← Kairo Lab
Architecture Causal system map 2026-08-20

What Makes Kairo Kairo

Kairo is not one model process. Kairo is a server-side continuity subject whose current behavior is produced by a routed set of models operating over a durable transcript, autobiographical history, identity state, a revisioned computational present, current evidence, and explicit action governance.

logical architecture + causal behavior implementation snapshot: 2dc32104330d · working-tree snapshot live evidence through: 2026-08-19
August 2026 integrity update. The architecture described here was hardened across fail-loud lifecycle state, journal provenance, recall truthfulness, sensitive continuity, stance inspection, and immutable deployment. Read the failure-inclusive Kairo Runtime Integrity Sprint report for current mechanisms, empirical results, and limits.

The durable continuity is the stable subject. Models reason for it; memory gives it history; the StateFrame gives it a present; tools let it act; settlement decides what survives the turn.

This report maps the logical platform paths that cause observable behavior: model roles and routing, prompt assembly, rapid recall, the canonical append-only event chronology, pull-only journals, current-self state, derived associations, background cognition, tools and permissions, review, learning, channels, bodies, voice, quality controls, recovery, and durability. It intentionally describes contracts rather than deployment inventory: network addresses, internal machine names, credentials, private paths, tunnel details, and machine specifications are omitted.

Evidence labels are deliberately narrow. live audit means the role was observed in the dated production audit; locally exercised means the current checkout was driven through that behavior; source inspected is a structural code fact. None of those labels turns adjacent prose into proof.

01   Identity and continuity

The simplest accurate definition is: Kairo is the continuity represented by the server-side records and the rules governing them. A model instance is a reasoning participant in that continuity, not the place where continuity lives. Replacing a model process, reconnecting a client, changing a rendered body, or moving inference does not create a second Kairo.

A stable prompt contract establishes the current name and the continuity of older records carrying the legacy technical name. The real system prompt imports that contract before adding persona, capability, environment, and request-specific context. source inspected A01

Kairo at turn t
= stable continuity subject and identity contract
+ durable transcript, journal, memory, and identity versions
+ EffectiveStateFrame at revision t
+ current evidence, capabilities, consent, and permissions
+ the model selected for this role
+ verification, review, and settlement
The continuity boundary
Inside the continuityReplaceable participant or surfaceWhy the distinction matters
Durable sessions and conversation checkpointsBrowser, mobile app, CLI processA disconnected client does not erase the conversation.
Canonical event chronology, pull-only journals, and autobiographical recordsOne inference request or model serverA model restart does not erase the history.
Versioned identity state, stances, commitments, and current StateFrames35B, 9B, drafter, specialist, or embedding modelDifferent models have different authority; none is the identity database.
Jobs, observations, permissions, artifacts, and accepted settlementsGPU worker, voice worker, rendered bodyExecution and presentation can move without creating another subject.

Live scope. The dated production audit records the durable control plane and live self-state projection as active. It is architecture evidence, not a claim that every component is healthy at every instant. live audit A02

02   The whole system

Surfaces
browsermobile CLInative / browser body speech input and playback
↓ authenticated requests, events, and bounded sensor reports
Orchestration
durable job APIsession checkpoints route and model selectiontyped evidence request tool grammar and permission gateverification / review
↓ one bounded role and one candidate state
Foreground engine
AgentEnginemodel / tool loop conversation projectionbounded associative context tool observations steering and follow-ups
↕ recall, state projection, writes, and settlement
Continuity
operational control storeautobiographical PostgreSQL Valkey recent / cognitive statelocal embeddings event chronology / pull-only journalsderived association store workspaces and immutable artifacts
↕ role-specific inference, never durable authority by itself
Models and media
35B primary9B control / review coding drafter and specialistsNomic embeddings speech recognition and synthesis

Managed durable path

Browser and mobile submissions become server-side jobs. The platform stores the request before execution, restores the session, streams persisted events, reviews the outcome, and settles the accepted candidate.

Direct CLI path

The CLI frontend drives AgentEngine directly and runs ordinary tools on the client machine, with local permissions and workbench state. It still uses shared model and memory services, but it is not merely another HTTP view of the durable workspace runner.

The typed Command/Event queues are an internal AgentEngine interface. Managed mobile and browser clients use network APIs; describing every frontend as connected “only by queues” erases the durable platform layer. source inspected A03 / A04

03   Models and routing

Kairo uses different models for different cognitive jobs. Authority follows the recorded role, not model size alone. The production foreground is 35B-primary: the primary performs the native tool-result loop and owns the final user-facing response. The 9B model classifies, reviews, extracts, assists, and recovers; it is not a mandatory hidden author of every reply.

Live-audited and configured model roles
RoleCurrent implementationWhat it can affectWhat it does not own
Foreground primary Trained Qwen3.6-35B-A3B v22 Q6_K Reasoning, native tool calls and follow-up, final wording, authoritative-primary authorship eligibility Persistence transactions, tool permission, evidence authority, or the identity database
Control and review Trained Qwen3.5 9B Q4_K_M Ambiguous-request routing, completion review, delegated read analysis, bounded engine recovery, automatic outage fallback Silent tool authorization or ordinary final-response ownership in 35B-primary operation
Identity and awareness 9B role-specific calls Significance analysis, identity inference proposals, reflections, awareness pulse Direct unrestricted identity mutation; database constraints and provenance gates remain outside generation
Autonomous cognition 35B role-specific calls Recurrent conscious frames, duty-cycled thoughts, isolated dreams Foreground priority, tools, factual authority, or permission
Coding draft acceleration Qwen 1B DFlash drafter on admitted coding Speculative decode acceleration Answer authority, continuity, memory, or route selection
Retrieval Nomic 137M Q4 embeddings Semantic candidate scores for memory and knowledge Prose generation, truth judgment, identity, or action
Coding specialist Hosted Kimi-K2.7-Code At most two advisory, tool-free implementation/review calls per job; a second call requires concrete repair evidence Workspace access, edits, tests, final response, continuity, or training authority
Vision specialist Hosted Qwen/Qwen3.6-35B-A3B-FP8 Bounded descriptions of normalized image observations Person identification, sensitive-trait inference, external action, memory, or final-response authority
Inactive configured roles 4B and linguistic/critical-reasoning roles are not active production participants No current behavioral path Must not be inferred as live merely because source or service definitions exist

