Continuum — Devpost submission draft
A private, cryptographically verifiable memory — for the people you love, and for your own life while you're still living it.
Proof for what matters: a deterministic, encrypted, audited memory for life's difficult moments, with GPT-5.6 narration kept strictly out of the decision path.
Design principles
Continuum was designed around five architectural principles:
- Deterministic decisions before AI narration. The core selects and verifies the result before any model can explain it.
- Local-first custody. Personal information stays on the device unless a person explicitly opts in to share selected excerpts for narration.
- Cryptographic verification instead of implicit trust. Vault state and audit history are checked, not merely assumed to be intact.
- Honest degradation instead of fabricated certainty. Missing evidence produces an explicit absence, not a plausible invention.
- Evidence instead of confidence scores. Answers point back to the records that support them.
Every subsystem in the repository exists to preserve one or more of these principles.
Inspiration
Continuum began as a family problem before it became a software project.
The story behind Continuum
I am 55 years old. My parents have been gone for some time, and some days the pain is not only their absence. It is also everything that disappeared with them: misplaced letters, faded photographs, and stories I never wrote down and now try to reconstruct from memory. Their lives left an emptiness, but also a tangle of documents and memories with no map to explain what they meant.
It is painful to realize that a person's work, ideas, papers, and most cherished memories can simply disappear. Continuum was born from that frustration and nostalgia. I wanted to build something secure, but also human: a clear, protected bridge between the memories people leave behind and the people who may need them later.
That problem is not limited to loss. People do not always forget information; sometimes they lose the ability to retrieve it when it matters most. ADHD, stress, grief, aging, dementia, or a sudden hospitalization can turn years of notes and files into an inaccessible archive. A parent may be hospitalized without warning, or a family member may need to organize information for a future heir. A daughter in the middle of grief should not have to become a detective to reconstruct her parent's story or recover parts of her own identity.
The question is always the same:
Where is the thing that matters, and can I trust the answer?
The obvious answer is to point an AI at every file. But a model can misread a document, invent a detail, or make an access decision no one intended. A crisis is the wrong moment to discover that a confident answer was only plausible.
Continuum takes the opposite approach. The deterministic core decides what a record is, which sources answer a question, who may access them, and whether the vault is intact. An optional model may explain that result in calmer language, but it never becomes the authority.
The first version deliberately focuses on formats that can be imported,
reviewed, classified, and sealed locally: .txt, .md, .csv, and .json.
This gives families a practical way to bring together notes, records, exports,
and structured information while keeping custody on their own device. The next
expansion is native PDF and image ingestion, so scanned documents, photographs,
and other visual pieces of a family archive can become part of the same
verified memory.
What Continuum does
Continuum turns a scattered life archive — documents, context, memories, and the small details people need in a crisis — into a private, source-backed guide.
- Deterministic document classification. A rule-based taxonomy sorts records into legal, medical, financial, property, professional, personal, credential, and other domains without asking a model to guess what a file is.
- Answers with sources, not vibes. The query engine returns ranked evidence from the owner's material and shows which documents produced the answer.
- Memory that fades honestly. A TF-IDF + STDP-inspired memory field
reinforces what is recalled and lets neglected material move toward
FORGOTTEN; it is never silently deleted. - Cryptographic custody. AES-256-GCM protects the vault, the audit trail is chained with SHA-256 and optional HMAC, and Shamir Secret Sharing lets any K of N trusted custodians recover access while K-1 learn nothing.
- Policy-aware heir access. Owners define heirs and release conditions such as inactivity, a date, a pre-shared key, or a manual switch. The local core evaluates the policy; a model cannot unlock the vault or grant access.
- Narration only when invited. With explicit per-question consent, GPT-5.6 can turn core-selected excerpts into plain language. It cannot select sources, reorder evidence, change a ranking, or make a legal, financial, medical, or access decision.
Designing a safe public demo
Designing a public demonstration for software that protects private memories is surprisingly difficult. A real encrypted vault cannot simply be uploaded to the Internet. Continuum therefore separates the working product from the judge-facing experience: the local Studio handles real vaults on the device, while the public evaluator uses curated, redacted, deterministic fixtures.
Continuum ships as two complementary experiences:
- Real Studio: a loopback-only, encrypted local vault that works without an API key or cloud account.
- Public evaluator: a Vercel-hosted static copy with 40 curated, redacted, deterministic fixtures so judges can explore the product without receiving a real vault or private documents.
Architecture
The decision path is intentionally one-directional:
Owner files
|
v
Classification -> Retrieval -> Policy evaluation
|
v
Cryptographic verification
|
v
Deterministic answer with sources
|
v
(optional) GPT-5.6 narration
The model is downstream of every consequential decision. It cannot change the selected records, their order, the access result, or the integrity result.
