Is a guest / household tier on the roadmap, or is single-principal the intended shape?

[mrbenburns]

Been running LifeOS for a while and hit a design question I can't answer from the repo, so figured I'd ask rather than guess.

The Trusted channels section in the USER OPERATIONAL_RULES template invites you to list "names of people whose inbound texts your DA may converse with — conversation only, never authorization." That reads like there's a guest tier: someone who can talk to your DA without being able to act as you.

But as far as I can tell the only mechanism that exists is PULSE.toml [imessage].allowed_handles, and an allowed handle gets permissionMode: "bypassPermissions", the full claude_code tool preset, the principal's settingSources, a system prompt stating the channel has skills, email and calendar, and its turns labelled Principal: in the history. There's no per-handle scoping, so adding a second handle doesn't make a guest — it makes a second principal.

Elsewhere the tree looks deliberately single-principal: the USER scaffold is ABOUTME / PRINCIPAL/ / DIGITAL_ASSISTANT/ / OUR_STORY, and I can't find multi-user anywhere in the shipped code or docs.

So the question: is the conversation-only tier something planned (the multi-user general-tier adapter shape), or is single-principal the intended long-term design and the Trusted-channels wording is aspirational?

Concrete case, and I think it's the common one: I'd like my wife to be able to check whether I'm in a meeting right now, ask what I'm working on, or add an item to the shared shopping list. Mostly reads, one narrow write, and none of it should carry my authority. Curious whether that's on your roadmap or something users are expected to build outside the core.

Thanks for the project either way.

[danielmiessler]

Single-principal is the intended shape, not a gap on the roadmap: one install serves one principal's goals, memory, and identity, and the boundary is structural (one beneficiary per subscription, per-principal TELOS and memory trees). Household = one install per person, each with its own DA name and USER tree; they can share a machine via separate config roots. A guest mode that serves other humans through your install is deliberately out of scope — it crosses billing and privacy boundaries the system is built to keep.