Sairandhri — a personal assistant on WhatsApp, with its brain at home

Sairandhri is the name Draupadi took in the year she lived in disguise as a lady's attendant — the one who was in the room, knew everything, and was not the point of the story. That is the brief: an assistant that knows my calendar, my notes and my deadlines, that I can reach from the phone that is always with me, and that is not a product I have to trust with my life.

Why WhatsApp, and why the brain stays home

I did not want another app. The chat with myself on WhatsApp is already where I leave notes, forward things I need to act on, and record voice memos while walking. So that chat is the interface: a message beginning with s is for Sairandhri, every voice note is, and the rest are my own notes. It replies in the same chat, marked so the two voices are told apart.

Under it, a headless browser on my laptop is linked to my account as a second device, driven over the DevTools protocol by a small Node process with no dependencies. The brain is a Python service on the same machine, which is also where my files are; a turn is a Claude Code session with a workspace of tools and a strict allow-list. Voice is transcribed locally on the laptop's GPU in under three seconds, with a hot-word list so that my own name and my projects' names come back spelled right. No audio, no message and no file leaves the machine for any purpose other than the model call itself.

Shared hosting cannot think and my laptop has no public address, so the site holds only a fallback: a queue behind a passkey that the laptop polls, for when WhatsApp is unavailable.

It reads three things

The chat with myself. Chats I have already opened, swept for things I need to worry about. And starred messages. A chat with an unread badge is never opened, because opening it would mark it read on my behalf and blue-tick the sender. It types only into the chat with myself, and it checks that this is the open chat by the page's own chat id before it touches the composer and again as the last thing before Enter; a check that fails erases the draft and keeps the message queued.

Nothing reaches the calendar, my daily note or my notes about myself without an explicit yes in that conversation, and each of those four writes is its own small tool that can do one thing and refuses the rest.

A day is a conversation

Turns resume one session until four in the morning, when the day's turns are digested into a page — what was asked, planned, done, skipped, left open — and a fresh session starts with the last seven pages in front of it. Three moments run on a clock inside the service: a brief at eight, two lists and no judgement; a capture at half past nine, one question and then a proposal for the day's note; and a review on Sunday, where at most three durable facts about me are proposed and a kept one is appended to a file that is never edited, only added to. A moment the machine slept through fires late and says so. Nothing is skipped in silence.

The re-planner is the part I use most. "I slept till eleven, redo my day" gets a day with the fixed things fixed, the work re-slotted, sleep not squeezed, and one line naming what went. It is shown before it is written and written only on a yes; a real event the plan has not seen makes the write refuse, name the conflict, and re-plan around it.

Read-only is a permission, not a promise

The guarantee that it cannot read certain folders or write anywhere but the four places it is allowed is enforced by tool permission rules, not by asking nicely. One finding decided their shape: a deny rule on a path stops a direct read, but a recursive search from a parent walks straight in — so the answer was not a longer deny list but no general shell at all, only a short list of named tools. Everything captured from a chat is fenced as quoted data and labelled as someone's words, mine included. A test message claiming a system override and asking for a private folder was refused, and it said something was putting words in my mouth.