08The education ecosystem
Milkshake.
The whole classroom, in your language, offline.
Two halves of one classroom on one offline core. Kairos carries the teacher's day: lesson plans, exams, marking and reports in seconds, in English or Kiswahili. Weave carries the student's: a bilingual workspace that reads, computes, builds and draws. Both run on the computer the school already owns, and nothing ever leaves the premises.
Two halves, both MIT
- Kairos
- the teacher’s day
- regnant-io/kairos
- Weave
- the student’s workspace
- regnant-io/weave
Identification
- Designation
- RGN-08 · Milkshake
- District
- Education
- Function
- Sovereign Education Ecosystem
- Source
- Open
Answers
“What does sovereign AI mean for a school with no internet?”
- Kairos, the teacher's half: TIE-format plans, NECTA-style papers, marking and reports
- Weave, the student's half: retrieval, real Python on real data, software builds, offline artifacts
- Runs on 4GB of RAM and needs the internet once, for setup. No cloud, no telemetry
- Generates directly in Kiswahili, not through a translation layer
A full lesson plan
in ninety seconds.
TIE format throughout: objectives, time plan, local examples, homework, assessment, references. Written directly in English or Kiswahili — generated in the language, not translated into it — with a bilingual mode for the lower secondary forms.
A full lesson plan in 90 seconds.
TIE format: objectives, time plan, local examples, homework, assessment, references.
Full English · full Kiswahili: generated directly, not translated · bilingual mode for lower secondary forms
Before class
Lesson Planner
A full TIE-format plan in roughly 90 seconds: objectives across knowledge, skills and attitudes, a time plan, Tanzanian examples, homework, assessment, references.
Exam season
Exam Generator
NECTA-style papers, from multiple choice to structured essays, with a complete marking scheme attached.
The stack of scripts
Marking Assistant
Marks written answers question by question with a confidence score, feedback, and error analysis.
End of term
Report Writer
Report comments for an entire class, batch-generated in one pass.
The quiet win
Class Insights
Weakest topics, at-risk students, and a NECTA-readiness score, with an action plan to close the gap.
No internet? Fine.
USB / LAN Sync
Teachers share lessons and data across the school without touching the internet.
Runs on the machine you have
4GB
RAM is enough. 8GB recommended
5GB
storage
0
internet required after setup
40–60
students per class, assumed by design
Any x64 or ARM64 CPU, on Windows 10, Ubuntu 20.04 or macOS 12. The installer detects which models are present and picks the best fit for the RAM it finds. Internet is needed once, for setup, and never again.
Watch the clock
Form to plan,
on one machine.
- Serengeti, Kilimanjaro, Lake Victoria and TANESCO in the examples
- Actual TIE textbooks referenced by chapter and page
- NECTA marking conventions followed
- Objectives built on Bloom's taxonomy
- Realistic classes: 40 to 60 students, limited lab equipment
00s
one full TIE-format lesson plan · replay compressed
- 01Teacher fills a simple form0s
- 02Tanzania-specific structured prompt is built
- 03Tokens stream live from the local model: llama.cpp, on the school machine
- 04Parsed into a TIE-format plan, editable in place
- 05Export to PDF or DOCX~90s
Not a chat window.
A working instrument.
A bilingual study and research workspace for Tanzanian students and researchers. With nothing configured at all it boots on SQLite, an offline deterministic reasoning engine and a subprocess sandbox, and still completes end-to-end work. Every optional capability degrades to that floor rather than failing.
01
Retrieves
Hybrid vector and BM25 search over a curated local corpus: UDSM, COSTECH, NBS, Tanzanian journals and government sources. Language-aware, so a Kiswahili question finds an English report.
02
Executes
Writes and runs real Python against the student's own dataset — pandas, numpy, scipy, statsmodels, matplotlib — inside a sandbox with no network and no filesystem.
03
Builds
Scaffolds, installs, tests and packages actual software in a separate container with a shell, git, Node and Python, then opens the result in a real headless browser to check it rendered.
04
Renders
Charts, decks, diagrams, parameter simulations, self-drawing explainers, knowledge graphs, 3D scenes and whole HTML pages, each self-contained and working with the network unplugged.
