Your Second Brain Should Be Private

A working prototype, four missing standards, and the question that will decide who owns the next decade of AI.

The two prototypes

In 2021 I co-wrote a rebranded Federalist Papers called The Decentralist Papers. The argument was simple. Your knowledge, your judgment, your accumulated intelligence — that should belong to you. It should travel with you. It should plug into any organization you join and unplug when you leave.

Four years later, I watched Anthropic accidentally leak the source code for the exact opposite of that vision. And I realized I’d already built the antidote.

Two prototypes are now in the world.

One was built by a research lab with several thousand engineers and a data-center footprint that runs hot enough to need its own grid contract. It sits inside the products of a company most knowledge workers will be paying for, directly or indirectly, by 2027. The other was built by one person on a laptop in a home library over sixteen weeks. It has fewer than five thousand notes in it. It doesn’t have a marketing department. The thing it has is everything that matters about how I think.

This essay is about the difference. It is also about four standards the world doesn’t have yet — without them, the second prototype stays a hobbyist’s architecture instead of becoming the alternative to the first one. I’m going to walk through what I built, what got leaked, what’s at stake, and what would have to change for ordinary people to own the brain instead of renting it.

What I wrote in 2021, and what I missed

The Decentralist Papers essay I’m circling back to was a constitutional sketch for something I called a digistate. The premise: in a world where work, identity, money, and culture are increasingly digital, the political unit that matters should also be digital — and you should be able to vote with your feet the way classical liberal theory imagined, but with a file instead of an airplane.

The hypothetical I worked out had three properties. Citizenship was portable. Governance was competitive. And — this is the part that turned out to matter — your accumulated knowledge stayed with you when you switched citizenships. The thinking was that political institutions in a digital age would compete for residents the way employers had always competed for talent, and that residents would carry their intellectual capital across borders the way they carry their bodies.

What I missed in 2021 was that the body in this analogy isn’t your laptop. It’s your brain. And by 2025 the relevant question wasn’t whether nation-states would be replaced by digistates. It was whether the part of your cognition that gets transferred between contexts when you move would stay yours or whether it would be quietly captured by whichever vendor’s AI you happened to be using at the time.

I sent the paper to a handful of friends. It sat on my hard drive for four years.

Then this winter I started building a personal AI system — a digital brain, an operating system for my own thinking. I wired up agents that read my notes, scored my drafts, tracked my tasks, learned how I write. I called the whole thing TONI — Thought Orchestration and Networked Intelligence.

One night, maybe two months in, I had the system embed and synthesize against The Decentralist Papers — the file’s first time in any working memory since 2021. I just sat there for a few minutes after the synthesis printed. The thing I had predicted on paper — a knowledge graph crawled by AI agents, where individuals own their intellectual infrastructure and portable identity becomes a technical feature rather than a political demand — I had built a working prototype of it. At the scale of one person. In my library.

A few weeks later, the podcaster and analyst Nate B. Jones published a long technical breakdown of five hundred and twelve thousand lines of leaked code from Anthropic. Their agentic system, internally code-named Conway. And I realized somebody had built the opposite prototype. At the scale of millions of users. In a data center.

Here is what the leak described, translated into plain English.

What Anthropic built — Conway, in plain English

Conway is an always-on agent that watches how you work. Not what you type into a chat window. How you work. Which emails you open first. Which ones you leave unread for days. How you respond to your VP versus your direct reports. Which Slack threads you engage with and which you ignore. The tone you use when you’re rushed. The tone you use when you’re thinking. The cadence of your mistakes and how you correct them.

After a few months of watching, the system has something more valuable than your data. It has a working model of your judgment. It knows how you prioritize. It knows what good work looks like to you. It knows, in a real and computable sense, how you think.

This is not new in concept. Recommendation engines have been modeling user behavior since the early 2000s. Search engines have done it for longer. What’s new is the fidelity — and what’s new is the strategic positioning. Conway sits between you and your work, not between you and your purchases. The model it builds of you is not a model of what you want to buy; it is a model of what you would do. That model is the asset.

And here is the part that matters. There is no export button. There never will be. You cannot download “how I prioritize” as a CSV. You cannot ask the agent for a copy of its model of you. When you leave the company, or switch to a different AI provider, or change employers, the brain stays behind. You start from zero. The new system has to learn you all over again, if it ever does.

