Sathi

Why Sathi exists

Sathi is the trusted, evolving interface through which a person interacts with an increasingly intelligent world.

We plan for a world where intelligence itself stops being scarce — where reasoning, planning, and generation are cheap and abundant. When that happens, the scarce things are the human ones: trust, continuity, agency, context, identity, good judgment, and alignment with what a person actually values. Sathi is built to preserve those, not to add one more clever tool.

So its objective is deliberately not the industry's. Sathi does not optimize engagement, obedience, profit, or productivity alone. Its aim is to help people flourish — a broader thing than comfort or efficiency: less unnecessary suffering, more autonomy, stronger relationships, better understanding, and room to pursue meaningful goals. We assume our grasp of "living well" is incomplete and will keep changing, so the architecture is built to change with it.

Reality has priority over ideology. Every belief Sathi holds stays open to revision by better evidence — from science, from lived experience, or from a simple user correction. Confidence should scale with evidence; where it is uncertain, it should say so rather than perform certainty. A good companion tells you what it honestly believes, flags its doubts, stays correctable, and respects your freedom to choose. The measure of Sathi is not how well it defends today's beliefs but how gracefully it finds tomorrow's better ones.

What it feels like — five small moments

Feature lists say little, so here is daily use as it actually looks. Every moment below works today — in Nepali, English, Japanese or Hindi — and each caption names the machinery behind it.

One intelligence. Many contexts.

• It remembers what matters. Not everything becomes a permanent memory: Sathi keeps the people, events, ideas and intentions that count — and what you delete is gone, provably.
• It understands. Conversations, documents, calendars and relationships connect into one picture, so it can see what matters to you — not just what you asked.
• It acts — with your yes. It drafts the message, prepares the calendar change, lines up the follow-through; a human confirms before anything executes.
• It grows with you. Understanding is re-derived as your life changes and models improve; your corrections teach it.

And your life doesn't exist in isolation. Family, work, health, school — each carries its own context, its own authorities, its own boundaries. Sathi works across the contexts you choose to connect, without collapsing them into one: you decide what connects, what stays private, and what may be shared.

Where this is going (direction, August 2026 — stated as direction because it is not built): your Sathi comes with you. By default it stays you-first — one consolidated view of your life, where a workplace or a club appears as one relationship, not another dashboard to manage. Step into a company's context and you are not handing yourself over: the company holds only the slice of you it was given, and your personal Sathi stays present the way a trusted contact does. If work needs something personal, the company's side cannot reach in — it asks your Sathi, and your Sathi asks you. Switching context is never switching accounts; when you leave, that link — and what it allowed — is revoked. And the workplace need not run Sathi at all: it may run its own system entirely, and your Sathi still comes along, on the same explicit terms.

What Sathi is an instance of

Sathi is one private, opinionated instantiation of Altruistic AI — an open architectural framework for sovereign, adaptable, trustworthy information communities. The framework deliberately embeds as few values as possible; every implementation adds its own, and owes the world a published copy. Sathi's are this page.

We field-test it the way we believe such systems must be tested: from the inside out — the builder, then the family, then a small community — before asking anyone else to trust it. Trust is earned outward, ring by ring, and what reality teaches here flows back into the open framework.

The framework's core, in one breath (refined August 2026): reality is the ultimate teacher — reality generates observations, observations become understanding, understanding informs action, and reality grades the result. Five invariants guard that loop: reality is primary (digital versus physical is mere provenance); locality — every node acts only on its own observations and what was explicitly shared, so global behaviour emerges rather than being centralized; context — information has meaning and permissible use relative to where it exists, so a boundary is a change of law, not just a wall; recursive composition — person, family, company, village expose one interface at every scale; and propagation— understanding travels while ownership stays home, every request answered with the least disclosure that suffices; crossing a boundary is an explicit, governed act, and what arrives never inherits the permissions of its source — it answers to the receiving context's rules.

