What 07:41 looks like instead.
2 things need you.
✓ 2 handled on my own · 2 need you · 6 to catch up on
Same morning. Same ten things.
This page is the product: what was already handled, what needs a decision from you, and what you can read later — in that order, with the source of every line one click away. Everything after this slide exists to make this page safe to believe.
It decides what needs you and what doesn't.
Every line tells you what to do, or tells you that you don't have to.
The act zone
act zone — the accent edge is semantics, not decoration
The awareness zone
awareness zone — visibly recedes
Two things to notice. The instruction is what to do, in the words you would use — not SECURITY_ALERT, confidence 0.82. And it tells you not to click the links in the message. It won't hand you the attack surface, and it won't touch it itself.
Six lines in the awareness zone, five of them saying out loud that nothing is needed: “Nothing needed — I'll file it for you.” · “I'll file it where it belongs.” · “Just an update — no reply needed.” Rows that need you get an accent edge and a checkbox. Rows that don't get neither. You can sort them before you have read a word. Every row carries the email or event it came from — · 1 source · Details — and that link opens the signal inside the app. Never an external URL.
The sixth is wrong, and we are not cropping it out. The voice note reads “Take a look and tell me what to do” — an action request rendered in the zone this slide defines as no-edge, no-checkbox, visibly receding. That is a bug in the frame, and it is exactly the kind the two-zone rule exists to make visible.
Sources · 3 file references
Rows verbatim from docs/screenshots/briefing.png · two-zone hierarchy specified in DESIGN.md:108-141 · in-app signal links, never raw external URLs, per DESIGN.md:133-136 and CLAUDE.md Safety Invariant #8.
It sends mail and answers invites on your real accounts.
Two local handlers call live APIs: Gmail v1 and Google Calendar v3. Real sends, real RSVPs, real event changes.
Your call. I'll explain the why on each one — say yes if it sounds right, or tell me why not so I learn for next time.
one primary per card · “Yes, do it” / “Not this time” / “Tell me why so I learn”
The queue is titled “I want to handle these — OK?” None of that is decoration. “Approve / Reject” asks you to audit a machine. “Yes, do it” asks you to answer a colleague. Reverting to the generic version is treated as a review failure in this codebase, in writing.
Each card shows three things before you commit: where it came from (google_calendar · Acme kickoff), how urgent it thinks it is (NORMAL, or HIGH with an amber edge), and an “If you approve — what happens” preview you can open first. And when it genuinely doesn't know, it says so instead of picking: the high-risk card on this screen reads “I'm not sure what to do with this. What would you like?” — followed by options, not a default with a cancel button.
Copy drift in the tier card above this crop, stated rather than hidden: it renders “Maximum trust” at Handle most things because nextTierThreshold is null there — no automatic promotion exists past that rung, so the progress bar has no target to name (apps/api/src/routes/twin.ts:147-150, rendered at apps/web/public/js/components/progress-bar.js:67). Full autopilot is still a rung above it. See the ladder.
Sources · 7 file references
packages/ironclaw-adapter/src/handlers/email-action-handler.ts:5 (GMAIL_API, 4 fetch calls) and calendar-action-handler.ts (Calendar v3, 1 fetch). grep -c 'fetch(' returns 0 for the finance, task, smart-home, social, document and health handlers, all of which throw to force fallback; smart-home-action-handler.ts:6-8 says so in a comment. apps/api/src/execution-setup.ts:62-132 registers IronClaw and OpenClaw only when their URLs are configured. Card copy verbatim from docs/screenshots/approvals.png. Brand-voice rule (“never regress to generic Approve/Reject”) is docs/demo.md Step 2. Corrects README.md's “Concrete Examples” table, which implies end-to-end flight booking and grocery reorder.
You cannot earn full autopilot.
