Gestu

LINKING PROOT USERLAND

NETWORK TRANSFER: 0 BYTES · LOCAL KEYSTORE SEALED

Gestu Well Protocol · v1.5 · Sovereign Build

Your Personal
Phone Assistant. Not Big Tech's.

A private intelligence that lives on your handset — drawing from Gestu's well, never from someone else's datacenter. Reasoning happens on your silicon. Your files stay in your vault. Your phone answers to you.

Claim the Sovereign Pass Inspect the Engine ↓ APK · 48.2 MB Direct sideload, signed build

On-Device Engine

LiteRT + Gemma 4

100% offline & private

Cloud Resilience

31-Provider Failover Mesh

31/31 routes armed

Access Model

Flat $14.99/mo

400M tokens included

Human Backing

Support 10AM – 7PM

4d/wk · 24h response promise

Data path On-device by default. A cloud route leaves your country and reaches that provider under their retention policy — we attach no profile, and nothing comes back. Zero-egress mode forces the local path and blocks the mesh entirely: flip it and there is nowhere for a prompt to go.

PTY proot/debian-12 · uid 10234 VAULT sqlite AES-GCM · sealed EGRESS 0 bytes this session

DESCEND

02 — Instrumented Workflows

Three hands.
One well of wisdom.

These are not marketing cards. They are instruments — operable, telemetred, and honest about what they do. Touch them.

Artifact 01 · Encrypted Local Vault

Your contracts sit encrypted on your device.

Drop a client NDA, a rate card, or a 40-page SOW. Gestu parses it into the local SQLite vault with AES-GCM at rest, then reasons over it on-device. No upload bar, no retention policy to read, no vendor holding a copy. With zero-egress enforced below, that reasoning has no route off the handset at all.

  • On-device SQLite vault encrypted with AES-GCM per-row
  • Hardware KeyStore sealed keys — non-exportable
  • Zero-egress mode forces the LiteRT path, blocks the mesh

Local path only. The mesh is blocked, so a prompt has no route off this device.

vault://freelancer/session-0417
Network transfer
not tracked Local path only · the mesh is blocked
Documents sealed
1,284 avg. parse 41 ms · q4 model
Vault integrity
HMAC OK AES-GCM at rest · last verified just now

03 — The Manifesto

Two assistants.
Opposite metaphysics.

One rents you intelligence and keeps the receipts. The other hands you the well.

The Big Tech Assistant Trap

Skill rented, sovereignty withheld.

  • Mandatory telemetryEvery prompt, every file, every pause — logged to train the next model.
  • Surveillance-shaped trainingYour private documents become tomorrow's benchmark.
  • Arbitrary 3-hour cooldownsCapacity throttled by a boardroom, mid-thought.
  • Automated bot supportA loop of articles, and a ticket that closes itself.
  • No local computeOffline means useless. Your phone is a thin client to their estate.

Verdict: you are the product, and the product is metered.

The Sovereign Gestu Standard

The well is yours. Draw freely.

  • Hardware KeyStore encryptionKeys sealed in silicon. Non-exportable by design, ours included.
  • Flat $14.99/mo, 400M includedNo cooldowns, no mid-task cut-off, and no overage charge if you go past it. Your bill does not move with your curiosity.
  • Embedded Linux sandboxA rootless Debian or Alpine userland inside your own storage.
  • Dedicated human engineering10AM–7PM, four days a week. A person, with a 24-hour promise.
  • On-device core, and cloud only if you askLocal inference has no uplink. The mesh exists for the hard questions — and it crosses borders, so we say so rather than implying otherwise.

Verdict: zero telemetry, nothing reported back, flat price.

04 — Engine Architecture

Three strata.
One instrument.

Scroll to descend the shaft. Each strata seals over the last.

Layer 01 — The Local Core

Inference that never phones home.

Google LiteRT runs quantized Gemma 4 weights directly on the NPU and CPU. Prompts, documents, and voice never touch a socket. Airplane mode is not a degraded state — it is the primary one.

