KIWI
Autonomous local AI agent and community of voices living in The Grove with private memory.
The Problem
Autonomous AI agents often suffer from leaky memory isolation, unpredictable side-effects on host systems, and lack of human-in-the-loop governance for high-stakes file operations and external device actions.
My Role
Architected and implemented the cognitive engine ("The Grove"), fail-closed host action safety policies, immutable exact-action plan ledgers, multi-device agent companion protocol, and unified multi-channel gateways.
Highlights
- Community of six voices living in The Grove with local memory running on the user's machine
- Local cognitive core ("The Grove") separating owner memory from credentialed client sessions
- Fail-closed security policy requiring immutable exact plans with rollback for all destructive actions
- DPAPI-secured Windows companion agent with local execution receipts and anti-re-execution guarantees
- Multi-modal interaction surface: Next.js Web UI, Voice HUD (:4321), and Telegram bot gateway with inline approvals
- Deterministic audit ledger tracking every state mutation, file movement, and memory association
Stack
Constraints
- Host safety is non-negotiable: no autonomous file deletion or batch reorganization without human-confirmed exact plans.
- Offline-first engine: core cognitive loops and memory databases must run purely locally without cloud dependencies.
- Multi-tenant memory isolation: administrative sessions and API token holders must never access the owner private mind context.
System Architecture
Key Trade-offs
The decisions worth defending — what I chose, what I turned down, and why.
File management execution model
Chose
Immutable two-phase exact-action plans with hash verification and dry-run preview
Rejected
Direct agent tool execution with broad shell permissions
Agents making speculative shell or file modifications risk catastrophic data loss; two-phase plans guarantee human oversight and rollback capability.
Engine-to-web communication architecture
Chose
Dedicated loopback HTTP/SSE gateway with bearer token authentication
Rejected
Monolithic single-process Next.js application
Decoupling the AI engine process from the Next.js frontend ensures background monitoring, telegram polling, and long-running skills survive web redeployments.
Device pairing security model
Chose
Windows DPAPI machine-bound tokens with polling architecture
Rejected
Inbound SSH or remote socket servers on client machines
Inbound listening ports expose clients to local network scans; outbound HTTPS polling behind DPAPI keeps remote companion devices secure.
What I'd Do Differently
An honest retrospective — the stuff I'd change with more time, more users, or a second pass.
- 1Implement automated regression tests for memory graph decay sweeps earlier in the development lifecycle.
- 2Consolidate SQLite schema migrations between better-sqlite3 and pg-schema under a single unified migration runner.
- 3Add fine-grained telemetry dashboards to observe cognitive latency across multi-turn reasoning chains.
Interactive Autonomous Agent Shell
Test live KIWI autonomous agent supervisor routines (agent status, grove ping, mcp tools, help) in the emulated shell below.
Technical Deep-Dive
Architecture, specifications, and implementation details.
KIWI — Plan aprobat / Approved plan
Revizia 17. P0 cap-coadă: file_organizer trece pe planuri exacte (kind file_organizer în ledger; builtin pregătește pe dryRun:true cu copii de recuperare, execută DOAR cu exactPlan:{id,kind} valid + aprobare umană — allow la pregătire, confirm la execuție; automation file-organizer e preview-only, nu mai mută fișiere), dev_task e oprit implicit în config (security.skillPolicy.dev_task: 'deny'; dev_status/dev_cancel refuză fără dev activ; calea de migrare rămâne sarcinile de dispozitiv P1 / editărilor interactiv-agenzice P2, nu ledger-ul de mutări), drift-ul target/config e închis (configPath() onorează KELVIN_CONFIG_PATH; POST /api/documents/root sincronizează și kiwi.mind.config.skills), memoria proprietarului e izolată (GET /api/kiwi/knows — doar admin fără authorization atinge engine-ul, conturile credențiate primesc source:'embedded'), iar rutele de documente/upload sunt limitate (readChatBody 500 KB + 100k pe /api/documents/chat/stream, motorul 413 pe ambele rute de chat documente, /api/chat/files respinge 413 din Content-Length înainte de multipart; scripts/repair-attachment-links.mjs auditează/repară message_files în tranzacție). Tipul file_organizer și restul planurilor exacte (revizia 16: documents_organize, disk_doctor reap) păstrează backup + rollback și aprobare umană obligatorie. Reper anterior revizia 16: planurile exacte pentru documents_organize/disk_doctor reap; revizia 15: pluginurile declară capabilitățile. Verificare: 132 teste motor (131 + 1 skip); 228 mind/web în 34 suite; ambele typecheck-uri trecute; fără lansare în producție. P0 rămas (blocat, documentat): acceptarea pe două sisteme Windows (inexistent al doilea sistem; VM-urile sunt Linux) și migrarea output dev_task rămasă la P1/P2. Pilotul P1 de producție rămâne oprit. Ambele versiuni se actualizează împreună. Dovezi: audit RO / EN, acțiuni gazdă RO / EN.