Security and authority

Hard stops

This page adds operating controls that are intentionally stricter than syntax shown in the product reference.

Secret handling

Only interactive authentication by the owner or an approved managed test account is allowed. Run ob login with every credential-bearing option omitted.

Never place real email, password, MFA, token, encryption-password, recovery-code, session-cookie, or other secret values in commands, code blocks, CI configuration, environment examples, repository files, logs, chat, agent prompts, screenshots, issue comments, receipts, or proof artifacts. Do not ask a user to paste personal credentials into chat.

Official option names may be listed as non-runnable completeness metadata. They are not an automation pattern.

Exact approval required

Stop before any of these actions:

• authenticate, switch accounts, or log out;
• enable, buy, renew, upgrade, or otherwise change Sync or Publish;
• change billing, plan, region, entitlement, or account settings;
• create/delete a remote vault or Publish site;
• configure or unlink Sync/Publish;
• change Sync mode, conflict strategy, file/config scope, exclusions, device identity, or config directory;
• start continuous Sync on a new device;
• use mirror-remote or rely on pull-only for a writer;
• change Publish scope/site options, publish broadly, suppress confirmation, or publish user content;
• restore/delete content, permanently delete a file, install/uninstall plugins, or run untrusted eval code.

Approval must name the action, target, account alias, scope, cost, evidence, and rollback owner.

Least privilege

• Use a dedicated OS identity and a filesystem allowlist for server or agent projections.
• Give agents only the vault paths and capabilities they need.
• Treat eval, plugin mutation, restore, permanent delete, Sync mode changes, and public Publish as high-impact operations.
• Supervise continuous processes, bound and redact logs, and define a stop/disable procedure.
• Make a recoverable backup before setup, mode changes, unlink, continuous operation, or destructive recovery.

Authority does not travel with files

Obsidian Headless, Sync, Publish, GitHub, Drive, Vercel, and knowledge mirrors are transports or projections. They are not Agent HQ, an accepted Score, project decision authority, or trusted-wiki Gold.

Never copy a live writable Kanban, Agent HQ, trusted-wiki, or other SQLite database between devices. Use supported exports, immutable receipts, Git objects, application-level sync, or an explicitly approved quiesced backup workflow.

Evidence before completion

A successful command is not proof of the outcome. For Sync, require provider-native source and destination status plus a second-device exact path, bytes/content, and SHA-256 readback, followed by conflict/deletion checks. For Publish, require a reviewed dry-run before an authorized publish and public URL/content readback afterward. ob sync-status alone is not convergence proof.

See Recovery and the source ledger.