The engine — agents, commands, rules, scripts, the dashboard — is one codebase. The data — configurations, voice rules, drafts, notes, logs — lives in a separate vault directory, resolved through an environment variable and versioned on its own.
Nothing about a client is ever committed to the engine repository. Not a config, not a draft, not a name in a comment.
This buys three things:
- The engine is portable. Handing someone an install means handing them the code and letting them point it at their own vault. There is nothing to strip out first.
- Data is auditable on its own timeline. The vault has its own history, separate from code changes, so “when did the voice rules change” is a question with an answer.
- Redaction has a boundary to enforce. The exporter that produces this site’s data knows exactly which side of the line it is on, and its client-name rule can be absolute rather than case-by-case. Three commit subjects in the ledger on the proof page are visibly redacted on that rule.
The unglamorous rule underneath: a system that keeps other people’s material has to be able to state, structurally rather than aspirationally, where that material is.