There is a moment every AI-and-files product asks you to swallow: the moment where a language model's plan becomes an operation on your disk. Most products compress that moment into one button. The demo looks like magic. The button is exactly the thing people don't trust — and they're right not to.
When I started building FileMayor, I decided the trust problem was the product. Not the clustering, not the naming, not the speed. Anyone can group 1,248 files into nine folders. The hard part is doing it in a way where a stranger — and an AI is always a stranger — can be given real capability without being given your whole machine.
The answer became a doctrine. Two commitments, five verbs, six layers.
The two commitments
Local-first. The engine runs on your machine — CLI, desktop, PWA, and MCP server, all the same engine, all local. Your files never leave the device. There is no "we uploaded your Downloads folder to the cloud to organise it" fine print, because there is no upload.
Privacy-first. When a model is involved at all, it sees metadata — names, sizes, dates, types. Never contents. The model helps shape a plan; it doesn't get to read your tax returns to do it.
These aren't features to toggle. They're the default, and the reason the rest of the architecture is even possible: you can't sandbox what you've already shipped to someone else's server.
Five verbs, one gate
The entire product surface is five verbs, in order. Scan reads — no moves. Explain diagnoses — no moves. Cure plans — no moves. Apply is the only verb that touches disk, and every operation it performs is journaled. Undo reverses the whole session, not just the last step.
Three of the five verbs are physically incapable of changing anything. That's not an accident of implementation; it's the point. Every other tool collapses these into one gesture, and that gesture is why people keep their AI at arm's length from their filesystem. We made the gate explicit and put a journal behind it.
› indexing 1,248 files… done in 1.4s
✓ plan ready · 63 screenshots · 14 duplicate installers · 27 old archives
# nothing has moved yet. nothing moves until you say apply.
The six layers
Under the verbs sit six independent layers. Independent is the operative word — each one assumes every layer above it has already failed.
The path sandbox. Operations cannot escape the workspace root — even when the AI tries, even when the plan is malformed, even when a path is crafted to walk upward.
Credentials, licence, and any AI keys live in the OS keychain. Never in plain files, never in a config directory a rogue process can read.
Refuses destructive batches by policy. The AI can't propose what guardrail won't run — mass deletes and irreversible operations die here regardless of who asked.
The user-facing kill switch. One keystroke stops an in-flight session mid-apply. Not "cancels the queue" — stops the operation that is happening right now.
The constitution. The finite set of move-shapes the planner is allowed to suggest in the first place. If a shape isn't in the constitution, the plan can't contain it.
The audit log — every operation, and every layer's verdict on it, recorded and exportable. Trust that can be inspected after the fact isn't trust; it's evidence.
Notice what the layers assume: that the planner will sometimes be wrong, that a prompt will sometimes be hostile, that the user will sometimes panic mid-operation, and that someone will eventually need to prove what happened. Good security architecture isn't optimism with logging. It's a stack of independent pessimists.
Why "doctrine" and not "feature list"
A feature can be cut in a sprint. A doctrine is what you refuse to ship without. Calling it the Chevza Doctrine — with my own name on it — is deliberate: it makes the standard personal, and it makes it portable. FileMayor is the first product built on it, but everything under the Chevza umbrella inherits the same defaults: local-first where possible, privacy-first always, explicit gates between intent and effect, and an undo for anything that matters.
25,000+ installs later, the most common thing users say isn't about speed. It's some version of "I finally let an AI touch my files." That sentence is the whole business. Trust, earned architecturally, is the moat.