Local Data Residency: Securing Obsidian and JSONL Memory

Series draft — Part 13 of 15 in Hardened Agentic Stack. Outline only; expand before un-drafting.

Phase 4: Architectural Best Practices

The Problem

Unencrypted Obsidian/JSONL memory exposes the agent’s entire knowledge base after a local compromise.

The Infrastructure Fix

Directory encryption (fscrypt / app-level) plus redaction at write time.

The Architecture Pattern

Data-at-Rest Protection for agent memory.

Planned sections

1. The “Oh No” moment — concrete incident or near-miss that makes the risk visceral.
2. ClawQL context — how this control protects a high-privilege local/edge agent.
3. Technical how-to — concrete configs, policies, or snippets a builder can apply.
4. Safety check — what “trusted enough” looks like once this layer is in place.

Key visuals

• Memory store threat model

Source modules (docs.clawql.com)

• memory-context-poisoning-prevention
• data-classification-pii-redaction-residency
• secrets-at-rest-vault-hsm-audit

Rule of Three (keep on publish)

Layer	Takeaway
Problem	Unencrypted Obsidian/JSONL memory exposes the agent’s entire knowledge base after a local compromise.
Infrastructure fix	Directory encryption (fscrypt / app-level) plus redaction at write time.
Architecture pattern	Data-at-Rest Protection for agent memory.