What it is. What it refuses to be.

No. The reference deployment is a single local daemon bound to loopback. Browsing, search, graph traversal, backup, and policy evaluation work with networking disabled and with no hosted account. Remote access is a separate, explicitly configured mode — never the only path to local data.

Not on attach, and not on index. The catalog and caches live outside the workspace in a private application-data directory. Generated artifacts inside the workspace — a homepage, a lock snapshot — are opt-in and written only through the approval path. If a reserved filename already exists, onboarding shows a diff instead of overwriting.

It is rebuilt from the source files and accepted annotations. That is the point of Invariant 04: derived state is disposable. Your originals, their hashes, and your explicit decisions are what matter.

No. Core behavior — navigation, full-text search, relationships, snapshots, policy, backup — is deterministic. Models are an optional, replaceable enhancement behind a permissioned adapter, with a ledger recording actor, operation, input hashes, output digest, and policy result. A no-model mode makes zero inference calls and can prove it.

Only through the same chain a human uses: proposal, immutable preview with exact versions, a named approval bound to that preview hash, then an execution that rechecks scope and records a receipt. A token is scoped to actor, workspace, capabilities, and expiry; revoking it denies access immediately. A document an agent reads cannot expand its own authority.

It is treated as data with a source label. Content never triggers execution, never becomes a shell command, and cannot request credentials or broader scope. Cross-file injection tests are part of the acceptance suite, not a marketing claim.

By default, protection is your operating system's full-disk encryption and file permissions. Application-level encryption is optional and requires a real key-management and recovery model. Calling a plain database “encrypted” because the app uses TLS would be misleading, and Intralock does not claim it.

The reference implementation is Go with a single binary and SQLite. Path normalization, case-insensitive volumes, Unicode normalization, macOS aliases, and Windows reserved names are explicitly tested. Optional desktop wrappers are shells around the same daemon — not independent storage engines.

Those products ask you to import content into their model. Intralock starts from your existing tree, keeps it authoritative, and adds a governed projection: stable IDs, search, typed relationships, provenance, policy, and verifiable snapshots. Your files remain usable by ordinary tools when Intralock is not running.

Version 1.0.0 is a proposed canonical specification, published as a design and conformance baseline. It is not a claim that a conforming implementation has shipped. Anything on this site describes required behavior and the evidence a release must produce.