Every new twin starts on the bottom rung, where it proposes and never acts.
| Promotion | In a row | Approved | In tier |
|---|---|---|---|
| Just watch → Ask me first | 10 | ≥80% | ≥24 h |
| Ask me first → Handle small stuff | 20 | ≥85% | ≥72 h |
| Handle small stuff → Handle most | 50 | ≥90% | ≥7 days |
| Handle most things → Full autopilot | — | — | — |
The missing row is the point. PROMOTION_THRESHOLDS has exactly three keys. There is no code path that grants full autonomy — it is reachable only by a person deliberately choosing it.
Promotion needs both a count and a clock. Twenty approvals in twenty minutes proves you clicked fast, not that the twin got you right, so the engine refuses on either, and it reads the time floor from an audit table rather than from a counter anyone could bump.
What the clock does not do, stated because it cuts against us: the floor is applied only when the audit table yields a finite number of hours. A missing row — or a malformed one that parses to NaN or Infinity under clock skew — skips the floor, and the promotion is then decided on count and ratio alone. The Number.isFinite guard on that branch keeps a literal “NaN” out of the reasoning a user reads; it is not a second lock on the clock. The repo's own tests assert exactly that behaviour, by name.
Stated exactly, because it is stronger than the version we planned to tell: that engine runs today only for per-capability (MCP server) tiers, in the promotion-eligibility job. For your own autonomy tier there is no evaluator at all. The ladder above is a published contract, and no promotion path writes users.trust_tier — the only runtime writer is your own PUT. Scoped honestly: two developer-tooling paths do write the column, and neither can promote a live user. The demo seed script sets one of its three sample profiles to high_autonomy, and restore-from-backup writes back whatever tier the backup already held. Nothing promotes you but you, more literally than intended.
The observer default is enforced in three independent places: the policy evaluator's tier gate, a built-in policy rule, and the decision maker's auto-execute check. An unrecognized tier string falls through to deny. Above observer, auto-execution stays risk-capped — low caps at low risk, moderate at moderate, and even full autopilot escalates critical.
These numbers are not marketing copy, and the lock on them is narrower than “a test diffs the two files.” The settings page mirrors the engine's constant by hand — it is browser JS and cannot import the TypeScript — and promotion-thresholds-shape.test.ts pins the engine constant to these exact values, so any change to the engine breaks the build and forces the mirror to be updated in the same PR. A test that compares the two directly isn't written yet.
Copy drift, stated rather than hidden: the settings page ships “Just watch” for the bottom rung while TIER_DISPLAY_LABELS at policy.ts:128-129 reads “Watch & Suggest”. The table above uses the label the app actually renders.
Sources · 13 file references
policy.ts:102-121 read directly — three keys (OBSERVER 10 / 0.8 / 24, SUGGEST 20 / 0.85 / 72, LOW_AUTONOMY 50 / 0.9 / 168), no MODERATE_AUTONOMY key. Engine at packages/policy-engine/src/trust-tier-engine.ts:58-152; the time floor is at :123-136, gated by Number.isFinite(stats.hoursInCurrentTier) at :123 — so a non-finite value skips the floor rather than blocking on it, and :146 keeps the literal out of the reasoning string. The two tests that pin that behaviour name it: trust-tier-engine.test.ts:204 (“should NOT let NaN hoursInCurrentTier bypass the temporal floor”, asserting only that the reason string has no “NaN”) and :224 for Infinity. Its two production callers are both per-MCP-server: apps/worker/src/jobs/promotion-eligibility-check.ts:53 (mcpServerRepository.listActive(), writing promotion_offers rows) and apps/api/src/routes/capabilities.ts:1543. users.trust_tier writers, all three of them: the runtime one is apps/api/src/routes/users.ts:254 (userRepository.updateTrustTier → user-repository.ts:190, one caller); the two developer-tooling ones are packages/db/src/seeds/demo-showcase.ts:458 (UPDATE users SET trust_tier = 'high_autonomy' for the seeded power-user profile) and packages/db/src/backup/backup.ts:280 (restore re-inserts the saved tier). Triple enforcement of the observer floor: policy-evaluator.ts:529-535 (default → allowed:false), default-policies.ts:134-170, decision-maker.ts:533-541. Threshold lock: packages/policy-engine/src/__tests__/promotion-thresholds-shape.test.ts; frontend mirror at apps/web/public/js/pages/settings.js:32-54. Four-vs-five caveat is docs/safety-model.md:183, the repo's own words.
