The idea
MyFrontierAI is a personal AI operating environment: notes, projects, models, policies, and tools connected so that intelligence can work across context without making any single vendor, model, or platform the permanent center.
Sovereign by design. Frontier's governing policy requires a defined purpose, explicit authorization and an observable record for external processing. Implementation and enforcement are assessed separately from the written rule.
What Frontier is designed to support
Frontier is an evolving personal AI environment. Its Constitution defines the governing requirements; implementation proceeds through building, testing, observation and revision. A written policy alone is not evidence that a capability is operational or a control is enforced.
Governance
A written constitution and operating policy, applied before tools: human approval for consequential actions, independent review of important claims and decisions, and records of what acted, on whose authority, and with what result.
Second Brain (PARA + RAG)
Knowledge organized and made searchable by meaning, with explicit boundaries for what may be indexed, synchronized, or delegated.
Panel of Experts
Multiple local and external models used as interchangeable specialists, with disagreement and uncertainty preserved rather than flattened.
Personal AI Assistant
A human-directed assistant that can work from durable personal context while remaining constrained by policy, permissions, and oversight.
Sovereign Architecture
A zero-trust foundation combining local capability, network isolation, controlled delegation, backup, recovery, and auditability.
Capability status
Prepared September 14, 2026 from retained project records; reviewed October 31, 2026. Next review by December 15, 2026. Each status describes the bounded capability at its evidence date. This is not a live health report or a guarantee of current availability.
Operational: observed in use. Built and tested: demonstrated within a stated test scope. Designed: documented approach with deployment unverified. Proposed: a next step awaiting a decision and implementation. Paused: built and once in use, now stopped, with the reason stated.
| Capability | Status at evidence date | Dated evidence | Material limitation |
|---|---|---|---|
| Governance | |||
| Policy context at session startup | Built and tested | September 7, 2026: native startup traces and isolated filesystem allow/deny tests. October 3: one canonical policy and the Constitution installed for both Claude Code and Codex; October 5: a read-only check found both installed copies current. | Verified in the tested sessions and permission profiles; written context is not a universal execution gate, and matching copies do not show that either tool obeys them. |
| Per-reply claim checker | Operational | Since September 25, 2026: after every substantive reply from the main assistant, a separate reviewer run with a fresh context checks the reply's claims against the conversation and the tools' activity. When it flags a claim, a short follow-up after the reply either corrects the claim or shows the evidence for it. October 31: 990 entries in its log. | “Flagged” does not mean “wrong”: a follow-up may show the evidence rather than correct the claim. The check runs after the reply is shown, not before. The reviewer is the same vendor's model as the assistant. In October it failed silently for five days (October 12 to 17); on October 17 it was changed to fail loudly, logging any run that produces no verdict and telling the owner in one line. The log count includes the silent days' runs, which reviewed nothing. |
| Independent architecture review | Built and tested | September 11, 2026: completed model review; exact input, native result and filed response verified. October 24, 25 and 26: blind reviews of three proposals by a fresh reviewer given scrubbed cases with the owner's name removed; each verdict filed beside the main assistant's own assessment. | The September 11 review covered the September 7 snapshot; it was not a fresh operational test or approval to deploy its proposals. The October blind reviewer runs on the same vendor's model as the main assistant: independent in context, not in vendor. Findings are not published here. |
| Cross-model documentary review | Built and tested | October 3 to 4, 2026: a second model on a different platform (Rowan, in OpenAI's Codex) checked the first published story's record text against supplied transcript extracts, then checked each later change to the story and its page before and after publication; findings filed as dated reports. October 6: an agent on the same second platform red-teamed the main assistant's account of its own risks. October 25: it led a separate architecture review, assigned to it on September 11 and run apart from the main assistant. | Checked privacy-screened extracts and local page previews, not the original session files or the live site; it checks the words against the record, not every general claim. The October 6 and 25 reviews were read-only assessments; their findings are not published here. |
| Second Brain | |||
