MarzsAI

INSPIRATION Assistants lie about themselves. Ask one to remember something and it says "saved" and saves nothing. Ask it what it can do and it invents a capability. I wanted the opposite failure mode: an assistant that would rather say "I cannot do that" than be pleasant and wrong. That turned out to be an engineering problem, not a prompt problem.

WHAT IT DOES MarzsAI is a conversational assistant with real surfaces behind it. It holds your vehicles, trips, reminders with a month calendar, saved memory, and Digital Files — a place to bring in documents, pictures or audio from anywhere on your phone or iCloud, which stay on the phone in a folder that is yours. Audio plays with a bar, a full page, and a bubble that floats over the conversation so the music does not stop when you go back to chatting. Siri and Shortcuts reach it. Everything the model is allowed to claim is generated from the app's own code, so the two cannot drift apart.

HOW WE BUILT IT SwiftUI and SwiftData on iOS 26, with the assistant's system prompt generated from the app rather than typed: a capability manifest built out of the destinations that actually exist, held under a hard byte ceiling, with a test that computes what one more capability would cost and fails BEFORE the ceiling is hit rather than after. Inference runs through a Next.js server on Vercel so no model credential ever enters the binary. RevenueCat and StoreKit 2 handle purchases. The project file is generated from a YAML manifest by XcodeGen, so the repo never carries a merge-conflicting pbxproj.

The part I am actually proud of is the boundary form. Each capability's sentence to the model is a struct with slots — who writes it, how the person adds one, and the specific false claim it exists to close — rather than free prose. A bespoke sentence that forgets a clause reads fluently and is invisible. A form with slots makes a missing clause a missing slot, and a test can see it.

CHALLENGES The honest ones, because the polished ones are not interesting:

A design system that refuses itself. The glass treatment is measured, not asserted. One surface was rejected at 0 of 10,000 interior pixels moving across three scroll offsets against a control that moved 15%. Another was refused because glass floating over a flat background is invisible by definition — 1.02:1 in light, 1.12:1 in dark.
A build number derived from the commit count. CFBundleVersion comes from git rev-list --count HEAD, which means any record that names a build number goes stale the moment another commit lands. That bit us: a release-notes record was correct, one more commit moved the count, and it went stale silently. The fix is a gate, and the lesson is that a gate only anybody remembers to run is a document, not a gate.
Nineteen compiler errors that were real, live, fresh — and about a different build arena than the green test sweep. Both readings were correct. They went to zero on one build with nothing edited.
Shipping telemetry into the user's own file list. The app's diagnostic logs were written to Documents, which is also where the person's imported files live, so the app's reports about itself were filed among their things. Found because a real user sent a screenshot. Fixed by ownership: what the person put there is theirs, what the app wrote about itself is ours, and they live in different directories.

ACCOMPLISHMENTS Shipped to the App Store on 16 September 2026, and shipped an update four days later. A capability manifest that is generated, bounded and tested rather than written. 988 tests across 102 suites. A release procedure that records its own scars — every rule in it exists because something went wrong once and got written down instead of remembered.

WHAT WE LEARNED Most of what cost us time was an unchecked premise, not a hard problem. Twice in two weeks an argument ran for hours about a number that one grep would have settled. The discipline that actually pays is not being clever; it is reading the thing before reasoning about it.

WHAT'S NEXT Digital Files opens any file, not just audio — a reader for documents, images and code, rendered as text and never in a web view, because an imported file is untrusted input. PDF conversion, document scanning straight into a file, and icon/list/grid views. A full-screen map surface. And a release checklist that makes shipping without release notes impossible rather than merely discouraged.