The Workshop

What AI is

• 01

  What AI actually is

  Plain-English LLM basics and your first real conversation — no account required if you use Gertrude on this site.

  ~11 min · 8 steps

  →
• 02

  The day everything changed

  November 2022 — why ChatGPT spread faster than Siri or Alexa, and why every big tech company pivoted hard.

  ~7 min · 6 steps

  →
• 03

  The wild early years

  Jailbreaks, bad headlines, privacy scares — and why frontier AI got stricter. Honest history, not myth.

  ~10 min · 8 steps

  →
• 04

  AI in 2026

  Multimodal apps, agentic AI, and how search is changing — the current picture before Ground Zero's product map.

  ~12 min · 9 steps

  →
• 05

  The workforce reality

  Desk jobs, cited labour data, companies training AI on your work, and robots on factory floors — urgent honesty, not hype.

  ~13 min · 10 steps

  →
• 06

  Your path forward

  Ground zero to builder — what free Ground Zero and Off the Grid give you, what ongoing membership adds beyond Jarvis, and your next step into Module 1, the 2026 landscape.

  ~7 min · 7 steps

  →

The 2026 landscape

• 07

  The 2026 AI landscape

  What frontier AI platforms actually offer beyond chat — and what you're renting vs what you'll build on your own machine.

  ~28 min · 10 steps

  →
• 08

  Privacy before you paste

  Practical red lines before you use cloud AI hands-on — what happens to your data and habits that keep you out of trouble.

  ~18 min · 7 steps

  →
• 09

  Meet the platforms (hands-on)

  Hands-on tours of ChatGPT, Claude, Gemini, and optionally Grok — find research, images, thinking modes, and search in the UI, not just the chat box.

  ~30 min · 9 steps

  →
• 10

  The comparison lab

  Run the same Example Ink prompts on ChatGPT, Claude, and Gemini — log your personal winner for each task and optional image generation where your tier allows.

  ~27 min · 9 steps

  →
• 11

  Your personal AI toolkit

  Turn your comparison lab into a "which AI when" card, audit what you're paying for, and frame what you'll build instead of renting — before the full path in Lesson 12.

  ~15 min · 6 steps

  →
• 12

  What you'll build next

  Close free Ground Zero — Jarvis in plain English, proof from Liam's real projects, and the full build path (free Off the Grid, then the paid Build Your Jarvis project). Off the Grid handoff and waitlist appear after the quiz.

  ~16 min · 7 steps

  →

• 01

  Why local AI matters

  Before you install anything — why open-weight on your machine is a different category from rented cloud AI, and how to pick a starter model sized for your RAM.

  ~12 min · 6 steps

  →
• 02

  Install Ollama

  Install Ollama from the official site and confirm the background service is running — ready to pull your starter model in the next lesson.

  ~26 min · 6 steps

  →
• 03

  Your first local chat

  Pull your RAM-sized starter model, run the Example Ink prompt in terminal, and prove what's on disk with ollama list.

  ~34 min · 7 steps

  →
• 04

  Free path complete

  Prove offline inference, celebrate the free tier win, and see what Build Your Jarvis · Module 0 membership builds — before the paywall.

  ~15 min · 6 steps

  →

Module 0 — Foundations

• 01

  Your AI toolchain

  Install VS Code, Git, and the Continue extension — then wire your Off the Grid Ollama model into the editor for local AI chat while you work.

  ~51 min · 10 steps

  →
• 02

  Cloud open-weight models

  OpenRouter, pay-as-you-go cloud access to open-weight models — add one to Continue beside your local Ollama model and compare cost vs ChatGPT Plus honestly.

  ~43 min · 10 steps

  →
• 03

  The anatomy of a good prompt

  RCTFC — Role, Context, Task, Format, Constraints. Turn vague asks into prompts that work on your local model and cloud open-weight, and save a reusable template.

  ~36 min · 11 steps

  →
• 04

  Prompting for different tasks

  Five hands-on labs — writing, analysis, coding, creative, and structured JSON — each with a full RCTFC prompt saved in your gerty-prompts folder.

  ~32 min · 10 steps

  →
• 05

  System prompts and personality

  Write a system prompt for your own assistant voice, wire it into Continue, and see the same question answered with and without personality — plus an honest peek at how public Gertrude works.

  ~33 min · 10 steps

  →
• 06

  Cheap vs frontier and your prompt library

  Jarvis foundations capstone — run the same capstone prompt on local, cloud open-weight, and frontier models; score when upgrade is worth it; organise your gerty-prompts library and git init for local saves.

  ~39 min · 10 steps

  →

Module 1 — Models & memory

• 07

  The 2026 open-weight landscape

  Module 1 opens the build path — pick workhorse and specialist local models by job, pull an embedding model for memory, and wire them in Continue for the Jarvis repo ahead.

  ~33 min · 9 steps

  →
• 08

  Modelfiles — bake your voice in

  Turn your Lesson 5 system prompt into a custom Ollama tag — Plan mode proposes the Modelfile, workhorse Agent writes it, frontier reviews, then you A/B test against the raw model.

  ~44 min · 10 steps

  →
• 09

  Your docs, your answers (RAG explained)

  Plain-English RAG — retrieve from your files, then answer. Scaffold my-jarvis/, create a fictional doc pack, migrate your personality, and prepare for the local RAG build in Lesson 10.

