# Salmex I/O — Full Reference

> Archived. Salmex I/O has been sunset and is no longer available for download or sign-up. This reference is kept as a record of what was built. It was a personal AI operations platform that ran locally as a single Go binary: persistent memory, multi-channel communication, agentic execution with a coding agent and web search, and human-in-the-loop safety via an LLM judge. It supported Anthropic, OpenAI, Gemini, and Ollama.

## Overview

Salmex I/O is a self-hosted AI operations platform designed for power users who want AI that acts on their behalf rather than just responding to prompts. It runs entirely on your machine, connects to any major LLM provider, and stores all data in your own PostgreSQL database.

The platform is built as a single Go binary with zero runtime dependencies — no Node.js, no npm, no Docker required. It uses a ports-and-adapters architecture with 8 distinct layers and explicit dependency injection.

Built independently in London. The product has since been sunset and is no longer maintained.

## Architecture

8-layer architecture with ports-and-adapters pattern:

1. Agent Layer — agentic reasoning loops, multi-step tool use, session management
2. Channel Layer — Telegram, Slack, Discord, CLI, HTTP, web; unified message routing
3. Gateway Layer — JSON-RPC gateway, lane-based FIFO queues (serial per session)
4. Plugin Layer — JSON-RPC 2.0 over stdio, subprocess isolation, crash recovery, lazy start
5. Memory Layer — 3-tier: session transcripts, working memory, long-term (PostgreSQL + pgvector)
6. Judge Layer — LLM-based safety review, 4 risk levels, confidence scoring, decision caching
7. Scheduler Layer — cron expressions, natural language scheduling, River-backed queue
8. UI Layer — 40+ typed events, SSE streaming, JSONL transcripts

Key infrastructure:
- Database: PostgreSQL with pgvector extension for hybrid vector + BM25 retrieval
- Config: DB-driven hot-reload configuration with AES-256-GCM encryption, version history, rollback
- Events: Typed event bus with agent, channel, memory, and system events
- Concurrency: Lane-based FIFO queues ensuring serial processing per session

## Memory System

Three-tier persistent memory:

1. Session transcripts — every conversation preserved as structured JSONL
2. Working memory — current goals, active context, in-progress tasks
3. Long-term memory — PostgreSQL + pgvector with hybrid retrieval

Retrieval pipeline:
- Vector similarity search via pgvector embeddings
- BM25 full-text search via PostgreSQL tsvector
- Reciprocal rank fusion to combine results
- Confidence decay — memories age and lose weight over time
- Extraction pipeline — extracts facts, preferences, decisions, entities from conversations
- Consolidation — periodic deduplication and merging of related memories
- Volatility filtering — distinguishes stable facts from transient information

Memory is shared across all channels and all LLM providers. Switch from Anthropic to OpenAI mid-session — your context follows.

## Safety: LLM Judge

Every tool call passes through a structured safety pipeline:

- A separate LLM model (the "judge") reviews tool calls before execution
- Four risk levels: None (instant), Low (logged), Medium (reviewed), High (requires approval)
- High-risk actions (code execution, sending messages, external API calls) escalate to the user
- User receives a notification on their preferred channel: "The agent wants to [action]. Approve or deny."
- Confidence scoring with per-session context
- Decision caching for repeated safe operations
- Everything is logged and auditable

Risk level examples:
- None: reading a file, listing directory contents
- Low: writing to a file in the user's project
- Medium: executing a shell command, calling a search API
- High: sending a message on behalf of the user, deploying code, calling external APIs with side effects

## Coding Agent

Embedded coding agent with full tool use:

Tools (9+1):
- read — read file contents
- write — write/create files
- edit — precise string replacement edits
- exec — execute shell commands
- grep — search file contents with regex
- find — find files by pattern
- ls — list directory contents
- truncate — truncate file to line range
- workspace_info — get project structure and context
- create_agent — spawn sub-agents for parallel work

Session trees with branching — tree-structured conversations with id/parent_id, branching, navigation, compaction. Iterative summarisation for long sessions.

## Web Search

Multi-engine search with intelligent routing:

- Perplexity — AI-powered deep research with source citations
- Brave — privacy-focused web search with instant answers
- Google — Custom Search for broad coverage and site-specific queries

Features:
- Intent-based routing — automatically selects the best engine per query
- Deep research mode — multi-step research with synthesis
- 2-tier cache — in-memory + PostgreSQL for fast repeated queries
- Aggregation — combines results across engines with deduplication

## LLM Providers

Multi-provider support with unified interface:

- Anthropic — Claude Opus, Sonnet, Haiku (state-of-the-art reasoning and coding)
- OpenAI — GPT-4, o3, o4-mini (broad capability and tool use)
- Google Gemini — 2.5 Pro & Flash (large context and multimodal)
- Ollama — run open-weight models locally (Llama, Mistral, Qwen, and more)

Bring your own API keys. Switch providers at any time without losing memory or context.

