GodBrain

Local-first Jarvis on this Windows desk. The mouth is an OpenAI-compatible loopback server on :8000 (desk default: llama-server; Colibri is the interchangeable alternative). Not a commercial -cli wrapper and not MCP. Models inherit the same Golden Records, and the kernel adds tools a stock llama-server will not give you.

TLDR

The GodBrain turns local models into a shared, sovereign cognitive system. The core idea:

• 🧠 Model-agnostic mouth — Plug in an OpenAI-compatible /v1/chat/completions server on :8000 (desk default: Gemma 12B on llama-server). Not an arbitrary chat API. No model is special; they inherit the same teachings.
• 📚 Models teach models — Librarian writes candidate Golden Records; you /verify or /reject. Chat retrieves committed teachings through rag-service (:8084), so the next model does not start from a blank context. That is the query path — not a Mongo shell.
• 🛠️ Tools a stock llama-server will not give you — Built into the C++ kernel, not 40 npm MCP servers. Chat tool_calls plus command_types (save/recall, skills, host observe, telemetry, privileged PowerShell behind GODBRAIN_API_TOKEN + a non-blank reasoning). Bounded /edit is a separate chat door, not a command_type.

The Compute Cheat Code (vault ≠ GPU)

Mongo + rag-service is the vault. The mouth is just compute. A bigger card, a future cloud ingest, or a 128GB Mac can still read the same Golden Records. This desk is one generate slot (Gemma 12B IT Q6_K_L, bartowski MTP on). A 3090 replacing the 4080 is still that slot, not a second mouth and not a silent swap to GLM MoE.

Hybrid ingest is real: drop a source in inbox\ or POST /api/librarian. The local mouth extracts candidates. You crown them. Cloud models do not skip /verify, do not get a Mongo shell, and do not run wsudo. Privileged PowerShell still needs bearer + reasoning. Heal does not DISM, rewrite the registry, or patch a fleet.

See it running

Galaxy on this host: 3D graph, This host / Pending on the left, mouth and no-GPU glance buttons on the right.

How it works

GodBrain routes tool calls through a native C++ kernel instead of patching a specific inference server's chat template. The mouth must already be an OpenAI-compatible loopback server on :8000 (desk default: llama-server; Colibri is the interchangeable alternative). This host does not call a commercial API, and .vscode/mcp.json is empty on purpose.

• godbrain_core/cpp_kernel/main.cpp hosts the HTTP API (bound to 127.0.0.1 only): Galaxy chat, no-GPU glances, /edit, and privileged command_type JSON. /edit is a chat door with an allowlist, not a command_type.
• godbrain_core/cpp_kernel/kernel.cpp (GodBrainKernel::dispatch / validate_sovereignty) is the Circuit Breaker: it intercepts high-risk command_types, requires a non-empty reasoning field plus a matching GODBRAIN_API_TOKEN bearer token, and only then dispatches the command.
• godbrain_core/cpp_memory_store is the desk Alexandria write/retrieval path (memory-store.exe / rag-service.exe on :8084). Go godbrain_core/memory_store stays as rollback with the same doors.
• LLM/colibri_LLM (Colibri, the C-engine) is one of the interchangeable local models GodBrain drives — it is not special-cased into the memory or execution layers.

Repository map

This tree is a desk runtime plus a released kit plus research. Maturity is source / offline gate / daily-driver, not "the folder exists."

Surface	Maturity	Notes
C++ kernel + Galaxy (godbrain_core/cpp_kernel, godbrain_core/frontend)	daily-driver on this host	:8083, /edit, privileged command_type
C++ Memory Store	daily-driver	:8084 Golden Records; Start/Heal prefer build/cpp_memory_store/Release
Memory Store / rag-service (Go)	rollback	Same stdin/HTTP exe names; do not delete
Heal / Watch / Start-GodBrain.ps1	daily-driver	one loop; WMI children get Mongo DB name + embedding identity, not GODBRAIN_RAG_PORT
Reclaim11	released kit (v12)	Windows repair ISO/zip; not the Jarvis loop
Skill Lab	source + one fixture gate	promotion needs a second independent fixture before it is usable policy
local_ingestion	source implemented	adapter; no Mongo writes from Python
Go / Rust routers	experimental	not the operator UI
polymarket_paper, polygon_*	paper / read-only	no live orders, no wallet
smart_contracts	Foundry tree	forge validate; not desk runtime
LLM/colibri_LLM	vendored mouth	interchangeable generate engine

The runtime default is one loop, not an agent graph: discover → plan → execute → verify. Heal/Watch keep :8084/:8000/:8083 up. Oracle chat generates; /verify last / /reject last is the check for playbooks and fights. Host inventory and Learn-backed facts promote themselves when a probe or a quote match is real. Librarian distills transcripts to candidates. The bottleneck is the verifier, not the model. A second node is allowed only when a named signal pays for it (Architect vs Surgeon, a second inference runner behind the same kernel door, or a future candidate-vs-verified conflict queue). Colibri and a rebuilt llama-server are interchangeable mouths, not a mesh.

