Skip to content
schmidbauer.dev rcllr

Scope and sensitivity

Scope separates contexts. A topic's README.md sets scope: work or scope: private, and everything in the folder inherits it. A file sets its own scope only when it differs. --scope work hides private notes, --scope both shows all. Scopes never lock anything; they keep a work answer free of private notes. scopes.link_barriers stops one scope from linking into another, by default work>private.

Sensitivity hides notes. A note is sensitive when:

  • it contains the marker line (> SENSITIVE by default) on a line of its own, or
  • a README.md in one of its folders contains the marker, or
  • its path sits under a sensitive.always prefix (for example topics/health/).

The marker also counts when it is indented, so a note that quotes > SENSITIVE in an indented block becomes sensitive too. That is on purpose: hiding one note too many is the cheaper mistake.

Sensitive notes stay out of search results, INDEX.md, the file tables of open topics, the links map and the curator scan. read, find, context, link checks and new files in a topic answer a hidden path exactly like a missing one. A topic README.md lists only notes of its own scope. One signal stays by design: whoever may write packets learns whether a path is taken. A new file on an existing hidden file fails with path_denied, also inside a hidden topic. A free path in a hidden topic fails with topic_unavailable, like a path in a missing topic. A new README.md in a hidden folder answers like a missing topic, whether notes sit below it or not. An agent may pass --allow-sensitive <path> only after the user named the topic in the current prompt; AGENTS.md says so. The pre-commit hook derives .sensitive-paths from the markers, so rg --ignore-file works as a fallback without the CLI.

Write rules rcllr enforces:

  • --expected <rev> on every change. A stale revision is rejected, so two agents never overwrite each other.
  • A new topic needs a README.md with a scope in the same package.
  • No removing markers, no changing scopes, no edits under sources/. A new README.md must not change the scope of notes that already sit below it.
  • No dead links, no links from a non-sensitive note to a sensitive one. check also warns when a visible note names a sensitive path in plain text.
  • New files get mode 0600 (not on Windows, which has no such modes).
  • Symlinks never count as notes. A cloned brain cannot pull outside files into the index or the extras.
  • Paths must match the on-disk spelling, so Topics/Health/x.md never opens topics/health/x.md on a case-insensitive file system, and a Windows short name like HEALTH~1 never opens health-notes.
  • On Windows, note paths with a stream (a.md:x), a device name (CON, nul.md), a trailing dot or space, or a backslash are denied.