Aldus Palace

A trustworthy context layer for AI that remembers, plans and acts. Free text goes in; typed commitments, decisions and memories come out — each with the evidence behind it, in a SQLite file you own.

Evaluate it in five minutes: EVALUATION.md maps every claim to the command that proves it. 中文版 README · 中文评估指南.

A to-do list asks you to file, tag, date and prioritize every item. The list grows. The managing becomes the work.

An AI assistant remembers things about you. That memory sits in a closed box. You read it through one app, and you move it nowhere.

Aldus Palace holds one place for what you need to do. You write a sentence. The system does the filing.

$ pnpm demo

$ input  Ship the onboarding page next week
Captured · 1 commitment
  commitment  Ship the onboarding page next week  ·  window 2026-09-19 → 2026-09-26

$ input  I prefer simple tools
Captured · remembered 1
  memory      Prefers simple products and interfaces; avoids complexity  ·  active

That output comes from the deterministic provider, offline; dates resolve on the day you run it. pnpm demo runs the same pipeline with no API key.

Try it in your assistant. MCP inside Claude, Cursor or any MCP client:

npm install -g @aldus-palace/mcp
claude mcp add aldus-palace -- node "$(npm root -g)/@aldus-palace/mcp/dist/index.js"

It reads a sentence and sorts it. Write "Ship the onboarding page next week" and you get one commitment, with the date worked out. No project picker, no priority field, no due-date calendar. Paste a paragraph and you get several objects: thoughts, commitments, decisions, memory candidates.

It catches repeats. Repeat yourself and the system points at the first record.

It remembers the rules you state. "I prefer simple tools" lands as a rule the system follows from the next capture onward. The memory list archives it.

It shows its work. Every memory carries the sentence you said, the confidence behind it, and a note that says whether you stated it or the system inferred it.

It follows you. One file, one API. Claude, Cursor, your own frontend, a script you write.

Who it's for

What developers get out of the box

When to use it

A real run of the offline provider. Relative dates resolve at capture time.

• One person, one instance. One database and one bearer token; run one instance per person.
• A SQLite file you own, or one Cloudflare Durable Object. Copy it, back it up, hand it on.
• Four surfaces over the same data: MCP, HTTP, the library and a typed client. You bring the screen.
• You decide what acts. The runtime records intent and plans; acting on the world is your call.
• Offline mode runs the whole pipeline with a deterministic provider; connect a model for general understanding, and the receipts show which provider produced them.

Four ways in, one schema, open source under Apache-2.0. Offline mode runs with no API key.

Library

import { DevLLMProvider, ensureDevUser, formatActionCard, initialize, newId,
         nowIso, processRawInput } from "@aldus-palace/core";
import { openSqliteDatabase } from "@aldus-palace/core/db/sqlite";

const db = await openSqliteDatabase("./aldus.db");
await initialize(db);                              // canonical DDL + migrations
const user = await ensureDevUser(db, { name: "Me", timezone: "UTC", language: "en" });

const id = newId("inp");
const text = "Ship the onboarding page next week";
await db.prepare(`INSERT INTO raw_inputs
  (id, user_id, content, source, processing_status, created_at, updated_at)
  VALUES (?, ?, ?, 'text', 'pending', ?, ?)`)
  .run(id, user.id, text, nowIso(), nowIso());

const card = await processRawInput(db, new DevLLMProvider(), user, id, "local");
console.log(formatActionCard(card));
// Captured · 1 commitment
//   commitment  Ship the onboarding page next week  ·  window 2026-09-19 → 2026-09-26

MCP — inside Claude, Cursor or any MCP client

npm install -g @aldus-palace/mcp
claude mcp add aldus-palace -- node "$(npm root -g)/@aldus-palace/mcp/dist/index.js"

HTTP — self-hosted, SQLite in a volume

cp .env.example .env && docker compose up --build
curl -X POST localhost:8787/v1/inputs \
  -H 'Authorization: Bearer dev-local-token' -H 'Content-Type: application/json' \
  -d '{"content":"Ship the onboarding page next week","mode":"sync"}'

Client — a typed client over the same HTTP API

import { createClient } from "@aldus-palace/client";

const aldus = createClient({ baseUrl: "http://localhost:8787", token: "dev-local-token" });
const card = await aldus.capture("Ship the onboarding page next week", "local");
console.log(card.action_card.summary);        // Captured · 1 commitment
console.log(await aldus.actions("proposed")); // what the Action Gate is holding

packages/core is runtime-agnostic and dependency-light: zod, dayjs and nanoid. Requirements: Node 20 or newer. better-sqlite3 ships prebuilds for common platforms; other platforms need a C toolchain.