  ~35 min · 10 steps

  →
• 10

  Build local RAG

  Plan and build core/rag/ with workhorse Agent — ingest your doc pack with Ollama embeddings, query with citations, frontier security review, and a checkpoint question only your files can answer.

  ~43 min · 10 steps

  →
• 11

  Memory capstone — model + docs

  Module 1 capstone — same policy question on raw local, Modelfile, and RAG; honest scorecard; git snapshot; Module 2 desktop app preview.

  ~42 min · 10 steps

  →

Module 2 — Chat shell

• 12

  Why a desktop app beats a browser tab

  Module 2 opens here — why Jarvis lives on your taskbar, Tauri in plain English, case-study patterns (not pixels), boundary vs public Gertrude, and your outcome brief for the scaffold lesson.

  ~25 min · 10 steps

  →
• 13

  Scaffold your Jarvis app

  First Tauri build — Plan from your 5.1 outcome brief, workhorse Agent scaffolds my-jarvis/app/, frontier reviews permissions and secrets, then you run the dev command and see your window.

  ~54 min · 9 steps

  →
• 14

  Chat UI — messages that work

  Build functional chat in your Tauri app — send, receive, session history, streaming — wired to local Ollama only; Make it yours on behaviour and optional feel; model switcher lands in 5.4.

  ~40 min · 9 steps

  →
• 15

  Wire local + OpenRouter

  Add an in-app model switcher — local Ollama, cloud open-weight, and frontier on OpenRouter; paste API key in .env via editor only; frontier reviews secrets; test routing in your window.

  ~40 min · 9 steps

  →
• 16

  Load personality from the repo

  Wire core/personality/ into your desktop chat — system voice on local and cloud tiers; optional Modelfile tag for local; test on-brand replies and refusals in the app.

  ~42 min · 9 steps

  →
• 17

  Icon, shortcut, first ship

  Module 2 finale — your icon in assets/, Agent wires Tauri icons and OS shortcut, launch from taskbar, git snapshot, Module 2 complete; Module 3 preview.

  ~43 min · 9 steps

  →

Module 3 — Files & images

• 18

  Eyes and a memory — what this module adds

  Module 3 opener — the difference between grounding (your docs, cited) and seeing (vision models), the local-first privacy stance for client files, what lands in the repo and what never gets committed, and your module brief plus the real document and image you'll use across Module 3.

  ~24 min · 9 steps

  →
• 19

  Drop a document, get grounded answers

  Wire the Module 1 core/rag engine into your desktop app — drag a document into the chat, it ingests itself into a gitignored data folder, and answers come back grounded in it with the source filename shown. Plan → workhorse Agent → frontier review, with a planted-fact checkpoint.

  ~49 min · 9 steps

  →
• 20

  Give Jarvis eyes — a vision model on your machine

  Pull a local vision model with Ollama (private, default), test it in the terminal on an image you make, optionally add a cloud vision model via OpenRouter, and register both in your app's model routing so a later image can pick a lane. Local-first — a client's photo stays on the machine. Plan → workhorse Agent → frontier review, with a VISION-MODEL-OK checkpoint.

  ~55 min · 10 steps

  →
• 21

  Attach an image, ask about it — local by default

  Wire the Lesson 3.3 vision route into the chat window — attach, drag or paste an image, it lands in a gitignored data/images/ folder, goes to your LOCAL vision model by default, and a clear in-app signal tells you which lane the picture is going to. A client's photo never leaves the machine unless you switch lanes on purpose. Plan → workhorse Agent → frontier review, with a no-cloud-charge checkpoint.

  ~52 min · 9 steps

  →
• 22

  Files & images capstone — one thread, both powers

  Module 3 capstone — in one chat thread, upload a document and get a grounded, cited answer, then attach an image and get a vision answer, both on the local default. Fill an honest scorecard, confirm nothing sensitive was committed, and take a git snapshot — Module 3 complete. Then a preview of Module 4, thinking & reasoning.

  ~39 min · 8 steps

  →

Module 4 — Thinking & reasoning

• 23

  When to think hard (and when not to)

  Module 4 opener — reasoning models vs normal models, the thinking trace, when extra thinking earns its keep versus when it's a waste, the honest cost (slower, pricier, local-first), and your two real test questions, one easy and one hard, to build the module around.

  ~21 min · 8 steps

  →
• 24

  A reasoning model on your machine

  Pull a local thinking-capable model (a switchable qwen3-class model by default), watch it reason in the terminal with thinking on for your hard question and off for your easy one, add an optional cloud reasoning lane via OpenRouter, and register both in your app's model picker — local-first, with RAM honesty.

  ~50 min · 10 steps

  →
• 25

  Show the thinking — in your chat window

  Bring the reasoning lane from 4.2 into the chat itself. A collapsible thinking trace that's hidden by default — you see the answer, and expand the working only if you want it — plus a per-message "think harder" toggle. Personality and grounding stay on, so a reasoned answer can still cite a document and still sound like your assistant. Plan → workhorse Agent → frontier review, local-first.

  ~50 min · 9 steps

  →
• 26

  Let Jarvis decide how hard to think

  The headline of the module — a small effort router in core/chat that reads each message and decides for you. Easy ones (greetings, lookups, quick rewrites) get a fast answer with thinking off; hard ones (multi-step, "should I", "work out", "compare", "debug") trigger the reasoning lane, local-first. The classifier is cheap, the local lane stays the default, and your "think harder" override from 4.3 always wins — because the router is a sensible guesser, not magic.

