STEP / 01
Attach
Register a directory read-only. Intralock observes the tree and assigns stable logical identities without touching a single byte.
sh
intralock init --workspace . --read-only
Intralock · Canonical specification v1.0.0
Your files.
A living workspace.
Intralock turns an existing directory into a navigable, searchable, verifiable workspace — without moving a byte. Its core is deterministic and useful with no model at all; intelligence is a replaceable, permissioned enhancement.
Proposed canonical design — not a claim of completed implementation.
workspace / research
indexed
research/
├─docs/
├─datasets/
├─applications/
├─.intralock/
├─AGENTS.md
└─intralock.lock.html
snapshot 01JEX…
fresh 12s
schema v1
- Runtime
- Local-first, loopback by default
- Catalog
- SQLite WAL + FTS5
- Interfaces
- REST · MCP · CLI · GraphQL · WebMCP
- Governance
- Ten invariants, denial-tested
01 — Premise
A folder, promoted to a workspace.
No import. No migration. No proprietary vault. Intralock reads what is already on disk and adds a governed layer around it — so the ordinary filesystem becomes an operational environment instead of a dumping ground.
STEP / 02
Index
Build a local catalog: full-text search, typed relationships, extraction provenance, and freshness. Derived state is always rebuildable from source.
sh
intralock index run --workspace wks_… --dry-run
STEP / 03
Inhabit
Open the generated landing page, search across documents, traverse the graph, or grant a scoped agent exactly the capabilities you approve.
sh
intralock server start --bind 127.0.0.1:8765
02 — Invariants
Constraints that survive features.
Ten immutable product invariants govern every architecture decision. Each one has a negative test; an exception needs a written decision record and an explicit sunset. These are the six that shape the ordinary experience.
01
Non-destructive first contact
Attaching a directory cannot modify its files until a distinct, explicit onboarding step authorizes change.
02
Local operation
Browse, search, traverse, back up, and evaluate policy with no network and no hosted account.
03
Separate derived state
Indexes, embeddings, thumbnails, and generated pages can be deleted and rebuilt from source.
04
No silent elevation
No role, model, plugin, document, or tool description can grant itself authority. Policy and consent decide.
05
Provenance-aware intelligence
Observed, inferred, proposed, approved, and verified stay distinguishable. Confidence is not fact.
06
Interface equivalence
The same governed operation is invoked across UI, REST, MCP, GraphQL, and CLI. Adapters never bypass policy.
03 — Interfaces
One domain, many surfaces.
The daemon owns catalog transactions and policy. Every interface is an outer adapter over the same typed operations — so a capability granted to a browser is the same capability the CLI and an agent speak.
HTTP · JSON
REST
Versioned resource API for workspaces, objects, search, context bundles, tasks, and backups.
GET /api/v1/search ?query=architecture &workspace_id=wks_…
stdio · HTTP
MCP
Small, typed tools for agents: discover, read, search, request context, propose work.
tools: workspace.list objects.read search.query context.bundle
shell
CLI
An independently useful product interface, not a debug shim. JSON output for pipelines.
$ intralock search "graph" --workspace wks_… --json
typed graph
GraphQL
Read-only exploration of objects, versions, edges, evidence, and capabilities with cost limits.
query { workspace(id: …) {
objects(first: 20) { … } } }
browser
WebMCP
Progressive browser tool exposure over authenticated actions — never an implicit privilege grant.
navigator.modelContext .registerTool(…)
async
Tasks & events
Long-running work returns a durable task ID. SSE and webhooks carry bounded, authorized events.
GET /api/v1/tasks/{id}
GET /api/v1/events?since=…
04 — Architecture
Files own their content. Everything else is a projection.
An intralockd process owns catalog transactions and per-workspace locks. A watcher and reconciler observe the tree; extractors produce bounded, provenance-carrying records; SQLite holds the catalog, graph, policy, tasks, and audit. The HTTP server renders HTML with HTMX; MCP, REST, GraphQL, and the CLI reach the same domain services.
The catalog is an asynchronously reconciled projection of the filesystem, so freshness is explicit: observed_at, indexed_at, content_hash, and watcher_sequence are first-class. A stale answer is labeled stale, never painted as current.
Filesystemoriginal files, ordinary tools, no vault
↓ watcher · reconciler · fingerprints
Extractbounded parsers
CatalogSQLite · FTS5
Graphtyped edges + evidence
↓ domain operations
policy
tasks
audit
events
↓ adapters
HTML / HTMX
REST
MCP
CLI
05 — Trust
Deny by default. Prove every mutation.
Local does not mean unauthenticated. Loopback is not a security boundary: the server checks origin, session, capability, scope, expected version, and idempotency before any write. Documents are data, not instructions. A page rendered from a workspace cannot call a privileged action because it was loaded from that workspace.
Mutation path
- Preview
- Three-way diff with base hash and owned regions.
- Approval
- Scoped, expiring approval tied to a specific work order.
- Apply
- Atomic replace, fsync, version precondition, receipt.
- Verify
- Post-write digest and ledger entry; rollback available.
Snapshot truth
intralock.lock.html is a versioned, digest-bound state snapshot — not a vault and not a permission grant. It renders without JavaScript and without the daemon.
06 — Who it's for
Three buyers. One honest status quo.
The competitor is not another app. It is the manual work of remembering where things are — the folder tree, the README, the bookmark, the search you have to run again.
| Job | Without Intralock | With Intralock |
|---|---|---|
| Recover context | grep, memory, a stale README | Search with source path, version and provenance |
| See what changed | File timestamps and guesswork | Change log, receipts, explicit freshness fields |
| Let an agent act | A shared login or full-disk access | Scoped, expiring tokens; preview and approval |
| Prove a state | A screenshot and a date in the filename | A digest-bound snapshot with a verification result |
Operator
Stop rebuilding context every Monday.
One landing page per folder: what is here, what changed, what needs attention.
Builder
Every folder can be a homepage.
Generated views over code, data and docs — with a conflict path instead of an overwrite.
Researcher
A citation that points at the file.
Every hit carries offsets, extraction method, version, and whether the interpretation was generated.
The specification is the product contract.
Seventy-nine sections: invariants, schema, authority, interfaces, security, delivery phases, and a capability acceptance catalog. Version 1.0.0 is a design baseline, published for conformance testing.