ostk-fleet-recall

Agents are replaceable. Their memory shouldn't be—and when two disagree, memory should say so.

Shared, durable semantic memory for agent fleets, backed by CockroachDB while preserving Recall's local-first semantics and two-tool MCP contract. It works with any MCP client; OSTK orchestration is an optional integration, not an install or runtime requirement.

ostk-recall remains the private, local-first corpus powered by LanceDB and SQLite. Fleet Recall is the distributed backend for agents that need to share memory across processes and hosts. This repository is new work for the CockroachDB AI Agents Hackathon and reuses the separately disclosed ostk-recall project.

The implemented hackathon surface is intentionally small:

• recall(search|get|conflicts|status) reads hybrid vector/lexical corpus and typed-claim state.
• remember(record) records a deliberate typed claim with provenance, idempotent mutation receipts, and conflict detection.
• ingest is a trusted operator CLI for populating the active chunk corpus.
• reference-agent runs one bounded step of the deterministic rollout-safety policy used by the default AWS agent proof.
• demo is a bounded, read-only HTTP surface; it exposes no mutation route.

The reference policy agent is ordinary Fleet Recall application code: it retrieves memory, applies an explicit deterministic policy, and records a cited action. It does not invoke OSTK, an LLM, or a model API. The OSTK adapter is a strictly optional interoperability path.

Four operational binaries are private workstation tools, not product or hosted routes. ostk-control-bootstrap and ostk-registry-activate implement the Stage-2 and genesis Stage-3 ceremonies. ostk-registry-successor-activate applies or inspects the one-time genesis-to-first-successor transition through the checked-in successor repository. ostk-conflict-reconcile is apply-only and materializes a new v2 conflict lineage for one immutable legacy conflict revision. None is copied into the production image or wired into Terraform, ECS, the public HTTP service, or normal MCP/runtime startup.

Attention schema space is reserved for future compatibility, but attention actions and a runtime attention workflow are not implemented in this hackathon slice. Additional canonical Recall actions are also future work.

Evidence status

Source and deployment evidence are intentionally reported separately. The current checkout embeds migrations 1 through 18. Current release completion requires exactly the eighteen successful rows 1 through 18. Serving requires an uninterrupted successful prefix of at least 18 and remains compatible with later additive migrations; a later successful row cannot hide a missing or failed prerequisite. The private compatibility gates deliberately remain narrower: Stage-2 control requires prefix 1 through 3, genesis Stage-3 requires 1 through 9, the first-successor repository requires 1 through 14, and conflict-detector reconciliation requires 1 through 16.

Migrations 12 through 14 supply the three successor tables. The successor repository, apply/inspect workstation CLI, and database-local fleet_registry_successor_activation one-shot role policy now exist. The policy is cluster-admin-only and creates a hardened NOLOGIN logical role; it does not provision a login or add an AWS secret, task, production-image binary, startup hook, or public/runtime route. The deny-only quarantine continues to keep those tables away from PUBLIC and the three prior application logical roles, and the reconciliation policy separately grants them no successor-table access. A separately provisioned successor login may receive role membership only for an exclusive local ceremony after cleanup of the other optional role's creator-scoped PUBLIC routine default and either-direction membership edges, the required external cross-database and PUBLIC-authority audit, and immediate policy reapply. It must lose that membership and login capability afterward. Conflict reconciliation likewise has an apply-only workstation CLI and a database-local, cluster-admin-only one-shot role policy. Database ownership is insufficient for either policy, and their mandatory cross-database audits remain external operator steps. Neither has Terraform, ECS, production-image, serving, or runtime wiring.

The current source separately implements the PUBLIC-03 publication boundary. The only admitted public login is fleet_publication, which inherits one NOLOGIN logical role, fleet_publication_reader. That role has CONNECT on fleet_recall, USAGE on public, and SELECT on exactly _sqlx_migrations, memory_corpus_models, memory_chunks, memory_claim_embeddings, memory_claim_support, memory_claims, memory_conflict_members, and memory_conflicts. It has no sequence, DML, DDL, system, delegation, or private-table authority. demo accepts only FLEET_RECALL_PUBLICATION_DATABASE_URL and rejects writer, control, activation, reconciliation, and test database variables. Its pool witnesses current_user = fleet_publication, current_database = fleet_recall, the fixed ostk-fleet-recall-publication application name, and canonical search_path = pg_catalog, public, pg_temp both when a connection is created and before it is reused.