It cannot spend your money. Not capped. Off.
The caps are configurable. The rule sitting above them is not.
The configured caps are $100.00 per action and $500.00 per day, checked in exact integer cents — no rounding, no tolerance band. Against the per-action cap, $100.00 passes and $100.01 → escalates; against the daily total, a day landing exactly on $500.00 passes and one cent past it is refused. Over the cap goes to you no matter how much trust you've granted.
Caps compose in one direction only. Global settings are the ceiling; an LLM-interpreted risk profile can only clamp down; per-app overrides clamp again; and boolean rails like “always ask before doing something that can't be undone” are OR-ed, so no lower layer can relax them. If the model misreads your risk profile, the worst case is over-restriction.
And the model is never allowed to price its own action. Candidates emitted by an LLM strategy carry a cost intent of unknown, and unknown is refused the zero-cost fast path and escalated to a human. Negative costs are rejected outright as a spend-tracking bypass.
Then the actual state of v0.6. A built-in, un-disableable rule denies any action with an estimated cost above zero. It is merged into every evaluation ahead of any policy you can write (priority 100) and there is no UI that turns it off.
condition { field: 'estimatedCostCents', operator: 'gt', value: 0 } · effect 'deny' · builtIn true · enabled true · priority 100
Where it sits in the order, precisely: the rule fires in the policy loop, which runs after the trust-tier and autonomy-settings checks. If you have quiet hours set, that branch returns early and a >$0 action lands in your approval queue instead of being denied outright — and then the re-evaluation at approve time (approvals.ts:625) denies it. Two different verdicts, same outcome: nothing is spent.
Financial autonomy is structurally off in the shipped build. The caps above are the machinery waiting behind a closed door.
Sources · 8 file references
Caps from apps/web/public/js/pages/settings.js:514 (maxSpendPerActionCents ?? 10000) and :521 (maxDailySpendCents ?? 50000), matching docs/demo.md Step 6. Exactness and the costZeroIntent “unknown” refusal at packages/policy-engine/src/policy-evaluator.ts:312-332 (#372) — the per-action comparison is estimatedCostCents <= maxSpendPerActionCents at :331, so the cap itself passes and one cent over does not; the daily comparison is the strict totalAfterAction > effectiveDaily at spend-tracker.ts:253, same boundary. Negative-cost rejection at spend-tracker.ts:214-224; one-way clamping (clampDown = Math.min) at spend-tracker.ts:96-100, covered by 15 tests in per-app-overrides.test.ts and 13 in risk-profile-clamp.test.ts. The cost>0 deny read verbatim at packages/policy-engine/src/default-policies.ts:13-38, merged unconditionally at policy-evaluator.ts:119-122, evaluated in the policy loop at :229-247 (deny return at :232-239) — after the tier gate at :135, the autonomy-settings check at :175-177 and the quiet-hours early return at :198-226. Approve-time re-evaluation at apps/api/src/routes/approvals.ts:625-628.
Pause. And exactly what pause covers.
Two buttons in this product say “Pause everything.” Neither one stops every subsystem.
Five different stops ship today, two of them called “Pause everything,” and they are not the same stop. The one in the top-right corner of every page pauses your installed capability servers — the MCP tools. It never touches the twin's email and calendar path and never touches your trust tier. The one lower in Settings demotes you to observer. The desktop tray stops the packaged worker and suppresses delayed replacement; its exact ready API/web generation may remain available, while a pause during recovery contains any partial generation. These controls are separate, and naming that here is cheaper than letting you find out during an incident.
