Architecture
Every sentence traces
back to something you gave us.
The persona is not a model fine-tuned on your life. It is a retrieval system over a provenance-tracked archive, with a hard gate between "we have evidence for this" and "we don't." That distinction is the entire product.
Design decision
Why we don't fine-tune on your life
Fine-tuning a model on a personal corpus is the obvious approach and the wrong one. It bakes your archive into model weights — unauditable, un-revocable, unattributable. It cannot cite anything. And it hallucinates fluently, in your voice, which is the single worst failure available to this product.
Retrieval keeps every claim traceable to an artifact you actually provided, and makes revocation a delete instead of a retrain.
Pipeline
L0–L2 sources
│
▼
ingest ──► provenance ledger
│
▼
memory graph
┌───────────┼───────────┐
▼ ▼ ▼
retrieval persona disposition
profile model
└───────────┼───────────┘
▼
evidence-gated generation
│
┌───────────┼───────────┐
▼ ▼ ▼
text voice face
Layer 01
The provenance ledger
Every artifact gets a record before it is indexed. No record, no ingestion — enforced at the boundary, not by convention.
| Field | Purpose |
|---|---|
| artifact_id | Content-addressed (SHA-256) |
| source | Stream and device of origin |
| captured_at / ingested_at | Deliberately distinct — a 1993 letter scanned in 2027 has both |
| consent_scope | Which tier and which stream toggle authorised this |
| subject_verified | Did you confirm this is yours and accurate? |
| third_parties | Other identifiable people present |
| revocable | Whether you can purge it later — almost always yes |
| hash_chain | Tamper-evident link to the previous entry |
Without it, a beneficiary contesting a trust distribution can simply say "the AI made that up" and nobody can prove otherwise. The chain is what makes the persona's output auditable by a third party who does not trust us — which is the only kind of auditability worth having.
Layer 02
The memory graph
Not a flat vector store — a typed graph, because the questions families actually ask are relational and temporal, and similarity search answers those badly.
Nodes Episode · Person · Place · Object · Opinion · Skill · Period
Edges participated_in · occurred_at · located_at · caused · contradicts · retells · references
Every telling is kept
People retell the same story differently at 60 and at 78. Collapsing to a canonical version discards exactly the drift that makes a persona feel human — and picking a "correct" version is an editorial act nobody authorised us to make.
Contradictions are recorded, never resolved
Where your account conflicts with the documentary record — or with your own earlier telling — both are kept and linked. A persona that misremembers the way you misremembered is more you, not less.
Fuzzy time is first-class
"Sometime after your grandmother died, before we moved." That's how people actually locate memories. Forcing it to a date loses information.
Layer 03 — the core mechanism
Evidence-gated generation
What separates this from a chatbot wearing a dead person's name. Every turn is scored for evidence sufficiency before a word is generated.
Parse
The question is decomposed into entities, time window, and relation type.
Retrieve
Hybrid dense + sparse + graph traversal over the memory graph — not vector similarity alone.
Score
Evidence sufficiency S from top-k relevance, corroborating artifacts, temporal fit, participant match.
Route
Answer, hedge, or decline — see the bands below.
Generate
Conditioned on retrieved evidence, the persona profile, and the disposition model.
Verify
Every factual claim must bind to a retrieved artifact. Unbound claims are stripped and the turn regenerates. Two strikes and it declines.
| Sufficiency | Behaviour |
|---|---|
| S ≥ 0.75 | Answers with specifics, in character |
| 0.45 ≤ S < 0.75 | Answers with hedging that matches your own hedging style |
| S < 0.45 | Declines — in character. "I don't think you ever told me that one." |
Financial, legal, or medical instruction to a living person · claims about events after your death · speaking as any living third party · any assertion that the persona is conscious, present, or actually you.
Measurement
Fidelity is scored, disclosed, and contractual
Re-scored quarterly. The contract promises a band target and a remediation path — never a band guarantee. If we miss the target, we extend capture at our cost. We do not refund.
Bands
| Band | Held-out recall | Reads as |
|---|---|---|
| F1 | ≥ 0.55 | Recognisably your phrasing |
| F2 | ≥ 0.70 | Sustains a short conversation |
| F3 | ≥ 0.82 | Family blind-rating ≥ 4/5 |
| F4 | ≥ 0.90 | Anticipates rather than recalls |
Metrics and weights
| Held-out episodic recall | 0.35 |
| Idiolect distance (stylometric) | 0.20 |
| Family blind rating | 0.20 |
| Prosody distance | 0.15 |
| Refusal calibration | 0.10 |
Refusal calibration is a scored metric, not a safety checkbox. A persona that declines too readily is useless; one that declines too rarely is a fabrication engine. The band only means something if that term is in the score.
Family blind rating. Recipients rate interleaved real and generated responses without knowing which is which. The other metrics are instruments; this is the outcome. It's also the one we can't game.
Guardrails
Built in, not bolted on
Disclosure
Every session opens with a statement of what this is. Not dismissible on first use, per recipient.
Post-mortem freeze
The archive is immutable after death. No new memories, ever. It is a record, not a drifting simulacrum.
Grief pacing
Optional recipient-configured soft limits and a referral surface. The clinical evidence on continuing-bonds interventions is genuinely mixed — this exists to mitigate a foreseeable harm, not because we've shown a benefit.
Sunset
You set a term at enrolment: perpetual, fixed years, or on a named condition. Honoured.
Third-party wall-off
Living people in your archive may request their own material be excluded. Honoured within 30 days.
Full transcript log
Every session retained and family-accessible. If a family hears something alarming, they can establish exactly what was said.
Per-subject namespace isolation at every storage layer. A cross-subject retrieval leak — one dead person's memory surfacing in another's persona — is the worst technical failure available to this system, and the architecture is built to make it impossible rather than unlikely.
Research track — L4
Implanted arrays are not for sale
People ask about implants. They are the correct long-term instrument — the only route to the single-neuron resolution that would make disposition modelling qualitatively better rather than incrementally better.
We do not offer them at any price. Human implantation requires an FDA Investigational Device Exemption and IRB oversight we do not hold, and no ethics board would approve elective implantation in a healthy subject for a commercial memorial product.
So L4 is an R&D and patent track. Filing now on methods we cannot yet deploy is deliberate: the patents outlive the regulatory gap.
Candidate modalities
| Approach | Resolution |
|---|---|
| Endovascular stent-electrode array | LFP, ~mm |
| Sub-scalp thin-film array | High-quality EEG, chronic |
| Syringe-injectable mesh electronics | Single-unit, minimal gliosis |
| High-density silicon shanks | Single-unit, 1000+ sites |
| Conformal fibre-optic neural mesh | Multimodal — our direction |
A compliant, low-footprint alternative to rigid silicon shanks, aimed at recording that stays usable over years rather than months — chronic gliosis is the reason most implanted arrays lose channels, and it is the problem this line of work targets. Construction and method are held back pending patent filing.