Quilltap is a local-first application. Your data lives on your machine, encrypted at rest, accessible only with your key. That is the architecture, and it is not negotiable. But local-first does not mean local-only, and there are perfectly legitimate reasons to let some of your data leave the building.

We call it “the clown” instead of “the cloud” because the euphemism matters. “The cloud” sounds clean, abstract, weightless—as though your data floats in a benevolent mist somewhere above your head. It does not. It sits on a hard drive in a data center owned by Apple, Microsoft, Google, or Dropbox, subject to their terms of service, their security practices, and their willingness to cooperate with legal requests. Calling it “the clown” is a reminder: this is a performer, not a vault. He will carry the box with flair and sincerity, but he is not Saquel. The box is safe because of what Saquel did to it before it left, not because of anything the clown promises.

Pagliacci’s current role is modest but important. He enables three things: storing your data directory on a cloud-synced drive, connecting to hosted LLM providers over the internet, and—newly, as of 4.8—carrying sealed, portable artefacts out of the house altogether.

If you run Quilltap with only local models—Ollama, LM Studio, or similar—your data never leaves your machine, full stop. Pagliacci is not involved. He has nothing to carry. The clown is only in the picture when you choose to put him there.

A word first on which wall is under discussion. Docker is the isolation Quilltap provides; the managed Linux VM modes—Lima on macOS, WSL2 on Windows—were retired in 4.9 and are no longer built, shipped, or detected. A virtual machine is still the thicker wall, but it is one you build and manage yourself, and inside it QUILLTAP_HOST_IP is the supported route to services on the host: it both turns the localhost rewriting on and says where to point it.

Running Quilltap in a container introduces a wall, and a container sees only what was bound into it when it was made. Database-backed document stores ride along inside the data directory without being asked; filesystem and Obsidian stores point anywhere at all on the host, and inside the container they were simply absent—a fact the application concealed beautifully, since a store’s folder listing comes from the cached index in the database and therefore looked perfectly healthy while every operation touching a real byte failed.

The start script now enumerates your filesystem stores before it builds the container and binds each at its own host path, so a store’s location means the same thing on both sides of the wall. It is a plan rather than a list: stores sharing a vault collapse to one bind, a store nested inside another is dropped rather than shadowing its parent, and a path that does not exist is skipped and reported—Docker would otherwise create the missing source as an empty root-owned directory and present a hollow store as a sound one. Because binds are fixed at creation and never afterwards, a store added to a container already running stays invisible until the container is rebuilt with --recreate, which the script will notice and mention. quilltap docs docker-mounts prints the same plan, should you prefer to assemble the docker run by hand. Two arrangements only warn—a macOS path outside Docker Desktop’s shared folders, and a Linux user id that does not match the container’s—and one is refused outright, a Windows host path having no way to mean the same thing inside a Linux container.

Anyone syncing a document store through iCloud or Dropbox meets this on the first afternoon, which is the whole reason it is written down here rather than in a footnote.

A container also now keeps local time. It had been honouring its configured zone when printing a timestamp and nowhere else, so several subsystems that consult the clock directly went on living in Greenwich: an autonomous room scheduled for seven in the morning fired at two, daily token budgets rolled over at UTC midnight, and “today” and “yesterday” in episodic recall were offset by however far you live from the meridian. The container now applies TZ—or QUILLTAP_TIMEZONE, which wins—to the process clock itself, and the startup scripts detect the host’s own zone and pass it along, since a setting nothing sets is not a setting. An explicit choice always wins; detection merely fills the silence. A container started by hand with neither variable set still runs on UTC, and will not thank you for it.

Pagliacci exists to be transparent about a trade-off that most applications prefer to obscure. Cloud infrastructure offers real benefits. It also involves real concessions. Both deserve to be stated plainly.

A trunk that grows without limit is a poor thing to hand a man on a unicycle, and 4.8 took two large slices off it. Embedding vectors now store in a self-describing int8-quantized format roughly four times smaller than raw Float32, with legacy blobs still readable forever; alongside it, a stale-chat retention sweep nulls the regenerable caches on conversations nobody has played in a while, and cold-tier conversation embeddings are dropped and lazily rebuilt the next time you open the chat. Message text, attachments, memories and summaries are never touched. Because quantization is one-way, this is the release to take a backup before—and to run npx quilltap db optimize after, or the freed pages sit there smugly unreclaimed.

The exports were worse, and worse in a funnier way. A memory’s embedding is a typed array of floats, and the moment you ask JSON to write one down it becomes an object keyed by index—some thirty kilobytes per memory, of numbers. On a real corpus a characters export ran to 791 megabytes, of which about two and a half were the actual content. The remaining ninety-nine and seven-tenths percent was arithmetic nobody could use.

