Quickstart

From folder to workspace, read-only.

This walk-through attaches a directory, builds a catalog, searches it, and verifies a snapshot. Nothing writes to your files. Every step is reversible by deleting derived state — the original tree is untouched.

Before you start

You need a built or installed intralock binary and a directory you are willing to index. No admin rights, no account, and no network connection are required for the steps below.

shcheck the binary

intralock version
intralock doctor --full

doctor reports schema version, disk reserve, catalog integrity, and any queued work. If it cannot open the catalog, stop here — do not proceed with an unverified install.

1 · Attach read-only

Register the directory in place. Intralock assigns a workspace ID and records the root identity; it does not create files in the tree until you explicitly adopt generated output.

cd ~/projects/example
intralock init --workspace . --read-only

# → registered wks_01JEXAMPLESTABLEID (read-only)
# → 0 files modified

Invariant 01. First contact is non-destructive. If the command would write anything, it must fail instead.

2 · Inspect what was found

Before indexing content, confirm the scope: root path, exclusion rules, symlink policy, and size limits.

intralock workspaces list
intralock workspace inspect wks_01JEXAMPLESTABLEID

# root:        ~/projects/example
# policy:      local_read_only
# symlinks:    not followed
# max_bytes:   52428800

3 · Build the catalog

Dry-run first. It reports how many objects would be read, which extractors would run, and which files are excluded.

intralock index run --workspace wks_01JEXAMPLESTABLEID --dry-run
intralock index run --workspace wks_01JEXAMPLESTABLEID

intralock index status --workspace wks_01JEXAMPLESTABLEID

Indexing is incremental. A file whose content hash has not changed is not re-extracted. Failures are recorded per object with a reason; they do not abort the run.

4 · Search locally

intralock search "vendor renewal" --workspace wks_01JEXAMPLESTABLEID --json

Results carry an object ID, a content version, freshness, and provenance. A hit is a pointer to a source, not a paraphrase. If the catalog is stale, the response says so.

5 · Open the workspace

Start the local daemon and browse the generated view. The HTTP server binds to loopback by default.

intralock server start --bind 127.0.0.1:8765
# open http://127.0.0.1:8765/

Every route has a meaningful title and breadcrumb. The graph view always offers an accessible table alternative. If the daemon stops, static pages and the underlying files remain readable.

6 · Snapshot and verify

A snapshot binds declared and observed state to a digest. Verification reports one of five states; it never silently “passes.”

intralock snapshot create --workspace wks_01JEXAMPLESTABLEID
intralock snapshot verify --workspace wks_01JEXAMPLESTABLEID

# verified · digest sha256:ca9cea3b…
# excluded: 4 objects (secrets/**, .env)

7 · Grant an agent something narrow

An agent is a principal like any other. Issue a scoped, expiring token; do not hand it the workspace root as a path.

intralock tokens issue --actor agt_research \
  --workspace wks_01JEXAMPLESTABLEID \
  --capability search.query,object.read --expires 24h

intralock mcp serve --transport stdio

The token value is shown once. The agent still needs a passing policy check on every call, and a document it reads cannot expand its scope.

Where to go next

CLI reference — every command, flag, and exit code.
REST API — routes, errors, idempotency, and preconditions.
Workspace format — manifest, identities, and generated regions.
Security model — the four-object approval chain.