lowcache/memd

Review signals: 2 hardcoded secret. 2 static matches retained as context.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

Gitleaks found a possible hardcoded secret; value withheld. eval/scenarios/secret-redaction.json 2 findings.

2 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• memd brief prints a session-start brief for a project: Real input produced the expected result: Project: demo-project

  Source: - `memd brief [path]`: print a session-start brief.

  Input: <guest-path>

  Expected: Project: demo-project

  Command: <guest-path> brief <guest-path>

  Observed: Project: demo-project | state.md updated 2026-10-28 | status active 1 unprocessed curator inbox note(s). Global memory (cross-project) lives at <guest-path><host-path> — read its state.md / decisions.md there when a task touches user, system, or cross-project facts; leave global notes in its inbox/. Global state.md (excerpt): # System State _No state recorded yet. memd populates this from sessions._ Memory file index (read selectively): state.md (updated 2026-10-28, 75 chars) decisions.md (updated 2026-10-28, 54 chars) mistakes.md (updated 2026-10-28, 62 chars) todo.md (updated 2026-10

• memd status shows the backend, registry and ingestion status: Real input produced the expected result: demo-project (<guest-path>)

  Source: - `memd status`: show the backend, registry and ingestion status.

  Input: status

  Expected: registered demo-project project listed

  Command: <guest-path> status

  Observed: demo-project (<guest-path>) last distill : never ! 2026-10-28T11:24:40 [sweep/] curator backend not found: 'claude' — install it or set curator_cmd in <guest-path> ! 2026-10-28T11:25:14 [sweep/] curator backend not found: 'claude' — install it or set curator_cmd in <guest-path> sources : 0 (0 antigravity), 0 with pending content, 1 inbox note(s) global (<guest-path>) last distill : never sources : 0 (0 antigravity), 0 with pending content, 0 inbox note(s)

Examples

• Project test suite from README Testing section passes: command completed successfully

  Source: README.md Testing & Verification: python -m pytest tests/ -q

  Input: tests/ -q

  Expected: all 387 tests pass

  Command: <guest-path> -m pytest tests/ -q

  Observed: ........................................................................ [ 18%] ........................................................................ [ 37%] ........................................................................ [ 55%] ........................................................................ [ 74%] ........................................................................ [ 93%] ........................... [100%] 387 passed in 71.03s (0:01:11)

• memd status quickstart lists the registered demo project: command completed successfully

  Source: README.md CLI Command Quick Reference: memd status

  Input: status

  Expected: demo project listed with its path

  Command: <guest-path> status

  Observed: (headless) [models: sonnet/sonnet] — sends session content to the Anthropic API demo-project (<guest-path>) last distill : never ! 2026-10-28T11:24:40 [sweep/] curator backend not found: 'claude' — install it or set curator_cmd in <guest-path> ! 2026-10-28T11:25:14 [sweep/] curator backend not found: 'claude' — install it or set curator_cmd in <guest-path> sources : 0 (0 antigravity), 0 with pending content, 1 inbox note(s) global (<guest-path>) last distill : never sources : 0 (0 antigravity), 0 with pending content, 0 inbox note(s)

Cycles

• The sweep timer runs memd sweep to catch up all projects every 30 minutes: Cycle needs a curator backend for distillation: the default claude CLI is not installed and needs authentication (credentials not provided), and no ollama or other curator_cmd is available. Manual run of memd sweep was made and exited 1 with 'FAILED distill: curator backend not found: claude'; global and inbox steps ran. Inspected contrib/memd-sweep.service, contrib/memd-sweep.timer (OnUnitActiveSec=30min), and the sweep entry in memd/sweep.py via the CLI.

  Source: contrib/memd-sweep.service

  Observed: Cycle needs a curator backend for distillation: the default claude CLI is not installed and needs authentication (credentials not provided), and no ollama or other curator_cmd is available. Manual run of memd sweep was made and exited 1 with 'FAILED distill: curator backend not found: claude'; global and inbox steps ran. Inspected contrib/memd-sweep.service, contrib/memd-sweep.timer (OnUnitActiveSec=30min), and the sweep entry in memd/sweep.py via the CLI.

