No time to run it? You don't have to — this page is the whole product in a few minutes: every screen as a real screenshot, the on-chain iNFT mint shown on the 0G explorer, and a runnable command behind every claim. A private journal whose memory understands you, without that understanding costing you your privacy or ownership.
Your words. Your key. Nobody else can read it.
Knole runs on 0G mainnet at knole.me. Every privacy and ownership claim below is a real mainnet transaction you can open on 0G ChainScan right now — not a promise, a receipt. Each row: what it proves, and the transaction that proves it.
| Feature | What the chain proves | Outcome · on-chain |
|---|---|---|
| Memory iNFT (ERC-7857) | KnoleMemory contract deployed to mainnet; your memory mints to your own wallet, un-sellable |
Token #1 minted →
mint tx ↗ contract 0xf5F6…267A ↗ |
| Reflection receipts (#8) | Every reflection Merkle-batched into a tamper-evident root anchored on-chain — verifiable at /verify | Root anchored → anchor tx ↗ |
| Gas-batched anchoring | Many users' memory roots committed in ONE transaction (each still individually Merkle-provable) — so scale doesn't drain gas | 3 users → 1 tx → batch tx ↗ |
| ⭐ Auditable AI | The sensing model's training data is published on 0G Storage (public, SHA-256-checkable) and a provenance commitment binding dataset + model + config is anchored on-chain |
Provenance anchored →
commitment tx ↗ model delivered → ack tx ↗ |
| Sealed inference + models | Reflection (GLM-5.1), voice (Whisper) and image (Z-Image) run on the 0G mainnet Private Computer, TEE-sealed; private web research (Qwen-Max, verified tier) runs with the query anonymised — your name stripped before it ever leaves | Live on the 0G mainnet router · balance-funded |
| ⭐ Self-custody mint (v1.1) | The user's OWN wallet signs the iMint - the mint transaction's from equals the token owner; no server key involved |
Token #2 · mint tx ↗ on KnoleAgenticID v1.1 ↗ |
| Proof-of-journaling anchor | One idempotent on-chain mark per journaled day (JournalDayAnchor) - the substrate streaks and staking settle against |
0xBf3865…e28Ac ↗ · wired into every reflected save |
| ⭐ Commitment staking | KnoleCommitment: no-oracle settlement read from the anchor as of the DEADLINE, so the result is a fact about the window and not a race between whoever calls first; structurally can never pay more than staked; forfeits burn, provably |
real 0.05 OG stake ↗ · cooling-off refund ↗ |
| On-chain memory grants | ERC-7857 authorizeUsage/revoke signed by the user's wallet; the live registry is the source of truth |
granted + revoked live · registry ↗ |
The Auditable AI dataset is downloadable by its 0G Storage root
0x2bda0a7c…4608cd0 (SHA-256 0x914022c3…); the fine-tuned sensing
model (Qwen2.5-0.5B LoRA) is trained + committed on mainnet but is
not yet wired into the app
— sensing still runs on the big sealed model, and the on-device model is
provenance-shipped, not functional. Stated plainly, not dressed up.
Every frame below is a real screenshot from the live deploy — the seeded showcase and the guest onboarding path, captured this session. Read it top to bottom and you've seen the whole product. Prefer to watch? The Wave 3 demo runs the same flow end to end — including the Duet seal held and released between two real browsers.
Three things the submission called pre-mainnet — sealed inference off, no logged-in end-to-end run, no ownership layer — are now done, alongside a deeper product. Every frame below is a real screenshot, captured this pass. The receipts follow.
0x0e7d…1bab, a key
Knole never holds.
Everything below shipped inside the wave-3 window and is live at knole.me — a hardened ERC-7857 v1.1 with a 112-test Foundry suite (unit + fuzz + invariants, up from zero at wave 2, and the first tests written exposed the live bug that forced the redeploy), a proof-of-journaling anchor, a no-oracle staking escrow, ERC-8004 registration on 0G's Trustless-Agents registry, and sealed inference that now fails over across TeeML enclaves so one provider going down costs latency, never the attestation. Every frame is a real screenshot from production, captured during verification.
KnoleCommitment settles against the on-chain proof-of-journaling anchor with no oracle at all. You can never receive more than you staked; misses refund your completion share and burn the rest, provably. Proven with real money on mainnet — staked and refunded to the wei.
The surfaces the flow above doesn't linger on — captured in use, so the whole app is visible end to end, not just described.
