EvidenceBound Verified Memory

Most agents remember answers. EvidenceBound remembers the proof.

Comment

EvidenceBound Verified Memory — Time-Travel for AI Decisions

Most agents remember answers. EvidenceBound remembers the proof.

The problem

Long-lived AI agents do not only need to remember what they concluded. They need to prove why a prior decision existed, verify that the historical record has not been altered, and distinguish that historical integrity from whether the decision is still safe to apply now.

The primary judge question for EvidenceBound is:

What changed since my last review, and can you prove it?

The secondary question is:

Why did we reach this conclusion previously?

What it does

Session A verifies a decision, canonicalizes the evidence/provenance snapshot, binds policy/proof versions and SHA-256 hashes, and persists the verified memory to CockroachDB. Session A ends.

A genuinely independent Session B later receives only a public memory_id. It reconstructs the service, retrieves T0 from CockroachDB, verifies historical integrity, compares current evidence deterministically, classifies each change, re-evaluates current applicability, recalls prior verification incidents through CockroachDB vector indexing, and only then asks Amazon Bedrock to explain the already-trusted result.

The controlled demo deliberately produces the key semantic distinction:

  • historical decision = VERIFIED
  • historical integrity = VERIFIED
  • current applicability = REVIEW_REQUIRED
  • T1 includes UNCHANGED, CHANGED, STALE, and NEW

A changed value or hash does not automatically become REFUTED. Refutation requires a valid deterministic contradiction under the EvidenceBound rules.

Why CockroachDB matters

CockroachDB is the behavioral memory dependency, not a storage checkbox. The live acceptance test writes T0 in Session A, ends that session, creates a fresh repository/service instance for Session B, and reloads the historical record from CockroachDB. Session B cannot produce the canonical result without that persisted memory.

CockroachDB tool 1 — Distributed Vector Indexing

Verification incidents are stored as VECTOR(1024) values with a real CockroachDB vector index and recalled during T1. The representation is a deterministic EvidenceBound incident signature rather than an LLM-generated embedding, keeping trusted memory representation deterministic while still making vector retrieval a real database behavior.

CockroachDB tool 2 — Agent Skills Repo

The implementation applies the official cockroachdb-sql Agent Skill from the CockroachDB Agent Skills repo. The exact source blob is pinned, and the live acceptance gate follows the skill's connected-database guidance by running EXPLAIN checks for both verified-memory retrieval and vector retrieval before executing the T0/T1 behavioral flow.

AWS implementation

GitHub Actions assumes an AWS deployment role through OIDC and short-lived STS credentials — no long-lived AWS access key is stored in the repository.

The Lambda package is stored in Amazon S3 and deployed through AWS CloudFormation. AWS Lambda exposes the public judge service. On fresh T1 reopen, Lambda retrieves the historical record from CockroachDB, finalizes the deterministic integrity/diff/applicability state, and then invokes Amazon Bedrock Nova Micro for a bounded explanation.

Bedrock is explicitly outside the trust boundary. It receives only historical integrity, historical decision, current applicability, and {evidence_id, change} classifications. It cannot fabricate evidence, alter provenance, change classifications, or override trusted state.

Fail-closed production behavior

EvidenceBound owns canonicalization, provenance/evidence binding, SHA-256 evidence and record hashes, policy/proof version binding, deterministic comparison, historical integrity, current applicability, and trusted states.

Executable tests cover:

  • tampered historical payload → integrity failure → FAIL_CLOSED
  • Bedrock is not called after integrity failure
  • CHANGED != REFUTED
  • historical integrity can remain VERIFIED while current applicability is REVIEW_REQUIRED

Missing or malformed memory never falls back to a plausible LLM answer.

Real production acceptance

The public demo requires no credentials. Exact-head main CI and Cloud Acceptance are green.

The executable AWS workflow proves:

  • GitHub OIDC / AWS STS identity — PASS
  • real CockroachDB live acceptance — PASS
  • S3 deployment artifact — PASS
  • CloudFormation / Lambda deployment — PASS
  • public /health — HTTP 200
  • public Save T0 — HTTP 200
  • public independent Reopen T1 — HTTP 200
  • historical integrity — VERIFIED
  • current applicability — REVIEW_REQUIRED
  • changes — CHANGED, NEW, STALE, UNCHANGED
  • Cockroach vector recall — PASS
  • real Amazon Nova Micro explanation — present
  • fresh Session B — PASS

The public judge flow does not require hidden IDs, AWS credentials, CockroachDB credentials, or developer intervention.

Real-world impact

Verified Memory applies anywhere an agent makes decisions that may be reused later: compliance reviews, incident response, research workflows, analytical systems, policy-bound automation, and high-stakes operational agents. Instead of storing only an answer, the system stores the evidence-bound historical state needed to prove why the answer existed and to determine whether it is still applicable.

What was challenging

The hardest engineering boundary was keeping historical integrity separate from current applicability while still making the system useful to an AI agent. Another challenge was proving true independent-session behavior rather than accidentally relying on process-local state. The production acceptance path therefore forces a write in Session A and a later retrieval through a fresh Session B service instance.

We also kept the LLM deliberately weak in authority: Bedrock explains only after EvidenceBound has finalized trusted state. That made the system less flashy than an LLM-first design, but substantially easier to reason about and fail closed.

What we learned

The CockroachDB Agent Skills repo was most useful when treated as an executable engineering constraint rather than passive documentation: pinning the skill and requiring connected EXPLAIN gates made schema/query choices more auditable. Keeping transactional verified memory and vector incident recall in one CockroachDB system also avoided a second consistency boundary between operational state and a separate vector store.

New vs. pre-existing disclosure

Pre-existing: the EvidenceBound verification concepts/method, SignalReview.co, and earlier verified-memory ideas.

Built for this hackathon: this new isolated integration layer in a public repository created on August 13, 2026; CockroachDB schema and append-oriented persistence; vector incident recall; Agent Skill EXPLAIN gates; independent Session A/Session B flow; deterministic time-travel diff/applicability contract; GitHub OIDC AWS deployment; Lambda public judge surface; and bounded Bedrock explanation integration.

SignalReview.co is the real reference application. This submission is not a rebrand, and the controlled judge fixture is explicitly not presented as current sports data.

Built With

  • amazon-bedrock
  • amazon-nova-micro
  • amazon-web-services
  • aws-cloudformation
  • aws-lambda
  • aws-sts
  • cockroachdb
  • cockroachdb-agent-skills
  • cockroachdb-distributed-vector-indexing
  • fastapi
  • github-actions
  • github-oidc
  • python
Share this project:

Updates