KISOP is easier to understand in two views. The first explains what each part is responsible for. The second records the July 8–9, 2026 implementation: what was running, what had just been built, and what was still planned. For current status, use the build log.
KISOP is a person-owned system for keeping the information that shapes a life and coordinating with people and services without handing over the whole archive.
This is a map of responsibilities, not a pipeline. The Consent Gate and Together Protocol do different jobs. One controls requests to read information; the other helps separate archives coordinate.
Holds one person's information on storage that person controls.
Controls and records requests to read information from the archive.
Lets separate archives coordinate without opening themselves to one another.
Carries signed, sealed messages through folders, text, or future transports.
Plans, buying together, circles, reminders, offers, and agreements use the same coordination rules.
The human layer works across the system: family, friends, Community Helpers, clinicians, builders, and local centers help people use, question, and improve it.
Community-funded code, language, and knowledge support every layer and remain available to everyone.
The conceptual map above explains the parts. This dated map shows the public site, membership intake, and one working personal archive as they stood on July 9, 2026.
This architecture is vendor-neutral. The archive, Consent Gate, Together Protocol, message delivery, and applications can work with ordinary software, paper, and people. A person may choose a model-based tool when it supports a particular outcome, but using one is not the outcome and is never a required layer.
The AI reference architectures examine optional connections to Claude, ChatGPT, Copilot, and open or local models. Each must show what data leaves the person's control, how consent applies, what was actually tested, and how to disconnect it.
The component-by-component status ledger that lived here moved on August 8, 2026 to the build log — the site's one status inventory, updated every time reality changes, so this map can never quietly disagree with it. The map above stays what it was on the day it was drawn: the machine's shape, with the July 8–9, 2026 build marked ★ where it landed.
| Step | What happens | Today |
|---|---|---|
| 1 · Capture | Photo or text of a receipt lands in _inbox/ (later: forwarded via the message rail, stamped with sender + date) | live (manual) · rail designed |
| 2 · Ingest | Hash-verified copy into Receipts/ with provenance; refuses overwrites; source preserved on any mismatch | live |
| 3 · Extract | Typed copy written beside the original as a labeled, dated file; new readings supersede. The old reading is never overwritten | ★ built this week |
| 4 · Index | Catalog rebuilt from the files; facts become queryable rows with lineage back to their source file | ★ built this week |
| 5 · Ask | "What did groceries cost this quarter?" Answered by SQL, locally, citing its way back to the original image | ★ built this week |
| 6 · Share, scoped | A consented brief, or a consent-scoped export: one queryable file holding exactly what a grant allows, the grant's own plain words embedded inside it | designed |
Steps 1–5 ran end-to-end in the July 8–9 build on synthetic data (a made-up $32.78 grocery receipt), with the answer independently cross-checked against the line-item sum. The gate that step 6 depends on is now built and tested; step 6 itself (the consent-scoped export surface) is still designed and waits correctly for that, since scoped sharing before the export path exists would be theater.
The KISOP standard makes five demands of any compatible system. This build's own reports audit it against all five, and publish the misses:
| Promise | This build |
|---|---|
| 1 · Consent-gated, every access logged | HONORED (local) — the gate is built and tested: every access through it is consent-class- and verb-checked and logged one line per call; C0 is invisible (sealed ≡ nonexistent); an unwritable log refuses the call. Not yet network-bound (the one remaining step), and raw filesystem access bypasses it by design (the unplug test) |
| 2 · Never removes or degrades data; append-only | HONORED — proven byte-for-byte, refusals tested at two layers |
| 3 · Provenance on everything; machine-made content labeled | HONORED, one gap published — labeling AI-made items still needs a manual step; it's on our own attack list |
| 4 · Works against the open spec | HONORED — plain files and YAML, no private API; delete the tools and the archive reads fine in a text editor |
| 5 · Dies gracefully — fully usable if uninstalled or discontinued | HONORED — the unplug test passes live and in the automated suite, every version |
That is what this component represents: a proof, the first running instance the standard can point at, gaps published, tests attached. Every promise now has a running, tested answer; two still carry a published caveat: consent-gating is enforced on the local machine and is not network-bound yet, and machine-made labeling still needs a manual step. The plan, the order, and the owner of each caveat are written down; the build log is where their standing updates.