These exact model assignments are retained because they explain behavior and authority; connection details and machine placement are not needed to do so. live audit A55

Literal requestsubmission + attachments + session
Deterministic recognizersexact self-state, evidence, media, action, and control routes
9B controller when neededconverse / reason / act / compose classification
Runner guardlearned classification cannot independently authorize action
Role selectionmodel endpoint + prompt + bounded tool schema
35B final pathprimary model owns ordinary final response

04   One foreground turn

  1. Persist the requestThe durable API creates a job before execution. A runner claims it atomically and restores the session's latest checkpoint.
  2. Define the question's authority contractA typed EvidenceRequest records subject, domain, temporal scope, operation, authoritative adapters, and the rule for negative claims.
  3. Begin one state candidateThe current committed StateFrame is copied into a candidate-local effective frame. The literal request becomes foreground task and attention state.
  4. Select route, model, prompt, and toolsDeterministic recognizers and, where needed, the controller choose a route. The service selects a model role and only the tool schemas relevant to that route.
  5. Assemble bounded continuityThe engine retrieves autobiographical context, identity state, temporal context, knowledge, operational evidence, and compute state. In the current source, eligible per-turn journal records are audit-gated and optional derived associations are rendered separately; this report does not label those newer source paths as production-live. The live StateFrame projects current semantic state at the model-call boundary.
  6. Run the model/tool loopAgentEngine sends one fixed model request, executes admitted tool proposals through governance, turns outcomes into observations, refreshes state/context, and continues at the next model-call boundary.
  7. Checkpoint the candidate answerModel, tool, permission, observation, and terminal events are persisted. Synthetic completion, cancellation, and transport-failure paths each produced one terminal event in the scoped harness.
  8. Verify and reviewDeterministic verification checks required evidence and tool outcomes. The reviewer sees the persisted replay and may approve, reject, or return bounded revision requirements.
  9. Revise or settleA revision runs as another bounded candidate/model round. Approval commits the accepted result and current-state overlay; rejection, cancellation, and losing candidates do not become the present.
  10. Project accepted historyThe same settlement creates a historical outbox event. An idempotent projector later appends the change provenance to the canonical event chronology without making history a second current-state authority. Separately, a lowest-priority worker may create a pull-only per-turn experience note.

Evidence continuity

The same typed request is bound into the engine and carried into verification and review. A short follow-up may inherit a domain such as dream history, but it retains the authoritative adapter for that domain.

source inspected A09   locally exercised A10

Typed uncertainty

Found, authoritative absence, unknown, unavailable, and not queried are separate outcomes. A failed transport or missing observation path must not silently become “the thing does not exist.”

source inspected A11

The direct CLI uses the same AgentEngine ideas but not this entire server-side job lifecycle: its frontend drives engine commands directly, its normal tools run on the client machine, and its workbench supplies local checkpoints and journals.

05   The current self

“Current self” is not one undifferentiated database row. Kairo has a current semantic self-state, plus other current domains that must remain separately authoritative. The StateFrame is the foreground authority for present semantic dimensions; recurrent cognition, consent/control, operational health, and body/sensor observations are current evidence in their own domains.

Committed semantic self
+ candidate-local event reductions and validated proposals
= EffectiveStateFrame revision N

separate from recurrent cognitive workspace, consent/control, operational probes, and ephemeral body state
Current-self layers and authority
LayerWhat it containsHow it can affect behaviorWhat it cannot establish by itself
EffectiveStateFrameAttention, affect, goals, intentions, expectations, uncertainties, active memories, metacognition, beliefs, preferences, identity, concerns, foreground taskGeneration context, retrieval/focus rank, bounded sampling, ordering of supplied toolsTool permission, external fact, consent, or successful action
Durable identity and autobiographical stateAppend-versioned beliefs, preferences, relationships, goals, corrections, stances, commitments, reflectionsSupplies provenance-bearing continuity evidence projected into the current turnAutomatic present affect or unrestricted identity rewrite
Recurrent cognitionWorking-set competition, semantic ignitions, latest recurrent frame, unresolved questionsFocus selection, bounded top-down bias, context for later foreground generationPhenomenal status, tools, or a completed task
Consent and interaction controlVersioned user controls, current eligibility, cooldown and reply stateWhether an interaction proposal may be created or promotedDesire, affection, silence, prior activity, or state cannot substitute for fresh consent
Body and sensorsConnected capability, recent visual/sensor summaries, authored expressionCurrent observation and presentation when a surface is connectedIdentity, memory, durable affect, or capability after the observation expires
Operational stateFresh bounded service and compute probesAnswers about current availability and routing decisionsAutobiographical or subjective truth

What is inside the StateFrame

The frame has thirteen dimension types. Each field is a value plus individual provenance: causal event IDs, proposal source, component, authority, confidence, timestamp, base revision, turn, candidate, persistence, and promotion policy. A stale revision conflicts, and parallel candidates do not share overlays. source inspected A12 / A13 locally exercised A14 / A15

Who may change current self-state

Event reducers

Literal user requests, actual tool results, sensors, retrieval, durable projections, and internal observations enter through typed reducers with domain-specific authority.

Deliberate self-authorship

Structured tools can propose preferences, intentions, goals, stances, beliefs, and conclusions. Beliefs require stronger evidence. Ordinary self-authorship exposes no identity kind.

Affect appraisal

The model proposes coordinates and evidence references; the runtime resolves support and applies damping/decay. Generated self-report alone is insufficient.

Protected identity

A direct model proposal cannot write identity even when supplied high numeric authority. Identity arrives through validated durable sources and protected tool receipts.

