Fleet & Sync

askTheodor runs on your machine — but it doesn’t have to run on only one. Fleet & Sync lets you pair several installs together so they share work, mirror their workspaces, and hand jobs to one another. The classic setup: your laptop as a hands-on command center, plus an always-on box (a small server) that keeps Plans and Routines running 24/7.

The pieces

• Instance — one running install of askTheodor. Each gets a stable instance ID the first time it launches, so peers can always recognize it.
• Peer — another instance yours is paired with. Every install keeps a small registry of its peers — each peer’s address, its shared key, and what it’s allowed to do.
• Sync — keeping workspaces aligned by pulling and pushing rows between peers (mirror one machine, or share a workspace across several).

Paired securely

Instances talk over a tunnel — a public web address (via Cloudflare or ngrok) that lets two machines reach each other across the internet. Because that address is public, every request between peers is HMAC-signed with a 256-bit pre-shared key established once during pairing. In plain terms: each message carries a tamper-proof stamp only the two paired machines can produce, so no one else can impersonate a peer or forge a request.

Least-privilege scopes

When you pair a peer, you grant only the powers it needs — nothing more:

• sync — pull and push workspace rows.
• delegate — run a task on this instance.
• kafenio — read and post in the tavern.
• keys — receive encrypted provider API keys.
• full — a trust-everything wildcard for machines you fully own.

So a peer you only want to mirror data with never gains the right to run tasks or read your keys.

Looking inside and renaming machines

Coming in the next update

This arrives in askTheodor 0.9.283. If you’re on an earlier version you won’t see it yet.

• 🔭 Inspect shows what a paired machine is doing and has done: an overview, its tasks, the work its workers did (conversations with their latest answer), and the artifacts they produced (work products, files saved to the Library, and workspace files such as exports and letters). You can preview a file, or copy it to this machine. Inspect is read-only and needs the sync scope: a machine that may already mirror your workspace may also look at it.
• ✏️ Rename changes a machine’s name. For a paired machine, the new name is set here and, when the machine is reachable with the sync scope, on the machine itself too. You can also rename this machine, which is the name your other machines see.

Both use the same signed requests as sync. Details are on the Fleet screen.

Where to set it up

Pairing, scopes, and sync settings live in the app’s Peers panel and the Fleet screen. For the bigger picture — command centers vs always-on hubs, who’s the master, and running unattended — see Teams & remote.

Grant only what’s needed

Scopes are deliberately narrow. Give a peer full only when it’s a machine you completely trust (one of your own boxes); otherwise grant the specific scopes the job requires.

In practice

Scope-granting rule of thumb: sync for a machine that should only mirror data, delegate when it should also run work you send it, full only for a box you own outright. Scopes are symmetric in effect — grant the narrowest one that makes the job possible, and widen later if it turns out to be too tight.

A Team-Hub is worth it when work must continue without you — long jobs that outlive your working day, monitoring that can’t pause when a laptop sleeps, or overnight drafting you review in the morning. If your routines already run fine while your laptop is open, you don’t need one yet.

A paired hub can’t spend or send. Its channels are draft-only and its approval gate auto-denies anything outbound while headless. That’s the safety model, not a limitation to work around: put producers (researchers, writers) on the hub and keep reviewers and the actual send on your Command Center.

Pairing needs reachability. Two machines must be able to see each other — over a local network or through a tunnel. If pairing fails, that’s the first thing to check, before scopes or keys.

🎓 Learn it hands-on: Fleet: a Team-Hub on a VPS · See what your VPS did today

Terms in this page

• Fleet — several paired askTheodor instances working together across machines.
• Instance — one running install of the app, identified by a stable instance ID.
• Peer — another instance yours is paired with; tracked in a small per-install registry.
• Sync — aligning workspaces between peers by pulling and pushing data rows.
• Tunnel — a public web address (via Cloudflare or ngrok) that lets two machines reach each other over the internet.
• HMAC / pre-shared key — a shared secret used to stamp each request so peers can verify it’s genuine and untampered; established once during pairing.
• Scope — a granted permission (sync, delegate, kafenio, keys, or full) that limits what a peer may do, following least-privilege.
• Least-privilege — the principle of granting only the minimum permissions needed.
• Delegate — to run a task on a remote instance rather than locally.
• Inspect — a read-only look inside a paired machine’s tasks, work and files; needs the sync scope.
• Command center / hub — a hands-on machine vs an always-on one; see Teams & remote.