Recant

Take back poisoned AI memory everywhere, including reworded copies, with a signed and auditable chain of custody.

Comment

Inspiration

Agent memory changes the failure model of AI systems. A poisoned fact can be copied by one agent, paraphrased by another, and used by a third agent to take a consequential action. Deleting the original row is not enough. Operators need to know where a belief came from, find every contaminated descendant, take it back everywhere, and prove what happened later.

Recant treats shared memory like a custody and incident-response problem, not just a retrieval problem.

What it does

Every belief enters through an Attest Gateway that records its source, provenance parents, authority rank, and position in a signed per-agent hash chain. Working memory is only a disposable copy of that CockroachDB record.

When a source is found to be unsafe, recant(source_id) computes the full contamination closure. It follows explicit derivations and uses CockroachDB Distributed Vector Indexing to discover semantically similar copies that have no foreign-key edge. Claim evidence and source authority prevent a similar but independent source from being quarantined by mistake.

One serializable transaction quarantines the affected beliefs, records a signed action, revokes unused action permits, and appends an eviction event. Lambda and EventBridge fan that event out to agent working memory, where the affected copies are removed and pending actions that depended on them are aborted.

The read-only Forensics API reconstructs signed payloads from stored fields, verifies custody, replays earlier database states with AS OF SYSTEM TIME, and archives evidence to S3. Recant Guard separately requires a signed decision and a fresh, exact-argument, single-use permit immediately before any consequential tool call.

How we built it

CockroachDB is the system of record for sources, agents, beliefs, embeddings, derivations, incidents, action decisions, permits, and the append-only outbox. Tenant-scoped serializable transactions and row-level security protect every authenticated request. Versioned canonical payloads are signed, then rebuilt from stored fields during verification.

The vector index is a tenant-prefixed cosine index over 1024-dimensional belief embeddings. The taint engine combines a recursive SQL traversal with adaptive kNN probes and expands the closure to a fixpoint. Integration tests pin the CockroachDB vector search plan so a schema or operator regression cannot silently turn the lookup into a scan.

An agent uses the JSON-first ccloud CLI for a read-only deployment preflight. ops/inspect_cloud_cluster.sh checks that the named CockroachDB Cloud cluster exists and reports only its state, plan, cloud provider, region, and version. It deliberately strips ids, account metadata, and SQL endpoints from the output.

Amazon Bedrock Titan Text Embeddings V2 creates vectors for semantic taint discovery. Claude on Bedrock turns verified incident facts into a readable affidavit, with a deterministic template fallback. CockroachDB changefeed webhooks enter an authenticated Lambda receiver, EventBridge provides at-least-once delivery and retry, and a consumer applies each eviction exactly once through a transactional delivery ledger. S3 stores versioned evidence archives, signed custody checkpoints, and encrypted overflow manifests. KMS is the production signing backend.

The judge-facing console is React, TypeScript, and Vite. Its public Story mode uses deterministic fixtures so every judge sees the same sequence without credentials. Explore mode connects to the live Forensics and Quarantine APIs when their build-time URLs are configured.

Challenges we ran into

The first hard problem was separating discovery from authority. Vector similarity is excellent at finding an unattributed paraphrase, but it can also find a contradictory policy on the same topic. Recant therefore requires stored equivalence or entailment evidence before contamination crosses an independent source boundary.

The second was preserving exact-once effects over at-least-once delivery. The outbox remains append-only, while delivery state lives in a separate ledger. Evictions, dependent-action aborts, receipts, and the delivery row commit in one transaction, so retries become safe no-ops.

The third was making signed evidence survive real systems behavior. Signed timestamps come from the database clock, payload formats are versioned and canonical, idempotent responses are encrypted because they may contain a one-use permit, and verification reconstructs every payload from stored columns instead of trusting serialized blobs.

Accomplishments that we are proud of

  • One recant operation contains direct citations, explicit descendants, and a paraphrase with no recorded edge across a three-agent fleet.
  • The transactional source of truth, vector search, signed custody, durable eviction, and action authorization remain separate and testable boundaries.
  • Recant fails closed in production for authentication, tenant isolation, provenance, KMS signing, webhook verification, and external checkpoints.
  • The repository includes a disposable three-node CockroachDB environment, fresh-install migrations, deterministic seed data, adversarial regression tests, and a no-backend judge walkthrough.

What we learned

Agent memory needs incident response semantics. Provenance edges catch known copies, vector search finds unknown copies, and neither should be allowed to grant authority. We also learned that an append-only event log and an exactly-once delivery effect are compatible when delivery state is modeled separately and committed with the consumer's effect.

Finally, reproducible demos matter. The same product has a credential-free Story mode for judges and a live Explore mode for the real database, so the explanation never depends on a lucky network request.

What's next for Recant

The next step is a public live API deployment behind the existing console, followed by calibrated large-fleet tests across multiple CockroachDB regions. We also want to complete the Managed MCP authorization path for read-only forensic investigation, add policy simulation before Guard rollout, and turn signed custody checkpoints into an interoperable evidence format.

Built With

Share this project:

Updates

Submission history