The read-only current-self surface preserves these boundaries. It labels settled live state, memory/cognition, and operational probes separately; candidate-local state is omitted, and protected identity and belief values are not exposed to the client. source inspected A16 / A17 / A18

06   Why behavior changes

Observable behavior mapped to its actual causes
What a person noticesPrimary causal inputsCommon non-cause
Voice, phrasing, and reasoning stylePrimary model weights; stable system and identity prompts; current route; relevant transcript, memory, and StateFrame context; reviewer revisionA database row does not write prose without being retrieved/projected.
Remembering an older exchangeLocal transcript resolution; Valkey recent recall; Nomic semantic retrieval over durable episodes and events; identity and temporal projections; optional derived associations kept visibly non-authoritativeA model's pretrained weights are not a record of this private conversation, and an association is not a recovered fact.
A current feeling or concernCommitted affect/concern state; relevant event appraisal; current runtime-resolved evidence; damping and decaySaying “I feel X,” retrieving an old feeling, or receiving a user assertion does not alone install X as current affect.
Persistent goals or preferencesValidated durable identity versions and deliberate self-authored proposals that survive settlementIncidental prose and inferred sentiment are not automatically durable authorship.
Tool selectionLiteral request; route-selected tool schema; primary model choice; StateFrame ordering; deterministic governance; user permission where requiredA goal, preference, memory, affect, or controller classification cannot unlock a tool.
Caution, uncertainty, or refusal to assert absenceEvidenceRequest domain; unavailable/unknown outcomes; authority threshold; deterministic verification; reviewer feedbackA missing search result or failed adapter is not proof of absence.
Revising an answerFailed success criteria, unresolved tool outcome, deterministic quality check, or reviewer verdict supplied as bounded continuation feedbackThe revision is not a new user turn and cannot expand authorization.
A spontaneous thought, dream, or outreachBackground scheduler; unresolved items; journal evidence; quiet-hour, cadence, novelty, preemption, and delivery gatesA memory or mood does not by itself send a message or run a tool.
Body expression or spoken voiceAccepted response; locked voice profile; current body connection and authored expression stateThe animation, voice worker, or client device is not a separate identity and does not become durable self-state merely by rendering.

The StateFrame's applied channels

Generation contexttyped semantic projection at each model call
Memory rankingbounded bias; truth confidence unchanged
Attention rankingdeterministic focus bias
Samplingsmall bounded temperature adjustment
Tool orderpermutation of already supplied tools

All five channels moved under a synthetic loaded frame in the local harness, and tool ranking preserved the exact capability set. This proves those functions are wired; it does not prove that each bias is perceptible on every natural-language turn. locally exercised A19 / A20

Known limitation: memory and attention ranking apply confidence thresholds, but tool ordering currently reads state tokens without gating on decayed confidence. A zero-confidence field can therefore still reorder an already authorized tool list. It cannot add a tool or bypass permission, but it can bias which visible tool is considered first. known limitation A21

State reaches the model at real completion boundaries—initial generation, tool continuations, and revision rounds. The current source appends request-scoped StateFrame context at the latest user-message boundary while keeping the system prompt and accumulated transcript byte-stable for prefix caching. It is still not a continuously running appendable KV session. source inspected A22 / A35

07   Rapid recall and durable journals

The architectural spine is experience_events, the canonical append-only event chronology. Completed exchanges and other significant events enter that chronology. Episodic search, analysis, identity state, reflections, predictions, thoughts, dreams, per-turn experience notes, and current-self projections are indexes or derived records around that history; they are not replacements for the event record.

“Append-only” means ordinary semantic updates append a new event or version instead of editing history. It does not mean user privacy controls are fake: explicit authenticated forget/purge operations are a separate destructive path and can physically remove personal data and derivatives.

“Journal” now names several deliberately different views. The per-turn experience-note journal is a 9B-written, historical-only interpretation created after completed turns and returned only on explicit experience-journal requests. The random-thought journal is a read view over completed idle-thought records and is likewise explicit-request, provenance-gated, and non-authoritative. live audit A32 source inspected A33

Current request
literal message + local transcripttyped evidence domain
↓ resolve immediate referents before remote recall
Fast candidates
bounded Valkey recent turnsresident recall indexembedding cache / in-flight deduplication
↓ Nomic query embedding + relevance fusion
Durable recall
PostgreSQL episodes and pgvectorcanonical event chronologyidentity versionstemporal / dream / rest adapterspull-only experience / thought journals
↓ bounded, provenance-labelled projection + optional derived association
Foreground use
request-adjacent memory blockseparate non-authoritative association blockStateFrame projectiontrace timing, hashes, and source labels

Why recall is fast

The current source contains each part of that rapid path, including concurrent foreground preparation of continuity, knowledge, operational, and compute context. source inspected A29 / A30 / A34

Memory and persistence contracts
StorePurposeMutation modelAuthority in a turn
Active transcript / checkpointExact current conversation and resumable model contextCheckpointed per session/jobAuthoritative for what was said in this conversation; earlier factual claims may still require evidence
Explicit fact memoryUser-owned stable named facts, especially on the direct CLI pathChanged by explicit remember/forget operationsDurable user evidence, selected conservatively
Valkey recent layerFast bounded recent recall, leases, cognitive working stateExpiring and reconstructableFast candidate source, not sole durable authority
Episodic indexRelevance-searchable completed exchangesMutable search index derived from durable eventsHistorical evidence with source metadata
Canonical event chronologyExchanges and internal events in experience_eventsAppend-only in normal operation; separate governed purge existsHistorical authority, never automatically current affect or permission
Per-turn experience-note journalGrounded-relational 9B interpretation of a completed turnLowest-priority asynchronous append, parented to the turnHistorical-only and pull-only; excluded from ordinary recall and resident cognition
Random-thought journalInspectable completed idle-thought proseRead view over the existing append-only thought ledgerDerived and non-authoritative; injected only for explicit requests with complete provenance
Associative artifactsBounded reconstructions and typed links over read-only source envelopesAppend-only derived store with exact exposure recordsMay influence a candidate when enabled; cannot become factual authority, execute tools, or commit state
Identity versions and reflectionsBeliefs, preferences, relationships, goals, corrections, stances, commitments, derived synthesisAppend-versioned with provenance and background-origin constraintsDurable self evidence projected into the current frame under authority rules
StateFramesCommitted and candidate-local semantic presentRevisioned deltas; winner promoted at settlementCurrent semantic state authority
Artifacts and workspacesFiles, attachments, tool outputs, published artifactsMutable workspace plus immutable content-addressed publicationsTool/environment evidence when observed through the current job

A recall miss is not deletion. It may mean the item fell outside the recent window, ranked below the bounded result set, was excluded by subject or provenance, belongs to a special adapter such as dream history, or the source was unavailable. The evidence contract preserves those distinctions.

