Reads everything.Sends nothing I have not approved.
A personal email and calendar agent for one person. It runs on a Mac mini in my home, reads four mailboxes, and was never granted a scope that can send.
How it is separated01 — Privilege separation
Two planes. One of them cannot speak.
The part of Leona that reads mail, classifies it, and proposes what to do is a no-egress plane. It has no send client, no raw network module, and no import path to the part that acts.
That is not a promise in a document. It is a lint rule and a dependency graph that fail the build. A separate actuator plane is the only thing in the system allowed a side effect, and it moves only on approval.
Reader plane
Reads, classifies, proposes.
no egressActuator plane
The only plane permitted side effects.
approval requiredADR-0001 — enforced by no-restricted-imports in lint and by dependency-cruiser in CI.
02 — Where it lives
It lives in a house, not a region.
No cloud host. No cloud database. Leona runs on an always-on Mac mini and is reachable through a Cloudflare Tunnel, so no public port is opened on the network.
Postgres binds to localhost. The disk is FileVault-encrypted. Mail and OAuth tokens stay on that machine. Nothing is mirrored to a server I do not own.
03 — What it is allowed to know
Read-only, and forgetful on purpose.
Four mailboxes, connected with gmail.readonly. A send scope was never granted, so there is nothing to revoke.
Message bodies are never written to the database and never written to a log. Mail from institutional accounts is redacted before it reaches any model. What the ledger keeps is the shape of a message, not its contents.
04 — Approval
A draft is a row until I say otherwise.
What Leona writes is a row in Postgres. It becomes a message only when I approve it.
Every action lands in an append-only audit log. Sign in with Apple, pinned to a single owner, so nobody else can mint a session — not another person, and not the agent.
05 — On the phone
Four screens, and no fifth.
- TodayAscent — the daily check-in and the streak.
- ScheduleTime Ledger — day, week, month.
- InboxWhat arrived, classified.
- ApprovalsWhat is waiting on me, and nothing moves until it is.