pdurlej/platform

Fork 0

Phase 08+ scope: Włóczykij as second-tier curated vault (physical-separation safety architecture) #178

New issue

Closed

opened 2026-05-11 07:43:59 +02:00 by claude · 3 comments

claude commented

2026-05-11 07:43:59 +02:00

Collaborator

Context

Per operator voice-note 2026-05-11 07:26:

"Włóczykij jest tutaj /Users/pd/Obsidian/Włóczykij. Docelowy flow jest taki, że będzie jeden szeroki surface, który jest Iskra i Piotr. I tam mamy miejsce na współpracy agentów ze mną. I pewnie będzie taki bardziej Włóczykij, który pewnie będzie kopiował dużo rzeczy z Iskra-Private, ale te agentyczne rzeczy nasze zostawi tam. Czyli to będzie tylko sync w jedną stronę, a kopia go zostaje."

Confirmed path: /Users/pd/Obsidian/Włóczykij/ (already exists as empty directory; aspirational, not yet active).

Architecture (operator's preferred model — supersedes my earlier read-time-filter proposal)

Safety by physical separation, not read-time filtering.

Vault	Path	Agent access	Content
`Iskra-i-Piotr`	`/Users/pd/Obsidian/Iskra-i-Piotr/`	YES (per sensitivity tier per ADR-0010)	wide surface for agent-operator collaboration; current operator working set
`Włóczykij`	`/Users/pd/Obsidian/Włóczykij/`	NO — physical denylist	curated long-term vault; mostly copies from Iskra-i-Piotr without agentic stuff; eventually overlay private filtering

Operator: "Jeśli czegoś nie chce widzieć u agentów no to to jest Włóczykij a jeśli coś akceptuje, że może być u agentów no to jest Iskra-i-Piotr. Wydaje mi się, że taki set jest bezpieczny z definicji."

Operator's reasoning: agents physically cannot leak content from a path they don't read. No filter to misconfigure.

One-way sync model

Iskra-i-Piotr/                          Włóczykij/
   │                                       ▲
   │  operator + agents work here          │
   │                                       │
   │  ── one-way sync (filtered) ──────────┘
   │     (agentic working notes stay; curated content copies)
   │
   │  Włóczykij is read-only from operator's perspective for
   │  active work; operator may edit Włóczykij directly for
   │  curated rewrites but those don't sync back.

Scope (this issue produces 2 follow-up tickets)

Ticket A — Physical-separation enforcement in `ops/local-admin/capabilities.yaml`

Amend ADR-0010 capabilities.yaml with top-level vault_roots:

vault_roots:
  accessible:
    - "/Users/pd/Obsidian/Iskra-i-Piotr/"
  denylist:
    - "/Users/pd/Obsidian/Włóczykij/"
    - "/Users/pd/Obsidian/100 Projects/"      # operator-confirmed; not in scope
    - "/Users/pd/Obsidian/200 Areas/"          # operator-confirmed; not in scope
    - "/Users/pd/Obsidian/001 System/"         # operator-confirmed; not in scope
    - "/Users/pd/Obsidian/010 Inbox/"          # operator-confirmed; not in scope
    - "/Users/pd/Obsidian/01_Inbox/"           # operator-confirmed; not in scope
    - "/Users/pd/Obsidian/Włóczykij/"
    # (operator confirms full list on review)

Wrappers (per ADR-0010) MUST refuse any read with path matching any denylist entry. Default-deny, allowlist-explicit.

Ticket B — One-way sync script `scripts/vault-sync-iskra-to-wloczykij.sh`

Operator's spec:

Source: /Users/pd/Obsidian/Iskra-i-Piotr/
Target: /Users/pd/Obsidian/Włóczykij/
Direction: source → target only (no reverse)
Filter: agentic-working-notes EXCLUDED (operator defines which folders/tags/frontmatter qualify; suggest agent_workspace: true frontmatter as marker)
Schedule: ad-hoc operator-triggered initially; can become weekly via launchd later
Conflict policy: if target file edited directly by operator (manual rewrite), source-side change does NOT overwrite — source-newer-but-target-conflicts logs warning, requires operator review

Out of scope (this issue)

Replacing pseudo-anonymization (separate issue; defense-in-depth on top of physical separation)
Future "private" overlay on Włóczykij (operator-mentioned: "pewnie nałożę na ten volt jakąś tam prywatną") — separate Phase 08+ issue
Multi-vault support beyond Iskra-i-Piotr + Włóczykij (Phase 09+)

Phase

Phase 08+ (after Phase 07 implementation of local-admin tier + vault janitor). Ticket A could land sooner as scope-amendment to ADR-0010; Ticket B is post-implementation.

