Sathi Ecosystem

Many devices. One Sathi. One boundary.

This page shows how physical devices — a speaker, displays, sensors, one day perhaps robots — join the same private Sathi a family already talks to, so that daily life stays inside one trusted interface instead of leaking across a dozen corporate clouds. Companion page to /principles, which explains the beliefs and data flows underneath.

You speak; it answers. The memories stay on your wall, the help stays humble — and the cloud stays outside the window.

One Sathi, one boundary

There is one trust boundary: the family's own infrastructure. Everything inside it shares one understanding, one authority ladder, one audit trail. A device that joins the ecosystem is not a new product with its own account, app, and cloud — it is a new organ of the same Sathi. The speaker is ears and a voice in the kitchen. The phone is the careful surface with the confirm button. A display is a face. A robot, far away, would be hands. Embodiments come and go; the intelligence remains continuous — because the family, not any device or vendor, owns the substrate it learns from.

The constitutional rule, binding since before any hardware existed: a device adds senses, never a second brain. No per-device memory, ever. Whatever Sathi learns through one surface, every surface knows; whatever the family deletes is gone from all of them, provably.

Every surface is an organ of the same Sathi — senses come and go, the understanding stays. The gate to foreign clouds is closed by rule: de-cloudable hardware is welcome; tethered hardware is not.

The organ map — in honest tenses

Statuses are the truth at the time of writing: what is live, what is being built, what waits by design, and what is a horizon we plan for but do not promise.

Surface	Status	What it is
Phone & web app	Live	Chat, voice conversation, documents, family messaging and calls — the careful surface where confirmations happen.
Home speaker	Building	The first unit is alive, on open hardware: say the wake word, and music from the family's own library plays in the kitchen — no foreign cloud in the path. Ahead: Nepali-first speech, timers, calendar with a spoken yes/no, and only then any custom device.
E-ink displays	Planned	Quiet screens from shelf-label size to wall frames: calendars, the day's shape, family photos, art. No microphone, no camera — presence without a trust bill.
Car	Planned	The phone app projected to the dashboard. Arrives with the native app; useful the day our own music streams fast.
Wearables / health	Planned	Understand-through first: local, de-clouded companions to commodity bands and watches feed the archive without a vendor cloud. Sathi-branded wearable hardware — probably never; good hardware exists, the missing piece is a loyal home for the data.
Home sensors, lights, locks	Planned	Through a self-hosted home hub (Home Assistant class), not a Sathi rewrite: devices speak locally to the hub, Sathi understands and acts through it, under the same ladder.
Robot vacuum	Planned	A commodity vacuum, de-clouded with open firmware so it answers only to the home hub. The first "hands" — deliberately humble ones.
Entry & security cameras	Waits by design	Outward-facing, expected-monitoring duty — the socially legible kind, with signage. Local recording only. Ships after the consent layer (see below), not after the capability.
In-room cameras	Perhaps never	Honestly: creepy today, even within a loving family. The understanding gains would be real; the trust required is maximal. If values evolve, this returns to the table — consent-first, and only then.
Humanoid robots	Horizon	Not a promise — a test. If one arrived tomorrow it would be a client of the same understanding and the same ladder: zero new memory, zero second brain. Physical action is the authority ladder's final exam, so the trust machinery matures long before hands do.

What any device must promise

Same understanding. It reads and teaches the one shared Sathi — never its own memory.
Same authority ladder. Its actions carry the same grants, confirmations, and audit rows as everything else.
Paired, bounded, revocable.Each device binds to one family member's account through an explicit pairing step, and can be cut off in one gesture.
Local-first. If a device needs a foreign cloud to function, it does not enter the house. De-cloudable commodity hardware is welcome; tethered hardware is not.
Exit is built in — stated in honest tenses. Today: every Sathi device keeps working if you replace Sathi itself (endpoints configurable, protocols standard, and no device ships until its swap-out guide has been performed for real), and your export is a complete, self-describing archive — your node and its relationships, cryptographically signed, in files you can read. Planned, not yet real: re-creating a running Sathi from that archive in one step. The open framework's bar — exit safe, forking expected, migration inexpensive — is what we are building toward, and we will not claim it early.
A mute that is physical and a kill switch a grandmother can use.

Cameras, honestly

Audio is transient; video is archival — and it captures people who never consented: guests, relatives, the courier at the door. Our family-transparency model rests on explicit interpersonal consent, and an indoor camera strains it past what we are willing to claim today. So the rule is written down: security cameras do entrance duty only, record locally, and arrive after the per-audience consent layer is real; ambient in-room cameras stay off the roadmap until trust — and perhaps the whole culture around such devices — has grown into them. The difference between a trusted interface and surveillance infrastructure is who holds the footage and who can be seen by it. We intend to stay on the right side of that line even when the hardware is cheap.

Curated hardware, honestly

Good smart devices are hard to identify from a marketplace listing — and a family that gets burned by a junk lock blames the idea, not the listing. So where it helps, we will curate: commodity lights, plugs, and sensors, selected and tested by us, carrying the Sathi mark as a promise of curation, not of manufacture. The rule that makes the mark mean something: only devices that work fully locally (open local protocols or re-flashable firmware) get the logo. Safety-critical devices — locks above all — are held to a stricter bar and come last. Custom-built Sathi hardware remains reserved for the few places being first-party matters, the speaker first among them.

Tell us where we're wrong

Device people, security people, smart-home veterans: this page was written to be corrected. Messages go straight to the operator.

Sathi is the reference implementation of the open Altruistic AI architecture.