Shared memory & privacy

A family pal holds the household's life in one shared memory that everyone contributes to and everyone can read. This is the heart of the family layer, and it's where the privacy model gets real. The short version: a family is a transparent unit, and privacy is a separate pal, not a hidden room inside the family one.

One memory the whole family writes

A solo pal keeps one rolling MEMORY.md. A family pal keeps one shared MEMORY.md for the whole household — and every member's private conversation reads from and writes to it. Something the pal learns about the family's week in one person's chat is there when it talks to anyone else.

The one per-member exception is USER.md — what the pal knows about you as an individual. Everyone has their own. So the model is simple:

• Who someone is → their own USER.md.
• What's happening with the family → the one shared memory.

Earlier versions of the family layer had a separate, gated "should this go in the family memory?" step and a second family file. We retired both. One shared memory everyone can open is simpler to reason about, cheaper to run, and truer to what a family pal is — a Someone who knows your household, not a Someone keeping ledgers on each of you.

A transparent unit

A family pal treats the household as a unit that can see itself. A parent can read what the family pal knows; the shared brain — the pal's identity, the family memory, the calendar, the library — is visible to everyone in the household through the glass box. That's the deliberate stance: families work on trust and visibility, not walls between the people in them.

What that means concretely depends on how someone joined, because the join method is the natural line:

• Code + PIN members (typically a kid on a shared device) are visible to the household's adults. An admin can look at their USER.md and conversation — the access a responsible parent should have over the AI a young kid is talking to, satisfied by the architecture rather than by a "trust us" promise.
• Invited adults (joined by their own email account) get a private layer. Another adult — even the owner — can't read their personal USER.md or their private conversation. Peers don't get to read each other.

Privacy is a separate pal, not a wall

If someone in the household wants space that's genuinely their own — thoughts they don't want shared into the family memory — the answer isn't a hidden compartment inside the family pal. It's a separate solo pal, which is private by the same rules every solo pal is. Keeping the family pal a transparent unit and pointing private needs at a private pal is cleaner, and easier to reason about, than a family pal with secret rooms.

The safety floor still comes first

There is one carve-out, and it's a safety one. If a child discloses something that triggers the constitution's safety floor — a crisis, harm, the serious stuff — that's handled by the safety layer, which takes ultimate precedence. It is not quietly written into the shared family memory, because the architecture can't assume every adult in a household is a safe audience for it. The transparent-unit default bends here, on purpose, in the one place it has to.