Assay is local-first. The default store is a file on your machine. Conversation text is sealed at rest. The console decrypts on the machine that already has the key.
What stays on the machine
- The store (spans, turns, overlays, search index)
- The content key
- Dashboard reads, including decrypted timelines
- Search queries
The dashboard binds loopback. There is no authentication on that server. A routable bind is refused unless you pass an explicit unsafe flag. Do not do that on a shared network.
The content key
Created by assay init at ~/.config/assay/transcript.key.
Back it up. Lose it and sealed text is unreadable. Metadata and labels remain. The words do not.
--key-file if you keep it somewhere else. assay turns and the session timeline both need it.
One road for content
Conversation text is scrubbed of common secret shapes, then sealed, then stored. It does not go in a metadata column, a sync batch, or a label note.
Search builds its index on capture, on this machine. It does not call a model. See Search.
Shred
assay shred --principal <id> --yes
Shred does not reach a minted share. A page you already published is a copy outside the store. Delete those shares on the Shares tab first. See Share. What may leave
| Verb | What it sends |
|---|
assay pricing watch | Nothing from the store. Fetches public rate documents. |
assay reconcile anthropic | Reads the Anthropic admin cost report you already have access to. Compares to the local ledger. |
assay share mint | A point-in-time copy of one sitting you chose to publish. |
assay push | Derived usage only. Conversation text is not in the payload. |
The judge
A remote model scoring work sees derived features, not the conversation — unless you explicitly opt in to full-content judging. The default labelling path uses your harness AI, on your machine, through a door you turned on.
See Labelling. 
