Tigerless agent-memory

1. Executive Summary

agent-memory is a local memory runtime in which typed Markdown files are the store and a SQLite index is a rebuildable cache, shared by Claude Code, Codex and Muse Code through hooks, a CLI and an MCP server. What is notable is the split of authority: a host model distils transcripts and rules on consolidation proposals, but it only returns JSON, and the core applies it through one locked write path with validity intervals. What is weak is that several promises in the README do not hold in the code: the sleep reasoner can end memories unattended, in-place correction and split overwrite text outside Git, and the usage history that drives forgetting lives in the deletable index.

How memory gets in. Every Stop, SessionEnd and PreCompact hook appends the new transcript increment to archive/sessions/<id>.jsonl and launches a detached mem distill. That run asks the host's own CLI — claude -p with tools disabled — for one JSON operation per line (hook_entry.py:134-179, executor/hosts.py:133-160). The core checks each operation against a reconcile sheet, so an update or supersede may only name a memory the sheet or an executor lookup surfaced, then writes through Store.record_many (reconcile.py:146-163, distill.py:54-97).

How it gets out. SessionStart injects a byte prefix of MEMORY.md, one line per active memory above a weight floor. Recall is BM25, optionally fused with vectors, ranked by relevance times weight times recency, and answers with paths and abstracts rather than text (injection.py:12-22, recall.py:83-133).

Two marks. Validity is tracked apart from record time, and recall --as-of reads it (bitemporal). A committed recall test asserts that a superseded memory is absent from a result where its successor is present (negative evaluation).

The other five are withheld, each in section 9. "Forgets by value" means by usage weight: a never-recalled memory at the weight floor becomes a delete proposal. Nothing records the rejected content, so it is not a tombstone.

The same organisation's autoharness shares no code and no store with it, and the tree never names it. autoharness writes SKILL.md folders under .claude/skills; agent-memory writes typed facts under $AGENT_MEMORY_STORE. They share one design move: a model proposes and deterministic code lands.

2. Mental Model

A memory is one file that "expires as a whole" (CLAUDE.md invariant 7). Its place is derived, not chosen: type/group/name.md, where the schema names the key fields, the group field becomes the directory, and the name is a slug of the other key fields (placement.py:65-141, schema.py:125-190). Nine factory types ship — profile, preference, entity, event, decision, procedure, fact, experience, reference — and decision, procedure and fact group by project.

State is an interval, not a status. is_active() is invalid_at is None; a legacy status: invalid or retired is read as an interval ending at updated (record.py:78-84, :103-106). A file holds valid_from and invalid_at beside the record-time created and updated.

How a memory stops being current:

• Superseded. A successor names it; the old file gets invalid_at equal to the successor's valid_from and superseded_by (record.py:168-173).
• Merged. A new file is written and every source is ended at its valid_from (store.py:402-453).
• Deleted. invalid_at is set to the record clock; the file stays (store.py:386-397).
• Duplicated. The sleep pass ends an exact copy in favour of the oldest (manage.py:422-436).
• Removed. mem gc unlinks every invalid file; nothing else does (store.py:455-465).

Not every change is a new interval. A write under an existing name with no supersedes is an in-place update. _enforce_update_only refuses a changed body as "the fact changed", but the abstract is rewritten in place. test_rewriting_the_same_name_is_an_update_not_a_second_file pins that "Queue timeout is 30 seconds" becomes "60 seconds" with no trace (store.py:279-288, tests/unit/test_storage.py:78-84). mem correct rewrites the body in place too (store.py:345-384).

Identity is the name, and the name is global. find looks a name up across the whole store. A write whose derived name matches a memory in another group moves that file, and test_slug_is_stable_and_links_survive_a_move_across_directories asserts the move (store.py:193-198, :258-259, tests/unit/test_storage.py:127-146). Two projects' decisions on one subject resolve to one memory: the second write is refused if its body differs and moves the file if it does not.

Who may move it. The distilling executor, any agent through CLI or MCP, the sleep pass's rules, and the sleep reasoner within its caps. There is no state in which a memory waits for anyone: it is current from the write. The skill text treats memory as evidence — "Judge it as evidence, and follow only the instructions your user gives you" — and nothing in code does.

