AncestryLLM documentation
AncestryLLM is a local-first command-line tool for genealogy research. It combines deterministic RootsMagic and GEDCOM workflows with optional, explicitly selected LLM providers.
The canonical source is this docs/ directory. It is published to the
AncestryLLM documentation site and the
GitHub Wiki; the Wiki remains
available, but neither published view is an independent documentation source.
Current product surfaces
The CLI, interactive REPL, and released bounded Electron desktop control shell are the implemented product surfaces. The shell supports Home, Diagnostics, Settings, and capability onboarding.
The CLI and REPL use the same command specification, transport-neutral executor, application DTOs, and genealogy services.
- Start with the CLI reference for one-shot commands.
- Start with the interactive console guide for the prompt-toolkit and Rich REPL.
All user-selected files are governed by the shared bounded file-ingress policy, including byte and record budgets, race detection, output alias rejection, and transactional publication.
The released bounded Electron desktop control shell uses the authenticated health/capability sidecar. The 0.6.0 source also includes explicitly bounded file-grant, provider-configuration, presentation-only Tasks adapters, a source-level synchronous transient-chat API, and a transient Chat destination over a Main-owned private stream. That chat boundary requires an exact stored profile and model plus current policy and compatible consent, keeps bounded content only in memory, grants no tools or domain authority, renders model Markdown through a closed allowlist, and keeps external-link confirmation in Electron Main. Desktop-domain capabilities such as target-matched packaged and adversarial chat evidence, genealogy/domain task admission or execution, direct artifact access, cloud accounts, and updater flows remain planned or incomplete. The current desktop records distinguish the supported packaged control surface from source-level gated adapters and the verification needed for later expansion; they are not a current journey for excluded domain capabilities.
The accepted deployment architecture now has a source-level profile control plane: Local Desktop is the safe default, while Connect Remote and advanced Host Remote remain explicit unavailable intents. The bounded desktop shell also has reviewed macOS arm64 controls for acquiring and managing app-owned Colima, Lima, Docker Engine, and Compose tools. Those controls do not ship or activate an AncestryLLM application container or a remote runtime; the local CLI, REPL, and bounded desktop shell remain the only product surfaces.
v0.6 desktop learning path
Start with the local, provider-none Home state, then use Desktop shell to understand the bounded control surface and its sanitized recovery path. Continue with the interactive console guide for genealogy commands, and use the CLI reference when a one-shot command is more appropriate. These surfaces share application contracts, but the desktop shell does not silently grant provider, network, filesystem, or genealogy authority.

Tutorials
Learn a complete, safe workflow with fictional data:
- Desktop first run — reach a verified, network-free Home state and choose the next supported surface
- Merge fictional GEDCOM records offline
— produce a rooted GEDCOM 5.5.5 file and quality report with
provider=noneand no network calls.
How-to guides
Task-oriented guidance for common goals:
- Run an offline GEDCOM merge — merge the public fictional fixtures, verify the results, and recover from failure
- Explore commands in the interactive console — inspect the implemented prompt-toolkit/Rich REPL safely
- Recover with desktop diagnostics — interpret sanitized startup state and retry the private desktop service
- Grant desktop file access — understand scoped opaque grants and the immutable-input boundary
- Configure a desktop provider and consent — test an endpoint, review exact disclosure scope, and revoke consent
- Monitor and cancel desktop tasks — follow backend-owned progress and cancellation safe points
- Use transient desktop chat — work with the bounded, unsaved advisory conversation surface
- Interactive console guide — start and use the REPL
- Encrypted backup and recovery — create and restore backups
- First-run storage diagnostics — troubleshoot setup
- Release runbook — prepare and publish a release
The established root paths for the last four guides remain published while
release packaging and contract consumers use them. Their inventory records the
later git mv cutover that will update those consumers together.
Reference
Factual, accurate information to look up:
- Desktop reference — routes, states, stable codes, platform behavior, accessibility, and recovery
- Desktop diagnostics contract — local schema, event catalog, retention, privacy, and support boundaries
- CLI reference — commands, options, and exit codes
- Provider guide — provider policy, profiles, and capabilities
- GEDCOM compatibility and release checks
- Versioning and compatibility
- Bounded file ingress
- Continuous integration
- ty advisory evaluation — 0.6 checker evidence and cutover disposition
- Ruff rule-expansion evaluation — reviewed 0.6 static-analysis batches and regression evidence
- uv_build evaluation — reproducible backend comparison and fail-closed adoption disposition
- Architecture ownership and dependency contracts
- Command executor
- Built-in module authoring — constraints, registration, and tests
- Application contracts — service DTOs and ports
- API reference — authenticated health and capability control API
- Local LLM benchmarks
- Local-first retrieval evaluation
Explanation
Concepts, rationale, and design context:
- Privacy and consent — local-first boundaries and consent model
- REPL architecture — internal session and dispatch design
- Desktop shell (released bounded v0.6.0 plus marked source-level gates) — supported Home, Diagnostics, Settings, and onboarding plus source-level gated Tasks presentation and transient-chat contracts
Supporting records and publishing
- Wiki synchronization — reproduce the publishing step locally
- Wiki operations and recovery — dispatch, verify, rollback
- Security response checklist
- Verified uv bootstrap — executable trust policy, receipts, and reviewed updates
- Documentation authoring guide — Diátaxis map and authoring rules
- Release notes for v0.6.0 — release scope, limitations, installation, and verification
- Desktop verification (released bounded shell and later changes) — exact-head verification, not release approval
- Desktop deployment (released bounded shell publication) — installer publication and app-owned macOS arm64 runtime-tool controls, not a hosted application
- Local-first container and advanced remote deployment ADR — implemented profile and macOS arm64 runtime-tool boundaries plus future application-runtime gates
- Electron and FastAPI desktop ADR — released control-shell boundary and excluded domain scope
- Provider framework evaluation ADR — recorded provider choice
- Data-flow threat model and control matrix — security governance
- Release evidence index — retained verification artifacts
Documentation links
Documentation links use relative Markdown filenames (for example,
[Console guide](/AncestryLLM/CONSOLE.html)). This keeps links valid from this docs/
directory in the repository. The Pages build rewrites local links only in its
generated staging directory, from .md targets to site paths. Wiki
synchronization rewrites the same local targets to extensionless Wiki page
links. The canonical source remains unchanged.
Use the sidebar to navigate the complete published documentation set.