Steps 4–5 of the loop

The governed second brain

The loop's last stage is memory — but not the kind you're being sold. Most "AI memory" gives an agent better recall. Ours answers a harder question: what did the agent actually know, where did it come from, and can you prove it?

Memory is not accountability

A better memory makes an agent recall more. It says nothing about whether that knowledge was ever vetted, where it came from, or what the agent used at decision time. When something breaks, "the model remembered wrong" is not an acceptable postmortem.

So the brain is built around the receipt: every answer ships an inline citation to its source, backed by a tamper-evident audit trail you can verify after the fact. Recall is table stakes; the receipt is the product.

Compile, then govern

Two moves, in order, and the order is the whole idea:

Compile. Raw documents get derived into knowledge — summaries, concepts, contradictions — instead of being chopped into look-alike chunks and dumped into a similarity index.
Govern. Nothing becomes durable memory until deterministic code — rules, not model judgment — passes it: dedupe → policy → promotion, every decision appended to an audit log. The model proposes; the system decides and records.

A fact's journey, source to citation

Ingest

raw docs

PDF, markdown, notes — the source material.

Compile

the compiler

Six passes derive knowledge, not chunks (open-source ICO).

Govern

the control plane

Dedupe → policy → promote, by code (open-source INTKB).

Retrieve

qmd

On-device search; every hit is a citation.

every hop appended to a SHA-256 hash-chained trace → the receipt

Receipts — the part the category skips

Every retrieval, promotion, and compile becomes one line in an append-only log, and each line carries the SHA-256 hash of the line before it. Alter or reorder any record and the chain breaks, verifiably. There's a runnable verifier:

$ ico audit verify --json
{ "ok": true, "filesScanned": 1, "totalEvents": 61, "cleanFiles": 1, "breaks": [] }

Is it real? The full chain — compile → spool → govern → index → search → audit — runs end-to-end on a real corpus. Latest published run:

7/7

pipeline stages green

candidates promoted

cited answers returned

audit-chain breaks

Source for all of it — the numbers, the fixtures, the nightly CI that replays the deterministic half — is in the public governed-second-brain repo.

What it doesn't claim

Tamper-evident, not tamper-proof. The hash chain plus a git-anchored log prove a record wasn't quietly changed. It is not a blockchain, it is not immutable storage, and on a single machine it doesn't prove who wrote what — pushing the anchor to a remote plus per-actor signatures is what upgrades detection into attribution. Honesty is the point of a receipt, so the trust model is stated, not implied.

And the rule from chapter 2 holds here: volatile snapshots never enter the brain. Only durable conclusions — decisions, closed work with evidence, verified facts — get compiled. That's what keeps a cited answer worth citing.

Try it yourself

The whole stack is open source (Apache-2.0) and runs locally — no daemon, no network required. If you've got a technical person, hand them this: one command inside Claude Code or Cowork and the brain is running on their own files.

$ npx governed-second-brain init <folder>

Repos: the plugin · the compile layer · the govern layer · retrieval by tobi/qmd.