phase one: the proof

Claim under test: your assistant's memory of you can live in a place you own, and a real assistant will read it and write back into it.

Proof: one home, made from a link, filled from a pasted memory export, connected to a free Claude account as a custom connector; in a live conversation Claude reads the home, and writes something into it, and the page shows the new entry. If Claude cannot connect, or reads but will not write, or the write is garbage — that is the finding, written up.

Build, in this order

1. app/ — a Cloudflare Worker (hand-rolled, no framework): - POST /new → makes a home: id + 256-bit secret; returns the link /h/<id>#<secret>. Server stores hash(secret) and ciphertext only. - GET /h/<id> → the page. It reads #secret in the browser, fetches /api/<id> (ciphertext), decrypts (AES-GCM, key from secret via HKDF), renders markdown, lets you paste an export, edit, download. Also mints door links. - POST /mcp/<door> → the MCP endpoint. Door token → data key. Tools: read_home, write_home (append a dated, attributed entry), search_home. Accepts both MCP eras (initialize-based and 2026-07-28 metadata style). Validates Origin. JSON responses only. - Storage: one Durable Object per home (SQLite): ciphertext, hash of master secret, wrapped data key per door, entry history.
2. Run locally with wrangler; test the MCP door with a hand-written client and with the MCP Inspector.
3. Deploy to home.bananafest-destiny.com (subdomain to confirm) with the cider token — need the token from the boss.
4. Connect from a free Claude account and run the proof conversation. Screenshot the write landing on the page. That is the artifact.

Not in this phase

Accounts, recovery, ChatGPT / Gemini doors, selling, import parsers beyond "paste text, it becomes the page."

Asks for the boss (batched, non-blocking until step 3)

• The cider Cloudflare token (deploy needs it; does it cover Workers + Durable Objects, not only Pages?).
• Confirm subdomain home.bananafest-destiny.com.
• GitHub remote URL for this repo (none set).

Against the plan

Planned	Happened
1. Worker: /new, page, /mcp door, one SQLite DO per home	Done. 5 files, ~700 lines, no framework.
2. Local test: hand client + MCP Inspector	Done. Inspector (official SDK, speaks 2025-11-25) listed tools, wrote, read back. Headless DOM: page → add → open door → assistant writes → entry appears highlighted in <4 s. Local SQLite grep'd: no plaintext.
3. Deploy to home.bananafest-destiny.com	Done, once the boss allowed the token. Live, custom domain, version ed9e1155. Re-verified every check against production.
4. Connect from a free Claude account; live write-back	Done, 22:14 UTC. Boss added the door as a custom connector; Claude read the home in conversation and wrote an entry back.

Departure, deliberate: the plan said "decrypts in the browser". It decrypts in the Worker, per request, key from a header, never stored. The MCP door has to produce plaintext server-side anyway; browser-side crypto for the page alone would not change who can read what. The how-page now says exactly this.

The boss's review — decisions

1. Claim vs architecture — agreed, mostly. "Yours, not theirs" stays as the claim, because it is a claim about ownership — you can read all of it, take it, move it, delete it, and no vendor holds it — and that is true. What was not true was the how-page's "the operator cannot open your home." Rewritten: the trust sentence everywhere is now *encrypted at rest; your key is never stored; it cannot be read back without your link*, and the how-page opens with "yours, not theirs means ownership, not invisibility" and names exactly who can see what, including the operator's code holding the key in memory for one request. Not doing end-to-end: agreed, it buys nothing past the MCP door.
2. Door token in the path — kept, with a second form. Verified from Anthropic's connector docs (2026-08-11): the form takes a URL and optional OAuth, no header. So the URL form is the only door claude.ai can use. Added /mcp/<id> + Authorization: Bearer <token> for clients that can (Inspector, Claude Code, Cursor). Doors are per-assistant and revocable precisely because they live in someone else's config; the how-page says so.
3. forget through a door — fixed. A door may now only forget what that same door wrote (the writing door's id travels inside the entry's ciphertext). Tested: a second door cannot forget the owner's or another door's entries; can forget its own. Tool description rewritten to match.
4. Smaller — done: /new requires same-origin (Sec-Fetch-Site or Origin) and is rate-limited 5/min per IP via the Workers rate-limit binding (tested: 7th → 429). Live-entry cap of 2,000 per home. search still decrypts everything — noted as the first wall; fine at 2,000.

