Debrify treats WebDAV as a small, user-owned coordination layer. Each device publishes immutable encrypted sections into its own directory, then moves one manifest to make those sections visible. Peers authenticate the manifest, merge records deterministically, apply the result locally, and publish the same converged view from their own directory.
The server stores. The clients decide.
There is no central Debrify service in the loop. A phone, desktop and TV all run the same merge logic and use a normal WebDAV folder as their meeting point.
The service does not need Debrify-specific code. It needs ordinary WebDAV reads, writes, collection listing, and predictable read-after-write behavior.
Per-device ownership
Each device normally writes only its own directory, avoiding cross-device write conflicts even on providers with weak ETags.
Convergence over authority
Every active device eventually carries the full merged hot state. A single surviving device can keep that state alive.
Local-first behavior
App writes finish locally. Network errors become sync status, not failures in the action the person just took.
A small root, private manifests, immutable pieces.
The fixed layout keeps discovery cheap and publication atomic. Content hashes make large objects reusable and let readers verify every byte they download.
circle.authority # standing sync identity devices/ <device-id>/manifest.enc # commit record <device-id>/sections/ <sha256>.enc # immutable metadata objects/ <sha256>.enc # shared bootstrap archive
The authority object establishes one sync identity for the folder. Each manifest lists section names, content hashes, semantic digests, timestamps, schemas and sizes. A peer only reads a section when its manifest reference changes.
Bootstrap
A file-backed snapshot used to set up a new device: profiles, sealed connection resources, portable preferences, databases and attachments.
large · shared objectGraph
The structural map of profiles and resources. It changes much less often than watch progress or settings.
structure · revisionedHot state
Frequently changing records: portable settings, playback, playlists, connection metadata and other per-record state.
small · mergeableTombstones
Explicit deletion records. Missing data never means “delete,” so an incomplete read cannot erase valid local state.
replicated · retainedRead, merge, apply, publish.
A cycle is deliberately symmetrical. A device consumes every eligible peer view, folds it into local state, then publishes the converged result from its own directory.
Pin the root
Read the authority object and require the exact identity the device previously accepted. A missing or changed root stops the cycle.
Discover peer manifests
List device directories, authenticate bounded manifests, reject future or regressed timestamps, and calculate which sections changed.
Open and verify sections
Download only referenced changes. The content hash, AES-GCM tag, circle, author, logical name and schema must all agree.
Merge with a captured local snapshot
Resolve each record with deterministic rules. A profile switch or authorization change during the cycle aborts the apply.
Apply one batch
Write accepted records verbatim, preserving their provenance. A crash marker makes the batch safe to replay before another diff is built.
Publish the converged view
Canonicalize IDs, suppress unchanged semantic digests, upload new immutable bytes, then replace this device’s manifest last.
The newest record wins—with provenance attached.
Debrify does not merge a whole settings map under one timestamp. Every portable scalar and record carries its own time and origin so changing one setting cannot make an unrelated stale value look new.
Older clients cannot drop fields they do not understand simply by winning another field.
Equal normalized times compare origin device ID, then the canonical record hash.
Deletes replicate explicitly and are kept for 90 days after first publication.
After 30 days a manifest leaves the live hot-state union, while bootstrap discovery still considers it.
Large clock jumps pause stamping until repeated evidence makes the new offset credible.
Synced watch state enters the existing reconciler; Trakt or Simkl still outrank local state when configured.
The pointer moves last.
The most useful invariant is also the simplest: upload dependencies before the file that makes them visible. Readers see either the prior complete generation or the next complete generation.
Canonical payload and semantic digest.
New content-addressed immutable section.
Verify bytes, size, hash and authentication.
One small pointer update exposes the generation.
Creating a brand-new sync root is stricter. Debrify first proves exact read-after-write behavior with a disposable sentinel, uploads and verifies a complete seed, writes the device manifest, and commits circle.authority last. If two devices initialize at once, both read back the standing authority and converge on the winner.
Fast when it matters. Quiet when it doesn’t.
Local changes push quickly; cheap manifest validators look for remote work. TVs pause cycles during playback and under the tvOS low-memory gate.
The first write opens a bounded window; later writes join it rather than resetting it forever.
Five seconds during an active handoff, backing off through 10 and 15 seconds when nothing changes.
Progress churn gets a longer window; pause and settled seek can flush immediately.
A safety net for changes that produce no immediate trigger.
The benchmark isolates file encryption, decryption and hashing on an Apple M5 Max. It excludes network time, key derivation, snapshot creation and UI work; it demonstrates allocation behavior, not end-to-end sync speed on every device.
Authenticated on the client. Candid about trust.
Every document is encrypted and authenticated before upload, but the automatic setup model deliberately stores the machine-generated opening secret in the same WebDAV account.
What client-side AEAD guarantees
AES-256-GCM detects changed bytes and binds each section to its sync root, device, logical name and schema. Content hashes catch truncation and wrong-object responses.
What stays on each device
WebDAV credentials and the accepted sync secret are sealed with the platform key store. Credentials are scoped to the chosen origin, and unsafe redirects are refused.
This is not zero-knowledge storage
A provider—or an attacker able to read the whole sync folder—can obtain the authority object and its opening secret. Account security and HTTPS remain part of the confidentiality boundary.
What tampering cannot do silently
A changed root, malformed authority, invalid tag, hash mismatch, future schema or regressed manifest stops or excludes that input instead of turning it into local deletes.
Custom http:// endpoints remain available for local-network servers, with an explicit insecure-connection warning. “Forget device” removes protocol bookkeeping; it is not cryptographic revocation while that device still knows the WebDAV credentials.
A portable state model, not a disk clone.
Debrify syncs the state that lets a person continue across screens. Hardware choices, local paths and rebuildable caches stay with the device that owns them.
That boundary is why a phone can share progress with a television without also forcing the television’s navigation layout or the phone’s storage permissions onto another device.
Immutable data first. Manifest last. Merge everywhere.
WebDAV supplies the storage primitive. Debrify supplies identity, integrity, convergence and recovery—on every device, in the open.