Rayluno

• 

Inspiration

Personal AI assistants often sit at one of two unsafe extremes: they can chat but cannot complete meaningful work, or they receive broad tool access that is difficult to constrain, explain, and audit.

Rayluno takes a third path: an AI model may propose an action, but deterministic application code decides what is permitted, records authorization before impact, executes only bounded skills, and verifies the evidence before the next action.

What it does

Rayluno is a local-first Arabic and English Windows personal assistant with five connected product surfaces:

1. Personal Command Center — local tasks, reminders, daily agenda, overdue work, and recommended focus.
2. Explicit-consent Memory Vault — stores a fact only after a direct remember command. Ordinary conversation is not retained, and each saved fact is visible and deletable.
3. Verified Execution — a registry of permission-scoped skills with risk levels and plan-specific approval.
4. Authenticated Execution Proof — records authorization before impact, records the outcome afterward, and verifies the local receipt history before later actions.
5. Runtime Trust Center — displays six live guarantees derived from Python state rather than static marketing text.

The stable Windows judge path also supports local Vosk push-to-talk speech recognition, conservative Arabic correction for common transcription errors, and optional local Ollama fallback. The judge launcher preloads Vosk in the background and uses a bounded shorter end-of-speech window to reduce first-command latency.

Trust architecture

A consequential request must:

1. resolve to a registered skill;
2. pass deterministic allow-list policy;
3. request an expiring, plan-specific, single-use approval when required;
4. persist an execution_authorized receipt before the operating-system effect;
5. execute through a bounded adapter;
6. persist an outcome receipt;
7. preserve a hash-linked local trust history protected by an installation-scoped HMAC checkpoint.

Unknown actions fail closed before impact. Rayluno exposes no general shell, eval, or unrestricted operating-system command authority to the model.

Runtime Trust Center

The Trust Center reports:

• authorization before effect;
• authenticated local checkpoint;
• installation-scoped keyed fingerprints;
• explicit-consent memory;
• no general command authority;
• telemetry disabled by default;
• registered skill count and Judge Mode state;
• honest limits of local-only verification.

No local secret, raw command, argument value, or approval token is exposed to the JavaScript interface.

Reproducible Windows judge path

Use Python 3.11 x64 or newer.

py -3.11 -m venv .venv
.\.venv\Scripts\Activate.ps1
python -m pip install -U pip
python -m pip install -e ".[dev,desktop,commercial,voice]"
.\scripts\install-arabic-wake-model.ps1 -SetUserEnvironment
.\scripts\start-judge-demo.ps1 -CheckOnly
.\scripts\start-judge-demo.ps1

The launcher fixes the visible product identity to Rayluno, uses the tested local Vosk push-to-talk route, preloads the model in the background, performs a local doctor preflight, and keeps the existing permission and skill boundaries unchanged.

Demonstrate explicit approval

Enter:

جهز عرض الحكام

Rayluno performs no side effect immediately. It displays the selected Skill IDs, required permissions, risk levels, argument-key fingerprint, expiry countdown, and explicit Approve and Reject controls. Approval consumes the exact server-generated handle once.

Demonstrate fail-closed behavior

Enter:

اختبر رفض مهارة غير مسجلة

The proposal is rejected before impact because it does not resolve to a registered skill.

Inspect the evidence

Open Verified to inspect CHAIN VERIFIED, the Runtime Trust Center, and privacy-aware execution receipts.

Judge Mode disclosure

--judge-demo is an explicit evaluation entitlement override, not a hidden customer activation path. It enables only the existing bounded ai.local, automation.pro, and voice.local feature gates and two clearly scripted review scenarios. It does not add domains, applications, skills, permissions, shell authority, or persistent paid entitlement state.

The current activation endpoint is hosted on a third-party HTTPS subdomain as a temporary prototype/evaluation deployment. It is documented as temporary rather than presented as the final production architecture.

How Codex and GPT-5.6 were used

Codex powered by GPT-5.6 was the primary engineering collaborator. It was used to:

• audit the imported baseline and conduct the pre-submission security review;
• decompose the product into reviewable pull requests;
• design task, reminder, memory, skill, approval, authorization, receipt, and update boundaries;
• implement bilingual behavior, RTL/LTR support, accessibility contracts, and the runtime-backed Trust Center;
• build the Windows/Ubuntu and Python 3.11/3.13 CI matrix;
• diagnose failures from JUnit and Ruff artifacts rather than suppressing checks;
• build adversarial regression tests for consent, approval replay, expiry, privacy, journal corruption, deletion, truncation, rollback, and checkpoint tampering;
• add write-ahead authorization and installation-scoped HMAC evidence;
• shape the final judge path around claims the product can prove.

GPT-5.6 is deliberately not granted direct runtime control over the operating system.

Verification

The final version passes 467 automated tests across Windows and Ubuntu with Python 3.11 and 3.13, alongside JavaScript syntax validation, Python compilation, Ruff lint, and Ruff formatting.

Potential impact

Rayluno targets people who need hands-free or low-friction computing without surrendering control: users who cannot rely on traditional input, people recovering from hand injuries, creators managing multiple tasks, and busy professionals. The current release demonstrates the security and product foundation; broader accessibility validation and continuous voice interaction remain future work.

Honest limitations and next steps

The local HMAC checkpoint is not hardware-backed or remotely witnessed. Local SQLite data is not application-encrypted, development installers are not Authenticode-signed, and crash-recovery reconciliation for an in-doubt authorization remains future work. Planned production work includes OS-protected keys, encrypted local data, signed packaged builds, first-party activation hosting, broader Windows accessibility testing, and additional registered skills.

Built With

• codex
• github-actions
• gpt-5.6
• ollama
• powershell
• python
• pywebview
• sqlite
• vosk