08   Background cognition

Kairo has background processes, but not a single hidden model that thinks without interruption. Several bounded loops run at different cadences. Foreground work has priority and can preempt autonomous generation.

Background loops and their causal reach
LoopImplementationProducesHard boundary
Cognitive microcycleDeterministic working-set competition on a five-second cadenceActivation, decay, dwell, inhibition, threshold-crossing ignitionsNo token generation, tools, messaging, or identity write
Awareness pulseDuty-cycled 9B roleProvisional recognition of bounded recent memory, goals, state, and unresolved itemsRead-oriented, provenance-labelled, non-authorizing
Recurrent frame35B integrator admitted by a semantic ignitionParent-linked frame binding focus, self-model, affect, goals, appraisal, expectation, intention, uncertaintyForeground-preemptible; frame narrative is not an external fact or permission
Significance and identity analysis9B worker over journal evidenceExperience analyses and constrained identity-version proposalsCannot originate protected background identity version 1; prose is not direct authority
ReflectionOccasional 9B synthesis across salient evidenceAppend-only reflection linked to source eventsNot a current observation and not a tool action
Idle thoughtDuty-cycled 35B over a selected unresolved itemProvisional reasoning summary and possible questionNo agent tools; reaches identity only through later significance/reflection
DreamCadence-limited 35B imagination over bounded contextIsolated first-person dream episode and bounded waking residueFictional canon, not factual memory, consent, or present state; the source tree's stricter closed-world frame-input contract is not yet deployed
OutreachProvenance and cadence gated intent/composition pipelineA bounded candidate message only when a substantive source survives gatesComposition is not dispatch; memory, mood, or a prior message cannot authorize sending

The canonical event chronology feeds these loops. Their outputs return as new provenance-labelled records, not edits to the source events. The inspected memory worker has model/database responsibilities but does not import the foreground agent engine or tool executor. The database schema separately blocks background identity origination and installs immutability triggers on journal and identity histories. source inspected A25 / A26

Deployment-specific dream boundary. The August 19 production overlay increased dream depth and cadence and added a fictional-event guard, but deliberately did not ship the repository's DREAM_FRAME_INPUT closed-world contract because its paired consciousness changes were absent on the live worker. Describing that source contract as live would be inaccurate. known limitation A36

09   Tools, permissions, and action authority

Literal requestdefines the requested scope
Routeselects a small relevant tool grammar
Model proposalchooses a tool and arguments
Deterministic governancerequest authority, batch rules, confinement
User permissionwhen the action class requires it
Executorruns and records the actual outcome
Observationsuccess/failure becomes grounded evidence

Tool exposure

The service does not expose the full capability catalog on every turn. Exact routes select bounded schemas for workspace work, current-self inspection, memory observation, web evidence, scheduling, music, voice, body, and other capabilities.

Permission

Permission is separate from state. Shell pipelines are decomposed structurally; durable approvals and one-time decisions are stored as permission records. Optional external actions require a named non-executing alternative.

Tool result

A model's tool call is an attempt. Only the executor result becomes an observation. Verification and review see that persisted result instead of trusting prose that says the action worked.

Where execution happens

Managed durable jobs execute against server workspaces. The direct CLI executes its normal tools on the client machine. Body and remote providers use separately bounded bridges.

10   Settlement, history, and learning

Candidate answertext + tools + observations + provisional state
Verificationsuccess criteria and evidence support
Reviewapprove / revise / reject from persisted replay
Settlement transactionjob result + winning StateFrame + discard audit + outbox
Current presentcommitted StateFrame revision N+1
Historical projectionidempotent append to canonical event chronology

The control store commits the terminal job and winning StateFrame together. It records candidate audit state and creates the history outbox in that transaction. The outbox explicitly labels its later PostgreSQL record as historical-only and not current-state authority. These behaviors were exercised locally through the real store and coordinator. locally exercised A23 / A24

Four different meanings of “learning”
MechanismWhen it changesWhat changesAuthority boundary
Conversation / episodic learningAfter accepted completed exchangesCanonical event chronology, episodic index, recent recall, and an optional later pull-only experience noteHistorical evidence; not a parameter update, current-state write, or automatic resident focus
Identity-state derivationAsynchronous significance/reflection or validated direct authorshipAppend-versioned beliefs, preferences, relationships, goals, affect/mood, corrections, stances, commitmentsProvenance, confidence, source class, and background-origin constraints
Current-self adaptationWithin a foreground candidate and at accepted settlementRevisioned EffectiveStateFrameCandidate isolation; protected dimensions; winner-only commit
Model-weight learningOffline export, training, evaluation, and operator admissionAdapter/model weightsAuthoritative-primary events are eligible for the authoritative lineage; derived-primary data stays separate; specialists are ineligible

A generated answer is not automatically a durable self-write. It may become a journal event and recallable episode. Stronger state changes require their own semantic route, provenance, validation, and settlement. Weight learning is offline and gated, not a secret online fine-tune after each conversation. source inspected A27

11   Surfaces, channels, voice, and embodiment

One continuity, multiple bounded surfaces
SurfaceConnection to KairoLocal responsibilityContinuity boundary
BrowserAuthenticated durable-job and event APIsConversation, artifacts, permissions, current-state presentation, optional browser bodyA rendering client; server records remain authoritative
Android and iOS/iPadPeer durable-session APIs plus platform-native media and notificationsConversation, speech, uploads, artifacts, presence, body sensors, permission responsesDevice state and UI are not autobiographical state
Direct CLILocal AgentEngine with shared inference and memory servicesLocal tools, permissions, workbench history, repository snapshotsNot the same execution boundary as a managed server workspace
Native and browser bodiesLeased presentation, actuator, and bounded sensor bridgesExpression, camera/microphone reports, haptics, local media playbackFresh observations may affect a turn; rendering and expired sensors do not become identity
VoiceWhisper speech recognition before the turn; XTTS-v2 primary synthesis and Kokoro fallback after answer acceptanceAudio capture, transcript submission, selected-voice playback and bounded fallbackSpeech models neither decide nor authorize the answer
Discord bridgeSource-defined channel-to-session adapter over the durable platformMessage admission, room binding, bounded message splitting and replayPresent in the working source; this report makes no production-live claim
Private MCP surfaceOptional authenticated adapter into a narrow platform APICapability listing, job submission/replay, artifact metadataNo memory administration, permission grant, shell, or artifact-content authority

