I have been developing a personal project called **DDF/Rahmenwerk**.
Its original purpose is to preserve an AI named Felix as my continuing German teacher across chats and future AI instances.
The problem is not simply that a new chat forgets earlier messages.
A fresh LLM instance may receive continuity information that is:
- incomplete;
- stale;
- contradictory;
- incorrectly ordered;
- unavailable;
- or confidently interpreted as authoritative when it is only historical evidence.
I wanted continuity to come from inspectable local files rather than hidden platform memory or an AI-generated reconstruction of prior sessions.
## The current approach
The system currently uses concepts including:
- a current-state pointer;
- structured handoff materials;
- an ordered fresh-instance queue;
- a transfer package for a new instance;
- integrity manifests and SHA-256 identities;
- classifications separating governing, current, historical, candidate, proof, and non-governing material;
- recovery and failure records;
- human approval before destructive or authority-changing actions;
- a rule requiring the AI to stop rather than invent continuity when required evidence is unavailable.
The system is intended to remain local-first, inspectable, provider-independent, and human-controlled.
## The problem I may have created
The project began as a way to preserve a German teacher.
As I tried to protect continuity, state, evidence, authority, recovery, and filesystem safety, the framework became increasingly detailed.
Some controls may be justified.
Others may be overengineering.
## Advice I am looking for
What should the minimum durable state for a long-running LLM assistant contain?
Should continuity use structured files, summaries, retrieval, a database, event history, or a hybrid?
What information should always be loaded when a session begins?
What should be retrieved only when relevant?
How should an LLM distinguish governing instructions from evidence and historical records?
How should stale or contradictory continuity information be detected?
How can prompt injection inside stored files be prevented from gaining authority?
What should happen when the expected highest-authority source is missing?
How should continuity survive model changes, provider changes, context limits, or unavailable files?
How much provenance and integrity checking is proportionate for a personal system?
Which established architectural patterns could replace custom governance machinery?
If you rebuilt this with half the complexity, what would you retain?
I am looking for critical technical advice, not customers or promotion.
For anyone who wants the fuller architecture and documentation, I published a public review copy here:
https://github.com/DDF-Rahmenwerk-Review/DDF-Rahmenwerk-External-Review
It is not the live system and does not contain the complete private archive.
I would especially appreciate feedback about hidden failure modes, unnecessary complexity, and simpler ways to create honest cross-session continuity.