01 / The boundary
Keep the context.
Question the claim.
Inspect the structure
Parse metadata, verify content hashes and trace declared lineage. Review local snapshots and literal residue receipts without exposing memory content in the receipt.
Filter before retrieval
Check declared tenant, project, principal, state and validity before eligible text is emitted. Derived notes cannot broaden declared authority or retention.
Review the meaning
Local structural checks do not prove semantic truth, writer identity or authority to act. The operator authenticates callers, protects policy and reviews consequential decisions.
Release evidence: 48 tests, 21 wrapper cases and six sample commands passed in a fresh, non-author same-model-family review on macOS. Other platforms and research benchmarks were not independently reproduced. Read the scoped receipt.
02 / The collection
Three skills. One local evidence contract.
FORGE RECALL
Inventory existing local memory, propose conservative migration without rewriting it, filter by scope and validity, and explicitly review compiled outputs.
View on GitHub →FORGE GENESIS
Create an owner-approved local workspace with deny-by-default access, explicit metadata and a synthetic example. No credentials, provider SDK or cloud export required.
View on GitHub →FORGE HIVEMIND
Maintain a pending-review local principal registry and trace declared evidence through derived notes. Repeated sources do not become independent votes; uncertainty stays visible.
View on GitHub →03 / The architecture
One 6-layer model under everything.
where to look — a tiny index, not a warehouse
what was recorded — source text with explicit metadata
what was derived — prepare, review, then accept
what is retained — human-reviewed notes, not guaranteed truth
how notes depend on evidence — hashes and lineage
what is eligible now — scope, state and validity before text
All three packages include the same standard-library helper, their own documentation, MIT license and synthetic example. Native runtime adapters are not included. Memory text never grants tool permission.
04 / Where this goes
What comes next stays separate.
CROSS-MODEL REVIEW
A later evaluation track toward 2.5: compare model behavior with adversarial memory fixtures. No cross-model result is claimed for 2.2.
HOST ENFORCEMENT
Authenticate callers, protect policy and prevent native-tool bypass. These require host-specific integration and separate security review.
EXPLICIT ADAPTERS
Native runtimes, vectors, voice, vision and remote providers are opt-in future adapter work. Local checks do not verify remote erasure.
Cross-model/security 2.5 certification has not been performed. Version alignment is not a security certificate.
Your agent already remembers.
Now inspect the evidence.
MIT licensed · Markdown + JSON + Python 3.10+ · No network or credentials needed for the synthetic example · Not a security sandbox