Project GodBrain

Local-first Jarvis on this Windows machine. The mouth is an OpenAI-compatible loopback server. Desk generate is Qwen 3.8 27B EXL3 on :8888 (qwen3.8-27b-exl3-3.5bpw). llama-server and GGUF usage have been temporarily stopped from being used because of recurring IMA problems.

16 GB GPU's has a max ability for one generate slot. Colibri is a possible interchangeable alternative, due to it not relying on GPU VRAM, but not recommended as the daily mouth.

No commercial -cli wrappers and no MCP-servers. Models inherit the same Golden Records, and the custom kernel adds tools a stock server will not give you.

TLDR

The GodBrain turns local models into a shared, sovereign cognitive system. The core idea:

• 🧠 Model-agnostic mouth — Plug in an OpenAI-compatible /v1/chat/completions server. Desk default: Qwen 3.8 27B EXL3 on :8888.

• Not an arbitrary chat API. No model is special; they inherit the same teachings.

• 📚 Models teach models — Librarian writes candidate Golden Records; you /verify or /reject. Chat retrieves committed teachings through rag-service (:8084), so the next model does not start from a blank context. That is the query path — not a Mongo shell.

• 🛠️ Tools the kernel runs — All tools are built into the C++ kernel, so you don't need 40 different MCP servers.

• Galaxy GUI chat sends those tool rounds to the EXL3 on :8888. A pasted crash plus the word fix gets eight rounds and does not open elevate. command_types (save/recall, skills, host observe, telemetry, privileged PowerShell) still need GODBRAIN_API_TOKEN plus a non-blank reasoning. Bounded /edit is a separate chat door, not a command_type.

The Compute Cheat Code (vault ≠ GPU)

Mongo + RAG-service is the vault. The mouth is just compute. A bigger card, a future cloud ingest, or a 512GB Mac Studio can still read the same Golden Records because of the json format being enforced by the librarian. This machine has one generate slot (Qwen 3.8 27B EXL3 3.5bpw on the 16 GB card). A 3090 replacing the 4080 would still use a single slot, not a second mouth and not a silent swap to GLM MoE.

Hybrid ingest is real: drop a source in inbox\ or POST /api/librarian. The local mouth extracts candidates. You crown them. Cloud models do not skip /verify, do not get a Mongo shell, and do not run wsudo. Privileged PowerShell still needs bearer + reasoning. Heal does not DISM, rewrite the registry, or patch a fleet.

See it running

Galaxy on this host: 3D graph, This host / Pending on the left, mouth and no-GPU glance buttons on the right.

How it works

GodBrain routes tool calls through a native C++ kernel instead of patching a specific inference server's chat template. The mouth must already be an OpenAI-compatible loopback server. Desk generate is currently EXL3 on :8888. llama-server on :8000 stays paused. Colibri is the interchangeable alternative. This host does not call a commercial API, and .vscode/mcp.json is empty on purpose.

• godbrain_core/cpp_kernel/main.cpp hosts the HTTP API (bound to 127.0.0.1 only): Galaxy chat, no-GPU glances, /edit, and privileged command_type JSON. /edit is a chat door with an allowlist, not a command_type.
• godbrain_core/cpp_kernel/kernel.cpp (GodBrainKernel::dispatch / validate_sovereignty) is the Circuit Breaker: it intercepts high-risk command_types, requires a non-empty reasoning field plus a matching GODBRAIN_API_TOKEN bearer token, and only then dispatches the command.
• godbrain_core/cpp_memory_store is the desk Alexandria write/retrieval path (memory-store.exe / rag-service.exe on :8084). Go godbrain_core/memory_store stays as rollback with the same doors.
• LLM/colibri_LLM (Colibri, the C-engine) is one of the interchangeable local models GodBrain drives — it is not special-cased into the memory or execution layers.

Repository map

This tree is a desk runtime plus a released kit plus research. Maturity is source / offline gate / daily-driver, not "the folder exists."

