SwarmMarshal: local-first communication intelligence for agentic programmers.

SwarmMarshal is not primarily an email client with a chatbot attached. It is a local-first knowledge workbench that turns the user's communication history into an evidence layer for search, synthesis, drafting, timelines, legal review, and supervised automation.

The application runs as a .NET MAUI Blazor Hybrid desktop app for Windows and Apple Silicon Mac. It keeps provider data in local SQLite stores, enriches messages through a gated AI pipeline, builds source-backed context packs, and exposes those packs to the in-app assistant, supervised helper agents, user workflows, and external agents through MCP.

The critical engineering constraint is provenance. A model can write a summary, but durable knowledge must know where it came from. A route advisor can recommend a cheaper model, but the route must have proof for the function it will perform. A helper can draft or propose, but sends, deletes, external calls, and broad automation stay behind explicit user control.

The design principle is type the data, code the behavior. Structure — fields, schemas, records — is declared so the system can leverage it. Behavior — fetching, transforming, formatting — is authored as sandboxed C# rather than accreted as typed product features, which keeps the behavior space unbounded without growing an inner platform.

Authored tools carry a declared contract: named, typed parameters, a return description, and a sample input. They compile through Roslyn inside a shared sandbox with a safety gate — raw HTTP clients and filesystem access are rejected at compile time, and all web egress flows through a single instrumented channel. Compilations are content-hash cached; execution is time-bounded. Every invocation stamps a run record (time, status, output) onto the tool, and a workbench surface exposes the code, the contract, and the last run for inspection, hand-testing, or edit.

The payoff is a zero-LLM fast path. When an agent registers its bulk-refresh tool, repeated refreshes execute the compiled tool directly — a portfolio applet that previously spent roughly two model calls per symbol per refresh now spends none. Failures self-heal: when a tool errors, the system falls back to the model to diagnose and re-author it.

The same substrate serves three surfaces today: tools inside Vibes applets, per-field display formatting (authored snippets that return structured display values, never raw HTML), and the Today dashboard's generated panels — all sharing one sandbox, one safety gate, and one run-record contract.

A worker is a full profile of its own — data root, email account, role configuration — living under the hiring profile and executed by a dedicated child host process with a curated service set. The supervisor tracks a per-worker heartbeat, restarts crashed workers with backoff, adopts orphans after an abnormal exit, staggers autostart, and stops every worker when the app closes. One worker wedging cannot take down its siblings or the host.

Provisioning is conversational but gated: the assistant stages the hire — profile, account (connection-tested first), role — and activation waits on an explicit human approval task. Credentials never travel through approval payloads, and secrets pasted into chat are registered with a redaction service before validation so they cannot persist in transcripts or logs. Workers are bound to the device that hired them and never replicate to peers.

Paired same-owner devices form the swarm: signed LAN envelopes, journaled sync with per-origin high-water marks, last-writer-wins conflict resolution, snapshot bootstrap for fresh peers, and automatic gap healing for machines that slept through compaction. On top of that fabric sit the distribution services: peers advertise which local models they can serve, a remote-peer LLM provider forwards completions to the machine with the hardware (a PC using a Mac's Ollama install — or a worker asking its boss to broker a cloud model without holding the key), and a load-scored work allocator hands scheduled tasks, research jobs, and background work to the least-busy node.

Duplicate work is prevented economically as well as logically: short-TTL advisory claims ensure only one peer pays to enrich a given message, results replicate through sync, and cloud calls are deduplicated rather than forwarded peer-to-peer. There is deliberately no LLM heartbeat — the always-on layer is deterministic schedulers and sync, and a model is invoked only when there is real work.

General model rankings are useful only as priors. SwarmMarshal stores capability, cost, context, latency, and value metadata for candidate models, then tests important functions against task-specific suites. The message pipeline is the strictest example: a model can be famous, cheap, or locally installed and still be rejected if it fails threat decisions, routing, grounded facts, observations, parse stability, or knowledge-worthiness cases.

The "golden prompts" are synthetic, protected calibration cases tied to a prompt hash and a suite hash. The same suite can be run against OpenAI, Anthropic, Gemini, DeepSeek, subscription CLI providers, and local Ollama models. Results are reduced to aggregate metadata such as weighted score, pass rate, critical failures, parse failures, latency, hardware bucket, and required runtime settings. Raw prompts, raw responses, headers, messages, facts, embeddings, and personal data are not published.