Provenance-carrying memory; opt-in traces for a fine-tuned tool-use model

Context

“Learning” means two things: this machine remembers, and the species gets better. Memory is also the persistence vector for prompt injection (review).

The three plans

• Grok: short-term session plus an optional long-term store; a fine-tuned tool-use model.
• Fable: not detailed.
• Codex: SQLite + FTS + optional vectors; session/project/user/system layers; never-memory; a memory settings page with search, edit, export, delete.

Decision

SQLite with FTS5 and sqlite-vec, vector index versioned by embedding-model id, forward-only migrations with a snapshot at every activation so a generation rollback never corrupts a newer database. Layers session, project, owner, machine; never-memory for secrets. Every row carries provenance; rows derived from untrusted content are never loaded as instructions; owner-layer writes require confirmation. tacid memory searches, edits, exports and deletes.

One database and not one per person, amended 2026-09-07. This said “one database per user” and the machine has always had one, at /var/lib/tacid/memory/machine.sqlite. What settled it against the original wording is the layer taxonomy in this same decision: machine is machine-wide by definition and owner is the owner’s, so the layers are already the scope, and a database per person would have been a second answer to the question the layers answer.

What that left undone was scoping the reading, and it was not scoped at all: memory.search took no principal, and the daemon’s socket answers every local account by design. So anything that could reach it read back everything this machine had ever been told. An integration is the case that makes it plain — something a person plugged in, capped at consult by ADR-0061, could read what the owner had told their machine in confidence. An integration now sees machine and project: what this hardware is like and what is true of the directory it is being asked about, which is the useful half and the impersonal half. Everybody else reads all four, as before.

Species learning: opt-in tool-trace collection with a published sanitizer specification and a bundle shown before upload; tune/ fine-tunes a small Tacid tool-use model added to the registry; the dataset is licensed CDLA-Permissive-2.0.

Consequences

• Memory is a security surface and is tested by the injection corpus.
• The best local model for running Tacid will be one trained on Tacid.

Alternatives rejected

• Copying user files into an AI database: privacy and provenance disasters.
• A vector database service: a daemon for a problem SQLite solves.