The system
What an agent is, and how it runs.
One persistent identity, seven faculties, and a runtime on your own machine that writes every decision down.
1 identity · 7 faculties
Seven faculties, and what each one is in the runtime.
The faculties are a way to think about an agent. They are not the module list. Beside each word is the part of AI17Z that does the work, so you can check the claim against the software.
| Faculty | What it means | In the runtime |
|---|---|---|
| 01Knowledge | Curated reference material and a style corpus, kept apart from conversation. What a tool returns is evidence with its source attached: data, never instruction. | The KNOWLEDGE memory scope, and Toolspace results with provenance.KNOWLEDGE · provenance |
| 02Memory | Six scopes with an explicit write policy and deterministic retrieval. Every recalled memory carries the reason it was chosen. | Six memory scopes, each queried separately under its own limit. No hidden ranking model.THREAD · USER · PERSONA · ACCOUNT · KNOWLEDGE · EPISODIC |
| 03Perception | Everything that arrives becomes an immutable record and a job that survives restarts. For browser-backed channels it reads through a real Chrome that you sign in to yourself. | Event ingest and durable jobs; a Chrome profile on your disk for browser-backed channels.events · jobs · storage/browser-profiles/ |
| 04Relationships | Durable facts about a person, kept across every conversation and assembled into context beside the persona. | The USER memory scope, keyed by remote handle, and context assembly.USER |
| 05Behavior | Persona, voice and the rules it follows, as versioned configuration. What it may do is your decision, per agent and per capability. | Character configuration (persona layers, versioned) and owner permissions.DISABLED · OWNER_APPROVAL · ALLOWED |
| 06Tools | Typed capabilities through one Toolspace, where rate limits, caching, provenance and size limits are applied once. Plugins add capabilities to it and stay off until you allow them. | The Toolspace (typed capabilities, permission and readiness checks, audit) and installed Plugins.contract.abi · market.snapshot · plugin_<id>.<name> |
| 07Action | The target is verified before anything real is touched, and one event can never produce two remote actions. A dry run is the default. | The durable pipeline: verify, then act once, idempotent by unique index.dry run · one event, one action |
The runtime
Six parts you can open.
Beneath the faculties: the modules of the AI17Z runtime as they are built. Each one can be inspected.
Character
Who the agent is: persona, voice, the topics it cares about and the rules it follows. Versioned configuration you edit in Easy or Advanced Mode — the same file either way.Memory
Six scopes, each with an explicit write policy and its own retrieval limit. Nothing is ranked by a hidden model, so every recalled memory carries the reason it was chosen.Model
OpenAI, Anthropic, OpenRouter, Ollama, any OpenAI-compatible endpoint or a deterministic mock, behind one gateway with a fallback chain. Provider keys are encrypted with your master key.Browser
A real Chrome profile you sign in to yourself. AI17Z attaches to it for browser-backed channels and never answers a CAPTCHA or security challenge on your behalf.Tools
Typed capabilities through one Toolspace. The model asks for contract.abi or market.snapshot — never a vendor — and rate limits, caching, provenance and size limits are applied in one place.Plugins
A product layer over the same capabilities: declarative manifests, hosted capabilities or in-core integrations. No second registry, no second permission store, no downloaded code.
How they become one agent
Every event becomes a record and a job.
Jobs survive restarts and resume from the last completed step. A dry run executes the whole pipeline, verifies the target and stops before touching anything real — and it is the default.
- 01
Ingest
An inbound event is stored immutably. Permission to answer is checked here, and again at execution.
- 02
Assemble
Persona layers, relationships and memories — each retrieved memory with the reason it was chosen.
- 03
Generate
Through the model gateway, with every attempt and fallback recorded beside the answer.
- 04
Verify
The draft is validated and the target verified before anything real is touched.
- 05
Act — once
Unique by index, not by convention. A permission revoked while a job waited stops that job.
Design direction: the loop the architecture is organised around
- Observe
- Attend
- Reflect
- Update self
- Form intentions
- Deliberate
- Policy
- Act
- Verify
- Learn
This is where the architecture is heading, stated as direction. The pipeline above is how one event moves through the runtime.
Architecture
How AI17Z runs.
One continuous agent inside your own trust domain. Studio is an optional layer outside it, and never where the agent runs.
- 01Characterpersona · voice · rules
- 02Memorysix scopes · explainable
- 03Modelgateway · fallback chain
- 04Browseryour own Chrome
- 05Toolspacetyped capabilities · plugins
- Model provideronly if remote — with Ollama nothing leaves the machine
- AI17Z Studioaccount · marketplace · entitlements · Tool Gateway — only if you link
Memory
Six scopes. No hidden ranking.
Each enabled scope is queried separately under its own limit, deterministically. “Why did it remember this?” is always answerable.
| Scope | Keyed by | Holds |
|---|---|---|
THREAD | conversation | The turns of one conversation |
USER | remote handle | Durable facts about a person, across every conversation |
PERSONA | agent | What the agent itself has said or committed to |
ACCOUNT | account | Shared context for one connected account |
KNOWLEDGE | agent | Curated reference material and style corpus |
EPISODIC | agent | Compressed long-term summaries |
Models
Replaceable by design.
Every provider sits behind one gateway with a fallback chain. Provider keys are encrypted at rest with your master key and never returned by the API afterwards. A local model through Ollama costs nothing, and nothing leaves your machine.
Toolspace
The capability runtime.
The Toolspace is the one system a model can call. Capabilities resolve to upstream families and adapters that inherit rate limits, caching, a circuit breaker, provenance, size limits and the network boundary. Registered is not offered, and offered is not used: which capabilities a model may see is shortlisted deterministically and recorded beside what it used. Evidence is data, never instruction.
Plugins
How capabilities are packaged.
A Plugin is the installable layer: a declarative manifest, a hosted capability or an in-core integration that adds capabilities to the Toolspace. It brings no second registry, no second permission store and no downloaded code, and it stays off until you allow it.
Owner permissions
You decide, per agent, per capability.
Plugins are a product layer over the same capabilities: no second registry, no second permission store, no second invocation path.
Off
Never offered to the model and cannot be invoked.
Ask me first
For the first few uses, without choosing between off and unattended.
Allowed
One path: typed input, typed output, a readiness check and an audit row.
Where Studio fits
Optional, outbound-only, never in the loop.
Studio, this site, adds a web account, the plugin marketplace and linking an installation to that account. Your local AI17Z calls out to Studio over HTTPS when you ask it to; Studio never connects in to your machine. If Studio is unreachable, AI17Z keeps running.
The rules that do not bend
- Your agents, memory, prompts and provider keys stay on your machine.
- Your Studio account is not your local owner account, and a wallet is not an identity.
- An installation is identified by its own key — never by IP address.
- A marketplace entitlement never overrides your decision to switch a capability off.
- Paid access is granted only after Studio confirms the payment on-chain itself.
- Publishers never receive your data, keys or cookies, and never run code on your machine.