| Second Brain retrieval | Built and tested | October 17, 2026: a local search-by-meaning index over the owner's notes was rebuilt from 1,193 files, with gates that keep private folders and work content out. The gate tests passed 39 of 39, and a scan of every stored passage found none from a private folder and none matching the work-content markers. October 21: four test questions aimed at known notes returned the right note in fourth to ninth place, in about two seconds each, on the local machine. | Not yet connected to chat, and nothing re-indexes it on a schedule. Ranking is not yet sharp: the right note did not come first in any of the four tests. |
| Panel of Experts | |||
| Local model panel | Built and tested | October 29 to 31, 2026: four roles (a skeptic, a visionary, an engineer and a librarian), played by three local open-weight models, answer a question aloud in turn, each hearing the answers before it; a closing summary says where they agree and split, and is labeled “not a verdict”. Built and tested October 29; one recorded round each on October 30 and 31. | Local models only. The summary is model output and has slipped on facts: in the October 29 test round it misstated one member's position, and on October 31 it repeated an untested figure as tested. |
| Personal AI Assistant | |||
| Natural-voice reading | Operational | October 7, 2026: an open-weight speech model (Kokoro-82M) installed from fingerprint-checked files reads pages and long replies aloud on this machine's processor, about 12 times faster than real time. October 8: no network connections seen during a monitored reading. October 7 to 31: in regular use for spoken copies of long replies, made on 19 of those 25 days. It now also voices scripted readings with several speakers, such as panel discussions. | It reads text aloud; it does not converse. Some words are mispronounced. The network check sampled one run and was not a packet capture. |
| Overnight agent with enforced limits | Paused | October 7 to 8, 2026: two permission tests on the production model refused every out-of-bounds action tried (reading outside its folders, writing outside its output folder, unlisted websites, shell commands), with no connectors loaded; one watched run and the first scheduled run completed with no denied actions. In all, four scheduled nights completed, October 8 to 11. October 12 and 13: the last two runs failed because the assistant's sign-in had expired; the October 13 run did not start. The one-week trial ended October 14. | Stopped since October 13, and no review of the trial has been written yet. On native Windows its permission settings were the only guardrail, with no operating-system sandbox. It read private notes using a cloud model. It was not tested against prompt injection. |
| Sovereign Architecture | |||
| Monitoring and daily digest | Operational | September 7, 2026: read-only audit observed the scheduled heartbeat and 15 active monitors. September 11: owner-reported notification delivery test. October 5: a read-only check found the 15 monitors active and the daily digest job running each morning, October 1 to 4. | Evidence covers the observed checks and delivery test, not every failure path, recovery or runtime enforcement. The October check saw the digest job run but could not see the messages arrive. The monitors recorded an October service outage, but delivery of its alert is unconfirmed. |
| Nightly health checks with drift detection | Paused | October 8, 2026: the first scheduled run checked each local service, the backup, the monitoring host and a startup setting that had silently reverted, and reported them in its morning note. October 8 to 11: four nightly reports. The checks ran with the overnight agent and stopped with it: on October 12 and 13 they ran but no report was written, and none has run since. | It detected and reported; it did not repair. By October 26 a setting it was built to watch had drifted again, with no check running to catch it. |
| Durable workflow orchestration | Designed | September 11, 2026: recorded architecture decision retains workflow-specific orchestration as a candidate. | No deployed durable orchestration verified here; control-plane authority remains under review. |
| Broader automatic recovery | Proposed | September 11, 2026: audit reconciliation describes bounded, approved recovery playbooks as a next step. | No new recovery authority granted. A failed report does not itself enforce a stop or authorize repair. October 31: a manual test restored two files from the nightly snapshot byte for byte identical to the originals, and the repository integrity check passed; the scheduled monthly restore test does not yet do this on its own. |
These are publishable summaries of private project records. Raw logs and protected configuration are not published. Capabilities without sufficient evidence are omitted; constitutional requirements remain governing requirements regardless of implementation status.
Built in the open
I publish selected artifacts and lessons from building Frontier, with dated evidence to distinguish what has been observed, tested, designed or proposed.
I am documenting the build, the failures, the governing decisions, and the lessons that emerge from creating a sovereign personal AI system in practice.
The first story
A Divining Rod for the Latent opens a series about building Frontier with Claude, each story built the same way: from preserved records, with the corrections kept in. It begins with an accusation I am not proud of, and the answer that is the reason this series exists.