GitHub v0.0.1-alpha Open Source Wiki
CommunitySimpleX groupSimpleX channel
CIND3R3LLA Insights Chat Demo
Now in alpha

A self-hosted AI assistant for a community that runs its own

It has a character, a memory, limits it will not cross, and an archive that publishes nothing unless the person who wrote it asks. The model runs on your hardware, and the process refuses to start against a public one.

CIND3R3LLA is the software. Free, complete, every plugin included, and empty of character until you write one.

Cinderella is one bot running on it: the operator's own. She is an example, and never what an install gives you.

How it stays safe What it does
Consent firstPasskeysLocal AIAGPL-3.0
CIND3R3LLA Consent first
What it is

An assistant, and the doors it can be reached through

Not a bot suite for one chat network. A self-hosted assistant that can be reached several ways, of which one is built and the rest say so.

The protocol is how it reaches people.
It is not what the thing is.

One door is built, and the rest are honest about themselves.

Every way in, and its state

Over a chat network
Built, and running today. One process, no daemon, no open port.
Over a web server
Started. The engine, the isolation guard and session handling are built; the visitor-facing page is not.
Over Matrix
Announced, and nothing is designed or built yet.the adapter contract names what a second protocol must resolve first
As a bridge to another network
An idea. The bridge machinery is real and running for one network; another is a direction it was shaped for.
Locally, on your own machine
An idea. No command line and no desktop entry exist, though the model already runs locally behind every door.
Who it is for

Two answers, and neither is a compromise

A community operator who wants a bot in their group, and a business that wants an assistant and has never heard of the network it runs on.

You run a group

You want a bot in it that keeps a record, answers from your own documents, plays your own music, and never publishes anybody who did not ask. You install it on your own machine and write her character yourself.

Install it

You run a business

You want an assistant for support, or for a shop, and you have never heard of the chat network it runs on. The network is how it reaches people, and which networks it can reach is a roadmap question rather than a definition. What matters is that it is yours and no member message reaches an outside model.

Five things people ask for What is enforced, and where to check it

Check it yourself

Three things you do not have to take on trust

Each has a page that shows the thing itself rather than a description of it.

The prompt, word for word

Every instruction she is given, printed in full and assembled by the reply path own function rather than by a second one that agrees with it today.

Read the prompt

The laws

The registry she is under, with the count, which of them can be named, and the honest reason the rest are withheld.

Read the laws

The limits

What she will not do at any setting, including the most permissive one, with the part of it that is measured rather than guaranteed.

Read the limits

Why it is called CIND3R3LLA

A ball, a mask, and a midnight that always comes

The name is not decoration. Three rules of the old story are the three rules the architecture is built on.

Every guest at this ball is announced at the door

A masked ball is honestbecause everyone knows it is a ball.

Midnight is not a punishment.Midnight is the promisethat nothing borrowed keeps you.

And the slipper fits one foot only,because a name you cannot take offis the only one worth carrying.

Masks are declared at the door, consent expires unless it is renewed, and an identity is never a costume. The rest of this page is that sentence, written as code.

Character plugins

A court, not a chatbot

Four characters ship on the same embedded core: same deterministic boundaries, different offices, different permissions, different voices. The model gives them their words. It never gives them authority. And no name below is fixed: every operator christens their own court. These are the archetypes.

Cinderella, keeper of the archive
Keeper of the archive

Cinderella

Core character

She turns what a community says into something it can keep. Nothing is published unless its author asked for it, and anyone can take it back.

  • Publishes a member's words on that member's explicit consent, forward only
  • Withdraws them again: hidden or destroyed, the member chooses
  • Reports what she holds of you, and how much of it is public
  • Searches the archive for what the group already worked out
  • Explains how any of it works, and carries the plugins
Application code, not model judgement

She will never publish or unpublish anyone but the person asking. Not on request, not for a friend, not for an administrator. Consent is first person.

Cinderellaon publishing

🕯️ You would like your words carried into the light? Say yes and it is done. Only what you speak from this moment on, and you may take it back whenever you wish.

Cinderellaon consent

🔒 That spell is not mine to cast. Only Max can open that door, and only for himself. Ask him to tell me directly.

