> ## Documentation Index
> Fetch the complete documentation index at: https://docs.merionlabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Governed cloud sync

> Scale analysis beyond one machine without turning local capture into automatic upload.

# Governed cloud sync

Merion is local-first, not local-only. The local evidence lake is the source of truth. A personal or organization cloud workspace is an explicit boundary for larger storage, compute, and background analysis: workflow discovery, capability-gap analysis, evaluation engineering, customer-specific improvement, and eventually approved post-training.

## The boundary

```text theme={"system"}
local source systems
  → local content-free evidence index
  → explicit cloud policy
  → read-only sync plan
  → approved immutable manifest
  → durable local outbox
  → authenticated tenant-scoped transport (future)
  → managed storage and analysis
  → derived results with provenance
```

Sign-in, computer setup, history import, and live capture never imply cloud upload.

## Start local-only

```bash theme={"system"}
merion cloud status
```

Until configured, status reports `local_only`, no allowed cloud tiers, and `automaticUpload: false`.

## Configure a metadata-only policy

```bash theme={"system"}
merion cloud configure \
  --workspace my-workspace \
  --owner you@example.com \
  --scope personal \
  --region us-west \
  --retention-days 30
```

The private-alpha command writes a mode-0600 policy file under `~/.merion`. It stores no password, access token, signed URL, or cloud credential. The policy initially permits only content-free metadata up to `internal` classification for workflow discovery and capability-gap analysis.

Organization scope additionally requires `--organization <id>`. A policy pins:

* tenant workspace and personal or organization scope;
* allowed analysis purposes;
* allowed content tiers and maximum classification;
* residency region and retention window;
* encryption in transit and at rest;
* accountable reviewer and review time;
* per-manifest approval for raw source.

## Plan before queueing

```bash theme={"system"}
merion cloud plan --since 24h
```

Planning reads a bounded time window and produces content-free object descriptors: stable source identity, digest, tier, classification, byte count, and redaction state. It does not include raw prompts, screenshots, audio, OCR text, harness history, or source bytes. Planning does not mutate state.

Queue only after inspecting the plan:

```bash theme={"system"}
merion cloud queue --since 24h --approve
```

The manifest is content-addressed and idempotent. The local SQLite outbox supports leases, retries, committed receipts, and conflict detection. Queueing still performs no network upload in the private alpha.

## Content tiers

| Tier                | Intended content                                              | Default                                       |
| ------------------- | ------------------------------------------------------------- | --------------------------------------------- |
| `metadata`          | Content-free references and digests                           | Allowed after explicit policy setup           |
| `reviewed_evidence` | Human-reviewed episode evidence                               | Denied until separately approved              |
| `derived_artifact`  | Evals, aggregates, reports, and analysis outputs              | Denied until separately approved              |
| `raw_source`        | Prompt bodies, files, media, transcripts, or source snapshots | Denied; always requires per-manifest approval |

Changing a tier is a policy decision, not an implementation shortcut.

## Production transport foundation

The SDK boundary supports resumable, content-addressed object upload: open an immutable manifest, discover missing digests, resume an item from a verified offset, stream bounded chunks, commit each item by digest and byte count, and commit the manifest to receive a receipt. Credentials and short-lived signed upload instructions live only inside the transport implementation.

The production service still needs authentication, tenant isolation, a control-plane database, an object store, deletion and retention workers, regional routing, audit logs, and billing. None of those are represented as complete today.

## Disable without destroying evidence

```bash theme={"system"}
merion cloud disable
```

This prevents new planning and queueing. It preserves the local lake and immutable outbox history. Remote deletion, retention expiry, and legal-hold behavior will require the production control plane and must return durable receipts.