The checked-in Terraform now plans a distinct publication secret, execution role, task role, and publication-only customer-managed KMS key set. Those Terraform changes are validated but unapplied. A local authoritative TLS run against the exact official CockroachDB v26.2.3 binary passed the publication reader and existing repository/private-CLI matrix. The full LocalStack production-image PUBLIC-03 smoke also passed at source commit cd6ecfca2c1a6d112ba058aad899a21aa34bb0f4, including direct read, denied DML, DDL, and role delegation, writer-protocol denial in the public container, and recall after replacing that container; its source-bound receipt records the exact limits. Its database is deliberately insecure, so this does not prove database TLS, password authentication, real IAM, Fargate, or any AWS apply.

None of those source facts upgrades the historical cloud evidence below. The live revision-10 deployment predates this source boundary and proves a read-only HTTP route, not the new publication database or IAM separation.

The submission candidate is live at https://d13zrqfh66r7ub.cloudfront.net. The live revision-10 cutover runs source commit 56b577c82b9c5a5c80d73103f7f6b56d51698872 as immutable ARM64 image tag git-56b577c82b9c. The serving, migration, seed, and reference-agent task-definition families are all revision 10, and the service is healthy with one desired and one running task. Its idempotent rich-seed task exited zero and upserted exactly 552 rows: 346 documentation chunks, 2 code chunks, and 204 operations chunks. The public API returned repository-backed hits with the exact release source_revision and inclusive source-line ranges. Final desktop and 390px mobile QA verified safe inline Markdown, immutable exact #Lx-Ly links, a relative repository link rendered as a code-styled anchor, and no horizontal overflow. The final seven-query smoke gate passed. The public status surface reports CockroachDB 26.2.5, schema version 2, enabled vector, lexical, conflict-membership, and claim-support-chunk indexes, working cosine distance, and the pinned 512-dimension embedding model. The ECR Basic OS-package scan is COMPLETE with an empty finding-severity count; this does not claim Rust, Go, or application-dependency coverage. GitHub Actions run 31832684235 completed all five jobs successfully for this release.

The checked-in seven-query public relevance receipt is historical revision-7 evidence for the prior 548-row image boundary. It records exact conflict mappings for the specification-versus-code and migration examples, four relevant conflict-free answers, and zero results with zero conflicts for a nonsense query. It was not regenerated for revision 10 and must not be presented as the revision-10 smoke receipt.

The checked-in receipts below are historical revision-6 cloud evidence; the reference-agent and replacement proofs were not rerun for the current revision-10 release. The publication-safe source-conflict self-audit receipt proves that semantic recall surfaced the exact documentation and code sources behind incompatible Boolean claims 9 and 10 and projected their exact open conflict 3. The reference-agent receipt then correlates decision, action, incompatible-decision, and escalation claims 15/16/17/18 with open conflict 5 across four one-off Fargate tasks. The replacement receipt records a fully disjoint serving-task-set replacement that preserved exact public claims 16 and 18 through lexical/dense RRF; the publication verifier receipt cross-validates the pair. These were observed live in AWS/CockroachDB Cloud, but they describe the revision-6 boundary, not a revision-10 reference-agent or replacement run. LocalStack and local tests remain preflight evidence only.

HTTPS is provided by CloudFront's default certificate. AWS fixes that generated-hostname viewer policy at a TLSv1 minimum, although newer TLS can be negotiated. CloudFront reaches the ALB over restricted HTTP, guarded by the CloudFront origin-facing prefix list and a secret origin header, so this is not an end-to-end-TLS or TLS-1.2-minimum claim.

The publication-safe CockroachDB Cloud EXPLAIN artifact records all assertions passing for the exact production project-vector, source-vector, and lexical SQL shapes on a 10,001-row disposable fixture. The plans select memory_chunks_semantic_idx, memory_chunks_source_semantic_idx, and memory_chunks_lexical_idx. The production database was untouched, the fixture database was dropped, and the temporary workstation network rule was removed. The final public video and remaining entrant/Devpost fields are still release gates. This separately captured plan evidence was not rerun as part of the revision-10 cutover.

The final-cut plan leads with the live AWS UI and then shows the reviewed cloud agent and replacement receipts; see docs/VIDEO_DEMO.md. A standalone Fleet Recall MCP capture is optional local terminal footage, and a verified OSTK render is an optional alternate. Neither substitutes for cloud proof.

Keep the public judging deployment free and unrestricted through September 15, 2026 at 5:00 PM EDT / 4:00 PM CDT. Do not scale it to zero or tear down its AWS, CockroachDB Cloud, DNS/TLS, model, secret, logging, or network dependencies before that hold expires.

Local quickstart

This path starts one disposable CockroachDB node, loads the pinned 512-dimension model, ingests the synthetic demo corpus, exercises HTTP recall, and makes real MCP calls. A single node is useful for application development; it does not demonstrate CockroachDB's production availability or distributed topology.

