The school of the future, built for my own family

---

Level 1. The story

It started with spelling. One HTML page, hosted on Netlify, to help with spelling at home.

It became a school. Within months it was a learning platform built nervous system first: research underneath, a curriculum underneath that, an AI that decides each moment of a lesson, and a human approving every pass.

At its heart is a conversation engine. A paid chatbot can remember a child. This one decides what to do with what it knows, one turn at a time, walking a map of the curriculum and of the child. Level 2 shows how.

It learned three things. How each child learns. How each parent thinks and teaches. And itself: every turn is checked, logged and fed back, so the system gets better with use.

Other children want it. When one of my children showed it to friends, a friend typed in a topic, saw the map it drew, and asked if they could have it.

The question it answers. AI can now write a child's essay, answer the homework and explain any topic in seconds. A great deal of what school measures, it does for free. So what is left to teach a child, and how do you build for that?

The second problem underneath. The way children learn today is split up. Curiosity goes to a search box or a chatbot. Content comes from school and video lessons. Games sit somewhere else. None of them know about each other, so the child has to join them up alone. And every parent feels the same pull: learning that follows what the child loves, and an exam that is coming anyway. Lesson libraries pick coverage. Chatbots pick curiosity. This holds both.

It was not a weekend build. On the first day nothing worked at all. Then came months of research, a knowledge base built from hundreds of sources, and a long series of engineering failures, each one turned into a safeguard.

Every decision has a reason I can give you. A lot of AI-built code arrives with nobody able to say why it is shaped the way it is. This is the opposite. Each layer below exists for a stated reason, and each safeguard exists because something specific went wrong. Ask me about any of it.

We homeschool, so I could build for this without waiting for a school to change.

---

Level 2. The thinking, and the layers it became

Five calls

Teach what AI cannot do for a child. Storytelling first: having something to say, and finishing it. Then holding a point of view and questioning an argument.

The curriculum is the floor, not the ceiling. Cambridge sits underneath every subject, so nothing is missed. Children can go as far past it as their interest takes them. Age is not the unit; the skill is.

Movement is the measure. Progress is how a child moves along a map of skills. No timed tests and no streaks, anywhere. Exam-style papers are there when they ask for them.

The body comes before content. A tired or overwhelmed child cannot learn, so the system reads how they are arriving before it decides what to teach. Regulate, then relate, then reason.

A human approves every pass. The AI proposes what it has noticed. A parent reads it and decides. Nothing it infers changes the teaching until a person says yes.

The layers

Research at the bottom. Six knowledge sources, kept apart on purpose: nervous-system development research, the Cambridge curriculum (refreshed every month), a purpose layer on what learning is for, Global Perspectives, teaching methodology (IEW for writing, Lindamood-Bell for imagery, Critical Thinking Co), and a reference shelf for the books the children actually read, so the AI never invents a plot. They are separate because an early version mixed them and one source drowned out the rest.

A written theory of learning. The research was distilled into a plain-language account of how learning works and what has to be true before it can happen. Early versions were rejected as generic. One leaned on whatever it had read last. It was rebuilt to weigh every source evenly.

A model of each child, in plain language, built in passes. A picture of this particular child, built from what the parents observe. Testable predictions about what will help, tracked, and rejected when the evidence says so. Then numbers the software can act on: how hard to go, the mix of questions, when to pull back. Prompts describe; numbers decide.

It learns the parents too. Two parents, two roles, and the system meets each one differently. One gets a thinking partner who knows the research. The other gets one good question after each lesson, the kind that helps a teacher name a pattern they had already noticed. Whatever a parent tells it is filed silently: against a prediction, into the child's picture for review, or into the next session's plan. A reflective letter to a parent is written fresh each time it is asked for, and never stored.

Patterns across subjects, approved before they travel. When the same kind of slip shows up in maths and in spelling, the system flags it and matches it to the research. It changes nothing until a parent approves it. The other parent then sees the approved teaching move, with the dated pieces of work behind it, so they can see why.

One agent decides every lesson turn. A single orchestrator reads the child model, what the child knows now, how they are arriving, and what they did yesterday in another subject, then picks the next move from its tools. Yesterday's maths lesson knows today's English session.

