A local-first, permission-gated personal AI assistant running entirely on home infrastructure — voice interaction, natural-language memory, full calendar and email management, and a searchable knowledge base via RAG.
Wake-phrase detection runs on the Mac Mini itself, so audio never leaves the machine, and dictation drops straight into the vault inbox. The console is reached over a private Tailscale link rather than an exposed port.
Every connector is deny-by-default and needs an explicit permission grant. Anything destructive waits for human confirmation before it runs, and the audit log and permission state are panels in the interface rather than buried in config. Built end-to-end with Claude Code.
What I'd do differently
A real security audit on the build caught and fixed an OAuth CSRF gap and a container timezone bug.