Vault setup
Where local data lives and why `_WorkOS` matters.
Safety ruleKeep real user data local. Do not
publish private vault content, secrets, screenshots, or logs.
How to use this
`WORKOS_VAULT_PATH` must point to the `_WorkOS` subtree. Wooolfmesh-owned entities live there as Markdown. Registered reference vaults are read-only by default and can be indexed without being silently mutated.
What remains explicit
Capture, AI, review, import, and agent suggestions require user
approval before durable writes. Configuration should point at
_WorkOS, and reference vaults should remain read-only
unless deliberately reconfigured.