07The education ecosystem
Milkshake.
The whole classroom, in your language, offline.
Kairos carries the teacher's day: lesson plans, exams, marking and reports in seconds, in English or Kiswahili. Weave carries the student's. Both run fully offline, on the computer the school already has, and nothing ever leaves the premises.
What does sovereign AI mean for a school with no internet?
The deployment environment.
One ecosystem, two sides
Kairos
the teacher's side
shipping · MIT
Milkshake
offline · sovereign · TIE / NECTA first
Weave
the student's side
deployment ready · MIT
one classroom · teacher and student · nothing leaves the school
Side oneKairos, the teacher
Lugha: the language is the point
A full lesson plan in 90 seconds.
TIE format: objectives, time plan, local examples, homework, assessment, references.
Full English · full Kiswahili: generated directly, not translated · bilingual mode for lower secondary forms
Kairos: every lesson is a moment that matters
A school day, lightened.
Before class
Lesson Planner
A full TIE-format lesson plan in roughly 90 seconds: objectives across knowledge, skills and attitudes, a time plan, Tanzanian examples, homework, assessment, references.
Exam season
Exam Generator
NECTA-style papers, from multiple choice to structured essays, with a complete marking scheme attached.
The stack of scripts
Marking Assistant
Marks written answers question by question with a confidence score, feedback, and error analysis.
End of term
Report Writer
Professional report comments for an entire class, batch-generated in one click.
The quiet win
Class Insights
Weakest topics, at-risk students, and a NECTA-readiness score, with an action plan to close the gap.
No internet? Fine.
USB / LAN Sync
Teachers share lessons and data across the school without touching the internet.
Runs on the machine you have
4GB
RAM is enough. 8GB recommended
5GB
storage
0
internet required after setup
40–60
students per class, assumed by design
Any x64 or ARM64 CPU · Windows 10, Ubuntu 20.04, or macOS 12 · internet only for initial setup · auto-detects installed models and picks the best fit for available RAM
How it works: watch the clock
00s
one full TIE-format lesson plan · replay compressed
- 01Teacher fills a simple form0s
- 02Tanzania-specific structured prompt is built
- 03Tokens stream live from the local model: llama.cpp, on the school machine
- 04Parsed into a TIE-format plan, editable in place
- 05Export to PDF or DOCX~90s
Grounded in this classroom, not a generic one
- ⚑Serengeti, Kilimanjaro, Lake Victoria, TANESCO in the examples
- ⚑Actual TIE textbooks referenced by chapter and page
- ⚑NECTA marking conventions followed
- ⚑Objectives built on Bloom's Taxonomy
- ⚑Realistic classes: 40 to 60 students, limited lab equipment
The provable claim, drawn to section
Fig. 4: the whole claim in one cutaway: modest hardware in, a NECTA-aligned lesson plan out, and the only cable that matters is the one that isn't there.
Side twoWeave, the student
Deployment ready
Not a chat window.
A working instrument.
Weave is a bilingual study and research workspace for Tanzanian students and researchers. It retrieves from a curated local corpus, runs real Python against real data, builds and ships actual software, renders interactive artifacts that work with the network unplugged, and remembers a project across months.
With nothing configured at all it boots on SQLite, an offline deterministic reasoning engine and a subprocess sandbox, and still completes end-to-end work. Every optional capability degrades to that floor rather than failing.
01
Retrieves
Hybrid vector and BM25 search over a curated local corpus: UDSM, COSTECH, NBS, Tanzanian journals and government sources. Language-aware, so a Kiswahili question finds an English report.
02
Executes
Writes and runs real Python against the student's own dataset: pandas, numpy, scipy, statsmodels, matplotlib, inside a sandbox with no network and no filesystem.
03
Builds
Scaffolds, installs, tests and packages actual software in a separate container with a shell, git, Node and Python, then opens the result in a real headless browser to check it rendered.
04
Renders
Charts, decks, diagrams, parameter simulations, self-drawing explainers, knowledge graphs, 3D scenes and whole HTML pages, each one self-contained and working with the network unplugged.
05
Remembers
Durable keyed facts about a project: the hypothesis, the quirk in the data, the approach already rejected, surviving across threads and across months.
06
Talks
A live voice channel that can be interrupted mid-sentence, speaks as each sentence completes rather than at the end, and stays quiet in ambient mode until it is addressed.
07
Co-writes
A document in the side panel that the student and the assistant edit at the same time, where a conflicting edit is refused and offered rather than silently overwritten.
Two audiences, one engine, two stances
Student mode
A hint before the worked answer. Never a hint before the work.
On explanation it leads with a guiding question and checks comprehension once after a substantial concept. On execution it gates nothing: build this, clean this, draw this are ordinary requests, done immediately and explained afterwards.
Researcher mode
Direct answers, and a citation for every empirical claim.
No Socratic pacing. Strict citation discipline, predatory-venue checks enforced at the data layer, and drafting treated as part of the job: methods sections, literature summaries, tables, figures, reviewer responses.
The registry
Forty-six tools.
Advertised per mode, trust tier, wired services and routed intent. A capability the model cannot use is one it will not claim to have used.
12
Developer workspace
glob, grep, read, write, edit, move, delete, exec, screenshot, verify, package, list
10
Visual generation
chart, deck, diagram, simulation, animation, knowledge graph, HTML page, Babylon scene, 3D data scene, custom
06
Canvas
read, edit, append, write, create, list
05
Retrieval
library search, citation check, web search, fetch one page, iterative deep research
04
Artifact lifecycle
list, update in place, delete, present mid-run
04
Collaboration and memory
ask the user, remember, recall, forget
02
Analysis and data
sandboxed Python, read-only SQL over the student's datasets
02
Skills
list the library, read one procedure
01
Verification
static check that a generated page will actually open
Two sandboxes
Opposite threat models.
