Adaptive behavior, explicit control

Current source

Teach one useful routine without handing the model the keys.

SkyTwin's first versioned workflow is a read-only signal digest: describe what to watch for, replay the proposal against your recent signals, and activate an immutable version only after you review it.

Honest launch boundary: the maintained embedded model is available for ordinary local inference but is not qualified for workflow authoring. Released stock Ollama builds also lack the response-bound model identity this path requires. AI authoring therefore fails closed unless an eligible provider and model satisfy the checked-in contract.
SkyTwin Watches page in a seeded source-development profile showing Model artifact unavailable, a disabled Preview with AI button, and an Open settings action.
Cold start fails closed. This seeded source-development profile has no qualified local model artifact. Watches reports the missing artifact, keeps Preview with AI disabled, and points to Settings instead of silently changing provider or reasoning location. The disposable fictional sample does not expose this authoring surface.

What exists now

signal_digest.v1 is a vertical, read-only Watch. It can match owner-scoped signals on a schedule and present cited results. It does not send, delete, modify, spend, install, execute code, choose credentials, or expand its own authority.

AI may Deterministic code owns The user owns
Translate intent, ask one bounded clarification, summarize cited matches, and propose a minimal correction. Validation, canonical compilation, hashing, replay, ownership, policy boundaries, persistence, and exact run pins. Submitting authoring work, activating a version, choosing a correction, and rolling back.

Teach, replay, activate, improve

  1. Describe one digest. In Watches, state the source or filter, cadence, time when needed, and desired summary.
  2. Resolve at most one missing detail. Recoverable setup or provider failures preserve the draft instead of discarding the user's work.
  3. Replay against real owner-scoped signals. The review shows caught and ignored counts, bounded cited examples, schedule, scope, and whether AI synthesis was available. Synthetic pasted-example replay is not part of this slice.
  4. Activate explicitly. Creating or editing a proposal never changes the active version. Activation atomically moves the version pointer and replaces the Watch projection.
  5. Revise without rewriting history. A correction creates a new immutable version and a server-computed semantic diff. The new version must be replayed and activated separately.
  6. Roll back by selecting prior truth. Rollback appends an activation event and restores a previously active version; it does not mutate old versions or runs.

What every claimed run proves

A claimed Watch slot pins the workflow and version IDs, provider/schema versions, canonical payload and content hash, compiler projection, time window, and sanitized inference identity when model-assisted. User-authored revisions carry an explicit no-inference state. Completion stores a bounded display sample and a commitment over the complete matched evidence set.

Temporary model outage does not erase deterministic value. Matching stays deterministic. If summary inference is unavailable, the cited matches still complete with AI summary unavailable; a local failure never silently crosses to a cloud provider.

Retries after a committed authoring request reuse the durable proposal. Two simultaneous first attempts can both spend inference before the database uniqueness boundary reconciles them, but only one durable version/proposal survives. This is bounded duplicate inference cost, not duplicate workflow state.

Model readiness is a separate capability

Recommendation, download, runtime availability, structured authoring quality, and exact runtime identity are different checks. The authoring path requires the evaluated artifact/runtime pair to meet the checked-in semantic, revision-preservation, safety, latency, and identity gates. Unknown or changing identity fails closed.

State What the user should see
setup_required Configure a provider or choose the clearly labeled deterministic, non-versioned Watch fallback.
artifact_unavailable / runtime_unavailable Install or repair the exact local artifact/runtime; keep the draft intact.
unsupported_model The model cannot satisfy the authoring or identity contract. Ordinary chat may still work, but workflow authoring remains blocked.
temporarily_unavailable Retry later without changing reasoning location or silently selecting another provider class.

Backup, restore, purge, and CockroachDB

CockroachDB is the source of truth for workflows, immutable versions, proposals, activation history, idempotency bindings, and the active Watch projection. Backup schema v6 includes those user artifacts and sanitized inference metadata. Restore validates ownership, hashes, lineage, proposal transitions, projection pins, and active pointers before one transaction writes anything. User purge removes this state through owner-scoped database relationships and repository cleanup.

Current limits and future states

This is not a universal generated-code workflow engine. Action-bearing workflows, scoped autonomy, durable multi-step composition, parallel investigations, and portable workflow packs remain separately reviewed milestones. The stable envelope can grow to new typed providers without turning a model-authored graph into trusted runtime code.

Full source reference · Architecture · Inference boundary · Data lifecycle · Future-state epic