Retinue

Retinue is a self-hosted personal agent system. The agent gets real capability over messaging, files and data while the credentials to your accounts stay out of the model's context: the Signal keys and the WhatsApp and Telegram sessions live in sidecar containers the model reaches only through thin HTTP APIs, so a prompt-injected agent cannot steal what it never sees. That property belongs to the paths Retinue ships, in a deployment where those gateways are the only route to those accounts — and the environment scrub meant to enforce it currently reaches the main session but not the ones the dashboard and scheduler spawn (retinue#15). Outbound sends are governed by a policy keyed to the sending identity, not the recipient — a dedicated agent account can send freely while your own stays locked. Everything the agent knows is files in a git repo you own, and every file's triples land in a named graph derived from its path, so one SPARQL endpoint answers across all of them and provenance comes for free — getting data in works, and both features the framework ships to read it back out return nothing today: the dashboard's projects card asks for a namespace nothing emits, and the daily self-review job joins on an actor URI no file carries (retinue#1; 0 rows against 6, and actor:aros against actor-aros, both measured on a live store on 26 July 2026). It is an early single-maintainer project with a real onboarding cost, and its egress audit observes outbound traffic rather than enforcing it — both of which its own architecture review says in more detail than this page can. Source →