Built for ourselves, used internally, then released
What these tools share: kernel separated from shell, AI integrated as a first-class citizen, structured CLI output. Each one ran internally before we dared ship it.
Obsidian for bookkeeping: local-first, an on-device AI finance copilot, and a plugin system open to any AI. All ledger data is encrypted on the machine and AI analysis never leaves the device. Only sync requires an account and a fee; local capability is free forever.
01$ ledger-cli doctor02{ "ok": true, "store": "ledger-mac.store", "readonly": true }0304$ ledger-cli stats --month 2026-0905{ "monthExpense": 12483.20, "monthIncome": 32000.00,06 "netWorth": 486210.55, "wallets": 7 }A kernel-first developer toolbox: a Rust algorithm kernel underneath (the newtool CLI) and a Tauri 2 desktop app with a React shell on top. One kernel serves three consumers — AI (skill packages / MCP), humans (desktop app) and the browser (wasm).
01$ newtool list --json02{ "count": 3, "algorithms": ["base64", "jwt.decode", "uuid.v7"] }0304$ newtool run jwt.decode --params '{"token":"eyJhbGci..."}'05{ "ok": true, "data": { "header": { "alg": "HS256" } } }A capture proxy benchmarked against Proxyman that turns debugging sessions into a shared team asset. The only contract between the Go kernel pxc-core and the platform shells is a /v1 HTTP/WS API: macOS Swift, Windows WinUI and Flutter all share the same kernel.
01$ pxc sessions --host api.github.com --status 500 --limit 2002[ { "id": 42, "method": "POST", "path": "/v1/pay", "status": 500 } ]0304$ pxc bp respond 7 --status 201 --body '{"ok":true}'05{ "released": true, "mode": "mock" }How we build products
Not methodology slogans — hard constraints written into each repository’s AGENTS.md and enforced on every commit.
Product capability lives in a testable, reusable kernel; the UI is just a shell. Algorithms are written once and shared by people and AI alike.
Sensitive data stays on the user’s device by default; the cloud only handles what it must — sync and collaboration.
Kernel and shell agree on exactly one contract — a /v1 API, a CLI envelope or an algorithm manifest — so behaviour is identical across platforms.
Every product reserves an integration point for agents: identity, credentials, a read-only CLI and structured output, so AI can work safely.
Once a data model is settled it is never overturned. Load-bearing walls are fixed; everything else is free to iterate quickly.
From identity audit to captured traffic, every action is traceable, replayable and shareable. Debugging stops relying on word of mouth.
Hand the complexity of identity, agents and private domain to one governable kernel
Whether you are replacing an existing IAM, building an agent platform, or trying to make private-domain operations actually work — start with a 30-minute architecture call. We will first judge whether this is the kind of problem we are good at, and say so plainly if it is not.