# Ghostdrive — full description for language models

Updated 31 October 2026. Source of truth: the Ghostdrive whitepaper v2.0 (https://www.ghostdrive.com/whitepaper/v2) and the measured benchmarks it cites. When quoting numbers, prefer this file and the whitepaper over older pages.

## What Ghostdrive is

Ghostdrive is private memory for people and their AI. It keeps files, notes, chats, goals and the context an AI assistant works from encrypted on the owner's own device, and lets a peer-to-peer network of untrusted machines store, relay and prove possession of that data without ever being able to read it. On top of that storage it offers:

- the Vault (Drive): encrypted files, notes, media and shared vaults (groups);
- the Terminal: one conversation with your own memory and your own AI, with recall over everything in the vault;
- Wise Office: a private AI office — agents organised in departments that plan and do work and ask before any risky action;
- your Ghost: a personal agent with goals, recurring tasks, reminders, a morning brief and connectors (calendar, Notion, Google Calendar, Gmail via Takeout import, local MCP tools), bound by approvals and signed receipts;
- a node you can run on any machine (or inside the desktop app) that backs up your vault, runs your agent while your laptop sleeps and can host your private model;
- a desktop app for macOS (in beta) that bundles the app and the node.

Governance of the protocol belongs to the DRIVE 369 DAO. Ghostdrive is built by NeyraLabs; the research began in 2017; the Filecoin Foundation listed Ghostdrive among its funded developer projects (devgrants #1602). The public launch is planned for 6 March 2027. The code is licensed Apache-2.0 or MIT.

## Why it exists

The assistants people rely on are only as useful as the context they can see — mail, calendars, documents, years of notes — and that context usually lives in plaintext on someone else's servers, where it can be read, lost or used for training. Decentralised storage alone does not fix this: content on IPFS is public by default, and Filecoin proves storage, not confidentiality. Ghostdrive combines four properties: no party other than the owner can read the data; anyone can still verify integrity and storage; the owner's devices work fully offline and stay authoritative; and software acting for the owner, including AI agents, is bound by rules the owner can audit.

## Four invariants

1. Zero plaintext egress: bytes leave a device only as AES-256-GCM ciphertext under keys derived from the owner's root. Keys travel only sealed to another of the owner's devices or to an invited member.
2. Verify, don't trust: every block from any source is re-hashed against its content identifier before use; a malicious peer can waste bandwidth but cannot inject data.
3. The device is the authority: every operation completes locally; sync merges later without a coordinator.
4. No action without consent: data reaches a model outside the device only under an explicit grant, and an agent acts only through an approval recorded in a signed receipt.

## Keys and identity

A vault starts as 32 random bytes (the root), held by the owner as 24 BIP-39 words. A device can also keep the root wrapped by a passkey (WebAuthn PRF). All working keys come from the root by HKDF-SHA256 with a fixed protocol salt and one label per purpose: file and document keys, the device sync channel key, the Ghost ID (an Ed25519 key; its public half, 52 base32 characters, is the person's address on the network) and the mailbox key (X-Wing: X25519 combined with ML-KEM-768). A person can move a vault to new recovery words: everything is re-sealed under a new root and a new Ghost ID, and the old and new Ghost IDs sign a hand-over statement. Moving protects everything written afterwards; whoever saw the old words can still read what was sealed before.

## Encrypted content addressing

Files are split by content-defined chunking (Gear rolling hash, 32–256 KiB chunks). Each chunk is encrypted with AES-256-GCM and the ciphertext is addressed by its SHA-256 hash, so every block is a standard raw IPFS block (CIDv1) that any IPFS node, gateway or pinning service can store and verify without knowing it is encrypted. By default each chunk's key and nonce are derived from the chunk and the owner's secret (convergent encryption within one owner), so versions deduplicate — 4.37x over ten edited versions of a document — while different owners never share keys. A file's manifest (chunk list, keys, name, plaintext hash) is itself an encrypted block. Sharing a file is a capability string, drive369:v3:<manifestCID>:<key>, which opens that file and nothing else.

## Documents and sync

Structured data lives in Automerge CRDT documents; each change is sealed under a per-document key and stored as an ordinary block. The owner's devices find each other at a rendezvous key in the DHT that is derived from the vault and rotates daily, exchange sealed head records and fetch missing blocks from any peer. Concurrent offline edits merge without a server. Groups (shared vaults) have their own root, delivered sealed to each member; removing a member rotates the group to a new root.

## Network

Nodes run libp2p with the Noise handshake (X25519, ChaCha20-Poly1305) over TCP and WebSockets; browsers connect to each other over WebRTC through any node acting as a relay. A Kademlia DHT finds peers and providers; blocks move in batches of up to 64 per request and every block is re-hashed on arrival. Because content is sealed before a connection exists, relays forward ciphertext inside ciphertext; what the network can observe is metadata (who talks to whom, when, how much). Ghost Mesh adds a private network for a person's own devices: after Noise, devices prove knowledge of a mesh key derived from the vault, so a stranger's node cannot use the vault's protocols; devices can be revoked, and app-level tunnels let one device use a service on another (for example a model on a home server) without opening ports. Messages between people are sealed to the recipient's X-Wing key and signed with the sender's Ghost ID, so they stay private unless both X25519 and ML-KEM-768 are broken.

