Run it yourself
Stop it halfway. Watch every file go back.
The window below is this product’s own loop, running in this tab on a folder of twelve invoices. Start it, change your mind, and count what comes back.
Try it on your Mac
A test build of the Mac app is out to invited offices: it reads the text of the window you're working in and keeps one List of what you owe people and what's coming.
Simulated: the folder, the filenames, the pace. Not simulated: the loop, the boundary a stop lands on, the order it puts things back, the policy, and the record.
The folder is make-believe and the loop is not. It is packages/relay — the code the product runs — bundled into this page unchanged and compared against its source on every build, so the boundary a stop is delivered at, the order the unwind runs in and the record written at the end are the product’s own.
Four things to try
Try these four. Then try them on the agent you use now.
Each one is a button on the window above. None of them needs anything installed, and none of them sends anything anywhere.
Twelve files move, one at a time. At the invoice with no purchase order it stops and asks you — and the answer it will take if you say nothing is on screen with the question, not sprung afterwards.
Press it halfway through. Every file it moved goes back, in reverse order, before it reports a thing. Try that with the agent you use now.
Open the one it has not reached yet, while it is running. Nobody stops it. It re-asks why it was running, finds the answer has changed, and puts back what it had already done.
Turn it on, then start a run. The question never reaches you. It takes the answer it published, keeps going, and names the rule that kept it quiet.
However it ends, the receipt under the window is the whole of what it would tell anyone else: what it did, what it put back, what it refused, and the one line it would add to your record — which carries no filename and none of your words.
If you want the evidence
Nothing here asks you to take our word for it.
The window is the product. The rest is the checking, and it is here rather than in the way: your own sentence taken apart in this tab, the three times it refused rather than guess, and every field that would ever leave this Mac.
Put your own sentence in, and watch what would leave
Type into the left box. The right box is what would cross, every removal marked, with the leak guard’s verdict underneath on whether it would be sent at all. Open your network tab and watch it stay empty while you type.
Removed
- 1 email address
- 1 card number
- 1 account number
- 1 person's name
Leak guard
Clean. Nothing the redactor removed survives in any field, no field holds a URL, an email address or a key, and no label shares a long run with the text as it was before.
It is the redactor the product runs, built from packages/ambient and compared against it on every build, so there is no version of this that flatters us. Detection is by pattern and patterns have edges: a person is found by a list of common first names, so put an unusual one in and watch it cross whole.
Three times it refused rather than guess
Three lines this repository’s own programs printed, pasted. In each one the run ended with nothing written, nothing collected and nothing sent — and said out loud what it would have done instead.
It could not be sure it had taken everything out, so it sent nothing at all. A sentence that looks redacted and is not is worse than one that plainly is not.
1 Mail SUPPRESSED — [FILE] is standing next to text it did not remove (touching), so the sketch looks redacted and is not
A card number was written across two boxes on the screen, where the redactor would have read two harmless halves. It dropped the whole reading rather than send it.
1 Safari SUPPRESSED — a value appears to be split across accessibility nodes, so joining them would have hidden it from the redactor
Asked what you were doing at a quarter past ten, it said it did not know, and said how far its record does reach.
Record: ~/day.jsonl I don't know — the record stops at 4 ms and a sample only speaks for the 2 ms it covers.
A gate you have only ever seen let something through has not been seen working, which is why the refusals are the demonstration and not the apology. Every one of them is a line a person can argue with.
Everything that would ever leave this Mac, field by field
One object, printed rather than described. Exactly one file in the codebase may build it, and it re-checks the result against an allowed-keys set that throws on an extra key and on a missing one.
The wire, verbatim · 8 fields, no more and no fewer
{
"ts": 1789491667000,ts — When the observation was made: milliseconds since the epoch, as a number. Not a duration, not a session, not a log.
"app_category": "spreadsheet",app_category — The category, never the application. “spreadsheet”, never “Excel” — and never a window title, a file name or a URL. It is chosen from a fixed list of ten, and a value outside that list is refused rather than sent.
"task_type": "reconciliation",task_type — The kind of work, from a fixed list of ten: drafting, review, research, correspondence, reconciliation, filing, call-prep, scheduling, reading, idle. Never a sentence you typed, never a heading, never a project name. When the classifier is not sure it says “unclassified” at confidence zero, which is an answer rather than a placeholder.
"signals": ["long-document", "revision"],signals — Flags about the shape of the work, from a closed set. Not free text. “There are three windows open on one thing”, never which three.
"key_hash": "a7d9f2…4c10",key_hash — An HMAC-SHA256 under a salt generated on this Mac and never sent. It says “same shape as an hour ago” and nothing else, and it does not reverse into the text it came from.
"confidence": 0.81,confidence — How sure the classifier was about the two fields above. It is a number about the guess, not about you, and below its floor it asserts nothing.
"est_minutes": 26,est_minutes — Roughly how long that pattern looked like it took. Rounded, and only ever an estimate.
"sketch": "reconciling a ledger against a statement; second pass over the same rows"sketch — One sentence, at most 800 characters, after twenty-one redaction passes over fifteen kinds — plus one exact-match pass that runs first and removes your account name, home directory and device name. It is a branded type that can only be constructed from a redaction result, so an un-redacted sketch is a compile error rather than a review finding.
}
There is no field for any of these. Not disabled — absent.
pixelsscreenshotsvideo framesOCR textwindow titlesfile namesapp namesURLskeystrokesthe text of a password fieldyour account namethe day it recorded
Exactly one file in the codebase may build this object. It assembles from a dedicated struct and re-checks the result against an allowed-keys set that throws on an extra key and on a missing one; three of the eight fields must be members of a closed vocabulary and three more are numbers, so the only field that can hold screen text is the one the redactor produced; and a leak guard rejects any label that shares a run of more than twelve characters with the text before redaction, any field at all still containing something the redactor removed, and any field at all that still holds a URL, an email address or a key. The eight keys above are that constant, read out of the source on 12 September 2026.
The values are illustrative. The field list is not: it is read out of the constant the serializer enforces, and a script compares this page against that constant, key by key and in order, on every build.
What this page does not show
- The folder in the window is make-believe. Twelve invoices that do not exist, in a list that lives in this page. What runs on them is the product’s loop, unchanged.
- Four of the five hands still refuse. One of them —
desk.collect— has been read and signed by a person, so it runs. The rest are written, wired and unread, and the registry will not load a manifest nobody has signed. That is a reading job nobody has been staffed for, not a feature nobody has built. - No model runs in any of it. What labels a piece of work is a heuristic that declines when it is unsure, and the tier that would judge anything for you is specified, priced and unbuilt.
- There is no application to install. Reading the accessibility tree cannot be sandboxed, so distribution needs Developer ID and notarization, which needs a paid Apple developer account this project does not have.
The founding cohort
A claim you can stop halfway is worth more than one you can read.
Octopus is sold on the mechanism you have just had your hand on, and you do not pay for it until you have done that on your own folder rather than ours — the first invoice is for the month it runs unattended on your own Mac.