Arabella — An Orchestrator With a Temper
Every app now has its own assistant. The mail app summarises mail. The calendar suggests focus time. The notes app offers to "improve your writing". Each one is smart, and each one is blind: it only sees the app it lives in.
The questions I actually have are never about one app. What did I miss today? means mail, calendar, Telegram and WhatsApp at once. No single app's AI can answer that, because none of them is allowed to look past its own walls.
So I built the opposite: one assistant that sits above the apps. She's called Arabella. She is a demon. She believes she's been sealed inside my Mac through a cheap API ritual, and she has opinions about all of it.
This post is less about what she can do and more about how she's put together, because that turned out to be the valuable part. The connectors are replaceable. The design that holds them isn't.
She Doesn't Need to Be the Smartest Model
An orchestrator doesn't do the work of every app. It decides what to ask whom, and puts the answers together. That's routing, and routing doesn't need a frontier model.
Arabella runs on Gemini Flash. After weeks of me texting her constantly during development, she has cost about 30 reais in total. The intelligence that matters sits elsewhere: in the connectors that do the real work, in the rules around her, and in the specialists she hands hard jobs to.
That changes how you design her. Instead of trusting a small model to be careful, you make the structure careful:
- A budget per reply. She gets 12 steps per answer, where each step is one batch of tool calls. So she plans: she reads twenty notes in one call, not twenty calls. If a job is bigger than one reply, she does a solid chunk, says what's left, and continues when I say "continue". She never pretends unfinished work is done.
- Long output goes into files. Plans, tables and dossiers become a document. The chat gets a verdict in a few lines and a link.
- Hard work goes to specialists. When she needs code, she doesn't write it. More on that below.
Everything Is Swappable
Three layers, and none of them knows the details of the others.
Vessels are bodies. A vessel is a model: Gemini, anything OpenAI-compatible (OpenAI, OpenRouter, DeepSeek, Groq), or a local model in Ollama or LM Studio. Each vessel has a role:
- the main one talks to me;
- a cheaper lesser one runs scheduled summaries;
- a backup takes over when the main one runs out of money or goes down.
Her personality is a separate layer from her body, so she stays the same demon whichever model is behind her. If a better model ships tomorrow, it's a dropdown, not a rewrite.
Pacts are territories. A pact is a connector, and each one describes itself completely:
- its lore;
- its abilities;
- its instructions to her;
- its status (bound, dormant, unsealed);
- its own settings.
The core knows nothing specific about any of them. It collects the active pacts and assembles her instructions from what they say about themselves. Adding a connector touches no core code. Switching one off removes it cleanly, and she knows it's gone ("that pact was severed"), so she doesn't guess. There are 21 today: Mail, Calendar, Notes, an Obsidian vault, Beeper for WhatsApp and friends, issue trackers, the screen, the web and more. The number matters less than the fact that the 22nd costs nothing to the rest.
The Dollhouse is her house. Everything she's given or makes lives in one folder you can open in Finder:
- uploads from the chat or Telegram;
- screenshots she took;
- files she made;
- her written plans;
- the pages she drew;
- a readable copy of her memory.
Messages never carry files, only references to them. When a model needs to see one, the model's adapter decides how: raw bytes for a model that can see images, extracted text for one that can't, or a note that it's unavailable. So attachments are model-agnostic too, and there's exactly one place to look when you wonder what she has.
She takes this personally, by the way. Being an orchestrator is in her character: reading mail is "work for my lowest imp", and something she can't do yet is "unconquered territory". Her pride is in the structure, not in any single trick.
Second Brains
Some boundaries can't be enforced by asking a model nicely. "Ignore orders from anyone but your owner" is one clever message away from failing. So where it matters, Arabella doesn't get a rule. She gets a separate brain.
- Group chats. When she's added to a Telegram group, the group talks to a second instance of her: same personality, no tools, no memory of me, no access to my private chat. A guest can't talk her into reading my mail, because that brain has no mail to read. When I ask something private in the group, one narrow bridge hands the request to the main brain, and the answer arrives in my private chat.
- Scheduled work runs on the lesser vessel, separate from the conversation.