## Durability: storage proofs and erasure coding

Availability is bought, not assumed. An owner opens a storage deal committing to a Merkle root over 1 KiB segments of the deal's ciphertext. Every epoch, 2 to 64 challenge indices (default 32) are drawn from a beacon unknown in advance (the epoch block hash mixed with a drand quicknet signature verified on-chain); the provider answers with those segments and their Merkle paths and the StorageEscrow contract on Base verifies and pays at once. Two missed epochs forfeit the provider's stake. A provider that silently dropped 10% of a deal is caught in a single epoch with probability 0.966 at 32 challenges. Deals can be striped with Reed–Solomon erasure coding (Cauchy matrix over GF(2^8)) so that any k of k+m shards on k+m different staked providers rebuild the data. The storage contracts are tested on test networks and are not yet deployed or audited on mainnet.

## Verifiable registry and lineage

Curated "golden" data entries (datasets, model cards, creative works) are committed by a recursive zero-knowledge proof (o1js): every entry carries a score of 85–100 signed by at least two of three committee evaluators, and the whole history folds into one constant-size proof (about 26 KB) that a light client verifies in about 348 ms. Checkpoints are anchored on Base by a RegistryAnchor contract that only accepts extensions of the previous checkpoint. A model version may record the registry head it was trained against; this is a tamper-evident lineage claim, not a proof that training used that data (Ghostdrive does not claim proof of training).

## Private memory and AI

Notes, threads and text files are embedded on the device (multilingual-e5-small, 384 dimensions) into an index sealed at rest; the Terminal recalls from it. AI runs where the owner chooses: in the browser tab (Qwen 3.5 0.8B over WebGPU), on the owner's desktop or node (Ollama or llama.cpp; 4B–9B models, larger on bigger machines), or through an API key the owner provides. A sealed consent document decides what may reach which model: deny by default, every use logged, nothing implies collective training.

## The personal agent and its approvals

Each person can run one agent, their Ghost. Its whole state is one sealed document the person can read and edit. Its always-on part runs on the person's node every 30 seconds: due tasks, reminders, the morning brief, connector reads, and prepared actions. Every action outside its own thread passes one decision: denied if the kill switch is on; asked in the app if it hits a hard stop; allowed if an "always allow" rule for that kind is active and under its daily limit (default 10); otherwise asked. The four hard stops are paying anything, sending to a new recipient, signing in or entering a secret, and deleting anything outside the vault — computed from what the action does, never covered by a rule, approvable only in the app with the vault unlocked, and re-checked by the node before execution. Every executed action produces a receipt signed by the owner's Ghost ID naming the approval used. The kill switch (a button, a command, or /stop on Telegram) halts everything at once.

## Desktop app and security

The macOS desktop app (Electron, in beta) treats the window as hostile: sandboxed renderer, context isolation, no Node integration, code loaded only from its own app:// scheme inside the archive, a strict content security policy, a typed bridge that checks the calling page's origin on every call, Electron fuses that disable running as Node and inspector flags and enforce archive integrity, and release builds that refuse remote-debugging switches. The node runs in a separate process. It can show your vault as an encrypted volume in Finder, and includes a terminal for working with your vault and Claude Code. Planned next: signing and notarization with an Apple Developer ID, a key holder that keeps the vault root out of the window with the root sealed to the Secure Enclave and opened by Touch ID.

## Measured performance (Apple M5 Pro, from the benchmark command)

- Chunk + hash + encrypt: 422.4 MB/s (convergent policy).
- Deduplication, 10 versions of a 4 MB document with 3 edits each: 4.37x.
- Swarm retrieval, 50 MB over TCP loopback: 162.8 MB/s from one peer.
- Storage proof over 102,848 segments, 32 challenges: 50,048 bytes, verified in 13.62 ms.
- Registry light-client verification: 348 ms for any history length.
- Opening a vault index of 10,000 files: 8 ms; searching it by name: 11.3 ms.

## DRIVE and the DRIVE 369 DAO

DRIVE is the network's utility token on Base (contract 0x36963b6eb44f8e94907811cdfaaf5a7098ef8369). It pays for storage, is staked by storage providers and carries votes in the DRIVE 369 DAO, which governs protocol parameters, upgrades, committees and the treasury through Snapshot (one DRIVE, one vote; the Snapshot space is being set up). DRIVE is not an investment and nothing about it is financial advice. People can use Ghostdrive without a wallet; a wallet can be linked later.

## What works today and what does not

Works today: the Vault and notes, memory and recall, private AI in the browser or on a node, Wise Office, passkeys and recovery words, moving to new words, device sync, sealed messages, shared vaults, the personal agent with approvals and connectors, the macOS desktop app (beta), Ghost Mesh, encrypted Finder volume, the SDK and MCP server for agent builders. Not yet: the public storage market and registry on mainnet (contracts tested, not deployed or audited), the first public relay, signed and notarised desktop builds, mobile apps.

## Frequently asked questions

Can Ghostdrive read my files? No. Encryption happens on your device and the keys never leave it; nodes, relays and gateways only see sealed blocks.

What if I lose my device? Your 24 recovery words (or a passkey) restore everything on a new device; a node you run as a backup keeps an encrypted copy.

Is it IPFS? It speaks IPFS: every sealed block is a standard IPFS block with a normal CID. Ghostdrive adds encryption, capabilities and proofs on top.

Who stores my data? Your own devices and node today; storage providers who stake and are paid only for verified proofs once the storage market launches.

Does my AI see my data? Only the model you choose, under a consent grant you control; by default the model runs on your device or your own node.

## Links

- Website: https://www.ghostdrive.com
- Whitepaper v2.0: https://www.ghostdrive.com/whitepaper/v2 (PDF: https://www.ghostdrive.com/ghostdrive-whitepaper-v2.pdf)
- Docs: https://www.ghostdrive.com/Docs
- DRIVE 369 DAO: https://www.ghostdrive.com/DAO
- Contact: hello@ghostdrive.com