And nobody could use it for a reason worth stating on a page about trusting other people with your data: a vector means nothing except against the model that produced it. Carry one into a corpus governed by a different embedding standard and, whenever the widths happen to agree, semantic search is silently poisoned with no error anywhere to say so. Exports therefore no longer carry embeddings at all—the writer omits them, the reader discards them from archives already in the wild, and an import re-embeds what it inserted against your default profile. Backups gain an opt-in compact mode on the same reasoning, though full fidelity remains the default: a backup exists to restore this instance, where the vectors are valid on arrival and re-embedding costs real money at precisely the moment you are least amused by an unexpected bill.

A file you hand to somebody else is not the same object as a backup you keep in a drawer, and the exporter now behaves as though it knows the difference. Plugin configurations are redacted on the way out, always. A manifest may declare password-typed fields, which are perfectly reasonable in a local backup and entirely unreasonable in a parcel bound for a colleague; the exporter drops them and tells the import preview exactly what it removed. Where it cannot resolve a manifest at all, it withholds the whole configuration rather than guessing—the correct instinct for a clown who does not know what is in the box.

And because an import merges rather than overwrites, a redacted key leaves the receiving instance’s own secret undisturbed. Nobody arrives home to find their API keys replaced by a row of asterisks somebody else’s exporter was too polite to send. Instance settings travel whole minus a short and deliberately named list—the mount-point pointers, the maintenance clock, and the version guard—an imported value in any of which could lock a perfectly healthy instance out of its own database.

The clown can turn on you, give it to anybody he wants—and all that they see is a black box. The Foundryman built the lock to keep other Estates out. Saquel built the lock to keep nefarious residents and thieves out. Between the two of them, the box that Pagliacci carries is sealed with authenticated ChaCha20-Poly1305 under a 256-bit key, and optionally gated behind a passphrase with 600,000 PBKDF2 iterations. (Saquel would like it noted that these pages once said “AES-256 via SQLCipher”; she has corrected the record at some length, and compares the two ciphers while she is about it.)

As of 4.8 that is doubly true, the same construction having been extended to the one thing that used to travel undressed. Archive bundles are now sealed with PBKDF2-SHA256 at 600,000 iterations, deriving an AES-256-GCM key from your instance passphrase and—deliberately—not from the master pepper, which does not travel with a logical backup and would render every restored archive permanently unopenable. A small header carries the parameters, the salt, the initialization vector and a key-verification hash, so a trunk sealed under a passphrase you have since changed is diagnosed as exactly that, in plain words, rather than presented to you as an inscrutable cryptographic failure at eleven at night.

Changing your passphrase therefore re-seals every trunk on the shelf, reporting progress as it goes; the change-passphrase card tells you up front how many it is about to rewrite, and should the rewrite be interrupted it names precisely which ones still answer to the old passphrase, rather than leaving you to guess by trial.

Which brings us to the best illustration this page has of its own thesis. A trunk carried off does not open elsewhere. Hand a bundle to another machine, or restore it beside a passphrase it has never met, and it opens only with the passphrase it was sealed under—not the receiving instance’s, not the clown’s good intentions, not anybody else’s. If something genuinely must travel readable, the command line will write you a plaintext copy on purpose and on the record: quilltap db characters export. The clown may carry the box anywhere he likes. He still cannot open it, and neither can the person he hands it to.

One consequence of that arrangement is quietly generous. Delete All Data and a replace-mode restore both offer—by default—to keep the archived-character bundles, and because the trunks are sealed under your passphrase rather than under anything inside the databases being erased, a kept bundle stays openable afterwards. What survives a wipe is a loose trunk: importable through the ordinary character import, no longer rehydratable, the character row it belonged to having gone with everything else. Both dialogs say so in as many words.

This is the essential relationship between the Vault and the Clown. Pagliacci provides distribution. Saquel provides protection. The clown is sincere and helpful and carries things with theatrical flair. But the clown is not trusted with the key. Nobody is trusted with the key except you.

Pagliacci’s current role—cloud sync and provider connections—is the foundation for something more ambitious. The roadmap includes an optional hosted database backend for users who want distributed resilience over local-first control: your data replicated across infrastructure, surviving hardware failure, professionally backed up, and accessible from a future mobile client.

This is not announced. It is planned with the same trade-off transparency that governs everything Pagliacci touches. The user chooses. The user understands what they are choosing. The clown carries the box, and the clown is honest about what carrying means. He used to be a machinist himself; he knows the machinery, and he knows what it costs to trust someone else with it.

The stage is being built. The costume is already on. He is, as always, ready to perform.