RUNTIMELiteRT (TFLite Next)
WEIGHTSGemma 4 · int4 quantized
EGRESS0 pings · socket deny-list
FALLBACKMesh arms only on request

Layer 02 — The 31-Provider Mesh

Resilience as a routing problem.

When a frontier model is genuinely required, Gestu routes across 31 providers — DeepSeek, Anthropic, Gemini, SambaNova, and your own local servers — under a circuit-breaker loop. A dead route is invisible; the answer still arrives.

ROUTES31 providers, hot-standby
BREAKER3 strikes → 30 s quarantine
BUDGET400M tokens/mo included
COOLDOWNSNone. Ever.

Plainly A cloud route is a cloud route. When the mesh answers, your request reaches a third-party provider, may cross borders, and is held under their retention policy — not ours. We send no profile and no identifier alongside it, and we take nothing back. If a prompt must not leave the handset, turn on zero-egress mode: it forces the local LiteRT path and blocks the mesh, so the request has no route at all.

CIRCUIT BREAKER · ALL ROUTES HEALTHY

Layer 03 — Gestu Build / PRoot Sandbox

A userland, inside Android storage.

No root. No unlocked bootloader. PRoot maps a full Linux userland into app storage, so Python 3, Node.js, Bash, and long-running daemons execute beside your data — inspectable, disposable, and entirely local.

DEBIAN 12~150 MB · shared with Build
ALPINE~5 MB · independent install
RUNTIMESPython 3 · Node · Bash · git
AGENTSClaude Code · OpenCode

NO ROOT · NO BOOTLOADER UNLOCK · NO CLOUD VM

05 — Device Evidence

Not a render.
The shipped instrument.

Every frame below is a raw capture from Gestu 1.5 running on a handset — including the rootless sandbox, the OpenCode terminal, and the memory ledger. Select a surface to inspect it.

Gestu launch screen with the Gestu emblem, Start Interactive UI, and Open Gestu Build.

01 / 10 · HOME

The wellhead

Gestu at first light — the carved rim of Gestu Well, the on-device emblem, and two ways in: the interactive UI, or straight down the shaft into Gestu Build.

  • Gestu 1.5
  • raw capture · 1272 × 2772

Modes

Plan → Build

Plan mode reasons without touching a file; build mode writes, runs, and commits.

Reasoning

Switchable effort

Swap agents and models mid-session with /agents and /models.

Keys

ctrl · esc · tab

A dedicated key row sends control characters to the PTY, not the IME.

Export

APK → Internal storage

Build artefacts come out of the sandbox to Internal storage, ready to sideload.

06 — Access

One flat price.
No meter running.

Bring the well home free. Pay once for the current — and take all of it.

Local Core

BYOK · offline-first

$0/ forever

The whole on-device engine, no account required.

  • 100% offline LiteRT + Gemma 4 inference
  • Local SQLite vault, AES-GCM at rest
  • Hardware KeyStore key sealing
  • Gestu Build / PRoot sandbox (Debian or Alpine)
  • Manual API keys for your own providers
  • No managed failover mesh
  • No autonomous background heartbeat
Download the APK

48.2 MB · signed · no telemetry SDK bundled

Sovereign

Sovereign Pass

Flat rate · 400M tokens included

$14.99/ month

400M included cloud tokens a month. The local core is unlimited, and never counts against them.

  • 400M included tokens/month across the full 31-provider mesh
  • The on-device core is unlimited — local work never counts
  • No cooldowns, no throttling, no mid-task cut-off
  • Never per-token billing: overage is never charged to you
  • Complete Gestu Build / Openclaw suite
  • OpenCode plan & build modes, switchable reasoning
  • APK export from the sandbox to Internal storage
  • Autonomous background heartbeat (Daemon Mode)
  • On-device voice: sherpa-onnx briefing playback
  • Dedicated technical support, human, 24h promise
  • All future strata — no upgrade gates
Take the Sovereign Pass

Billed by Google Play · cancel in a tap · no lock-in