Never merged.
One protects the student's data from the code. The other gives the code everything it needs to build something real. Granting the second set of powers to the first would quietly remove the protection the first exists for.
Analysis sandbox
Model-written Python, run against real research data.
- No network. No
open(). An import allowlist and a forbidden-attribute list checked before anything runs. - A fresh workspace per execution, never reused across users, holding a read-only private copy of the one dataset.
- 30 seconds, 512 MB, 10 MB of output, then the workspace is destroyed.
- Every run written to an audit row separately from the execution path: user, dataset, code hash, result hash, status, peak memory.
Developer workspace
A persistent project directory with a container behind it.
- Node, Python, git, ripgrep, ffmpeg and a real chromium, so a build, a test suite and a screenshot all work.
- Non-root, all capabilities dropped, no new privileges, 2 GB, 2 CPUs, and removed when the command ends.
- Network on, which is the entire point: dependencies install, repositories clone, scaffolders run.
- Path resolution rejects
../, absolute paths, drive prefixes and symlinks that leave the tree.
Docker unavailable? The workspace reports itself disabled and its twelve tools are simply not offered.
What it can draw
Ten kinds of artifact.
All of them offline.
No CDN, no external font, no network at runtime, strict CSP, and an opaque-origin iframe around the lot. House style is applied by the render service rather than asked for in the prompt, so a hundred charts from three different models still look like one product.
A generated page is statically checked before it is presented: module syntax in a classic script, resources the policy will block, and truncation. Those are the three failures that look fine in the source and render blank in the browser.
01
Charts
02
Slide decks
03
Structural diagrams
04
Parameter simulations
05
Self-drawing explainers
06
Knowledge graphs
07
3D data scenes
08
Interactive 3D scenes
09
Self-contained HTML
10
Sandboxed custom JS
Bilingualism
Two columns,
not a translate button.
- 01Every message is stored in both Kiswahili and English as first-class columns, alongside the language it was written in.
- 02A student's own words are never machine-translated for storage. The literal text is kept in both columns, so the toggle always shows exactly what they typed.
- 03Assistant answers are mirrored by a background thread, off the critical path. A failed translation leaves the same language twice, never an empty message.
- 04Retrieval is language-aware, so a Kiswahili question surfaces English sources.
- 05The register is academic Kiswahili with BAKITA-standard terminology, or academic English.
Two surfaces most of this class of product does not have
Live session
Voice that can be interrupted.
By default the phone does the work and the socket carries only text, so it runs on a mid-range Android with no models and no GPU. Recognition keeps running during playback specifically so that speaking over the assistant cuts it off, checked on interim results so it stops on the first syllable. Replies are spoken sentence by sentence as they are written. In ambient mode the default is silence: it answers when named, when the sentence is shaped like a request, or within 25 seconds of last speaking.
Shared canvas
Nothing is silently overwritten.
A document in the side panel both parties edit at once. The person sends whole-document writes carrying the revision they last saw; a stale one is refused and the current text offered back. The assistant sends anchored edits that find exact text and replace it, so they rebase onto whatever the document currently says. If the anchor has gone, the edit fails with something the model can act on rather than clobbering a paragraph.
Properties, not policies
Retrieved text is data, never instruction
Web pages, files and tool results are treated as untrusted. Crawled passages are run through a filter that neutralises injected instructions before the model ever sees them.
Artifacts are contained, not reviewed
Generated pages run in an opaque-origin iframe with scripts allowed and nothing else. Containment is what makes model-authored rendering safe.
Every outbound fetch is guarded
Private, loopback, link-local and cloud-metadata addresses are blocked on the research path, the ingestion path and the crawler alike. Fetches are size- and time-bounded.
Warehouse SQL is read-only
Select and with, one statement, and every file, system and schema construct blocked by pattern.
Artifact URLs are signed
An HMAC over the storage key, so a link cannot be forged or enumerated. Stale renders are swept hourly on a three-day life.
The crawler asks first
Robots respected, politeness delays enforced, spider traps met with three independent defences, consent recorded, and every outcome written down.
Stated plainly
What is
not built yet.
A capability that is almost there is worse than one that is honestly absent. These are the four the system will not claim.
- 01Verified vision. Screen frames are wired end to end and unit-tested, but no vision-capable model has been run against them, so nobody has watched it describe a screen.
- 02Multi-replica realtime. The canvas and steering hubs hold state in process memory; horizontal scaling needs a shared bus first.
- 03The Firecracker sandbox. Stubbed behind the identical contract. What runs today is the hardened subprocess backend.
- 04Multi-user presence on the canvas. Built for one person and the assistant: no cursors, no per-edit identity.
Built for the constraints that actually exist
Metered mobile data. Mid-range Android phones. Intermittent connectivity. Small institutional servers that must not be hammered.
One unauthenticated endpoint reports exactly what a given installation can do: which engine, which database, which sandbox, which services are reachable. Anything absent is not offered to the model, so it cannot promise what this machine cannot deliver.
What sovereignty means here
The institution holds the deployment. The student holds their data. No one else sees it.
Self-hosted on school infrastructure. Nothing in the default path requires an API key, a cloud account, or an internet connection. The architecture, the source and the deployment are handed over under MIT.
Who Weave is for.
Privacy, in plain words
Student data never leaves the school computer.
No cloud sync. No telemetry. No analytics. No third-party AI APIs. Backups are encrypted files the teacher controls.
The open one
The rest of Regnant is owned outright by institutions. Milkshake belongs to everyone.
MIT-licensed, free for schools, NGOs and government education projects. Sovereignty here does not mean a perimeter. It means no one can take it away.
Bring Milkshake to your school →Next system · 01/07
Cordon→Private Inference Engine