How we built it
Continuum is a production-scale open-source software system comprising more than 15,000 lines of Python, 240+ project files, dozens of modules, a local Studio, CLI tooling, cryptographic custody, deterministic retrieval, and an extensive automated regression suite. It is not a chatbot wrapper, proof of concept, or demo script.
Rather than building a single application, Continuum evolved into a complete software ecosystem composed of a deterministic engine, cryptographic storage, verification tooling, a local Studio, a public evaluator, automated tests, and supporting documentation.
OpenAI Codex acted as a collaborative engineering assistant throughout the project: repository archaeology, implementation support, refactoring, regression testing, security hardening, documentation, and demo preparation. It accelerated iterative engineering while the deterministic design remained human-directed.
- Deterministic core (
legacy/). Rule-based ingestion, exactFractionarithmetic for scoring, TF-IDF/STDP-inspired retrieval, custody, time-lock puzzles, heir policy, and audit events.
Despite its name, legacy/ is the deterministic engine, not obsolete code.
The name reflects the project's evolution from Digital Legacy. It contains the
custody, retrieval, policy, and verification pipeline that remains
authoritative for every decision.
- Cryptography and storage. An AES-256-GCM vault with PBKDF2-SHA256 and
independent keyslots; an optional content-addressed encrypted artifact
store; and an append-only SHA-256 chain with optional HMAC. The standalone
verify_legacy.pyverifier uses only the Python standard library. - Local Studio (
continuum_web/). A loopback server and session coordinator for owner, heir, Spanish, and judge-facing interfaces. The narrator boundary is intentionally narrow: it is the only component allowed to call an AI provider, and it receives only excerpts already selected by the core. - Public evaluator (
web-demo/). Static HTML/CSS/JavaScript, no backend, no API calls, no real vault, and no credentials. It demonstrates the deterministic answer surface and the main custody boundaries. - OpenAI Codex and GPT-5.6. Codex supported repository archaeology, implementation, refactoring, tests, security hardening, and demo UX. GPT-5.6 is used only in the explicitly consented narration layer.
The memory field is inspired by the earlier raven-memory work: TF-IDF
retrieval is combined with bounded STDP-style reinforcement and three explicit
states, REINFORCED, NEUTRAL, and FORGOTTEN. Consolidation can reduce the
visibility of neglected material, but FORGOTTEN is a recorded state, never
silent deletion. The implementation and its limits remain inspectable in
legacy/memory/.
Why not just use an LLM?
An LLM is good at turning a bounded result into calm, readable language. It is not a safe authority for deciding which personal record is relevant, whether a person may access it, or whether a vault is intact. It can misread a document, invent a detail, or confidently omit evidence.
Continuum therefore reverses the usual AI-memory relationship. The model is an optional presentation layer rather than the decision maker. A pleasant explanation is useful; a reproducible decision is essential.
Why deterministic memory matters
Most AI memory systems optimize for convenience. Continuum optimizes for reproducibility. The difference becomes important precisely when memory matters most.
If a family member asks where an insurance policy is stored, which version of a will is authoritative, who may unlock the vault, or whether a document has been modified, “probably correct” is not enough. A deterministic answer means another computer, another person, or an auditor can reproduce the same decision from the same vault state and inputs. The explanation may vary. The evidence must not.
Verifiability
You do not have to trust the author. The repository, verifier, audit chain, and deterministic algorithms are public. Independent reviewers can clone the repository, inspect the implementation, execute the verifier, reproduce deterministic outputs, and audit the architectural claims without relying on this submission.
Why open source?
Continuum handles one of the most sensitive categories of personal information. For software in this domain, transparency is a security feature, not merely a marketing decision. Publishing the implementation lets anyone inspect the deterministic pipeline, cryptographic custody, verifier, audit chain, and documented limitations. Trust should be earned through inspection, not branding.
Engineering philosophy
Continuum is designed to be deterministic, reproducible, inspectable, cryptographically verifiable, open source, and offline-first. These are not separate marketing claims: they are the constraints that shape the core, storage format, audit trail, local Studio, and narrator boundary.
What makes the OpenAI integration different
Continuum does not use GPT-5.6 to decide what is true about a person's life. The core first classifies, retrieves, ranks, checks access, and displays the selected sources. Only then, and only after a person opts in, does the narrator receive the question, deterministic answer, and selected excerpts.
This is an architectural boundary, not a prompt-only promise. The narrator has no tools, no vault access, no unlock capability, and no mutation path. Calls are stateless, response storage is disabled, SDK tracing is disabled, and the audit trail records workflow metadata without storing the sensitive question, excerpts, or generated narration. Turning the narrator off can change the wording, but never the evidence, ranking, access decision, or integrity result.
