Reads everything.Sends nothing I have not approved.
Adapted and tailored to my life to stabilize it end to end. It runs on a Mac mini in my home, reads four mailboxes, and was never granted a scope that can send.
What it does01 — What it does
One operator for the whole day.
Not an inbox app and not a calendar app. One agent that holds the threads of a life together, end to end.
- ScheduleMeetings aggregated across every inbox into a single schedule.
- ProjectsProject sessions orchestrated from one place.
- DraftsMessages and email drafted, and held until I approve them.
- PeopleRelationships managed, so nobody who matters goes quiet.
- BodyFood and workouts tracked.
02 — Privilege separation
Two planes. One of them cannot speak.
The part of Leona that reads mail, classifies it, and proposes what to do is a no-egress plane. It has no send client, no raw network module, and no import path to the part that acts.
That is not a promise in a document. It is a lint rule and a dependency graph that fail the build. A separate actuator plane is the only thing in the system allowed a side effect, and it moves only on approval.
Reader plane
Reads, classifies, proposes.
no egressActuator plane
The only plane permitted side effects.
approval requiredADR-0001 — enforced by no-restricted-imports in lint and by dependency-cruiser in CI.
03 — Where it lives
It lives in a house, not a region.
No cloud host. No cloud database. Leona runs on an always-on Mac mini and is reachable through a Cloudflare Tunnel, so no public port is opened on the network.
Postgres binds to localhost. The disk is FileVault-encrypted. Mail and OAuth tokens stay on that machine. Nothing is mirrored to a server I do not own.
04 — What it is allowed to know
Read-only, and forgetful on purpose.
Four mailboxes, connected with gmail.readonly. A send scope was never granted, so there is nothing to revoke.
Message bodies are never written to the database and never written to a log. Mail from institutional accounts is redacted before it reaches any model. What the ledger keeps is the shape of a message, not its contents.
05 — Approval
A draft is a row until I say otherwise.
What Leona writes is a row in Postgres. It becomes a message only when I approve it.
Every action lands in an append-only audit log. Sign in with Apple, pinned to a single owner, so nobody else can mint a session — not another person, and not the agent.