IKARUSpersonal ai os
Six systems, one ledger.
All six are built and running. Each acts through the same gate, so the Trust Center sees every call.
Browser Attach
A browser extension plus a backend toolkit that let IKARUS work inside real browser tabs: read the page as you see it, click, fill forms, navigate, take screenshots, and notice downloads completing on disk.
It never takes a tab on its own. You hand one over, and the window stays in front while it works.
- Reads pages two ways. The DOM and the accessibility tree, so it reads structure, not just markup.
- Follows spawned tabs. When a page opens a new tab, IKARUS picks it up automatically and keeps working.
- Multi-tab registry. Every attached tab gets a stable letter alias, and a drift guard rechecks each tab before acting on it.
- Watches downloads. A file is tracked until it is really on disk.
Aliases stay stable while tabs open and close. Commands address tabs by letter, and a drift guard rechecks each tab before acting on it.
The Vault
IKARUS's own knowledge store: notes and real file uploads, organized into flat collections, each entry scoped to one Nexus or kept global. A graph view shows how entries, files and Nexuses connect.
It is where work lands. A workflow can capture what it found into a new entry, or read one back.
- Notes and files. Real uploads stored on your disk, not references to a cloud.
- Nexus scoping. An entry linked to one Nexus does not appear in another. Unlinked entries stay global.
- Collections and graph. Group entries flat, then see the connections drawn as a map.
Trust Center
The governance surface. Every tool call in IKARUS passes one gate: first the Executive's named allowlist, then the approval tier you set for that capability class. The Trust Center is where you see and control both.
The privacy inventory lists every store actually on disk, with sizes and record counts. Where a log does not exist, it says so.
- Approval tiers per class. Read, write, destructive and external calls each sit at observe, explain, ask or execute.
- Action History. Every call is recorded, including attempts the gate refused.
- Emergency stop. Halts running plans and blocks write, destructive and external calls. Reads survive, and blocked attempts are logged.
- Per-Nexus grants. Each Executive holds its own tool grants with per-tool tier chips.
Workflows
A workflow is an ordered list of typed steps: an instruction for the assistant, a browser action against an attached tab, or a vault reference that reads a live entry or captures results into a new one. Simple app and URL steps ride along too.
One engine runs them all. Editor, chat sidebar or chat command, it is the same path, and the tiers still apply mid-run.
- A full editor. Add, remove, reorder and edit steps on the workflows page.
- Nexus-scoped. Your workflows belong to the Nexus that made them. Running one across Nexuses is refused.
- Starter templates. Research-to-Vault and a read-back briefing ship built in. System workflows stay read-only.
Automation Recorder
Do a task with IKARUS once, then keep it. Say RECORD in chat or press Record on the workflows page, work normally, and stop. The recorder captures the tool calls IKARUS executed for you, not your raw clicks, and derives clean workflow steps from them.
Review before anything exists. The recording opens as an unsaved draft. Steps that cannot be replayed are flagged, not dropped.
- Attended posture. It records agent-executed actions only. There is no screen or keystroke capture.
- A live indicator. Recording state is visible on every page.
- Gated replay. A replayed workflow passes the same permission gate as a hand-built one.
browser.click · tab A · "Download invoice"
vault.create · "Invoice, March" (fed by the reads above)
STOP RECORDING → draft opens in the editor for review
Adaptive Intelligence
IKARUS notices what you repeat. It reads four real sources it already has: workflow run history, the Action History log, recorder sessions, and locally kept browsing history, and looks for sequences and routes that recur.
A sequence has to recur in three separate sessions before it counts as a pattern. Every suggestion carries the confidence behind it.
- Suggestion-only, enforced. Proposals open in the workflow editor for your review. Nothing approves itself, and approved workflows still pass the gate.
- Dismissal is permanent. Decline a pattern once and it stays declined.
- Routines can lapse. An approved routine you stop using gets guarded and revoked rather than firing stale.
- Local sources. Browsing history stays on your machine, with excluded domains and 30-day retention.
The Nexus model and the permission gate behind all six systems: how it works