The switch that stops automatic action is Settings → Pause auto-execution (#379), the panel beside this text. Signal sync continues and otherwise-allowed actions route to review. Self-hosters get a matching operator switch, SKYTWIN_AUTO_EXECUTE_DISABLED, that the interface cannot clear. Either one flips the same flag inside the evaluator, and the ordering is the interesting part: it is applied at the end of policy evaluation, not the start, so it can only escalate things to you — it can never turn a refusal into an approval. That was a real bug once; the source comment records it. There is no single whole-system stop today.
Pause stops your twin from acting. It keeps watching, so nothing is lost. One caveat, fixed while this deck was in review: the primary inbound-mail path did not pass per-user autonomy settings to the evaluator, so only the operator switch fired there. #615 routes them through — decision-maker.ts:256 now passes context.autonomySettings.
Undo. Delete.
One of these two is not what its label says, and we would rather say so here than let you find out during an incident.
What “Undo” actually does
Every row of the decision log carries an Undo button, and it does not un-send the email. Clicking it opens a form — what went wrong, how bad, what you'd have preferred — and writes that as feedback against the decision. The twin reads it and adjusts. The toast is honest about which of the two it is: “Walked back. I'll remember: …”.
Real reversal of an executed action exists in exactly one place in this codebase, POST /api/capabilities/:id/regret, and it only reaches actions taken through an MCP server. The decision log never calls it. Undoing the send itself is not shipped, and Safety Invariant #5 is why we won't write the word “reversible” on this slide until it is.
Can I get out?
“Delete everything about me” — profile, decisions, memory, preferences, OAuth tokens, sessions, spend records — runs as one serializable transaction. Either all of it is gone or nothing changed. There is no half-deleted state to discover later, and the endpoint is ownership-gated so nobody can purge anyone else.
Sources · 10 file references
Undo wiring: apps/web/public/js/pages/decisions.js:175 renders the button on every row, :384-390 posts submitFeedback(userId, decisionId, 'undo', …) to apps/api/src/routes/feedback.ts:129-157, which persists the event and calls twinService.processFeedback — no execution path is touched. Rollback: packages/execution-router/src/execution-router.ts:336, reachable only from apps/api/src/routes/capabilities.ts:706. CLAUDE.md Safety Invariant #5. The five stops: top-right button at apps/web/public/js/components/global-pause-button.js:101 → POST /api/capabilities/pause-all (apps/api/src/routes/capabilities.ts:1391-1421, which calls mcpServerRepository.markAllPausedForUser and nothing else); the demote-to-observer button at settings.js:499; the auto-execution stop at settings.js:483 → PUT /api/users/:id/autonomy-pause (settings.js:1301); the operator env var read at policy-evaluator.ts:70; and the desktop lifecycle pause wired through apps/desktop/src/tray.ts into apps/desktop/src/service-manager.ts. User pause and operator switch merge at policy-evaluator.ts:101-117 and apply at :249-273, where the source comment records the pre-review bug in which an early return turned every deny into an approval. Purge at packages/db/src/repositories/user-purge-repository.ts:24-26 (no partial-delete state) and :46-119 / :142-143, ownership-gated at apps/api/src/routes/users.ts:97.
Every call is logged, explained, and correctable.
A gate you can't audit after the fact is a promise, not a control.
An explanation record has four mandatory narrative fields — summary, confidenceReasoning, actionRationale, correctionGuidance — plus structured evidenceUsed[] and preferencesInvoked[]. What happened, what it read, why this and not the alternative, and how you correct it if it's wrong.
Refusals get one too. A decision blocked by policy still writes a record carrying the block reason. That is the difference between an audit log and a highlight reel: a log that records only successes isn't a trail.
And whatever it learned about you is a list you can edit — not a chat transcript, not a pile of vectors. Every entry carries how sure the twin is and where it came from, and every entry has two controls: Edit, and “That's not right.” The page says it in the twin's own words: corrections are the fastest way I get smarter.