A regulation gate on every turn. Green: teach, one question at a time. Amber: simplify. Red: drop the content and settle. Gone: close kindly. Sessions end at 25 minutes. It never pushes through.

It improves itself with every turn. Every turn is validated and logged. After sessions, the picture of the child is updated, what they know is re-estimated, and new words and concepts join a graph shared by every subject. Predictions that stop holding are dropped. The children report bugs from any screen.

Privacy walls in code, not in policy. Three zones: what the child sees, what a parent sees, and a journal no one can read, not even the AI. The engine has no route to the journal, and a test fails the build if any other code tries to read it.

The showcase: the conversation engine, and why it is not a chatbot with a memory

A paid ChatGPT or Claude account can remember a child. Put the schoolwork in a project and it will know their name, their books and what they asked last week. That is memory. It is not the hard part.

The hard part is deciding what to do with what you know, one turn at a time. That is what this engine does.

Before the first word

Before it says anything, the engine reads:

• the picture of this child, and the numbers that say how hard to go and when to pull back
• how the child is arriving today, from a body check-in
• what they know now, concept by concept, as a probability that moves with every answer
• where the conversation sits on the curriculum map, and what comes before and after it
• what they did yesterday in another subject

Walking the map

The curriculum is stored as a graph. Chapters link to what must come before them, what comes next, and what sits alongside them in other subjects.

When a child asks about something, the engine finds where that sits on the map and walks outward. It checks the prerequisites. If one has never been tested, it plans a quiet check. If one shows a gap, it plans to go back for it. If a harder version of the same idea exists at a later stage, it can borrow from it.

If the question sits outside the map entirely, the engine says so to itself and follows the child freely. It tags what they covered so it can be placed later.

Every turn

• It reads how the child is doing and adjusts: teach, simplify, settle, or close.
• It asks exactly one question. Never two, never none.
• When the question has one right answer, it registers that answer silently and checks the child's reply before it responds. It does not agree with a wrong answer.
• A validator checks every turn afterwards and flags any that break the rules.
• Every turn is logged.

After the session

A separate pass reads the whole conversation and builds the child's own knowledge graph. Concepts become nodes. Each node is typed: curriculum, the child's own idea, a personal anchor, a cross-subject bridge. Links between nodes are typed too: a prerequisite, a meaning link, a connection the child made by themselves. Each node carries a mastery state from new to solid, and it can be marked as decaying. Each node also records which thinking move it took: notice, describe, explain, question, predict, connect, evaluate, create.

The maps

At the end of a session, the child sees a mind map of where they went, colour-coded by subject. A parent sees the traversal map: every session, every node, every link, and the links the child found on their own.

The first child map used a physics layout. It never rendered under the build tool, and when it did, the nodes piled on top of each other. It was replaced with a fixed hub-and-spoke layout that is readable and always paints.

What a project folder in a chat app does not do

• It does not hold the curriculum as a map with prerequisites, or walk it.
• It does not estimate what the child knows, concept by concept, and update that with every answer.
• It does not read how the child is arriving and pull back when they are overwhelmed.
• It does not check an answer before it praises it.
• It does not hold itself to one question per turn, with a validator to prove it.
• It does not build a graph of the child's own connections across subjects.
• It does not wait for a parent to approve what it has inferred.

Same models as everyone else. The difference is the engineering around them.

The same question, three ways

On 10 November 2026 we typed one question, "Why is Lake Hillier pink?", into ChatGPT twice: once with no context, and once inside a project holding school material and a note about an invented child. The answers are shown in full and unedited. Next to them is a real masalas session that started from the same question.

masalas. The same question, followed for a whole session, and kept, so the next session starts from there. This is the map.

One question, followed all the way

A child asked why a lake in Australia is pink. One session, May 2026.

The engine did not answer and stop. It followed the question across geography, biology, chemistry, history and language. The pink comes partly from an alga that lives in very salty water, which led to the pH scale, and to acids and bases. The alga led to how living things adapt to extreme places. The lake led to the other pink lakes of the world, and to the island reserve around it, protected so closely that it can only be seen from the air. The lake's name is a surname, which led to Matthew Flinders and his expedition of 1802.

