D4L — Design For Life · R&D

A personal
operating system.

A life generates a record — medical letters, contracts, bank statements, emails, school reports, health data. D4L turns that scattered record into a sovereign knowledge graph you own, queryable across decades, with an attention engine that knows what needs action and an AI interface that has to earn the right to be believed.

Running in daily production for one household — private by design, not on any store
60+ architecture decision records · 50+ automated acceptance suites
The AI proposes. Only a human commits.

How it works Work with us

D4L — a structured, luminous model of a life's record

The Idea

Everyone runs a life. Nobody has infrastructure for it.

A specialist asks when the symptoms started. An administration wants five years of documents. A school thread, a contract renewal and an insurance claim all need chasing this week — and the evidence is scattered across two inboxes, three portals, a filing cabinet and a photo roll. The record of your life exists; it just isn't queryable, and nothing is watching what needs action.

D4L is that missing infrastructure. Every document, email, appointment, measurement and transaction is captured once into a permanent memory — tens of thousands of records and growing. An attention queue is derived from it: what needs action, in what order, escalating as deadlines approach. And an AI interface sits on top: ask a question about any part of your life, across decades, and get an answer with the sources attached.

What It Unlocks

Ask your life anything.

No inbox, folder, portal or app can answer these — because each answer spans all of them. You ask in plain language; every answer comes back with its sources.

"When did the knee pain actually start — and what else was going on that month?"

Clinical letters, years of health measurements and the calendar joined into one timeline, with the source behind every claim.

"Find the boiler warranty, and every message where we chased the installer."

Entity-aware retrieval across documents and correspondence — it knows the company, not just the keyword.

"What exactly did the school confirm about the September start?"

The verbatim wording, from the right thread, with the full exchange behind it — in the original language or translated.

"Did the move actually change our spending — or does it just feel that way?"

A before/after event-study across the household's finances — and an honest refusal if the data is too thin to say.

"What did we decide about the car last year, and why?"

Decisions are permanent records that keep their reasoning and follow-ups attached — the "why" survives the years.

"What needs my attention this week that I haven't noticed yet?"

The attention queue, recomputed from the record itself and escalating toward deadlines — not whatever an inbox happens to show.

Sovereignty

Your record, working for you — not on you.

Most of your record already lives on someone else's servers, and what those platforms choose to show you is optimised for their benefit: engagement, advertising, retention. Not accuracy. Not you.

D4L inverts that. It is a privately owned mirror of your life: facts with provenance, analysis that declares its own confidence, and an attention queue with no agenda — nothing is ranked by what a company gains from showing it to you. The record stays yours: never pooled, never mined, never someone else's training set.

And because the record is the asset, the intelligence is upgradeable. D4L's memory speaks MCP — an open protocol any capable AI model can read. The model is a replaceable component; your data never changes hands to change models. Every time frontier AI gets smarter, your system gets smarter with it.

The Build

One system, five concerns.

Every component answers exactly one question — what is true, what needs action, how do I find it, what do the numbers say, and how does any of it safely change. The discipline of keeping those concerns separate is what makes the whole thing trustworthy.

Memory — two ledgers, nothing else is truth

All authority lives in two append-only ledgers: memory records (what is true) and interaction events (what needs action). Every database, search index, graph and queue is a disposable projection — destroy them all and the system rebuilds them exactly. Wrong data is corrected by a new record, never edited; history stays queryable forever.

Ingestion — runs where the data lives

An always-on cloud node triages Gmail and calendar around the clock. The Mac ingests documents through OCR and extraction, years of health exports, and live data from our own apps over the Firestore API. Every feed keeps a replayable acquisition cache, and the nodes converge by conflict-free two-way sync — no master, no gaps.

Attention — an event-sourced queue

Incoming communication is triaged into one channel-agnostic lifecycle: observed → triaged → drafted → approved → sent → waiting → resolved. The queue itself is a pure function of the ledger — deterministic order, identical on every device. Push notifications are the doorbell, never the state: what needs you is always recomputed from the record.

Retrieval — semantic memory, openly readable

Records carry meaning, not just keywords: the verbatim original and its translation are both searchable across languages, people and organisations are resolved by a deterministic entity registry, and every answer cites its sources. The AI reads it all through a read-only Model Context Protocol surface — open, so the model is swappable — with enforced response budgets and visible errors, never silent truncation.

Analysis — numbers that refuse to guess

A cross-domain analytics layer joins health series, finances and life events, so before/after questions about your own life become computable. A deterministic query engine does the statistics behind hard coverage controls — when the data is too thin it refuses rather than fabricates. The model explains results; it never invents them.

The Trust Contract

The failure mode this layer exists to close: an AI's conversational fluency substituting for ground truth. Automatic pipelines flow into memory freely — but anything subjective can only be proposed, entering through one visible, tamper-proof preview → commit step. Decisions are never minted by a model, and advice on sensitive matters is evidence-gated: no recommendation without proof the primary sources were actually read. All of it enforced at the ledger boundary, not promised in a prompt.

The Bar

Engineered to be trusted with a life.

A system that holds someone's medical, financial and legal record doesn't get to be a prototype. These are the standards D4L is held to — and the same ones we bring to commissioned work.

Decisions on the record

60+ architecture decision records and counting. Every significant choice is written down with the alternatives considered and the reason it won — the "why" survives every session, every refactor, every year.

Forced-failure tested

50+ automated acceptance suites gate the failure paths, not the happy paths: tampered commits refused, impossible state transitions rejected, corrupted configuration fatal on arrival. A test that can pass without doing the work is not a test.

Deterministic by contract

Same ledgers plus same configuration means a byte-identical rebuild — identical IDs, identical indexes, identical queue order. A fixed golden corpus runs the real pipeline end-to-end and is compared field-for-field before any change ships.

It grades its own honesty

A tiered fidelity judge scores the system's AI-generated syntheses against the source artefacts — deterministic screen, model screen, then adjudication. Fabrication is a measured metric with a quality floor, not an assumption.

Drift is never silent

Every change to the record shows up as drift against a blessed baseline and is reviewed by a human before being accepted. Nothing is auto-approved, nothing disappears, and every failure path is loud.

Private by construction

The engine repository is code-only — machine-enforced by a pre-commit guard, not by good intentions. Personal data reaches the cloud only as encrypted semantic memory; original documents never leave the machine they arrived on.

A personaloperating system.