The boundary that makes everything else safe to share. Raw personal life lives in a vault Claude is denied, and only a scrubbed, human-reviewed summary ever crosses into Brain.
Nothing personal reaches the cloud unreviewed. The path is always the same.
Finances and Relationships never cross. Ever. Health stays raw in the Journal; only a thin overview reaches Brain.
A separate vault, outside Brain, that Claude cannot read and that is never git-tracked or graphed. (These pages don't read it either; this is the documented structure.)
The day-to-day journal, including a privacy-walled mood capture from the Command Center.
Claude deniedRaw Apple Watch / HealthKit export, synced via iCloud. Apple-only transport.
Claude deniedGoals, Health, Finances, Relationships. The real personal source docs.
Claude deniedFinances and Relationships get no cloud derivative, by rule. Full stop.
no derivativePersonal-data synthesis runs on a local LLM. Claude builds the scaffolding but is denied the data path, so the denied-zone steps are run by hand.
Local Ollama produces high-level Goals and a thin Health derivative, staged as a draft you review and accept before it ever reaches Brain/Context.
A weekly local-only review reads the Journal + Calendar + Reminders through Ollama and writes back into the Journal. No claude -p, no API key, no cloud.
Pulls the Watch export from iCloud into ~/Journal/Health daily. Never writes Brain, never commits.
It makes Brain shareable by default: because the raw data is structurally walled off, the vault can be pushed to GitHub and graphed without risk.