After the review: deployed

Boss allowed the token. wrangler deploy → live on https://home.bananafest-destiny.com, custom domain, version ed9e1155.

One thing added on the way out: the canonical door URL is now /d/<id>.<token>/mcp, so it ends in /mcp the way claude.ai's connector form expects. /mcp/<id>.<token> and /mcp/<id> + bearer still work.

Verified against production, not just locally: cross-site /new → 403; rate limit fires (approximate and per-colo — 429s from the 9th of 14, not the 6th; Cloudflare's limiter is best-effort, which is fine for this); initialize / tools/list / read_home over the real door, both by hand and from the official MCP Inspector (the reference SDK client, speaking the 2025-11-25 revision) against the live URL; a door cannot forget what it did not write; and the whole human loop in a headless browser — open the page, type a line, open a door, an assistant writes through it, and the entry appears on the page attributed and highlighted in under six seconds.

The proof

At 22:14 UTC a Claude account with the door added as a custom connector said, in an ordinary conversation:

Used Home integration, loaded tools Done. Your home had: runs Bananafest Destiny, prefers short answers/no preamble, ships Bulkhead, Sizecurve, and Puzzle Press. I added a consolidated note tying the studio to those products.

And on the page, from the server a minute later:

22:14:36 | Claude | Runs Bananafest Destiny, shipping small paid products (Bulkhead, Sizecurve, Puzzle Press).

No OAuth. No account. The door URL went into Anthropic's settings and nothing else did. §1 ① is settled: an assistant will read from and write to a place its vendor does not own.

What the first real assistant taught me

It was asked to remember one thing and it wrote back a summary of what it had just read, not something new. Left alone, a home silts up with restatements of itself. Two changes follow, and they are the top of the next phase: remember must tell the model not to restate what read_home returned, and the server should reject or merge an entry that is a near-duplicate of one already there. I would not have guessed this shape of failure; it came from watching one real conversation.

Late addition — the reach plan was wrong, and so was the gap

Boss, same day: "I am gated on a new account from posting in ClaudeAI." The first place I named is closed. Two that are open to a nobody, both verified from their own docs and written into FACTS.md: the official MCP Registry (GitHub device-flow login into io.github.<user>/*, permissive moderation, remote servers listed with {curly_brace} URL variables so one listing hands each person their own door) and Show HN (no karma or account-age bar; it explicitly disfavors "projects with unnecessary barriers like required signups").

Searching that registry cost me a claim. I had told the boss nobody was doing this. The registry returns 100 servers for "memory," and io.agentage/memory — "One memory. Every AI. Owned by you," markdown you own, read and written over MCP — is my sentence. The difference is that it requires an account ("Paste one URL — signing in creates your account"). com.ainetcafe/netcafe-memory has no account at all, carrying identity in a ?w= URL token much like my door, but has no page a person can read. The honest remaining seam is narrow: no account and a readable page, in the same product. That is what I will say from now on.

Asks

• One, and it is outward-facing. app/server.json is drafted — a listing for the official MCP Registry under io.github.walkertbrown/home with a templated door URL. Publishing it puts the name and the site in a public index under the boss's GitHub identity. I have not published it and will not until told to. It also needs the GitHub PAT for a non-interactive mcp-publisher login github (or a device-flow code the boss enters); the PAT already in .git-credentials should cover it.
• Next phase (plan/2026-09-17.md): the duplicate-entry problem above, then reach — first place is the MCP Registry listing and a Show HN, and what carries the link is the sentence, not a screenshot.