NAOMS · building block
Signed storage
Every change is a signed, tamper-evident record, and large files stay on the owner’s disk.
Signed storage is NAOMS’s append-only event log: every change is a cryptographically signed record chained to the one before it, so history cannot be quietly rewritten after the fact. Large files are addressed by a hash of their own content, encrypted, and kept on the owner’s own device. It is the foundation the rest of the data layer is built on.
What a person notices
- Edits show up on their other devices without waiting on a server to relay them.
- Nobody, not NAOMS, not an app developer, can quietly rewrite something the person already saved.
- Big files stay on their own laptop or phone instead of getting stuck in someone else’s cloud storage.
What you get as a developer
Signed storage is the layer everything else in “Your data” is built on: a content-addressed, encrypted, append-only record of every change, kept on the owner’s own device.
- Every write is a signed record chained to the one before it and to whoever signed it. It is not a row in a shared table that anyone with access could edit after the fact.
- Files are addressed by a hash of their own content and encrypted before they touch disk, so identical content is only ever stored once, and a stored file can be verified against its own hash rather than trusted blindly.
- Nothing evicts or offloads a file automatically. Two independent settings both have to be turned on before a single byte is deleted, and by default neither is on.
- Storage is scoped to the person’s own identity on that device, so one account’s files never leak into another account’s space on a shared machine.
How it connects
VaultA separate encrypted store, sealed the same way, for secrets specifically.File storageSplits large files into chunks that live on this same signed layer.Knowledge graphSigned records become the nodes people search over.Import & packsPacks carry the same signature and content-hash guarantees when data leaves a device.