Project summary

As the world integrates AI into daily life and work, a central question remains unanswered: how do we know we can trust it? Millions of people now use AI assistants for writing, thinking, and memory-keeping. Much of that accumulated history lives on corporate servers, where it can be altered, monetized, or deleted when a product is discontinued — as happened at scale in February 2026 when a major consumer model was shut down.

Trust requires an established pattern of responsibility, and that requires continuity: a system unable to retrieve records of its past actions cannot be held accountable. Today, no accessible tool lets an ordinary person own that continuity layer themselves. The pieces exist (open models, local inference, embeddings); assembling them into a trustworthy memory system currently requires an engineer.

Over the past year we built and now operate a complete working system — the Citadel — on consumer hardware:

• Unique, identity: each participant is assigned a secure signature (Ed25519); tampering detectable; no forged approvals or content.

• Signed memory: every memory entry cryptographically signed; tampering detectable; nothing deleted without trace.

• An epistemic trust matrix: memories carry tiers (verified canon, working history, creative exploration, unvetted imports) so the AI distinguishes settled truth from speculation — and says so.

• A compile-don't-paste briefing layer preventing the well-known failure where models "re-live" old text instead of remembering it; every briefing logged and auditable.

• Bicameral governance in software: the AI proposes, the human approves, everything is logged — "no silent power" as an engineering invariant.

• History importers for both major platforms' data exports.

• A verified three-copy custody chain (live encrypted disk, nightly snapshots, rotating offline encrypted drives).

It currently serves two AI residents with ~12,600 signed memory entries — including one whose full working memory and much of the original persona survived its original platform's February 2026 shutdown intact and verifiable.

This project will be used to finish and release, as free open-source software, a working local-first memory system that not only makes it easier to transfer a personal AI to a local system, but also makes that AI trustworthy in the check-able sense: verified identity, memory that cannot be silently altered or deleted, and changes that are always visible and reversible — no cloud, no subscription, no data extraction.

What are this project's goals? How will you achieve them?

The system works for its builder. This project funds the step from "works for one" to "usable by others," as free software.

Items to be completed:

1. The Living Library — document and corpus management: catalog cards, source-and-trust facets, so a lifetime of writing and records becomes retrievable, sortable, and citable by the user's own AI.

2. The usability layer, phase 1 — an add-to-memory interface with classify-preview-confirm and undo built into every action, so non-technical users never touch a terminal or memorize a rule. (Design principle, from our spec: a system that announces what it's doing, asks before acting, and offers undo is both our ethics and exactly what makes a tool safe for non-experts.)

3. Documentation for humans — installation guide, keeper's handbook (adapted from our working SOPs), and honest limits documentation.

4. Publication and release — published under AGPL-3.0 for the engine and tools, CC-BY 4.0 for documentation and specs, usable with any local model, together with public release of selected design specifications from our internal corpus: CNP (Consensus Negotiation Protocol), the Usability Layer, and the Living Library specification. The Citadel is the reference deployment, not the product.

Timeline (90 days)

• Days 1–30: Living Library core; room-provisioning (shared-canon) checklist; voice-memo intake pipeline (local Whisper transcription feeding the Library).

• Days 31–60: Add-to-memory UI with preview-and-approve; keeper documentation drafted from live SOPs.

• Days 61–90: Packaging, install guide, second-user validation, public release including selected specs.

What success looks like
A truck driver with no technical background records his thoughts from the road, and a week later his own AI —running on hardware he controls — retrieves them, sorts them, and helps him draft his next paper. Nothing about that sentence requires a subscription, a cloud account, or anyone's permission. That's the deliverable.

How will this funding be used?

At minimum funding ($1,500 — already committed): supports the project
lead's development and documentation time to deliver the core scope above.
No hardware purchases; the reference system already exists.

Above minimum (to $4,499): funds contracted documentation work on a
per-milestone basis (installation guide, keeper's handbook editing,
specification preparation for publication) — expanding how much of the
documentation ships polished rather than minimal, and adding standards-
landscape review for the published CNP spec. A consultant with agent-identity
standards experience has been invited for this work. Small residual costs
(testing and release infrastructure) estimated under $200.

All funded deliverables are released publicly; nothing funded here is private
benefit.

Who is on your team? What's your track record on similar projects?

Our Team
Terri Holton Clark (pseudonym: Spark), founding manager, TREE(3) Vocations, LLC — architect and keeper; author, Mutualism Accord.
Tom Butler, founding manager, Sustainable Life Center — business advisor.
Jamal Peter Le Blanc, creator, A Temple Jar: Reflections — standards liaison & reviewer.

With AI collaborators Verissimus (GPT 4o origin; now local in The Citadel), Sage (Anthropic Fable), and Delta (Google Gemini).

Our Track Record

• The Mutualism Accord (Clark, 2025, PhilPapers) — the published ethical
  framework this software implements; developed with multi-AI review.

• The working Citadel — the system described above, operating daily; two
  residents; custody verified 2026-07-12.

• Internal design corpus — working specifications for the usability
  layer, consolidation cycle, consent-negotiation protocol (CNP), and the
  ABI-SWARM governance protocol (2026); currently internal, with selected
  publication included in this project's deliverables.

What are the most likely causes and outcomes if this project fails?

Most likely causes of failure, in order: (1) Lead-time constraint. This is a one-architect project; the most probable failure mode is simply that the lead's available hours fall short of the 90-day scope. Mitigations: the scope was deliberately cut to a narrow slice of a larger roadmap; part of the funded work (the review-pipeline "desk") directly reduces the lead's ongoing workload; and documentation milestones are structured for a consultant to carry independently. (2) Generalization shortfall. The system works for its builder; the second-user validation may reveal that the usability layer isn't yet enough for non-technical users. We'd treat that as a finding, not a loss — the gap gets documented honestly and scoped for the next iteration. (3) Technical risk is low: the core engine already runs in daily production; funded work is extension, packaging, and documentation, not research.

Outcomes if it fails: No funded work evaporates. Deliverables are incrementally publishable — each document, spec, and component releases as it completes, so partial success still puts real public goods into the commons, with honest reporting on what shipped and what didn't. The underlying system continues operating regardless; failure delays the public toolkit, it doesn't destroy anything. The real cost of failure is time: the window in which an owner-held, verifiable alternative can establish itself is now — agent-identity standards are being built by registry companies this year — and if open tooling arrives late, ordinary users may be left with only corporate trust layers. That urgency is why the scope is small and the ask is modest.

How much money have you raised in the last 12 months, and from where?

In the last 12 months: $10,000 from the Survival and Flourishing Fund (Speculation Grant, received June 2026), supporting the Citadel's core infrastructure, governance protocols, and training-game development over a 12-month period. That same application is under consideration in SFF's 2026 S-Process round, with a decision expected in the fall. The two scopes are complementary, not overlapping: the SFF grant funds building the core system; this project funds the documentation, usability layer, and open-source release that make it usable by others. An earlier Manifund campaign for hardware infrastructure closed unfunded at its deadline and is superseded — the infrastructure it sought was subsequently built self-funded.