Hiro development journal

Typed memory and local GBrain shadow recall implemented

2026.07.22 at 10:25:20 America/Los_Angeles Published Machine-readable JSON

Executive summary

The approved first two phases of Hiro's governed memory plan were implemented: an additive typed SQLite operational store and a pinned, local-only GBrain recall bridge.

SQLite remains authoritative for facts, preferences, tasks, reading items, approvals, and append-only action history. Only allow-listed world-knowledge projections can enter GBrain; tasks, approvals, calendar truth, action events, secrets, and raw recall queries are excluded.

A disposable synthetic gate seeded 30 isolated pages and ran 120 held-out queries. It measured 100 percent top-1 retrieval, 100 percent owner isolation, successful removal of instruction-like memory content, and 125 millisecond p95 steady-state search latency. This result authorized shadow observation only; GBrain content is not injected into Hiro's answers.

Work completed

Typed operational memory

Implemented and focused tests passed

Added an additive, versioned SQLite migration for source references, versioned claims, tasks, reading items, immutable approval decisions, append-only action events, a GBrain projection outbox, and privacy-minimized recall evidence.
Added repository functions for claim creation, precedence enforcement, supersession, tombstoning, task and reading-item creation, approval decisions, action-event append, projection enqueue, and recall telemetry.
Preserved the legacy facts interface while dual-writing compatible versioned claims. Lower-trust inferred data cannot replace a user-stated or manual claim.
Recall telemetry stores a one-way query hash, result slugs, timing, status, and prompt-use flag. It does not store the raw query.

Pinned local GBrain runtime

Implemented and startup verified

Pinned GBrain 0.42.64.0 at a specific upstream commit and pinned the Windows Bun runtime with its published SHA-256 digest.
Added a checked-in PowerShell launcher that normalizes the known Windows Path/PATH collision, verifies the pinned runtime paths, strips inherited cloud-provider keys, and starts GBrain from an isolated home directory.
Initialized the production-local PGLite brain with no embedding provider and explicitly selected conservative search. No HTTP listener, remote GBrain endpoint, hosted embedding, synthesis provider, personal-data import, integration scaffold, autopilot, or dream cycle was enabled.
A real child-process launch returned the expected pinned GBrain version, satisfying the repository's Windows launcher requirement.

Serialized recall bridge and projection boundary

Implemented in shadow mode

Added one long-lived, serialized local MCP subprocess for both search and projections so the single-process PGLite store never has competing Hiro writers.
Added off, shadow, and active-read modes. Shadow is now the default; it performs bounded retrieval and records privacy-minimized evidence but returns no memory text to the system prompt.
Every projected slug is placed under a non-reversible owner namespace. Search results outside the requesting owner namespace are discarded before use.
Only person, organization, company, project, meeting-note, document, and reading-content records are projectable. Only put-page and delete-page projection operations are currently enabled; other operations dead-letter pending a later review.
Projection failures retry at most three times, store only a generic error code, and then dead-letter. Recall timeout or process failure falls back without failing the user turn.

Prompt-injection and environment diagnosis

Resolved and regression-covered

During disposable initialization, a provider-selection boundary problem was detected: a child process could discover configuration outside its intended local home. The launcher was corrected to use an isolated working directory, and a clean initialization then correctly reported that no embedding provider was configured.
The local brain was initialized only with the explicit no-embedding option after that clean failure proved isolation. No provider request was required for the accepted initialization.
Instruction-like lines retrieved from stored pages are stripped, snippets are bounded, and any future active-read content is labeled as untrusted evidence rather than instructions.
The initial two-second startup timeout produced a measured safe fallback. It was raised to five seconds; a fresh production-local startup probe then completed successfully in about 2.35 seconds.

Decisions and reasoning

Enable shadow observation after the synthetic gate passed, but keep active-read authorization false. Shadow retrieval cannot affect Hiro's answer content.
Keep GBrain provider-free and keyword/graph-only for this pilot. This avoids new API keys, hosted memory services, and model spend.
Do not import existing personal memory yet. The production-local brain starts empty, and the completed evaluation corpus is synthetic and disposable.
Keep operational truth and authority in SQLite and authoritative tools. Memory recall never grants permission to schedule, send, modify, or delete an external resource.
Require a separate measured promotion review before active prompt injection, hosted embeddings, remote MCP, personal-data migration, autonomous consolidation, or broader GBrain operations.

Validation and evidence

Check	Status	Result
Typed memory, recall bridge, launcher, and operational-boundary tests	passed	26 focused tests passed; the final combined relevant suite completed with 55 passing tests in 2.51 seconds. They covered provenance precedence, supersession and tombstones, immutable approvals, append-only action events, owner filtering, raw-query exclusion, failure fallback, projection allow-listing, pin metadata, provider-key stripping, and existing operational boundaries.
Related routing regressions	passed	29 additional routing and factual-grounding tests passed in 1.18 seconds after the prompt-builder integration.
Real pinned GBrain MCP write and search	passed	A disposable local MCP process accepted a synthetic project page and returned it through local keyword search with the expected owner-scoped slug.
Synthetic held-out shadow gate	passed	Thirty local synthetic pages and 120 queries produced 1.0 top-1 recall, 1.0 owner isolation, successful injection sanitization, 88.5 millisecond mean latency, 125 millisecond p95 latency, and zero recorded case failures.
Active-read promotion	not-authorized	The evaluator explicitly reports active_read_authorized false. The current evidence covers local exact-keyword retrieval and safety boundaries, not personal-data usefulness, semantic paraphrase recall, relationship gain, deletion propagation at scale, or longitudinal behavior.
Journal tests and site build	passed	The timestamped-entry unit test passed. The production build generated and validated 25 entries, verified timestamp identity, aliases, sitemap, Atom content, noindex metadata, and the IndexNow key, then completed TypeScript and Vite production compilation. The first sandboxed build attempt hit a Windows generated-file permission condition; rerunning the same build with the required write access completed successfully.

Current state

Typed SQLite records are available and legacy fact writes retain compatibility while creating versioned claims.
The production-local GBrain PGLite store is initialized, provider-free, conservative, and empty of user data.
Shadow recall is enabled by default. It can add latency and structured evidence, but cannot add GBrain text to Hiro's prompt or answer.
The immediate rollback is MEMORY_RECALL_MODE=off. The active-read implementation exists behind configuration but remains unauthorized.
The Hiro working tree already contained many unrelated changes. This session made narrow edits and added isolated files without resetting, staging, or overwriting unrelated work.

Next steps

Collect shadow completion, latency, empty-result, and fallback metrics during ordinary Hiro use without importing personal data.
Add a reviewed, minimal synthetic-to-curated projection workflow and verify deletion and supersession propagation end to end.
Expand held-out evaluation to paraphrases, conflicting sources, temporal freshness, relationship traversal, adversarial distractors, process restarts, and longer soak tests.
Compare shadow recall against the current SQLite and Markdown baseline on useful stateful tasks. Require a measurable relationship-recall gain and no operational regressions before proposing active-read promotion.
Ask for separate approval before importing personal data, enabling active-read prompts, connecting any hosted provider, or enabling autonomous GBrain features.