D4L

D4L — Design For Life · R&D

A personal
operating system.

A life generates a record — medical letters, contracts, bank statements, emails, school reports, health data. D4L turns that scattered record into a sovereign knowledge graph you own — then governs the decisions on top of it. It reads what each new event means, checks it against the rules you've ratified, and either handles it, recommends, or asks. It can propose anything. It legislates nothing.

  • Running in daily production for one household — private by design, not on any store
  • 70+ architecture decision records · 140+ automated acceptance suites
  • The AI proposes. Only a human legislates.
How it works Work with us
D4L — a structured, luminous model of a life's record

The Idea

Everyone runs a life. Nobody has infrastructure for it.

A specialist asks when the symptoms started. An administration wants five years of documents. A school thread, a contract renewal and an insurance claim all need chasing this week — and the evidence is scattered across two inboxes, three portals, a filing cabinet and a photo roll. The record of your life exists; it just isn't queryable, nothing is watching what needs action, and every decision starts from a blank page.

D4L is that missing infrastructure. Every document, email, appointment, measurement and transaction is captured once into a permanent memory — tens of thousands of records and growing. An attention queue is derived from it: what needs action, in what order, escalating as deadlines approach. An AI interface sits on top: ask a question about any part of your life, across decades, and get an answer with the sources attached. And above all of that runs a decision layer — one that recognises what an incoming event means, matches it to the judgement you've written down as policy, and acts only within the bounds you've set.

The Principle

One organising idea holds the whole thing together.

A system trusted with a life needs a spine — a small set of laws that every part obeys and no feature is allowed to break. These five are enforced in the architecture, not promised in a README.

What It Unlocks

Ask your life anything. Then let it act.

No inbox, folder, portal or app can answer these — because each answer spans all of them. You ask in plain language; every answer comes back with its sources. The last two aren't questions you ask — they're the system doing its job.

"When did the knee pain actually start — and what else was going on that month?"

Clinical letters, years of health measurements and the calendar joined into one timeline, with the source behind every claim.

"Find the boiler warranty, and every message where we chased the installer."

Entity-aware retrieval across documents and correspondence — it knows the company, not just the keyword.

"What exactly did the school confirm about the September start?"

The verbatim wording, from the right thread, with the full exchange behind it — in the original language or translated.

"Did the move actually change our spending — or does it just feel that way?"

A before/after event-study across the household's finances — and an honest refusal if the data is too thin to say.

"What did we decide about the car last year, and why?"

Decisions are permanent records that keep their reasoning and follow-ups attached — the "why" survives the years.

"What did I promise people — and what's now overdue?"

Every commitment made in a message is tracked to its deadline. What you owe and what you're owed, chased before it slips — with a reply already drafted.

"Which insurance was active the day of the accident — not the one we hold now?"

Point-in-time reconstruction: the record answers as of any past date, because nothing is ever overwritten — only superseded. A life you can rewind.

it actsA receipt arrives.

Matched to your ratified policy, filed under Finances, kept as evidence, and never queued — unless it's over the threshold you set, which surfaces it. No attention spent.

it asksA school closure lands on a day you have the kids.

The conflict is spotted against the calendar, marked in the diary, and raised as a recommendation with the reasoning — a real decision, so it proposes and waits for you.

Sovereignty

Your record, your judgement — working for you, not on you.

Most of your record already lives on someone else's servers, and what those platforms choose to show you is optimised for their benefit: engagement, advertising, retention. Not accuracy. Not you.

D4L inverts that. It is a privately owned mirror of your life: facts with provenance, analysis that declares its own confidence, and an attention queue with no agenda — nothing is ranked by what a company gains from showing it to you. The rules it acts on are yours too — written in plain language, ratified by you, changed by no one else. The record stays yours: never pooled, never mined, never someone else's training set.

And because the record is the asset, the intelligence is upgradeable. D4L's memory speaks MCP — an open protocol any capable AI model can read. The model is a replaceable component; your data never changes hands to change models. Every time frontier AI gets smarter, your system gets smarter with it.

The Build

One system, four governed layers.

The whole system is a one-way stack. Reality is the ground truth. Interpretation reads it to work out what's happening now. Action decides what to do about it, within your policy. Learning watches how you respond and proposes better rules. Each layer draws only on the ones beneath it — and the only path that ever writes upward runs through a human. Around the edges sit the loops that keep it honest: a fidelity judge that scores every AI synthesis against its sources, and a ratification gate no proposed rule can skip.

REALITY what is true Events Memory Time INTERPRETATION what it means Situation never stored · recomputed Variance vs what matters ACTION what to do Policies your judgement Actions reversible only Advice with proof LEARNING how it improves Draftsman drafts a rule You ratify or you don't Outcomes recorded JUDGE fidelity scores AI vs source propose · you ratify derived ✕ evidence Reality → Interpretation → Action → Learning · each layer reads only the ones before it the human is the only gate that writes upward

Reality — two ledgers, nothing else is truth

All authority lives in two append-only ledgers: memory records (what is true) and interaction events (what needs action). Every database, search index, graph and queue is a disposable projection — destroy them all and the system rebuilds them exactly. Wrong data is corrected by a new record, never edited; the past stays queryable exactly as it stood on any date — a life you can rewind, never overwrite.

Ingestion — runs where the data lives

An always-on cloud node triages email and calendar around the clock. The Mac ingests documents through OCR and extraction, years of health exports, and live data from our own apps over the Firestore API. Every feed keeps a replayable acquisition cache, and the nodes converge by conflict-free two-way sync — no master, no gaps.

