| name | add-hands |
| description | Give your Founder OS hands - let it DO things, not just answer. Trigger on "add hands", "let it do things", "give it hands", "let it take actions", or "set up actions". The default ships only SAFE, reversible, local actions (open a file, folder, app, or link; save a note to your log) that run with no confirmation. Anything irreversible or outward-facing - running a command, and later sending or posting - passes a confirm gate and is OFF until you turn it on. Computer control (driving your screen) is NOT shipped; it is named as a later capability, gated when it lands. This is the swappable "hands" from the brain / mouth / hands scaffold, and the confirm gate is the whole point: the OS never takes an action you cannot undo without asking you first.
|
| why | Hands are where an assistant stops being safe by default. The honest design is a gate, not a feature list: safe and reversible actions run freely so the OS is useful, and every irreversible or outward-facing action stops for an explicit yes. Shipping the gate as the core - with sending, posting, and computer-use named as not-yet rather than implied - keeps the people-first line and never promises an action the OS cannot take safely. |
| enhance | The default hands open things and save notes - reversible, local, no confirmation. To let the OS run commands for you, turn that on in voice/hands-config.json; it then stops for an explicit yes every time and shows you exactly what it will run. Sending, posting, and computer control are not built yet - when they are, they arrive behind the same gate. |
| summary | Let your OS open things and save notes; risky actions ask first. |
| allowed-tools | ["Bash","Read"] |
| mcp_requirements | [] |
Add hands
Runs on: local-exec - the happy path runs a local Python setup and a local action dispatcher. On a read-only or cloud surface, explain the actions and the gate but do NOT take any action or claim one ran - it has not until the user runs it locally.
The OS ships complete as a brain that reads and answers. This adds hands: the ability to act on what it decides. It is the swappable hands from the brain / mouth / hands scaffold. The brain stays the same; the hands are how it reaches out and does something. Nothing here is required, and nothing irreversible happens without you saying yes.
The rule that governs everything here: the confirm gate
Every action is one of three classes, and the class decides what happens:
- Auto (safe, reversible, local): runs with no confirmation. Open a file, a folder, an app, or a link. Save a note to your log (an append you can delete). These cannot lose work or reach outside your machine, so stopping for a yes would only annoy you.
- Confirm (irreversible or outward-facing): stops for an explicit yes every time, and shows you exactly what it will do first. Running a command is the shipped example. It is OFF by default - you turn it on deliberately in
voice/hands-config.json.
- Blocked / not built: sending, posting, and computer control. They are named honestly as not yet built. When they are added, they arrive in the Confirm class, behind this same gate. The OS says plainly it cannot do them yet rather than pretending or stalling.
This mirrors the OS's existing approval-gates rule for irreversible actions. Hands do not invent a new safety model; they apply the one the OS already has to real actions.
The accessibility floor
The default hands need NO key, NO paid service, and NO pip install. Opening things and saving notes use tools your machine already has. Everything past that is opt-in.
Pre-flight
- Confirm a local runtime: this skill runs Python and your machine's file/app openers. On a web-only surface, walk the actions and the gate and stop - do not take any action or claim one ran.
- A note action appends to
brain/log.md. If that file does not exist yet, the dispatcher creates it; say so plainly rather than failing.
The flow
1. Wire the default hands
python skills/add-hands/setup.py
It writes voice/hands-config.json (the action classes and which are enabled) and copies the action dispatcher into the gitignored voice/. By default only the Auto handlers (open, note) are enabled; the Confirm handler (run) is wired but OFF. It installs nothing and needs no key.