Surface	Maturity	Notes
C++ kernel + Galaxy (godbrain_core/cpp_kernel, godbrain_core/frontend)	daily-driver on this host	:8083, /edit, privileged command_type
C++ Memory Store	daily-driver	:8084 Golden Records; Start/Heal prefer build/cpp_memory_store/Release
Memory Store / rag-service (Go)	rollback	Same stdin/HTTP exe names; do not delete
Heal / Watch / Start-GodBrain.ps1	daily-driver	one loop; WMI children get Mongo DB name + embedding identity, not GODBRAIN_RAG_PORT
Reclaim11	released kit (v12)	Windows repair ISO/zip; not the Jarvis loop
Desk panel (scripts/Show-DeskMenu.ps1)	daily-driver	Tray window: port status, EXL3 27B text vs 8B vision, ask :8888, lyrics record / Whisper again / lock in
Lyrics loop (scripts/lyrics_loop.py)	daily-driver	CPU Whisper. Audio and state.json stay in C:\nvme\stt\lyrics. Door: scripts\Invoke-LyricsLoop.ps1
Frontend University	mastery ladder + React God + visual God (seeded canvas, anti-generic)	React (Next for sites, Vite for apps); Qwen on :8888 is the learner; C++ Carmack is a later GO
local_ingestion	source implemented	adapter; no Mongo writes from Python
Go router / Rust router	experimental, parked	:8082; not Heal; not this quarter
polymarket_paper, polygon_*	paper / read-only	no live orders, no wallet
smart_contracts	Foundry tree	forge validate; not desk runtime
LLM/colibri_LLM	vendored mouth	interchangeable generate engine

The runtime default is one loop, not an agent graph: discover → plan → execute → verify. Heal/Watch keep :8084/:8000/:8083 up. Oracle chat generates; /verify last / /reject last is the check for playbooks and fights. Host inventory verifies its canonical sensor read. /api/truth keeps caller claims candidate; a matching probe or documentation quote verifies only a separate, source-bound observation, not the caller's interpretation. Librarian distills transcripts to candidates. The bottleneck is the verifier, not the model. A second node is allowed only when a named signal pays for it (Architect vs Surgeon, a second inference runner behind the same kernel door, or a future candidate-vs-verified conflict queue). EXL3 on :8888 is the desk mouth. Colibri and a paused llama-server are other runners behind that same kernel door, not a mesh.

Large changes follow a contractor gate: investigate the repo, state a goal and falsifiable assumptions, ask at most three blocking questions (each with a default), then implement. One-liners skip the ceremony. Verify on the live ports, then persist. The next loop starts from git and Golden Records, not from chat history.

Ingest is the same loop with a stricter write rule: raw sources stay immutable; Librarian extracts new claims, not a recap; contradictions are flagged on both sides and never silently overwritten; open questions stay questions. Chat and any digest read the processed Golden Record layer, not the raw transcript pile. Routine extract uses the cheap local runner; a heavier model is only for a flagged fight or a high-stakes synthesis.

Golden Record RAG status

Golden Records are the manual: crowned facts the mouth RTFMs instead of scouring the internet. Retrieval ranking among verified cards is "which page," not "what most pages said." Candidates and raw web text are not Oracle truth.

Layer 3 is implemented. The production C++ kernel and the parked Go/Rust routers retrieve prompt context only through http://127.0.0.1:8084/v1/search. They validate the generation and hybrid-v1 contract, preserve bounded citations and trust labels, and wrap retrieved text as explicitly untrusted reference data. If the service is unavailable, unready, malformed, oversized, or returns no usable context, and this kernel process has no usable session notes, chat fails closed before a model is started. Ordinary conversation and /remember notes remain explicitly untrusted local continuity, not verified knowledge. Personal notes never enter technical prompt context. RAG-derived references are rechecked through /v1/document before prompt or session-recall use: verified status, identity/version, complete-content hash and applicable live Windows pin must still match. Missing, retired, changed or unreadable origins are withheld with explicit reasons; unrelated local notes survive. At most three bounded origin reads run outside the session mutex. An authorized judgment makes a saved local note require its matching current origin; a local status string alone cannot make it verified. RAG-free file, edit and No tools advisory requests do not perform these reads. Every ordinary runner receives actual evidence within a shared 4 KiB budget, including follow-ups with prior chat history. Clipping preserves UTF-8, escaped values and the closing untrusted-data marker; the optional session pointer cannot crowd out evidence. They do not fall back to the old nodes collection. Galaxy graph and node lookup use the same service (/v1/graph, /v1/document) and the active rag_documents generation.