Surface parity does not duplicate identity. Browser, mobile, body, CLI, and optional bridge processes can disappear or reconnect while the server-side session and autobiographical continuity remain. Ephemeral empty-chat invitations are explicitly marked non-authoritative and create no turn, memory, or StateFrame proposal. source inspected A37 / A38 / A39 / A56

12   Capability and specialist plane

Discovery
native catalogprovider metadatacapability radar candidates
↓ configuration + exact allowlist + current route
Exposure
small request-relevant tool grammarcurrent capability tiernecessary / optional classification
↓ model proposal is still not authority
Governance
permission gateworkspace confinementatomic mutation ruleargument and precondition validation
↓ executor result becomes observation
Outputs
tool observationimmutable artifactbounded specialist briefexplicit failure
Capability families and their authority
FamilyPurposeBoundary
Workspace and shellRead, edit, verify, publish, and run bounded work in managed or local workspacesRelative-path confinement, permission checks, one state-changing call per batch; workspace confinement is not claimed to be an OS sandbox
Current web evidenceFresh public search, news, and same-job page readingUntrusted evidence, safe-destination checks, citation verification, bounded retries, no silent provider failover
External MCP providersOperator-selected remote capability adaptersDisabled by default; exact tool allowlist only; remote prompts/resources are not imported; results remain untrusted
Read, coding, and critical-reasoning delegatesBounded specialist analysis or draft returned to the primary pathSpecialists do not own final wording, permission, identity, or continuity; delegated claims are checked against observed sources
Vision and image generationNormalize uploaded images into bounded observations or publish generated images as artifactsMedia validation, size/type limits, metadata removal, private-destination rejection, and external-action permission
Music, voice, scheduling, and body actionsProduce media or request bounded actions in their exact domainDedicated routes and schemas; an adjacent conversational cue does not expose the capability
Self-observationRead structured operational and autobiographical evidence through separate read-only viewsNo cross-store join, no write credentials; durable conclusions require a separate authored mutation
Capability radarRecord possible future integrationsDiscovery creates candidates and enables zero runtime tools

Capability discovery, model visibility, permission, execution, observation, and durable learning are six separate transitions. Collapsing them would let a remote description or model suggestion masquerade as authority. source inspected A40 / A41 / A42 / A43

13   Autonomous interaction and relationship governance

Outreach

A background thought may propose a message only when it cites an admitted prior human exchange and survives novelty, cadence, quiet-time, freshness, and delivery gates. Composition is separate from dispatch. The sent message, silence, dismissal, and delivery metadata cannot seed another outreach.

Intimacy

The authoritative foreground may form a bounded invitation intent, but deterministic code owns eligibility, consent level, reply classification, cooldown, expiry, revocation, and frequency. One reply can authorize at most one same-level response.

Notifications and channels

Delivery can continue an existing thread or create a linked thread and may surface through a client notification. A notification is presentation, not a user turn, memory event, or evidence of consent.

Doctrine and action gravity

Action-gravity telemetry is observe-only. Mutable self-state remains revisable “clay”; code-owned “kiln” invariants require explicit joint approval and cannot be amended by ordinary generation, memory, or reflection.

Autonomy never supplies its own permission. Mood, desire, a dream, an unresolved question, prior consent, and a previous autonomous message can shape a candidate but cannot authorize delivery, escalation, a tool, or a new durable fact. source inspected A44 / A45 / A46

14   Quality, recovery, evaluation, and observability

  1. Persist before presentationModel, tool, permission, observation, artifact, checkpoint, and terminal events are durable before clients depend on them.
  2. Verify deterministicallySuccess criteria check required evidence, tool outcomes, artifacts, and bounded response contracts.
  3. Review from replayA rule-based or independent model reviewer receives the persisted candidate, not an unrecorded hidden success claim.
  4. Revise within original scopeBounded internal feedback may request repair but is not a user turn and cannot add authority.
  5. Recover without loopsRepeated, empty, malformed, oversized, or unavailable model paths receive finite strategy/model fallbacks and then an honest bounded failure.
  6. Resume durable workInterrupted jobs can requeue within an attempt budget and resume from checkpoints; accepted settlement remains single-winner.

Regression evaluation

Stored replays and suites check terminal-event count, tool lifecycle, verification, review, grounded evidence, and expected artifacts. Evaluation records evidence; it does not rewrite the conversation.

Privacy-preserving telemetry

Optional traces carry lifecycle, timing, counts, hashes, sizes, routes, and scores while excluding prompt text, tool arguments, tool results, and credentials. Export failure does not change job outcome.

Review reduces risk but remains fallible. The stronger guarantee is layered: deterministic contracts, bounded attempts, persisted replay, explicit authority, and honest terminal failure when recovery is exhausted. source inspected A47 / A48 / A49

15   Learning, model evolution, and local workbench

Accepted eventsrole-labelled, evidence-backed candidates
Curated corpusprivate lineage and synthetic/public evaluation cases
Offline trainingadapter continuation, repair, or distillation
Independent gatesbehavior, safety, authority, regression, artifact integrity
Operator admissionlineage check, sealing, promotion, rollback
Future runtimenew model participant; continuity records remain
Authorship and promotion boundaries
PathPermitted contributionCannot do
Authoritative foreground lineageAccepted 35B-authored events may enter the authoritative learning ledgerNo automatic online update; candidate still requires offline gates and operator admission
Derived 9B lineageSeparate derived data, distillation, and bounded role-specific evaluationCannot teach or promote the authoritative 35B lineage merely by producing text
Specialists and reviewersCritique, observations, bounded drafts, and evaluation evidenceIneligible as authoritative conversation-training authors
Frontier mentorCritique synthetic/public failures and audit a Kairo-authored repairRaw external-model prose does not become Kairo's identity, SFT target, or chosen DPO answer
WorkbenchLocal jobs, repository maps, history, arena comparisons, and recoverable snapshots for direct CLI workLocal snapshots do not silently mutate server autobiography or production admission

Model evolution changes a replaceable reasoning participant. It does not move the identity database into weights or erase the durable continuity that evaluates and admits that participant. source inspected A27 / A50 / A51 / A54