Local or hosted: local

Install memd from the README (pip install .) and exercise its CLI: memd init, note, status, brief, recall, sync/sweep, and the documented pytest suite

cd <guest-path> && ls -la && cat README.md | head -c 7000 && python3 --version && echo "CDP=$CDP_URL" && curl -sS -m 10 -i "$CDP_URL/json/version"
cd <guest-path> && sed -n '1,400p' README.md | tail -c +7000 | head -c 7500
cd <guest-path> && tail -c +14500 README.md | head -c 7500
cd <guest-path> && tail -c +22000 README.md; echo; echo ---; cat pyproject.toml | head -60; ls .coldpass memd scripts tests; git -C . status 2>&1 | head -2
cd <guest-path> && which git; git --version; python3 -m venv --help >/dev/null && echo venv_ok; (git init -q && git remote add origin https://github.com/lowcache/memd && timeout 120 git fetch --depth 1 origin f721ee36adf34bb2a96860a52b17d49741309e1f && git reset -q --mixed FETCH_HEAD && git log --oneline -1) 2>&1 | tail -5
mkdir -p <guest-path> && python3 -m venv <guest-path> && <guest-path> install -q --upgrade pip 2>&1 | tail -3; cd <guest-path> && <guest-path> install . 2>&1 | tail -5
M=<guest-path>; $M --help; echo "rc=$?"; $M init --help 2>&1 | head -30; echo; $M status --help 2>&1 | head -15
export XDG_CONFIG_HOME=<guest-path> XDG_STATE_HOME=<guest-path> HOME=<guest-path>; mkdir -p $HOME && rm -rf <guest-path> && mkdir -p <guest-path> && cd <guest-path> && git init -q && git -c user.email=a@b -c user.name=a commit -q --allow-empty -m init && M=<guest-path>; $M init <guest-path>; echo "init rc=$?"; $M note -m "The service listens on port 8741" ; echo "note rc=$?"; ls -la <guest-path> <guest-path> 2>&1
export XDG_CONFIG_HOME=<guest-path> XDG_STATE_HOME=<guest-path> HOME=<guest-path>; M=<guest-path>; cd <guest-path>; cat .memory/state.md; echo ---; cat .memory/inbox/*.md; echo ---; $M status; echo "status rc=$?"; $M recall "memory" ; echo "recall rc=$?"; $M sync; echo "sync rc=$?"; $M brief <guest-path> | head -20; echo "brief rc=$?"
cd <guest-path> && ls contrib; cat contrib/memd-sweep.service 2>/dev/null; cat contrib/memd-sweep.timer 2>/dev/null; cat pytest.ini; <guest-path> install -q pytest 2>&1 | tail -2; <guest-path> -m pytest --version
cd <guest-path> && export XDG_CONFIG_HOME=<guest-path> XDG_STATE_HOME=<guest-path> HOME=<guest-path>; timeout 900 <guest-path> -m pytest tests/ -q -p no:cacheprovider 2>&1 | tail -15; echo "rc=${PIPESTATUS[0]}"
export XDG_CONFIG_HOME=<guest-path> XDG_STATE_HOME=<guest-path> HOME=<guest-path>; cd <guest-path>; <guest-path> sweep; echo "sweep rc=$?"; <guest-path> status | head -8; tail -5 <guest-path> 2>/dev/null
cd <guest-path> && ls contrib/curators; which claude ollama npm node 2>&1; grep -n "curator_cmd\|claude_bin" docs/configuration.md | head -8; ls <host-path> 2>/dev/null | head -3; env | grep -i -E "anthropic|claude" | sed 's/=.*/=<set>/'
mkdir -p <guest-path> && cd <guest-path> && cat > probe.json <<'EOF'
{"kind":"cli","argv":["<guest-path>","brief","<guest-path>"],"cwd":"<guest-path>","env":{"XDG_CONFIG_HOME":"<guest-path>","XDG_STATE_HOME":"<guest-path>","HOME":"<guest-path>"},"expected_text":"Project: demo-project"}
EOF
cat > claims.json <<'EOF'
[{"kind":"claim","claim":"memd brief prints a session-start brief for a project","source":"README.md","quote":"- `memd brief [path]`: print a session-start brief.","input":"<guest-path>","expected":"Project: demo-project","probe_kind":"cli","argv":["<guest-path>","brief","<guest-path>"],"cwd":"<guest-path>","env":{"XDG_CONFIG_HOME":"<guest-path>","XDG_STATE_HOME":"<guest-path>","HOME":"<guest-path>"},"expected_text":"Project: demo-project"},
{"kind":"claim","claim":"memd status shows the backend, registry and ingestion status","source":"README.md","quote":"- `memd status`: show the backend, registry and ingestion status.","input":"status","expected":"backend line and registered project","probe_kind":"cli","argv":["<guest-path>","status"],"cwd":"<guest-path>","env":{"XDG_CONFIG_HOME":"<guest-path>","XDG_STATE_HOME":"<guest-path>","HOME":"<guest-path>"},"expected_text":"demo-project  (<guest-path>)"}]