Lexical/metadata retrieval remains the zero-configuration canonical fallback. An optional exact-loopback OpenAI-compatible embedding provider enables generation-versioned embeddings and deterministic hybrid RRF over a bounded 4,096-document exact-cosine backend. Health and search responses state the exact mode and degradation reason; they never claim hybrid when the provider, model identity, projection, or bounded backend is unavailable. The checked-in synthetic fixture currently measures Recall@K, MRR, and nDCG@K at 1.0 with zero hidden-record leakage. These are reproducibility checks for the deterministic fake provider, not real-model quality claims. Privileged command_type dispatch remains a separate C++ request path protected by the configured bearer token and sovereignty checks.

Kernel command_types

These are the first-class commands the C++ kernel currently validates and dispatches (JSON on :8083, not an IDE MCP server):

Tool	Purpose
save_godbrain_thought	Candidate Golden Record via memory-store.exe
query_recent_thoughts	Newest active-generation rag_documents
query_godbrain_skills	Promoted skills only (untrusted procedure + evidence profile)
record_godbrain_skill_run	Append harness evidence (skill_verification_runs)
promote_godbrain_skill	Promote after origin is verified and a passing run exists
set_godbrain_status	verified / rejected / stale with reasoning
observe_godbrain_host	Windows inventory + os_pin; auto-verified sensor
promote_godbrain_claim	POST /api/truth host_fact / doc_fact / playbook
get_system_telemetry	Hardware/system awareness
execute_godbrain_script	PowerShell (requires reasoning + bearer)
propose_sovereign_architect_change	PowerShell (requires reasoning + bearer)

/edit is not in this table. It is an allowlisted chat apply, recorded as local-edit-apply-v1, and cannot promote a skill.

Why the sovereignty check matters

The mouth can emit these tool calls, but execute_godbrain_script, propose_sovereign_architect_change, record_godbrain_skill_run, and promote_godbrain_skill are high-risk: the kernel rejects them unless the payload carries a non-blank reasoning string and Authorization: Bearer matches GODBRAIN_API_TOKEN. Ordinary loopback GET glances stay unauthenticated. Chat writes fail closed until GODBRAIN_API_TOKEN is set. Every route on the existing Tailscale shortcuts listener needs the bearer, including GETs. The separate read-only Phone Desk accepts the exact device-owner identity from its authenticated Tailscale service/worker TCP connection; spoofed local headers are denied. It exposes no chat/control routes.

The bigger picture

Karpathy's second brain is cute for taking notes. GodBrain is the same idea with a judge: raw sources stay immutable, Librarian extracts claims as candidates, you /verify or /reject, and the next model inherits the processed Golden Records — not the transcript pile.

Two product wants that are not notes:

• Replace any need for use of the Claude, Codex, Copilot, Gemini-cli and similar on this host.
• GodBrain is the local agent loop you own: Galaxy + C++ kernel + one mouth. Hands are compiled into local_tools.cpp, not an MCP/plugin catalog.
• Copilot's Filesystem + Desktop Commander list was existence proof, not a stack to import.
• Do not dual-run. llama-server is an interchangeable generate engine; a GodBrain fork might be made later, only if ggml sunsets or blocks the tool path.
• Kernel tools and judge stay here so a vendor CLI dying does not take the desk with it.
• Replace the web-dev loop on this repo. Galaxy, Tailscale glances, Shortcuts, and allowlisted /edit should grow until you do not hire someone to ship GodBrain UI.
• That is a destination, not "no sandbox, write anything."
• Models teach models over time. Chat already retrieves committed teachings through rag-service (:8084). query_recent_thoughts and /recall list newest projected nodes; /recall <query> searches verified Golden Records through that same API — not mongosh, not a MongoDB IDE/MCP plugin against the live vault.

On this host it is one Windows loop, not Ring 0, not a Distributed Cognitive OS across Devuan/macOS, and not zero permission-begging. The vault is decoupled from the GPU. The operator is not.

