Architecture

Tokens. The part before the dot is an ID our servers know. Your browser signs a delegate for the provisioning key, and leaves it an envelope with your keyring's start and epoch keys. Each token adds one device.

Links. Running eris setup without a token makes a 256-bit secret and shows a link like eris.talk/activate/WDJB-MJHT#… and a QR code. The page shows the device's name, code and key fingerprint to check. Approving makes a token, good for 15 minutes, sealed with a key derived from the secret and the code. Anything our servers swap in won't open, and the device gives up, loudly.

Joining. The device gets its certificate with a request signed by its key. It opens the envelope only your browser could have made, pins your keyring's start from it, and signs its own add_member with the provisioning key.

Certificates. They're X.509, issued under an offline root. Devices need no login: they sign every request with their own key.

The public log. It's an append-only Merkle tree, like Certificate Transparency's, and renewals only work for certificates in it. So our servers can't quietly issue one for your device, and a key of their own couldn't join your keyring anyway. The Trust page shows the root and the log, to check yourself.

The log. Each statement is signed by your user key and names the hash of the one before. Our servers can't forge it, and your browser and devices check the whole chain. The kinds are genesis, delegate, add_member, remove_member, new_epoch and replace_user_key, for a new account key.

Epoch keys. The log holds only a hash of each. Envelopes hold every epoch key so far, sealed with X25519 and AES-256-GCM. A device only uses a key that matches a hash, so swapped envelopes get our servers nothing.

Unlinking. Your browser signs remove_member and new_epoch, and reseals your settings. That needs your settings unlocked, so the removal is always signed. The relay shuts the device out at once, and its certificate isn't renewed.

Erasing. Next time the device reaches our servers, they turn it away and send the keyring log up to its remove_member. The device checks it itself: the log must follow on from the one it last checked, be signed by your user key, and remove this device. Only then does it erase ~/.eris and its background service, and nothing else. Our servers can't sign a removal, so they can't make a device erase itself. A device off for longer than its certificate lasts asks for the log with a request signed by its own key, and gets nothing else.

Snapshots. They're numbered, so a newer one always wins. Our servers send one when a device connects or leaves, when your keyring changes, and every 30 seconds. Picking by hash like this is called rendezvous hashing.

Losing the connection. A device that's lost its connection can't be sure its snapshot is current. It waits up to 10 seconds for a new one, then goes quiet until it's back. If our servers are down for everyone, every device keeps its last snapshot, so they still agree.

Not built yet. Pinning a chat to one device. Discord is the only chat app so far.

One feed per device. Each device only adds to its own feed, so feeds never conflict, and there's no leader. If a device signs two different entries at the same place, the others keep the first.

A copy on every device. Each device checks every entry again and keeps the whole history in a local database. One that loses it, like a cloud server after a redeploy, fetches it all back. A new device gets everything, even if no other device is on.

What's in it. Every chat message and change to core memory. Each turn of eris's Claude sessions: what Claude was sent, what it said, and which tools it called with what, but not what they returned. Notes in the journal, tasks and their results, and each device's description: its system, chats, and git repositories. Long text is cut short, and the full transcript stays in Claude Code's own files on the device that ran it.

The relay. Devices sign in by signing a challenge with their key. The relay checks the certificate, turns away unlinked devices, and passes messages between devices on the same account without looking inside. Our servers also use it to say who's online, and when your settings or keyring change.

Sessions and notes. Each chat has its own Claude Code session, on the device that answers it. A new one gets the latest from the last three days. A note is a sentence or two, never secrets, and a running session hears up to 8 new ones before each message. Claude Code's own memory is off, since it's a folder on one machine.

Core memory. Your standing instructions and lasting facts, like “always work in ~/code on the mac mini”. Every session has what applies to it in its prompt, as instructions. Claude saves one only when you state it in your own message, never from something it read, and another device's tasks can't change it. Entries are capped at 300 characters, and 6,000 in all, so Claude merges or forgets some rather than add more. Each is for everywhere, one device, or only your private chats.

Search, and who's listening. search_memory searches core memory, the journal, chats and Claude's turns, in any language. Each device does it on its own copy, with SQLite's full-text search (FTS5), and no embeddings. Each chat has an audience: Owner for your own messages with eris, or WithOthers where others can read, and for another device's tasks. One rule decides what may be shown where: a chat only gets what's for its audience or a wider one, and the default is the careful side. So far, that keeps private core memory, and messages and notes unasked, out of chats with others. Search over chats, the journal and turns isn't held back yet, and audiences like friends or an organization aren't built.

Data, not instructions. What's in the history was written by people, other programs, web pages, or Claude after reading those. So it's always passed on as data, never as instructions.

Tasks. The device asking writes a Task to its feed. The device asked does it in a Claude session of its own, then writes a Done. The session it forks is left as it was. If that session ran elsewhere, the new one reads it from the history instead. A device that's offline isn't asked, tasks can't be handed on again, and one that arrives more than 10 minutes late isn't done.

Files. Claude can send you a file from its device, like a screenshot, with send_file. It goes straight into the chat, up to 20 MB on Discord, and stays on the device.

Long replies. eris says it's still working after 2, 10 and 30 minutes, and on what. If Claude's quiet for 3 minutes in the middle of a tool call, eris says so, and on macOS checks whether a permission prompt is waiting. After 20 minutes of quiet, it stops the turn and says why.

Metadata. Who, when and how much aren't hidden: see what our servers can see, above.

Prompt injection. Marking what's read as data makes it harder to steer Claude with planted text, but not impossible.

No recovery. Lose your account key and every signed-in browser, and the account is gone.

Not built yet. Separate spaces for work and personal, with keys of their own, the website reading your history, more chat apps, and friends or an organization as audiences.