EOF
python3 -I -c "import json;json.load(open('probe.json'));json.load(open('claims.json'));print('json ok')"
cd <guest-path> && cat > claims.json <<'EOF'
[{"kind":"claim","claim":"memd brief prints a session-start brief for a project","source":"- `memd brief [path]`: print a session-start brief.","input":"<guest-path>","expected":"Project: demo-project","probe_kind":"cli","argv":["<guest-path>","brief","<guest-path>"],"cwd":"<guest-path>","env":{"XDG_CONFIG_HOME":"<guest-path>","XDG_STATE_HOME":"<guest-path>","HOME":"<guest-path>"},"expected_text":"Project: demo-project"},
{"kind":"claim","claim":"memd status shows the backend, registry and ingestion status","source":"- `memd status`: show the backend, registry and ingestion status.","input":"status","expected":"registered demo-project project listed","probe_kind":"cli","argv":["<guest-path>","status"],"cwd":"<guest-path>","env":{"XDG_CONFIG_HOME":"<guest-path>","XDG_STATE_HOME":"<guest-path>","HOME":"<guest-path>"},"expected_text":"demo-project  (<guest-path>)"}]
EOF
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -c 4000
cd <guest-path> && cat > cycles.json <<'EOF'
{"detected":true,"checks":[{"claim":"The sweep timer runs memd sweep to catch up all projects every 30 minutes","source":"contrib/memd-sweep.service","quote":"ExecStart=%h/.local/bin/memd sweep","schedule":"systemd timer OnUnitActiveSec=30min (contrib/memd-sweep.timer)","method":"manual cycle: venv memd sweep with the same argv as ExecStart, no source edits; systemd not run; %h substituted by venv path","input":"<guest-path> inbox note","expected":"sweep reports syncing demo-project and a distill failure because no curator backend exists here","kind":"cli","argv":["<guest-path>","sweep"],"cwd":"<guest-path>","env":{"XDG_CONFIG_HOME":"<guest-path>","XDG_STATE_HOME":"<guest-path>","HOME":"<guest-path>"},"expected_text":"syncing demo-project"}]}
EOF
cat > examples.json <<'EOF'
[{"kind":"example","claim":"Project test suite from README Testing section passes","source":"README.md Testing & Verification: python -m pytest tests/ -q","input":"tests/ -q","expected":"all 387 tests pass","argv":["<guest-path>","-m","pytest","tests/","-q"],"cwd":"<guest-path>","env":{"XDG_CONFIG_HOME":"<guest-path>","XDG_STATE_HOME":"<guest-path>","HOME":"<guest-path>"},"expected_text":"387 passed"},
{"kind":"example","claim":"memd status quickstart lists the registered demo project","source":"README.md CLI Command Quick Reference: memd status","input":"status","expected":"demo project listed with its path","argv":["<guest-path>","status"],"cwd":"<guest-path>","env":{"XDG_CONFIG_HOME":"<guest-path>","XDG_STATE_HOME":"<guest-path>","HOME":"<guest-path>"},"expected_text":"demo-project  (<guest-path>)"}]
EOF
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo "rc=$?"; python3 -I -c "
import json,sys
d=json.load(open('<guest-path>')) if open('<guest-path>').read().lstrip().startswith('{') else None
print(d if d is None else {k:(v if k!='replay' else str(v)[:1500]) for k,v in d.items()})" 2>&1 | head -c 3000; tail -c 1500 <guest-path>
cd <guest-path> && cat > cycles.json <<'EOF'
{"detected":true,"checks":[{"claim":"The sweep timer runs memd sweep to catch up all projects every 30 minutes","source":"contrib/memd-sweep.service","quote":"ExecStart=%h/.local/bin/memd sweep","testable":false,"reason":"Cycle needs a curator backend for distillation: the default claude CLI is not installed and needs authentication (credentials not provided), and no ollama or other curator_cmd is available. Manual run of memd sweep was made and exited 1 with 'FAILED distill: curator backend not found: claude'; global and inbox steps ran. Inspected contrib/memd-sweep.service, contrib/memd-sweep.timer (OnUnitActiveSec=30min), and the sweep entry in memd/sweep.py via the CLI."}]}
EOF
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo "rc=$?"; python3 -I -c "
