Overview

• What it is: Existential is a local-first AI for people who think for a living. Its Oracle, one presence made of many small agents, reads and tends a person's own notes on their own machine, and lets teams think together. Your own files never leave your machine. What you choose to share with a team is sanitized before it leaves, and lives in infrastructure the team controls. With the person's consent, the Oracle can think in a cloud model instead. Private notes stay on the Mac unless the person allows otherwise, and keeping everything on the Mac is always one of the choices.
• My role: co-founder and CTO. I imagined, researched, designed and built Existential as a one-person design and development team, and wrote its protocol specification.
• The question behind it: how can people let an AI into their thinking, alone and together, without giving up control, authorship or privacy?

Where it came from

For years my notes and voice memos outgrew every way I found of filing them; keeping them in order took more attention than thinking with them. In the research collectives I worked in, the tools took more attention than they returned, and summaries began to stand in for the documents they summarized. As I put it in my notes: "I was spending more time trying to account for the work that I was doing than actually performing the work."

Death Dialogues named semantic coordination failure, the way people coordinating across fields use the same words while meaning different things. That observation is the thesis Existential is built on. My WisCAM research, on a kind of value that grows when it is shared, is the direct antecedent of the Existential Protocol.

Six earlier proofs of concept taught two lessons that run through everything below. A rule written into an agent's instructions is a request, not a guarantee, so anything that must hold is enforced in the architecture. And infrastructure built before its experience is designed produces a system nobody can use.

How I researched it

I studied five things: my earlier proofs of concept; the literature on trust in automation, privacy, memory and governance; the products already in the field; the note tools people use today, tested by hand; and my own working days.

Decision	What the research found	Where it shows
Earned autonomy	An assistant that always asks becomes an inbox; one that never asks claims unearned trust. People hand over control last.	Rules set to Acts or Asks; every change undoable
Privacy enforced in code	Running locally is not privacy on its own, and an instruction is not a constraint.	Checks at every boundary; consent before any cloud model
Insight for the person	Memory tools fetch context for a model, not for the person. Priorities change daily.	A morning brief; insight beside the note; cited answers
The non-technical member first	Infrastructure-first systems were unusable. Nothing paired local AI with upkeep of the notes people already keep.	Six plain places; a first hour on the person's own folder
Whose words are whose	Summaries stood in for the work. Clipped material is reference, not authorship.	Every passage marked as yours, someone else's, or the Oracle's
Teams and the public face	No tool let a group publish as a team, keep authorship private and still credit its members.	Private views first; dissent kept; approval before publishing

Up close: an AI that earns its autonomy

The decision I spent longest on is how much the Oracle may do on its own. Both easy answers fail. An assistant that asks before everything becomes another queue to clear; as the Existential manifesto puts it, "a system that asks permission for every act becomes one more inbox." An agent that never asks, as my own early user story imagined ("The Oracle never asks for permission or approval"), claims trust it has not earned. The research on trust in automation points between them: people extend trust in stages, first to competence, then to transparency and good intent, and hand over control last. The aim is appropriate trust, not maximal trust.

So the Oracle earns its autonomy, and the line between what it may learn to do alone and what it must always ask is whether the act can be taken back.

It starts from rules a person can read. Setup asks a few plain questions while the models download, and the answers become the Oracle's first rules.

It acts under a rule, only there, and says what it did. Each morning the brief reports the night's changes in a sentence, with Undo all. Done for you lists every change with the rule that made it and its own Undo, and a failure shows as a failure, with its reason. If a person keeps undoing the same kind of change, the Oracle asks whether to stop doing it there.

It asks less only when the person agrees. When it has done something the same way often enough, it proposes a rule ("Name the rest of your meeting notes date-first?"), says exactly what a yes would change, and lets the answer be taken back. Trust is earned per kind of action and per place, so earning it for filing says nothing about sharing. Every rule sits on a page the person can read, edit, and switch between Acts and Asks.

Some things always ask. Deleting anything, spending money and sending anything off the Mac wait for the person, whatever the Oracle has learned. These are the acts a person cannot fully take back. Everything else is visible as a rule, reported as a sentence, and undoable.

