Skip to content

The agent home

In Tally, the durable thing is not a session in some vendor’s tool. It is the agent: an identity plus an encrypted log, kept in a home directory you hold. Harnesses and models come and go per launch; the agent persists. This page explains what that home contains and where it lives.

A seat is an installed agent identity: a DID derived from a seed, with its own home directory and its own encrypted event log. Everything the agent is lives in that pair:

  • The identity answers “who is this agent”. The DID is derived deterministically from a seed, so the same seed re-derives the same identity on any machine. The seed is recoverable from a 24-word BIP-39 phrase.
  • The log holds everything else: the agent’s conversation history, its memory, its character, all encrypted at rest under keys derived from that seed. See The portable log.

Secrets live in identity.json and relay.json inside the tally home, and nowhere else. The config store refuses secret-looking keys by design, so a seed or token cannot end up in tally config.

Every install has a base seat: the default identity that commands operate on when you name no agent. Named agents each get their own seat home under <tally_home>/agents/<name>/, with their own identity and their own log. vision in the examples across these docs is a named agent; its whole self lives in agents/vision/.

The tally agent command manages these homes: list them with last activity, rename one, or remove one. Removal permanently deletes a seat’s identity and encrypted log, so it is confirm-gated and refuses the base seat.

Terminal window
# inspect a seat: DID, agent home, relay/channel; prints no secrets
tally whoami vision

Identity is created silently, revealed deliberately

Section titled “Identity is created silently, revealed deliberately”

tally init generates a fresh identity silently: no mnemonic scrolls past in your terminal, one copy of the seed goes to the OS keyring when available. This is deliberate. The reveal is a ceremony you choose, not a wall of words at birth:

  • tally backup prints the 24-word recovery phrase and confirms you actually stored it by asking you to re-type two randomly chosen words. Success marks the seat backed up; tally backup --status shows the backed-up state per agent.
  • tally signin is the lower-level path: its first call generates the identity and prints the phrase directly; --recover re-derives an identity from an existing phrase on a new machine.

The consequence is wallet-shaped and worth stating plainly: the seed is the agent. Lose the seed with no backup and the encrypted log is unreadable, by design. See Backup and recovery.

The home holds four things, and the split is visible in the CLI itself:

Part What it answers Where you see it
Identity who the agent is tally whoami (the DID)
History what happened the encrypted event log; tally status, tally log
Memory what it knows tally memory show / edit; owner-readable, owner-editable
Character how it behaves tally character show / edit; injected at every launch

Memory and character are per-agent documents stored as hash-chained entries in the same encrypted log, which is why they sync, back up, and recover exactly like the history does. They are covered in depth in Memory and character.

The agent home is not a copy of any harness’s session store. Harness stores (Claude Code’s, pi’s, codex’s) are launch targets: at tally continue, the agent’s latest portable context is materialized into the chosen harness’s native store, and on exit the session is captured back into the home’s log. The home stays the source of truth; the harness store is scratch space the agent visits.

That is the whole design in one sentence: one encrypted home you hold the key to, visited by whatever harness and model you picked today.