## Channels

Multi-channel communication — same agent, same memory, same tools across:

- Telegram — full bot integration
- Slack — workspace integration
- Discord — server/guild integration
- CLI — terminal interface
- HTTP — REST API for custom integrations
- Web — browser-based interface

Unified features across all channels:
- Message routing with outbox pattern
- Quiet hours and presence detection
- Delivery tracking with retry logic
- Escalation (judge approval requests) on any channel

## Plugin System

Extensible via JSON-RPC 2.0 plugins:

- Subprocess-isolated — each plugin runs in its own process
- Crash recovery — automatic restart on plugin failure
- Lazy start — plugins start only when needed
- Health checks — periodic liveness monitoring
- Standard protocol — any language that speaks JSON-RPC 2.0 over stdio

## Configuration

DB-driven hot-reload configuration:

- All settings stored in PostgreSQL (not flat files)
- AES-256-GCM encryption for all secrets (API keys, tokens, credentials)
- Hot-reload via LISTEN/NOTIFY — changes take effect without restart
- Version history — every change tracked, full rollback capability
- Sensitive field masking in CLI (--unmask requires TTY)
- SSL enforcement in production
- Dual-mode startup: static defaults or dynamic via config manager

## Status

- Sunset / archived. No longer distributed, sold, or supported.
- Downloads and sign-up have been removed; no new licences are being granted.
- This website is kept online as a record of the work and its architecture.

## Security Comparison: Salmex I/O vs OpenClaw

| Aspect | OpenClaw | Salmex I/O |
|--------|----------|------------|
| Secrets | Plaintext default, opt-in SecretRef | AES-256-GCM encrypted in PostgreSQL |
| Tool safety | No review, full user permissions | LLM judge, 4 risk tiers, human-in-the-loop |
| Memory | Basic chat history recall | Hybrid vector + BM25, extraction, consolidation |
| Runtime | Node.js, 1,200+ npm dependencies | Single Go binary, zero runtime deps |
| Plugins | npm marketplace (1,184+ malicious found) | Subprocess-isolated JSON-RPC 2.0 |
| Auth | Disabled by default, 220K+ exposed instances | HMAC-SHA256, constant-time comparison |
| CVEs | CVE-2026-25253 + 5 additional (RCE, injection, path traversal) | None disclosed |

OpenClaw security issues documented:
- 512 vulnerabilities found, 8 critical (enterprise readiness score: 1.2/5)
- CVE-2026-25253: arbitrary code execution via WebSocket origin bypass
- 5+ additional CVEs: command injection, SHA-1 cache poisoning, PATH hijacking, TAR path traversal, voice RCE
- API keys stored in plain text by default (opt-in SecretRef added later), targeted by RedLine, Lumma, and Vidar infostealers
- 1,184+ malicious skills found in ClawHub marketplace (36% containing prompt injection)
- 220,000+ instances exposed to the public internet, 17,500+ confirmed vulnerable to RCE
- Microsoft recommended dedicated VM isolation
- Palo Alto Networks: "lethal trifecta" of private data access, untrusted content exposure, external communication
- Kaspersky: "wide open to untrusted data"
- Cisco: "personal AI agents like OpenClaw are a security nightmare"

## Technical Specifications

- Language: Go 1.23+
- HTTP framework: Gin
- Database driver: pgx
- Logging: zerolog
- CLI: Cobra
- LLM SDKs: openai-go, anthropic-sdk-go, google genai
- UI framework: SvelteKit with Svelte 5
- Desktop: Tauri v2 (Rust core) + SvelteKit + Go sidecar (macOS, in development)
- Design system: INFRARED — dark-only, @salmexio/ui component library

## Links

- Home: https://salmex.io/
- Sunset notice: https://salmex.io/sunset
- Blog: https://salmex.io/blog
- The Case for AI You Own (essay): https://salmex.io/blog/the-case-for-ai-you-own
- Architecture: https://salmex.io/docs/architecture
- Licence (archived): https://salmex.io/licence
- Creator (Salmen Hichri): https://salmenhq.com/