How it works
Intero is built like an operating system. Devices plug in through drivers. A small kernel keeps time honest and judges each night. Everything the kernel says is written to a ledger with receipts. Apps read the ledger, and shells show it to you.
-
1 · Drivers
Every record, kept byte for byte
A driver per source (Oura, WHOOP, Garmin) reads the vendor's records and keeps each one exactly as it arrived, addressed by its own SHA-256, with every field, including the ones nobody reads yet. A record seen twice is stored once.
Each reading carries a sensor passport: the vendor, the device, the metric's definition and, where known, the device era. A firmware change can move a sensor's bias, so era is part of the evidence.
-
2 · Kernel: time
One clock, no silent shifts
Every observation stores the instant in UTC, the time zone, and how the source expressed time (UTC, local with an offset, or a local wall clock with no zone). A night belongs to its wake date in the zone you were in. Each driver ships a test that would fail if local wall-clock time were ever stored as UTC, the bug that quietly shifts "mornings" by hours.
-
3 · Kernel: Sensor Court
Witnesses, a verdict, dissent
For each metric and night, each device is a witness. The court:
- Translates each vendor onto a shared scale, estimating its systematic bias on nights the devices were worn together.
- Measures noise per device with the three-cornered hat, falling back to a documented, deliberately wide prior when it can't.
- Fuses the readings, weighting each by its precision, into one value with an 80% band that also grows when devices disagree.
- Overrules a witness that sits too far from the others, with a reason assembled from the numbers.
- Refuses, with a typed reason, when there is no witness, no noise model, or a band too wide to be useful.
-
4 · Ledger
Claims with receipts
Every verdict, calibration, noise model, forecast and refusal becomes a claim in an append-only ledger. Each claim carries a receipt (the input readings, their passports, the algorithm and its version, the parameters) and the hash of the claim before it, so tampering with any stored claim breaks the chain.
A better algorithm doesn't rewrite history. It appends new claims under its new version, and the old ones stay on record.
-
5 · Apps
Features dock through one contract
Recovery Watch, the body forecast, Déjà Vu, Drift Radar and Sensor Audit are apps. Each declares the capabilities it needs, and the kernel checks them at every call. An app can only append claims in its own namespace, and an estimate without a band or inputs is rejected before it reaches the ledger.
-
6 · Shells
Web, iPhone, Apple Watch, command line
Shells only render claims. Labels and units come from one metric registry, so the iPhone and the web can't drift apart. Tap a number and you reach its receipt.
Why refusals are a feature
Most apps always show a score. When the data is thin they show one anyway, and you can't tell a good night's reading from a guess. Intero treats "I don't know" as an answer with a shape:
- A refusal is typed. "No device reported it", "only one device, and nothing yet to check it against", "the devices define it too differently to combine" and "the likely range is wider than useful" are different problems with different fixes.
- A refusal is never a zero. A missing night is skipped by everything downstream, never averaged in as nothing.
- A refusal has a receipt. You can see which readings were looked at and why they weren't enough.
- A refusal tells you what would help. Wear a second device for a few weeks, and the court can measure the first one's noise.
Refusals are drawn hatched, everywhere: every refusal reason.
Where language models fit
Intero itself makes no calls to language-model services. If you connect an assistant, it can read Intero's claims and speak for them, but every number in what it says is checked against the cited receipts, in its unit and within display rounding. A number it can't back with a receipt fails the check.