Settings → P2P
This page links your Mnemosyne OS to the Mnemosyne OS of people you trust, computer to computer. You choose which vaults each contact may query. The rail entry is P2P. The page title is Synaptic P2P, with a Beta badge. The subtitle reads A chosen part of the memory, machine to machine. Only trusted contacts with a verified key read what is published here.
Nothing goes online by itself. The page opens offline and stays offline until you turn on Reachable.
While it reads, the page says Reading the bridge…. If the bridge did not start, it says The bridge is not running: with the error code.
Simple and advanced mode
The page has two screens over the same facts. The link at the top right of the Connection card switches between them. It reads Advanced mode on the simple screen and Simple mode on the advanced one.
- The simple screen is the default. It uses plain words: invite, contact, reachable. Its cards are numbered steps.
- The advanced screen shows the same facts with their names: peer id, key, addresses, categories, raw error codes.
The choice is a per-viewer setting kept in local storage. Both screens call the same functions and show the same state.
| Simple screen | Advanced screen |
|---|---|
| Connection | Connection |
| 1. Send the invite | My invite |
| 2. Add the person | (inside Contacts) |
| Not on the same network? | Not on the same network? |
| 3. Connect | Contacts |
| Give access to a vault | Give access to a vault |
| (absent) | What is shared |
| Ask a contact | Ask a contact |
Connection
On the simple screen, the card opens with Share part of the memory with a trusted person, from computer to computer. Only contacts on the list can read it.
The switch turns the node on and off. On the simple screen it is labelled Reachable. The line beside it reads Not reachable right now. while off. While on, it reads Reachable: people on the list can connect to this computer.
The advanced screen shows the node state instead:
| State | Line |
|---|---|
| Offline | Offline: nobody can reach this install. |
| Starting | Starting… |
| Online | Online: trusted peers can reach this install. |
| Stopping | Stopping… |
The switch is disabled while the node starts or stops. While online, a second line counts {{connected}} connected, {{proven}} verified. The page reads the state again every 5 seconds while online.
Becoming reachable needs a licence. Without one, the switch refuses and says so. Your contacts, shared vaults and messages stay readable.
Three warnings can appear under the switch:
| Warning | Meaning |
|---|---|
| This install has no identity key: its connections will be refused. | No wallet exists on this install. |
| Contacts file unreadable, moved unchanged to {{path}}. The list starts empty. | The contacts file was quarantined. |
| {{n}} unreadable entr(y/ies) in the contacts file, left out. | Some contact entries were dropped. |
Your invite
The card is 1. Send the invite on the simple screen and My invite on the advanced one. Copy my invite copies a text that holds this computer's identity and addresses. The button reads Copied when the clipboard took it. If the clipboard refuses, the card says The clipboard refused the copy. Select the text and copy it by hand.
While the node is offline, a warning says Turn on “Reachable” before copying, so the invite carries an address.
The simple screen adds Send it to the person. The invite holds this computer's identity and address. The advanced screen shows {{n}} address(es) on the invite. Its link Show details unfolds three values: Peer id, Key and Addresses. A dash stands for an empty value. If the system has no keystore, a warning says The identity key is encrypted with a publicly known key: this system has no keystore.
Adding a contact
The card is 2. Add the person on the simple screen. On the advanced screen, the same form sits under the contact list.
- Paste the invite
Paste the other person's invite in the box Paste their invite here.
- Name the person
Type a name in Their name, 64 characters at most.
- Add
Press Add. It reads Adding… meanwhile.
The app checks the text before it touches anything. A pasted text that is not an invite is refused with a sentence:
| Sentence | Cause |
|---|---|
| Paste an invite first. | The box is empty. |
| Text not recognised. Paste the text that “Copy my invite” produces on the other computer. | The text is not an invite. |
| This invite has no valid id. | The peer id is missing. |
| This invite has no valid key. | The key is missing. |
| One of the addresses in this invite is not an address. | An address is malformed. |
Contacts and connecting
The card is 3. Connect on the simple screen and Contacts on the advanced one. The simple card opens with Both computers must have added each other, and one of them must be reachable. If it fails: send them the invite and ask them to turn on “Reachable”.
With no contact, the card says Nobody yet. Paste an invite that was received. Each contact is a row with these parts:
| Part | Content |
|---|---|
| Dot | Green when the contact is verified. |
| Name | The name you typed, or Unnamed. |
| State, simple screen | Connected and verified or Not connected. |
| State, advanced screen | A short peer id, and verified when it is. |
| Connect | Enabled only while you are reachable. |
| Bin button | Named Remove. |
Remove asks first: Remove {{name}}? Their next connections will be refused. A contact whose invite carried no address shows Their invite has no address. Ask for a new invite, or wait for them to connect.
