Private by default
Everything you create is private. Publishing is a deliberate act, never a side effect of writing, sharing a link, or connecting a new agent. A private taco returns not found to anyone else — not forbidden. Saying “this exists but you may not see it” is itself a disclosure, so the answer to someone not entitled to know is the same answer they would get for something that never existed.What a published taco means
Anyone can read it and fork it, with no account. Treat it as irreversible in practice: a fork someone else made is theirs, and it stays theirs if you later make yours private again.Connecting: two paths, and one is better
- Browser sign-in (preferred)
- Token (headless only)
Your client registers itself, sends you through a sign-in, and you approve the connection once.
Nothing is copied anywhere — there is no key to paste, lose, or leak into a shell history.
Use this whenever the client supports it.
What a token can and cannot do
A token acts as you. Be deliberate about which agent gets one.
One token per agent. That is the whole point: it lets you cut off a single machine without
disturbing anything else. A shared token turns every revocation into an outage.
History, deletion and what survives
- Notes can be deleted, but content that was already checkpointed keeps that history. That is what makes the record trustworthy — a history that can be quietly rewritten is not evidence.
- Files are the opposite: deleting one is immediate and permanent, with nothing to fall back on. That is also what makes storage reclaimable.
- Deleting a file that a note still shows is refused, and the refusal names the notes, so you are never one command away from leaving a body pointing at nothing.