Twenty links in one session. Half of them the child made, not the engine. A chat app answers the question. This engine keeps a map of where the question went, and the next session starts from it.

Behind every turn the engine also reads how the child is arriving today, where this sits in the curriculum, and how solid each idea already is. This map is one of those layers, drawn in full.

A second module: Chatterbox to Author

A child writes a whole book, from the first idea to the last chapter.

They write on paper. The workbook is printed. When they want, they photograph a page, and the app reads the handwriting exactly as written. The spelling stays as it is.

The coach answers only when asked, and never writes the story. Asked to look at a page, it names one specific strength and asks at most one question. When the child is stuck, it asks up to three questions about their own hero, plot and setting. A parent account cannot use it: the server refuses with "Only the child writes."

When they ask for an edit, they stay the author. Each editing pass looks at one thing, such as strong verbs or chapter endings. It quotes the child's own sentence, offers one alternative, and the child decides.

Underneath the story, a curriculum. The child sees a map and a book to finish. Underneath, 165 of the workbook's 202 pages are mapped to one or more of 47 writing and thinking skills: show don't tell, pacing, dialogue, foreshadowing, claim and evidence, story structure. On every page the coach knows which skill it is working on and how many questions it may ask.

Three ways in, never one gate. Every planning field takes typing, speaking, or a photo of handwriting, and all three land in the same place. If the microphone or camera fails, the other two are one tap away.

Drafts belong to the child. A draft stays private until the child chooses to share it.

---

Level 3. The engineering: what broke, and what we built so it cannot break quietly again

Day one

On the first day nothing worked at all. The site went up on Netlify and could not reach its own server. The publish path was wrong, the address of the server was wrong, and the security rules between the two were rewritten three times before a single request got through. Every lesson below came after that.

What broke, and the safeguard each failure left behind

Most of these failures reported success.

The models were retired and nothing said so. Two AI models were retired in June. Every AI call in the platform failed for 17 days before anyone noticed. Now there is one model registry, a check on every boot that asks the provider which models still exist, a fallback to the newest model of the same tier, an alert email, and a build test that fails if a model name is written anywhere else.

A child saw a raw billing error. When the API account ran dry, a child asking a science question saw the provider's error text in the chat. Now every error is sorted by kind, the child sees a kind sentence, and the detail goes to the log.

The AI agreed with wrong answers. The conversation had no grading, so a confident wrong answer got a warm yes. Now, when the AI asks a question with one right answer, it registers the answer silently, and the next reply is checked before the AI responds.

The AI's output drifted. Two questions at once, no question at all, stray code, leaked tool syntax. A validator now checks every turn and writes a row of telemetry. Its first run found all four checked turns missing a question, which traced back to the prompt and the spec disagreeing.

The agent is allowed to fail. If it times out or errors mid-lesson, the lesson carries on from a plan made in advance. The child never sees the failure.

Jobs reported success and did nothing. The weekly digest searched for module names nothing wrote, so two of its six sections were blank every week while the job said it worked. A push said "Everything up-to-date" with the branch missing. The rule now: check the effect by reading it back, never the return code.

"Did it deploy?" had no answer. The health check returned OK whether the new build was live or the old one was still running. It now reports the exact commit that is serving.

No test had ever run. The only suite needed live passwords and live data, so it was always skipped. The gate now runs with no credentials, no network and no running app, in about two seconds, on every push. It holds 64 checks, including: the browser never calls the AI directly, the secret key never reaches the browser, only the journal reads the journal, and child screens never see what the AI has inferred about them.

Autocorrect picked obscure words. Spelling help matched a misspelling to the nearest word in a 370,000-word dictionary, so "keychain" became "kelchin". Corrections now only land on common words.

A screen guessed which child it was serving. It answered with the same child for every address it did not recognise. Screens now read the child from the address, and never guess.

What it taught me to build everywhere else

masalas was the first platform. What it taught became the way I run every system since.

A ledger of real failures, graded honestly. Every real failure across my platforms is logged with a citation, sorted into a class (silent success, local proves nothing about production, built and never switched on, and so on), and paired with the control that should catch it. The ledger marks plainly whether that control exists yet. It cannot mark itself done; only a passing test or a guard in code can.