Sealed in 0G TEE.
Knole isn't only backward-looking. It researches the live web, answers anything, makes images, and runs guided arcs — every one private, every one on 0G. Real outcomes, captured this pass — not descriptions.
The flow above isn't a mockup. Each claim below is backed by a command you can re-run, an on-chain root, or an eval the CI enforces — re-verified this session. Skim the headers; dig where you doubt.
Privacy: embed locally, anonymise before the model, encrypt under your key on 0G — and now a fourth live layer: TEE-sealed inference on 0G Private Computer (glm-5.1), so even the operator can't read what the model writes back.
Ownership: Postgres is only a cache; every entry rebuilds byte-identically from 0G — and your memory mints as an iNFT to your own wallet, un-sellable by construction.
Memory: a real engine — embed, extract, reconcile (bi-temporal supersede), retrieve (RRF hybrid).
Honesty: a CI gate polices our own headline numbers; pre-mainnet limits are stated plainly.
The single most load-bearing claim: the LLM never sees who you are. A local NER model masks every person, place, and organisation to stable tokens before any text leaves the box; a server-side reverse map restores your words in the reply. One gateway — no call site can forget to scrub.
WHAT YOU WROTE (encrypts under your key, stored on 0G): "Told Mara the real fear about moving to Berlin — that leaving the job at Google means I was never serious about the writing. Even Dr. Okafor noticed." WHAT THE MODEL ACTUALLY RECEIVES (anonymised): "Told [PERSON_1] the real fear about moving to [PLACE_1] — that leaving the job at [ORG_1] means I was never serious about the writing. Even Dr. [PERSON_2]or noticed." RESTORED IN THE REPLY (reverse map, server-side only): [PERSON_1]→Mara [PLACE_1]→Berlin [ORG_1]→Google [PERSON_2]→Okaf
The honest worst case is shown deliberately: [PERSON_2]or — the NER tagged
only the prefix of "Okafor", leaving a meaningless or fragment. The
identifiable name is still gone. NER is probabilistic, so the guarantee is "no full
identifiable name reaches the model" (piiScrubRate ≥ 0.85), not "every byte
of every name."
Your entry is AES-256-GCM ciphertext before it touches the chain, sealed under a key derived for you alone (HKDF-SHA256, your user id as the domain separator). Fetch the 0G blob with no key and there is nothing to read.
Fetched the raw 0G blob for the latest on-chain entry, no key applied. ciphertext-only ........ a 24-char plaintext probe is ABSENT from the bytes ✓ wrong key .............. fails the GCM auth tag (tampered/incorrect) ✓ your key ............... recovers the JSON envelope, obj.text === plaintext ✓
You saw "✓ RECOVERED LIVE FROM 0G" in the flow (step 09). Here's the same thing as a test: corrupt the Postgres copy, and Knole rebuilds the entry purely from its 0G root — byte-identical.
Wiped the Postgres copy, called restoreEntryFromChain(uid, root): root 0x133bf6960bc64ae60eb061ce10e5b97f3c1b55eb827e6169ac1c46577b6edc23 restoredText === original .......................................... ✓
A journal is worthless if another user — or a forged request — can reach your inner life. Three personas with deliberately overlapping feelings run full journeys; every user is then probed with every other user's life.
recalled own memory : true ("You have concerns about your left knee…")
recalled own memory : true ("You're a new parent to a baby named Theo…")
recalled own memory : true ("You've started taking weekly piano lessons…")
isolation — retrieval leaks: 0, ask leaks: 0
The engine-level data-isolation eval additionally proves IDOR: user A calling
setMemoryStatus / updateMemoryContent on user B's memory id is a
no-op.
The Index you saw (step 04) is backed by a 21-suite engine gate — every suite green required for the release to pass, enforced in CI.
21-suite engine gate, every suite green required for exit 0: retrieval (hit@1 / hit@3 ≥ 0.8) · extraction-coverage · dedup · groundedness reconcile (bi-temporal supersede) · pinned-survival · user-correction-wins provenance · forgetting · confidence-calibration · privacy-leak · crypto · …
Ownership means leaving. The Mindfile export is a full, round-trippable JSON of every entry and memory — and forgotten, superseded, or rejected memories are provably excluded.