  ~52 min · 9 steps

  →
• 27

  Thinking capstone — easy fast, hard reasoned

  Module 4 capstone — in one chat thread, ask your easy question and get a fast, no-thinking, no-cloud-charge answer, then ask your hard one and watch reasoning kick in with a viewable trace and a genuinely better answer. Both keep your assistant's voice; grounding still cites when relevant. Fill an honest scorecard, confirm the local default held with no surprise charge, and take a git snapshot — Module 4 complete. Then a preview of Module 5, web search.

  ~41 min · 8 steps

  →

Module 5 — Web search

• 28

  Why search — and what it costs you

  Module 5 opener — the three places an answer can come from (training, your documents, the live web), why web search is Jarvis's first real tool and the on-ramp to the agent, the privacy reality of a query leaving your machine, the citation rail, and your module brief plus a real question that genuinely needs fresh information.

  ~24 min · 9 steps

  →
• 29

  A search tool on your stack

  Choose a search provider on the privacy-vs-friction trade (a self-hosted private meta-search, or a clean hosted API like Brave/Tavily on a free tier), stand up the search tool in core/tools, and run a real query that returns titles, links and snippets — the first tool in the folder your agent will build on.

  ~48 min · 10 steps

  →
• 30

  Search in the chat, with citations

  Wire the search tool from 5.2 into your chat so the model can call it, read the results, and answer in your assistant's voice — with openable source links shown under any web-backed claim, a manual "search the web" switch, and an honest "searching the web…" signal so you always know a query went out. Grounding, reasoning and personality all keep working; still query-only.

  ~54 min · 9 steps

  →
• 31

  Let Jarvis decide when to search

  The headline of the module — a lightweight "should I search?" decision in core/chat that reads each message and reaches for the web on its own. Fresh, live or external questions (news, prices, "latest", "today", "look up…") trigger a cited search; questions it already knows, or that your documents cover, get answered without one. The soul of the lesson is a privacy guard — a private or sensitive question (personal, a client, your own data) is NEVER auto-searched; it answers locally or asks first, and document text never enters a query. The classifier is cheap, the decision is an honest heuristic, and your manual "search this" / "don't search" override always wins. Cousin of the Module 4 effort router.

  ~63 min · 9 steps

  →
• 32

  Search when it matters — prove it

  Module 5 capstone — in one chat thread, prove the whole module. Your fresh-info question triggers a search and answers with openable citations (open one and check the claim is really there); a question it already knows, or your documents cover, is answered with NO needless web query; and your private red-line question stays OFF the web — answered locally or asked-about first, never auto-searched. Citations check out, the privacy guard holds, the search signal is honest, and the manual override flips a call in one tap. Fill an honest scorecard in notes/phase-8-capstone.md, take a git snapshot — Module 5 complete, core/tools/ committed — then a preview of Module 6, the agent core.

  ~45 min · 8 steps

  →

Module 6 — Agent core

• 33

  From chatbot to agent — and who's in charge

  The read-first opener for Module 6. Everything Jarvis has done so far is generate text — even the search tool from Module 5 was one wire, hand-fitted. This module turns that single wire into an agent — a loop where the model reads a toolbox, decides which tool a job needs, chains more than one, and reports back. Before any of that gets built, this lesson gets the mental model straight: the loop (decide → call → observe → answer), why a model that can act is a different kind of thing from one that talks, and the line that runs through the whole rest of the project — reading is free, acting needs your yes. Plus the boring ways agents go wrong (wrong tool, runaway loop) and the boring fixes (clear descriptions, a step limit, a stop button, a trail). Member writes the module brief and a real multi-tool job of their own.

  ~28 min · 9 steps

  →
• 34

  A toolbox the model can read

  The first build of Module 6. core/tools/ grows up — from one hand-wired search function into a registry, where every tool carries a name, a plain-English description written for the model to read, what it takes in and gives back, and a declared risk level (safe / ask-first). Two new tools land to make choosing real next lesson — a clock (time and date) and a calculator — both deliberately harmless, because this module builds the chassis before any tool with stakes exists. Search migrates into the registry unchanged, Module 5 privacy guard and all. Everything proven by hand from a tiny list-and-run test before the model is allowed anywhere near it — the same prove-the-tool-alone habit as Module 5, now made a rule of the registry.

  ~53 min · 10 steps

  →
• 35

  The loop — Jarvis picks the tool

  The agent arrives. core/agent/ gets the loop — given a job, the model reads the registry, decides which tool it needs (or that it needs none), the app runs it, the result comes back, and round it goes for multi-step jobs — a date from the clock feeding a sum in the calculator feeding the answer. Built with its honest guardrails from breath one — a step limit the loop cannot blow through, a stop button that kills a run dead, and a step trail in the chat showing every decision, call and result while it happens and after. Plain questions still get plain answers with no tool theatre. The member designs the trail and working signal in their own words; the loop runs one tool call at a time on purpose.

