The operator owns the House.
Authority begins with the operator, not the platform, Program, model, connector, or future company.
Principles
Power is only useful when the operator can understand and stop it.
Systead’s ambition needs enforceable limits.
These principles are intended to shape architecture, interface language, Programs, automation, AI, exports, and public claims—not decorate a philosophy page.
No destructive action happens silently.
Material changes expose intended outcome, scope, affected records, risk, verification, and recovery.
Important conclusions expose their evidence.
The House should distinguish source, interpretation, estimate, inference, conflict, and uncertainty.
Canonical records remain challengeable.
Current standing is explicit, but it can be reviewed, corrected, superseded, and traced.
Programs cannot bypass Core safety.
Specialist depth inherits shared authority, privacy, audit, recovery, and export contracts.
Private information does not cross boundaries accidentally.
External destinations, connectors, models, exports, and public repositories require declared scope.
Automation remains inspectable and interruptible.
Observed facts, recommendations, staged changes, approved execution, and verification are separate states.
The House remains exportable.
Years of meaning should not become hostage to one service, database, model, or developer.
AI assists judgment. It does not impersonate certainty.
Models may help reconstruct, compare, explain, and propose. They do not silently become canonical authority.
Public claims remain narrower than the private ambition.
What exists, what is tested, what is planned, and what is merely envisioned must remain distinguishable.
Authority ladder
The Steward earns authority one bounded step at a time.
The word “intelligence” does not create permission.
Local-first is a control decision, not a magic word.
Systead should prefer operator-controlled storage and remain useful without a mandatory cloud account. That does not mean every optional connector, model, or synchronization path is automatically local or private. The product must declare when information may leave the device, where it goes, why, and under whose authority.
The honest promise is stronger than “nothing ever leaves”: nothing should leave accidentally or invisibly.