Ownership and Privacy

Ownership and privacy

In the loop: Keep it yours. The rule under all four lines.

A loop that runs unattended against a folder holding your life needs one rule above all the others: nothing writes into your notes without you. The machine proposes and you apply. Private folders never reach the compiled layer. The engine and the notes are separate repos, so you can share one and keep the other.

Who owns which folder

The rule is enforced by ownership.

Folder	Owner	What lives there
Work/, Personal/, Library/	you	projects, life, reference material
Inbox/	you	unsorted capture, triaged later
Thinking/	you	Daily/, Ideas/, Beliefs/, Decisions/, calibration
.wiki/	the machine	compiled layer, regenerable, never hand-edited
_Agent-Context/	shared	PROFILE.md, context, tasks, health, the rules agents follow
_Templates/	shared	note templates
tools/	engine	compiler, lint, search, filer, calibration, dialectic
.agents/	engine	scheduled jobs, systemd units, persona definitions

A project is any folder under Work/ or Personal/ with a notes.md. Project mirrors track changes across all permitted source files and exclude private descendants. Use ## Next Action in a project note for its next concrete step; ## Kill Criteria stays separate on the dashboard, because the condition under which you would stop is a different thing from a task.

Capture workers own new files in Thinking/Daily/ and Inbox/Links/. Worker commits are path-scoped and serialised. Raw images, source documents and failed conversions are retained. If a model call, network request or scheduled job fails, the source stays in place and the retry state records what happened.

The LLM fence

The text-processing LLM never gets general file tools. Context is embedded in the prompt. It cannot read, write, move or delete anything. Image OCR is the narrow exception, and even there the image reader receives only the specific image it needs. That is the reason a script can run unattended against a folder that holds your life.

Inside that fence the LLM is the connective tissue of the loop. Local whisper.cpp transcribes voice. Claude reads handwritten images and cleans the text, fixes names against the current context, and adds links between a capture and the notes it touches. The original image, source document or raw conversion stays recoverable, and a failed model call does not erase the input.

When personas run as live agents on a worker, the fence is a settings file that denies Write, Edit, WebFetch, WebSearch, git push, rm, sudo, ssh and reads of ~/.config, ~/.ssh, ~/.claude. See Reference Deployment.

Privacy

Privacy follows from the same separation.

• The repo you clone contains no notes. Content folders are gitignored in the engine repo; your vault is wherever BRAINLESS_VAULT points.
• Identity papers, health folders and official documents are ignored anywhere in the tree by default. Add your own folder names to private_segments in PROFILE.md (see Configuration) and they will never be compiled.
• The public repo is produced from a private vault by tools/export_public.py, a whitelist copy plus a leak scan that refuses to pass on identity numbers, keys, tokens or a name. If you fork this for your own vault, use the same script.
• Folders whose name changes every time, like an HR export with a date in it, are matched by part of the name: private_name_parts in PROFILE.md.

One list of lessons for every agent

Your standing preferences and the lessons from correcting an agent live in _Agent-Context/LEARNINGS.md, each with the rule, why, and how to apply it. They sit in the vault, not in one tool's memory, so a correction given once reaches every agent: the session hook loads the file into every Claude Code session, and the Buzz agents and the reply worker read it too. AGENT-RULES.md sets the rules; this file says how to apply them well, and the rules win on a conflict. The repo ships a stub with one example entry.

Checks, not requests

A rule written in a prompt is a preference. An agent that can do the wrong thing eventually will, so the standing rules run as code.

• Hooks. .claude/settings.json runs tools/hooks/claude_guard.py on every Claude Code tool call.
  • A write into a human folder asks first, and so does a deletion.
  • A secret or a bank number never lands in a file.
  • A wiki page without its language and English summary goes back to the model.
  • The guard is silent when a call passes, and a bug in it never blocks anything.
• Model chatter. Output where the model talked about its tools instead of your source ("Write is disabled, so I'll output…") is refused before it becomes a page, and lint lists any that got through earlier.
• Run log. Every scheduled run leaves one line with what it did. A job that fails, goes quiet or runs every night with nothing to do shows up in HEALTH.md the next morning.

Backups

Sync is not backup. Two machines and a remote follow each other, so a bad automation run reaches every copy within minutes. brainless backup create runs once a month from the hourly job. It seals the whole vault, private folders and git history included, with age, to a public key, and writes the archive into a folder that sync does not reach. The machine that makes backups cannot read them; the private key lives in your password manager. brainless backup verify is the restore test, and HEALTH.md counts the days since the last archive and the last restore.