Local-first security model

The safest source upload is the one that never happens.

MirrorTrace separates the local data plane from the cloud control plane so billing and device access do not require your source code.

Local source boundary

Checkpoints, diffs, untracked contents, context files, and recovery copies stay in the desktop application data directory.

Supabase receives account, device, plan, timestamps, and one-way project/checkpoint fingerprints for access and limits.

Agent processes use fixed argument arrays and canonical working directories. Critical merge conflicts require explicit confirmation.

Desktop sessions use the operating system credential vault; server secrets never ship in the desktop or browser bundle.