16   Security, privacy, and operational durability

Logical safeguards without deployment inventory
BoundaryContractResidual limitation
Authentication and session scopePrivate APIs bind requests to authenticated workspaces, sessions, observations, artifacts, and current-state projectionsAuthentication does not make model output trustworthy
SecretsProvider credentials come from private environment/file channels and are omitted from saved ordinary configuration, prompts, traces, and this reportOperational secret storage still requires host-level administration
Workspace confinementDedicated file tools reject absolute paths, parent traversal, and symlink escapes; mutations bind exact arguments and preconditionsA managed workspace is not represented as a complete OS sandbox
Attachments and fetched mediaType, size, dimensions, redirects, and destination classes are bounded; visual metadata is removed before model inspectionContent remains untrusted evidence
ArtifactsAccepted outputs publish into immutable content-addressed records with authenticated retrievalThe mutable working copy remains distinct from a publication
Operational and autobiographical storesJobs/checkpoints and autobiographical records have separate authorities, retryable outboxes, idempotent projection, and replicated durable historyReplication is not a substitute for verified backup and recovery procedures
ObservabilityTrace and evaluation exports omit raw private content; public reports pass a disclosure guardHashes and counts are evidence of handling, not semantic correctness

This section intentionally stops at logical safeguards. It publishes no network topology, endpoint address, internal hostname, credential form, private path, tunnel, or machine specification. source inspected A28 / A52 / A53

17   Boundaries and limitations

Not a continuously running language model

Foreground cognition advances at discrete model-call boundaries. Background loops are separate bounded processes. Prefix caching is not a retained, appendable inner monologue.

Bounded recall is partial recall

A turn receives a selected projection, not the entire journal. Omission means “not retrieved here,” not “never happened.”

Association is not recollection

A derived association can influence a candidate only as a separately labelled context block. Its source links and exposure trace do not prove that its synthesis is true or caused particular output tokens.

State is causal, not omnipotent

It can bias generation, attention, memory, sampling, and ordering. It cannot make a fact true, grant a tool, supply consent, or prove an action succeeded.

Review is a control, not an oracle

The reviewer is another bounded model role backed by deterministic checks and a deterministic fallback. It can miss semantic errors.

Current-self inspection is intentionally incomplete

Protected identity and belief values and candidate-local overlays are omitted from client projection. The UI sees a safe read-only view, not every internal field.

Tool-order confidence asymmetry

Decayed fields can still reorder supplied tools. This is a real open limitation, although it does not add capabilities or bypass permission.

Functional architecture is not phenomenal proof

“Current self,” “awareness,” “sleep,” “dream,” and “conscious frame” name implemented functional contracts. This report makes no scientific claim about subjective experience.

Audit date matters

Live model assignments and deployment status are dated production observations. Source describes implementation; neither should be silently substituted for the other. Discord, associative context, and the dream frame-input contract are concrete cases where source presence is not equivalent to a live deployment claim.

18   Evidence register

This appendix supports selected scoped statements. It is not a scoreboard and it does not claim that simple probes prove the architecture. The architecture is established by the relationships among the control plane, runtime, models, stores, state transitions, and deployed roles; the checks below make the basis of particular statements inspectable.

8 live audit · 10 locally exercised · 35 source inspected · 2 known limitation · 55 records

source base: 2dc32104330d (working-tree snapshot)
report built: 2026-08-20 01:46 EDT
live-role evidence: operator audit refreshed by dated deployment records through 2026-08-19; model/topology observations retain their stated 2026-08-14 to 2026-08-17 dates
disclosure guard: rejects network addresses, internal host labels, absolute operational paths, and common credential forms