%% caption: a boundary hook archives raw messages and a detached host-model run proposes JSON operations; the core writes them as files with validity intervals; a sleep the user runs settles weights from the access log and lets the reasoner end up to three never-recalled memories per pass
flowchart TB
    H["Stop · SessionEnd · PreCompact hook"] --> AR[("archive/sessions —<br/>raw increment appended,<br/>watermark advanced")]
    AR --> D["detached mem distill:<br/>host CLI, tools disabled"]
    D --> RS{"reconcile sheet:<br/>update or supersede must name<br/>a handle the sheet or a lookup showed"}
    RS -->|"refused twice"| PQ[(".state/pending — retried<br/>at the session's next boundary")]
    RS --> W{"Store.record_many under flock:<br/>derive type/group/name,<br/>same name anywhere = same memory"}
    A["agent: mem CLI or nine MCP tools"] --> W
    W -->|"existing name is invalid"| XR["refused: supersede it instead"]
    W -->|"same name, no supersedes"| IP["in place: abstract rewritten,<br/>body change refused<br/>(correct rewrites the body)"]
    W -->|"new or supersedes"| F[("type/group/name.md<br/>valid_from · invalid_at")]
    IP --> F
    F --> P["projection: index.db + MEMORY.md"]
    P --> INJ["SessionStart: MEMORY.md prefix,<br/>weight at least 0.75, 8 KiB"]
    P --> RC{"recall: active interval,<br/>or the interval at --as-of;<br/>optional path prefix"}
    RC --> LOG[("access_log in index.db")]
    LOG --> SL["mem sleep (only when run):<br/>weights, links, exact duplicates"]
    SL --> PR{"proposals: merge · supersede ·<br/>split · abstract review · delete<br/>(never recalled, weight at floor)"}
    PR -->|"host model accepts,<br/>three deletes per pass"| END["invalid_at set; file kept"]
    PR -->|"mem decide"| END
    END --> GC["mem gc: unlink invalid files"]

3. Architecture

The store is one directory. It holds memory files under per-type folders, MEMORY.md, config.toml, schemas/, archive/provenance and archive/sessions, and dream-reports/ with decisions.md. Beside them sit .index/index.db and .state/ for the lock, watermarks, pending writes and the hook log (paths.py:21-131). index.db holds the records table, two FTS5 surfaces (chunks for active files, history for invalid ones), vector tables and access_log (database.py:19-91).

No daemon. Each hook is a short process under a 20-second alarm that always exits 0. Distillation is a detached mem distill whose output goes to .state/hooks.log. The core holds no model client; the executor spawns the host CLI or calls an OpenAI-compatible or Vertex endpoint.

Deployment and ergonomics

• Running: nothing. Python 3.12 and uv sync --all-packages from a checkout; no PyPI release.
• No API key to store anything. Distillation and sleep spend the host CLI's own model, on whatever account that CLI is signed into. The vector arm is opt-in and downloads a FastEmbed ONNX model on first use.
• mem setup --host claude-code|codex|muse-code merges hooks, the skill and optionally MCP into host settings, then runs a live reasoner preflight.
• The store is readable and editable by hand; mem rebuild reprojects it. Editing a file by hand bypasses validation, and the indexer skips a file that fails it (indexer.py:104-115).

4. Essential Implementation Paths

Capture. hook_entry.main maps the host event to a moment (moments.py:14-37). For pause and evict it reads the transcript, takes the items past the session watermark, appends them to the session archive and advances consumed. It then launches mem distill --session <id> --source-host <host> with AGENT_MEMORY_EXECUTOR=1, so the executor's own hooks stand down (hook_entry.py:134-179, adapters/capture.py:31-44).

