Personal harness — your phone, your bot

The iMessage + WhatsApp bridges run on your own Mac and answer as you. The personal harness is the whole stack behind that: it senses what's happening, remembers you and the people you talk to across every channel, reasons about what to do, makes the reply sound like you, and then acts — all owner-only and local, with nothing about your whereabouts ever revealed to a contact.

The harness, end to end

Five layers, top to bottom, fed by your surfaces and grounded by the control plane. Every cell links to the section that explains it. The memory layer (amber) is the cross-app store — one canonical identity and one timeline that every other layer reads from and writes to.

Your agents

Fifteen agents make up the personal suite across three execution models. Ten are owner-facing — they nudge or brief you in your self-chat and never touch your contacts. Only the two assistant agents reply to contacts as you. Four bridge-signal agents react to device signals on your Mac. This distinction matters for trust: owner-facing agents can be aggressive and proactive; assistant agents carry the weight of impersonation.

How each agent loops

Each diagram shows the stages of one agent's cycle — solid arrows are the forward flow; the dashed arc loops from the last stage back to the first. Agents are grouped by how they execute. The two contact-facing agents are rose-highlighted because they reply as you to real people — they carry the full weight of impersonation.

Scheduled — runs as a Lantern agent on a cron timer

These agents are created via POST /v1/agents and run on the Lantern platform on a cron schedule — visible in the dashboard with runs, cost, and history like any other agent. Gmail-reading agents need the Gmail connector installed. LANTERN_CONCIERGE=on enables bridge nudges from concierge; the rest are always-on once scheduled.

Bridge loops — runs on your Mac, driven by device signals

These agents run inside the bridge process at a short interval and react to iPhone signals (driving state, sleep data, step count, Focus mode). Each is opt-in via its env var — set the var and the loop activates on the next bridge restart. They never leave a message if the signal threshold isn't met, so they stay silent when there's nothing actionable.

Reactive — fires on every inbound message

The two assistant agents sit in the bridge's message handler and fire on every inbound message from a contact. They carry the full weight of impersonation — everything in the harness (owner voice, bot-tell guards, pacing, draft-and-confirm, claim verifier) exists to keep them indistinguishable from you.

L1 · Sense — signals & ingestion

The harness starts from real-world context. iPhone automations (geofences, Focus, the Action Button, NFC, and CarPlay / Bluetooth → driving) fire signed Shortcuts that POST one tiny signal — location, focus, device, health, media — to the control plane over a private Tailscale network. On-device screen and app-usage stays owner-only and never leaves the Mac; inbound email is ingested and classified into life-events; and every inbound message on every channel is a signal too. The bridge reads the signals file fresh on every owner turn, in front of the LLM, so a signal that just landed is already in context with zero polling lag.

The phone-trigger flow in detail — triggers, the token-gated /v1/signals hop over Tailscale, and the on-demand read:

Each trigger is a one-line iOS Personal Automation wired to a signed Shortcut. Generate the whole set with one command — scripts/iphone/app-context/generate-signals.sh writes 13 ready-to-import shortcuts to your Desktop (the signal token is baked in, so they're never committed). Full recipe + trigger table: RICH-SIGNALS.md; remote-access setup in REMOTE-ACCESS.md.

L2 · Remember — cross-app memory & identity

This is how the harness stores cross-app stuff. The person graph resolves any (channel, handle) — an iMessage address, a WhatsApp JID, an email, a phone number for voice — to a single canonical person, so what you learned about someone on WhatsApp is there when they email or call. On top of that identity sit two recall indices: episodic memory (a rolling 14-day log of date · topic · outcome per contact) and a 7-day topic index that surfaces what other threads said about the same topic, so cross-thread context is available without ever volunteering it.

The owner profile — your facts, per-contact relationship rules, and the style lessons the 👎 flywheel mines — is injected as ground truth into every reply. Presence is a live cross-bridge view of whether you're reachable, and the life-events ledger records classified bills, deliveries, travel, and fraud alerts so the dashboard can show a feed and per-category trust toggles. The substrate is deliberately split: local 0600 JSONL on the Mac for the most personal signals (episodes, topics, dislikes) and control-plane Postgres with row-level security, encrypted at rest for the tenant-scoped person graph, memory events, and life-events. Because both channels write the same person and the same timeline, a fact learned on one channel is recalled on the other for the same canonical person.

L3 · Reason — decisioning & orchestration

With context and memory in hand, the harness decides what to do. The life-event engine classifies inbound into typed events and extracts their fields; the auto-act ladder routes each one by your per-category trust setting — safe-auto (just do it), ask (one-tap confirm), or never. The availability concierge turns live presence plus your calendar into truthful replies for contacts who ask if you're around, while anticipation fires proactive nudges to your self-chat for pre-meetings, anniversaries, overdue replies, and open commitments. When a meeting is in play, scheduling can propose, hold, and confirm a concrete time and book it.

L4 · Sound like you — persona & authenticity

A correct reply still has to sound like you. Owner-voice is mined from your real sent messages, and a language & dialect modality keeps the bot in your attested forms — never invented word-forms. The last pass before every send is the bot-tell guards: they suppress drafts that use customer-service stock phrases, leak reasoning, or deny your biographical facts, and trigger a regeneration instead of staying silent. Pacing replays your real per-contact reply latency with typing indicators, and draft-and-confirm plus the claim verifier hold low-confidence replies for your approval and rewrite any “I did X” the bridge can't actually back up into honest intent form.

L5 · Act — actions & delivery

Finally the harness follows through. Reply send delivers the paced message on the right channel (with an SMS/RCS fallback when an iMessage send fails). Mac actions create Calendar events, Notes, and Mail via locale-safe AppleScript — only after you confirm. Connectors (Gmail, Calendar, and the rest of the 17) reach your other systems through the control plane, and voice calls place real outbound calls over Twilio or LiveKit when a task needs a phone, not a text.

Safety & privacy — the rail beside every layer

Privacy isn't a layer; it runs alongside all of them. Owner-only enforcement means the doc, action, and command pipelines fire only for the owner — DMs from non-owner contacts never reach them. A hard location-leak guard ensures the concierge shares availability only — never your location: a contact asking “where are you?” gets “he's away from his phone right now”, not a place. A master kill switch lets you silence all inbound from self-chat. The most personal stores are local 0600 and path-restricted, and secrets never appear in logs, traces, or run state. See Security for the full model.

Privacy recap

• Signals are stored only on your Mac, mode 0600. They never leave your machine.
• The composite summary grounds your own self-chat — the bot never volunteers it and never reveals it to a contact.
• The token gates the endpoint; keep it server-side only.
• Turn it off any time: LANTERN_IPHONE_SIGNALS=off on the bridge, or unset LANTERN_SIGNAL_TOKEN on the receiver.