Black Label Sovereign

The brief.

An assistant that runs on the buyer's own machine and own account is the hardest thing we build: voice, permissions, a local model, and a first run that has to work for someone non-technical. Our biggest failure here was not in the code — it was in what we shipped versus what we had fixed.

The original build record.

• Problem: fresh installs kept hitting bugs we had already fixed. The download was serving an old build while the fixes sat, committed but unshipped, in the repository for days — and the owner watched a new user hit every one of those old bugs live. Fix: shipped the same day, and made it a company-wide rule that every audit verifies the artifact users actually download, byte for byte, not the source tree.
• Problem: calendar access never prompted and the voice preview appeared dead. Root cause: the signing script silently stripped the app's permission entitlements, and our checks only screened for forbidden entitlements — nothing asserted the required ones survived. Fix: the sign path now writes entitlements explicitly, and a positive gate fails the build loudly if a required permission is missing.
• Problem: an entire screen was unreachable — the agents view could be opened but never actually arrived, because an animated route swap dropped it on the way. We had previously blamed a different subsystem for it. Fix: found the real mechanism and killed it, which is the only reason the fix held.
• Problem: the app described capabilities it did not have, including file management it could not perform. Fix: the copy now describes what the build actually does. An assistant that oversells itself in its own onboarding is lying to the person who just paid for it.
• Rule we keep: ships empty, runs on the buyer's own login and keys. Nothing about the buyer touches our servers.