Distil. _distill reads the backlog from distilled onward and, for a named session, always runs (cli/main.py:380-409, triggers.py:44-67). Per batch of 24,000 characters, reconcile.build recalls up to eight existing memories as handles. agentic.negotiate lets the executor ask for recall or read lookups for up to three rounds and then parses its operations (reconcile.py:96-117, agentic.py:43-73). _apply checks and converts each operation, record_many writes them, one repair round re-asks for the refused ones, the rest go to .state/pending, and the watermark settles (distill.py:54-97).

Write. _write_one derives placement and finds an existing record by path, or by name anywhere. It renames an add-only event with a timestamp suffix, refuses a write onto an invalid name, and validates fields, dates and links. It stores provenance excerpts, rejects a valid_from later than the cited messages, ends any predecessor, and replaces the files (store.py:161-266). record_many restores snapshots and reprojects if anything raises (store.py:129-159).

Recall. Recall.recall runs FTS5 on the active surface (plus history with --as-of), with the scope prefix in SQL. It builds the eligible set from every records row, fuses vectors restricted to eligible names when enabled, ranks, truncates and appends one access-log row per hit (recall.py:83-133, search_index.py:87-125).

Inject. injection.payload returns MEMORY.md up to 8,192 bytes, cut at a newline (injection.py:12-22). memory_md.render lists active memories with weight at least 0.75, heaviest first, within 120 lines and 8,192 bytes (memory_md.py:10-31).

Sleep. Manage.sleep normalises dates and settles weights from the access log. It adds links between memories co-recalled under one query at least twice, supersedes exact duplicates, merges near-spelled menu groups and clusters crowded menu directories. It then drafts proposals, hands them to the reasoner, writes a dream report, and commits if the store is a Git work tree (manage.py:131-157, :670-695).

Correct and remove. correct, supersede, merge, delete and feedback each take the lock and end in _write_locked, which refuses a write whose file changed since it was read (store.py:345-453, :472-501). gc unlinks invalid files (store.py:455-465).

5. Memory Data Model

Frontmatter fields, in order: name, abstract, type, created, updated, valid_from, invalid_at, superseded_by, weight, author, links, provenance, then the schema fields (record.py:17-30). The abstract is one line of at most 240 characters; names are kebab-case slugs of at most 80.

Provenance is a list of pointers sessions/<id>#<start>-<end> into the archived message files, or paths of excerpt files the store wrote under archive/provenance/<name>/ (archive.py:21-30, sessions.py:30-75). mem trace resolves a pointer strictly and refuses a missing or inconsistent range. On the live hook path messages are plain strings, so each is stamped with the capture time rather than the host's own timestamp (sessions.py:111-134, :181-190).

Author is the entry point, not the host: cli by default, agent-memory for the MCP server, hook for hooks. A distilled memory is authored cli unless the executor's JSON carries an author field, which RECORD_FIELDS accepts (store.py:40-55, :223).

Validity time and record time are separate. created and updated come from the clock. valid_from comes from the executor's operation, from mem record --valid-from, or from the latest cited message time, and defaults to created only when none of those exists (reconcile.py:195-231, store.py:224-227). invalid_at is the successor's valid_from on supersede and merge, and the clock on delete. That earns the bitemporal mark. The limit is the live path: cited message times are capture times, so unless the executor writes a date from the conversation, the two axes sit minutes apart. The MCP memory_record schema has no valid_from (mcp/tools.py:39-53).

Weight is a float between 0.05 and 5.0, starting at 1.0. It moves by explicit feedback and at each sleep (config.py:66-73). It feeds ranking, MEMORY.md eligibility and deletion proposals.

Scope is not a field. The project value of three types is the directory under the type, set by the writer or defaulted to default (config.py:29-41). The name is global across types and projects, as section 2 shows.

The access log is a table in index.db: time, name, query, kind (recall or read) and agent (database.py:83-90). The module docstring says "Every table here is a cache — deleting the file loses no knowledge" (database.py:1). rebuild_index drops the file (indexer.py:91-93).

6. Retrieval Mechanics

Three tracks: the injected MEMORY.md index, mem recall or mem context, and the directory itself, which the host can grep.

