The sync client runs on your machine. The server never sees a key.
It owns the files, the keys, and the sync. Nodes land as plain markdown you can open in any editor, secure-area pages are encrypted here before they leave, and nothing is overwritten while a conflict stands.
Day one starts from a folder you already have.
No import and no new editor. This is the first day, from a folder of company markdown to an agent on your phone, with the commands as they run.
- Point it at the folder you already have. The runbooks and notes stay
where they are. On the first sync the sync client adopts each file, and the only thing
it adds is a short header:
id,scopeandkey_id. - Mark the pages we must not read. Create a scope key, then put
scope: financein the header of those pages. From that sync on, they leave this device encrypted, path included. - Keep working the way you do.
instibrain watchsyncs every save, and Claude Code on this machine reads the same plain files it read yesterday. - Connect the AI on your phone. Claude on the web or on your phone connects over MCP and reads the open area. It holds no key, so the finance pages are out of its reach.
- When two edits collide, nothing is lost. The server's copy lands beside
yours as a
.conflict.mdfile. Merge the two, then runinstibrain resolve.
An agent that reads a file sees what the file says: the model reads plaintext, secure-area pages included. What our server cannot read and what your AI can read are two different claims.
Survey, pull, adopt, push. Then wait for the next change.
One cycle on demand with instibrain sync, or continuously with
instibrain watch, debounced so a burst of saves is one cycle. This is a
real session, output included.
The server copy lands as pricing/floors.conflict.md
next to yours. The node stays blocked until you resolve it — no cycle will
push over an open conflict.
Ten commands. Most days you use one.
The rest exist for the moments that matter: admitting a second device, taking up an admission, and making sure one lost laptop is not the end of your brain.
One cycle: survey the folder, pull what changed, adopt what is new, push what you edited.
A cycle now, then on every change, debounced. The one you leave running.
Device id, root folder, cursor, and what it tracks: live nodes, tombstones, and adoptions still pending.
Push a file you merged after a conflict. The two vectors were joined when the conflict was raised; this bumps your counter and pushes.
Create a scope key this device owns. Every node in that scope is encrypted under it.
Admit another device to one scope, key included and wrapped to that device alone.
Take up an admission an admin already signed. The chain is verified from genesis first.
Seal this device's keys under a passphrase, into one file you store off this machine.
Rebuild an empty device from that file, so one lost laptop is not the end of the brain.
Print this device's public key. The one thing you paste elsewhere, and the only key that is safe to.
and most days you use one.
everything the sync client owns lives inside it.
open for reach, secure for the key.
the server stores wraps, never a key.
Admission is a signed entry appended to a membership chain, and this device verifies that chain from its genesis entry before it accepts a scope key from it. An operator who appends itself is caught by the verification, not by our good intentions. The threat model has the detail.
One command, and their agent arrives already knowing the company.
We ship to the agent, not to the machine. A new person runs one command: the sync client installs, the scope they were granted materializes as plain files, and their agent builds the rest of its own setup from pages in the brain, because the pages carry the commands.
Everything their role may read is on the disk in minutes, in the folder their editor and their agent already open.
Config, launchers and tool wiring are pages, so the agent reads them and builds its own environment. A page encodes intent, and survives the machine that differs.
Over the client's own MCP surface an agent closes a merge, pushes a file, or checks what changed, with nobody at the terminal.
Pull the scope and the agent loses the map: what exists, where it lives, how it is used. What was pulled before stays on that device, as in any encrypted store.
Plain markdown on your device, whichever area a page is in.
The sync client runs on our own machines first, exactly as described on this page. Read the protocol it speaks, or the security model that keeps us out of your secure area.