Verity

Persistent, verifiably-fresh agent memory on CockroachDB — because a cache that doesn't know when its own source data changed is a liability, not an optimization.

Comment

Inspiration

A cache that doesn't know when its own source data changed is worse than no cache at all -- it's a liability that looks like an optimization. Agent memory has the same problem at a bigger scale: an agent that "remembers" a security advisory's severity from three polls ago, after that advisory got restated, is confidently wrong. Verity is built around one idea: memory is only valuable if it can prove it's still fresh, and CockroachDB -- a single strongly-consistent store holding vectors, governance metadata, and freshness state together, with changefeeds to push real-time invalidation -- is what makes "prove it's still fresh" actually cheap to check instead of an afterthought.

What it does

Verity gives an agent persistent semantic memory over a live security-advisory corpus (NVD, CISA KEV, and EDGAR, polled every 15 minutes, keyless, no fixed demo dataset). Every advisory gets embedded with a real MiniLM model and written into CockroachDB's Distributed Vector Index -- so instead of recomputing embeddings from scratch and throwing them away every poll cycle, the agent accumulates real, queryable memory across every poll, forever. Ask it about a topic and it runs a real ANN query -- ORDER BY embedding <=> $query -- and correctly surfaces related advisories over unrelated content, live. When an advisory gets restated, a CockroachDB changefeed pushes that change to a webhook receiver that actively evicts the stale cached decision immediately, instead of waiting for a TTL to lapse.

How we built it

  • CockroachDBClient -- implements the existing DataHubClient abstract interface, so the same gate/matching/governance engine runs against CockroachDB with no consumer code changes. A hand-rolled multi-round-trip graph walk collapses into WITH RECURSIVE queries: path-finding becomes one round trip, and the neighborhood walk turns an unbounded per-hop GMS BFS into three fixed SQL round trips regardless of hop count.
  • Distributed Vector Indexing -- a VECTOR(384) column with a vector_cosine_ops index; real MiniLM embeddings written on ingest, queried via real ANN search.
  • Changefeeds -- CREATE CHANGEFEED ... INTO 'webhook-...' WITH updated, diff pushes every row change to a receiver that evicts affected cached decisions -- live-verified against a real deployed endpoint.
  • AWS Lambda -- the changefeed's webhook receiver runs as a real Lambda with a public Function URL, deployed and live, VPC-attached to reach Redis over its private IP.
  • AWS Lambda + EventBridge Scheduler -- ports the 15-minute ingest poll onto a scheduled Lambda; Lambda's lack of persistent disk required shuttling change-detection state through S3. Code-complete and locally tested, not yet deployed.

Challenges we ran into

  • The obvious mapping for search() was wrong -- the interface's search(query: str) takes free text, not a vector, with no embedding model at that layer. Fixed by keeping search() text-based and adding a separate search_by_embedding() for real ANN.
  • Confirming the changefeed's exact webhook JSON payload shape needed a real deployed endpoint -- docs got us close but not exact.
  • The vector index is built vector_cosine_ops, which only accelerates <=> -- <-> silently bypasses the index entirely. Caught by validating against the live cluster.

Accomplishments that we're proud of

Every claim in this submission is backed by something that actually ran against the live cluster: a real ANN query correctly distinguishing security-advisory content from unrelated finance content; a real changefeed delivering real INSERT/UPDATE/DELETE payloads; a real 15-minute NVD/KEV/EDGAR poll cycle, not a recycled fixed dataset.

What we learned

"CockroachDB as agent memory" is a genuinely different proposition from "CockroachDB as a database swap" -- the win is that co-locating vectors, governance metadata, and freshness state in one strongly-consistent store collapses a multi-round-trip, eventually-stale cache into something that can prove its own freshness.

What's next for Verity

Migrate the AWS-hosted pieces onto a dedicated free-tier footprint; extend changefeed-driven invalidation into a fuller event-sourced audit trail; open the memory layer up as a queryable API other agents could consume directly.

Built With

  • ccloud
  • changefeeds
  • cockroachdb
  • eventbridge
  • fastapi
  • lambda
  • mcp
  • minilm
  • psycopg
  • python
  • sentence-transformers
  • vector
Share this project:

Updates