Core concepts
Demo mode vs Real mode
Two states. Demo = simulated. Real = signed receipts.
Two user-visible states. Nothing in between.
Demo (simulated)
Demo mode activates when you are logged out, or logged in without either Google connected or an LLM API key on the server. You see an orange Demo · Simulated pill at the top of /chat.
- Every chat reply is a deterministic canned response. Zero LLM spend.
- Every tool approval returns a mock result labelled
Simulated. Nothing is sent, booked, or charged. - No Supabase writes. No receipt. No rate-limit cost to you beyond
10 requests per hour per IP.
Real
Real mode activates when you are authenticated (Privy) AND capability_real = capability_google || capability_key is true. Green Real pill with a sub-label showing which capability is active.
- Chat uses the real LLM. Supabase persists the thread.
- Approve triggers a real API call to Google (Calendar/Gmail) or whichever Tier 2 tool you have connected.
- Every successful action produces an ed25519 receipt and lands in /security.
The rule we never break
Never claim real execution unless it truly ran. Demo mode never produces a receipt.