Quiet · local-first, unlisted
Koi Cave
A private operator brain that never leaves the machine.
Private development project. No public download is offered here; the technical build record below is dated July 2026
Verified 2026-09-10 · 1 sources
- Public site offers a development record, not a download
- https://koinophobia.dev/products/koi-cave — public development page and its absence of a download action checked 2026-09-10. Technical notes below are preserved as July 26, 2026 history; no newer binary or signing claim is made.
The human problem
Every tool that promises to organize your work wants your work on its servers, on a subscription, forever. I wanted the leverage without renting my own context back from someone else.
The thesis
Personal infrastructure beats personal productivity apps. If the thing that knows the most about how I work is owned by a company, that's a dependency, not leverage.
Where it actually stands
- July 26, 2026 record: A macOS app: notes, tasks, memory, and automations, running local-first.
- July 26, 2026 record: The operator loop closed for the first time on July 23: a typed command becomes a validated packet, passes an approval gate, runs a repo-inspection worker, and comes back as a receipt that a separate validator re-checks from artifacts on disk.
- July 26, 2026 record: That work is deliberately unmerged. The last gate is human hands — me typing the command into the composer myself — before it lands on main.
- July 26, 2026 record: The morning founder brief is certified with limitations — it survived every failure drill I could design, including corrupt caches, malformed events, and a disconnected mail provider.
- July 26, 2026 record: One known truth bug remains: items waiting on me for more than 72 hours drop out of the brief while it reports no urgent signal. That's the exact failure mode a brief exists to prevent.
- July 26, 2026 record: The mail integration has never completed a real sync. The stored config holds a client ID and no tokens, so every brief it has ever produced was built from local state.
Decisions and tradeoffs
Local-first, with no hosted fallback.
The moment there's a sync server, the privacy claim becomes a policy instead of an architecture.
Made the worker unable to complete its own commands.
A system that grades its own homework converges on flattery. Receipts exist only when a validator re-reads the artifacts from disk — a failed check becomes an honest not-healthy receipt, never a quiet success.
Certified it with the limitations written down instead of fixing them first.
A known, documented failure is safer than an undocumented one. The report says what it doesn't do.
Kept it off every public surface.
It has no users, no URL, and no store presence. Putting it on a product page would be inventory-padding, and this site doesn't do that.
What building it taught me
I certified a feature against every failure I could imagine and never connected the one integration that would have made it real. The drills tested how it behaves when the data is missing, which turns out to be the only state I've ever actually run it in.
What isn't true yet
- No public download is offered here.
- The July 2026 signing, operator-loop, and mail-sync notes have not been reverified for a newer build.