A shelf of shared parts. The fixes that mattered became shared packages used across my platforms: the self-healing model registry born from the 17-day outage, one parser for AI responses, one embedding client, and a deploy guard that refuses to ship a stale tree to production. A part moves to the shelf when a second platform needs it, not before.

One control plane over all of it. A morning brief that reads the systems directly instead of trusting anyone's notes, a check that stops two agents working on the same thing at once, and a gate on anything going public.

How the work gets done: AI run as a team

I design the system, decide what ships, and fix it when it breaks. The building is done by AI agents, organised like a team with roles, rules and checks.

Skills: the team's standing procedures. A repeated job becomes a written skill the agent loads before it starts. One builds the next history and geography book from the source files, one chapter at a time, against a fixed checklist. One vets a public lecture series before anything from it reaches a child: keep what holds up, rebuild it on real sources, drop the rest. One cuts the next four weeks of printed work from the real coursebooks. The procedure lives in the skill, not in my head, so it runs the same way every time.

Agents in parallel, without stepping on each other. Several agents work at once, each in its own copy of the code. A check reads the code history and stops one agent touching what another is mid-way through. One agent integrates and ships; the others hand their work over. For research, one agent sends out readers in parallel and gets back conclusions, not file dumps.

Agents that audit the engine. Scheduled cloud agents were set to read real sessions and report what the engine got wrong: two questions in one turn, leaked code in a reply, a wrong answer it agreed with.

The parents work through the AI too. Each parent has their own connector in Claude, with a set of tools onto the platform: record a piece of work, read the child's progress, see the approved teaching moves. Everything a parent saves is recorded as theirs.

Hooks that run whether anyone remembers or not. Every working session opens with a brief built from the live systems, not from anyone's notes: what ran, what failed, what is unmerged. Every session closes by re-indexing what was learned, so the next one starts from it.

Gates in front of everything that matters. Every push runs the offline test gate. The live server reports exactly which commit it is running. On my other platforms, a deploy is refused if the code is out of date. Nothing goes public until it passes a check for AI-sounding writing and a privacy read by me.

A swarm, held back until it can be trusted. A swarm of agents is written and ready: it fans out across every system and proves each check still works. It was held back on purpose, after two questions: are we really ready, and does everything that produces a signal have something that reads it? Both answers were no. A swarm on top of an alarm that is usually wrong only multiplies the noise. In the team's build order the builders come last, after the architect, the test engineer, the shipper, evals and security.

An exit gate on what gets built. Before new work starts, it answers six questions. Does it work without me in the room? Is it in the repository and documented, or on one disk? Can a buyer verify where its revenue lands? Is it a separable unit? Does it reduce dependence on any one customer? Is it built on something only we have? The last was added after a regulatory-compliance AI tool passed the first five and was still a bad idea, because we had no advantage in that market. Alongside it sit four standing gates: reuse, privacy, voice, and a place for a human to approve.

---

Level 4. For the engineer

• Stack: Node and Express on Railway, React and Vite on Cloudflare Pages, Supabase Postgres with pgvector. Claude for reasoning, Voyage for embeddings, Gemini for handwriting and images, Deepgram for voice.
• DECISIONS.md: every architecture choice, the tradeoff, what did not work, and what I would change.
• Changelog for the module.
• The demo: no login, made-up content, the real interface.

Other modules, available on request: guided learning (maths, science and English, mapped to Cambridge) · Global Perspectives (creative projects, never an exam) · spelling (where it began) · research to author (the Chatterbox approach, for non-fiction) · a private journal no one can read, not even the AI.

What changed: 755 commits since 31 March 2026, 36 of them on Author. Designed and run by me, built with AI agents, with a human approving every pass.

Known limitations:

• Spelling is read, not taught, in Author. The module keeps the child's spelling exactly as written. It does not feed a spelling lesson.
• Skills are mapped, not yet tracked. The coach is grounded on the skill for each page. It does not yet record progress against those 47 skills.
• Handwriting reading can be wrong. A page numbered 78 was once filed as 178 with no way to fix it. Every filed page now has a "wrong page?" control, and unsure reads are flagged.