Plue
Open Plue

Personal AI assistant

An AI you can hold to account.

A private, approval-aware personal AI workspace for objectives, memory, devices, and execution.

Missions, tools and approvals, rendered the way the product renders them.

What it is

A personal assistant, built like infrastructure.

Plue runs on one box and answers to one owner. You give it durable intent — fix this, watch that, build this — and it plans bounded missions, picks the right subsystem for each step, and waits where approval matters.

There is no hidden second brain and no shadow engine. One planner, one memory authority, one approval path. Models are routed by policy rather than fashion, every step lands on the execution graph, and the receipts are yours to read.

  • Self-hosted. No cloud tenancy, no shared inference state.
  • Owner-scoped. Authority comes from the backend, never from client state.
  • Fail-closed. Hard denials hold in every autonomy mode.

What it can do

Fifteen working capabilities, one executor.

Agent Brain

The live map of every mission, tool call and approval, composed from real execution records.

Execution

Missions & objectives

Durable intent that survives restarts, waits and failures, advanced a bounded step at a time.

Planning

Unified orchestrator

One planner decides which subsystem handles the next step. No second engine, no drift.

Planning

Autonomy & trust

MANUAL, ASSISTED or AUTONOMOUS. Hard denials fail closed in every mode.

Trust

Computer use

A disposable desktop it can see and drive: screenshots, clicks, windows, on an isolated sandbox.

Execution

Browser sessions

Structured navigation and QA through a private browser worker; outward changes ask first.

Execution

Voice

Streaming speech in and out, barge-in, spoken approvals, and a bounded offline mode.

Execution

Devices

Thin, authenticated fronts for one identity and one memory: phone, watch, laptop, desktop, CarPlay.

Surfaces

Memory & knowledge

Typed, provenance-tagged facts with hybrid retrieval and a real forget.

Memory

Shared memory bridge

One bounded brief other agent surfaces can read and write, without merging runtimes.

Memory

Coding workspace

A full self-hosted coding agent: repositories, terminals, previews, desktop installers.

Execution

Website factory

A requested site becomes research, design, code, browser QA, and a deploy from an exact SHA.

Delivery

Sports ledger

Forwarded slips read by vision into a fixed schema, with a running stake, result and P&L ledger.

Personal

Proactive intelligence

It notices events, weighs relevance, respects quiet hours, and acts only through existing policies.

Trust

Automations

Scheduled and event-driven workflows, each run in its own disposable container, with run history.

Delivery

The stack behind it

Models chosen by policy, recorded per call.

Every request is routed to the right class of model and the decision is written down — provider, model, reason, fallback. No hard-coded model, no second router.

Reasoning deepseek-flash→deepseek-v4-pro

DeepSeek-first by policy for planning and tool selection, escalating when the task earns it.

Fallback gpt-4o-mini·gpt-4o

OpenAI stands behind the router whenever the preferred model is absent, incapable, or unaffordable.

Vision gpt-4o

Reads forwarded bet slips and result posts into a fixed, validated schema.

Voice gpt-4o-mini-transcribe→gpt-4o-mini-tts

Streaming speech-to-text and text-to-speech, OpenAI-bound like embeddings — the reasoning preference never moves them.

Embeddings text-embedding-3-small

256 dimensions, exact cosine over a bounded candidate scan, provenance attached to every hit.

Budgets daily·monthly·per-request

Hard caps that pause work when they are reached — and that the model cannot raise.

Trust

Trust is the feature.

Trust is granted server-side and scoped per assignment — not from a chat message, and not from a checkbox in a client.

Read-only

Observation only. Every mutating capability is denied and audited.

Approval required

Routine work runs; state-changing capabilities pause for a recorded decision.

Full trust

Routine gates lift for allow-listed scope. Explicit denials never do.

Owner autonomy MANUALASSISTEDAUTONOMOUS

Autonomy changes who satisfies an approval gate. It never changes what is allowed, who owns what, or what a capability can do.

Always denied, in every mode

  • production_target
  • arbitrary_shell
  • arbitrary_docker
  • host_filesystem
  • credential_access
  • trust_escalation
  • destructive_operation
  • unrestricted_browser
Client state never grants authority.

By the numbers

Counted in the repository, not in a deck.

313skills in the catalogue, across nine domains
1,478skills loaded in the coding workspace
119tests on the offline-queue contract alone
13fail-closed production gates