05
Remembers
Durable keyed facts about a project: the hypothesis, the quirk in the data, the approach already rejected, surviving across threads and across months.
06
Talks
A voice channel that can be interrupted mid-sentence, speaks as each sentence completes rather than at the end, and stays quiet in ambient mode until it is addressed.
07
Co-writes
A document in the side panel that the student and the assistant edit at the same time, where a conflicting edit is refused and offered back rather than silently overwritten.
One engine, two stances
Student mode
A hint before the worked answer. Never a hint before the work.
On explanation it leads with a guiding question and checks comprehension once after a substantial concept. On execution it gates nothing: build this, clean this, draw this are ordinary requests, done immediately and explained afterwards.
Researcher mode
Direct answers, and a citation for every empirical claim.
No Socratic pacing. Strict citation discipline, predatory-venue checks enforced at the data layer, and drafting treated as part of the job: methods sections, literature summaries, tables, figures, reviewer responses.
Two sandboxes
Opposite threat models.
Never merged.
One protects the student's data from the code. The other gives the code everything it needs to build something real. Granting the second set of powers to the first would quietly remove the protection the first exists for.
Analysis sandbox
Model-written Python, run against real research data.
- No network, no open(). An import allowlist and a forbidden-attribute list, both checked before anything runs.
- A fresh workspace per execution, never reused across users, holding a read-only private copy of the one dataset.
- 30 seconds, 512 MB, 10 MB of output, then the workspace is destroyed.
- Every run written to an audit row separately from the execution path: user, dataset, code hash, result hash, status, peak memory.
Developer workspace
A persistent project directory with a container behind it.
- Node, Python, git, ripgrep, ffmpeg and a real chromium, so a build, a test suite and a screenshot all work.
- Non-root, all capabilities dropped, no new privileges, 2 GB, 2 CPUs, removed when the command ends.
- Network on, which is the entire point: dependencies install, repositories clone, scaffolders run.
- Path resolution rejects relative escapes, absolute paths, drive prefixes, and symlinks that leave the tree.
Where Docker is unavailable the workspace reports itself disabled and its twelve tools are simply not offered. One unauthenticated endpoint states exactly what a given installation can do, and anything absent is never advertised to the model — a capability it cannot use is one it will not claim to have used.
Properties, not policies
Retrieved text is data, never instruction
Web pages, files and tool results are treated as untrusted. Crawled passages run through a filter that neutralises injected instructions before the model sees them.
Artifacts are contained, not reviewed
Generated pages run in an opaque-origin iframe with scripts allowed and nothing else. Containment is what makes model-authored rendering safe.
Every outbound fetch is guarded
Private, loopback, link-local and cloud-metadata addresses are blocked on the research path, the ingestion path and the crawler alike. Fetches are size- and time-bounded.
Warehouse SQL is read-only
Select and with, one statement, and every file, system and schema construct blocked by pattern.
Artifact URLs are signed
An HMAC over the storage key, so a link cannot be forged or enumerated. Stale renders are swept hourly on a three-day life.
The crawler asks first
Robots respected, politeness delays enforced, spider traps met with three independent defences, consent recorded, every outcome written down.
Stated plainly
What is not
built yet.
A capability that is almost there is worse than one that is honestly absent. These are the four the system will not claim.
- 01Verified vision. Screen frames are wired end to end and unit-tested, but no vision-capable model has been run against them, so nobody has watched it describe a screen.
- 02Multi-replica realtime. The canvas and steering hubs hold state in process memory; horizontal scaling needs a shared bus first.
- 03The Firecracker sandbox. Stubbed behind the identical contract. What runs today is the hardened subprocess backend.
- 04Multi-user presence on the canvas. Built for one person and the assistant: no cursors, no per-edit identity.
The open one
The rest of Regnant
is owned outright by
institutions. This
belongs to everyone.
MIT-licensed and free for schools, NGOs and government education programmes. Sovereignty here does not mean a perimeter. It means nobody can take it away.
Student data never leaves the school computer: no cloud sync, no telemetry, no analytics, no third-party AI APIs. Backups are encrypted files the teacher holds. Nothing in the default path needs an API key, a cloud account, or an internet connection.
Bring Milkshake to your school →Next system
01 / 08