After the first use on learn.halkyon.eu, the developer decided how the
operator's side scales and how much an assistant thinks: the figures'
months oldest first (D57); a budget per person covering the assistants
granted, one sheet granting several people several assistants (D58,
amending D3); the budget in money and tokens, each optional (D59);
assistants grouped by provider, each in its colour, no logos (D60); a
handle chosen among those that exist (D61); the operator's screen an
overview of screens, loaded 50 at a time (D62); and effort within the
operator's range, chosen by the person (D63).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
The developer's decisions of 26 Oct (D1-D5) and the calls made
building it; notes in ADR 0017 (point 10) and ADR 0021 (D54) on what
it amends; Learn's AGENTS.md on the sidecar and the checks.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
A draft is changed in a sheet of its own, as the composer saves a card
as soon as it is left; a note's cards come from the whole note, its
selection left for later; the entry is "Flashcards from a text". The
developer agreed to all three on 26 Oct.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
Explaining a miss in a snack bar after Bad, checking as a wrong typed
reading's Why? and Check in the field, cards from text as drafts in a
sheet, made from a note, a PDF page or pasted text.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
The first part of step 3, decided as D47 to D52 in ADR 0021: where a
conversation shows (a sheet over the screen), where kept ones are found
(the field), the scope's chip and that it starts with only what is
ticked, how conversations are kept, and what a device that can't seal
does.
Two synced tables: assistant_conversation (its title, assistant and
scope) and assistant_turn (one question and everything up to its answer,
never changed once written, ADR 0001, rule 2), so two devices continuing
a conversation offline lose nothing. SyncConversationGateway seals every
row with the person's key, a turn bound to its conversation, and reads
no row that isn't sealed: a device that can't seal keeps nothing (D52,
ConversationNotKept). Deleting one blanks it and its turns first (ADR
0002, rule 2). A turn keeps every message a follow-up sends back (tool
calls and results, the providers' own blocks), but no image, only that
one was sent.
The instance's privacy page says conversations are kept, encrypted, and
what the instance sees of them.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
D45: chat completions in each known host's dialect (OpenAI, Mistral,
Gemini, OpenRouter), in a common one to every other host. D46: OpenAI's
Responses API as a third protocol, stateless, its encrypted reasoning
sent back. D30's field at OpenAI is safety_identifier, at OpenRouter user.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
Step 2's decisions: the answer streams over Serverpod's own stream; the
adapters are tested on replies written from the providers' documentation and
on recorded ones later; the assistants, their keys and prices sit in
deploy/assistants.env, passed whole to the server alone; the instance's
/privacy describes the whole instance; the agreement is kept on the grant;
figures are kept 3 months, by UTC's days and months; a member offers no
assistant yet.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
The wait screen says the account is approved and leads to the usual
sign-in, which opens the keys and sets up the authenticator: a pass is
never worth a session. The pass deletes only a new account that was never
approved; a suspended one keeps its data, and deleting it takes its
owner's password and a code, as ADR 0017 has every deletion.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
A waiting account gets no session but a pass, the operator role is a
scope made first by SQL, the matching code is four BIP-39 words the
operator reads, and the operator's card is in Settings.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
The developer's decisions of 25 Oct, reviewing ADR 0021 whole:
- What an assistant may see and do (D7–D12): the scope of each question
(the parts ticked, the studyset, its tree, the library), looked up
through read-only tools the app answers on the device; private
studysets out of a wider scope unless switched on, and a warning
whenever one's content would go to a remote model, Lumo included, as
no provider keeps a question confidential while its model answers;
changes only as drafts; progress never; text first, an image when
ticked or asked for.
- What it keeps, does and where it lives (D13–D18): conversations kept
sealed with the person's own key; four features (questions about what
is open, cards from text, explaining a miss, checking a written
answer); grants and limits in halkyon_base, the adapters in a package
of their own (halkyon_llm, BSD-3-Clause); the proposal's points 4–8
and 10 as written; the warning once per studyset and assistant; built
for v0.21.0.
- Sign-ups and operators (D19–D26): SIGN_UP open, approval or closed;
the first operator by SQL, others named in the app; suspending an
approved account; a wait screen with a matching code the operator
checks with the person; 14 days, 10 waiting.
- What people are told and what never goes (D27–D30): the app and a
privacy page of each instance's own; others' posts only with their
author's switch, a copy's licence being its agreement; an opaque ID
per person for the provider.
ADR 0022 and Learn's AGENTS.md now point to it as accepted.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
ADR 0022, decided 23 Oct: the hand-off to assistants outside the app and
the Claude connector (ADR 0006) go in v0.19.0, app and server together;
the field keeps the web search. ADR 0021 takes the developer's D4-D6: the
operator's keys for several providers, granted per person; personal keys
on the person's devices, only where the operator allows them.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