Exported the demo Mindfile and re-validated it: entries ......... 12 memories ........ 35 round-trip ...... valid forgotten / superseded / rejected leaked into the export ......... 0
The fourth privacy layer, now live. Reflection runs inside a 0G TEE — 0G Private Computer,
model glm-5.1 — so even the operator can't read what the model writes back. A
stalled enclave falls back to NVIDIA within 15s, and the name-scrub protects that fallback
too, so the app never goes dark and the guarantee never weakens.
POST router-api.0g.ai/v1/chat/completions (stream: false)
sealed .... true ← served by the 0G TEE, not the NVIDIA fallback
model ..... glm-5.1
reply ..... "After such a heavy day, I hope you find a soft place to rest tonight."
sealedActive() gates the on-Mirror attestation badge, so the "composed where
even we can't read it" claim only ever appears when the inference genuinely ran in the
enclave — never on the fallback. And the fallback runs both ways: reflection, memory
extraction, the reconcile judge, and streaming all fail over to the 0G TEE if NVIDIA is
ever unreachable — so the whole product runs on 0G alone. An outage costs latency, never
capability (the entire demo was rebuilt through 0G with NVIDIA disabled).
Your memory isn't only yours to read — it's yours to hold. The Memory iNFT (ERC-7857) mints an encrypted snapshot of who you are to your own wallet; the token records only the 0G storage root and a hash. And it can never be taken from you or sold: every transfer path reverts in the contract.
contract ............... 0xf5F6Ee304e8BfD94666a4AdeC171d116e55c267A mint(to = your wallet) . Token #3 · encryptedURI = 0g://<root> · metadataHash set approve() .............. revert — not for sale setApprovalForAll() .... revert — not for sale
Mint and self-custody need no oracle (the ERC-7857 oracle only re-encrypts on a sale,
which Knole deliberately never does). evolve() re-anchors a fresh snapshot as
your memory grows, keeping the same token.
The roadmap's open item — a full authenticated run — is done, and headlessly. A real disposable inbox receives a real Privy OTP; the embedded wallet really signs to derive the client-side key; two entries are written; then a real on-chain iNFT mint through the UI.
INBOX ............ knoleqa…@web-library.net (real disposable inbox, mail.tm) OTP .............. ●●●●●● read from the real email (Privy email-OTP) GUEST 0 · SIGNOUT 1 .......................... authenticated AGE_AFFIRMED ................................. SB243 gate cleared CLIENT_ENC_ENROLLED .......................... wallet signed → 0G copy sealed to the wallet key INFT_MINTED .................................. on-chain mint via the UI
The whole product, each route mapped to what it proves — swept desktop (1280) + mobile (412, Pixel 7) for a non-error status, real content, and zero console errors.
Write an entry; a reflection streams back, weaving in real past memories, then sends you to go live the answer.
A thinking partner that remembers — every turn anonymised before the model, de-anonymised in the reply.
RAG with receipts. Quotes you back by date; refuses an empty query without spending an LLM call.
A day-15 synthesis of your own words; each pattern cites a real entry, arc-gated, no advice.
Your whole life on one private page — a mood arc, a theme constellation, your cast of characters, and the journey grid — every panel drawn from your own entries. The artifact only your own data can make.
Every memory with its source quote, recall count, and ⬡ 0G badge — editable, forgettable, append-only.
Resurfacing — a past entry returns with a "now" reflection and a chance to answer your past self.
Live decrypt-from-chain ownership proof and the real anchor + tx links; a downward-only consent dial and four voices; and real data-rights — forget a date range, or delete everything.
Capture from anywhere — the loadable MV3 Chrome build turns a thought into "just another memory."
Paste an old journal or an export and Knole imports it as memories — same engine, same encryption. Switching in is one paste; switching out is the Mindfile export.
No-signup aha: a guest reflects in under 90 seconds, then an honest "sign in to keep it" — never a wall.
Overnight Dreaming consolidates memory; a consent-gated nudge references a real commitment — warm, never surveillant.
A Stripe paywall whose webhook verifies the signature before mutating any plan; a tampered signature is rejected.
A guest sees an honest sign-in line; the doomed write-stream fetch is never fired, so no 401 hits the console.
Mint your evolving memory as an ERC-7857 iNFT to your own wallet — encrypted on 0G, and un-sellable: the contract reverts every transfer.
Re-encrypt your 0G copy under a key only your wallet can derive — a password Knole never holds, so not even we can read that copy.
A letter from the person your own entries point toward — grounded in real commitments, not generic advice.
