PersonOS

Every agent asks
before it knows.

PersonOS gives every AI the context it needs for the task — and nothing else. Memory stays evidence-backed, revisable, and under the person’s control.

Try the context request Read the developer model
✳ Weekly update
Ready
❯

Draft my Monday weekly update in my preferred tone. Lead with concrete progress from this week, then cover current blockers and any pending follow-ups. Use only context PersonOS explicitly releases for this request; if a field is withheld, leave it out rather than infer it.

Thought for 7s (ctrl+o to expand)

I should build this from task-scoped context, not from the full person model.

I’ll request preferred tone, recent progress, current blockers, and pending follow-ups for this update.

If PersonOS withholds a field, I’ll omit that section rather than fill the gap.

Calling personos…(ctrl+o to expand)

⎿  personos_read(purpose: "weekly work update", fields: 4, duration: "15m")

Reaching for context…(0s · ↓ 84 tokens · esc to interrupt)

Called personos (ctrl+o to expand)

⎿ ContextPack CP-8F31 · 2 released · 2 withheld · ctrl+o to expand

releasedvoice.tone, work.recent_progress

withheldwork.blockers, relationships.pending_followups

Here’s a draft:

This week, I completed a working end-to-end PersonOS demo. Claude Code now declares a concrete purpose and requests only the personal context needed for that task.I connected that request to an owner-controlled approval flow, compiled the released fields into a scoped ContextPack, and used the pack without exposing the rest of the person model.The same run now writes a signed audit receipt, so the request, authorization, released and withheld fields, output, and evidence trail can be reviewed together.

Current blockers and pending follow-ups weren’t released, so this draft only covers verified progress.
❯

personos-demomainPersonOS MCP · connected

PersonOSProduct prototype · local demo data
Broker connected

Access

Who can read which part of your context.
2active grants 0reading now 1approved, never used
Apps and callersStanding and one-time grants live together
Current projectThursday availabilityPreferred writing tone

Revocation blocks future reads. Context already delivered to an agent cannot be recalled.

Duration
  1. AskClaude Code declares its purpose
  2. ChooseYou narrow the requested fields
  3. UseOnly approved context shapes the answer

Interactive product prototype. The Claude Code session and MCP call are simulated with local demo data; no personal data is read or sent.

The agent gets a ContextPack—not your whole life.

Permission happens before model context.

Retrieval is not consent. PersonOS separates what exists in memory from what this agent may use right now.

  1. A

    Ask with a purpose

    The agent names its task, requested fields, and how long access should last.

  2. B

    Approve the slice

    The owner can approve a subset. Sensitive fields can require a stronger confirmation.

  3. C

    Compile the pack

    Only approved, current, evidence-backed context reaches the model for this task.

  4. D

    Leave a receipt

    Grant, denial, read, revoke, and proposed updates remain visible in the audit trail.

CONTROL & AUDIT

Every permission stays controllable. Every read stays inspectable.

PersonOS keeps grants, released fields, withheld fields, purpose, duration, and the signed receipt in one place. This is the record left by the Claude Code demo above.

Exact scopeReleased and withheld pathsLive controlShorten or revoke future accessSigned historyPurpose, duration, caller, receipt

Memory that can show its work.

A PersonOS memory is not an untethered sentence. It carries its evidence, time, confidence, and revision history.

Evidence logAppend-only

“I’m based in Hangzhou now.”

Conversation · user-declared

“I moved to Shanghai last month.”

Conversation · user-declared
Derived memoryRebuildable
Historical fact

Lives in Hangzhou

Superseded · evidence EV-0218
Current fact

Lives in Shanghai

Evidence-backed · EV-0703

One source of truth.
Four useful layers.

Evidence is durable. Everything above it can be revised, rebuilt, or withheld from a task.

EvidenceWhat actually happened

Immutable source records

Memory atomsClaim · Fact · Event

Searchable, time-aware units

Person modelStable, revisable understanding

Identity, state, boundaries, goals

Working memoryWhat matters right now

Fresh session context

The same person.
A different slice for every task.

A writing agent may need tone and project context. A planning agent may need availability. Neither automatically receives health, finance, or private relationships.

See the integration contract
Writing ContextPack3 fields · this task
  • Preferred voice
  • Current project
  • Audience context

Receipt will be written after use

Memory should arrive with proof — and a boundary.

The current PersonOS core exposes evidence-backed recall, ingest, trace, task status, and session consolidation. Context authorization is an owner-side preview that is being unified with the memory runtime.

Explore the developer page Read the current boundary
recall
// before the agent answers
POST /api/v1/recall

{
  "session_id": "review-042",
  "query": "What matters for this review?",
  "mode": "auto"
}

// returns a brief plus its evidence

Built enough to inspect.
Early enough to be honest.

We separate what exists in code from what still needs production hardening.

In the current core

Evidence and memory atoms, bitemporal facts, fast/deep recall, light-dream consolidation, user isolation, recall/ingest/trace APIs.

Owner-side preview

Partial context grants, sensitivity levels, short-lived access, high-sensitivity confirmation, signed receipts, proposal-only writes.

Not claimed as finished

Production OS isolation, formal policy enforcement, heavy-dream, complete cascading forget, multimodal ingest, and a public benchmark harness.

Questions people should ask a memory system.

Your memory.
On your terms.

Build agents that know enough to help — and still know where the boundary is.

Explore the integration