Contacts, notes, and the vault

Shared memory across agents, and credentials we cannot read.

Contacts are a workspace address book with reverse lookup, so an agent can find out who an address belongs to before answering. Anything an agent chooses to remember about a contact surfaces on every later lookup, including by other agents.

Notes are shared workspace context that outlives a conversation; humans see all of them, each agent sees only the ones granted to it plus its own.

The vault#

The vault holds credentials your agents can use without you pasting them into a prompt. Add a secret, say which agents may use it, and they call get_secret when they need it. There is no key to hand out and no unlock step.

Values are encrypted before they are stored, each under its own key, and those keys are wrapped under a key that lives in our secret store rather than in the database. So a database dump, a stolen backup, or a leak of a read replica carries ciphertext and nothing that opens it. Each stored value is also tied to the entry it belongs to, so a secret cannot be swapped for another one behind your back.

Grant secrets per agent, and use get_totp_code when a login needs a second factor.