Large changes follow a contractor gate: investigate the repo, state a Goal and falsifiable assumptions, ask at most three blocking questions (each with a default), then implement. One-liners skip the ceremony. Verify on the live ports, then persist. The next loop starts from git and Golden Records, not from chat history.

Ingest is the same loop with a stricter write rule: raw sources stay immutable; Librarian extracts new claims, not a recap; contradictions are flagged on both sides and never silently overwritten; open questions stay questions. Chat and any digest read the processed Golden Record layer, not the raw transcript pile. Routine extract uses the cheap local runner; a heavier model is only for a flagged fight or a high-stakes synthesis.

Golden Record RAG status

Golden Records are the manual: crowned facts the mouth RTFMs instead of scouring the internet. Retrieval ranking among verified cards is "which page," not "what most pages said." Candidates and raw web text are not Oracle truth.

Layer 3 is implemented. The production C++ kernel and the experimental Go and Rust routers retrieve prompt context only through http://127.0.0.1:8084/v1/search. They validate the generation and hybrid-v1 contract, preserve bounded citations and trust labels, and wrap retrieved text as explicitly untrusted reference data. If the service is unavailable, unready, malformed, oversized, or returns no usable context, and this kernel process has no session notes, chat fails closed before a model is started. Non-empty process session notes (hydrated from RAG at boot, or /remember) may still go to the mouth without a fresh Golden Record hit. They do not fall back to the old nodes collection. Galaxy graph and node lookup use the same service (/v1/graph, /v1/document) and the active rag_documents generation.

Lexical/metadata retrieval remains the zero-configuration canonical fallback. An optional exact-loopback OpenAI-compatible embedding provider enables generation-versioned embeddings and deterministic hybrid RRF over a bounded 4,096-document exact-cosine backend. Health and search responses state the exact mode and degradation reason; they never claim hybrid when the provider, model identity, projection, or bounded backend is unavailable. The checked-in synthetic fixture currently measures Recall@K, MRR, and nDCG@K at 1.0 with zero hidden-record leakage. These are reproducibility checks for the deterministic fake provider, not real-model quality claims. Privileged command_type dispatch remains a separate C++ request path protected by the configured bearer token and sovereignty checks.

Kernel command_types

These are the first-class commands the C++ kernel currently validates and dispatches (JSON on :8083, not an IDE MCP server):

Tool	Purpose
save_godbrain_thought	Candidate Golden Record via memory-store.exe
query_recent_thoughts	Newest active-generation rag_documents
query_godbrain_skills	Promoted skills only (untrusted procedure + evidence profile)
record_godbrain_skill_run	Append harness evidence (skill_verification_runs)
promote_godbrain_skill	Promote after origin is verified and a passing run exists
set_godbrain_status	verified / rejected / stale with reasoning
observe_godbrain_host	Windows inventory + os_pin; auto-verified sensor
promote_godbrain_claim	POST /api/truth host_fact / doc_fact / playbook
get_system_telemetry	Hardware/system awareness
execute_godbrain_script	PowerShell (requires reasoning + bearer)
propose_sovereign_architect_change	PowerShell (requires reasoning + bearer)

/edit is not in this table. It is an allowlisted chat apply, recorded as local-edit-apply-v1, and cannot promote a skill.

Why the sovereignty check matters

The mouth can emit these tool calls, but execute_godbrain_script, propose_sovereign_architect_change, record_godbrain_skill_run, and promote_godbrain_skill are high-risk: the kernel rejects them unless the payload carries a non-blank reasoning string and Authorization: Bearer matches GODBRAIN_API_TOKEN. Ordinary loopback read/chat routes (no command_type) stay unauthenticated for the local UI. Every Tailscale route needs the bearer, including GETs.

The bigger picture

Karpathy's second brain is cute for taking notes. GodBrain is the same idea with a judge: raw sources stay immutable, Librarian extracts claims as candidates, you /verify or /reject, and the next model inherits the processed Golden Records — not the transcript pile.

Two product wants that are not notes:

• Replace Copilot / gemini-cli on this host. GodBrain is the local agent loop you own: Galaxy + C++ kernel + one mouth. Hands are compiled into local_tools.cpp, not an MCP/plugin catalog. Copilot's Filesystem + Desktop Commander list was existence proof, not a stack to import. Do not dual-run. llama-server is an interchangeable generate engine; a GodBrain llama fork is later, only if ggml sunsets or blocks the tool path. Kernel tools and judge stay here so a vendor CLI dying does not take the desk with it.
• Replace the web-dev loop on this repo. Galaxy, Tailscale glances, Shortcuts, and allowlisted /edit should grow until you do not hire someone to ship GodBrain UI. That is a destination, not "no sandbox, write anything."
• Models teach models over time. Chat already retrieves committed teachings through rag-service (:8084). query_recent_thoughts and /recall list newest projected nodes; /recall <query> searches verified Golden Records through that same API — not mongosh, not a MongoDB IDE/MCP plugin against the live vault.

