A brain with paperwork
Pluto is Orbit’s context and inference service. It takes a verified, subject-scoped message or external event and turns it into a useful response. This is where recent conversation, durable memory, relevant connected data, temporal context, and typed capabilities meet the model.
That sounds like the brain. The important architectural choice is that Pluto’s model is not the authority. It can reason, propose, and synthesize. Deterministic code owns identity, evidence, persistence, capability schemas, idempotency, and the boundary around external actions.
Why Pluto?
In Roman mythology, Pluto rules the underworld: the vast realm below the surface. Orbit’s Pluto owns the machinery beneath a deceptively simple text thread: context, evidence, memory, retrieval, inference, and capabilities.
The name also completes a useful piece of the map. Charon ferries connected information across the boundary into Pluto. Pluto decides what context is relevant to the moment. The mythology is really fun imo.
Every turn gets a receipt
Gateway sends reactive turns. Argus sends proactive wakeups. Pluto validates the subject, transport, time zone, attachments, and group-message policy, then creates or reuses an idempotent turn before inference begins.
The turn records typed evidence and the state of context that was observed. A provider retry therefore reopens the same unit of work instead of inventing a second conversation. When I later inspect an answer, there is a stable place to ask what came in, what context won, which tools ran, and what was persisted.
verified turn
→ validate + deduplicate
→ record evidence
→ resolve bounded context
→ infer with store: false
→ execute typed capabilities
→ apply deterministic gates
→ return a messaging-native resultContext is selected, not dumped
A personal assistant may have years of memory, thousands of emails, and a calendar that never stops changing. Stuffing all of it into one prompt would be expensive, noisy, invasive, and surprisingly bad at finding the one thing that matters.
Pluto builds bounded context for the active turn. It resolves relevant memory claims with evidence lineage, asks Charon for a small set of attributed connector excerpts, adds recent conversation and the owner’s local time, and records what was selected. Only the winning encrypted excerpts are decrypted for inference.
- Durable memory answers what the owner has asked Orbit to carry forward.
- Retrieval answers which connected source material is relevant right now.
- Recent conversation answers what is happening in this thread.
- Temporal context answers what words like “tomorrow” mean for this person.
The model proposes; code disposes
A model can suggest that a sentence contains a durable preference. It cannot write directly to memory. The proposed claim crosses a deterministic gate that checks its predicate, confidence, temporal shape, supporting quote, and relationship to owner-authored evidence before an immutable version is stored.
The same principle governs capabilities. Kepler, Pluto’s typed runtime, gives every capability a strict schema, canonical arguments, a per-turn idempotency key, a redacted audit record, and a controlled result. The model chooses from tools it has been given; it does not materialize a new privileged API because a prompt sounded confident.
Reads stay here. Writes leave the building.
Pluto owns bounded reads from connected services because reading is part of building context. It can search mail, inspect calendar data, hydrate a small set of documents, and keep encrypted connector credentials and indexed resources scoped to the owner.
Provider writes cross a harder boundary. If Orbit wants to send, reschedule, or change something outside itself, Pluto creates a proposal for Vulcan. Timers, reminders, watches, and background workflows go to Argus. Reasoning about an action and being authorized to perform it are intentionally different jobs.
Google read → Pluto
reminder / watch / workflow → Argus
external write proposal → Vulcan
identity / admission → Janus
message delivery → GatewayThe outside world cannot rewrite you
External events can wake Orbit and influence a response, but they cannot silently become facts about the owner. An email that says “Kaustubh loves 7 a.m. meetings” is source material, not self-authenticating memory. A calendar change can trigger useful reasoning without acquiring the authority of something the owner said.
Only owner-authored turns may create owner-memory claims. That single rule blocks an entire class of accidental and adversarial personalization failures while still letting Orbit use connected context when it is relevant.
Silence is a valid result
A proactive wakeup does not automatically deserve a notification. Pluto can reason over fresh context and return a silent disposition when nothing useful changed or the event does not clear the person’s attention policy.
This matters because proactivity is only impressive while it remains trustworthy. The goal is not to maximize messages. It is to notice the moment where context changed enough that doing or saying something genuinely helps.
Why Pluto matters
Pluto is where Orbit becomes more than a command parser. It can combine a loose request with the right memory, a tiny piece of a connected world, the current time, and a real capability while still leaving an inspectable trail of how it got there.