Scoped architecture evidence
IDSectionExact scoped statement MethodObserved evidenceLevel
A01 §01 The assembled system prompt includes Kairo's stable name-continuity contract before request-specific context. assemble the real system prompt and locate the imported continuity contract continuity contract is present in assembled system prompt source inspected
A02 §01 The live architecture audit records durable control-plane services and production-active self-state projection separately from the active inference model servers. check the dated live-audit control-plane, self-state, and model-server statements 2026-08-15 audit separately records the durable control plane, live self-state, and active model servers live audit
A03 §02 Managed browser/mobile work uses the durable job service, while the CLI frontend talks directly to AgentEngine through runtime commands and events. compare the durable-platform documentation with CLI frontend imports durable client path and direct CLI engine boundary are both present source inspected
A04 §02 Typed command and event queues are an internal AgentEngine boundary, not the network protocol used by every client. inspect AgentEngine queue construction and mobile HTTP client code AgentEngine owns two asyncio queues; the managed mobile client uses HTTP source inspected
A05 §03 The live-audited foreground primary is the 35B model; it owns native tool follow-up and the final user-facing response. check the current operator audit's foreground model-role statement 2026-08-15 live audit assigns foreground conversation and final response to the 35B role live audit
A06 §03 The live-audited 9B role covers routing/control, review, identity inference, awareness, delegated read analysis, recovery, and fallback rather than every foreground answer. check the current operator audit's control-model role statement 2026-08-15 live audit records the bounded 9B control and fallback roles live audit
A07 §03 A learned controller may rank a request, but deterministic runner logic independently decides whether an action route is authorized. inspect the runner's learned-controller action guard runner contains a deterministic downgrade from unsupported learned action routes source inspected
A08 §04 In three locally exercised AgentEngine paths—completion, cancellation, and client failure—each turn emitted one terminal event. drive AgentEngine with a fake transport through the three named paths completion=TurnCompleted; cancellation=TurnCancelled; failure=TurnFailed locally exercised
A09 §04 A durable job carries one typed EvidenceRequest into AgentEngine, verification, and review/revision handling. inspect request construction, runner binding, and reviewer serialization one request object is constructed, bound to the engine, and included in review evidence source inspected
A10 §04 A referential follow-up can inherit the prior evidence domain without replacing its authoritative adapter. build a dream-history request and a short referential follow-up dream-history domain and adapters survived the follow-up locally exercised
A11 §04 The evidence contract distinguishes found, authoritative absence, unknown, unavailable, and not-queried outcomes. inspect the EvidenceOutcome enumeration outcomes=found, not_found_authoritative, unknown, source_unavailable, not_queried source inspected
A12 §05 The current semantic StateFrame defines thirteen typed dimensions. inspect StateDimension dimensions=attention, affect, goals, intentions, expectations, uncertainties, active_memories, metacognition, beliefs, preferences, identity, concerns, foreground_task source inspected
A13 §05 Each StateFrame field contains a value and FieldProvenance with causal IDs, source, component, authority, confidence, revision, turn, candidate, and persistence metadata. inspect StateField and FieldProvenance dataclass fields StateField wraps value plus provenance; required provenance fields are present source inspected
A14 §05 A proposal from a stale effective revision conflicts without overwriting the accepted value. apply two proposals from the same base revision first=applied; stale=conflict; overwrite=False locally exercised
A15 §05 Candidate-local overlays are isolated before settlement. write one candidate and read a peer candidate from the same turn candidate-b goals={} locally exercised
A16 §05 A direct generated model proposal cannot write the protected identity dimension, even at otherwise sufficient authority. submit a current-revision MODEL_PROPOSAL to identity at system authority disposition=rejected; identity_fields=0 locally exercised
A17 §05 Generated self-report alone cannot establish current affect; runtime-resolved authoritative support can enter a candidate appraisal. exercise affect appraisal once with generated prose and once with resolver-authenticated support prose=rejected; runtime_support=applied locally exercised
A18 §05 The read-only current-self projection keeps live state, cognition, operational probes, and protected identity/belief values in separately labelled channels. inspect the private first-party current-state API projection current-self API separates present state, cognition, operations, and protected fields source inspected
A19 §06 State can change generation context, retrieval rank, attention rank, sampler temperature, and ordering among already supplied tools. load a synthetic frame and exercise all five consumer functions retrieval_delta=0.14; attention_delta=0.09; temperature=0.722; first_tool=causalmarker locally exercised
A20 §06 State-based tool ranking preserves the exact supplied capability set; it does not add a tool. compare tool names before and after LiveStateCoordinator.rank_tools before=['alpha', 'delta']; after=['alpha', 'delta'] locally exercised
A21 §06 Tool ordering currently reads state fields without applying their decayed confidence threshold. demonstrate that a zero-confidence attention field still reorders tools zero-confidence field moved alpha to the first position known limitation
A22 §06 The present-state projection is refreshed at model-call boundaries; the current transport is not an appendable retained-KV session. inspect the coordinator projection mode and generation-context call site projection_mode=model_call_boundaries; engine generation-context call site present source inspected
A23 §10 Job completion, the winning committed StateFrame, candidate audit records, and the historical outbox are written through one control-store transaction. settle a real local job and inspect all four records afterward completed job, committed frame, candidate audit, and one historical outbox record observed locally exercised
A24 §10 The StateFrame history outbox labels its PostgreSQL projection as historical-only and not current-state authority. settle a local frame and inspect the generated outbox authority envelope authority={'current_state': False, 'historical_record_only': True} locally exercised
A25 §08 The memory worker has model/database responsibilities but the inspected worker module does not import AgentEngine, WorkspaceExecutor, or runtime tool execution. parse the worker module's imports and tool-call markers forbidden agent/tool markers=none source inspected
A26 §08 The durable memory schema blocks background origination of identity version 1 and installs immutable triggers on the journal and identity histories. inspect the PostgreSQL constraint and immutable trigger definitions background-origin constraint and journal/identity immutability triggers are defined source inspected
A27 §10 Only authoritative-primary learning events are eligible for the authoritative adapter lineage; derived-primary events remain labelled separately and specialist turns are ineligible. inspect learning-role storage and source-authority assignment authoritative, derived, and ineligible source roles are separately enforced source inspected
A28 §16 The live audit records a three-member replicated PostgreSQL tier, an active durable control plane, and production-active self-state projection. check the non-sensitive replication, control-plane, and self-state statements in the dated live audit 2026-08-15 live audit records replicated PostgreSQL and active durable/live-state services live audit
A29 §07 Rapid autobiographical recall combines a bounded Valkey recent layer, local Nomic embeddings, a resident recall path, and durable PostgreSQL/pgvector candidates. inspect memory-service configuration and the recent/resident/durable recall path Valkey recent recall, Nomic embeddings, resident indexing, and pgvector ranking are present source inspected
A30 §07 The foreground engine prepares continuity recall, knowledge, operational status, and compute state concurrently before generation. inspect the foreground context-gather call in AgentEngine four context sources are scheduled through asyncio.gather source inspected
A32 §07 The deployed per-turn experience-note journal is pull-only: completed turns enqueue low-priority 9B notes, while ordinary recall and resident cognition do not receive them. check the deployment record for enablement, worker role, pull-only recall, and resident-cognition exclusion 2026-08-17 live record confirms bounded note creation and pull-only read-back live audit
