docs: reframe bento/vault around the AI broker - #155
Merged
Merged
Conversation
nyblnet
changed the title
Supersedes the 2026-07-25 vault entry. Two files: a DECISIONS.md entry and a rewrite of docs/vault-design.md. The reframe came from subtraction. Of the five promises in the old entry, four were met or taken while it sat unbuilt — mobile reach by tray plus any existing File Provider, sharing by the collab relay, per-device version history by autosave.ts, and plain file sync was never ours. Search alone survived, and it is measured rather than assumed. Control test in an indexed folder: a plain HTML file with a phrase in <body> is found by Spotlight; the same phrase inside a <script> is not; a real deck is not found, though grep finds it instantly. Bento libraries are invisible to OS search. Before any indexer is built, the cheap avenue gets tested: text in <noscript> IS indexed, and every save already writes a page-one render there. What makes vault necessary is the AI broker. A travelling document can never carry a model credential, and under tray localStorage is per-DOCUMENT — the origin is SHA256(path) truncated, verified at EditorViewController.swift:55-58. The only place a credential can live once and serve a library is a server the user runs. Two claims that reached the draft were wrong and are corrected in the doc rather than repeated. Ollama does not blanket-refuse file:// — its default allow-list includes file://* (envconfig/config.go:100-106); the real issue is that browsers send Origin: null and gin-contrib/cors matches by exact string or regex (config.go:128-140), so null won't match file://*. That one is marked reasoned, not measured. And LiteLLM's virtual keys, budgets and spend attribution are stock behaviour, not an add-on. Cut as deferred architecture: backup and version history (autosave.ts already covers it, and the audience runs restic and git), SSO beyond key distribution and forward revocation, and — with the org profile as destination rather than first build — NAT traversal, hole-punching, the dead-drop and the portable relay twin, all of which existed to serve a laptop asleep behind a home NAT. New invariant: AI is additive, never load-bearing. Every app stays fully functional with no vault and no model, or PLATFORM.md §1 is gone.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes the 2026-07-25 vault entry. Two files: a
DECISIONS.mdentry and a rewrite ofdocs/vault-design.md.Why the reframe
Subtraction. Of the five promises in the old entry, four were met or taken while it sat unbuilt — mobile reach by tray plus any existing File Provider, sharing by the collab relay, per-device version history by
autosave.ts, and plain file sync was never ours.What makes vault necessary is the AI broker. A travelling document can never carry a model credential, and under tray
localStorageis per-document — the origin isSHA256(path)truncated (EditorViewController.swift:55-58). The only place a credential can live once and serve a library is a server the user runs. The doc is explicit that the argument rests on credentials alone, and that pointing an editor at a local model is commodity work.Search: measured end to end, and it came out smaller
The original draft claimed Bento documents are invisible to OS search, and flagged a
<noscript>avenue as untested. Both are now resolved by measurement rather than reasoning — and the answer narrows the pillar.The preview left
<noscript>for ordinary markup (see the thumbnails entry of 2026-07-27, landed in #161). Ordinary markup indexes. Measured withmdimport -d2 -ton a deck saved from the current shell:kMDItemTextContent<noscript>, isolatedSo a deck is findable by its title slide today, for free, with no vault. What remains unserved is full-text search — the deck that mentions Q3 churn on slide fourteen. That is narrower than the original claim and it is the need an index actually serves. Sequencing step 2 is marked done accordingly: the indexer's job is slides 2..n, not the library.
Corrections to the draft's own research
file://. Its default allow-list includesfile://*(envconfig/config.go:100-106). The real issue is that browsers sendOrigin: nullandgin-contrib/corsmatches by exact string or regex (config.go:128-140), sonullwon't match. Marked reasoned, not measured — there was no running Ollama to test against.What I cut
The rewrite drops the old doc's availability/dead-drop sections, client list, data-model sketch and threat model, because they describe an architecture now deferred. The relay material is unaffected and still lives in
relay-design.md. The dropped threat model was written for the personal-server shape and will need rewriting for whatever ships — git history holds it.Rebased onto current
main; theDECISIONS.mdconflict was two same-day entries both claiming the top of an append-only log, resolved by keeping both.Docs only. No code.