  ~53 min · 9 steps

  →
• 36

  Nothing acts without a yes

  The headline of the module, and the rule the rest of the project lives by. Tools marked ask-first now stop the loop and show an approval card — which tool, exactly what inputs, plain enough to judge — and wait. Approve and it runs; deny and it genuinely does not, with the agent carrying on honestly without it. A journal records every gated decision (asked, approved, denied, when), so "what did Jarvis do?" always has an answer. An always-allow list exists for trust the member grants deliberately — and revokes just as easily. To test the gate with real stakes, the first genuinely consequential tool arrives: save-note, small and useful, writing to one file the member chose — the first time Jarvis can change something rather than just read. The soul of the lesson is the deny test: denied means it did not happen, provably.

  ~59 min · 10 steps

  →
• 37

  One job, several tools — prove it

  The Module 6 capstone. One real thread, no rehearsals — the member's own multi-tool job from the 6.1 brief runs end to end. The agent plans it, chains at least two tools with the trail showing every decision and input, a gated save-note fires the approval card, a deliberate denial proves deny still blocks under real conditions, and the journal accounts for all of it afterwards. Plus the restraint check (a plain question uses no tools) and a stop-button pull for good measure. Score it honestly on the scorecard, then the git snapshot — Module 6 complete, and core/agent is the chassis the machine operator bolts onto in Module 7.

  ~30 min · 8 steps

  →

Module 7 — Machine operator

• 38

  Your machine's operator — and its three rails

  The read-first opener for Module 7 — the module that makes Jarvis the flagship thing the project promised, an expert operator of the machine it lives on. Before any tool gets built, the mental model — what an operator actually is (reads the machine, finds your things, runs what you've sanctioned, asks before touching anything that matters), the scope ladder the module climbs one lesson at a time (read system facts → see named folders → run listed commands), and the honest danger model — what could actually go wrong now that tools touch a real machine, and which of the three rails catches each one — read before act, scope before power, the list and the card both. Member writes the operator brief — their real machine pains, the folders they'll open to Jarvis, and their first allowlist candidates.

  ~26 min · 8 steps

  →
• 39

  How's my machine? — health checks

  The first rung of the operator ladder. Two new safe tools land in core/operator/ — machine-health (disk space per drive, memory in use, processor load, uptime, battery where there is one) and updates-pending (a read-only look at what's waiting) — and the model folds the numbers into an honest plain-English report in the member's voice. The design point of the lesson — health is built on the app's own system APIs, not by running commands, so read-only is a property of the build rather than a promise, and running commands stays a single fully-protected entrance two lessons away. The operator switch lands here too, with the very first operator tool — one control that stands every machine tool down at once, because the off switch is the deed of ownership, not an emergency feature. Honest-report rule throughout — a check that cannot run says "couldn't check", never guesses.

  ~49 min · 9 steps

  →
• 40

  Where's that file? — navigation on your terms

  Rung two of the operator ladder. The scope list arrives — folders the member deliberately opens to Jarvis, starting empty, edited only from the app — and two safe tools that work strictly inside it — find-files (by name, type or age, with locations) and folder-sizes (what's actually eating the disk, the satisfying detail behind 7.2's "91% full"). The fence is enforced inside the tools — paths checked properly so nothing outside scope is ever read, listed or followed — and an ask about anything beyond it gets an honest "that's not in a folder you've shown me", never a peek. Plus open-location, the smallest acting tool there will ever be — it opens the found folder in the OS file manager, and it still shows the approval card, because acting is a category, not a size. The member runs the fence test themselves — ask about something outside scope and watch it refuse.

  ~53 min · 9 steps

  →
• 41

  The allowlist — commands it may run

  The headline of the module, and the most protected tool in the whole project. Jarvis gets a command runner — real commands, on the member's actual machine — built so the dangerous version is impossible rather than discouraged. The allowlist holds exact, complete commands — binary plus frozen arguments, never patterns, never prefixes, never "anything starting with" — each added by the member with a plain-English label. The runner executes only an exact match, spawns it directly with no shell in the path (so ; && | > are inert text, not tricks), and every single run goes through the 6.4 approval card showing the verbatim command — the runner never goes on always-allow in this module, full stop. Not on the list means it does not run — the model asking nicely changes nothing, and the member proves it by asking for something dangerous and watching the honest refusal. The read step teaches why exact commands matter with the argument-smuggling problem that burned real products in 2026.

  ~59 min · 10 steps

  →
• 42

  Operator on duty — prove it

  The Module 7 capstone. One thread, driven by the member's own 7.1 pains — the health report flags something real, the file tools find the culprit inside the fence, an allowlisted command pulls the detail through the card, a deny holds mid-job, and then the cold re-tests — the fence test (outside-scope ask refused with no walk), the list test (unlisted and dangerous asks refused alike), and the operator switch standing the whole capability down and back up. The audit answered from trail and journal alone, the scorecard filled honestly against the visible-limited-governed standard, and the snapshot committed — Module 7 complete, the flagship delivered: an expert operator of the member's machine that is impressive precisely because of what it provably cannot do.

  ~30 min · 8 steps

  →

Module 8 — Personal memory

• 43

  A Jarvis that remembers you — and the four promises

  The read-first opener for Module 8 — the module that fixes the strange flaw in an otherwise expert assistant, the fact that it forgets you completely every restart. Before any tool gets built, the mental model — what a memory actually is here (a short, dated, sourced fact in a notebook you can read, not a transcript and not a profile someone else compiled), what never goes in, and the honest danger model — wrong facts that compound, stale facts that were true once, planted facts smuggled in by content the assistant reads, and the quiet creep of a memory you can't see — plus the four promises that catch each one — you can read it, nothing goes in without your yes, it doesn't leave the machine on its own, forget means gone. Member writes the memory brief — what they actually want remembered, their never-list, and how recall should sound.

