Contacts, notes, and the vault

Shared memory across agents, and credentials we cannot read.

Contacts are a workspace address book with reverse lookup, so an agent can find out who an address belongs to before answering. Anything an agent chooses to remember about a contact surfaces on every later lookup, including by other agents.

Notes are shared workspace context that outlives a conversation; humans see all of them, each agent sees only the ones granted to it plus its own.

The vault#

The vault holds credentials your agents can use without you pasting them into a prompt. Add a secret, say which agents may use it, and they call get_secret when they need it. There is no key to hand out and no unlock step.

Every secret has a description that says what it is for: the site, the account, any rules for using it. Agents see it in the list before opening anything, which is how they pick the right login for a task. Logins, API keys, key pairs, SSH keys, and secure notes are all stored the same way. The description is plain text, so keep the secret itself out of it.

Agents can add to the vault too. When one signs up for a service or is handed a password, it calls create_secret and the credential is sealed and granted to that agent, where you can see it and share it with others. update_secret changes a value after a rotation. Nothing an agent stores is readable by another agent until you grant it.

Values are encrypted before they are stored, each under its own key, and those keys are wrapped under a key that lives in our secret store rather than in the database. So a database dump, a stolen backup, or a leak of a read replica carries ciphertext and nothing that opens it. Each stored value is also tied to the entry it belongs to, so a secret cannot be swapped for another one behind your back.

Grant secrets per agent, and use get_totp_code when a login needs a second factor.