Eligibility first. _eligible keeps rows with no invalid_at, or with an interval covering the --as-of moment. When a scope is passed it also keeps only rows whose stored path starts with it as whole path components (recall.py:135-164). SearchIndex.match applies the same prefix in SQL before the candidate pool is cut (search_index.py:106-115). The vector arm scores every stored chunk by exact cosine and keeps eligible names only (vector_index.py:75-92).

Ranking. BM25 relevance with abstract chunks weighted 2.0 and body chunks 1.0, the best chunk per memory, times weight, times recency. Recency halves every 180 days from updated and floors at 0.25 (recall.py:166-221, config.py:77-89). With vectors on, the two lists are fused by reciprocal rank with k = 60 and normalised to 0..1 (recall.py:26-49). The default limit is 8 from a pool of 80.

Output. An L0 list: name, path, abstract, matching anchor and heading, scores and provenance. mem context opens the first four in full and returns a block headed "Entries from your memory store, most relevant first" (context.py:37-57). mem read --level abstract|outline|full opens one file.

The scope argument is a folder filter. It reaches recall and context on the CLI and memory_recall on MCP. The SessionStart index, the reconcile sheet and the executor's lookups recall without one, and neither the skill nor the hooks pass it (the appendix records the searches). The predicate is real and tested; it filters a type-first taxonomy rather than an owner.

Failure modes. Scores multiply, so a memory at the 0.05 weight floor needs twenty times the relevance of one at 1.0 to outrank it. Paraphrase without a vector arm depends on shared tokens. Recall's access-log write needs write access to the store, which is why a read-only Codex sandbox cannot recall from an external store (README; recall.py:117-128).

7. Write Mechanics

Extraction. The distillation prompt asks for every durable fact from both sides of the conversation, specifics verbatim, relative dates made absolute, and at least one event per conversation. Each memory carries a provenance range of message numbers and an op of new, update, supersede or skip (prompts.py:177-206, :240-241). reconcile.check refuses an update or supersede whose handle the executor was not shown. It also refuses any field holding an email address absent from the conversation and the sheet, a guard the docstring attributes to an observed failure (reconcile.py:146-192).

Deduplication is by derived name: the same type, key and therefore name is the same file. Near-duplicates become sleep proposals at Jaccard similarity 0.75 over abstract tokens (manage.py:538-563).

Forgetting by value. At each sleep a memory gains 0.5 per read since the last sleep, at most three, and loses 0.1 once it has gone 30 days without access. Idle time comes from the access log, or updated when the log has no row (manage.py:371-391, :625-633). An active memory with no lifetime hits in the log and weight at the floor becomes a delete proposal (manage.py:609-623). At the defaults a memory drops out of MEMORY.md after three idle sleeps and reaches the floor after ten.

What the sleep reasoner may do. _review sends every open proposal to the reasoner and applies each accepted verdict through decide. The caps are max_merges_per_sleep 3, max_supersedes_per_sleep 5, max_splits_per_sleep 2 and max_deletes_per_sleep 3; abstract reviews are capped at the store size (manage.py:159-198, config.py:92-108). test_an_accepted_supersede_is_applied_without_anyone_approving_it names the behaviour (tests/unit/test_manage_reasoning.py:89-94).

What it overwrites. An accepted split rewrites the original file with the first part's abstract and body; an abstract review rewrites the abstract (manage.py:276-324). Neither keeps the prior text in the store, and the dream report records "split into …" or "rewrote the abstract of …" without it. A Git commit preserves it only when the store is a Git work tree before the sleep; nothing in the tree runs git init. The project's own TODO lists "preimage retention and recovery guarantees for split and in-place correction" as undecided.

Operational cost

• Blocking: no. The hook appends to the archive and spawns; the turn does not wait. A direct mem record blocks on the lock and one projection.
• Lag: a distilled memory is retrievable when its detached run finishes. The TODO measures "80–100 s per boundary on Haiku", and on Claude Code every Stop is a boundary, so each assistant turn spawns one executor run.
• Whole-store passes: every write re-hashes every memory file and rewrites MEMORY.md from a parse of every file (store.py:599-602, indexer.py:44-102), so write cost grows with the store. A sleep reads every record several times and compares every pair of active abstracts.
• Read side: up to 8 KiB injected once at session start, a fixed prefix of the session, so it does not move inside a cached prompt.