Cropped to one row on purpose: the third card on that capture renders a preference as raw JSON, which contradicts the plain-language standard the rest of this deck argues for. It is a bug in the frame, so the bug is named here rather than shown as if it were fine.
That is the loop. The “no” you type on an approval card lands here, and this page is what gets promoted on the ladder.
Sources · 5 file references
packages/shared-types/src/explanation.ts:6-35 (narrative fields) and :40-56 (EvidenceReference, PreferenceReference); blocked-path branch persisting escalationRationale at packages/explanations/src/explanation-generator.ts:62-68. Screens read directly from docs/screenshots/decisions.png and twin.png. Undo is a feedback control, not a reversal — see Undo. Delete. for what it does and does not do. CLAUDE.md Safety Invariants #2 and #6.
There is no SkyTwin server. Not “we don't look” — there is nothing to look with.
Four facts you can check, starting with what the installer actually contains.
01The installer brings its own database. The model it fetches on your say-so.
CockroachDB ships inside the desktop bundle as a native binary, verified against a published sha256 when the installer is built — a mismatch aborts the build. The model is not in the box: the app sizes one to your machine (row 02) and downloads it, 2.0–9.0 GB, when you agree. Nor is the llama.cpp runtime — the API adds the local provider only once it finds both a binary and a model, so a fresh install has no LLM until you supply one. No Docker, no Ollama, no API key, no .env, no account.
02It sizes the model to your machine before you sign in.
Two public endpoints read your RAM, free disk, cores and architecture, then pick from a five-model catalog across four memory brackets — Phi-3.5 Mini at 4 GB, Qwen2.5 3B and Llama-3.2 3B at 8, Qwen2.5 7B at 16, Qwen2.5 14B at 32 and up. The first-run screen says “your AI runs privately on this computer — we'll use <model>” and it has already worked out which one. That removes the two hardest asks in local AI — choose a model, paste a key — before the first screen.
03Cloud is consent, not a default.
Cloud-first is one environment variable, and an unrecognized value falls back to local — a typo must not silently escalate to a vendor.
04If you do turn cloud on, email addresses are masked out of the decision engine's prompts before they leave.
On by default, not opt-in. The regex is length-bounded because it runs over untrusted inbound mail and must not backtrack. Scope, stated plainly, because it is narrower than the row title alone would suggest: it covers the two PromptBuilder paths — situation interpretation and candidate generation — and inside those it masks the raw signal dump and episodic memories, not the situation summary. Chat, briefing prose, draft-email generation and capability inference send their text unmasked today. Addresses only, in any case: names and phone numbers are never masked, and the source file says so and says why.
Sources · 14 file references
Provider chain at apps/api/src/lib/llm-client-factory.ts:62-129, local-first default at :121-128, embedded gate at :66-75 and :154. Redaction at packages/llm-client/src/redact.ts:31-40 (the length-bounded regex and why) / :51-56, default-on at prompt-builder.ts:21-22, reached only from prompt-builder.ts:41 / :74 / :99 — whose two production callers are packages/decision-engine/src/strategies/llm-situation.ts:14 and llm-candidates.ts:18. grep -n 'redact\|Pii' returns nothing in packages/assistant, packages/policy-prompts, packages/capability-engine or draft-email-candidate.ts. Runtime probes at packages/embedded-llm/src/runtime-detector.ts:72-74 with NullPort fallbacks. Hardware sizing at apps/api/src/routes/system.ts:16 / :24 and apps/api/src/system/hardware.ts:112-174 (:163-168 refuses to promise local execution without the llama.cpp binary); catalog at packages/embedded-llm/src/model-registry.ts:55-110 — every entry a HuggingFace downloadUrl, none bundled. Build-time sha256 verify at apps/desktop/scripts/build-single-binary.sh:121-130; that script downloads CockroachDB and nothing else, and build.extraResources in apps/desktop/package.json ships only apps.tar.gz + bundle-manifest.json. “Hash-verified” is claimed for the desktop build script only — not for install.sh (no checksum logic, issue #369) and not for model downloads (the registry ships placeholder hashes).