import json
d=json.load(open('<guest-path>'))
print('valid',d.get('valid')); print('problems',[p[:400] for p in d.get('problems',[])])
r=d.get('replay'); print('replay status', r.get('status') if isinstance(r,dict) else str(r)[:300])"
cd <guest-path> && git status --short | head -20; ls -d build *.egg-info .pytest_cache 2>/dev/null
cd <guest-path> && rm -rf build memd.egg-info .pytest_cache && mkdir -p .coldpass && cat > .coldpass/report.json <<'EOF'
{"outcome":"needs_credentials","fault_owner":"prerequisite","operation":"Install memd from the README (pip install .) and exercise its CLI: memd init, note, status, brief, recall, sync/sweep, and the documented pytest suite","operation_scope":"Linux, Python 3.12.3 (README requires 3.10+), git 2.43; stdlib-only package in a venv at <guest-path> Curator distillation requires the claude CLI (authenticated) or a configured curator_cmd; neither is available and no credentials were provided.","steps":["git init; git remote add origin https://github.com/lowcache/memd; git fetch --depth 1 origin f721ee36adf34bb2a96860a52b17d49741309e1f; git reset --mixed FETCH_HEAD","python3 -m venv <guest-path> && pip install . (README: From a local clone)","memd init <guest-path> (registered, created 8 files)","memd note -m \"The service listens on port 8741\" (inbox note written)","memd status / memd brief <path> / memd recall memory (all rc=0)","memd sync (rc=3, documented: sync exits 3 without a backend)","memd sweep (manual cycle of contrib/memd-sweep.service ExecStart; rc=1, FAILED distill, curator backend not found: claude)","python -m pytest tests/ -q (README Testing section): 387 passed"],"deviations":["Pip reports version 0.6.0 while the README-era tests reference 0.3.0 changelog; no effect on operation.","No claude CLI or ollama installed; distillation (sync/sweep) cannot complete. Did not install or authenticate claude, and did not obtain credentials.","Systemd timer not run; manual cycle used the same argv as ExecStart with the venv path substituted for %h/.local/bin.","Used XDG_CONFIG_HOME/XDG_STATE_HOME/HOME under <guest-path> to isolate config and state.","Temporary build artifacts (build/, memd.egg-info/, .pytest_cache) removed from the workspace after install and test."],"stuck_step":"memd sweep / memd sync distillation step (curator backend)","main_blocker":"No curator backend: the default claude CLI is not installed and requires authentication (credentials not provided); no local curator_cmd model is available.","plain_failure":"memd's distillation step fails with \"curator backend not found: 'claude'\". This is a missing prerequisite, not a product defect: the README says the sync exits 3 and preserves the backlog without a backend, which matches what was observed. All deterministic operations (init, note, status, brief, recall, the 387-test suite) worked.","suggested_fix":"Install and authenticate the claude CLI (or set curator_cmd to a working backend such as contrib/curators/ollama-curator.sh with ollama and a model) in the VM, then rerun memd sweep to confirm distillation writes .memory files and commits them."}
EOF
python3 -I -c "import json;json.load(open('<guest-path>'));print('report ok')"; cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | python3 -I -c "import json,sys;d=json.load(sys.stdin);print('valid',d.get('valid'),d.get('problems'),d['replay']['status'])" ; rm -rf build memd.egg-info .pytest_cache 2>/dev/null; ls .coldpass
cd <guest-path> && python3 -I -c "
import json
p='<guest-path>'
d=json.load(open(p))
d['deviations'][0]='pip installed memd 0.6.0, while the README changelog <email> (documentation lag, no effect on the operations run).'
json.dump(d,open(p,'w'),indent=1)
print('ok')" && cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | python3 -I -c "import json,sys;d=json.load(sys.stdin);print('valid',d.get('valid'),d['replay']['status'])"; rm -rf build memd.egg-info .pytest_cache 2>/dev/null; true