Orkas Orkas
Home Blog Architecture
Architecture

Cloud Sync in Practice: How Orkas Syncs Data Across Devices

How Orkas syncs user data across devices with encrypted transfer, content storage, server-owned commits, account locks, sync rules, model-assisted conflict handling, delete confirmation, and a recycle bin.

Cloud sync for user data is not just upload and download. It has to protect private content in transit, keep storage cheap, serialize writes from multiple devices, understand different data shapes, ask for confirmation before dangerous deletes, and preserve a way back when a decision turns out wrong.

Orkas treats cloud sync as a product boundary, not a background utility. Conversations, agents, skills, task state, knowledge files, and settings all need to move across devices while keeping a clear chain of responsibility: the device prepares content, object storage holds bytes, and the server owns the authoritative index.

The framework below is the one we use to reason about the system: encrypted content flow, content-addressed storage, account-level sync lock, server-owned commit, deterministic sync rules, model-assisted conflict handling, delete confirmation, recycle bin, and recovery markers.

Cloud sync at a glance
Device dataScans user-owned data and compares it with the last clean baseline.
Security layerEncrypts, hashes, verifies, and signs the intent of each sync pass.
Cloud storageStores content objects and a compact index of what should exist.
Recovery layerKeeps tombstones, conflict archives, delete prompts, and recycle-bin entries.
The system is built as a set of checks around the data flow, not as a blind file mirror.
The short version Local-first, and still on your other machine Sync is opt-in; the workspace stays on your machine by default. More on that boundary on the local-first AI agent page.
Download Orkas — free

The sync contract

Each sync pass answers four product questions: what content is eligible to move, how is it protected, who is allowed to publish a new cloud index, and how can the user recover if sync made the wrong call?

The contract for every pass
ScopeOnly user data is considered.
EncryptPayloads are protected before leaving the device.
StoreObjects are addressed by content identity.
LockOne account sync pass publishes at a time.
CommitThe server validates and writes the next index.
RecoverDeletes and conflicts keep a return path.
Sync is reliable because each stage has a narrow responsibility.

Encrypted content path

User data is prepared on the device before it reaches storage. The sync engine normalizes the candidate set, computes content identity, encrypts payloads, uploads through short-lived credentials, and verifies downloaded bytes before writing them back to the device.

From user data to protected cloud object
SelectChoose user-authored data.
HashCompute content identity and size metadata.
EncryptProtect payload before upload.
UploadSend object bytes with temporary credentials.
VerifyCheck hash and expected metadata on pull.
ApplyWrite only verified content to the device.
Object storage sees encrypted payloads; the sync engine verifies content identity before trusting a pull.

Storage and index

Orkas separates stored bytes from the cloud index. Content objects hold the encrypted data. The index records which logical data items should exist, their content identity, version counters, stored size, cloud revision, and tombstone state. The device also keeps a baseline from the last successful pass so it can tell old state from new edits.

Three records, three jobs
Device baselineThe device's memory of the last completed sync.
Cloud indexThe server-owned list of current items, versions, and tombstones.
Content objectsEncrypted bytes addressed by content identity.
Why split them? Large bytes can live in object storage, while the small index remains the single source for sync decisions.
The index tells devices what should exist; content objects supply the bytes.

One sync pass

A pass starts cheap and becomes strict only when there is real work. Orkas first checks whether anything changed, then obtains the account sync lock, recomputes changes while that lock is held, moves content, asks the server to commit index operations, and finally updates the device baseline.

One pass lifecycle
PreflightScan and fetch the latest cloud index metadata.
Sync lockReserve the account sync lane for this device.
RecheckRecompute changes after the lock is held.
TransferUpload, download, merge, or prepare deletes.
CommitServer validates cloud revision, quota, and schema.
BaselineRecord the new clean state after success.
The second diff is important: the preflight view may already be stale by the time work begins.

Sync lock and commit

The sync lock and the commit check solve different problems. The sync lock reduces wasted concurrent work across devices. The server-side lock serializes index writes. The expected cloud revision check prevents an older read from becoming the next truth. Quota and schema checks run in the same server-owned commit path.

The commit gate
Device asksIs the account sync lane available?
Lock grantedThe pass gets a short heartbeat window.
Objects readyContent bytes are already uploaded or fetched.
Server lockIndex write is serialized per account.
Version checkReject if the cloud revision changed.
PublishWrite the next index and update usage.
Devices move bytes; the server publishes the authoritative state.

Rules before conflicts

Most sync decisions are not conflicts. The device compares the baseline, current device data, and cloud index. If only the cloud changed, pull. If only the device changed, push. If both changed, route by content type. If something disappeared, enter the delete-safety path instead of immediately removing data.

Decision engine
BaselineWhat this device last confirmed.
Device data nowWhat this device currently has.
Cloud nowWhat the server index declares.
ActionPull, push, merge, tombstone, confirm, or restore.
The baseline makes a simple rule possible: unchanged sides do not need a merge.

Conflict handling

When both sides really changed, Orkas does not collapse everything into last-writer-wins. Append-style logs can merge by missing records. Lists can merge by stable record identity. Structured JSON can use version counters and timestamps. Markdown and binary files are conservative: if the system cannot prove a lossless merge, it keeps a full copy of the losing version.

For ambiguous text or structured-content conflicts, the product can package the relevant versions for model-assisted handling. The model can explain the conflict, draft a merged version, or help the user choose. It is not the only guardrail: deterministic validation, archived originals, and user-visible recovery remain part of the path.

Conflict resolution pipeline
ClassifyDetect file shape and available version metadata.
Rule mergeUse deterministic merge when it is safe.
Model assistExplain or draft for ambiguous text conflicts.
ArchiveKeep originals when safety is uncertain.
ValidateCheck schema, identity, and expected shape.
PublishCommit only the accepted result.
Model assistance improves resolution quality, while deterministic checks keep it bounded.

Delete confirmation

Deletes are treated as state transitions. A remote delete becomes a tombstone. A device-side delete becomes a candidate operation. Orkas checks recent writes, watches for large delete waves, and pauses the pass for confirmation when the amount of disappearing user data looks risky.

Delete confirmation path
Delete seenA data item is missing or tombstoned.
Recent writeCheck whether it was recreated or edited.
Wave checkDetect unusually large delete batches.
PromptAsk for confirmation when risk is high.
ConfirmCommit tombstones after approval.
CancelPull cloud copies back when deletion was accidental.
Risky deletion is interruptible; the user gets a choice before it becomes durable cloud state.

Recycle bin and recovery

Before a valid delete removes a device copy, Orkas moves it into the sync recycle bin. Conflict losers are archived for review. Pending uploads survive a failed commit so the next pass can reuse bytes. If a user deliberately clears cloud data, other devices see a cleanup marker and stop re-uploading stale content.

Recovery surfaces
Recycle binDeleted device copies remain recoverable.
Conflict archiveLosing versions are kept when merge is uncertain.
Pending uploadsSuccessful object uploads can be reused after commit failure.
Cleanup markerCloud-cleared accounts do not silently rehydrate old data.
Sync recovery is not one feature; it is several small escape hatches placed at failure points.

What this buys us

The result is a sync system with clear boundaries. Devices prepare and verify content. Object storage holds encrypted bytes. The server publishes the index. The account sync lock and server lock keep passes orderly. Rules handle the common cases. Model assistance helps with ambiguous conflicts. Delete confirmation and the recycle bin protect users from the most expensive mistakes.

That is the standard Orkas needs for cloud sync: not magic, not a blind mirror, but a careful mechanism that lets user data move between devices and still feel consistent.