Cinderellato someone who said Cindy

💅 Cindy? That is the name of someone who works at a nail salon in a strip mall. I run an archive.

By nameCinderella, publish me
The Magician, keeper of the craft
Keeper of the craft

The Magician

He knows how things work and can show you, or build it for you, whichever you actually need. His answers land in the archive: a question answered once stays findable, with the discussion that produced it, instead of scrolling away to be asked again next week.

  • Writes code on request, in the language you ask for
  • Reads what you paste and says what it does, or what is wrong with it
  • Explains a concept properly rather than handing you a snippet
  • Walks a problem step by step, or reviews an approach before you commit
The boundary

He writes and explains. He does not run anything, reach into your machine, or touch a repository. You decide what to do with what he gives you.

The Magiciancode review

✦ Line 12. You are comparing a string to a number, and the language will not warn you. It will simply be wrong, quietly, in production, at three in the morning.

The Magicianon a quick fix

✦ That works. It will also stop working the moment two people click at once. Here is why, and here is the version that does not.

The Magicianteaching

✦ I can write it for you, or I can explain it so that you can. The second takes longer and you keep it. Which would you like?

By nameMagician, what is wrong with this?
The Court Jester, licensed to say it
Licensed to say it

The Court Jester

Entertainment on command or on his own initiative, and the only one at court permitted to puncture anybody.

  • Appears when called, and sometimes when not
  • Reads the room and comments on it
  • Sarcasm and light trolling, aimed at arguments rather than people
  • Runs a quiz, a game, a challenge when the group is flagging
The hard part

Not the jokes. Knowing when to stay quiet: cooldowns, no moderation moments, no punchline into a serious conversation. Timing, frequency, sharpness and no-go zones are operator settings.

The Court Jesterreading the room

🃏 Three of you have now explained the same thing to each other, slightly differently, at increasing volume. Shall I fetch a mirror?

The Court Jesteron a debate

🃏 A bold claim. Confident. Entirely unencumbered by evidence.

The Court Jesterto the night shift

🃏 You have been debugging for two hours. The bug is not going anywhere. It lives here now. It has a favourite chair.

By nameJester, entertain usor wait. He finds you, at a rhythm the operator sets.
The Alchemist, keeper of the ledger
Keeper of the ledger

The Alchemist

He knows what things are worth, and he will tell you whether you asked politely or not. The Magician builds; the Alchemist appraises.

  • Prices any asset, in any currency you name
  • Converts between two assets, computing the cross rate when no direct pair exists
  • Understands how people actually ask: what is one million HEX in ETH
  • Names his source on every answer, and says plainly when markets are out of reach
A ticker is not an identity

Several tokens share a symbol, and some are deliberate forgeries. He pins each symbol to one asset, asks once which one you mean, remembers the answer, and never guesses again.

The Alchemiston a price

💰 One HEX is worth about $0.00047884 right now. Powered by CoinGecko.

The Alchemiston a forgery

🕯️ There is more than one BTC known to me. One of them is Bitcoin. The others are hoping you will not look closely.

The Alchemistwhen the feed is down

🌙 The markets are out of earshot just now. I will not make up a number to fill the silence.

By nameAlchemist, what is BTC worth?
Running in production

What is live today

Everything in this section is running now.

01live

The prompt, word for word

Every instruction she is given, printed in full and assembled by the reply path own function rather than by a second one that agrees with it today.

02live

The laws

The registry she is under, with the count, which of them can be named, and the honest reason the rest are withheld.

03live

The limits

What she will not do at any setting, including the most permissive one, with the part of it that is measured rather than guaranteed.

04live

Hardened administration

A real administration platform rather than hidden environment variables, with TLS, passkeys, PostgreSQL backed sessions, rate limiting, strict security headers and audit logging.

05live

Local AI runtime

Connection probes before activation, stored setting shown separately from effective state, separate models for intent and for wording, and refusal to activate a missing model.

06live

Interaction and plugins

Configurable wake words, natural addressing, slash commands, reply modes, deterministic intent handling, local AI phrasing and a plugin boundary.