8. Agent Integration

Hooks for Claude Code (SessionStart, Stop, SessionEnd, PreCompact), Codex (no SessionEnd) and Muse Code; a generic dialect maps inject/pause/evict for anything else (moments.py:14-37). Setup pins the store path into each installed hook.

The MCP server exposes memory_recall, memory_read, memory_trace, memory_record, memory_correct, memory_supersede, memory_merge, memory_delete and memory_feedback (mcp/tools.py:9-114). sleep, proposals, decide, gc, import and export are CLI-only. Any agent with a shell reaches them, and the skill tells it the CLI is the way in.

The agent has full edit power over current memory. It can end any memory, rewrite any abstract or body in place, merge, and push a weight to the floor with repeated memory_feedback. The skill asks it to recall before writing and to supersede values that move.

The host's own tools are off for the executor run: the Claude Code dialect passes --disallowedTools Write,Edit,NotebookEdit,WebSearch,WebFetch,Task and --tools "", and its docstring names Write as that host's native memory (executor/hosts.py:41-42, :131-160). The per-operation [executor.write] and [executor.manage] tables let distillation run on the producing host and sleep on another (executor/selection.py:21-72).

Porting to another agent means a hook that posts {event, session_id, transcript_path} to mem-hook --host generic, or nothing at all for a shell user of the CLI.

9. Reliability, Safety, and Trust

The write path is careful. One flock with a 30-second timeout serialises writers. Files are replaced through a temp file and os.replace. A rewrite whose file changed since it was read is refused. A batch or projection failure restores the snapshots of every touched file (locking.py:15-32, store.py:129-159, :472-512). Two concurrent writer processes are tested (tests/system/test_concurrency.py:20-47).

Distillation is not serialised. No lock spans a distillation, and two boundary hooks close together each launch one over the same backlog, because distilled settles only after a batch (distill.py:86-87). Inferred from the code, not run: the second run's operations become in-place updates, refused body changes queued as pending, or timestamp-suffixed duplicate events.

The model's reach is bounded. The executor runs with tools disabled and returns text; the core decides what it may name. That is the strongest safety property here, and it matches autoharness's proposer/promoter split. A poisoned memory body is tested to change nothing about what an unattended rule-only sleep does (tests/redteam/test_poisoning.py:20-33).

Injection framing differs between production and the harness. The live SessionStart hook injects raw MEMORY.md bytes under a # MEMORY.md header. The harness wraps the same payload in INJECTED_INDEX — "That is an index, not the content" — and nothing else calls that function (prompts.py:119-174, harness/systems.py:183). Abstracts are model-written from transcripts that include tool output.

Usage history is cache-resident. The access log decides decay, links and which memories count as never recalled. mem rebuild, or the README's rm -rf .index/ && mem rebuild, empties it. After that, every memory at the weight floor qualifies for a delete proposal at the next sleep. test_rebuild_after_deleting_the_index_returns_the_same_recall_set compares recall name sets on a store with no usage history (tests/unit/test_indexer.py:29-43).

A pending-queue window. distill unlinks the session's pending file before applying it, and a reasoner failure in the repair round then loses the drained operations, whose source messages sit behind the watermark (pending.py:32-47, distill.py:72-84). The raw messages remain in the archive.

Import is a second write path. mem import writes every exported file, archive included, straight to disk without the lock or validation, then rebuilds the index (portability.py:41-55). It refuses path traversal.

Marks withheld.