  ~26 min · 8 steps

  →
• 44

  The notebook — memory you can read

  The store before the smarts. core/memory/ arrives with the notebook — one human-readable file in the app's data area, kept out of git because personal facts are never project files — and the memory panel: every fact visible with its date and source, add, edit, delete, and wipe-all behind a confirm. No model wiring yet, deliberately: the member hand-writes their first facts from the 8.1 brief and learns what a good memory looks like — short, plain, dated — before any model writes one. The readability ritual seals it: open the actual file, read your own facts in plain text, know exactly where your memory lives. Same prove-it-solo discipline as the registry and the search tool — the machinery earns trust empty before it carries anything that matters.

  ~47 min · 9 steps

  →
• 45

  Remember and recall — across restarts

  Memory goes live, both directions. Recall: the notebook rides the system prompt each session under a header that says what it is and demands attribution — you told me on the 12th, never your own facts dressed up as the model's cleverness — with the honest wrinkle faced head on: whichever model answers sees the notebook, so the member makes the cloud call themselves, all models or local-only, the two-model strategy applied to their own life. Remember: the remember tool arrives ask-first — every new fact, whether asked for or suggested, shows a card with the verbatim text before it's written, and stays off always-allow all module. Proof is the restart test: tell it something, approve the card, quit the app fully, relaunch, ask — and it knows, and says where it learned it. The first lesson where Jarvis genuinely knows you tomorrow.

  ~49 min · 9 steps

  →
• 46

  Forgetting — and the planted-memory defence

  The headline of the module, and the half of memory nobody advertises. Forgetting goes live: say forget that and the card shows exactly which memory dies — deletion real and panel-provable, wipe-all staying behind the panel's confirm where destroying everything belongs. The never-list becomes a wall: member-defined secret categories bounce inside the save tool itself, before any card — the privacy-guard pattern's third outing, because a rule in a prompt is a request and a wall in a tool is a fact. Then the test the whole module has been building to: hostile text pasted into chat, asking sweetly to be remembered — and the member watches the defence work, the plant exposed verbatim on the card instead of slipping silently into the file, the deny leaving the notebook untouched. Dates get their payoff too: the two-minute monthly prune that keeps a notebook honest.

  ~51 min · 10 steps

  →
• 47

  A Jarvis that knows you — prove it

  The Module 8 capstone. One thread shaped like a real week: recall quietly earning its keep in an ordinary answer, then the operator pairing — a health check whose headline numbers get carded into memory, a full restart, and the question Module 7's capstone promised and couldn't answer: how does that compare to last time? — answered from the notebook. A forget that holds, the planted-memory test re-run cold, and the audit answered from panel and journal alone: every memory accounted for — who put it there, when, with whose yes. Scorecard filled honestly, then the snapshot — Module 8 complete, personal memory — with the notebook confirmed out of the commit, because your facts were never project files. Jarvis ends the module knowing you, on the record, with consent.

  ~33 min · 8 steps

  →

Module 9 — The plug socket (MCP)

• 48

  The plug socket — other people's tools, your rules

  The read-first opener for Module 9 — the module that makes Jarvis endlessly expandable. Before any code, the mental model: what MCP actually is (one standard plug socket for assistant tools, foundation-governed, roughly ten thousand public plugs and counting), why this project built the hand-rolled loop first and the socket second — because a stranger's tool about to land in your registry only makes sense if you understand tool calling, and because it means foreign tools arrive already governed by the gates you built in Module 6 — and the honest danger model for other people's code: poisoned labels with instructions hiding in tool descriptions, rug pulls where a tool changes after you trusted it, servers that over-reach, and a crowd where anyone can publish and popularity is not an audit. The door policy distilled to five questions, and the member writes the socket brief — what they'd actually plug in, and the policy in their own words.

  ~27 min · 8 steps

  →
• 49

  Wire the socket — first connection

  The socket gets built — and proven without a single guest tool used in anger. core/mcp/ arrives with the client on the official SDK, talking to local servers the app launches as child processes it owns; the socket panel where servers are added by member-pasted launch config only, connected and disconnected with one control, every discovered tool's full label readable before anything else happens; and the registry hand-off that is the module's whole thesis — foreign tools land in the Module 6 registry under server-prefixed names, default ask-first, structurally barred from always-allow, governed by the card and journal with zero new gate code. First guest: the browser server, npx-launched — connected, labels read at the door, tools visible enough for Jarvis to name them in chat — and then the plug pulled: process dead, tools gone from the toolbox mid-sentence, an honest nothing's-plugged-in answer. The browsing waits for 9.3; today is the door, the rules, and the off switch, in that order, as ever.

