distill-kura

蒸留蔵 — distill-kura

A long-term memory for agents that is distilled, not accumulated. Recall works by *meaning*, writing is gated by *evidence*, and one server can hold several separate memories — one per agent mode — so switching mode switches what the agent remembers.

Ships as a DeepSeek Harness plugin, an MCP server for any other host, an HTTP service, and a Python library. Standard library only; no vector database, no embeddings, no framework. Why this exists

Two failures kill an agent's long-term memory, and they kill it from opposite sides.

Retrieval by keyword misses the thing you needed. A question about *"SSD inference chips"* shares no word with a memory titled *"running the 2.6T model off an SSD tier"* — yet they are the same subject. Word search returns nothing; the agent answers from nowhere. The fix here is not embeddings but *recognition*: the entire index (one line per memory, written as a recognition trigger) goes into one prompt, and a small model names what bears on the question. An index of ~500 memories is around 6k tokens — a few percent of a modern context window, and it sits in the prefix cache.

Writing everything poisons the store. An agent asserts something; a naive distiller records the assertion as a fact; the next agent reads it back as ground truth and repeats it with more confidence. That loop is self-reinforcing, and prompt instructions do not stop it — measured, not assumed. So the write path is gated by deterministic Python: every candidate memory must carry quotes that exist *character-for-character* in the raw material, tagged with where they came from. A quote that is not found verbatim is discarded. A candidate with no surviving quote is thrown away. A number with no [TOOL] behind it is stripped. Text crediting the human with a decision, when no [USER] quote survived, is refused at the last gate. Ideas are welcome — they go to a seed file, never to the store, and graduate only when later evidence confirms them. Tier zero: recognition before intelligence

The recall above is the right tool for a question that shares no words with its memory. It is the wrong tool for a question that *names* what it wants — and in a working session, most questions do. A blind 40-question benchmark on a live 317-memory store split exactly along that line: the direct questions needed no intelligence at all, and everything else needed all of it.

So before the thinker runs, a deterministic recognizer gets one look. The design is transposed from the n-gram embedding table inside Qwen3.8-Flash-Next — many hash heads voting over one table, behind a gate — onto the index: Five heads, each an independent recognition channel: exact name; IDF-weighted word tokens (identifiers, ports, katakana runs); character 3-grams with stop-grams (a gram present in over a fifth of the store drowns in its own collisions, so it is dropped); character 2-grams; and the head of each body. Coverage scoring — each head's vote is normalized by what it could possibly have reached for *this* question, so one lucky rare gram cannot fake confidence. An honesty gate — a hit is returned only when the top score clears an absolute bar *and* beats the runner-up by margin. Anything less and the fast path says nothing; the question falls through to the thinker, unchanged.

Blind-tested — the examiner wrote the 40 questions from the index alone, never seeing the implementation — against the live store over HTTP: What that buys: The everyday case stops paying the intelligent price for a lookup. Direct recall drops from ~900 ms to ~2 ms, and the fall-through tax on every other question is about 2 ms. It knows what it does not know. Zero wrong answers across the set is the gate working, not the heads being clever — everything uncertain goes to the model. On the six questions whose answers were *not* in the store, tier zero refused all six; the thinker tier answered something every time. Refusal is a