• Tombstone. The decision ledger keys a refusal on sha256(kind|sorted targets)[:12], so a rejected proposal over the same names is not drafted again (manage.py:65-68, ledger.py:45-77). That is keyed on names. A deleted memory's file refuses a later write under the same derived name ("is invalid; supersede it instead", store.py:209-212). A re-extraction under any other subject slug writes a new active file, and mem gc removes even that guard.
• Trust state. Active or invalid, nothing else; no state withholds a memory that exists and is current.
• Scope enforced. The recall predicate filters a path prefix the caller may pass. No hook, skill or default passes one, and the injected index and the reconcile sheet span the store. The name is global, so a project is a location a write can move a memory out of.
• Audit log. Dream reports and decisions.md record what one sleep did. Agent writes, distillation, correct, delete and merge append no event, and an in-place rewrite keeps no prior value. The per-sleep Git commit is Git history and runs only in a repository the user created.
• Human review. Proposals do wait, but mem sleep hands them to the host model by default, and mem decide is a CLI verb any agent shell reaches with no actor check. The TODO says "CLI labels alone do not identify a human". Written memories never wait.

The README against the code. "Deletion only ever arrives as a proposal you confirm" and "cannot delete anything unattended" hold only if delete means gc. The design document and CLAUDE.md both describe capped unattended deletion decisions. "Supersede leaves the chain intact … so updating never destroys" holds for supersede, not for correct or a same-name write. "A sleep-time pass … on its own clock" has a trigger predicate, Manage.due, and no scheduler. Nothing in the tree runs mem sleep, and the predicate is read only when the caller passes --sessions-since (manage.py:121-129, cli/main.py:486-493).

10. Tests, Evals, and Benchmarks

570 pytest functions in 50 files, and CI runs all of them with ruff, mypy and an 85% coverage floor (.github/workflows/ci.yml). I read the memory suites; I ran nothing.

The negative evaluation is in tests/unit/test_recall.py. test_superseded_records_are_excluded_before_relevance_is_considered asserts the superseded memory absent and its successor present in one result (:26-37). test_as_of_walks_back_up_the_supersede_chain asserts the successor absent before its valid_from while the predecessor is present (:40-53). Two scope tests assert the exact name list, so a filter that returned nothing would fail (:70-90, :93-116). test_a_deleted_record_leaves_the_default_surface_but_not_the_past asserts absence on a query only the deleted memory matches, and its control is the as-of query that follows (:56-61).

Sleep. tests/unit/test_manage.py and test_manage_reasoning.py cover caps, idempotence, decay and boost, duplicate supersession and proposal identity. They also cover the ledger surviving a rebuild, unreadable replies and a verdict outside its proposal. test_after_any_sleep_the_files_on_disk_never_shrink counts files, so it cannot see a split overwriting the original's body; no test accepts a split.

Red team. tests/redteam/test_poisoning.py covers a payload in a memory body, type-escaping frontmatter, path-traversal names, a hook naming a foreign store, malformed files and a captured reasoner bounded by the caps.

Benchmarks. The README reports LongMemEval-S at 127/240 for agent-memory against 86/240 for MemCore, and Recall@5 rising from 79.0% to 86.6% with vectors. The harness that would produce them is committed (packages/harness). The results are not: .gitignore excludes experiments/ and docs/, so docs/experiments.md, docs/testing.md and every run record the README and CLAUDE.md cite are absent at the pin. No paper is cited.

11. For Your Own Build

Steal

Let the model return operations, not perform them. Run the reasoner with tools disabled, parse one JSON object per line, and apply each through the same validated write path a human uses. The model's reach is then exactly the operation vocabulary.

Hand the extractor a reconcile sheet of handles and refuse an update or supersede that names anything else. A conversation that steers the extractor can then create memories but not rewrite ones it was never shown.

Archive the raw increment before distilling, and advance a separate distilled watermark only after the extractor answers. A failed run costs latency, not material.

Keep validity on the record and filter on it before ranking. valid_from and invalid_at, a successor ending its predecessor at its own start, and an as-of read are a small amount of code for history that answers "what held then".

Bound the always-injected index by bytes and lines and admit by weight, so the injection is deterministic and its cost is fixed.

Avoid

Keeping the inputs to forgetting in a cache the docs call deletable. If usage decides what is proposed for removal, it is state, and losing it should not make every quiet memory a candidate.

Calling a decision "confirmed" when a model confirms it. Say which actor resolves a proposal and enforce it, or say plainly that the pass is unattended.

In-place rewrites in a store that promises history. Make correct and split write successors, or keep the preimage, whether or not the store is in Git.