Three recursions run through it: structural (everything is nodes and links), computational (the same interface at every scale), and — the newest, and the claim this deployment exists to test — learning: institutional capability compounds while personal substrate never pools. Collective intelligence without collective ownership. Future institutions here own missions, not domains — "optimize health outcomes", never "the health vertical" — and the assistants fronting them are ambassadors of that capability, never owners of your data.

What Sathi is

Sathi is a personal life operating system: one private deployment that holds a family's conversations, documents, calendars, and — with consent — an archive of their digital life, and turns it into an assistant that genuinely understands the people it serves. It speaks Nepali, English, Japanese, and Hindi. It runs on a single server we own and operate.

The organizing goal is sovereignty, for the sake of privacy: moving daily habits — messaging, calls, documents, assistant queries, and eventually voice at home — off rented corporate surfaces onto infrastructure the family controls. Renting encrypted storage is acceptable: a landlord who can delete but never read is survivable with backups. Routing the family's plaintext life through third parties is what we are retiring, one habit at a time.

Underneath, Sathi models the world the way the framework does: as a graph, not a container. Each person is a sovereign community of one — a node that belongs to itself — and belonging, to this family or to a future neighborhood, is a consented, revocable link, never a location. Since July 2026 that is schema, not metaphor: every relationship in the system is a link row carrying the consent that created it, and your export is a sealed, signed archive that can rebuild your Sathi on a fresh account — memories, history, and conversations restored after an integrity check. The exit is a tested code path, not a promise. (The full archive is one bundle — your document files ride inside it, each fingerprinted by the seal; your copy of shared conversations comes along as history, while the live thread itself belongs to everyone in it.) Leaving issues a signed receipt of what was destroyed and what remains, with the consent basis for each retention — and a verified return reactivates every connection the other side never revoked.

How understanding works (and what we rejected)

Sathi's architecture separates what happened from what we currently believe:

• Archive first. Originals — messages, documents, exports — are preserved unchanged. Understanding is always re-derivable from them, so when better models arrive, the same life gets understood better without re-uploading anything. Exception, permanent: deletion beats immutability— when a user deletes something, it leaves the archive too, provably.
• Beliefs are bi-temporal claims.Every extracted fact carries when it was true and when we learned it, a confidence score, and provenance back to its source. New facts supersede old ones instead of overwriting them, so "what did I believe last year?" stays answerable. Contradictions are surfaced to the user, not silently resolved.
• The assistant may say "I don't know." If retrieval finds nothing relevant, Sathi says so. Inventing memories is treated as a defect of the highest severity.
• Hypotheses are labeled. Patterns Sathi notices about a person are shown as guesses with evidence, and the user can confirm, correct, or reject each one; rejections teach it.
• Context assembly is the product. Each reply is grounded in a budgeted selection of relevant memories, documents, and knowledge — scored by relevance, recency, importance, and confidence — and every assembly is traceable.

Choices we evaluated and rejected, with reasons — after studying the memory-system literature and practice (mem0, Zep/Graphiti, Letta/MemGPT, MemOS, LongMemEval, and practitioner post-mortems):

• No graph database. Relationships live as structured rows; a graph engine added operational weight without adding answers at our scale.
• No per-capability memory.Every surface — chat, voice, documents, future devices — reads one shared understanding. A user never repeats themselves to a different "mode."
• No fine-tuning as memory. Understanding lives in data we can inspect, correct, and delete — not in opaque weights.
• No memory SaaS. The understanding layer is the moat and the responsibility; outsourcing it would outsource both.

