# Under the hood: what Matt Edmund is deep in

> Security: agents never hold a key, a sandbox per job, five adversaries, per-user keys and tamper-evident logs. Context: re-decided every turn, small models judge and big models think, sub-second recall, a nightly "sleep" pass. Reliability: fail closed, replay everything, measured with Card IQ and Tool IQ, every change attacked by a reviewer. Golf: a Rust engine bit-identical on iPhone and server that works with no signal, courses as checkable geometry, on-device models. Items marked (building) are in progress.

## Security

- **Agents never hold a key.** One Rust executor holds every credential. Agents propose typed effects, policy checks them, and anything irreversible is signed with a passkey on his phone. The box re-checks the exact proposal hash before it acts. (Rust, passkeys, typed effects)
- **A sandbox per job.** Every agent job gets a throwaway VM: a fresh clone in, a branch out through an egress proxy, then it's destroyed. The reader that touches untrusted text has no network and no shell. (Apple container, gVisor, egress proxy)
- **Five adversaries.** Threat-modelled against the AI being tricked, other tenants, outside attackers, the operator and the cloud provider. Every answer passes a no-leak gate per audience and holds when unsure.
- **Keys per person, logs that can't lie** (building). Per-user encryption keys, an append-only audit trail of every record an answer read, and access that fails closed; built toward an operator who can't read your vault. (XChaCha20-Poly1305, HKDF, hash chain)

## Context

- **Re-decided every turn.** On each turn, lenses run over a knowledge graph and build a fresh map of what matters. The model reads that map, never a fixed prompt.
- **Small models judge, big models think.** Fast System One judgment models do recall, routing and classification. Frontier models are spent only on meaning. (TypeSafe Jev, MCP)
- **Recall under a second** (building). A warm in-memory runtime, precomputed neighbourhoods and local int8 embeddings. Text lives in git, links live in Postgres. (ONNX, Postgres, pgvector)
- **It sleeps** (building). A nightly pass relinks everything, refreshes the cards and precomputes what you're likely to ask next.

## Reliability

- **Fails closed, heals forward.** When unsure, refuse. A failed rebuild keeps the last good image and finishes the rest. Next: an alert turns into a draft fix from the always-on box (building).
- **Replay everything.** Every fact keeps its history, and links know when they were true. Each new lens re-runs over the whole past, so improvements reach old data too.
- **Measured, not vibes.** Card IQ scores whether a model can use a memory. Tool IQ scores whether it picks the right tool. Golden corpora gate every release.
- **Attack it yourself.** Every change gets a reviewer whose only job is to break it. That's how a policy bug got caught that every test had passed.

## A caddie that does the maths

"A model can say anything. A golf ball can't." Drop The Hands is where Matt tests whether AI can be trusted with a real decision. The full walk-through, on a real hole: https://33prime.io/caddie.html

- **One engine, two chips** (shipping). The Drop The Hands caddie is a Rust engine that gives bit-identical answers on the iPhone (arm64) and the server (x86), through UniFFI and PyO3, checked against a golden corpus. On the phone, the Watch and the lock screen.
- **The maths decides, the model talks** (shipping). Monte Carlo strokes-gained aim and a rule-based club policy compute every number. The language model only explains them, behind a live contradiction guard.
- **Courses as checkable geometry** (building). Golf Course Atlas turns real courses into centrelines, fairway-width profiles and cross-sections. A physical-sanity validator blocks anything that couldn't exist. Hundreds of courses mapped.
- **Models on the device** (building). A small caddie model and voice intent on the phone. One speech model everywhere (Parakeet v3, int8 ONNX). Local int8 embeddings, with no outside API.
- **Works with no signal.** GPS on the phone, the course and the engine on the device.

## Stack, in short

Rust, Python (FastAPI), TypeScript, Swift/iOS, Postgres and pgvector, ONNX on-device models, MCP (Model Context Protocol), Claude and other frontier models, TypeSafe Jev judgment models, Fly.io.