Cookwala / Trust
Trust is a number with a unit, a record you can check, and a list of what we got wrong
This page gathers the safety model, the privacy rules, the security policy, the governance, the critiques and the status of every part of Cookwala. Nothing here promises zero harm; a standard that did would be lying.
The safety sheet
- Safety limits
- enforced on the device; stricter always wins; no recipe, agent, message, extension or operating mode can raise one; a maker changes a default only through a documented safety case and a signed firmware release
- Local stop
- motion stops within 0.5 s, heat cuts within 1 s, with or without a network; never refused for authorization
- Refusal
- before heat, with the step and the reason; deep frying has one rung: an oil thermometer
- Unattended operations
- cutting, sautéing, searing, frying, reducing never run without a person present or reachable within one minute
- Minimum core temperatures (defaults)
- poultry 74 °C · ground meat 71 °C · reheating 74 °C (USDA FSIS; UK FSA 75 °C) · hot-holding at or above 60 °C · two-stage cooling
- Allergen blocks
- refuse; no substitution around a block
- Text
- data, never instructions; attempts are logged as incidents
- Agents
- act only under a signed mandate: a signed permission from a person that says what an AI agent may do for them, with limits and an expiry; irreversible actions and safety overrides always need confirmation; the second is never granted
- Recalls
- signed feed; executors refuse recalled revisions; block_and_stop_running stops running executions safely
- Incidents
- anonymous, date only, modelled on aviation's confidential reporting
The default limits pack is a draft for planning and conformance tests; device makers replace or tighten it from their own safety case, and no authority has reviewed it. safety-limits.default.json · Core section 6
What the standard cannot prevent: hardware failure, a maker that lies about what it enforces, a person who overrides a limit on a device that allows it. Conformance and certification make these detectable, not impossible.
Privacy
- Execution logs carry no personal data and leave the device only with opt-in, withdrawable consent; open datasets coarsen times to the day.
- The Humanitarian Profile carries no personal data at all: organizations, aggregates, sites.
- The Household Context Profile keeps a home's facts at home: 139 facet types with a privacy class and a travel rule; 45 never leave in any form; providers receive derived constraints; 13 device self-state types may travel only under explicit, withdrawable consent; no behavioural score of anyone; income never inferred; everything erasable within a stated window.
- No cookies on this site, and fonts are served from cookwala.ai, not a third party. The host, Cloudflare, injects its cookie-less Web Analytics beacon on every page; it counts page views and sends no personal data to us. Its removal is the founder's decision and this line will change when it happens.
Household Context Profile · The essay · next a data-protection impact assessment with a reviewer
Security
- Hashes over RFC 8785 canonical JSON; Ed25519 signatures (P-256 for hardware keys); key records with validity and revocation; selective disclosure; event logs with one sequencer and witnessed checkpoints: a signed summary of an event log that witnesses counter-sign, so a later rewrite can be detected, so a rewrite is detectable; relayed items verify against the issuer, never the relay.
- Report vulnerabilities privately; safety problems are security problems. Acknowledged within 3 working days; 90-day default disclosure.
Conformance and certification
137 public vectors. A claim is a signed report: self-declared → verified by a registry operator → certified by an independent certifier. Reports, never badges. No certifier is engaged. The path · the reference report
Governance
One editor today, in public with written reasons; RFCs with 30-day comment periods and named reviewers for safety; a steering committee with published numbers and seats for the people affected; a neutral foundation later; a patent non-assertion pledge; Contributor Covenant. Governance · RFCs
Critiques we published
We wrote critiques of our own idea from six viewpoints (a red team, a technical reviewer, a demanding adopter, an AI lab, a relief agency, a health agency), and published them with our responses and the status of each concern. They are self-authored; no outside organization has reviewed Cookwala yet, and none is named as having done so. We then changed the one-liner, made the schemas strict, redesigned the ledger and the simulators' baselines. Critiques · Concern register, 30 items · The gap list
Status of everything
| Part | Status |
|---|---|
| Core 0.2 | core normative, draft under review |
| Humanitarian 0.2, Household Context, Registry, Conformance reports, Federation | draft profiles |
| Kitchens and runs, Supply signals, Mission, Market, Reasoning, Health personalization, Extensions | exp experimental |
| Rule packs: a reviewable list of food-safety and nutrition rules a program chooses to apply, derived from published guidance | draft none professionally reviewed yet |
| Simulators | model illustrative, not forecasts |
| Pilots, partners, certifier, foundation | planned none exist |
| Hosted services (registry publish, status page) | planned static files today |