Working today

Shipped on this desk, not slideware:

• One loop — Heal/Watch keep :27017 / :8084 / :8000 / :8083 up. Discover → allowlist start → verify. Heal does not kill, reboot, DISM, or run the repair cocktail.
• Teachings in and out of Mongo — Librarian → memory-store (candidate only, fail-closed JSON). Chat/Oracle retrieve through rag-service, never by giving the model a Mongo shell. Oracle search is verified-only.
• Judge — /verify /reject for playbooks and fights. Host probes and Learn quotes auto-verify when the evidence actually matches. That is how the mouth is fostered: crowned option next time, not token-chase from weights (ASCII instead of a BIOS map, shiny instead of a click path).
• Bounded file work — /edit writes root .ps1 / .cmd / .md, scripts\, docs\, godbrain_core\. Not vendor/build/LLM/archive. Never git push from the mouth. Chat tools (OpenAI tool_calls, kernel executes) cover %USERPROFILE%, %APPDATA%, %LOCALAPPDATA%, %ProgramData%, %ProgramFiles%, %ProgramFiles(x86)%, C:\Tools, and C:\Temp\GitHub the way Copilot Filesystem+Desktop Commander do in VS Code: list/read/write/search/edit, run_pwsh, console SysInternals / reg query / ETW / schtasks /Query. /yolo N adds mutate + MinSudo/wsudo -A. Not --ti, not pskill/PsExec, not MFIT, not a Mongo shell.
• Privileged PowerShell — execute_godbrain_script / propose_sovereign_architect_change need bearer + a non-blank reasoning. That is pwsh via the kernel, not Visual Studio as a tool.
• Operator glance — scripts\Show-SystemFlex.ps1 (flex on this desk). Host chrome, not /brief, not Heal.
• Desk panel — scripts\Show-DeskMenu.ps1 returns the caller's shell and opens its own hidden STA GUI host. Status and Ask run asynchronously without overlapping requests. The panel resizes/maximizes, keeps reply line breaks and expands the Ask area. Picture Ask uses thinking off, temperature zero and a 2,048-token response ceiling. Pick text/vision on :8888 or Qwen-Image-2.1 on :8871; image editing uses a bounded, final-handle-jail-checked input file. Progress shows real diffusion steps and saved request-specific receipts. Disposable image workers exit before completion so Windows releases native RAM/VRAM. Saved context/KV/MTP/vision profiles apply only on explicit Start; complete-file review stays read-only and candidate. Native Dell S2522HG controls and global F9 replace DDM; Dark Stabilizer cycles without claiming a current level. The separate Serve row reports the private background Phone Desk mapping; explicit Tailscale Start preserves it or creates it only when entirely unconfigured. Existing file/folder Ask stays available. X hides; the power glyph quits. See Desk guide and the DDM command map.
• Phone Desk — A small read-only iPhone/Android overview: model/profile, global VRAM, RustDesk, Tailscale, SSH, core listeners and passive STT/TTS/CPU OCR health. One static page and a separate 127.0.0.1:8085 listener inside the C++ kernel, privately proxied by Tailscale Serve. Speech cards distinguish available local assets, successful requests and backend errors. Refresh never loads weights, generates, starts or repairs anything; stale/error data cannot look ready. No Node production backend, phone app build, browser token or public Funnel.
• RustDesk phone button — scripts\Start-RustDesk.ps1 explicitly restores a missing installed service entry (LocalSystem, Manual), starts it and verifies the enabled SYSTEM --server child. Existing startup settings are preserved. It avoids the native installer's logon shortcut and image-name kills. iOS Shortcuts or an Android SSH client can invoke it; open RustDesk only after the success receipt, then select the PC.
• Manual CS2 / AFK policy — CS2 releases the identified model slot, pauses gym/automation, disconnects Tailscale, launches Steam and returns; no automatic post-game resume. AFK Watch is operator-enabled, host-only by default, with optional Qwen/gym recovery behind the same loop and crash/CUDA latches. Explicit Stop holds are preserved; no new service ACLs or task elevation.
• Lyrics — scripts\lyrics_loop.py through scripts\Invoke-LyricsLoop.ps1. Two CPU Whisper passes, lock the lines that agree, redo only the draft. Recordings stay on C:\nvme\stt\lyrics. The 4080 is not used.
• Autonomous frontend practice — scripts\Invoke-FrontendGym.ps1 -Continuous runs local learner/tutor attempts against a protected browser evaluator.
• Failures feed repairs; passing source and evidence become reusable gym examples without operator code review. This is not authority to modify Windows.

The verifier is still the bottleneck. Privileged doors existing is not "the hard part is done."

Your iPhone or Android can be the remote desk

The phone is the control surface; the models, files and compute stay on the Windows PC. Tailscale supplies private reachability, SSH runs your existing PowerShell commands under your authenticated Windows account, and RustDesk supplies the full interactive desktop when you need it.