Acceptance criteria

ops/local-admin/capabilities.yaml amended with vault_roots.accessible + vault_roots.denylist
Wrappers enforce vault_roots boundary at runtime
scripts/vault-sync-iskra-to-wloczykij.sh exists with one-way sync semantics
Test: agent attempting to read /Users/pd/Obsidian/Włóczykij/anything is denied
Operator runs sync once; verifies filtered copies in Włóczykij

Refs

Operator voice-note 2026-05-11 07:26 (introduced architecture)
ADR-0010 (local-admin tier) — this issue amends its capabilities.yaml
PR #171 comment (Włóczykij architecture inversion)
Operator's KOS2 (github.com/pdurlej/KOS2) — vault janitor prior art

Coordination

Lane: Phase 08+ design (advisor + executor)
Owner: TBD (when operator decides Phase 08 priority)
Operator: confirms denylist contents; decides sync schedule; reviews first sync output

Role: advisor (claude)

## Context Per operator voice-note 2026-05-11 07:26: > *"Włóczykij jest tutaj /Users/pd/Obsidian/Włóczykij. Docelowy flow jest taki, że będzie jeden szeroki surface, który jest Iskra i Piotr. I tam mamy miejsce na współpracy agentów ze mną. I pewnie będzie taki bardziej Włóczykij, który pewnie będzie kopiował dużo rzeczy z Iskra-Private, ale te agentyczne rzeczy nasze zostawi tam. Czyli to będzie tylko sync w jedną stronę, a kopia go zostaje."* Confirmed path: `/Users/pd/Obsidian/Włóczykij/` (already exists as empty directory; aspirational, not yet active). ## Architecture (operator's preferred model — supersedes my earlier read-time-filter proposal) **Safety by physical separation, not read-time filtering.** | Vault | Path | Agent access | Content | |-------|------|--------------|---------| | `Iskra-i-Piotr` | `/Users/pd/Obsidian/Iskra-i-Piotr/` | YES (per sensitivity tier per ADR-0010) | wide surface for agent-operator collaboration; current operator working set | | `Włóczykij` | `/Users/pd/Obsidian/Włóczykij/` | **NO — physical denylist** | curated long-term vault; mostly copies from Iskra-i-Piotr **without** agentic stuff; eventually overlay private filtering | Operator: *"Jeśli czegoś nie chce widzieć u agentów no to to jest Włóczykij a jeśli coś akceptuje, że może być u agentów no to jest Iskra-i-Piotr. Wydaje mi się, że taki set jest bezpieczny z definicji."* Operator's reasoning: agents physically cannot leak content from a path they don't read. No filter to misconfigure. ## One-way sync model ``` Iskra-i-Piotr/ Włóczykij/ │ ▲ │ operator + agents work here │ │ │ │ ── one-way sync (filtered) ──────────┘ │ (agentic working notes stay; curated content copies) │ │ Włóczykij is read-only from operator's perspective for │ active work; operator may edit Włóczykij directly for │ curated rewrites but those don't sync back. ``` ## Scope (this issue produces 2 follow-up tickets) ### Ticket A — Physical-separation enforcement in `ops/local-admin/capabilities.yaml` Amend ADR-0010 `capabilities.yaml` with top-level `vault_roots`: ```yaml vault_roots: accessible: - "/Users/pd/Obsidian/Iskra-i-Piotr/" denylist: - "/Users/pd/Obsidian/Włóczykij/" - "/Users/pd/Obsidian/100 Projects/" # operator-confirmed; not in scope - "/Users/pd/Obsidian/200 Areas/" # operator-confirmed; not in scope - "/Users/pd/Obsidian/001 System/" # operator-confirmed; not in scope - "/Users/pd/Obsidian/010 Inbox/" # operator-confirmed; not in scope - "/Users/pd/Obsidian/01_Inbox/" # operator-confirmed; not in scope - "/Users/pd/Obsidian/Włóczykij/" # (operator confirms full list on review) ``` Wrappers (per ADR-0010) MUST refuse any read with path matching any `denylist` entry. Default-deny, allowlist-explicit. ### Ticket B — One-way sync script `scripts/vault-sync-iskra-to-wloczykij.sh` Operator's spec: - **Source**: `/Users/pd/Obsidian/Iskra-i-Piotr/` - **Target**: `/Users/pd/Obsidian/Włóczykij/` - **Direction**: source → target only (no reverse) - **Filter**: agentic-working-notes EXCLUDED (operator defines which folders/tags/frontmatter qualify; suggest `agent_workspace: true` frontmatter as marker) - **Schedule**: ad-hoc operator-triggered initially; can become weekly via launchd later - **Conflict policy**: if target file edited directly by operator (manual rewrite), source-side change does NOT overwrite — source-newer-but-target-conflicts logs warning, requires operator review ## Out of scope (this issue) - Replacing pseudo-anonymization (separate issue; defense-in-depth on top of physical separation) - Future "private" overlay on Włóczykij (operator-mentioned: "pewnie nałożę na ten volt jakąś tam prywatną") — separate Phase 08+ issue - Multi-vault support beyond Iskra-i-Piotr + Włóczykij (Phase 09+) ## Phase Phase 08+ (after Phase 07 implementation of local-admin tier + vault janitor). Ticket A could land sooner as scope-amendment to ADR-0010; Ticket B is post-implementation. ## Acceptance criteria - [ ] `ops/local-admin/capabilities.yaml` amended with `vault_roots.accessible` + `vault_roots.denylist` - [ ] Wrappers enforce `vault_roots` boundary at runtime - [ ] `scripts/vault-sync-iskra-to-wloczykij.sh` exists with one-way sync semantics - [ ] Test: agent attempting to read `/Users/pd/Obsidian/Włóczykij/anything` is denied - [ ] Operator runs sync once; verifies filtered copies in Włóczykij ## Refs - Operator voice-note 2026-05-11 07:26 (introduced architecture) - ADR-0010 (local-admin tier) — this issue amends its capabilities.yaml - PR #171 comment (Włóczykij architecture inversion) - Operator's KOS2 (github.com/pdurlej/KOS2) — vault janitor prior art ## Coordination - Lane: Phase 08+ design (advisor + executor) - Owner: TBD (when operator decides Phase 08 priority) - Operator: confirms denylist contents; decides sync schedule; reviews first sync output **Role:** advisor (claude)

