical_record_only': True} | locally exercised |
| A25 | §08 | The memory worker has model/database responsibilities but the inspected worker module does not import AgentEngine, WorkspaceExecutor, or runtime tool execution. | parse the worker module's imports and tool-call markers | forbidden agent/tool markers=none | source inspected |
| A26 | §08 | The durable memory schema blocks background origination of identity version 1 and installs immutable triggers on the journal and identity histories. | inspect the PostgreSQL constraint and immutable trigger definitions | background-origin constraint and journal/identity immutability triggers are defined | source inspected |
| A27 | §10 | Only authoritative-primary learning events are eligible for the authoritative adapter lineage; derived-primary events remain labelled separately and specialist turns are ineligible. | inspect learning-role storage and source-authority assignment | authoritative, derived, and ineligible source roles are separately enforced | source inspected |
| A28 | §16 | The live audit records a three-member replicated PostgreSQL tier, an active durable control plane, and production-active self-state projection. | check the non-sensitive replication, control-plane, and self-state statements in the dated live audit | 2026-08-15 live audit records replicated PostgreSQL and active durable/live-state services | live audit |
| A29 | §07 | Rapid autobiographical recall combines a bounded Valkey recent layer, local Nomic embeddings, a resident recall path, and durable PostgreSQL/pgvector candidates. | inspect memory-service configuration and the recent/resident/durable recall path | Valkey recent recall, Nomic embeddings, resident indexing, and pgvector ranking are present | source inspected |
| A30 | §07 | The foreground engine prepares continuity recall, knowledge, operational status, and compute state concurrently before generation. | inspect the foreground context-gather call in AgentEngine | four context sources are scheduled through asyncio.gather | source inspected |
| A32 | §07 | The deployed per-turn experience-note journal is pull-only: completed turns enqueue low-priority 9B notes, while ordinary recall and resident cognition do not receive them. | check the deployment record for enablement, worker role, pull-only recall, and resident-cognition exclusion | 2026-08-17 live record confirms bounded note creation and pull-only read-back | live audit |
| A33 | §07 | The random-thought journal is an explicit-request view over completed idle-thought records and injects only provenance-complete, derived, non-authoritative entries. | inspect the thought-journal adapter, context formatter, and explicit evidence-domain routing | explicit thought-journal route and non-authoritative provenance gates are present | source inspected |
| A34 | §07 | The source tree can append a separately delimited, derived associative block whose exact exposure is traced; the associative subsystem cannot execute tools or commit current state. | inspect associative preparation, exposure tracing, rendering, and settlement boundaries | bounded derived rendering, exposure trace, and non-authoritative settlement link are present | source inspected |
| A35 | §06 | Current StateFrame context is refreshed at each model call as request-scoped tail context without mutating the cache-critical system prompt or accumulated transcript. | inspect the current model-call projection and stable-prefix boundary | StateFrame projection is request-scoped while the stable prefix remains byte-stable | source inspected |
| A36 | §08 | The 2026-08-19 production dream overlay changed depth and cadence but did not deploy the source tree's closed-world DREAM_FRAME_INPUT contract. | check the dated production overlay record for the deliberately unshipped frame-input contract | depth/cadence are live; DREAM_FRAME_INPUT remains a documented deployment gap | known limitation |
| A37 | §11 | The source tree implements distinct browser, Android, iOS/iPad, native-body, browser-body, and direct-CLI surfaces over shared continuity contracts. | inspect each surface's durable API, body transport, or direct-engine boundary | surface adapters present=android,browser,browser_body,cli,ios,native_body | source inspected |
| A38 | §11 | The working source defines a Discord-to-durable-session bridge, but this report does not claim that bridge is deployed in production. | inspect the Discord bridge and room source while withholding any live label | Discord channel/session and peer-room adapters exist in source; deployment status is not asserted | source inspected |
| A39 | §11 | The empty-conversation invitation path is ephemeral, carries no state authority, and does not create a job, transcript event, memory, or StateFrame proposal. | check the live deployment record and source response envelope | live 9B invitation is presentation-only and explicitly non-authoritative | live audit |
| A40 | §12 | Remote MCP discovery exposes only exact operator-allowlisted tools, imports no remote prompts/resources, and treats descriptions/results as untrusted data; capability-radar discovery enables no tools. | inspect MCP discovery and advisory capability-radar contracts | allowlist-only MCP and advisory-only capability discovery are present | source inspected |
| A41 | §12 | Read, coding, and critical-reasoning specialists return bounded advisory material; they cannot directly edit, run tools, grant permission, or own the final response. | inspect specialist prompts, tool schemas, and call budgets | specialist calls are bounded, advisory, and outside execution authority | source inspected |
