alibi

Inspiration

What it does

How we built it

Inspiration

Agent memory is usually a vector store you append to. Nothing records where a fact came from, nothing notices when two sources disagree, and nothing expires. When the agent turns out to be wrong there is no way to ask what it believed at the time. A stale memory and a quiet world look identical from the outside, right until one of them costs you something.

What it does

alibi is a memory layer where every fact carries its source, expires on a schedule, and quarantines itself when two sources disagree.

No provenance, no memory. A fact needs a source kind, a reference and an observation time. An empty source is refused by a CHECK constraint, not by a validator someone can route around.

A contradiction quarantines and never overwrites. When a lower authority source contradicts the record, both sides are held and the agent asserts neither. A compromised tool can make this agent uncertain. It cannot make it wrong.

Trust expires by fact class. Config in seven days, observations in one, incidents never. A stale fact is refused along with what would re-verify it.

Every answer cites its rows, and beliefs_asof replays what the agent believed at any past moment.

How I built it

Reads go through the CockroachDB Cloud Managed MCP Server, which connects as its own SQL identity and refuses anything that is not a SELECT. Semantic recall is ranked by the distributed vector index in SQL rather than in the application. Writes go through a separate identity that holds no DELETE, so the ledger is append only. Source documents live in Amazon S3 and become the citations. The language model only maps a question to a memory key and phrases an approved answer. It cannot query the ledger or override a refusal.

Challenges I ran into

The managed MCP server caps a query at 16384 characters, and a 384 dimension vector at full precision inlined twice blows that on its own.

Cluster Developer is not enough for MCP authorization. Cluster Admin is.

CockroachDB returns the VECTOR type to psycopg as text, so a naive list conversion turned 384 floats into 4097 single characters. I caught it only because the test asserted the length instead of that the value was not null.

Bedrock returned zero on demand quota for every model on this account, so the model runs on the Anthropic API instead.

Accomplishments that I'm proud of

Four guarantees a judge can verify rather than take on trust. The agent identity cannot INSERT. The writing identity cannot DELETE. A fact without a source is rejected by the database. And the MCP server refuses a write even when the caller holds Cluster Admin, which I measured rather than assumed.

What I learned

Retrieval thresholds picked by feel are worthless. Before I measured real embedding scores, the agent answered a question about an admin password it had never held by citing port facts. That is the exact failure this project exists to prevent. An answerable question scored 0.898 against its own fact and the best score for an unanswerable one was 0.755, so the floor sits between them.

Embeddings also cannot tell one agent's billing api port from another's search api port, so without a scope boundary one agent's unresolved contradiction becomes a different agent's refusal.

What's next for alibi

Scope becomes a real namespace column instead of a subject prefix. Trust horizons become per tenant policy instead of constants. And the audit table gets an export, because an evidence log nobody can take with them is only half an evidence log.

Challenges we ran into

Accomplishments that we're proud of

What we learned

What's next for alibi

Built With

• amazon-web-services
• anthropic
• claude
• cockroachdb
• mcp
• model-context-protocol
• onnx
• psycopg
• python
• sql
• vector-search