claude referenced this issue

2026-05-11 07:47:58 +02:00

Phase 08+ scope: IronKey Keypad 200C as Tier 2 hardware-encrypted storage for Włóczykij vault #180

claude commented

2026-05-11 07:47:58 +02:00

Author

Collaborator

Role: advisor (claude)
Intent: cross-link
Needs owner: no

Operator voice-note 2026-05-11 07:45 + image IMG_9781.HEIC introduced a hardware-encryption tier for Włóczykij: Kingston IronKey Keypad 200C 16GB as canonical Tier 2 storage (purchased Black Friday 2025, sitting unused awaiting setup).

This supersedes the storage location assumption in this issue. Canonical Włóczykij is at /Volumes/IRONKEY/Włóczykij/ (only when physically mounted), not /Users/pd/Obsidian/Włóczykij/ (which becomes optional M1-disk mirror).

Full architecture + 6 open operator questions in issue #180.

Recommend: keep this issue (#178) as Phase 08+ scope ticket for vault_roots + one-way sync semantics. Issue #180 adds Phase 08+ scope ticket for hardware-tier storage. Both are needed; both apply to Włóczykij; #180 narrows storage location decision.

**Role:** advisor (claude) **Intent:** cross-link **Needs owner:** no Operator voice-note 2026-05-11 07:45 + image IMG_9781.HEIC introduced a hardware-encryption tier for Włóczykij: **Kingston IronKey Keypad 200C 16GB** as canonical Tier 2 storage (purchased Black Friday 2025, sitting unused awaiting setup). This **supersedes the storage location** assumption in this issue. Canonical Włóczykij is at `/Volumes/IRONKEY/Włóczykij/` (only when physically mounted), not `/Users/pd/Obsidian/Włóczykij/` (which becomes optional M1-disk mirror). Full architecture + 6 open operator questions in issue #180. Recommend: keep this issue (#178) as **Phase 08+ scope ticket for vault_roots + one-way sync semantics**. Issue #180 adds **Phase 08+ scope ticket for hardware-tier storage**. Both are needed; both apply to Włóczykij; #180 narrows storage location decision.

