What you can try today, and what you should not assume.

Yes. The current alpha includes an isolated fictional-data sample. It is the supported evaluation surface: no Gmail, Microsoft, or other account is required; sample interactions have no provider, connector, or execution-adapter effect. Start with the five-minute walkthrough.

Yes. The desktop alpha is a usable packaged app for Apple Silicon macOS, x64 Windows, and x86-64 Linux. It is unsigned, so macOS Gatekeeper or Windows SmartScreen will warn, and it predates parts of the current source path. It also includes a five-step wizard for connecting a real Gmail inbox through a Google OAuth app you create. Use the app window for first-account setup. An already authenticated browser session can use the same local page at http://localhost:3200/#/connect-gmail, but a fresh browser does not inherit the desktop session. Use it for the fastest hands-on experience; use current source for the newest guarded fictional sample. Neither is a managed OAuth service or supported public beta.

No for the fictional sample. A model-backed path needs either a compatible local runtime and model or an explicitly configured hosted provider. Neither choice is implicit. See where inference runs.

No. OAuth-token storage is mixed: the credential vault can encrypt new or reconnected grants when it is initialized and unlocked, while legacy plaintext token columns remain possible without that state. Current local twin-profile, preference, and memory content should be treated as readable by someone who can read the local database files. Use full-disk encryption and read the privacy policy before adding personal data.

Source users can use the encrypted skytwin-backup CLI. It exports twin data into a passphrase-protected archive, deliberately excludes OAuth tokens and machine-local authority records, and restores only onto a fresh install. The exact commands and failure behavior are in the backup reference.

The product model includes pause, audit, deletion, and recovery controls. Read the safety guide for the user-control model and the privacy policy for current storage disclosures. Do not infer release-wide verified deletion behavior from a source-only demonstration.

No. Storage location, reasoning location, and network use are separate facts. A local model can run without a hosted inference call; a hosted provider is an explicit network choice; other application features can have their own documented network behavior. The inference guide separates these terms.

Only an explicit interactive TrustedRouter call whose pinned SkyTwin adapter verifies fresh same-session gateway attestation and an exact-byte confidential-route receipt earns that label today. Failure returns no content and never falls back to a conventional provider. NEAR AI remains verification-pending and unavailable because its reviewed evidence does not pin the dynamically selected model/proxy workload. See the review checklist and canonical boundary.

Not by suggestion alone. Candidate actions must carry risk and provenance, pass policy, respect trust and spend limits, and either enter an admitted execution path or stop for a person. Missing provenance fails safe as untrusted external content. Read the safety model.

The local MCP surface can provide scoped context, proposals, and subscriptions. It is not blanket delegation authority, and an agent must not execute around policy. The agent guide defines the authority contract and recommended loop.

Gmail is available as an advanced BYO path. The historical desktop alpha includes a wizard in its app window for creating and using your own Google OAuth client for Gmail. An authenticated local browser session can use the same page; current source can enable the retained live connector with SKYTWIN_GOOGLE_CONNECTION_MODE=experimental plus operator-supplied credentials. This can ingest a real inbox and Calendar; it is not a supported managed or currently verified SkyTwin OAuth service. The alpha also contains a historical SkyTwin-team client ID for initial identity and Calendar access. Start with a test account and follow the Gmail setup and privacy guide. Microsoft implementation code is retained behind the source flag, but there is no equivalent supported setup claim.

No. The planned v0.7.0-beta remains blocked by signing, notarization, clean-machine proof, and release-wide evidence gates. The release guide and machine-checked claim ledger state what is still required.

Open a GitHub issue. For a security-sensitive report, follow the repository’s security-reporting guidance instead of including secrets or personal records in a public issue.