Governed cloud sync
Merion is local-first, not local-only. The local evidence lake is the source of truth. A personal or organization cloud workspace is an explicit boundary for larger storage, compute, and background analysis: workflow discovery, capability-gap analysis, evaluation engineering, customer-specific improvement, and eventually approved post-training.
The boundary
Sign-in, computer setup, history import, and live capture never imply cloud upload.
Start local-only
Until configured, status reports local_only, no allowed cloud tiers, and automaticUpload: false.
The private-alpha command writes a mode-0600 policy file under ~/.merion. It stores no password, access token, signed URL, or cloud credential. The policy initially permits only content-free metadata up to internal classification for workflow discovery and capability-gap analysis.
Organization scope additionally requires --organization <id>. A policy pins:
- tenant workspace and personal or organization scope;
- allowed analysis purposes;
- allowed content tiers and maximum classification;
- residency region and retention window;
- encryption in transit and at rest;
- accountable reviewer and review time;
- per-manifest approval for raw source.
Plan before queueing
Planning reads a bounded time window and produces content-free object descriptors: stable source identity, digest, tier, classification, byte count, and redaction state. It does not include raw prompts, screenshots, audio, OCR text, harness history, or source bytes. Planning does not mutate state.
Queue only after inspecting the plan:
The manifest is content-addressed and idempotent. The local SQLite outbox supports leases, retries, committed receipts, and conflict detection. Queueing still performs no network upload in the private alpha.
Content tiers
Changing a tier is a policy decision, not an implementation shortcut.
Production transport foundation
The SDK boundary supports resumable, content-addressed object upload: open an immutable manifest, discover missing digests, resume an item from a verified offset, stream bounded chunks, commit each item by digest and byte count, and commit the manifest to receive a receipt. Credentials and short-lived signed upload instructions live only inside the transport implementation.
The production service still needs authentication, tenant isolation, a control-plane database, an object store, deletion and retention workers, regional routing, audit logs, and billing. None of those are represented as complete today.
Disable without destroying evidence
This prevents new planning and queueing. It preserves the local lake and immutable outbox history. Remote deletion, retention expiry, and legal-hold behavior will require the production control plane and must return durable receipts.Last modified on August 25, 2026
