kenward

// 00the gap it fills

Add a second person and it breaks.

Personal-assistant projects are built for one person on one box. Add a second human and you get one of two bad outcomes: a single shared brain that leaks everyone’s private context into everyone else’s conversations, or separate installs with no shared knowledge at all.

Neither is what a household wants. A family wants the assistant to know that Tuesday is bin day and that the boiler code is 4471, while not telling your brother what you asked about last night. Doing that properly means per-person identity, cryptographic separation, invites and multi-device sync — the boring, expensive half of the problem. That half already exists in lore, so kenward is the assistant loop on top of it rather than a memory system built from scratch.

// 01the memory model

Two kinds of memory, and one asymmetry.

Private memory is what the assistant knows about you: preferences, ongoing concerns, the shape of your week. A lore space with exactly two members — you and the node.

Shared memory is what the household knows collectively: house logistics, recurring plans, decisions everyone should be able to recall. A lore space with every member in it.

Private conversations can read shared memory, because that is useful — you should be able to ask when the bins go out. Group conversations can never read private memory, because that is the entire point. Copying something out of a private space into the shared one is an explicit, reviewed act that shows you the full text before it is published.

And nothing is written to memory without you being told. A note to your own private memory is written first and then shown to you in full — the exact words and the space they went to — with an Undo button that removes it. Anything going to the household's shared memory is shown to you first and written only if you say yes, because other people will have read it by the time you regret it.

— what kenward itself says, in both modes

// 02two modes, one binary

The setup question is about trust, not topology.

Which mode you run is chosen once, during setup, by answering one question: does everyone here trust whoever runs this machine to be able to read their private conversations? A non-technical installer can answer that. They cannot answer “do you want per-user pods?”, and the pods are a consequence rather than the decision.

• Simple

  One process. Everyone’s memory separated, every key in one place.

  What this mode does NOT do is seal anything against whoever runs this machine. All members' keys live in one process here, and one bot token carries every conversation, so the person operating this computer can read every member's private memory — on the disk, and in flight on its way to and from Telegram. For most households that is fine — it is your own family machine, and you already trust whoever set it up.

• Isolated

  One pod per person. Each holding only its own key, and its own bot.

  Your assistant runs in its own process, with its own key and its own Telegram bot. Nobody else in the household can read your private memory, and neither can the person who runs this machine — not from the disk, not from a backup, and not before your process has been unlocked.

Both quoted verbatim from what kenward doctor prints.

The assistant loop, the memory policy, the routing and the capture flow are identical in both. Only the supervisor differs. Simple mode is honest about being simple — separation between members is real, sealing against the machine’s owner is not, and kenward doctor says so out loud. Isolated mode is not a paid tier: it is the mode that makes the privacy claim true, and charging for that would be gating the wrong feature.

// 03what it does

Six things, and no dashboard to live in.

Members need no client software beyond Telegram, which they already have.

• Ten languages

  English, Spanish, Catalan, Portuguese, French, Italian, Dutch, German, Chinese and Modern Standard Arabic — each written out by hand rather than run through a template, down to Arabic’s bidirectional isolates and Catalan’s elisions.

• Remembers, and says so

  Every write is announced in your own language, with the exact words and the space they went to, and an Undo button behind a real delete. There is no setting that makes a write silent.

• Reminders

  A reminder is a piece of text and a time to send it. When the time comes the text is sent, verbatim: nothing generated, nothing retrieved, no model consulted. A node that was asleep delivers late and says it was late.

• A group chat that stays quiet

  In the household group kenward answers only when it is addressed, and records the rest of the conversation without speaking into it. Reminders are the one exception, and they are kenward speaking without being addressed on purpose.

• Runs on whatever is awake

  Endpoints carry tier tags; each space declares the tiers it may use, in order. A machine that is powered off is skipped in about two seconds. When the chain is exhausted kenward refuses rather than reaching further, and there is no setting that changes that.

• A wizard in the browser

  An admin dashboard with a first-run wizard that sets the whole household up without a terminal: install, account, Telegram, endpoints, trust. One HTTP server, one account, bound to loopback unless you say otherwise.

// 04install

One binary, then two questions.

The script picks the right build for your machine, checks it against the SHA-256 published with the release, installs it, and offers to set up the systemd unit. macOS runs the same line. Windows downloads the .exe and runs it from a terminal.

$ curl -fsSL https://raw.githubusercontent.com/BlueHeisenberg/kenward/main/install.sh | sh
$ kenward setup

Setup asks two questions that shape the household. The first is the one above, about security, and it chooses the mode. The second only looks similar: one assistant for the whole household, or one each? That one is about presentation. A member’s own bot is a separate contact, not a separate secret — and because one bot is one contact is one agent, one each needs Isolated mode’s per-member bots. Setup says so rather than quietly handing everybody the same assistant under several names.

$ kenward invite --name "David"   # single-use, expires in 24h
$ kenward doctor                  # config, memory, transport, every endpoint
$ kenward dashboard               # the browser wizard, on loopback

Until an invited member sends their code the bot will not reply to them at all — not an error, not a prompt, silence. A bot username is publicly discoverable, and any reply would confirm to a stranger that there is something here. INSTALL.md has the full procedure, including the Telegram /setprivacy step whose omission has no symptom.

// 05where the claim stops

The honest limit, stated once.

kenward has to see your words in plain text to answer them, and it is the second member of your private space. That is the price of an assistant that answers when your laptop is shut. Someone with root access to this machine, while your assistant is running, could reach your key. There is no way around that for any assistant that runs on a server and answers questions — what changes is that reaching it means deliberately attacking your own household, rather than opening a file.

— verbatim, from what isolated mode itself prints

• Your key stays unwrapped while your process runs. Your passphrase is given to your own process when it starts and never travels over Telegram — sending it in a chat message would hand it to Telegram’s servers and leave it in your message history. The consequence is that once your assistant is unlocked and running, your key stays in that process’s memory until it stops or you lock it.
• In Simple mode the operator can read everything — every member’s private memory, at rest and in flight. That is the mode’s known limitation, not a bug.
• A delete is a tombstone, not a shred. Undo really does remove an entry: it stops coming back from search and from get, here and on every synced device. The row is still on the disk. That is why publishing something into the shared space shows you the full text first — unpublishing is not the same as never having published.
• The privacy differentiator is a property of self-hosting. Isolated mode on somebody else’s infrastructure seals nothing against that somebody else.