# Thinking Machine Labs > Documentation for Thinking Machine Labs projects. Reference material for people building on them — protocol, architecture, API, and the guide. Every page of this site is served as markdown at the same path with `.md` instead of the trailing slash — https://docs.thinkingmachinelabs.dev/argala/guide/blobs/ is also https://docs.thinkingmachinelabs.dev/argala/guide/blobs.md. The markdown is the page without the navigation, and diagrams come back as ```mermaid source rather than the SVG the HTML page draws. [https://docs.thinkingmachinelabs.dev/llms-full.txt](https://docs.thinkingmachinelabs.dev/llms-full.txt) is every page below concatenated into one file (~275KB). ## argala - [argala — sealed graphs](https://docs.thinkingmachinelabs.dev/argala.md): Local-first storage, sync, and key custody for apps whose server is not allowed to read the data. ## argala — Start here - [Is argala the right tool?](https://docs.thinkingmachinelabs.dev/argala/start/is-argala-the-right-tool.md): argala is for applications where "we cannot read it" is the feature. - [Install](https://docs.thinkingmachinelabs.dev/argala/start/install.md): Requires Node 22.5+ on the server (node:sqlite). The client runs in any browser with WebCrypto, in Node, and in native shells. - [Ten minutes, end to end](https://docs.thinkingmachinelabs.dev/argala/start/ten-minutes-end-to-end.md): There is a runnable version of all of this: - [Concepts](https://docs.thinkingmachinelabs.dev/argala/start/concepts.md): Choosing a graph is choosing a key boundary. Everything in one graph is readable by everyone in that graph — role rules inside a graph are UI courtesy, not cryptography. ## argala — The guide - [The guide](https://docs.thinkingmachinelabs.dev/argala/guide.md): Everything you need to build an application on argala, presented in the order you will need it. - [Part 1 — the relay](https://docs.thinkingmachinelabs.dev/argala/guide/the-relay.md): registerRelay mounts fourteen routes on a Fastify instance you own. - [Part 2 — the device](https://docs.thinkingmachinelabs.dev/argala/guide/the-device.md): open generates this device's keypairs on first run (stored in the KeyStore), registers the public halves with the relay, and loads any keyrings it already holds. - [Part 3 — reading and writing](https://docs.thinkingmachinelabs.dev/argala/guide/reading-and-writing.md): Draw waiting as "sealed — another device holds the key", never as empty. - [Part 4 — reactivity and UI](https://docs.thinkingmachinelabs.dev/argala/guide/reactivity-and-ui.md): The callback fires once immediately, and then only when the answer changes — not on every write anywhere in the graph. - [Part 5 — devices and key custody](https://docs.thinkingmachinelabs.dev/argala/guide/devices-and-key-custody.md): Show this list in your UI. A ghost device — one a malicious relay inserted to wait for a grant — is only detectable if somebody can see it. - [Part 6 — sharing a graph](https://docs.thinkingmachinelabs.dev/argala/guide/sharing-a-graph.md): Membership is your Directory's answer. Once isGroupMember('acme', 'alex') is true, Alex's devices can open g:acme, and the next sync from any key holder grants them. - [Part 7 — revocation and rotation](https://docs.thinkingmachinelabs.dev/argala/guide/revocation-and-rotation.md): The relay stops handing that device key material and flags every graph it held keys for. - [Part 8 — recovery](https://docs.thinkingmachinelabs.dev/argala/guide/recovery.md): For when there is no device left to grant from. - [Part 9 — blobs](https://docs.thinkingmachinelabs.dev/argala/guide/blobs.md): Records are capped at 512 KB, and last-write-wins is a poor fit for a 20 MB payload. - [Part 10 — partial sync](https://docs.thinkingmachinelabs.dev/argala/guide/partial-sync.md): Partial sync is off by default. Turning it on tells the relay something it can filter on, and everything you tell it is readable forever. - [Part 11 — realtime](https://docs.thinkingmachinelabs.dev/argala/guide/realtime.md): The relay pokes; your existing socket layer delivers; the device pulls. - [Part 12 — operating it](https://docs.thinkingmachinelabs.dev/argala/guide/operating-it.md): From SECURITY.md, restated because they are the difference between an app that is end-to-end encrypted and one that says it is: - [Part 13 — catching a dishonest relay](https://docs.thinkingmachinelabs.dev/argala/guide/catching-a-dishonest-relay.md): The relay cannot read a record, alter one, or forge one. What it could always do — until now — is decline to hand one over, or hand over the version that was replaced. - [Part 14 — linking a device, and approving one](https://docs.thinkingmachinelabs.dev/argala/guide/linking-a-device-and-approving-one.md): Part 5 said a second device shows up with a key gap and receives the key on the next sync. - [Part 15 — who is allowed to do what](https://docs.thinkingmachinelabs.dev/argala/guide/who-is-allowed-to-do-what.md): Signatures answer who wrote this? Until now, nothing answered were they allowed to? ## argala — Reference - [Recipes](https://docs.thinkingmachinelabs.dev/argala/reference/recipes.md): Deterministic (upsert-by-id still merges across your devices), stable through rotation, linking and recovery, and unlinkable to any shared ID without a key only you hold. - [Troubleshooting](https://docs.thinkingmachinelabs.dev/argala/reference/troubleshooting.md): A restarted device pushes but never pulls. Subscriptions are not restored from disk — only your openGraph/subscribe calls create them. - [API reference](https://docs.thinkingmachinelabs.dev/argala/reference/api-reference.md): @argala/client/node: NodeSqliteGraphStore, FileKeyStore, SqlGraphStore. - [Limits and defaults](https://docs.thinkingmachinelabs.dev/argala/reference/limits-and-defaults.md): A relay may be configured with stricter limits. It may never be looser: a client that respects these must never be rejected for it. - [Where to go next](https://docs.thinkingmachinelabs.dev/argala/reference/where-to-go-next.md) ## argala — Internals - [Architecture](https://docs.thinkingmachinelabs.dev/argala/internals/architecture.md): How the pieces fit, why each boundary is where it is, and what happens on the wire when somebody types a character. - [Protocol](https://docs.thinkingmachinelabs.dev/argala/internals/protocol.md): Everything a second implementation would need. - [Security](https://docs.thinkingmachinelabs.dev/argala/internals/security.md): argala's whole claim is that a server can hold an application's data and be unable to read it. ## argala — Project - [Roadmap](https://docs.thinkingmachinelabs.dev/argala/project/roadmap.md): This roadmap lists what is missing, in priority order, and what each item would actually require. - [Changelog](https://docs.thinkingmachinelabs.dev/argala/project/changelog.md): Notable changes to argala. Dates are the day the work landed; versions begin at 0.1.0, and until 1.0.0 a minor bump may change the wire. ## memex - [memex](https://docs.thinkingmachinelabs.dev/memex.md): Stop sending things to yourself. memex is a private place on your Android phone for everything you'll need later. Early access on Google Play. ## memex — privacy - [memex privacy policy](https://docs.thinkingmachinelabs.dev/memex/privacy.md): What the memex Android app stores, what can reach the network, and the one Google library that reports on itself. ## memex — pro - [memex pro](https://docs.thinkingmachinelabs.dev/memex/pro.md): memex pro keeps your phone, your computer and a browser in step, and shares what you choose with people. No account. Early access on Google Play. - [memex pro privacy policy](https://docs.thinkingmachinelabs.dev/memex/pro/privacy.md): What memex pro keeps on your devices, what leaves them and where it goes, what our switchboard sees and keeps and for how long, and what Google is told.