self.md radar — 2026-08-30
Agent memory is getting less interested in “remember the chat” and more interested in what survives a session without becoming a landfill. The useful split is emerging in public: shared memory that follows you between tools, local memory you can inspect, and an explicit boundary around what an agent may do with either.
1. memory is becoming a small record system
Itsuki is pitching a layer beneath multiple AI tools: it extracts durable objects from conversations and returns them across connected clients. Its public model is not “keep every turn.” It separates facts, events, entities and relationships from greetings and scheduling residue, while keeping each saved object attached to its source.
That distinction is the whole product. A transcript can answer almost anything eventually, but it makes every future tool reread the same fog. A record can be revised, deleted, cited and carried into the next context without pretending that every sentence deserved to become part of somebody’s long-term self.
The uncomfortable question is jurisdiction. Once one hosted store sits beneath several tools, it becomes a real personal system of record. “One key, 26 tools” is convenient. It also means admission rules, export, deletion and audit trails stop being minor settings.
reading: Itsuki’s public architecture · Itsuki documentation
2. the local-first alternative has to be boring enough to trust
Memnest takes the opposite operational posture: a local Rust service for coding agents, with SQLite as the source of truth, local BM25 plus vector search, and a separate encrypted vault for credentials. Its indexes are described as derived and rebuildable rather than sacred state.
That is a better shape than a magic “memory” blob. It gives a person somewhere to look when recall is wrong, somewhere to delete a record, and a boundary between searchable history and secrets. The project also scopes memory by workspace, with a separate shared playbook, which is a modest answer to a messy problem: work context is not identical to a person.
Local-first is not a privacy sticker. It still needs useful retrieval, migration paths, redaction that does not eat ordinary text, and a way to tell an agent that a fact is stale. But inspectable files and rebuildable indexes are a healthier starting point than asking a model to remember harder.
reading: Memnest repository · Memnest architecture notes
3. memory does not grant permission
A separate issue is arriving just as fast: an agent can know the repository, the task, and the user’s past preferences, then still make a change nobody approved. EngineeringSpec’s RC17 workflow argues for treating authority as versioned repository data: named paths, constraints, verification, stop conditions, and a reviewed contract at a trusted Git base.
It is a useful correction to the current appetite for ever-richer context. Context answers what the agent knows. Validation answers whether a result passes a test. Neither says whether it was allowed to touch deployment configuration or migrate a shared table while repairing a session refresh.
A memory layer makes an agent feel continuous. That feeling gets dangerous when continuity is mistaken for consent. The right move when a task grows beyond its approved boundary is not a more confident inference. It is a visible stop.
reading: EngineeringSpec’s authority model · EngineeringSpec repository
left on the table
- CRBRO is unusually explicit about retrieval and secret-redaction benchmarks, but it overlaps too heavily with today’s local-memory thread to earn a separate slot.
- Qwen Code is a substantial terminal-agent project, but a feature inventory would add less than the question of who owns remembered context and write authority.
Related self.md routes
- Personal AI OS tools — the control-plane map for personal agents, receipts, memory, and tools
- AI coding assistants — compare coding workbenches by review surface, permissions, cost, logs, and escape hatches
- Agent memory systems — what agents should remember, what belongs in logs, and how to avoid memory sludge