Document Title
SPHENE KERNEL v2.2
Deterministic, Flat-File, Sovereign Encrypted Knowledge Substrate for Humans & Autonomous AI
CRYPTOGRAPHIC VAULT PARTITIONS
Workspace Documents
0 notesInteractive 3D Knowledge Graph
Differential Timeline ("Human Veto")
Inspect, approve, or veto autonomous AI agent modifications at the AST block level before vault persistence.
Zero Pending Agent Modifications
All notes are in sync. When connected autonomous agents (Hermes, Claude, Cursor) modify a document, the changes appear here for human veto review.
Plugins & Extensions
Verified WebAssembly isolates with strict WASI capabilities, zero OS shell execution, and Ed25519 integrity attestations.
Why Sphene Extensions Are Safe (Zero-Trust Model)
Unlike legacy Electron PKMs where community plugins run as unrestricted Node.js processes with full disk access and telemetry scrapers, Sphene executes all extensions inside isolated WebAssembly WASI containers with strict path whitelisting (< 3MB RAM ceiling) and verified cryptographic Ed25519 signatures. The Private Partition is permanently quarantined and inaccessible to all extensions.
INSTALLED EXTENSIONS
0 InstalledNo Extensions Installed
Browse the verified catalog below to install 1-click extensions with cryptographic supply chain protection.
COMMUNITY GIT REPOSITORIES
Public Git SourcesAdd public Git repositories (e.g. GitHub) to install and update community plugins directly via git clone/pull.
VERIFIED EXTENSION CATALOG
🛡️ Sphene Authority CertifiedCurated first-party and community extensions with full documentation and active capabilities.
Settings & User Management Hub
Manage sovereign user accounts, cryptographic private vaults, on-disk encryption, and delta versioning policies.
Daemon Connection & App Endpoint
Inspect or re-route the daemon URL when running as a standalone app, Cloudflare Tunnel, or remote server.
When running Sphene as an installed standalone app without an address bar, use this setting to point the app to any Cloudflare Tunnel (https://...), Tailscale Funnel, or remote server. "Switch to URL" validates connectivity and immediately navigates this app window to the target address.
Tailscale Sovereign Remote Mesh (Zero-Port Sync)
Encrypted WireGuard peer-to-peer mesh. Connect your phone or laptop from anywhere with zero port-forwarding or router setup.
📲 Pair Your Mobile Device or Laptop
Scan the QR code with your phone camera or click the link below to authorize Sphene on your Tailscale network.
Sphene receives its own permanent MagicDNS address. Sync works through any firewall, hotel Wi-Fi, or cellular connection.
To enable native 1-tap app install on mobile and trusted SSL certificates:
- Open the Tailscale Admin DNS Console →
- Scroll down to "HTTPS Certificates"
- Click "Enable HTTPS Certificates..." (authorizes free Let's Encrypt certificates)
Once enabled, Sphene automatically provisions the TLS certificate and activates port 443 within seconds.
🔑 Open Tailscale Admin DNS Settings →Zero-Knowledge Cloud Relay (Google Drive & Dropbox)
Asynchronous time-shifted sync for your phone and PC. Notes are client-side AES-256-GCM encrypted before upload — cloud providers see only ciphertext.
Best for Android & Google users. Syncs to an isolated "Sphene Vault" app folder with Zero-Knowledge encryption.
No Google account needed. Works seamlessly on iOS & Android via Dropbox App Folder sandbox with PKCE auth.
Editor & Markdown Preferences
Configure dynamic editing behavior, inline formatting, and Obsidian-compatible live preview.
When enabled (default), formatted Markdown renders graphically as soon as your cursor leaves a line. Moving the cursor back to any line instantly expands it to raw text for editing.
When viewing or editing a document on desktop/wide displays, the sidebar smoothly slides out of view to maximize writing and reading space. Moving your mouse within 25% of the left screen edge smoothly rolls the sidebar back into view like a taskbar.
Import Notes from Obsidian / Disk
Recursively scan and import a complete folder of Markdown files, preserving all subfolders and notes hierarchy.
Select any existing Obsidian vault or folder on your computer. Sphene will recursively import all .md notes into the Workspace partition, faithfully mapping all subdirectories to native Sphene Folders.
Global Vault Encryption
Encrypt all documents across the entire vault (Workspace, Reference, and Private) with AES-256-GCM.
When active, raw markdown files on disk are armored ciphertext (<!-- SPHENE-VAULT:ENCRYPTED:AES256 -->). The UI seamlessly decrypts for authenticated sessions.
This key is distinct from user passwords and used exclusively for vault-wide sovereign encryption.
Your knowledge is 100% sovereign. If Sphene ceases to exist or you are stuck on a deserted island with only a Linux terminal, you can decrypt your raw notes yourself with OpenSSL:
# Decrypt any note without Sphene using standard OpenSSL:
openssl enc -d -aes-256-cbc -pbkdf2 -in Note.md -out Note_decrypted.md -k "YOUR_MASTER_CIPHER_KEY"
Delta Document Versioning
Preserve Git-style line-by-line historic diffs and instant one-click version rollback.
App Version & Sovereign PWA Cache
Inspect kernel release status, purge stale service worker caches, and force synchronization.
20260918.01 • Service Worker Shell: sphene-shell-v2.2.15
Local Storage & Lazy Ghost Notes
Manage notes stored on your device. Evict cached note bodies to reclaim space without losing vault notes.
Theme & Appearance
Customize your personal visual theme. Each user profile retains their own individual theme preference.
Personal Theme & Appearance
Choose your preferred interface theme. Your active theme is linked to your user profile and preserved across sessions.
Update Personal Credentials
Change your active username and sovereign password.
Two-Factor Authentication (2FA)
DisabledProtect your account with Time-based One-Time Passwords (TOTP). Compatible with Google Authenticator, Aegis, 1Password, Authy, and any standard authenticator app.
sphene reset-2fa <user>).
Create New Sovereign User
Each user receives their own isolated, AES-256 encrypted private notebook (Private/<username>/). Keys are derived via PBKDF2-HMAC-SHA256 and HKDF.
Registered Vault Users
Private documents are cryptographically isolated per user with zero cross-user sharing.