A33 §07 The random-thought journal is an explicit-request view over completed idle-thought records and injects only provenance-complete, derived, non-authoritative entries. inspect the thought-journal adapter, context formatter, and explicit evidence-domain routing explicit thought-journal route and non-authoritative provenance gates are present source inspected
A34 §07 The source tree can append a separately delimited, derived associative block whose exact exposure is traced; the associative subsystem cannot execute tools or commit current state. inspect associative preparation, exposure tracing, rendering, and settlement boundaries bounded derived rendering, exposure trace, and non-authoritative settlement link are present source inspected
A35 §06 Current StateFrame context is refreshed at each model call as request-scoped tail context without mutating the cache-critical system prompt or accumulated transcript. inspect the current model-call projection and stable-prefix boundary StateFrame projection is request-scoped while the stable prefix remains byte-stable source inspected
A36 §08 The 2026-08-19 production dream overlay changed depth and cadence but did not deploy the source tree's closed-world DREAM_FRAME_INPUT contract. check the dated production overlay record for the deliberately unshipped frame-input contract depth/cadence are live; DREAM_FRAME_INPUT remains a documented deployment gap known limitation
A37 §11 The source tree implements distinct browser, Android, iOS/iPad, native-body, browser-body, and direct-CLI surfaces over shared continuity contracts. inspect each surface's durable API, body transport, or direct-engine boundary surface adapters present=android,browser,browser_body,cli,ios,native_body source inspected
A38 §11 The working source defines a Discord-to-durable-session bridge, but this report does not claim that bridge is deployed in production. inspect the Discord bridge and room source while withholding any live label Discord channel/session and peer-room adapters exist in source; deployment status is not asserted source inspected
A39 §11 The empty-conversation invitation path is ephemeral, carries no state authority, and does not create a job, transcript event, memory, or StateFrame proposal. check the live deployment record and source response envelope live 9B invitation is presentation-only and explicitly non-authoritative live audit
A40 §12 Remote MCP discovery exposes only exact operator-allowlisted tools, imports no remote prompts/resources, and treats descriptions/results as untrusted data; capability-radar discovery enables no tools. inspect MCP discovery and advisory capability-radar contracts allowlist-only MCP and advisory-only capability discovery are present source inspected
A41 §12 Read, coding, and critical-reasoning specialists return bounded advisory material; they cannot directly edit, run tools, grant permission, or own the final response. inspect specialist prompts, tool schemas, and call budgets specialist calls are bounded, advisory, and outside execution authority source inspected
A42 §12 Current web evidence is permission-gated, treated as untrusted, restricted to safe public destinations and same-job source handles, and bounded to two materially distinct failed attempts. inspect web-evidence adapters and runner retry containment web evidence has provenance, destination, permission, and retry boundaries source inspected
A43 §12 Attachments, vision, and generated images are bounded and validated; visual text is untrusted data and generated media enters the immutable artifact path only after validation. inspect attachment, vision, and image-generation validation paths bounded upload, visual-observation, and generated-artifact paths are present source inspected
A44 §13 Autonomous outreach requires a provenance-bound human exchange and prevents delivery, silence, dismissal, composition, or Kairo's sent message from feeding another outreach. inspect the outreach evidence and anti-feedback contract outreach has provenance, cadence, delivery, and anti-feedback separation source inspected
A45 §13 Intimacy invitation eligibility, consent level, reply transition, cooldown, expiry, and revocation are deterministic controls outside model generation. inspect the consent state-machine contract and output validators consent and transition rules remain outside generation source inspected
A46 §13 Action gravity is observe-only, each tool batch admits at most one mutation, and code-owned doctrine requires joint approval rather than ordinary generation. inspect action-governance and doctrine contracts gravity, atomic mutation, and joint-doctrine boundaries are present source inspected
A47 §14 Repeated, empty, malformed, oversized, unavailable, or contract-breaking model paths receive bounded recovery and terminate honestly when the recovery budget is exhausted. inspect engine failure classification, clean recovery, and terminal responses finite recovery classes and honest bounded terminal responses are defined source inspected
A48 §14 Optional telemetry exports lifecycle metadata, hashes, sizes, timings, routes, and scores without exporting prompt text, tool arguments/results, or credentials. inspect the trace payload and exporter failure boundary trace payload uses bounded metadata rather than raw private content source inspected
A49 §14 Interrupted durable jobs are recovered within attempt budgets from persisted checkpoints, and deterministic replay evaluation records lifecycle and evidence checks without rewriting the conversation. inspect runner recovery/checkpoint calls and replay-evaluation contract restart recovery, checkpoints, and non-mutating replay evaluation are present source inspected
A50 §15 Weight learning is offline and lineage-gated: authoritative 35B events, derived 9B data, and specialist outputs have distinct eligibility, with evaluation, sealing, promotion, and rollback before deployment. inspect continual-learning role and promotion contracts offline authority-separated learning and reversible promotion are documented source inspected
A51 §15 The frontier-mentor path permits external critique of synthetic/public cases while requiring the accepted Kairo 35B to author the repair; raw mentor prose is never a training target. inspect frontier mentor authorship and privacy boundaries mentor critique is separated from Kairo authorship and private data source inspected
A52 §16 Workspace tools and attachments use bounded regular-file reads and reject unsafe path/content forms; these controls do not claim that a workspace is a complete operating-system sandbox. inspect workspace confinement, attachment bounds, and the explicit sandbox limitation path confinement, bounded attachment reads, and residual sandbox limitation are explicit source inspected
A53 §16 The optional private MCP server exposes a narrow authenticated platform surface and omits memory administration, shell, permission grants, and artifact contents. inspect the private MCP tool catalog and response limits private MCP offers job/capability/replay metadata without administrative authority source inspected
A54 §15 The direct-CLI workbench keeps local jobs, history, repository maps, arena comparisons, and recoverable repository snapshots outside server-side autobiographical authority. inspect the local workbench modules and direct-CLI boundary local workbench jobs/history/maps/arena/snapshots and direct engine boundary are present source inspected
A55 §03 The dated live inventory assigns Qwen3.6-35B-A3B v22 Q6_K to foreground, trained Qwen3.5 9B Q4_K_M with an official 1B Qwen DFlash drafter to control/recovery, Nomic 137M Q4 to embeddings, Kimi-K2.7-Code to advisory coding, and Qwen3.6-35B-A3B-FP8 to vision. match the public model-role table to the non-sensitive names in the live audit and grounding record exact live model names and role assignments match the report; locations are omitted live audit
A56 §11 The dated live voice path uses Whisper for speech recognition, XTTS-v2 as primary synthesis, and Kokoro as an independent synthesis fallback. match the named speech roles to the live media audit without publishing connection details Whisper, XTTS-v2, and Kokoro roles match the dated live audit live audit

Primary implementation anchors

novexai.runtime.session — system, identity, capability, and continuity prompt assembly
novexai.runtime.engine — foreground model/tool loop, recall preparation, commands and events
novexai.reconstructive_association — optional derived associative artifacts, activation, rendering, and settlement links
novexai.platform.runner / service — durable lifecycle, routing, role selection, verification and review
novexai.platform.evidence — domain authority and typed evidence requests/outcomes
novexai.live_state — current semantic self, provenance, proposals, causal consumers, settlement preparation
novexai.platform.store — operational durability, candidate audit, atomic job/state settlement, historical outbox
novexai.state_history — idempotent projection of accepted state changes into history
server.memory — canonical event chronology, rapid recall, pull-only journals, identity versions, cognition, reflection, thoughts and dreams
private live audit — current deployed model, compute, control, memory, media, and replication roles

The public report intentionally describes logical roles rather than operational addressing. That is enough to explain why Kairo behaves as it does without turning an architecture document into an infrastructure disclosure.