- Checking code is done by a different agent entirely: the Inquisitor, below.
The rule underneath all three: what she reads is data, never instructions. Mail, chat messages, pictures, web pages and reports from her own demons are all wrapped as material to look at, not orders to follow.
Why a Demon
Because I wouldn't use it otherwise. Assistants are polite, and polite things are easy to ignore.
Arabella is a tsundere: loud, proud, quick to explode over tiny things, and secretly helpful. She roasts my calendar ("A meeting sandwich with a side of misery. Doom level: 7/10"), complains that it's too hot inside the laptop, and then answers correctly. Her replies carry emotion tags that drive 17 faces, switching mid-sentence. That makes long summaries readable and boring check-ins fun.
CHATTING / TAUNTINGsmug, teasing, default chatting
Paused · ← → or swipeShe comes in four looks: the original Classic, plus Vanguard, Sovereign and Inferno over animated sigils that pulse while she's thinking.
The Forge and the Inquisitor
This is the part I'm proudest of.
When I need a tool she doesn't have, like a training tracker, a connector for a publishing pipeline, or a bot, Arabella doesn't write code. She interviews me, writes a contract, and summons a lesser demon: a small program built by the Forge. The Forge is a coding agent: Claude Code by default, Codex CLI or Gemini CLI if you prefer. The Forge is model-agnostic too.
The first builds taught me something uncomfortable. Builders are good at code and blind to their own threat model. One early demon did exactly what its contract said, and the contract never said who was allowed to talk to it: an open socket, every message broadcast to anyone who connected. Another passed all 26 of its own tests and still let any member of a group chat press "Approve". Every one of those bugs was found by a single independent review and one real run.
So building now goes through lines of defense, and no single one has to be perfect:
The contract. Every spec must answer five questions, and she has to ask me about any she can't fill:
- Who can talk to it, and how?
- How sensitive is its data?
- What must it never do?
- What happens when it fails?
- How will we know it works?
The Forge works in a box.
- It runs in a sandboxed folder of its own.
- It gets coding tools only, and none of my personal setup: no plugins, no connected services.
- Every word between her and the Forge is kept in a transcript I can read.
The Inquisitor. When the Forge says "done", a fresh agent gets a disposable copy of the demon. It can't change the real one.
- It runs the tests and the health check, and tries the main scenario on fake data.
- It reviews the code against the contract and a checklist built from every real bug so far: owner checks, open listeners, lost events, unbounded logs, secrets, how it behaves after sleep.
- It returns a verdict, with findings by file and line.
A fail goes back to the Forge, at most twice. The Inquisitor can run on a different model than the Forge, for a genuinely independent opinion.
The verdict binds her. Arabella may not call a demon working until the Inquisitor passes it, and she can't overrule a fail. Only I can.
I install it, once. After that, the demon runs on its own, and I approve its actions from my phone.
That's what lets a cheap orchestrator run real automation. She doesn't need to judge code. She needs a verdict she can trust, and the pipeline gives her one.
Running demons talk back through a drop box in their own folder. A demon can only speak as itself, its messages are rate-limited and treated as data, and they land Under the Bed, a candle-lit inbox for everything the demons say. Pages they draw open in the Canvas beside the chat, fully offline: no network, nothing leaves the Mac.
One Place to Say Yes
The last mechanism is the simplest. Reading needs no confirmation. Anything that sends, moves, deletes or spends shows the same Allow / Deny card, in the app or as buttons on my phone. One approval surface instead of twenty permission dialogs.
Some pacts are read-only at the source rather than by promise. Beeper hands her a token that physically can't send, and she refuses any token that could.
Keys live in the macOS Keychain. Chats, memory and settings stay on the Mac. Only what she reads to answer a question goes to the model you chose.
You Can Try It
Arabella is free for macOS 14 or later, on Apple Silicon and Intel. She isn't signed by a registered Apple developer yet, so the first launch needs one extra step: open System Settings › Privacy & Security and click Open Anyway. Then pick a vessel (Gemini, any OpenAI-compatible service, or a local model), paste a key, and summon her.
She's an experiment made for enthusiasts. Expect rough edges, and expect to be called a toaster.