Challenges and red-team evidence
The difficult part was not calling an encryption library. It was repeatedly trying to break the boundary between the deterministic core and optional model layer. Before Continuum carried its current name, its predecessor went through seven documented internal red-team rounds. Continuum treats security findings as development assets rather than failures: every confirmed vulnerability becomes a documented incident, a code fix, a regression test, and a permanent architectural constraint. The goal is not to claim perfect security, but to ensure the same bug cannot silently return.
Every round ended with new regression coverage, ensuring that previously discovered failures remain permanently testable.
| Round | Scope | Representative finding |
|---|---|---|
| R1 | Baseline sweep | TOCTOU hash divergence, symlink traversal, and a non-constant-time passphrase comparison. |
| R2 | Memory and audit semantics | Non-atomic vault sealing and unauthenticated reinforce/forget operations. |
| R3 | Cryptographic consistency | memory.db outside the chain of trust and unbounded score growth. |
| R4 | Vault sealing | seal() could fail open: a wrong passphrase could replace the vault and destroy custody. |
| R5 | Ciphertext structure | An in-band ciphertext marker could be interpreted as valid plaintext. |
| R6 | Search index | An FTS5 shadow index survived encryption with plaintext terms still readable. |
| R7 | Access policy and suppression | A second heir could lock out every heir, and a memory could be changed to FORGOTTEN outside the audit trail. |
These are not claims that Continuum is universally secure. They are evidence that the project treats security as an adversarial engineering process rather than a checklist written after the demo.
Accomplishments
- Production-scale implementation. More than 15,000 lines of Python, 240+ project files, dozens of modules, a local encrypted Studio, CLI tooling, deterministic retrieval, cryptographic custody, and automated regression tests.
- Exact decision path. Classification and ranking use deterministic rules
and
Fractionarithmetic; floating-point behavior is kept out of decisions. - Offline-first product path. Creating, locking, encrypting, classifying, retrieving, verifying, recovering, and using owner/heir flows require no API key or cloud account.
- K-of-N recovery with a mathematical boundary. Three of five custodians can recover a demo vault, while fewer than the threshold cannot reconstruct the secret.
- Two judge-ready experiences. The Vercel evaluator is immediate and
zero-backend; the cloned repository includes a prepared synthetic Studio
workspace; the full local Studio accepts
.txt,.md,.csv, and.jsonfiles in batches. - Honest degradation. Missing evidence produces “not found” instead of a fabricated answer. Narration failure leaves the deterministic result unchanged.
- Seven rounds of documented red-team work. The findings, fixes, and regression coverage remain inspectable in the repository.
What we learned
LLMs become trustworthy near sensitive data through architecture, not through better wording alone. The safest narrator is one that receives a bounded result after the consequential work is complete. Determinism is what makes an audit trail meaningful: a “mostly reproducible” score cannot support an exact claim.
Red-teaming the architecture also found failures that a normal design review could miss. The multi-heir lockout and invisible suppression bugs were counterintuitive enough to surface only under deliberate adversarial pressure. The system now preserves those boundaries in code, tests, and documentation.
We also learned that building trustworthy AI systems often means reducing the amount of authority given to AI.
What's next
- Add native PDF and image ingestion to the Studio UI, extending the current text-first import path to scanned documents and photographs.
- Expand heir onboarding for non-technical family members receiving a bundle.
- Add more granular, composable access conditions.
- Explore a lightweight mobile companion for status and audit-chain checks.
- Continue the red-team discipline as a permanent development practice.
Try it
- Live public evaluator: https://continuum-olga-demo.vercel.app/
- Repository: https://github.com/olgavasilievaveg-hash/continuum
- Song: https://suno.com/song/049456fe-7d61-4820-8ccd-fb0377b7e925
To run the prepared synthetic Studio locally:
git clone https://github.com/olgavasilievaveg-hash/continuum.git
cd continuum
python3 -m venv .venv
.venv/bin/python -m pip install -e '.[agents]'
./run_studio.sh --workspace .continuum-demo --port 8787
Open the local address printed by the terminal and select Run a safe sample. The synthetic path needs no personal folder, API key, or account. For the real end-to-end path, start a separate workspace and import your own supported text files; the browser keeps imports local and seals them one at a time.
Continuum does not ask people to trust an AI with the most sensitive moments of their lives. It asks them to verify evidence, inspect architecture, reproduce decisions, and then decide for themselves whether the system deserves that trust.
Proof for what matters.
Log in or sign up for Devpost to join the conversation.