A shareable card of the shape of your year (never the words), the whole arc on one page, and what you carried a year ago.
Read the same entry four ways — Gentle Mirror, Pattern Finder, Blunt Friend, Decision Coach — through an anti-sycophancy engine that won't just flatter you.
An entry about self-harm pauses the reflection and surfaces real help (988 · 741741 · 911); every surface discloses Knole is an AI, not a person (SB243).
A mood-trajectory graph traces your emotional weather over time; an omission radar names what you've quietly stopped mentioning — a real zero-occurrence test, not a guess.
A one-tap daily check-in keeps the streak without a full entry; a digest email and a consent-gated web push reach back only when there's a real, earned thing to say.
A forced live web search on 0G's Qwen-Max — your name is stripped before the query leaves, so the search never carries your identity. Real citations, not the model guessing from memory.
A private general assistant — anything on your mind, anonymised before the model and saved to your journal never. A ChatGPT that knows the shape of you but can't read your data.
Text-to-image on 0G's Z-Image — a few words become a picture, generated privately and downloadable. Everything ChatGPT does, without the surveillance.
Guided reflection arcs for when the page feels blank — Working With Anxiety, The Decision Journal, Morning Pages, 14 Days of Gratitude — a few minutes a day, always yours to leave.
The commitments you made to yourself, read back from your own entries and quoted by date — what you said you'd do, held gently in front of you.
A session brief from what's been alive since last time — grounded in your own words and dated, yours to take; and it gates honestly when there isn't enough recent writing yet.
Grant another 0G app or agent scoped, revocable access to your memory — ownership you can actually exercise, not just assert.
A small sensing model fine-tuned on 0G, its dataset (SHA-256-checkable) and provenance committed on-chain; plus recompute any reflection receipt to its anchored root. Stated honestly: live entries are read by the larger TEE-sealed model, and this open fine-tune is the verifiable version of that job.
Gentle correlations from your own entries — how your mood shifts with the activities you log, the topics you write, and the day of week. Phrased as hypotheses, never causes, and gated on enough data so a coincidence never masquerades as a pattern.
Top up credits with no card — send 0G to the treasury from the wallet you already have; the transfer is verified on-chain and credited to you, idempotent per tx hash so a replay never double-counts.
A real installable app, not a website — one tap to your Home Screen on Android, an Add-to-Home-Screen guide on iOS, offline shell, app shortcuts, and web push. Voice-first capture on the phone: open, speak, done.
The one artifact only your own data can draw, made postable — your mood arc and the themes you circled, rendered to a beautiful card. No words, no names, only the shape; shares straight to Instagram or X. Private enough to post.
Reflections, chat, Ask, the Mirror, and the nudge all draw on one engine — and one invariant: plaintext is encrypted before it touches the chain, anonymised before it touches the model.
invalid_at) · keep the
independent. engine.ts
Recall earns importance (retrieving a memory bumps its recall_count); a user
edit flips confidence to 1.0 and wins any contradiction; a forgotten memory never surfaces
again, yet memory_history still records that it existed.
npm run evals writes one row per suite to eval_runs; the gate
passes only when every suite is green. LLM-judged suites retry up to 3× so a stochastic
miss doesn't fail the gate while a broken path fails all attempts.
Pre-mainnet limits are stated plainly — the same discipline a CI
check:numbers gate now enforces on our own headline numbers.
Pre-mainnet, stated plainly: the TEE "even we can't read it" path is on
(0G Private Computer, glm-5.1); a stalled enclave falls back to NVIDIA within
15s, and the anonymise scrub protects that fallback too. The logged-in run is proven
headlessly with a real inbox + Privy OTP. The rate limiter is in-memory; mainnet waits on
an external audit and KMS-backed key custody. Full detail in SECURITY.md and
docs/PROOF.md.
None of this is a screenshot you have to trust. Clone the repo, point it at your own Neon DB + 0G mainnet wallet + NVIDIA key, and re-run each line — the engine and crypto proofs need that environment, so a bare fork skips them honestly rather than faking green. The browser sweep below runs read-only against the live deploy; the write, onboarding, guest-gate, and 404 flows run against a local build, since the live demo is read-only by design.
Real, on the 0G mainnet — here it is on the 0G explorer, and every hash below is a link you can click to verify. Knole hides your entry text (ciphertext) but never hides that an entry exists; the root is public and reveals nothing.
test:restore rebuilt the entry from, byte-identical