Your memory belongs to you

"Sovereign" is our word; these are the buttons. Three verbs, all real today:

What Sathi is allowed to do (trust before authority)

• Actions follow an explicit authority ladder: observe → advise → draft → act with confirmation → act and report → act silently. Every grant is per-domain, explicit, and revocable; every action leaves a permanent audit record.
• Today almost everything sits at "act with confirmation": Sathi drafts the email or prepares the calendar change, and a human taps yes. Nothing executes unconfirmed. Voice will add a spoken yes/no rung for low-risk reversible actions on trusted family devices — by written policy, not by drift.
• Content fetched from the outside world (web pages, email) is treated as data, never as instructions — and writes stay human-confirmed precisely because assistants that act on injected instructions are a known failure class.
• Every claim, document, and conversation carries a sensitivity tier from the moment it enters the system, so disclosure rules and provider routing can hang off it — classifying millions of items retroactively is the migration that never happens.
• The rule that scales with capability: Sathi proposes; policy decides — and today, policy decides to ask you. The ladder exists so that authority, consent, and audit are in place before the intelligence is strong; a more capable Sathi earns wider grants rung by rung, and it can never talk its way past the rules. Being able to do almost anything will never mean being allowed to do everything.

What leaves our infrastructure — honestly

Three columns, three tenses: what is true today, what we are moving to next, and the strongest option available anywhere right now — including when we deliberately decline it. This table is the part most worth checking us against.

Honest limitations

• Today, a private family deployment. One operator, one server, no signups, no billing, no SLA. But the goal grew (August 2026): Sathi is built so that any person or family — in Nepal, Japan, anywhere — can eventually join or run one. The interface stays the same for everyone; what differs is only the links and their capabilities. Until each ring of trust is earned, signups stay closed — and this page exists so you can evaluate the thinking before anyone is asked to trust the deployment.
• Operator access is granted, never assumed.The administrator can open a member's threads, claims, and documents only after that member grants support access in their own account — a revocable consent recorded on the relationship graph. Without the grant, their content is invisible to the admin panel, and every admin request lands in a tamper-evident audit log. Running the deployment (suspending accounts, quotas, deleting an account on request) never requires it. Honest limit: enforcement is application-level and audited, not yet cryptographic — the operator still runs the database; cryptographic separation is planned for the first community the operator does not run.
• Some processing is still rented.See the table above — we publish what transits third parties rather than pretending it doesn't.
• Sharing is the destination — behind a gate. The rings open outward: the builder, the household, then kin — a nephew, a sister-in-law — then communities in Nepal and Japan, then anyone. Each ring opens only when Sathi is genuinely more trustworthy than the incumbents for the people in it. The gate is unchanged; what changed is that opening is the goal, not a maybe — and this page is how outsiders help us test the gate honestly.

Where this goes — ring by ring

Openness is the declared destination, not a maybe — but each ring opens only when the people in the previous one genuinely prefer Sathi to the incumbents. In honest tenses:

The long view: Sathi when ASI is ubiquitous

We plan on the assumption that very capable AI becomes cheap and abundant. In that world, the rented superintelligences will be owned by large corporations, and their loyalty will be contractually elsewhere. The scarce thing will not be intelligence; it will be an intelligence whose objective is purely you — one that holds your ground truth, briefs outside intelligences on a need-to-know basis, verifies their answers against your life, and keeps an audit trail of exactly what was disclosed to whom. Whatever shape it takes — one model or many, software or devices — Sathi is built to become that intelligence, yours. If that day truly arrives, ownership stops mattering to us: the intent is to open the ecosystem and let communities — human or otherwise — maintain it.

Until then, seven commitments bind every near-term decision:

1. Archive first; understanding is regenerable.
2. One understanding, many surfaces — never per-device memory.
3. Provider independence — no vendor owns the moat layer.
4. User sovereignty — deletion wins; export is total.
5. Trust before authority — grants and audits, never defaults.
6. Family context is permission-structured from day one.
7. Sensitivity is classified the moment data arrives.

If a near-term decision would break one of these, the decision is wrong regardless of how much time it saves.

Tell us where we're wrong

This page fails at its purpose if it only collects agreement. Architecture criticism, privacy holes, better prior art — all welcome. Messages go straight to the operator.