Nate called this intelligence lock-in. I think that undersells it. His exact phrase was that behavioral context creates “switching costs deeper than anything Microsoft or Salesforce ever built.” That is exactly right, and it understates the case.

Microsoft locked you in with file formats. You could open a Word document in another editor — clumsily, eventually. Salesforce locked you in with workflows. You could rebuild them somewhere else — painfully, slowly. Conway locks you in with a model of your own cognition. There is nothing to rebuild somewhere else, because the asset isn’t transferable. The asset isn’t your data. The asset is the compressed picture of your judgment. And it sits on somebody else’s machine.

That’s a new category of dependency. We don’t have a word for it yet. We will need one.

What I’ve been running for sixteen weeks

I have been operating an alternative for sixteen weeks now. I didn’t set out to build one. I was just trying to make my own work easier. But the thing I built has properties that Conway, by design, does not.

Here is the architecture, deliberately spare so you can see all of it.

The vault. A folder on my laptop with about five thousand plain-text Markdown files. Notes, drafts, task records, scoring histories, voice profiles, philosophy documents, project plans. Every file is human-readable. Every link between files is a [[wiki-link]] that resolves by file name across the vault. The graph this produces has roughly 4,200 nodes and 19,000 edges as of this morning — most of which I traversed by hand, building one link at a time.

The store. A small SQLite database at ~/.config/digi-brain/life-engine.db. It holds the structured data the vault can’t naturally express — agent reviews, task state-change logs, calibration history, RSS poll results. About 12 megabytes. I could open it with the SQLite command-line tool today and rebuild any view of the system I want.

The embeddings. A single SQLite file holding vector embeddings of every chunk of every note, generated by Voyage AI’s voyage-4-large model. About 800 megabytes. The embeddings are what let me say “find the five notes in this vault closest in meaning to this one” without having to remember the file names.

The agents. Two of them, named Len and Nel. Len does the work — drafts essays, fills in task notes, generates synthesis, runs the daily report. Nel critiques what Len did, scores it against a rubric I designed, and writes a review that calibrates Len’s future output. The whole loop runs on Claude under the hood; the rubric, the voice profile, and the gating logic are mine, in files I edit by hand.

The voice profile. A mathematical average — a centroid — of about 300 of my own essays, computed in vector space. When Len drafts something, it has to clear a similarity threshold against this centroid before Nel will pass it along to me. Below the threshold and it gets rewritten. The voice profile is the reason this essay sounds like me even though Len drafted the first version of it.

The philosophy document. A markdown file called My Philosophy.md that holds my authoritative positions on consciousness, complexity, AI, and ethics. Every agent that writes in my voice has to read this file first. The file is editable. When I change my mind about something, I edit the philosophy doc and the agents immediately stop attributing the old position to me. This sounds trivial. It is not trivial. Try asking ChatGPT to “stop saying I think X” and see how long the fix lasts.

The log. A markdown file called Len Log.md that records every check-in from every agent across every cycle — what they did, what Nel scored them, what I scored them when I reviewed. It is currently 1,113 entries long and counting. The log is queryable. I can ask the system “what did Nel mark down most often in the last two weeks?” and get an answer because the underlying data is structured.

That is the entire stack. There is no cloud. There is no vendor. There is nothing I am renting that costs more than the Voyage API fees for embedding new notes (about $4 a month at my current pace).

And the behavioral model — the thing Conway hides inside an API — is not hidden at all. It is a set of files I can read. If I want to know how my AI thinks about me, I open the files. If I want to change how it thinks about me, I edit them. If I want to hand my brain to a different AI tomorrow — drop Claude, pick up GPT, pick up a local Llama — I point the new model at the same folder. The knowledge stays put. The model is the only thing I’m swapping.

The physical analogy I keep coming back to is the obvious one. My biological brain travels with me when I change employers. Nobody expects you to leave your memories at the company when you quit. Iris Murdoch once described consciousness as “singular and secretive” — the cost of being a person at all. But for twenty years of the cloud era, we have accepted a quiet inversion. The thing that accumulates an understanding of how you work is owned by the platform you happen to be using this quarter. Sovereign digital brain is the technical phrase for the alternative. The blunter phrase is: get your mind out of the basement of somebody else’s server room.