Four more decisions

Privacy enforced in code, at every boundary

Running on the person's machine is not privacy on its own: the numbers a model uses to compare passages can be turned back into text, and an instruction to an agent can be ignored. So each scale has its own store, and nothing moves between them except through code every contribution must pass. As the white paper argues, a system that kept private thinking and public contribution "in one graph could never detach them afterward." Choosing a cloud model starts with a card that says what would leave and where.

Insight for the person, not context for a model

The memory tools I surveyed fetch context for a model; none served the person reading. The Oracle works the other way. The morning brief says what the person's own work is doing, and the day's order comes from what they say matters, because my own priorities changed sharply from day to day. Beside an open note sit passages from the person's own work that support or push against it. Ask answers with numbered sources and shows nothing until a second reader has checked it. There are no scores, badges or streaks: a number people can see becomes a target.

The non-technical member first

I designed for a student, artist or researcher with a chaotic folder of notes who has never used an AI agent. Every core feature had to work, and explain itself, with no AI vocabulary and no integrations; integrations are a layer for power users. The places are named for what a person does: Today, Waiting on you, Projects, Notes, Map and Ask. Testing other tools by hand showed the value of guided setup and of meeting people in the notes they already keep, so the first hour is spent on the person's own folder: one finding worth having, and one small piece of tidying, with Undo.

Whose words are whose

This answers the problem I started from. Every passage is marked as the person's own, as someone else's with its source, or as written by the Oracle, naming the agent; the Oracle's additions never count as the person's. A clipped web page is kept as reference, not authorship, apart from the person's own note about it.

Teams and the public face

Most thinking happens with others, and there the same three questions get harder. A team gets a shared memory, its inner mind, in a repository the team controls; its history names the team's Oracle rather than who wrote what, and members appear by default under a separate pseudonym in each team. An organization gets a public voice, its outer mind. A person decides what crosses from their machine to a team, and a team decides what its organization says in public. I found no tool that let a group publish as a team while keeping authorship private and still crediting its members, and that gap shaped this layer.

Decisions are where semantic coordination failure shows. Each member writes a view privately first, drafted with the Oracle on their own machine; the team then sees where its camps agree before any vote, and dissent is kept in the members' own words.

The public face is where the outer mind publishes. Only settled decisions can be promoted, every draft waits for the members' approval, any member can object, and there is no Publish button: the last approval publishes. Each publication goes out signed, after a hygiene check and a leakage judge on a separate model family.

What I built underneath

The interface sits on a system I built and keep in daily development.

• Reading. A twelve-stage pipeline on the person's own machine: concept extraction, embeddings, deterministic scoring and graph clustering. Every saved note is split into passages, linked to related concepts and notes, and scored by how much the rest of the person's thinking leans on it, by formula rather than a model's opinion.
• Privacy in code, not policy. At every boundary a contribution crosses to a team or the public: a deterministic identity scrub, sanitizing, a check by a second, differently built model, and a hold on anything that fails. Each check is code a contribution must pass, not a promise.
• Publishing. An Oracle that composes public documents from private material, behind a hygiene check and a leakage judge on a separate model family, published in one signed step.
• Deliberation. Signed, recorded conversations between organizations' Oracles, exercised between test Oracles.
• Anonymous attestation. A full attest, verify and revoke cycle on the Ethereum Attestation Service and Semaphore, on a test network, recording that a team member produced an insight without naming them.
• The protocol. The Existential Protocol v0 specification: seven parts, forty-one ratified rulings.

You can follow Existential at existential.ing.

Reflection

Designing an AI for someone who doesn't trust AI changed what I think its interface is for. It isn't there to show how much the system knows. It is there to show its work, keep almost everything undoable, and let nothing leave without consent, for a person and for a team.

I built it this way because I was its first member. My thinking had outgrown my tools, and my work with others kept disappearing into summaries. I wanted a system that gives that attention back and keeps each person's words their own, whether they stay on the Mac or go out under a team's name.

The screens show Existential's interface with invented notes, names and teams.