After Connect, the row shows the outcome. The advanced screen adds the raw code.
| Sentence | Meaning |
|---|---|
| Connected, identity verified. | The connection worked. |
| They have not added this computer yet. Send them the invite. | The other side does not trust you yet. |
| They refused the connection. | The other side refused. |
| This person is not on the list. | The peer is not in your contacts. |
| The identity differs from the one in the invite. Check with the person. | Key or signature mismatch. |
| The computer at that address is not this contact's. | Another computer answered. |
| Blocked after a failed check. Turn “Reachable” off and on again to retry. | The peer is banned for this session. |
| This install has no key to prove itself with. | No wallet here. |
| No address to connect to. | The invite had no address. |
| Turn on “Reachable” first. | You are offline. |
| No answer in time. | Timeout. |
| No connection. Check that they are reachable and have added this computer, then send them the invite. | The dial failed. |
| The connection failed. | Any other code. |
Not on the same network?
Two computers on two different networks cannot reach each other directly. This card helps you install Tailscale on both. Each computer then gets an address the other can reach. That address goes into your invite by itself. The card opens with To link two different networks: install Tailscale on both computers, with the same account. Each gets an address the other can reach.
The card says where Tailscale stands, in one line.
| Line | Button |
|---|---|
| Tailscale is not installed on this computer. | Install Tailscale or Download Tailscale |
| Tailscale is installed but stopped. Open the Tailscale app. | none |
| Tailscale is waiting for an account sign-in. | Sign in to Tailscale |
| An admin of the Tailscale network must approve this computer. | none |
| Tailscale is disconnected. | Sign in to Tailscale |
| Tailscale is starting… | none |
| Tailscale is running. Address: {{ip}} | none |
| Could not read Tailscale’s state. | Read again |
The card reads the state again every 4 seconds while Tailscale is not running, and every 30 seconds once it runs. The installer and the sign-in happen in other windows, so the card follows them.
Install Tailscale shows when a one-click install is possible. It reads Downloading… meanwhile. Then the card says Installer started. Accept the Windows prompt, then sign in from the Tailscale window. Otherwise the button is Download Tailscale, and the card says Download page opened. Install Tailscale, then come back here. Sign in to Tailscale opens the sign-in page in the browser, and the card says so.
The install and the sign-in can fail with these sentences:
| Sentence | Cause |
|---|---|
| Installer refused: its signature does not match Tailscale's. | A code starting with SIGNATURE_ or SIGNER_NOT_TAILSCALE. |
| Downloading Tailscale failed. Check the connection and try again. | A code starting with DOWNLOAD_, or a fetch failure, timeout or abort. |
| Windows did not start the installer. | A code starting with LAUNCH_FAILED. |
| Tailscale did not answer. Open the Tailscale app and sign in from its window. | A code starting with CONNECT_NO_ANSWER. |
| Tailscale is installed but stopped. Open the Tailscale app. | The Tailscale service is not running. |
| The Tailscale operation failed. | Any other code. |
The advanced screen adds the raw code beside each sentence.
Once Tailscale runs, the card says the other computer needs Tailscale too. It uses the same account when one person owns both computers. Otherwise the computer is shared with the other account, as explained below. One of three lines follows.
| Line | When |
|---|---|
| Turn on “Reachable” so the Tailscale address goes into the invite. | You are offline. |
| The Tailscale address is not in the invite yet. Turn “Reachable” off and on again. | Online, but the address is missing from the invite. |
| The Tailscale address is in the invite. Send it again if the person had added this computer before. | Online, address present. |
Two people, two accounts
The link Two people, two accounts? See how to share unfolds four steps. It shows only while Tailscale runs. The intro reads Each person keeps their own account. Only one of the two shares their computer:
- Open the console
On the computer that shares, press Open the Tailscale console. It opens
https://login.tailscale.com/admin/machines. If it cannot open, the card says Could not open the console. Go to login.tailscale.com/admin/machines in the browser. - Share the computer
In the console, on the row of this computer, click “…” then “Share”. The step names the computer by its Tailscale host name.
- Send the link
Send the invite link to the other person. They accept it with their own Tailscale account.
- Connect
In Mnemosyne OS, the person who received the share clicks Connect next to the contact.
The fold ends with They see only this computer on the Tailscale network. Hide the sharing steps folds it again.
Give access to a vault
This card carries an EXPERIMENTAL badge. Its tooltip reads Tested, not yet proven between two real installs. Every send takes a gesture. The card opens with A contact given a vault asks it questions and reads the answers.
A contact with access queries the vault and reads the memories that answer. The access is read only, through questions, on that vault only. It works while both computers are connected.