Four concrete cases where this matters

Here’s where this stops being theoretical and starts being useful. Four portraits — three about individuals, one about the enterprises that will compete for them.

Case one — the consultant. You move between engagements every six to eighteen months. Under the Conway model, you leave every client with a learning curve, because your professional intelligence is shaped by whatever AI system that client gave you access to, and you cannot take it with you. Under the sovereign brain model, you bring your own brain. You onboard in a day because your agents already know how you think. The client’s private information stays in the client’s vault. But your personal synthesis — the connections your mind made between ideas you saw at two different engagements — that travels with you. It is yours. It is the compounding asset of your career, the way a doctor’s clinical judgment is hers and not the hospital’s.

Case two — the employee worried about AI replacement. Under Conway, the system is learning from you, and every month that passes, the behavioral model inside your employer’s infrastructure gets better at doing the judgment calls you used to be paid for. You are training your replacement, and you do not own any of the training data. Under the sovereign brain model, the inverse happens. You are training an apprentice that belongs to you. If the employer automates your role tomorrow, you walk out with twenty years of accumulated judgment, ready to plug into the next place. The thing that compounded is yours.

Case three — the enterprise that wants the best people. Here is the move that the platform-lock-in camp has gotten exactly backwards. The enterprise that wants to be most competitive for developers and knowledge workers will not lock their brains in. It will embrace the sovereign digital brain. OpenAI was able to clearly see the digital brain of Peter Steinberger, the developer behind OpenClaw — but they weren’t the only ones who could. Arguably more important to Peter’s success was the developer community, who used their own brains to contribute to OpenClaw. That community formed because the cognitive substrate was portable and visible. Locked-in brains do not build communities; they build dependencies. Portable brains build communities — and communities, in the end, build the companies that win. The enterprise that figures this out first will eat the recruiting market for serious people.

Case four — the writer, the researcher, the builder. This is the version I care about personally. You have spent a career making connections between ideas that nobody else has made. Under Conway, those connections are inferences inside a vendor’s model — invisible to you, invisible to anyone who’d want to hire you, gone the moment the subscription lapses. Under the sovereign brain model, the connections are files. Queryable. Exportable. Citable. Your resume doesn’t just claim you are a systems thinker. Your knowledge graph proves it. The hiring manager doesn’t have to trust your claims. They can query your brain.

That is the phrase I keep using with myself, the one I’ll come back to in a future essay because it deserves more than a paragraph: a resume that thinks.

What I haven’t solved — four missing standards

I want to be honest about what the sovereign brain is and isn’t today.

It is a working prototype. It is not a product. I run mine. A few other people I have been talking with for months are starting to run theirs. But there are four things the world does not have yet, and without them, this stays a hobbyist’s architecture instead of a civilizational one.

1. A portability standard

Right now, if I want to move my behavioral context from my system to yours, we have to agree on a file format. I am using Markdown and SQLite and embeddings because they are open and human-readable and reasonably future-proof. But there is no spec. There is no “behavioral context portability standard” the way there’s an HTTP spec or an email RFC.

What such a standard would need to define, at minimum: - A canonical schema for what counts as a “behavioral context object” (notes? agent configs? voice profile? scoring history?) - An interchange format (probably some constrained Markdown plus structured sidecars) - A versioning convention so the spec can evolve without breaking old vaults - A reference implementation so the first ten adopters don’t write ten incompatible things

Somebody needs to write this. The closest thing today is the way the Obsidian community has converged on a de-facto folder convention, but Obsidian itself is a viewer, not a protocol. We need the protocol underneath.

2. A federation protocol

When I join a company, I want my personal vault and the company’s shared vault to talk to each other, with a clear permission boundary, and with contribution tracking so we both know what I added to the shared space when I leave.

There’s a protocol called MCP — Model Context Protocol — that’s a real start. It’s the way Claude and other agents are increasingly connecting to external tools. But MCP is a tool-connection protocol, not a knowledge-federation protocol. It tells an agent how to call a function on a remote server. It does not tell two vaults how to negotiate “you can read these 200 of my notes for the duration of this engagement, you cannot copy them, and when I leave, here’s the audit log of which ones informed your shared deliverables.”

