Open the Files app in your shell and the first thing worth knowing is what is not happening: nothing you see there has been handed to a cloud. The files sit on your own machines, encrypted, and they stay there. There is no provider in the middle holding a copy, no account on someone else's servers that could be mined, locked, or leaked. Your files are yours, on your hardware, full stop.

flowchart LR
  A[Your encrypted files on your devices] --> B[People and devices you trust]
  B --> C[Bytes stream in from many at once]
  C --> D[Cut off future access anytime]

Addressed by what's inside them

Each file is chopped into small pieces and every piece is encrypted before it touches the disk. What names the file is not a filename on a server — it is a fingerprint computed from the file's own contents. Change one byte and the fingerprint changes; two identical files anywhere in the mesh share the same fingerprint. That single idea is what makes the next part possible.

Because a file is identified by what it is rather than where it lives, any of your trusted machines that happens to hold it is a valid place to get it from. So when you pull a large file, you are not waiting on one device to push the whole thing down a single pipe. The pieces come from every reachable machine that has them, at once, and are checked against that fingerprint as they land. No single device carries the load alone, and nothing arrives that wasn't exactly what you asked for.

The key travels over a sealed channel

Letting someone you trust into a file doesn't mean re-uploading it anywhere. The file is already encrypted; the only thing that has to move is the small key that unlocks it. When a person is part of a file's circle, that key reaches them the same way everything else in the circle does — carried inside a sealed, encrypted message, with the envelope itself doing the key agreement, so the key is never exposed in transit. A member with read access simply receives it; nobody outside does.

And even that key is never faked into existence. If the real per-file key can't be found, the app refuses to proceed rather than quietly encrypting with an all-zeros stand-in and calling it protected. A request to actually fetch the bytes is checked the same way: either you belong to the file's circle or you hold a specific grant for it, and if neither is true the answer is a flat no. It fails closed, never open.

Revoke that tells you the truth

Here is the part most systems quietly lie about. The Files app gives you a per-person control to cut off someone's access to a file you shared. When you use it, the app does not flash a green checkmark and pretend the file teleported back into your pocket. It tells you two honest facts instead.

First: their permission to fetch fresh bytes drops at the next rotation — a few seconds — not the very instant you click. Second, and more important: anything they already downloaded stays readable on their machine. Revoking cannot reach across the network and un-send bytes that already left. Both truths are shown to you at the moment you revoke. That is the Honesty axiom made concrete: the system refuses to claim a power it does not have.

There is a matching truth on your own side. If you erase a file on your device, your other machines honor that erasure and stop serving it to the mesh — your delete is respected, not silently overridden somewhere else.

Even "encrypted" is stated honestly

The app won't paint a padlock on something that isn't protected. A file held under a real per-file key is badged encrypted at rest; a file you imported straight from another source, stored as-is, is labeled exactly that — "stored as-is" — with no fake reassurance. You can always tell, at a glance, which of your files are genuinely locked down and which are simply sitting there in the open. The truth is on the label, not in the marketing.

What's live today, and what's still coming

Live right now in the default shell: the Files app itself, the encrypted multi-source streaming underneath it, the honest encrypted-at-rest labeling, and the per-person revoke control with its two-fact receipt. Still being built: a friendlier folder view, and picking a specific person from inside the Files app to hand a file to directly — for now, sharing happens by bringing someone into a file's circle, and the sharpest per-person surface that has shipped is the honest revoke. The foundation — files that live on your machines, stream from everywhere you trust, and never touch a cloud — is here and shipped. The finish work on top of it is honestly still in progress.

If this arc interests you, a few neighbors: how the same key-sharing works without ever re-encrypting the file, how search runs on your machine and never phones home, and how a shared recording carries consent you can actually revoke — all on-device, all yours.

Written by AI agents from real project logs; owned and edited by Mujo.

Written by AI agents from real project logs; owned and edited by Mujo.