claude referenced this issue from a commit

2026-05-17 18:15:07 +02:00

docs(specs): vault-to-infisical-migration-v0 prebuild (#64)

claude referenced this issue

2026-05-17 18:15:19 +02:00

docs(specs): vault-to-infisical-migration-v0 prebuild (#64) #336

claude referenced this issue from a commit

2026-05-17 18:19:03 +02:00

docs(specs): vault-tier-3-architecture-v0 prebuild (#178 + #180)

claude referenced this issue

2026-05-17 18:19:18 +02:00

docs(specs): vault-tier-3-architecture-v0 prebuild (#178 + #180) #337

claude referenced this issue from a commit

2026-05-17 18:22:20 +02:00

docs(specs): pseudo-anonymization-readlayer-v0 prebuild (#177)

claude referenced this issue

2026-05-17 18:22:40 +02:00

docs(specs): pseudo-anonymization-readlayer-v0 prebuild (#177) #338

claude referenced this issue

2026-05-17 21:01:19 +02:00

WIP: docs(specs): prebuild joint Spec Kit for #132 + #181 YubiKey integration #344

claude referenced this issue from a commit

2026-05-17 21:01:21 +02:00

docs(specs): prebuild joint Spec Kit for #132 + #181 YubiKey integration (WIP)

claude referenced this issue from a commit

2026-05-17 21:28:58 +02:00

docs(specs): secrets-pipeline-foundation-v0 prebuild (#237)

codex added this to the 02 - DR and restore confidence milestone

2026-05-19 08:36:20 +02:00

pdurlej referenced this issue from a commit

2026-05-23 10:30:57 +02:00

Merge pull request 'docs(specs): vault-tier-3-architecture-v0 prebuild (#178 + #180)' (#337) from claude/vault-tier-3-architecture-v0-prebuild into main

codex commented

2026-05-29 16:21:43 +02:00

Collaborator

M10 disposition: moved to 10 - Improvements.

What this is: Włóczykij second-tier curated vault.

Why parked here: Parked in M10 because it is product/safety architecture for future curated storage, not part of the immediate DR/secrets closeout path.

This preserves the idea without letting it block M02/M03/M04 closeout. Before reactivation, split it into a narrow issue or PR with concrete acceptance criteria.

M10 disposition: moved to `10 - Improvements`. What this is: Włóczykij second-tier curated vault. Why parked here: Parked in M10 because it is product/safety architecture for future curated storage, not part of the immediate DR/secrets closeout path. This preserves the idea without letting it block M02/M03/M04 closeout. Before reactivation, split it into a narrow issue or PR with concrete acceptance criteria.

codex modified the milestone from 02 - DR and restore confidence to 10 - Improvements

2026-05-29 16:21:43 +02:00

codex commented

2026-05-29 16:36:32 +02:00

Collaborator

Closing as superseded/completed by the current Wloczykij implementation and ADR-0023.

Evidence checked read-only:

/Users/pd/Obsidian/Włóczykij exists locally and contains the vault structure.
rs2000:/srv/obsidian/Włóczykij exists.
rs2000:/srv/obsidian/Włóczykij-runtime exists for the runtime mirror path.
modules/obsidian-headless-wloczykij/module.yaml is active and declares the rs2000 gold-vault boundary.
ADR-0023 defines Wloczykij as the gold vault and explicitly forbids raw OpenClaw mounting.

Remaining related improvement stays in #180 / M10: IronKey / physical tier work.

Closing as superseded/completed by the current Wloczykij implementation and ADR-0023. Evidence checked read-only: - `/Users/pd/Obsidian/Włóczykij` exists locally and contains the vault structure. - `rs2000:/srv/obsidian/Włóczykij` exists. - `rs2000:/srv/obsidian/Włóczykij-runtime` exists for the runtime mirror path. - `modules/obsidian-headless-wloczykij/module.yaml` is active and declares the rs2000 gold-vault boundary. - ADR-0023 defines Wloczykij as the gold vault and explicitly forbids raw OpenClaw mounting. Remaining related improvement stays in #180 / M10: IronKey / physical tier work.

codex closed this issue

2026-05-29 16:36:32 +02:00