I keep a personal agent in my pocket. It lives in WhatsApp's "Message yourself" chat. I type a thought and it lands where it belongs: work items, reminders, someday ideas, or a conversation with an LLM that has actually read my notes.
It started with a note I couldn't organize. Sections for work, ideas, chores, reading, all in one list, all carrying the same weight. A someday idea sat next to a task due this week. The fix was boring: capture should cost nothing, triage should be scheduled. So I made capture the thing I already do anyway (message myself), and made triage an agent that files my dump once a week.
The whole thing is a markdown file in a private git repo. A small adapter on a Windows box that's always on watches the self-chat and routes messages: /dump saves it verbatim, /remind makes a calendar event, /do adds a commitment, everything else goes to a headless LLM that runs in the repo. The note syncs between my machines with git. Nothing else holds my data.
Three rules came out of using it daily.
Capture is explicit. Nothing lands in the dump unless I say the word. My dump, my responsibility.
The agent can add but not reshape. It can append items and create reminders freely, but moving or deleting anything on my board requires it to propose the change and me to say /apply. A headless agent can't ask questions, so propose-and-confirm is its way of asking. This is the guardrail I'd keep over everything else.
One home per fact. Reminders live on the calendar, not in the note. Work lives in the note, not on the calendar. When a thing shows up twice, that's a bug.
It also learns from me. Conversations log locally, and a reflection pass turns my corrections into rules it reads. A booking reminder where I had to fix the month twice is now a rule: never guess a date, ask.
The honest part: the self-chat filter keeps strangers out but can't tell me from someone holding my unlocked phone. The real threat model is ninety seconds, not a hacker. And a headless agent is only as safe as the account it runs as, which a security review tells you in one sentence: the blast radius is the desktop user.
Why do this at all? I build agent systems for work, and I wanted to live with one as the user. Partly it's laziness: the least-effort capture that still respects my attention. It's not a product. It's a notes app with a brain attached, it's boring on purpose, and it answers to no one but me.