Interpretation — a situation nobody stores

Every incoming event is read for what it means: information to remember, a change to your situation, or a variance from what you expected. The situation itself — what's true and open right now — is recomputed from the record on every call and then discarded. There is no situation cache to drift, no stale belief to correct.

Attention — an event-sourced queue

Incoming communication is triaged into one channel-agnostic lifecycle: observed → triaged → drafted → approved → sent → waiting → resolved. The queue itself is a pure function of the ledger — deterministic order, identical on every device. There is no push and no badge demanding attention: a home-screen widget you glance at on your own terms pulls a fresh digest from the record on every read, holding no state of its own — so what needs you is always recomputed from the ledger, never carried in a notification.

Action — decisions governed by policy

Your judgement, written down as explicit policies the system matches each event against. Before it recommends anything, it resolves whose job an item even is — yours, the other party's, shared, or genuinely unknown — deterministically from the evidence, never a classifier's guess, and "unknown" is a legitimate answer that quietly takes work off your plate. On its own it takes only deterministic, reversible steps — file, mark, surface; anything that sends, deletes or commits waits for you behind a human gate. Promises are tracked as first-class state: what you owe, what you're owed, chased with a draft the moment a deadline slips. New behaviour like this runs in shadow for weeks — changing nothing you see — until the evidence says enforce.

Retrieval — semantic memory, openly readable

Records carry meaning, not just keywords: the verbatim original and its translation are both searchable across languages, people and organisations are resolved by a deterministic entity registry, and every answer cites its sources. The AI reads it all through a read-only Model Context Protocol surface — open, so the model is swappable — with enforced response budgets and visible errors, never silent truncation.

Analysis — numbers that refuse to guess

A cross-domain analytics layer joins health series, finances and life events, so before/after questions about your own life become computable. A deterministic query engine does the statistics behind hard coverage controls — when the data is too thin it refuses rather than fabricates. The model explains results; it never invents them.

Learning — the system drafts its own rules

When it notices how you keep handling something, a draftsman writes the rule in plain language and proposes it — never a bare "suppress this", always a workflow you can read. Nothing changes how the system behaves until you ratify it, and low-stakes proposals batch into a weekly review. Decisions keep their outcomes attached, so the judgement gets better with evidence.

The Trust Contract

The failure mode this system exists to close: an AI's conversational fluency substituting for ground truth. Automatic pipelines flow into memory freely — but anything subjective, and every new rule, can only be proposed, entering through one visible, tamper-proof preview → commit step. Decisions are never minted by a model; advice on sensitive matters is evidence-gated — no recommendation without proof the sources were read. The AI proposes; only a human legislates. Enforced at the ledger boundary, not in a prompt.

And underneath all four layers, one substrate. Sources flow into the two ledgers; every projection — including the live situation — is rebuilt from them; the AI reads through a read-only surface and can only ever propose a change back.

Email Calendar Documents Health App data TWO APPEND-ONLY LEDGERS memory what is true attention what needs action search index knowledge graph analytics mart situation disposable projections — rebuilt byte-identically; the situation is never even stored read AI — any capable model read-only MCP · provenance on every answer propose · human commits no push — a glanceable widget pulls a live digest from the ledger on every read

The Bar

Engineered to be trusted with a life.

A system that holds someone's medical, financial and legal record — and acts on it — doesn't get to be a prototype. These are the standards D4L is held to, and the same ones we bring to commissioned work.

Decisions on the record

70+ architecture decision records and counting. Every significant choice is written down with the alternatives considered and the reason it won — the "why" survives every session, every refactor, every year.

Forced-failure tested

140+ automated acceptance suites gate the failure paths, not the happy paths: tampered commits refused, impossible state transitions rejected, an unratified rule that tries to execute stopped cold. A test that can pass without doing the work is not a test.

Proven in production, not just in tests

A green test proves the code is consistent — never that the control actually ran where it matters. A dedicated assurance layer proves each control independently: that it is present and can block, that it executed, that it received the evidence it needs, and that it governs the live production surface at the serving commit — then retains the proof, which expires by itself when the code changes. The assurance layer is itself forced-failure tested: it caught a control that had silently gone missing, then proved the fix.

Deterministic by contract

Same ledgers plus same configuration means a byte-identical rebuild — identical IDs, identical indexes, identical queue order. A fixed golden corpus runs the real pipeline end-to-end and is compared field-for-field before any change ships.

It grades its own honesty

A tiered fidelity judge scores the system's AI-generated syntheses against the source artefacts — deterministic screen, model screen, then adjudication. Fabrication is a measured metric with a quality floor, not an assumption.

Drift is never silent

Every change to the record shows up as drift against a blessed baseline and is reviewed by a human before being accepted. Nothing is auto-approved, nothing disappears, and every failure path is loud.

Private by construction

The engine repository is code-only — machine-enforced by a pre-commit guard, not by good intentions. Personal data reaches the cloud only as encrypted semantic memory; original documents never leave the machine they arrived on.

Why It's Here

R&D, not a product.

D4L isn't on any store — it runs privately, for one household, on its own data. It's on this site because it's the clearest statement of how we build: systems where the AI is genuinely powerful but never blindly trusted — free to propose anything, allowed to legislate nothing. If your problem needs that level of engineering, we should talk.

Work with us