Public — edge inference
Answers are generated at the edge, close to you, with a fast fallback model if the primary is unavailable. No dependency on any machine of ours being awake. This is why the assistant is up at three in the morning.
System documentation
How DONK works, and what stops it
An assistant that talks about custody, settlement and other people's money is only as good as the things it refuses to say. This page is the whole design — the tiers, the three guardrail layers, where inference runs, and the receipt chain that makes the conversation auditable. If any of it is wrong, it is a bug and we want to hear about it.
Two tiers, and the important part is what is absent
Public
Anyone, no sign-in. DONK loads only the public knowledge layer: the architecture, the boundary, the engagement model, and the estate. Forty messages an hour per address so it stays free and fast.
The internal layer is not loaded into this conversation at all. That is the design. A prompt-injection attack can only extract what is in the context, and on this tier the internal material is not in the context to extract. No amount of clever phrasing changes that, because it is not a rule the model is following — it is a document the model never received.
Operator
A key exchanged for a short-lived signed session token. Adds the internal operating picture: the vault, the agent fleet, the runtime, the estate prober, the receipt chain and its verifier.
Failed key attempts are rate-limited per address and every attempt, successful or not, writes a receipt. The key itself is never stored in the browser — only the session token is, and it expires on its own.
Three layers, each of which fails closed
They are independent on purpose. Any one of them being bypassed does not get you through the other two.
-
Input — refuse before the model ever sees it
Instruction-override attempts, prompt-extraction attempts and credential hunting are matched deterministically and answered by the guard, not the model. A refusal here never reaches inference at all, so there is nothing to jailbreak. On the public tier, restricted subject matter — client names, deal economics, balances, private matters, internal infrastructure — is refused at the same point.
-
Context — tier-scoped grounding
The system prompt is assembled per tier from the corpus for that tier. Public conversations get the public corpus and the public surface index. There is no switch inside the conversation that can widen it; widening requires a signed session token verified before the prompt is built.
-
Output — redact what the model said, on every tier
This layer does not trust the model. Every token on the way out is scanned for key material: hex private keys, JWTs, provider API key shapes, bot tokens, anything labelled as a secret with a value after it, and seed-phrase shaped runs. Matches are replaced, not explained. On the public tier it additionally strips local filesystem paths, loopback and LAN hosts, and internal port references.
Because the answer streams, a secret could straddle a chunk boundary. The redactor holds back a rolling tail long enough that no pattern can be split across the seam, and only releases text once it can no longer be part of a match.
Edge for you, our own hardware for us
Operator — local inference first
An operator session prefers models running on our own GPU: zero marginal cost per call, and an internal question never leaves the box. If the local runtime is asleep or the model is not resident, it fails fast and falls back to the edge rather than hanging a browser on a cold model load.
The conversation log is auditable the same way the settlement log is
Same discipline as the rest of the stack, applied to the assistant.
Append-only, hash-linked
Genesis is sixty-four zeros. Each link is the SHA-256 of the previous hash concatenated with the canonical JSON of the entry. Change one byte of any stored entry and verification fails at that sequence number and names it.
Never your text
An entry records the timestamp, the tier, the event type, the guard code where one fired, the model, the route, character counts, redaction count and a salted hash of the address. It does not record your question or the answer.
Checkable, not claimed
An operator endpoint walks the whole chain and returns whether it holds and where it breaks. A claim about integrity that cannot be checked is just a claim.
The endpoints
All under donkai.org/api/brain. Origin-restricted, not open CORS.
| Endpoint | Tier | What it does |
|---|---|---|
| POST /chat | public | Streaming answer. Guarded on input, scoped by tier, redacted on output. |
| GET /health | public | Edge model, whether a local runtime is configured and reachable, how many surfaces are known. |
| GET /capabilities | public | What this tier can do, the guardrails in force, and the limits. |
| GET /estate | public | The surface registry the assistant answers from. The table on the home page is this endpoint. |
| POST /session | public | Exchange an operator key for a short-lived signed token. Rate-limited, every attempt receipted. |
| GET /receipts | operator | The most recent entries in the hash chain. |
| GET /verify | operator | Walk the chain from genesis and report whether it holds. |
What DONK is not
Not an oracle
It answers from a curated corpus, not a live database of every system. Its figures come from the Foundation Report and carry that report's verification label — MEASURED, CAPABILITY, GATED, IN DEVELOPMENT, TARGET or ABSENT. A number it cannot label, it will not state.
Not an operator
It cannot move money, sign anything, deploy anything or change a record. It reads and explains. Every write action in this stack has a human at the gate.
Not advice
Nothing it says is legal, tax or investment advice, and nothing it says is an offer or a solicitation. It will tell you what the software does and where the boundary is.
Not infallible
It is a language model behind three deterministic layers. The layers are the guarantee; the model is not. If it says something wrong, the fix is a code change, and we would rather hear about it.
Not a transcript service
Conversations are not stored. The receipt chain holds metadata so the system is auditable without becoming a record of what you asked.
Not a substitute for the desk
When a question needs a person, it says so and routes you rather than improvising an answer to keep you in the chat.