On your hardware — and what that costs.
Three more facts you can check, one weight, and the claim we are not making yet.
05Voice is on-device.
Speech-to-text with whisper.cpp, speech with Piper. The phone app records and ships audio to your own desktop over your own network, not to a service.
06OAuth lands on your loopback interface.
The redirect is http://localhost:3100/api/oauth/google/callback. The token goes straight to the desktop process and never passes through a server anyone else operates. Google scopes its third-party security assessment to apps that handle restricted data “from or through a third-party server” — no server in the path is the test we're on the right side of, and you can check that against their wording rather than take it from us. It is not an exemption: what isn't true yet has what we still owe Google on the bundled client.
07Eight external runtime dependencies, across 30 packages and six Node apps.
@modelcontextprotocol/sdk · ajv · bonjour-service · chrono-node · express · pg · tweetnacl · zod
26 of 30 packages have zero. Five LLM providers, no vendor SDKs — Anthropic, OpenAI, Google, Ollama and llama.cpp are all reached over plain fetch. The Prometheus endpoint is hand-written to keep it that way. The dashboard has no bundler and no framework: 21,693 lines of vanilla JS across 53 files, 31 of them page modules, and express is its only runtime dependency. One database, no broker, no Redis. One grep disproves any of it if it's false.
What isn't encrypted at rest, and how far it got
OAuth credentials have the whole mechanism — AES-256-GCM, a fresh 96-bit IV per encryption, a scrypt-derived key that is never persisted and lives in a one-hour in-process cache — and it is still not reached end to end. Tokens land plaintext on connect and are upgraded to their encrypted columns only by a process holding your unlocked key. The only place that upgrade runs is the worker, and the worker cannot see the key the API unlocks: they are separate processes and the handoff isn't built. The source comment says so, in those words.
Your preferences, twin profile and memory pages are written in plaintext too. The columns shipped, the crypto helper shipped, the key provider is switched on only in tests. Planned for 0.7, along with the cross-process key handoff. Until both land, the thing protecting this data is your operating system's disk encryption, not ours — and we are not going to write “your data is encrypted at rest” before it is.
Sources · 15 file references
Dependency set recomputed at HEAD by scanning dependencies in every packages/* and apps/* package.json and excluding @skytwin/* (desktop and mobile excluded and stated as such): exactly the eight listed; 26 of 30 packages have none. packages/llm-client/package.json has only workspace deps. apps/web's only runtime dep is express. Hand-written Prometheus at packages/observability/src/prometheus.ts:1-24, mounted at apps/api/src/index.ts:255. OAuth redirect at apps/api/src/routes/oauth.ts:419 and packages/config/src/index.ts:123. Crypto at packages/credential-vault/src/key-derivation.ts:22-25 / :70-98, envelope.ts:14-50, key-cache.ts:36. OAuth gap: tokens are inserted plaintext by oauth-repository.ts:59-95 (saveTokenForAccount, no encrypted columns in the INSERT); the only encrypting path is DbTokenStore's lazy migration, and its single production instantiation is apps/worker/src/index.ts:542 / :547, wired to a KeyCache that nothing ever populates — the comment at :72-85 states it: “Cross-process unlock IPC is not yet implemented… this cache is empty and the worker behaves exactly as it did before — plaintext tokens flow through.” The API's sharedKeyCache (routes/credential-vault.ts:34) is populated on unlock but is never handed to a token store. Preferences gap: twin-repository-adapter.ts:32 defaults the provider to null, setPreferenceVaultKeyProvider at :35 has no caller outside preferences-vault.test.ts, and resolveKey(null, …) returns { mode: 'plaintext' } at vault-helper.ts:162-174. twin_profiles / brain_pages have the migration-066 columns and zero TypeScript references. Corroborated by docs/launch-readiness-report.md on #374. Installer sizes from the v0.6.58.0 release assets.