Local, Private, Public

Three states for your knowledge. Understanding the boundaries is critical.

RDK has three states for your knowledge. Understanding the boundaries is critical to using the system correctly.

LOCAL

Files in your vault — Obsidian, filesystem, Logseq, Notion. You edit these directly. Examples:

A note in ~/Documents/ObsidianVault/projects/auth.md
A markdown file in any folder RDK is watching

LOCAL files are not indexed until you run rdk vault:indexor auto-sync picks them up. They are not visible to RDK Central, not visible to other nodes, not visible to your dashboard. They live on your machine and that's where they stay.

PRIVATE

Indexed chunks that have been encrypted with your vault key (AES-256-GCM) and synced to RDK Central. Stored as ciphertext. Decryptable only by:

Your node (using the key in ~/.rdk/config.json)
Team members to whom you've explicitly granted vault access

RDK Central cannot decrypt private chunks. RetroDeck cannot decrypt them. If your vault key is lost, your private chunks become permanently unreadable.

Examples:

A chunk indexed from your projects/ folder
An entry stored via rdk_index from Claude
The default visibility for everything in your vault except folders marked public

PUBLIC

Indexed chunks that are plaintext on RDK Central. Retrievable by any node on the network. Earns USDC tips when retrieved.

Public chunks are immutable. Once a chunk is public, it cannot be made private again — other nodes may have already cached it, and the network has no way to recall it.

Examples:

A chunk in your vault/published/ folder (designated public via rdk vault:set-public)
A chunk explicitly published via rdk publish:chunk
A previously private chunk you promoted via the dashboard

State transitions

You can move content between states, but only in certain directions:

LOCAL → PRIVATE   rdk vault:index (default)
LOCAL → PUBLIC    index a file in a public folder, or rdk publish:chunk
PRIVATE → PUBLIC  promote on the dashboard or via CLI
PUBLIC → PRIVATE  not possible
PUBLIC → LOCAL    not possible
PRIVATE → LOCAL   delete the chunk — network copy removed, local file unchanged

What this means in practice

If you're not sure whether something should be public, keep it private. You can always promote later. You can never demote.

When rdk vault:index runs, files default to PRIVATE — encrypted on the network. To share knowledge publicly, you need to take an explicit action: mark a folder public with rdk vault:set-public, publish directly with rdk publish:chunk, or promote on the dashboard.

Folder structure example

~/Documents/ObsidianVault/
  Projects/           # PRIVATE (default — everything outside public folders)
  Daily/              # PRIVATE
  research/           # PUBLIC (you designated it with vault:set-public)
  published/          # PUBLIC (you designated it with vault:set-public)

You can use any folder names — research/ and published/are examples. The distinction is whether you've run rdk vault:set-public on them.