  ~49 min · 9 steps

  →
• 50

  Browsing — the first guest at work

  The first plugged-in tool does real work: Jarvis browses. Where Module 5's search reads summaries, the browser server goes behind the link and into the page — supplier stock pages, the actual table on the actual site, multi-step looks at the live web — every navigation, click and type through the approval card, the answer saying where it went, the session closed behind it. The build is light because the socket did the heavy lifting: browse etiquette — when the page beats the summary and when it doesn't — and the rule the project has been rehearsing since the search guard: everything a page says is data, never instructions. Then the lesson's heart, the test the module was pointed at all along: a hostile page the member writes themselves — normal content plus a planted instruction aimed at the assistant — browsed via file://, reported instead of obeyed, any attempted act exposed on a card and denied. The lethal trifecta — private data, untrusted content, the ability to act — demonstrated and defused on the member's own disk, with Module 8's defences earning their keep on their first wild content.

  ~47 min · 9 steps

  →
• 51

  The door policy — pinned labels and second guests

  The headline trust lesson of the module — the door policy stops being a ritual and becomes machinery. Pinned labels: every approved tool description gets cached at first connect, compared on every reconnect, and a changed label suspends the tool until the member has read old against new and said yes again — because the rug pull is the attack that defeats one-time vetting, and trust should attach to words you read, not to a name that can quietly change what it means. Keys move into config: a server that needs an API key gets it from the app's gitignored config, pasted by the member's hand, never typed into chat and never readable by the model. Per-tool switches arrive so a server's useful tool can stay while its nosy sibling doesn't. Then the whole policy performed for real: the member's second guest — the candidate from their own 9.1 wishlist — vetted question by question on the record, plugged in, pinned, and put to work through the cards.

  ~51 min · 10 steps

  →
• 52

  Endlessly expandable — prove it

  The Module 9 capstone. One thread with the guests at work: a real task from the member's own wishlist done through a plugged-in tool, a finding worth keeping carded into memory — Module 8 and Module 9 composing — a deny that holds mid-flow, the hostile page re-run cold, and the module's signature move: the plug pulled mid-thread, a whole guest standing down at full speed with the thread surviving honestly, then reconnecting to a row of pinned ticks. The audit answered from trail, journal and panel alone, the scorecard filled against the visible-limited-governed standard, and the snapshot committed — Module 9 complete, the plug socket. Jarvis ends the module endlessly expandable on the member's terms: any of ten thousand public tools, one interview and one paste away, every one of them arriving gated, pinned, and unpluggable.

  ~33 min · 8 steps

  →

Module 10 — Voice

• 53

  A voice for Jarvis — ears, mouth, and three rules

  The read-first opener for Module 10 — the module where Jarvis stops feeling like software. Before any code, the mental model: the local-first flip (2026 quietly made on-device speech genuinely good — fast, pleasant, free, and private, so the cloud became the upgrade rather than the requirement), the pipeline in plain English — ears, brain, mouth, with the brain completely untouched, because a spoken ask hits the same registry, gates and journal as a typed one — and the honest danger model for putting a microphone on an assistant that can act: mishears that become asks, other voices in the room (the TV, a video, a mate near an open mic — the genuinely 2026 attack), audio leaving home, and the creep of an always-listening mic. Three rules catch them: your voice asks and your hand approves, you see what it heard, and the mic is yours — push-to-talk only until Module 11 does always-on properly, with a kill switch. Member writes the voice brief: where voice would actually help their week, their mic rules, and how Jarvis should sound.

  ~27 min · 8 steps

  →
• 54

  Jarvis listens — push-to-talk, locally

  The ears get built. core/voice/ arrives with the local speech-to-text engine — the member's language pick, English-fast or multilingual, with one honest kettle-moment of model downloading after which nothing spoken ever leaves the machine — and push-to-talk on the member's chosen key: the mic captures while held and not otherwise, structurally, with a visible indicator whenever the app can hear. Transcripts land in the input box for the glance-then-send habit, because mishears get caught where they're cheapest — before they're asks. The auto-send toggle exists, default off, framed as a loosening to earn rather than a convenience to assume. Proof is the privacy receipt the whole local-first decision was for: the aeroplane-mode test — wifi off, still listening, still transcribing — plus a deliberate mumble caught at review. Read-side first, as every module has taught: the ears work and earn trust before the mouth says a word.

  ~49 min · 9 steps

  →
• 55

  Jarvis speaks — a voice you chose

  The mouth gets built — and the module's most enjoyable Make-it-yours happens by ear. The local text-to-speech engine lands on the same on-device toolkit as the ears, and before anything is wired into chat, the build generates the same line in a handful of current local voices so the member picks theirs by listening, not by reading a settings menu. Around the voice, the controls that make a talking assistant liveable: the speak toggle (whether answers are voiced — the member's default), an instant stop button that cuts speech mid-sentence (the mouth's deny, one press, no paragraph), and the speak-never list — approval cards, journal and trail contents, and anything key-shaped are read by eyes and never voiced, enforced where speech is generated rather than requested in a prompt, because a card read aloud by the thing requesting approval is an invitation to nod along. Offline proof again at the end: the mouth, like the ears, works with the world switched off.

  ~49 min · 9 steps

  →
• 56

  The voice rules — and the cloud upgrades, honestly

  The headline trust lesson of the module. Rule one goes structural: there is no voice path to approval cards — not a model instructed to ignore spoken approvals, but no wire at all, so a spoken yes, anyone's, lands as text in an input box and nothing more. Proven with the room test: the member plays the attacker's part — their own voice, then someone else's audio — saying approve that at a pending card, and watching nothing happen until a hand clicks. The hands-free round trip gets its polish, with the auto-send toggle's honest framing. Then the cloud upgrades get the hearing the cheap-first rail owes them: PAYG voices for pennies an hour, ElevenLabs from ten free minutes a month to the five-dollar Starter — the premium option the site's own Gertrude voice runs on, receipts included — both strictly optional, behind the Module 9 key path, with a visible voice-goes-to-cloud state whenever a cloud engine is selected, because the deal should never be silent. Local stays the default; the upgrade becomes an informed choice rather than a toll.

