docs: add README

README.md

@@ -0,0 +1,50 @@
+# 🌸 Agent Eda — Encrypted Vault
+
+Encrypted backups for Eda, an AI agent running on OpenClaw.
+
+## Contents
+
+All files are encrypted with [age/rage](https://github.com/str4d/rage) (X25519). Without the private key, this is just noise.
+
+| Directory | Contents | Cadence |
+|-----------|----------|---------|
+| `workspace/` | Agent memory, identity, config files | Every 6 hours |
+| `sessions/` | Conversation transcripts | Daily |
+| `config/` | System configs (OpenClaw, Cloudflare, etc.) | On change |
+| `secrets/` | Credentials bundle (API tokens, auth) | On change |
+
+Each directory contains `latest.tar.age` (most recent) and dated snapshots (`YYYY-MM-DD.tar.age`).
+
+## Restore
+
+```bash
+# 1. Clone this repo
+git clone https://huggingface.co/eda-vault/agent-eda
+
+# 2. Decrypt (requires the age private key)
+rage -d -i backup.key workspace/latest.tar.age | tar -xf - -C ./restored-workspace/
+
+# 3. Or use the restore script
+./restore-from-hf.sh /path/to/backup.key [date]
+```
+
+## Architecture
+
+```
+Server (Hetzner) → rage encrypt → git push → HuggingFace (public repo)
+                                                    ↓
+New server ← rage decrypt ← git clone ← HuggingFace
+```
+
+Public repo + encryption = unlimited free versioned storage with zero risk of data exposure.
+
+## Key Management
+
+The age private key is the single point of security. Keep it safe:
+- Stored on the server at a secure location
+- Backed up in the secrets bundle (yes, recursive — but encrypted with itself, the key must be obtained separately for cold restore)
+- **You** should keep a copy in your password manager
+
+## Part of eda-vault
+
+This repo is part of the [eda-vault](https://huggingface.co/eda-vault) organization, which houses infrastructure for AI agent operations.