Ateliersavant In-House
GHOST — Relationship Intelligence Without Inference
Every relationship tool on the market tells you how to feel about people. This one tells you what actually happened — and keeps the evidence intact when it turns out to be wrong.
A NOTE ON THE NAME
GHOST is the internal working name, not the commercial one. Ateliersavant ran the naming programme for this product — five candidate names carried through semantic depth, emotional register, AI-category collision, international pronunciation, and trademark exposure. A direction was selected and is currently in legal review; it will be announced on clearance. Everything described here refers to the product. Nothing here should be read as a trading name.
The Category Sells Certainty About People. Certainty Is the One Thing It Cannot Honestly Offer.
A wave of products now promises to read your relationships: sentiment scores, personality profiles, engagement ratings, prompts telling you who is drifting away and who to message first. They are commercially attractive and epistemically indefensible. Text does not carry mental state. A short reply can be anger, a deadline, or a train entering a tunnel — and no model can distinguish those from the message alone.
The failure is not that these systems are occasionally wrong. It is that being wrong is unrecoverable: once a tool has decided someone is disengaged and folded that judgement into its own memory, the original evidence is gone and the verdict quietly compounds. The user is left managing the software's opinion of their life rather than their life.
We took the opposite position. The valuable thing is not a verdict — it is accurate recall across years of conversation, held in a structure where every interpretation is labelled, confidence-scored, and reversible. Build the memory honestly and the user does the interpreting, which is the only place that judgement has ever belonged.
One layer, one job
Every skill belongs to exactly one layer, and may only read the layer beneath it. That single rule is what keeps a language model's guess from ever contaminating the record of what was said.
Deterministic as far as possible
Five of the seven layers use no model at all. Parsing, signal extraction, conversation dynamics, relationship memory and context assembly are ordinary code — testable, repeatable, and free of temperature.
The model writes, it does not judge
Generation is confined to the top two layers, and even there it is bounded. The model drafts language. It is never the thing deciding what is true about a person.
Relationship memory you can read, and correct
Everything the system believes about a person is on one page: how they are related to the user, the tone profile it has derived per channel, and the discrete facts it holds — grouped by kind and counted, not summarised into a paragraph nobody can audit.
A tone profile reads like an observation rather than a verdict — direct, efficient, lightly warm; lowercase casual punctuation on this channel. That is a description of writing behaviour, which text genuinely carries. It is not a claim about mood, intent or character, which text does not.
Drafting, against the same endpoint the keyboard uses
A draft is composed by choosing a contact, an intent and a channel — the three variables that actually change how a person writes. The output streams, so the user watches it form rather than waiting on a spinner for a finished paragraph to appear.
The panel deliberately calls the identical endpoint the iOS keyboard calls. One drafting path, exercised in the open, means the surface used for testing and the surface used in production cannot quietly diverge.
Channels — and an honest loading state
Each connected channel reports exactly what it holds: how many people, how many messages, over what period, and when it last ran. A system asking for access to years of private correspondence owes the user a precise account of what it took.
The banner says reading your history and learning your voice rather than a spinner. New contacts surface as a review queue instead of being absorbed silently — consistent with the rule that the system flags ambiguity rather than resolving it on the user's behalf.
Skills — and a badge that costs something
Six drafting behaviours the user turns on to match how they actually communicate. Each is described in terms of what it does to the writing, not in feature language.
The Arrives in v2 badge is the detail worth defending. The panel is live, the choices persist, and the interface states plainly that they do not take effect yet. Most products would have hidden the screen or let users assume it was working.
LANGUAGES
The product replies in the language of the thread rather than a global setting — the correct model for people whose relationships do not stay in one language. Nine activated individually, one marked primary.
ADVANCED
Opens with settings most people never need to open. Three notification types, stated as the only ones the product will ever send. The local database reports its size in kilobytes with a button to open it in Finder — the storage claim made inspectable rather than asserted.
Built as a Forensic Evidence System, Not an AI Memory Product
Observed data — the raw text, the sender name exactly as it appeared, the timestamp exactly as the source recorded it — is written once at ingestion and never modified, overwritten or deleted. Database-level triggers enforce this rather than convention, because a rule that depends on every future developer remembering it is not a rule.
Interpreted data sits strictly above it and is always reversible. Canonical identity, language detection, relationship entities — each carries a confidence score, an audit entry, and a correction path. The entire interpreted state can be rebuilt from observed data plus the audit log alone, which means no interpretation is ever load-bearing.
Ambiguity is flagged rather than resolved. Where the system cannot tell whether two identities are the same person, it says so and asks, instead of picking the likelier option and moving on. Degrading to a partial answer is always preferred to fabricating a complete one.
The design test we kept returning to: if the system is wrong about someone, can the user prove it — and can they undo it? For most products in this category the answer is no, because the original evidence was overwritten by the conclusion.
Four Surfaces, One Substrate
The intelligence layer is shared. What differs is where the user meets it — and each surface was scoped to the job it is genuinely good at, rather than porting one interface everywhere.
macOS application
Swift · SwiftUI
The ingestion and consent home. Channel connection, contact selection, on-device extraction using Apple Foundation Models, and local working-set storage.
iOS keyboard extension
UIKit · SSE
Where drafting actually happens — push-to-talk capture, streamed draft generation, and insertion into the field. It inserts; it never sends.
Server
FastAPI · Python
Orchestration, embedding, evaluation harness, and full tracing through OpenTelemetry and an LLM observability layer.
Web admin
Next.js
Settings, memory inspection, diagnostics and a test panel — the surface that makes the system auditable by its own operator.
Ingestion sources — each with its own parser and honest confidence rating
Eleven languages parsed, with code-switching detection — because the people worth remembering rarely stay in one language. A low-confidence source is labelled low-confidence in the interface rather than silently treated as fact.
Naming & brand strategy
A full naming programme — five candidates evaluated on semantic depth, emotional register, category collision, international pronunciation and trademark exposure, with a recommended direction now in legal review.
Product thesis & repositioning
The decision to abandon the original chat-embedded reply assistant and rebuild as a standalone intelligence system — and the argument for competing on honest recall rather than inferred verdicts.
Cognition architecture
The seven-layer escalation ladder, the one-layer-one-job rule, and the placement of model use at the top two layers only.
Data governance doctrine
The immutability principle, the observed/interpreted split, confidence scoring, correction paths, and trigger-enforced write-once storage.
Intelligence engineering
Eleven skills built and tested end to end, from ingestion parsers through cross-relationship pattern analysis and an orchestrator that wires the full pipeline in a single call.
Interface design
The macOS application surface — channel consent and backfill reporting, the skills and language panels, and a settings register written to reduce use rather than encourage it.
Multi-platform delivery
macOS application, iOS keyboard extension, Python server, and web admin — architected as one substrate with four purpose-scoped surfaces.
Ingestion & identity systems
Source-specific parsers with calibrated confidence, cross-channel identity resolution, and an auditable relationship entity model.
Quality & observability
A full test suite, an evaluation harness with golden rows, distributed tracing, LLM observability, and error monitoring across every surface.
Release governance
Phase plan to a multi-user beta, explicit done-when criteria on latency, insert rate and voice fidelity, and a maintained open-items register.
Written Before the Build, Not After
The criteria for calling the beta finished were fixed in advance, in numbers, so that shipping could not be argued into existence later.
A product whose entire argument is honesty about what it does not know would be a poor advertisement for itself with a tidied-up status page.
Next Case Study