Forensic memory

Problem

Every agent session on this machine writes a transcript to disk. Those transcripts answer real questions. How did we fix this error before? Which session made that decision? Where did this number come from? Without an index, the answers exist and cannot be found.

The common build does more than index. An extractor reads each finished session, decides what matters, and writes memories into a long-term store. The agent then treats that store as truth. I built that version first: a compiler on the session stop hook, and a poller that did the same across agents.

The question that matters is not whether a machine can write memories. It is whether a machine-written memory can be a record. I measured mine, and the answer was no.

System

In May I counted the extractor’s output: 2,366 open assertion rows, sludge that no session ever read again. The captures I wrote by hand in the same database stayed clean. That difference was the verdict, not a tuning problem. I deleted the extractor and its poller the same day, and I kept the search.

What survived is deliberately simple. One local server indexes every transcript into one SQLite database with full-text search. The transcripts come from four sources: my Claude profile (CLI), my employer’s work profile (also CLI), the Claude desktop app, and Codex. Results rank on text match, then on recency, and tool output is down-weighted because it is one third of the index. I refused embeddings and semantic search, and I recorded the reasons: the plain index already answers the real query shape. Subtraction first.

The survivor is still held to a measurement. A gold set of 15 real forensic queries runs against the live server, and the session each query must surface is pinned by hand. The baseline is 15 of 15 in the top five, with a mean reciprocal rank of 1.0. The eval exits non-zero on a failure, so it gates every change to the ranking code. The down-weight on tool output holds its default on that evidence: the sweep without it loses a case.

The instrument needed its own fix. Each search from an agent session is ingested into the corpus within seconds, and the eval’s own queries are no exception. Without a frozen date, the eval matched its own echo. Eleven weeks later, a test query’s top hit was the session that ran the test, minutes old. Every gold case now scores against the corpus at a frozen date, and the date moves only when I examine every case again. When a system records you, the instrument is part of the system.

The rule that keeps this system in its place is written at the top of the repo: forensic lookup only, never load-bearing. When a search surfaces something that matters, I promote it into the vault by hand — refine and cite, never copy. The archive points at what happened. Only the vault holds what I know.