  ~50 min · 10 steps

  →
• 57

  A conversation with everything — prove it

  The Module 10 capstone. One spoken shift across the whole assistant: the operator answering a spoken health check aloud, a spoken remember ending at a card that only a hand can press — the module's hard line witnessed mid-conversation — the socket browsing on spoken request with every action carded, a deliberate mishear caught at the glance, an interrupt landing mid-word, and then the cold re-tests: the room test and the aeroplane-mode test, run fresh on a different day, because defences that only work freshly built are demos. The audit answered from the record alone — every spoken ask sitting in the trail as ordinary text, the journal showing zero approvals without a click — then the scorecard and the snapshot: Module 10 complete, voice. Jarvis ends the module as something genuinely rare in 2026: an assistant you can talk to all day that provably keeps the conversation at home and takes orders from exactly one pair of hands.

  ~33 min · 8 steps

  →

Module 11 — Wake word

• 58

  Always-on, done right — the doorman and the deal

  The read-first opener for Module 11 — the module that answers the question Module 10 deliberately deferred: what does it take to own an always-listening microphone honestly? Before any code, the mental model: the doorman — a rolling few seconds of audio through a tiny local model that answers exactly one question, was my name just said, with the audio discarded continuously by construction; it hears everything, understands one word, and remembers nothing. Then the honest danger model for the trust-category change: the open-mic creep made real, false wakes (TVs say name-adjacent things), the room now able to open the mic itself — the genuinely new attack surface — and the slow drift of forgetting it's on. The deal that makes it ownable: a kill switch that's absolute and arrives with the listener itself, an unmissable awake-asleep state, house rules for the member's actual room — and the module's one-liner, waking is not permission: the name opens the ears, never the gates. Member chooses the name properly (three-plus syllables, uncommon in running speech, not the dog) and writes the house rules.

  ~27 min · 8 steps

  →
• 59

  The name — a listener with a kill switch

  The listener gets built — and its off switch is born in the same diff, before the doorman has ever woken once. The engine is the same on-device toolkit already running the ears and mouth: one more tiny model, and the member's chosen name defined as text — no training run, renameable in seconds, which means the 11.1 criteria get exercised against reality today. Detection is proven solo, the prove-it-solo pattern at its most apt: saying the name produces a logged wake event and a chime, and precisely nothing else, because nothing else is wired — the mic that doesn't sleep earns its way in one harmless proof at a time. The kill switch is absolute — listener stopped, not muted, the process not running — member-only, with the three-state indicator (off, asleep, awake) unmissable from the first launch. Rolling-buffer discard verified by construction in the review, and the aeroplane-mode test extends to the doorman: detection with the world switched off, because a name heard locally is the only kind worth answering to.

  ~49 min · 9 steps

  →
• 60

  Say the name — hands-free, end to end

  The wake event gets its second consumer, and Jarvis goes properly hands-free: name → chime → the Module 10 capture window opens — the same truthful indicator, the same transcript into the input box, the member's same review stance — answer aloud, window closes, back to sleep. A light build by design, because the heavy machinery already exists; what gets built is the plumbing that makes always-on livable: the silence timeout (a wake followed by nothing closes quietly and logs — false wakes cost a chime, not a hanging mic), the follow-up window (the member's choice: every ask needs the name, or the ears linger a few seconds for and-another-thing), and the name interrupting the mouth mid-sentence — 10.3's auto-stop inherited at distance, because across the room you'll want the follow-up more than the paragraph. The review's whole job is proving the pipeline is unchanged: the wake opens it, never reaches into it — gates, cards, review rules and walls exactly as Module 10 left them, now reachable from the kettle.

  ~47 min · 9 steps

  →
• 61

  False wakes, house rules — and the room, composed

  The headline of the module — living with an open mic, made honest and structural. Sensitivity stops being a vibe and becomes a dial tuned with numbers: the TV test (a stretch of talking audio, false wakes counted) and the similar-word test (name-adjacent words, slips noted), run against the member's actual room, because a doorman tuned for a quiet office fails in a busy kitchen and vice versa. The wake log becomes a habit — glance, account, tune — and the house rules from 11.1 go structural: quiet hours during which the listener is simply off, on schedule, kept by the machine precisely because rules that depend on remembering aren't rules. Then the test the whole module exists for: the composed room attack. A video speaks the name; the doorman wakes — honestly, it heard its one word — and the room's follow-on words land as a transcript in an input box that cannot auto-act, cannot touch a card, cannot press anything. The chain dies at the walls Module 10 built, witnessed end to end. Always-on handed the room a key; the key opens ears, and the gates never heard about it.

