Verified Memory MCP server

Hive prototype: evidence-gated answers from small local models

A research prototype that asks a small local LLM questions about local documents and only releases an answer when independent checks agree with the source. Otherwise it withholds the answer and records why. Everything is append-only and kept as evidence, including failures.

It runs on a single machine with the Python standard library. The optional model mode uses Ollama on loopback. There are no third-party Python dependencies.

Status: prototype. The measurements below are small, fixed-seed regression runs on one model family. They are not a reliability benchmark. See Stated limits before relying on any of this.

What it does

The unit of work is a cookie: a short-lived worker process with a single role. Cookies never share conversation state. They communicate only through an append-only SQLite event log.

1. Learner / ingest stores a source document's text, path and SHA-256 as an immutable snapshot.
2. Solver gets keyword-retrieved excerpts and must return either an answer with an exact quote or an explicit not found.
3. Support cookie is a separate process that sees only the question and the quote, never the solver's answer. It must independently answer or abstain.
4. Deterministic gates release the answer only when all of these hold:

• the quote exists verbatim in a snapshot
• the source file still hashes to that snapshot (freshness)
• the answer is anchored in the quote
• solver and support agree
• for policy tables, condition and outcome come from the same row
• every model response matched a strict JSON schema

A failure in any gate withholds the answer. The system never falls back to a probabilistic override.

1. Not found is not trusted on the solver's word. Absence must be confirmed independently before it is stored as a finding.

Query outcomes: supportedanswer, notfoundinsource, needsreview (answer withheld), unsupportedoutput, and stale_source.

Survivability work adds one-way replication of the event log to a storage-only replica, tiered retention, and verified restore. It also adds recreation of source files from stored snapshots, so a second machine can answer from a recovered checkpoint while the primary is offline.

Signed code releases extend this to the code itself. Every new master commit is backed up to the replica as an unsigned candidate, but only a release signed with a human-held key can become the approved version. A second signature, the recovery-tested pin, marks a release that has actually been recovered and run on another machine with the primary switched off.

agent-memory/ is a separate, self-contained pipeline. It turns your own Telegram JSON chat export into cited memory for your local agent: secrets are masked, a model proposes dated records in two attributed voices, code verifies every quote word for word, a second model audits each record, and you approve what is exported.

Architecture

┌───────────── append-only SQLite event log (triggers block UPDATE/DELETE) ─────────────┐
 ingest ──► │ source snapshots · claims · model calls (raw bytes) · verdicts · findings · lore      │
            └──────▲────────────────▲────────────────────▲─────────────────────▲──────────────────┘
                   │                │                    │                     │
             solver cookie    support cookie     relevance cookie      deterministic gates
            (excerpts only)  (question+quote)   (snapshot, no answer)  (quote/hash/anchor/row)
                   └──── each a separate process; same local model via ollama_local.py ────┘

Shortened. The full README is on GitHub.