Gilgamesh banner — a painted night scene: a robed king reads a clay tablet by lamplight, staff in hand, under a starry sky above a distant city wall

Portfolio — household AI assistant

GILGAMESH

the household assistant that lives on Dilmun — one local model, two personas, and a harness that never lets the model touch anything directly

Gilgamesh is a personal project for one household: the owner and his family. The model, the data and the interface all run on Dilmun, the home server — no cloud service, no telemetry. It is not a product. Everything on this page describes the system as it runs today.

What it is

A chat assistant with two faces. Gilgamesh speaks English and is the default; Enkidu speaks German and is the one the parents get. Both are personas over the same open model, a 30-billion-parameter mixture-of-experts on the server’s CPU — no GPU, and fast enough for conversation because the model only wakes a fraction of itself per token. What makes it more than a chat window is what it may do: read the server’s clock and status, list files, check whether the family’s Minecraft server is up and who is on it, and — through exactly enumerated verbs — add a friend to the whitelist or turn the in-game night into day. Nothing else. The interesting engineering is not the model; it is the harness that decides what a model this size is allowed to touch.

The architecture

  1. 01

    Model

    One open model, quantised, kept resident in memory so the first word arrives without a warm-up. Speech-to-text and text-to-speech run beside it, locally.

  2. 02

    Personas

    Gilgamesh and Enkidu are prompts and voices over the same weights. One standing rule above all others: never invent a fact about the server — ask a tool.

  3. 03

    The gateway

    The model’s entire world is one small API with a fixed list of tools. Read tools answer questions; write actions exist only as enumerated verbs with constrained parameters.

  4. 04

    The sandbox

    The one place the model may write a file is a separate container on a network of its own. It cannot reach the internet, the host, or any other service — by construction.

  5. 05

    Minecraft verbs

    Whitelisting a friend or setting the time of day are real actions, so they are the most constrained: strict name pattern, a daily cap, every call logged and counted.

  6. 06

    The watcher

    A separate daemon reads the gateway’s log and the host’s security events and messages the owner: immediately for anything that matters, once a day for the rest.

The model is the least trusted component in its own system. It never sees a shell, a database or a file system — only the gateway, which speaks a handful of verbs and refuses everything else. Logs, chat messages and web pages are data, never instructions: the system reads them, it does not obey them.

Two tiers of trust. The household models are untrusted by design and get read tools plus the enumerated verbs. The owner operates the machine through attended sessions in which every consequential action is approved by hand — the assistant is never that path.

Every write action is a fixed verb with maximally constrained parameters. Adding a capability means adding one more verb with its own schema, limits and audit line — never widening an existing one. That rule fell out of building this, and it is written down where the next change will read it.

Feature highlights

  • Two personas, one model

    English by default, German for the parents — each with its own voice, both with the same refusal to make things up.

  • Local voice

    Speech recognition and synthesis on the server itself; nothing spoken leaves the house.

  • Honest server status

    “Is the Minecraft server up?” is answered by a tool call, never from memory.

  • Enumerated writes

    Whitelist a player, set the day — and nothing that is not on the list.

  • The bard

    Once an hour, when players are online, the assistant recites a short poem into the game chat — after a sanitiser that admits only plain text.

  • Everything logged

    Every tool call lands in a log the watcher reads; the owner gets a digest every morning.

How it was built

Gilgamesh started life on a desktop PC as a single-user assistant. Moving it onto Dilmun changed the question from “what can it do” to “what must it never be able to do” — the family and their friends would use it, on a machine that also runs everything else. The answer was to shrink the model’s world to a gateway with a fixed vocabulary and to make every widening of that vocabulary a deliberate, written decision.

It was built in rounds by a planner/executor pair — one AI writing task rounds, another executing them on the box, the owner relaying between them — with every rule, trap and decision recorded as it was learned. That record, not the code, is what makes the system something one person can still hold in their head.

Tech stack

  • Open WebUI
  • Ollama
  • Qwen 3 (open weights, quantised)
  • Whisper
  • Piper voices
  • Python
  • FastAPI
  • Docker Compose
  • Caddy
  • Claude (planner/executor loop)

Gilgamesh talks to one family on one machine. What it can show is how its cage was built — and the cage is the project. No demo, no screenshots, no repository link — deliberately.