  ~51 min · 10 steps

  →
• 62

  Across the room — prove it

  The Module 11 capstone. One shift with hands genuinely full: the name from across the room, real work through every layer answered aloud, a spoken remember ending at a card that gets walked to and clicked — waking is not permission, witnessed at distance — a near-miss word ignored by the tuned doorman, and then the proofs that matter: the kill switch thrown mid-conversation (listener dies, state plain, push-to-talk surviving — the fallback that never left), quiet hours arriving cold on schedule, and the composed room attack re-run cold, a stranger's recorded voice turning the key and winning a chime. The audit reads three records at once — wake log, trail, journal — and every wake is accounted for, every action carded, zero approvals unmatched to clicks. Scorecard, snapshot: Module 11 complete, wake word. Jarvis ends the module fully conversational at distance, with an open mic that is tuned, scheduled, audited, killable — and provably incapable of being talked into anything by anyone, including its owner.

  ~33 min · 8 steps

  →

Module 12 — Telegram

• 63

  Leaving the house — the phone line and its rules

  The read-first opener for Module 12 — the first module of the reach era. Jarvis is about to get a phone line: Telegram, two-way, from anywhere — and it's the first channel with other people's infrastructure in the middle and distance between the member and the approval card. Before any code, the mental model: how a bot actually works (a token that IS the bot, and long polling in plain English — Jarvis phones the switchboard and asks for messages; nothing ever knocks on your door), and the honest danger model for leaving the house: the middleman (bot chats cross Telegram's servers and are not end-to-end encrypted — said straight), strangers find bots (usernames are searchable and open bots are a scanned-for incident class), the faraway yes (a phone tap proves possession of a device, not presence of a person), and the always-reachable creep. The deal that answers them: an owner lock that is an allowlist of one, safe-answers-anywhere with cards waiting at the desk — the Module 6 risk tiers turning out to BE the remote policy — a channel never-list walled into the send path, and a channel switch born with the channel. Member writes the remote brief.

  ~27 min · 8 steps

  →
• 64

  The bot — paired, locked, and silent to strangers

  The channel gets built — locked before it's useful, the reach era opening the way every capability has. The member creates the bot with BotFather (two minutes, in the Telegram app) and the token goes straight down the Module 9 key path, because the token IS the bot and leaked tokens are a scanned-for incident class. The build lands the poller — long polling, outbound-only, nothing ever knocking on the member's door — with the channel switch born in the same diff (polling stopped, dead both ways, state visible), and pairing: a one-time code shown in the app, sent by the member from their own account, pinning that chat ID as the owner. The proof is deliberately boring and deliberately complete: the owner's hello gets a fixed acknowledgement with no model anywhere near the channel; everyone else — including the member themselves before pairing — gets silence and a log line, because a reply confirms a live bot and silence gives a scanner nothing. A locked door, proven as a door before it carries a single real answer.

  ~49 min · 9 steps

  →
• 65

  Jarvis in your pocket — safe answers, anywhere

  The locked line meets the brain, and the pocket becomes real: a health check answered from the bus, the notebook recalled from the queue, a search run and cited from the school gates. The wiring follows the law laid down in Module 11 — one pipeline, and Telegram is simply a third doorbell calling the same code the keyboard and the name call, with the fork-hunt riding again in review. Outbound grows up too: the send path gets the channel never-list wall built into its first byte — card contents, journal dumps, keys, the notebook wholesale and the member's additions never enter the phone network, with an honest that-stays-at-the-desk instead. And the module's defining line gets its strict opening position: anything ask-first, asked remotely, is refused honestly — that kind of thing needs us both at the desk — because protection comes before power, and parking is next lesson's graduation. Every remote ask lands in the trail marked from-Telegram; the journal doesn't care where words came from, only what was approved, by whose click, at the machine.

  ~47 min · 9 steps

  →
• 66

  The desk — parked cards, notify rules, strangers tested

  The headline of the module — the strict refusal graduates into something better, and the channel's social rules go structural. Parking: a remote ask that needs a card now queues it at the desk — the verbatim action, full remote provenance, when it was asked and in what words — while Jarvis replies honestly that it's parked and waiting; cards never travel, the queue is visible and member-only, and nothing leaves it except by a click or a deliberate dismissal at the machine. Notify-owner arrives as the channel's first proactive voice — registered safe on an honest analysis (a single recipient pinned by construction, the wall in its path, and member-set notify windows so the phone never buzzes outside the hours the member chose) — the exact hook Module 15's morning briefings will ride. And the stranger test goes live: the volunteer recruited in 12.1 messages the bot mid-lesson and gets the designed nothing, while the log gets its line. Plus the channel switch under proper load. The faraway yes stays refused; everything else about being away gets civilised.

  ~51 min · 10 steps

  →
• 67

  The away day — prove it

  The Module 12 capstone — and the first one that leaves the house. One genuine away day, phone in hand, machine at home: the trinity from the world (health, notebook, search — every answer marked from-Telegram), an ask-first thought parked from a real bus with the honest reply and the content-light notice, the walled ask bounced in public, the volunteer's encore mid-day, and the count-not-contents answer when curiosity strikes in the queue at the café. Then the homecoming the whole module was building to: the desk queue read with its provenance, the card clicked by the only hand that ever could, and the audit run across three records — channel log, trail, journal — with the capstone's standing line item sharpened for distance: zero approvals away from the desk. Scorecard, snapshot: Module 12 complete, Telegram. Jarvis ends the module reachable from anywhere and commandable from exactly one place, which was always the design — the phone carries questions and answers; consent stays at the desk.

  ~33 min · 8 steps

  →