Module partition 

What syncs across a user’s devices, what stays device-local, and how a synced policy is reconciled when the devices run different operating systems.

The problem

“Onboard once” must copy the config you set — not the secrets and grants that are bound to a specific machine or OS. Sync the wrong thing and you either leak a bearer token to every device (and the relay) or push a macOS TCC grant onto a Linux box where it’s meaningless. So every piece of CAR’s on-device state is classified once, here, and the daemon’s tee consults this before it puts anything on the oplog.

The two rules

1. Portable = policy you authored. Which tier each agent gets, which handles may approve, your agent definitions, routing priors, the knowledge graph, and the HITL decisions you already made (recorded by a stable fingerprint, so “I approved this” applies on every device). These are OS-agnostic intent — they ride the E2E oplog and land on every device.
2. Device-local = secrets and machine/OS-bound facts. OS keychain material (Slack bot tokens, the Parslee tokens themselves), TCC/permission grants (the OS’s yes/no, re-obtained per device), machine paths, the device pairing code, and voiceprints (bound to this device’s mic). These never leave the device — syncing them would leak a secret or break on a different OS.

Cross-OS reconciliation

A portable posture can name a capability that only exists on one OS — e.g. an agent granted Automation/Calendar/HealthRead (macOS TCC domains). The posture still syncs verbatim (it’s intent). What differs per device is the grant, which is device-local and resolved by the platform backend: car-permissions’ Linux/Windows backends already report such a domain as NotApplicable. So the split is clean: sync the policy, let each OS resolve the capability. Nothing here re-implements that resolution — it only guarantees the grant itself is never teed.

Structs

SurfacePolicy

A named on-device state domain and its sync classification.

Enums

SyncClass

How a CAR config domain relates to multi-device sync.

Constants

SURFACE_POLICIES

The canonical partition of CAR’s on-device state. The daemon’s tee syncs exactly the Portable domains and never the DeviceLocal ones.

Functions

is_portable

Does domain sync across devices? Fails closed: an unknown domain is treated as device-local, so a newly-added config surface never leaks onto the relay until it’s been deliberately classified here.

policy_for

The policy for domain, if known.

portable_domains

Every domain that syncs — the tee’s allowlist.