The problem
Chat assistants reset to zero every session. A personal assistant is only useful if it accumulates context over months — and accumulating context is only acceptable if the thing holding it cannot be talked into leaking it. Max is built around both constraints at once: memory that compounds, and a security model that defaults to no.
Architecture
Memory. Structured memory items — identity, preferences, projects, events — extracted with source attribution and deduplication. Retrieval is hybrid: dense and sparse signals ranked together, so results match semantically and lexically. Each memory type has its own staleness window, and memory is isolated per user and per channel. Embeddings run locally by default (ONNX), with automatic fallback to cloud providers.
Identity. Behavior lives in SOUL.md. During onboarding the assistant observes how its user communicates and writes its own personality files; a per-user journal captures reflections on past interactions, and NOW.md acts as an ephemeral scratchpad for current focus.
Proactivity. Every hour the assistant checks in with itself — re-reads its notes, notices what is unfinished or due soon, and sends a message if warranted. Notifications route to the right channel and hold back if a conversation is already in progress.
Trust. The trust engine is fail-closed: actor identity is resolved once (guardian, trusted, or unknown) and enforced everywhere. Untrusted actors cannot read or write memory, trigger tools, or escalate. Credentials live in a separate process and never reach the model; every tool runs in a sandbox.
Capabilities are manifest-driven plugins (SKILL.md + TOOLS.json) that inject tools and prompt sections at runtime. One assistant spans the macOS app, Telegram, and Slack with shared memory, and swaps between Claude, OpenAI, Gemini, and Ollama without any other change.
What's verified here
The assistant answering questions in the corner of this site is a version of Max — same retrieval pattern, same grounding discipline, with this portfolio's project files as its corpus. Asking it about a claim on this page is the demo.
Honest limitations
The fail-closed security model is an architectural guarantee, not an external audit — the threat model and enforcement points are documented, but no third-party review is claimed. The desktop app is the primary surface; the CLI works but is explicitly secondary.