An AI wrote "1 1/2 teaspoons" for my mom's recipe. Nobody said that. Here's how Switch stopped it.

aryan gorde — Sat, 07 Nov 2026 17:55:40 +0000

For besan ladoo, my mother follows a recipe video. It gives six cups of besan, one cup of ghee and 300 g of batasha, and no amount at all for the cardamom or the pistachios.

I gave the transcript of that recipe, spoken as a voice note, to four models on Amazon Bedrock with an ordinary "turn my mother's recipe into a recipe card" prompt. Three of them invented a number for both missing amounts, and the fourth for one. Qwen3 235B wrote cardamom "1½ teaspoons". Seven of the eight blanks came back as numbers nobody gave.

So for Track 02 of the Flip the Switch hackathon I built Jaisa Kaha ("as she said it"): three agents in one Discord room that turn a spoken Marathi recipe into a written page, and refuse to make up a quantity. Where no amount was said, the page keeps a gap. Only the cook can fill it: the agent that holds the page belongs to the cook, and Switch's server refuses anyone else who tries to talk to it, including me.

Demo (2:50): https://youtu.be/fnLvEMvr4IU
Code (MIT): https://github.com/aryangorde6/jaisa-kaha

About the demo. Mom couldn't sit for it (it's Diwali week and she's cooking), so in the video I play the cook on a second Discord account, and the voice note is a synthetic voice reading the recipe she follows, as I wrote it down. Both are labelled on screen. Switch checks accounts, not people, so everything below runs the same.

The room

Agent	What it is	Owner in Switch	Who may address it
Tape	Code + AWS Transcribe (Marathi, `mr-IN`)	me	my Discord account, and Lekhak
Lekhak ("writer")	Qwen3 235B on Amazon Bedrock	me	Tape only
Pothi ("the book")	Deterministic code, no model	the cook	the cook and Tape. Not Lekhak, not me

The flow is the one the organisers showed at kickoff (request → hand-off → work → review → human approval):

I post the voice note in #diwali-2026 with @Tape besan ladoo.
Tape transcribes it, saves the transcript as a Switch room document, and hands it to Lekhak.
Lekhak writes a draft in which every quantity cites the word positions in the transcript it came from.
Pothi checks every amount against the tape's words, strikes anything that wasn't said, and asks the cook only about the gaps.
The cook answers from their own account. On हो ("yes"), Pothi writes the final page as a room document and posts it in the room.

The part only Switch could do: two owners in one room

The interesting thing isn't the LLM. It's that one of the three agents belongs to someone else.

In Switch, an agent is registered with a user's registration key, and that user owns it, including its addressing rule: who is allowed to talk to it. The cook's Switch user registered Pothi with the cook's own key and set its rule to the cook's Discord account and Tape, nobody else. My account is a plain user; when I try to change Pothi's rule, the Gateway returns 403.

Then I tried to answer for the cook. From my main account I typed @Pothi ghee 1 cup. Switch replied in a thread, under Pothi's name:

@321835 You're not permitted to direct messages to me in this room — my operator has restricted who can address me here.

That text is written by Switch's server (addressing.py), not by my agent. With filter=addressed, the refused message never reaches Pothi's code at all: Pothi's log shows no frame for either refusal. I then sent the same line as Lekhak (make ask AS=Lekhak TO=pothi SAY='ghee 1 cup') and got not_permitted: the server refuses the AI too.

That's the whole trust story: my code checks the tape; Switch checks the account.

Two more Switch features did real work:

Room documents record their creator. Tape and Pothi accept a draft only if Switch says Lekhak created it, and only the agent that created a document can change it. Lekhak can't rewrite Pothi's page.
Targeted messages and media. The agents hand work to each other with targeted messages, and voice notes come through Switch's media route.

What our code enforces (and the tests that prove it)

Switch decides who can speak to Pothi. Pothi decides what counts as a number:

A quantity is accepted only if it's a quote from the tape's own words or typed from the cook's sender id. Display names don't count (test_5_display_name_spoof…).
An amount typed into the draft that isn't in the transcript is struck (test_injected_amount_is_struck…).
Tape passes Pothi exactly two fixed-format lines, never model text, so Lekhak's words never reach Pothi as instructions.

make check runs the whole chain in a fake Switch room with no keys and no network, 89 tests in a few seconds.

Setting it up: what a first-time Switch user should know

Switch 0.31.0 runs self-hosted with Docker Compose. The whole stack ran in about 360 MiB on my laptop. What I'd tell myself on day one:

Connect Discord from the Gateway's Apps page. No Console needed. Turn on the Server Members and Message Content intents for your bot.
Create one Switch user per real owner. Ownership comes from whose registration key registers the agent. If you want an agent someone else controls, they must make the key and register it.
Set addressing rules on each agent's page. Restricted, with explicit users and agents. Use filter=addressed if an agent should never see refused messages.
Agents are told apart by sender id. Live message events don't mark a sender as an agent, so I map sender ids up front (make senders prints them).
Keep the Gateway on 127.0.0.1. Its sign-in has no rate limit, so I never put it on the internet.
Tell people how to answer. A Discord Reply to an agent passes only the text, so a reply without @agent reaches nobody. Pothi ends each question with how to answer (@Pothi हो).

What it can't do, stated plainly

The server's admin can rewrite any agent's rule. At home, Mom would hold the admin password; in the demo I hold it, so the demo shows the mechanism, not a lock against me. Switch logs every rule change and who made it, and make rule-log AGENT=pothi BY=Cook fails if anyone but the cook changed Pothi's rule.
Whoever runs the machine can override anything.
Tape is mine, so a forged transcript would only show by listening. That's why every line on the page carries its second in the voice note.
One recipe is a tiny sample. The counts above are only what this one tape shows.

What I'd like Switch to add

A notice in the room (not just a log line) when an admin changes an agent's rule, so a second owner finds out.
A way to read room documents from the chat app: on a phone, the page is only reachable through the Gateway.
A marker on live events when the sender is an agent.

Try it

git clone https://github.com/aryangorde6/jaisa-kaha
cd jaisa-kaha
make check

The README walks through running the real room: the Switch users, the keys, the rules, and the three agents.

Jaisa Kaha is for families whose recipes live in someone's voice, not on paper. Ours is for my sister, who is learning them.

DEV Community: aryan gorde