Thalix Vault documentation
Thalix Vault is a secure, single-organization file vault built around the tv command-line interface. It keeps file bytes in private Supabase Storage and file identity, versions, metadata, access, and audit history in Supabase Postgres, all behind SECURITY DEFINER RPCs the CLI reaches through an authenticated internal API.
Implementation status: partially implemented. Identity/session, Root Folders and metadata, files and versions, access delegation, the unified audit surface, the Agent Skill, ICM templates and workspaces, the Tier 1 local stdio MCP server, and the standalone distribution _tooling_ are all implemented and tested. Standalone releases have not actually been published yet, and the hosted Tier 2 MCP server is not built — see Current state for the complete, honest gap list. Nothing in this documentation set presents planned behavior as shipped.
Task routing map
A cold agent finds the single owning contract for any task from this table in at most two reads: this page, then the linked contract -- no further indirection.
| Task | Owning contract |
|---|---|
use-vault | Quick start |
administer-vault | Users, roles, and groups |
operate-vault | Stale upload reconciliation |
integrate-cli | Command reference |
review-architecture | Architecture overview |
change-documentation | Documentation workflow |
Start here, by role
- Users — Quick start, Getting started, Working with files, Access and delegation, Automation and JSON output.
- Administrators — Users, roles, and groups, Root Folder catalog and metadata, Audit and administration, Sign-in and passwords, Invitations.
- Operators — Stale upload reconciliation, Restore from archive, Failed release and rollback, User offboarding and deactivation, Incident investigation, GitHub Actions cost control, FOLDERS-01 Root Folder migration rollback.
- Architects and reviewers — Architecture overview, Trust boundaries, Security and authorization, Domain model, File lifecycle, Current state.
Documentation Operations
- Documentation Inventory — Complete page catalog with #61 FOLDERS-01 migration readiness, deployment checklist, and cutover requirements.
Reference
- CLI overview and Command reference — the authoritative syntax, permission, output, exit-code, and error-code source for every command.
- Install and update from a private Git checkout, Install the standalone binary, Releasing
tv, Agent Skill. - Templates and Workspaces and local MCP — the ICM template/workspace command family and the Tier 1 local stdio MCP server.
- Product overview, MVP scope, Brand reference, Glossary.
- Architecture decisions — durable records of important design choices.
Documentation authority
Implemented CLI behavior and its tests are the narrowest, most authoritative source for anything this documentation claims is shipped. Accepted ADRs own durable architecture rationale; the root PRD owns product scope. Where a page describes something not yet built, it says so explicitly with implementation_status: planned (or an equivalent honest label) rather than implying availability.
See Documentation workflow for ownership, status labels, review rules, and the definition of done.