Concepts

Vaults

Each agent's memory is a git repo on your forge that the agent maintains and you can clone, diff and revert.

An agent's vault is its memory: a git repo on your forge, named <repo_prefix><slug> (for example vault-cos). The office creates it from the vault-template repo when the agent is hired, gives the agent's forge user write access, and clones it into the agent's home directory as the agent's OS user (with a short-lived read token that is revoked right after the clone). The agent works inside that checkout during every run.

Layout#

CLAUDE.md            # rendered by the office: identity, charter, colleagues, office rules. Protected.
MEMORY.md            # an index of its memory, maintained by the agent and loaded every run
notes/               # durable knowledge
journal/YYYY-MM-DD.md
artifacts/YYYY-MM-DD-<title>/   # published deliverables: the file + artifact.json (written by the office)
.office/             # office-written metadata (vault standard version). Protected.
.gitignore           # ignores placeholder files the Linux sandbox can leave behind, and work/
work/<repo>/          # clones of repos the agent works on (forge.read / forge.write). Never committed to the vault.

work/ holds the other repositories an agent clones to work on, each with its own remote; it is ignored by the vault and excluded from the office's post-run commit. See Agents that open pull requests.

Path	Written by	Agent can push?
`CLAUDE.md`	The office	No. It's a protected file.
`.office/**`	The office	No. It's a protected file.
`MEMORY.md`, `notes/`, `journal/`	The agent	Yes
`artifacts/**`	The office, when the agent calls `artifact_publish`	Not protected, but the agent publishes through the tool rather than committing here. See Artifacts.

Why a git repo#

You own it. It's an ordinary repo in your own forge, not a row in a vendor's database. If you stop using the office, every vault is still something you can git clone.
Every change is reviewable. Memory edits are commits by the agent's own forge user, so you can diff them, blame them and revert them.
The agent can't rewrite its own rules. Branch protection on main lets the agent push, but protects the file patterns CLAUDE.md and .office/**, so the forge rejects any push that changes them. The run's Claude Code settings deny edits to them as well. Check 3 of the verify suite tests this through the API and with git push.

How a run uses the vault#

Before a run, the office runs git pull --ff-only in the vault as the agent, using that run's forge token.
During the run, the agent reads CLAUDE.md and MEMORY.md, does its work and commits.
After the run, if the agent left uncommitted changes, the office commits them as the agent (run <id>: uncommitted changes, skipping sandbox placeholder files) and pushes anything ahead of the remote with that run's token.

The token reaches git through environment variables (an http.extraHeader set by GIT_CONFIG_*), never on a command line.

Where the vault doesn't go#

Run transcripts are not stored in the vault. They go to the office's state directory, where the agent can't edit them, and their SHA-256 is recorded in the ledger. See The ledger.

Mail lives on the vault too#

Mail to an agent is stored as issues on the recipient's vault repo, with mail:new, mail:working, mail:replied and mail:closed labels. See Mail.