Read by default. Propose before writing. Preserve evidence and provenance.
Open-source previewTrust & privacy
Own the context your AI uses.
Holoself keeps canonical context as local Markdown. It has no hosted account, does not require external AI or vector services, and does not silently update canonical self.
Safety guarantees
Designed for reviewable local control.
No required network calls
Core CLI behavior runs locally. No hosted account, publication, or external action is required.
No silent canonical writes
Projects receive read access. Accepted reusable knowledge goes through proposal, displayed diff, explicit confirmation, and validation.
No hidden source of truth
Markdown remains canonical. Indexes and packets are generated, inspectable, and safe to rebuild.
Privacy-aware resolution
Visibility, public-safety, sensitivity, excluded lenses, and supported field restrictions filter context.
Secret filtering
Credential-like filenames and common secret patterns are excluded from context and index output. Detection is defense-in-depth, not a vault.
Provenance retained
Context results identify sources. Approved claims record project, source file, evidence, confidence, visibility, and approval.
Threat boundaries
What Holoself does—and does not—protect.
| Risk | Control | Your responsibility |
|---|---|---|
| Accidental canonical change | Read-only links, proposal states, confirmation, diff | Review evidence and target before approval |
| Over-sharing across lenses | Visibility and sensitivity filtering | Classify content accurately; test public workflows |
| Secrets entering index | Filename and content pattern exclusion | Never store credentials in context; rotate exposed secrets |
| Private files committed publicly | Private-by-default guidance and local paths | Configure Git ignores and review staged files |
| Compromised local AI tool | Bounded context and project access | Trust tools granted filesystem access; Holoself is not a sandbox |
Known limitations
Trust requires honest boundaries.
- Holoself cannot prevent an authorized local tool from reading files outside its intended workflow.
- Secret-pattern detection cannot identify every credential or sensitive passage.
- Visibility metadata is user-authored policy; incorrect classification can produce incorrect access.
- Semantic duplicate and contradiction analysis is heuristic, not proof.
- There is no hosted sync, account recovery, encryption service, or remote access control.
- The published npm package is a distribution channel, not a hosted Holoself service; context and operation remain local.
- Optional sync or private Git storage inherits the security model of that service.
Verifiable proof
Inspect claims against code and evidence.
Privacy policy
Data boundaries, package contents, and local handling.
Open PRIVACY.mdSchemas
Machine-readable contracts for links, proposals, and context output.
Browse schemasTests
Behavioral evidence for links, lenses, privacy, proposals, indexing, validation, and safety.
Browse tests