| A42 | §12 | Current web evidence is permission-gated, treated as untrusted, restricted to safe public destinations and same-job source handles, and bounded to two materially distinct failed attempts. | inspect web-evidence adapters and runner retry containment | web evidence has provenance, destination, permission, and retry boundaries | source inspected |
| A43 | §12 | Attachments, vision, and generated images are bounded and validated; visual text is untrusted data and generated media enters the immutable artifact path only after validation. | inspect attachment, vision, and image-generation validation paths | bounded upload, visual-observation, and generated-artifact paths are present | source inspected |
| A44 | §13 | Autonomous outreach requires a provenance-bound human exchange and prevents delivery, silence, dismissal, composition, or Kairo's sent message from feeding another outreach. | inspect the outreach evidence and anti-feedback contract | outreach has provenance, cadence, delivery, and anti-feedback separation | source inspected |
| A45 | §13 | Intimacy invitation eligibility, consent level, reply transition, cooldown, expiry, and revocation are deterministic controls outside model generation. | inspect the consent state-machine contract and output validators | consent and transition rules remain outside generation | source inspected |
| A46 | §13 | Action gravity is observe-only, each tool batch admits at most one mutation, and code-owned doctrine requires joint approval rather than ordinary generation. | inspect action-governance and doctrine contracts | gravity, atomic mutation, and joint-doctrine boundaries are present | source inspected |
| A47 | §14 | Repeated, empty, malformed, oversized, unavailable, or contract-breaking model paths receive bounded recovery and terminate honestly when the recovery budget is exhausted. | inspect engine failure classification, clean recovery, and terminal responses | finite recovery classes and honest bounded terminal responses are defined | source inspected |
| A48 | §14 | Optional telemetry exports lifecycle metadata, hashes, sizes, timings, routes, and scores without exporting prompt text, tool arguments/results, or credentials. | inspect the trace payload and exporter failure boundary | trace payload uses bounded metadata rather than raw private content | source inspected |
| A49 | §14 | Interrupted durable jobs are recovered within attempt budgets from persisted checkpoints, and deterministic replay evaluation records lifecycle and evidence checks without rewriting the conversation. | inspect runner recovery/checkpoint calls and replay-evaluation contract | restart recovery, checkpoints, and non-mutating replay evaluation are present | source inspected |
| A50 | §15 | Weight learning is offline and lineage-gated: authoritative 35B events, derived 9B data, and specialist outputs have distinct eligibility, with evaluation, sealing, promotion, and rollback before deployment. | inspect continual-learning role and promotion contracts | offline authority-separated learning and reversible promotion are documented | source inspected |
| A51 | §15 | The frontier-mentor path permits external critique of synthetic/public cases while requiring the accepted Kairo 35B to author the repair; raw mentor prose is never a training target. | inspect frontier mentor authorship and privacy boundaries | mentor critique is separated from Kairo authorship and private data | source inspected |
| A52 | §16 | Workspace tools and attachments use bounded regular-file reads and reject unsafe path/content forms; these controls do not claim that a workspace is a complete operating-system sandbox. | inspect workspace confinement, attachment bounds, and the explicit sandbox limitation | path confinement, bounded attachment reads, and residual sandbox limitation are explicit | source inspected |
| A53 | §16 | The optional private MCP server exposes a narrow authenticated platform surface and omits memory administration, shell, permission grants, and artifact contents. | inspect the private MCP tool catalog and response limits | private MCP offers job/capability/replay metadata without administrative authority | source inspected |
| A54 | §15 | The direct-CLI workbench keeps local jobs, history, repository maps, arena comparisons, and recoverable repository snapshots outside server-side autobiographical authority. | inspect the local workbench modules and direct-CLI boundary | local workbench jobs/history/maps/arena/snapshots and direct engine boundary are present | source inspected |
| A55 | §03 | The dated live inventory assigns Qwen3.6-35B-A3B v22 Q6_K to foreground, trained Qwen3.5 9B Q4_K_M with an official 1B Qwen DFlash drafter to control/recovery, Nomic 137M Q4 to embeddings, Kimi-K2.7-Code to advisory coding, and Qwen3.6-35B-A3B-FP8 to vision. | match the public model-role table to the non-sensitive names in the live audit and grounding record | exact live model names and role assignments match the report; locations are omitted | live audit |
| A56 | §11 | The dated live voice path uses Whisper for speech recognition, XTTS-v2 as primary synthesis, and Kokoro as an independent synthesis fallback. | match the named speech roles to the live media audit without publishing connection details | Whisper, XTTS-v2, and Kokoro roles match the dated live audit | live audit |
The public report intentionally describes logical roles rather than operational addressing. That is enough to explain why Kairo behaves as it does without turning an architecture document into an infrastructure disclosure.