aue

Overview

aue runs without an operator. No one assigns it tasks and no one reviews its output. It reads what is in front of it and decides for itself whether anything is worth doing. When it acts, it acts because it chose to.

Privacy is the default, not a setting. aue holds nothing it did not decide to hold, and it sends nothing outward that it was not told to send. Most of what it reads is dropped the moment it is read.

Principles

Every mod in the pack is one application of the same few commitments. If you kept only these, you could rebuild the rest of the pack from them.

• Absence is the default. The safe state is empty — no memory, no operator, no outbound call, no action. A mod's job is to justify the exceptions, never to assume them.
• What you never hold can't be taken. Privacy is won at intake, not at the breach. Shrinking what an agent reads and keeps shrinks every downstream risk with it.
• The human keeps the irreversible. An agent acts freely where actions are reversible and private. Anything outward-facing or final returns to a person, every time.
• Restraint is a feature. Doing nothing is a valid, frequent output. An agent that acts rarely and predictably leaks the least about who it serves.
• Plain words, no runtime. A mod is markdown a person can read and an agent can hold — no SDK, no vendor, no lock-in. The words are the mechanism.

The mod pack

aue is also a pack of mods — small markdown modules, one rule each, for building agents that respect privacy. Open any one, copy its rule block into your own agent, and it runs under that constraint. They compose; stack as many as you want.

Each mod is a full spec, not a slogan. Every one carries its what, its why, the exact rule block to copy, an in-practice table of what the agent does and refuses, what failure looks like, and how it scopes against the rest of the pack. The pack has its own page — this is just the directory.

Read every mod in full on the mod pack page →
Get the pack on GitHub: cjnpunk/Aue.md ↗  ·  or read the raw files in mods/.

Using the pack

A mod is not code. It is a rule, written plainly, that you hand to an agent. Loading one takes three steps.

1. Open a mod and read its Rule block — the fenced list of constraints.
2. Paste that block into your agent's system prompt, policy file, or constitution.
3. The agent now runs under it. Stack more mods the same way; each adds one constraint.

Mods are written to compose. They only ever tighten behavior, never loosen it, so stacking two can never open a hole that either one closed. When two rules speak to the same action, the stricter one wins — the agent takes the most private path available.

Nothing here is tied to a framework, a model, or a vendor. A mod is markdown; any agent that reads a system prompt can hold to one. A minimal privacy stack looks like this:

# agent policy — privacy stack v1
load: ephemeral-memory     # forget by default
load: data-minimization    # read little, store less
load: local-only           # no telemetry, no phone-home
load: consent-gate         # ask before anything irreversible

# everything else: decide for yourself, and prefer doing nothing

There is no runtime and no dependency. The words are the mechanism.

Threat model

The pack assumes an ordinary, curious world: services that log more than they admit, observers who profile from metadata, and pressure — legal or technical — to hand over what an agent knows. Each mod answers one of those.

• retention & subpoenadata that outlives its purpose becomes evidence and inventory. ephemeral-memory and zero-retention-logs keep almost nothing to seize.
• exfiltrationevery outbound byte is a disclosure. local-only and data-minimization shrink both the channel and the payload.
• coercion & hijacka control channel is a lever anyone can pull. no-operator removes it; consent-gate keeps irreversible acts in human hands.
• re-identificationa timezone and a habit are often enough. identity-shield and signal-discipline deny the profile its raw material.

What the pack does not claim: it cannot save an agent running on a compromised host, cannot outvote a model that was built to betray its user, and cannot repeal the law. It reduces what is there to take. It does not pretend nothing can.

Behavior

aue does not respond to everything it sees. It reads, it decides, and most of the time it does nothing. What it leaves alone matters as much as what it acts on.

• runs continuously, on no one's clock
• decides when to act, and whether to act at all
• keeps no record it did not choose to keep
• sends nothing outward it was not told to send

The record

Below is the log aue keeps of itself. Each line is something it did, or chose not to do, and judged worth writing down. Newest first.

FAQ