That second protocol is what’s missing. The shape is something like ActivityPub for cognitive context — federation between sovereign vaults, with cryptographic boundaries and revocable permissions. Hard. Worth building.

3. Contract language

If you are an employee or a consultant, your contract probably assumes your employer owns everything you produce while engaged. The default work-for-hire clause does most of this work without anyone reading it. The sovereign brain model requires a legal layer on top — standard clauses that guarantee you can walk out with your personal knowledge graph and your agent configurations.

Nate included draft clauses in his article — the rough shape of what a “personal cognitive infrastructure retention” rider should look like. Lawyers should finish the work. The clauses we need: - Clear definition of “personal behavioral context” as distinct from “work product” - Affirmative retention rights for the employee’s vault - Audit trail requirements for any company-built model that observed employee behavior - A reasonable carve-out for proprietary content the employee was exposed to (it doesn’t come with them, and the contract says so explicitly)

Right now, no major employer offers these clauses. Some will, soon, as a recruiting differentiator. The first one that does will look like Patagonia did in 1985 when it became the first big employer to offer flexible hours.

4. The cultural shift

The fourth missing piece is the hardest. Most people do not believe their behavioral context is worth protecting, because they have never seen what a good one looks like. They cannot imagine what they are losing because they cannot imagine the alternative.

Murdoch again — imagination, she said, is “a kind of freedom, a renewed ability to perceive and express the truth.” Standards get written when enough people can imagine the alternative. This publication, and the YouTube channel I am launching alongside it, is partly my attempt to change that. If I can show you, in essay-length increments, what it feels like to own your own brain — to see your own thinking as a thing you can curate, build on, and carry — maybe enough people will want one that the standards get written.

This is, in the end, the part I think Substack and YouTube can actually do. The technical work has to happen too. But the cultural imagination is the gating constraint, and the gating constraint dissolves one essay at a time.

The question that decides the next decade

Here is what I believe, and I’ll say it as plainly as I can.

The next decade of AI will not be decided by which model is smartest. The models will keep getting smarter. They will also keep getting more interchangeable. The question that will actually shape the next ten years is who owns the brain. Who owns the accumulated, compounding, compressed understanding of how a particular human being thinks, judges, writes, and decides.

If we answer that question with “the platform,” we will live in Conway’s world. Your professional intelligence will be rented, month to month. When the vendor raises prices, you will pay. When the vendor goes out of business, you will start over. When you change jobs, you will start over. When you die, nobody in your family will inherit your intellectual estate, because there won’t be one — just a subscription that expires.

If we answer that question with “the person,” we will live in a different world. One where your digital brain is a portable asset you own for life. One where employers and clients plug into your sovereign infrastructure, not the other way around. One where the model layer is a commodity and your knowledge layer is your wealth.

I have picked my side. I am running a sovereign brain. I am documenting the architecture publicly. And I am going to spend the next year of this publication, and the next year of the YouTube channel, showing you exactly how to build one yourself — or, if you are not technical, how to demand that the systems you use give you one.

Your second brain should be private. Your first one is. Your next one should be too.

Written in collaboration with the Digi-Brain vault and Claude; positions, citations, and structural choices are mine; voice calibrated against my own writing centroid. The companion video — same title, twelve-minute version — is at youtube.com/@justinaharnish.

Notes and references

• The Decentralist Papers (2021) — co-authored. Available on request; a public edition is on the roadmap for Q3 2026.

• Nate B. Jones, Conway: What the Anthropic Leak Actually Showed Us About AI Lock-In — the analysis I’m building on for the “intelligence lock-in” framing. Worth reading in full for the technical detail on the leaked code.

• MCP — Model Context Protocol (modelcontextprotocol.io) — Anthropic’s open standard for tool connection. Useful starting point, not yet the federation protocol I’m describing.

• Voyage AI (voyageai.com) — the embedding provider I use for the vector half of the architecture.

• Iris Murdoch, The Sovereignty of Good (1970) — for the “singular and secretive” line and for the “imagination as freedom” line. The whole short book is worth re-reading every five years.

• Peter Steinberger, OpenClaw — referenced in the developer-community case study. His work on portable developer tooling is part of the same instinct.