Obliviate — verifiable forgetting for AI memory

03-landing.png
02-architecture-flowchart.png
04-knowledge-graph.png
05-forget-cascade.png
06-three-proofs.png
07-certificate.png
08-verifier.png
09-as-of-system-time.png
10-s3-object-lock.png
11-direct-sql-audit.png
12-managed-mcp-audit.png

Inspiration

Every agentic-memory project this cycle answers the same question: how do agents remember more? Almost none answer the one that regulated, production memory actually demands: how do they forget — completely, safely, and provably?

Memory that only accumulates is a liability. A poisoned or wrong fact propagates through a knowledge graph and quietly corrupts every future answer. A departed customer's data lingers past its legal retention window — GDPR Article 17's "right to erasure" is a 2026 enforcement priority. And in almost every system, "delete" is a best-effort DELETE that leaves recoverable vectors on disk, orphaned graph edges, and no proof anything happened.

We wanted the opposite of a memory that only grows: an agent memory you can erase on command — and then prove the erasure to a skeptic, without asking them to trust our code.

What it does

Obliviate is verifiable "right to be forgotten" for AI-agent memory, built entirely on CockroachDB and running live on AWS.

You feed it plain English — runbooks, records, notes. It becomes a living knowledge graph with semantic recall: ask a question and it answers strictly from what it knows, every claim cited to its source. Ask about something it was never told and it says "not on record" instead of inventing an answer — the honesty that makes forgetting meaningful.

Knowledge graph

When a subject must be forgotten, one click cascade-deletes their entire knowledge sub-graph — documents, graph nodes, edges, and vectors — in one serializable ACID transaction. Then it proves the erasure three independent ways:

It existed — reconstructed with CockroachDB's AS OF SYSTEM TIME (MVCC time-travel: the database's own history is the receipt, with no separate audit log to trust).
It's gone — a live vector + graph re-search returns nothing.
It's irreversible — the per-subject AES data key is crypto-shredded.

The three proofs

Every erasure issues an ECDSA-signed certificate, written to object-locked (WORM) S3. Anyone can re-derive the hash and verify the signature at /verify — tamper with a single field and it fails.

Certificate of Erasure

Entities shared with a surviving subject are kept, never corrupted — only the leaving subject is removed from their provenance. Between hard deletes, a curation pass flags stale references, a timeline audits every change, and workspaces isolate each tenant.

Try it live: https://43-204-114-100.nip.io/ · Watch the 3-min demo: https://youtu.be/zeSkAWusiC0

How we built it

CockroachDB is the single store for the knowledge graph, the VECTOR(384) embeddings, and the tamper-evident audit trail. FastAPI serves both the web app and a Model Context Protocol (MCP) server. Embeddings run locally via fastembed (bge-small-en-v1.5); answers via Cerebras gpt-oss-120b (OpenAI-compatible, bring-your-own-key). It's deployed on AWS EC2 behind Caddy with automatic HTTPS.

Architecture

The pipeline — remember, recall, forget — all over one transactional store:

Pipeline

Recall is an index-backed vector search. Every node carries a 384-d embedding indexed with CockroachDB's distributed C-SPANN vector index, so semantic search is a top-k lookup, not a scan:

CREATE VECTOR INDEX nodes_embedding_idx ON nodes (embedding vector_cosine_ops);

SELECT id, weight, (embedding <=> $1) AS dist
FROM nodes
WHERE workspace = $2 AND deleted_at IS NULL AND embedding IS NOT NULL
ORDER BY embedding <=> $1
LIMIT $3;

Forget is one serializable transaction. The whole cascade — delete the subject's exclusive nodes and their edges, invalidate shared nodes, delete documents, crypto-shred the key, write the audit row — commits atomically or not at all:

The forget cascade

The proof of prior existence is the database itself. We anchor a timestamp before the deleting transaction opens, then read the past with AS OF SYSTEM TIME to reconstruct exactly what existed — no separate audit table anyone could forge:

-- captured BEFORE the delete txn opens:
--   t_before = cluster_logical_timestamp()

SELECT name, type, description
FROM nodes AS OF SYSTEM TIME '<t_before>'
WHERE workspace = $1 AND $2::STRING = ANY(subjects);

AS OF SYSTEM TIME

Irreversibility is cryptographic, not a flag. Each subject's documents are encrypted with a per-subject AES-256-GCM data key (envelope-wrapped by a root key). forget destroys that data key inside the transaction — after which the ciphertext, wherever it survives (MVCC history, backups, a leaked snapshot), is unrecoverable:

Crypto-shred

Independent verification, two ways. Every certificate can be re-checked offline (re-derive the SHA-256, verify the ECDSA P-256 signature). And through CockroachDB Cloud's Managed MCP server, an auditor can query the cluster directly — no trust in our app required — and confirm zero rows remain.

Challenges we ran into

The AS OF SYSTEM TIME anchor ordering was a subtle, load-bearing bug. Anchoring t_before inside the deleting transaction makes it equal the commit timestamp — so the "before" read sees the post-delete state and returns zero rows. The proof would prove nothing. We fixed it by capturing the timestamp one statement earlier (verified: 1 row before vs 0 after).
Crypto-shred scope had to be stated honestly. Destroying the key makes document ciphertext unrecoverable, but derived graph text is a separate representation — so the certificate says exactly that, rather than over-claiming total erasure.
Shared-entity safety. Forgetting one subject must never corrupt an entity shared with a survivor. Invalidation removes only the departing subject from a shared node's provenance (array_remove), keeping the node intact for everyone else.
A production rendering race. Late in the build, the live UI intermittently rendered unstyled because the runtime Tailwind compiler started before the large HTML finished streaming. Moving the compiler to the end of <body> removed the race — verified across repeated cold loads.

Accomplishments that we're proud of

Every proof survives hostile testing. Across multiple adversarial review rounds, we tried to fake out every proof — tampered certificates, re-onboarding a shredded subject, adversarial re-asks, corrupting a shared entity — and failed every time.

The evidence, captured outside the app:

S3 console — the certificate is under Object Lock, Compliance mode (write-once; not even the account root can delete it before expiry):

S3 Object Lock — Compliance

A direct SQL audit on the cluster for a forgotten subject — 0 nodes, 0 documents, key destroyed:

Independent direct-SQL audit

The same check through CockroachDB Cloud's Managed MCP server — an auditor queries the cluster directly and gets 0 rows:

Managed MCP audit — 0 rows

And the whole thing runs live on AWS free-tier, token-gated so anonymous visitors can browse and verify but never delete, with a self-heal that rebuilds demo data if it's ever wiped.

What we learned

AS OF SYSTEM TIME isn't just a query convenience — it can be a product's proof mechanism: the database's own MVCC history is a receipt you don't have to trust a separate log for. We also learned that "verifiable" is a discipline, not a label: every claim in the UI has to survive someone actively trying to break it, which is why the honest-limitations page reads like a security review. Unifying the graph, the vectors, and the audit trail in one transactional store is what makes the whole erasure atomic and the proof provable — it collapses on a generic database where those live in three systems that drift out of sync.

What's next for Obliviate — verifiable forgetting for AI memory

Multi-region homing so erasure honors data-residency requirements per subject.
A public, self-hostable verifier so certificates can be checked with zero dependency on us.
A formal machine-unlearning benchmark extending our Reconstruction-Robustness (RRS) and forget-correctness evals into a reproducible suite.

Live demo: https://43-204-114-100.nip.io/ · Code (MIT): https://github.com/vinayaksonthalia/obliviate · Video: https://youtu.be/zeSkAWusiC0