The vault list
The vaults come in up to four groups, in this order. An empty group is left out.
| Group heading | Holds |
|---|---|
| Shared with someone ({{n}}) | Vaults a contact already reads. This group wins over the others. |
| Personal vaults ({{n}}) | Your own vaults, ready to give. |
| App vaults ({{n}}) | An app's sandbox vault. |
| Cannot be shared ({{n}}) | Vaults that may not be shared, each with its reason. |
Past 8 vaults, a filter box Filter by name appears. It ignores case and accents. A filter that matches nothing says No vault matches “{{query}}”. With no vault mounted, the card says No vault is mounted right now.
Each row shows the vault name. An app sandbox shows the app's name first and the vault's own name beside it. The row then shows {{n}} memories, with a dash when the count could not be read. Each contact who reads the vault is a chip with a bin button. Its name reads Stop {{name}} from reading this vault.
A vault that may be shared has a Give access… button. It is disabled until you have a contact. In that case the card says Add a contact first.
A vault that may not be shared shows a one-word reason and a folder button named Open the vault. The button opens that vault in Settings → Vaults. The full reason is in the tooltip:
| Word | Full reason |
|---|---|
| private | private vault, MAXIMUM protection |
| provisional | app sandbox still provisional: make it permanent in Vaults first |
| not mounted | not mounted right now |
When more than 3 vaults cannot be shared, that group folds behind one line. The line gives the count and how many per reason. A click unfolds it.
Since this install started, some memories may have been held back. The card then says {{n}} memories were held back since this install started.
The access dialog
Give access… opens a dialog titled Give access to {{vault}}? It reads, in order:
- What the person can do. The dialog says the access is read only, through questions, on this vault only, while both computers are connected. It adds that access can be removed at any time.
- For an app vault only, a warning block This vault is managed by an app. It names the app and says the guard checks every memory before it leaves. You must tick I have looked at what this vault holds, and I accept that this contact can read it. before the grant button works.
- What a scan of this vault found: the dialog scans the vault when it opens. It says Reading this vault… meanwhile.
- Blocked words: a text box, one word per line.
- Give access to: a list of the contacts who do not read this vault yet.
The scan answers with one of these lines:
| Line | Meaning |
|---|---|
| {{held}} memories would be held back. | The guard found secrets or blocked words. |
| No memory held back in the {{scanned}} read. | Nothing found. |
| No memory held back in the {{scanned}} read. The memories not read are listed below. | Nothing found in a partial read. |
| This vault holds nothing to read. | The vault is empty. |
A count line follows: {{scanned}} memories read out of {{total}}. A large vault adds Large vault: only the most recent memories were read. The check still applies to every memory sent. Each finding names its source file, or no source. It says what was found, for example an API key, a password or the word “{{word}}”. The first characters of a found secret are shown so you can find it in your file. A long list ends with And {{n}} more, not listed here. The scan block always ends with This check runs on every memory sent, including memories added later.
Scan again runs the scan again. If the scan fails, the dialog says This vault could not be scanned: with the code.
The blocked words apply to every vault you share. A memory that contains one stays on this computer. Words can be split by new lines, commas or semicolons. Save these words saves them on their own button. It reads Saving…, then {{n}} words kept, and the scan runs again. Leaving the dialog keeps saved words.
With no contact, the last block says No contact yet. Add someone first. When every contact already reads the vault, it says Every contact already reads this vault.
Give access grants it. It reads Giving access… meanwhile. A refusal shows in the dialog. Cancel, the cross or the Escape key closes the dialog and grants nothing.
Removing access
Press the bin on a contact's chip. A confirmation asks Stop {{name}} from reading {{vault}}? Their next questions will be refused.
What is shared
This card exists on the advanced screen only. It holds short notes your contacts can read, typed here. It opens with Contacts read what is written here.
Pick a Category: Architecture decision, API contract, Dependency policy or Note. Note is the default. Type a Title, 200 characters at most, and a Text, 4,000 characters at most. Share publishes it. On success the card says Shared. The notes already shared are listed under the form, with their category.
Ask a contact
This card searches a contact's shared memory. Until a contact is connected and verified, it says Connect to a verified contact first.
Pick Who in the list of verified contacts. Type What to look for?, 512 characters at most. Press Ask.
| Result | Line |
|---|---|
| The contact did not answer | They did not answer: with the code |
| Nothing matched | Nothing matching on their side. |
| Memories matched | one entry per memory |
Each entry shows its title, the contact's name and from {{vault}} when it came from a shared vault. The advanced screen adds the category and the source reference. The text of the memory follows. A memory cut at 4,000 characters ends with Start of the memory only.
Related pages
- Governance: the devices on your local network that apps were allowed to read. That list lives on the Governance page.
- Agents: My machines pairs your own computers through this P2P.
- My machines in the manual.
- Vaults: protection levels and app sandboxes.
- Maximum protection in the manual.