The runtime runs as a pipeline, and the Core Intelligence Layer organises it into four engines. Understanding — the capture front end in agent/understand.ts — turns a sentence into typed objects; the engines decide what is kept, what happens next, what the system may do on its own, and which model is used. A model can contribute to understanding and to conflict detection, and every engine has a path that runs without one. Each engine ships today and has a designed extension — the shipped parts name the file they live in, and the full design is mapped in docs/INTELLIGENCE.md.

user / environment
      |
input          raw text, stored as written
      |
understanding  intent, typed objects, resolved dates, gates
      |
memory         candidates, evidence, confirmation, conflicts, versions
      |
planning       four kinds of time, today, risk, adaptive limits
      |
context        active memories and projects feed the next capture

The runtime lives in packages/core/src: agent/understand.ts for capture, services/ for planning, memory, the Action Gate and privacy, lib/ for the pure helpers, and providers/ for the model interface. The capability-by-capability map is in docs/MAP.md, and the full design, with each engine's shipped and planned parts in depth, is in docs/INTELLIGENCE.md.

capture -> extraction -> candidate -> evaluation -> conflict check -> storage -> activation -> retrieval

• Extraction reads two signals: durability markers ("from now on", "as a rule") and repeated behaviour. Rules run with no model; a model adds general understanding.
• Evaluation drops what should not be remembered: a temporary state, a one-off creative fragment, a low-confidence guess.
• Activation follows one published rule: confidence >= 0.8 and importance >= 0.8. Everything below that waits as a candidate.
• Conflict check compares a candidate against active memories on the same dimension and reports the contradiction instead of storing both.
• Retrieval injects active memories into the next capture, so understanding improves with use. Each injection lands in the action log.

1. A mood does not become a profile entry. "I'm tired today" is dropped before storage.
2. One inference does not make a principle. A principle the system inferred waits for confirmation, whatever its score.
3. Every memory carries evidence. The sentence it came from, a confidence value, and a note that says whether you stated it or the system inferred it.

The system touches work, decisions, relationships and habits; privacy is the shape of it, not a feature on top.

Shipped today — a SQLite file you own (or one Cloudflare Durable Object), a single-user runtime, immutable raw_inputs, model output validated and gated, an action_log entry on every mutation, and a memory gate that confident, stated memories pass on capture while an inference waits for you. A Privacy Gateway prepares a cloud call by data level (names, money, emails and phone numbers are replaced, level 4 stays local), permissions are progressive with Memory private by default, and purgeUserData deletes every row the user owns in one transaction — a critical action, so it takes two approvals. SECURITY.md records the posture and the current threat model.

Cloud providers are only built together with that guard, so a call cannot leave the device unredacted.

Designed next — local encrypted storage (Keychain / Secure Enclave).

Models return text. Code needs records. A model writes "0.8" where you asked for a number, invents a date, or stores one task under two titles. The runtime validates each answer, skips duplicates and resolves dates on the server. A failed answer leaves the previous record in place.

The slow path breaks products. A user waits on a model and loses interest. A background model meets retries, two clients writing at once, and records stuck mid-update after a crash.

Memory is a liability. Store the first inference and the user owns a personality from one remark. Replace the old record and the history disappears.

The pipeline runs offline: a deterministic provider implements the same interface as the model-backed ones, so 30 test suites and 11 acceptance fixtures replay with no key.

git clone https://github.com/heymi/aldus-palace.git && cd aldus-palace
pnpm install

pnpm test     # 30 suites — deterministic, offline, no API key
pnpm eval     # 11 acceptance fixtures — the behaviour this project promises

pnpm --filter @aldus-palace/example-understanding-only start
pnpm --filter @aldus-palace/example-memory-gate-only start
pnpm --filter @aldus-palace/example-today-only start

Each example prints the records it stored and the reasoning behind them, with no API key and no network. To use the macOS-shaped reference client in a browser, start the server and the client — capture a sentence, then watch it land in Home, Memory and the decision queue:

pnpm --filter @aldus-palace/server start                  # API on :8787
pnpm --filter @aldus-palace/example-reference-client start # client on :5173

packages/core          domain, agent runtime, storage port, migrations, providers
packages/mcp           MCP server (stdio) — profiles, local and HTTP backends
packages/client        typed HTTP client, one method per route
apps/server            Hono reference server (local SQLite and Cloudflare Durable Object)
examples/              six runnable examples, one per capability group (the last is a browser client)
spec/schema.sql        generated, readable schema (CI-checked)
eval/fixtures          acceptance scenarios
docs/                  everything above

0.x — usable and tested; the API may change between minor versions. See SECURITY.md before exposing an instance.

Fixtures, docs and focused fixes are welcome. See CONTRIBUTING.md. Commits carry a DCO sign-off (git commit -s).

Apache-2.0.