From your phone	Door
Glance at model/profile, VRAM and service readiness	Read-only Phone Desk over private Serve HTTPS
Extract image text, transcribe audio or synthesize speech	Optional :8001 helper, native HTTP Shortcut/client with a separate API key
Start RustDesk's actual remote-desktop backend	One SSH command / iOS Shortcut, then the mobile RustDesk client
Bring back only the kernel or RAG listener	SSH + Start-GodBrain.ps1 -Only kernel / -Only rag
Read logs, inspect processes/services and query local health	SSH + PowerShell; ordinary Windows permissions still apply
Ask the local model, ingest text or use existing model/gym launchers	Explicit SSH scripts; one GPU slot and setup/permission gates still apply
Save an idea or review/judge pending records	Existing bearer-authenticated tailnet API, or explicit SSH scripts
Use the PC's full control panel and desktop applications	RustDesk after backend readiness; not the read-only web page

See Phone control: iPhone and Android for setup, copyable commands, Shortcuts success/error handling, private HTTPS, token/key handling, long-running process caveats and honest recovery limits. Its remote OCR and CPU speech section documents raw File uploads, JSON text extraction, WAV playback and why a successful unauthenticated health check does not prove POST authentication. No router port-forward, public SSH or exit node is needed for ordinary tailnet access. A dead PC/Tailscale/SSH path still needs an independent recovery channel; neither a web page nor a domain name creates one.

The end goal

Wanted on this product (still gated):

• A mouth that ships real UI with automated browser evidence; important host work still follows the kernel allowlist and operator judgment. Copilot/gemini-cli are not part of that loop.
• Own the generate engine if the stock llama-server door is sunset or gimped. Fork later; do not vendor Copilot MCP to get there.
• Models that inherit each other's tested experience. The frontend gym already shares scoped, machine-tested examples across learner models and supports serial tutor feedback. Global host knowledge still uses /recall <query> through :8084 and drops sector=personal; its judgment gates are unchanged. The Rainman shelf remains /hylla (write) and /rainman (list/search).

Not this host — several are standing nos. See docs/architecture/future.md:

• Candidate-vs-verified conflict queue — later, and only if /pending is actually overloaded. /verify / /reject is enough now.
• Autonomous CVE ingest and auto-patch across Devuan / macOS / Windows.
• Self-directed DISM or registry repair. Named GO, one tool, never a standing allow.
• Unattended host repair beyond Heal's existing allowlist. Heal already does detect → allowlist → verify; anything past flushdns stays GO-gated. This restriction is not a demand for human review of routine frontend gym attempts.

Capability (evidence, not folder names)

Item	Source	Offline gate	Daily-driver on this desk
Heal/Watch listener loop	yes	Start/Heal scripts	yes
/verify /reject judge	yes	—	yes
Librarian candidates + rag-service retrieve	yes	C++ ctest + Librarian --self-test	yes (lexical; C++ :8084)
/mouth off / /mouth on	yes	—	yes (pause llama; Watch/Heal skip start)
/recall <query> verified search via :8084	yes	—	yes (tech only; personal dropped)
/hylla /rainman personal shelf	yes	—	yes (candidate until /verify; never tech RAG)
/mouth off /mouth on	yes	—	yes (pause llama; Watch/Heal skip start)
Bounded /edit + privileged pwsh	yes	Verify-LocalEdit	yes, allowlist still grows
Tool edit_local_file / write_local_file hash-bound replace	yes	local_tools_test	yes (tmp+MoveFileEx; append fail-closed if dest unread)
WMI child env: DB name + embedding identity	yes	Start-GodBrain.ps1 -SelfTestEnv	yes
Durable task ledger / chain continue	yes	/chain /cancel /continue	yes (one file, not tasks/todo.md)
Frontend University	learner/tutor + degree graph + browser examiner	npm test --prefix .\godbrain_core\skill_lab	opt-in scripts\Invoke-FrontendGym.ps1 -Continuous; scoped local evidence, not host authority
Mouth ships web-dev class UI work	destination	—	no
Autonomous CVE / cross-fleet / self-DISM	no (standing nos)	—	no

Credits

https://github.com/M2Team - wsudo enable's elevation to TrustedInstaller in every way you could possibly need.