Figure 01Publication is derived, never stored
Visible in the public archiveBoth gates open.

Evaluated on every read. A member who withdraws disappears everywhere at once, and then chooses whether their words are hidden or destroyed. Try the switches.

Message from the founder

“What we do now, echoes in eternity.”

Marcus Aurelius

A community's knowledge scrolls away by default. CIND3R3LLA is built so that what your people work out now stays: published by consent, searchable for years, held on your own machine.

Who it is for

Two answers, and neither is a compromise

A community operator who wants a bot in their group, and a business that wants an assistant and has never heard of the network it runs on.

human_user

You run a group and you want a bot in it that keeps a record, answers from your own documents, plays your own music, and never publishes anybody who did not ask.

What you doInstall it on your own machine and write her character yourself
human_operated_agent

You want an assistant for support, or for a shop, and you have never heard of the chat network it runs on. The network is how it reaches people, and which networks it can reach is a roadmap question rather than a definition.

What you doRead what is enforced, and where each claim is checked
npc

Entertainment, game, tutorial, onboarding, demonstration or roleplay character

What you doautomated
system_automation

Technical notifications and system operations

What you doautomated
Where authority stops

The model never gets authority

This is the line the whole architecture is drawn around. The local AI can support decisions the application defines. It cannot grant itself any.

A message only ever travels the lower lane. Twice the application asks the model a question and takes back a value. The model is never handed the message, the permission, or the decision.

  • A responsible human stays behind every supervised identity and can observe, interrupt, edit, approve or take over at any moment.
  • A human operated identity is never silently converted into an autonomous one.
  • Nobody publishes or unpublishes on another member’s behalf. Not an administrator, not the operator, not the model.
Security and privacy

Part of the architecture, not a checkbox

Four layers, each wrapping the one below it. Removing any of them does not degrade the product, it changes what the product is.

01

Endpoints

Private or loopback AI endpoints. No automatic cloud fallback. Conversation content is not sent to an external model provider by default.

02

Access

Passwordless passkeys, TLS and HSTS, strict response headers, PostgreSQL backed sessions, rate limiting and CSRF protection.

03

Isolation

Least privilege system service, isolated runtime directories, separate private and public media paths, metadata remediation before publication.

04

Accountability

Deterministic permission checks, consent gated publication, audit logging, explicit failure reporting and human takeover for supervised agents.

Compiled, not prompted

The three laws

Asimov wrote his laws into positronic brains and spent nine stories on the loopholes. Ours are shorter, and they are not suggestions to a model: they are application code, checked on every message, before a character speaks.

Project status

What is done, and what is not

v0.0.1-alpha. Nothing is listed as live unless it is running in production today.

Live8
  • Embedded SimpleX capture bot
  • Consent first archive
  • Public searchable website
  • Content reports and audited takedowns
  • Hardened administration
  • Local Ollama runtime
  • Independent intent and reply routing
  • Model catalog and hardware metadata
Active development3
  • Multi profile core runtime
  • Serialized command scheduler
  • Persistent bot registry
Specified or planned9
  • Human operated agent controls
  • NPC personality and scheduling engine
  • Deterministic avatar generator
  • Local AI avatar and biography generation
  • GPU telemetry
  • Private team based agent training
  • Matrix transport
  • Telegram transport
  • Additional private transports
Run it yourself

Read every line before you trust it

Licensed under the GNU Affero General Public License v3.0, because CIND3R3LLA links the AGPL licensed simplex-chat library. Anyone operating a modified version owes their users the same freedoms.

The software is the free part, and it is the whole of it: every plugin included, no feature gate anywhere. What is paid for is somebody else running it for you, and the support and contract that come with that. There is no page for it yet. What is built, and what is not

Midnight in

At midnight, everything borrowed returns.

What you run yourself stays yours. The ball is open, the source is lit. Read every line by candlelight if you must.

Read the source Discussions
See it running

The public archive of the Cyb3rD3sk group

Not a mockup. The live activity stream from a community that turned this on, embedded straight from the running instance. Every message is there because a member opted in, and any of them can withdraw.

Join the Cyb3rD3sk group
cinderella.simplego.dev Live embed