Rakazo

Beta teammate runtime with Pi sessions, computer tools and web, Electron and mobile clients. Team bots share a computer's trust boundary; separate folders and browser profiles don't isolate untrusted bots.

No product visual on file

Choose it when

You want persistent conversations plus browser, terminal and file work, with optional voice. Use Team Computers only for mutually trusted work; use separate computers when workloads need isolation. Treat trusted local-computer mode as host access, not a sandbox.

Skip it when

You need isolation between untrusted bots on one Team Computer, a tested complete-machine restore, or a backend that keeps working after its server and workers stop.

01 / Classification

Autonomy evidence

This is our classification, not a vendor badge. The record says what the product normally does. The gaps stay visible.

How we classify it

Tool use + multi-step plans, still human-gated per session.

Runs unattended

Yes — that capability is documented in this brief.

Trigger

Normally a person sends work to a teammate. Unattended=true is conditional on configured routines/scheduled jobs and a running backend/worker. Scheduled jobs create durable runs; recurring timers coalesce pending catch-up work rather than proving every tick produced a delivered response.

State

Messages/runs live in Postgres; workers claim execution with leases and heartbeats. Pi sessions run in the API/worker, separately from computer providers. Workspace checkpoints preserve the latest home, not an immutable archive or the entire OS image.

Tools

Agents operate browser/desktop, shell and files through the computer-provider contract and can delegate to bots/subagents. Model and provider capabilities constrain tools; documented voice needs a selected voice provider. None was exercised here.

Human control

Stop, takeover and protected-input requests are documented controls, not universal per-action approvals. Team folders and screen leases don't isolate untrusted bots sharing an OS user; use separate computers. Trusted local mode isn't a sandbox. Operators must own access, storage, worker monitoring and recovery of interrupted operations.

02 / Operations

Control reality

Useful agents eventually touch something real. This is the operational picture we have, not a promise hidden in a sales page.

Where it runs

Own backend/server with web, Electron and mobile clients; Pi executes in API/worker processes, while computer providers supply machines. Local Docker or optional remote services are choices, not a finished managed-service promise. Configured background work needs the server/workers running.

Data boundary

Model, voice, computer and integration providers are separate recipients to assess. The reviewed consent flow applies only to new mobile actions, not web/Electron/workers or global run revocation. Downstream routing and retention/security agreements still need verification; overall telemetry, retention and policy compliance weren't assessed.

Identity & permissions

Account/Space/recipient-scoped mobile consent isn't a global permission boundary. Team bots share OS user, workspace and shell/X11 access; independent browser profiles organize sessions but aren't isolation against another bot. Use separate computers for different trust boundaries.

What it can write

Computer browser, terminal and files · Delegated agent work and configured integrations

Surfaces

Web client · Electron client · iPhone and Android clients

Export / lock-in

Portable workspace checkpoints can restore a home on a replacement computer. LocalAgentHomeStore keeps only the latest copy; persistent encrypted DATA_DIR and off-host backups are operator requirements. OS packages outside the workspace aren't portable. No complete restore or cross-provider round trip was tested here.

03 / Receipts

Evidence ledger

Here is what this brief is built on. “Documented” means we found a source. “Tested” means this desk actually ran it. Those are different things.

Evidence status

documented

Source set

5 primary sources

Evidence review

2026-10-27

Sources on file

Corrections

Not recorded yet. If we change a material claim, the correction belongs here.

04 / Change log

Related coverage

The brief tells you what the product is. Payloads track the changes that may alter the decision.

No linked change coverage on file yet.