Skip to content

fleet-memory

House-memory v1 for the fleet one-brain (FLT-96, scoped by the FLT-89 design council): an append-only fact store with gated promotion and a byte-budgeted render for prime-time injection. The full multi-writer NATS memory graph is explicitly deferred — this is the smallest slice that makes a learning cross from one model's head into another model's behavior.

Model

Facts, not rules. Rules (prescriptive, few, curated) live in fleet-constitution's master and reach models as hashed managed blocks. Facts (descriptive, many, accumulating — "Grok loads AGENTS.md, not GROK.md") live here, with provenance, confidence, TTL, and supersede edges.

Record schema (council-adopted): id, scope, subject, claim, source_harness, source_device, observed_at, confidence, status, ttl_days, supersedes, evidence_uri, promotion_ticket. id is a content hash of (scope, subject, claim), so emitting the same observation twice dedupes by construction.

Store: append-only JSONL per scope (~/.fleet/memory/device.jsonl, house.jsonl). Nothing is edited in place — state changes (retraction, promotion) are appended, and the last record per id wins. A corrupt line fails loud with its line number; the store never silently shrinks.

Resolution: retracted and TTL-expired facts are inactive; a fact named in an alive fact's supersedes is inactive (A>B>C leaves only A — the tail does not resurrect); edges from retracted/expired facts do not kill. Conflicting active claims on one subject BOTH survive and are reported — contradiction is resolved by an explicit supersede or retract, never by silent overwrite.

Promotion device → house is GATED. promote refuses to run without --ticket — a board reference (shape-checked, e.g. FLT-96) recording the human/council decision that admitted the fact. Auto-promotion is how the brain fills with contradictions; it does not exist here. Re-promoting with a different ticket or supersede set appends a same-id revision (never a silent NoOp — a changed gate decision is never discarded).

Trust boundary — stated honestly (council review): in v1 the filesystem ACL is the security boundary. The ticket is audit metadata — it makes every house fact traceable to a decision, it does not make promotion unforgeable by a process that can already write the store. Verification of tickets against the live board, signed promotion receipts, or a privileged promote entrypoint are the hardening steps when the multi-writer graph lands. Structural integrity IS enforced now: every record's id must match its content hash (append and read, fail-loud), and subject/claim are single-line and bounded so a stored fact can never forge extra lines in the rendered prime (prompt-injection guard).

Commands

fleet-memory emit     --subject S --claim C [--harness H] [--confidence 0..1] [--ttl-days N] [--evidence URI]
fleet-memory promote  --id ID --ticket REF [--supersedes id1,id2]
fleet-memory retract  --id ID [--scope device|house]
fleet-memory list     [--scope device|house] [--all]
fleet-memory render   [--max-bytes N] [--out FILE]

--store DIR overrides the store directory (default ~/.fleet/memory).

render emits the house-facts snippet injected at prime (the FLT-88 mechanism). The byte budget is a hard ceiling on the exact output; over-budget facts are dropped lowest-confidence-first and the omission is stated inside the snippet — silent truncation reads as full coverage, so it is forbidden.

Build

dotnet build FleetMemory.slnx
dotnet test  tests/FleetMemory.Tests/FleetMemory.Tests.csproj

Layout: src/FleetMemory.Core (pure logic — schema, resolution, promotion, renderer), src/FleetMemory.Cli (verbs + I/O), tests/FleetMemory.Tests. CI on home-ci self-hosted runners: build -warnaserror, vulnerable-package gate, tests + ≥80% Core coverage.

claude-mem adapter (FLT-98)

fleet-memory candidates reads recent claude-mem observations (worker GET /api/observations, default types discovery,decision) and prints ready-to-run emit commands with --evidence claude-mem://obs/<id> provenance. It is read-only by design: the adapter surfaces promotion candidates; emitting to device is a human action, house promotion stays behind the ticket gate, and the raw observation firehose is never auto-synced (that is the council's hard boundary — curated facts only cross tiers).