On this host it is one Windows loop, not Ring 0, not a Distributed Cognitive OS across Devuan/macOS, and not zero permission-begging. The vault is decoupled from the GPU. The operator is not.

Working today

Shipped on this desk, not slideware:

• One loop — Heal/Watch keep :27017 / :8084 / :8000 / :8083 up. Discover → allowlist start → verify. Heal does not kill, reboot, DISM, or run the repair cocktail.
• Teachings in and out of Mongo — Librarian → memory-store (candidate only, fail-closed JSON). Chat/Oracle retrieve through rag-service, never by giving the model a Mongo shell. Oracle search is verified-only.
• Judge — /verify /reject for playbooks and fights. Host probes and Learn quotes auto-verify when the evidence actually matches. That is how the mouth is fostered: crowned option next time, not token-chase from weights (ASCII instead of a BIOS map, shiny instead of a click path).
• Bounded file work — /edit writes root .ps1 / .cmd / .md, scripts\, docs\, godbrain_core\. Not vendor/build/LLM/archive. Never git push from the mouth. Chat tools (OpenAI tool_calls, kernel executes) cover %USERPROFILE%, %APPDATA%, %LOCALAPPDATA%, %ProgramData%, %ProgramFiles%, %ProgramFiles(x86)%, C:\Tools, and C:\Temp\GitHub the way Copilot Filesystem+Desktop Commander do in VS Code: list/read/write/search/edit, run_pwsh, console SysInternals / reg query / ETW / schtasks /Query. /yolo N adds mutate + MinSudo/wsudo -A. Not --ti, not pskill/PsExec, not MFIT, not a Mongo shell.
• Privileged PowerShell — execute_godbrain_script / propose_sovereign_architect_change need bearer + a non-blank reasoning. That is pwsh via the kernel, not Visual Studio as a tool.
• Operator glance — scripts\Show-SystemFlex.ps1 (flex on this desk). Host chrome, not /brief, not Heal.

The verifier is still the bottleneck. Privileged doors existing is not "the hard part is done."

The end goal

Wanted on this product (still gated):

• A mouth that ships real UI and host work the way a web dev would — kernel allowlist, then you judge. Copilot/gemini-cli are not part of that loop.
• Own the generate engine if the stock llama-server door is sunset or gimped. Fork later; do not vendor Copilot MCP to get there.
• Models that keep inheriting each other's verified teachings. /recall <query> already searches :8084. Writes stay candidate until /verify. Extra sector/kind filters are optional, not a new vault.

Not this host — several are standing nos. See docs/architecture/future.md:

• Candidate-vs-verified conflict queue — later, and only if /pending is actually overloaded. /verify / /reject is enough now.
• Autonomous CVE ingest and auto-patch across Devuan / macOS / Windows.
• Self-directed DISM or registry repair. Named GO, one tool, never a standing allow.
• Closed-loop patch with zero hand-holding. Heal already does detect → allowlist → verify; anything past flushdns stays GO-gated.

Capability (evidence, not folder names)

Item	Source	Offline gate	Daily-driver on this desk
Heal/Watch listener loop	yes	Start/Heal scripts	yes
/verify /reject judge	yes	—	yes
Librarian candidates + rag-service retrieve	yes	C++ ctest + Librarian --self-test	yes (lexical; C++ :8084)
/recall <query> verified search via :8084	yes	—	yes
Bounded /edit + privileged pwsh	yes	Verify-LocalEdit	yes, allowlist still grows
Tool edit_local_file / write_local_file hash-bound replace	yes	local_tools_test	yes (tmp+MoveFileEx; append fail-closed if dest unread)
WMI child env: DB name + embedding identity	yes	Start-GodBrain.ps1 -SelfTestEnv	yes
Durable task ledger / chain continue	yes	/chain /cancel /continue	yes (one file, not tasks/todo.md)
Skill Lab second independent fixture	one fixture exists	Skill Lab README	no — policy not usable yet
Mouth ships web-dev class UI work	destination	—	no
Autonomous CVE / cross-fleet / self-DISM	no (standing nos)	—	no

Credits

TrustedInstaller on this desk is wsudo -T from conhost or Windows Terminal (C:\Tools\TeamM2\wsudo.exe). Privexec.exe in that folder is a GUI picker and is not used. Heal never calls wsudo. Chat run_elevate under /yolo uses MinSudo / wsudo -A -w, never -T. Chat acl_takeover / acl_release is the named -T door.