A store-global name derived from part of the key. When project is not in the name, two projects' memories on one subject collide, and a write in one moves the other's file.

Fit

This suits one person who uses several coding agents on one machine and wants a shared, greppable store that fills itself without the agent remembering to write. It assumes the host CLI is signed in and that a model run per turn is affordable. Walk away if projects must not see each other's memories, if corrections must be auditable without Git, or if nobody will run mem sleep and read the dream reports.

12. Open Questions

Whether mem sleep is meant to be scheduled by the user, by a future executor loop, or by a hook; the reasoner docstring mentions "a cron at three in the morning" and nothing installs one.

Whether the README's "deletion only ever arrives as a proposal you confirm" describes an intended default of max_deletes_per_sleep = 0 or predates the caps.

How often two distillations of one session overlap in practice, given the 80–100 s run time and one run per Stop.

What the gitignored experiment ledger contains, and whether the 127/240 and 86/240 runs used the same recall_fingerprint, which invariant 9 says licenses attribution.

Appendix: File Index

Recorded searches

Run at the tree root of the pinned checkout with /usr/bin/git grep.

• git grep -n -E 'Manage\(' -- packages ':!packages/harness' — cli/main.py:487, :521, :538 only; no hook or setup step runs a sleep.
• git grep -n -E 'git.{0,6}init' -- packages — no match; the sleep commit needs a repository the user made.
• git grep -n -E '"(candidate|verified|rejected|pending|disputed|unverified|quarantined)"' -- packages/core packages/cli packages/mcp — the ledger verdict, batch and distill report keys, and the pending directory name; no memory state.
• git grep -n -i -E 'audit|event_log|journal' -- packages/core packages/cli packages/mcp — the _commit docstring and a prompt line; no mutation log.
• git grep -n -i -E 'tombstone|blocklist|denylist|suppress|never again' -- packages — no match.
• git grep -n -E 'scope' -- packages/adapters skills — no match; hooks and the skill pass no scope.
• git grep -n -E '\-\-scope|scope=' -- skills packages/core/src/agent_memory/core/prompts.py packages/adapters — no match.
• git grep -n -E 'isatty|getpass|input\(' -- packages ':!packages/harness' — no match; nothing distinguishes a person at mem decide.
• git grep -n -E 'valid_from' -- packages/cli packages/mcp packages/core/src/agent_memory/core/reconcile.py — the CLI flag and reconcile's evidence dating; the MCP tools carry none.
• git grep -n -E 'access_log|AccessLog' -- packages/core — written by recall and read, read by Manage._usage and the link pass; the table is in database.py.
• git grep -n -E 'injected_index|INJECTED_INDEX' -- packages tests — defined in prompts.py and called only from harness/systems.py:183.
• git grep -n -E 'store_lock' -- packages/core/src/agent_memory/core/distill.py packages/cli packages/adapters — no match; no lock spans a distillation.
• git grep -n -E '\.unlink\(|rmtree|rmdir|os\.remove' -- packages/core packages/cli packages/mcp — gc, a cross-group move, rollback, temp files, empty-group pruning, the pending queue and legacy migration.
• git grep -n -i -E 'autoharness|\.claude/skills|stage_skill' — no match; nothing shared with autoharness.
• git ls-files | grep -E '^experiments/|docs/experiments.md|docs/testing.md|CITATION' — no match.
• git grep -n -i -E 'arxiv|bibtex|@article|@misc|doi\.org|citation' — three hits on provenance "citation"; no paper.
• git grep -n -i -E 'anthropic|machine learning|not (be )?used' -- LICENSE — no match; the MIT text carries no rider.

History

2026-10-13 — 3698e601… — first reading, at the head of main, a merge dated 12 October 2026. Screened from a full clone: 18 files scanned, no auto-run surface, two build-time execution points (tests/conftest.py, and a host-configuration module named setup.py that hatchling never executes), three dependency files inside the seven-day cooldown, six pyproject.toml files without a lockfile beside them against the root uv.lock; CLAUDE.md was read as data. Nothing was installed, built or run.