// the find
samvallad33/vestige
Local deterministic memory and safety kernel for AI agents. Replaces vector RAG with STRATA, a cryptographically signed, append-only ledger, so every agent state carries proof. Uses causal_walk engine to trace execution failures back to their root cause, and Operator Lite to block destructive terminal terminal commands before they ever run
Vestige is a local MCP memory server for coding agents, written in Rust. It keeps decisions and failure links in an append-only, hash-chained log and recalls them by exact id or tag instead of similarity search. It also bundles Operator Lite, a stdlib-only Python PreToolUse hook that pattern-matches shell commands and blocks destructive ones. It is aimed at developers who run Claude Code or a similar agent on their own machine and want project memory without a vector index.
Recall is deterministic. A memory comes back by id, a unique prefix of 8+ characters, or an exact tag, so the same query against the same log gives the same result and you can reason about why something was or was not found. The default build has no embedding model and makes no network calls.
Writes are checked, not just appended. Each write goes through a gate and leaves a receipt, `receipt replay` re-derives state from the log, and `selftest` plants a known cause in a throwaway copy and confirms the walk finds it. Few memory tools ship a way to test that they work.
causal_walk refuses to guess. It follows only edges the log recorded, is bounded at 8 hops and 500 nodes, and reports why it found nothing through `needs_report` and `emptyBecause` instead of returning nearest neighbours.
Operator Lite has the right shape for a blocking hook. It is one dependency-free file, starts in shadow mode so nothing is blocked on day one, writes a receipt per verdict, and its `replay` command runs the rules over your own Claude Code history without executing anything.
Operator Lite is pattern matching over command strings, so its coverage is only as good as its rule set. The 46-case bypass corpus is a useful signal, but a deny list will lag new shell tricks, and it only sees calls routed through hooked tools, which the README concedes.
Live log frames are hash-chained. The signed trailer appears only on sealed segments, and Operator's receipts are described as digests, not signatures. Someone with write access to the data directory can rebuild an unsigned chain, so this detects accidental or casual edits, not tampering.
Nothing can be erased. `suppress` hides a memory and cannot be undone on Strata, and `purge` is withheld until crypto-erasure ships under #402. If something you later need to delete gets stored, such as a credential that slipped past the gate or personal data, the current build offers no way to remove the bytes.
Recall by exact handle puts the burden on the agent. A memory that was not tagged the way the agent later asks for is effectively lost to recall. The benchmark table is from v3.1, which used hybrid search, so it says nothing about 4.x. The README also mixes a $149 paid-tier pitch into the install section, which makes the technical claims harder to weigh.