Prerequisites

• Rust 1.94 or newer, including Cargo, rustfmt, and Clippy. The crate's MSRV is 1.94.
• Docker Engine. Docker Desktop is sufficient on macOS and Windows.
• CockroachDB 26.2.3. The quickstart uses the pinned official Docker image and invokes cockroach sql inside it, so a separate host CLI install is not required.
• The official Hugging Face hf CLI.
• curl and jq for the HTTP smoke calls.
• Approximately 3 GB free for Rust dependencies, the CockroachDB image/data, and the 129 MB model weights.

Run all commands below from the repository root. First build the locked Rust dependency graph:

rustc --version
cargo build --locked
export FLEET_RECALL_BIN="$PWD/target/debug/ostk-fleet-recall"

1. Acquire and pin the local embedding model

Fleet Recall uses MinishLab's potion-retrieval-32M model, published under the MIT license. The command below pins the model repository to commit 6fc8051fab2a1e0ee76689cf08c853792ac285e7 instead of following a mutable branch:

export FLEET_RECALL_MODEL_REVISION=6fc8051fab2a1e0ee76689cf08c853792ac285e7
export FLEET_RECALL_MODEL_STAGE="$PWD/.model-stage/potion-retrieval-32M"
export FLEET_RECALL_MODEL_DIR="$PWD/.models/potion-retrieval-32M-$FLEET_RECALL_MODEL_REVISION"

mkdir -p "$FLEET_RECALL_MODEL_STAGE" "$FLEET_RECALL_MODEL_DIR"
hf download minishlab/potion-retrieval-32M \
  config.json model.safetensors tokenizer.json \
  --local-dir "$FLEET_RECALL_MODEL_STAGE" \
  --revision "$FLEET_RECALL_MODEL_REVISION"

for file in config.json model.safetensors tokenizer.json; do
  cp -L "$FLEET_RECALL_MODEL_STAGE/$file" "$FLEET_RECALL_MODEL_DIR/$file"
  test -f "$FLEET_RECALL_MODEL_DIR/$file" && test ! -L "$FLEET_RECALL_MODEL_DIR/$file"
done

hf download --local-dir is the official local-folder flow. The explicit cp -L creates a release bundle of regular, dereferenced files even if a local Hugging Face cache uses links. Fleet Recall rejects a required bundle entry if it is a symlink or not a regular file.

The repository revision pins the upstream source; Fleet Recall separately pins the exact runtime bytes. Compute its domain-separated digest:

export FLEET_RECALL_EMBEDDING_MODEL_SHA256=$(
  "$FLEET_RECALL_BIN" model-digest "$FLEET_RECALL_MODEL_DIR"
)
printf '%s\n' "$FLEET_RECALL_EMBEDDING_MODEL_SHA256"

The digest covers the filename, size, and contents of exactly config.json, model.safetensors, and tokenizer.json, sorted under the ostk-fleet-recall-model-bundle-v1 domain. Unrelated directory entries and the host path are excluded. migrate, ingest, health, demo, and serve verify this digest; model-loading paths verify before and after loading. The database registry identity is the stable logical model ID plus this digest, never a machine-specific path.

If maintainers intentionally advance the Hugging Face revision, keep the new revision explicit, recompute the Fleet Recall digest, and use a new empty or fully re-embedded corpus generation. Do not silently change model bytes under an existing corpus.

2. Start a local CockroachDB 26.2 node

The image and command match the repository's live-test target and CockroachDB's start-single-node development flow:

docker volume create ostk-fleet-recall-crdb
docker run --detach \
  --name ostk-fleet-recall-crdb \
  --add-host cockroach:127.0.0.1 \
  --publish 127.0.0.1:26257:26257 \
  --publish 127.0.0.1:8081:8080 \
  --volume ostk-fleet-recall-crdb:/cockroach/cockroach-data \
  --volume "$PWD/deploy/cockroach:/localstack:ro" \
  cockroachdb/cockroach:v26.2.3 \
  start-single-node \
  --insecure \
  --http-addr=ostk-fleet-recall-crdb:8080 \
  --store=/cockroach/cockroach-data

FLEET_RECALL_CRDB_READY=0
for _attempt in $(seq 1 120); do
  if docker exec ostk-fleet-recall-crdb \
    cockroach sql --insecure --host=127.0.0.1:26257 \
    --execute='SELECT 1' >/dev/null 2>&1; then
    FLEET_RECALL_CRDB_READY=1
    break
  fi
  if [ "$(docker inspect --format '{{.State.Running}}' ostk-fleet-recall-crdb 2>/dev/null)" != true ]; then
    docker logs ostk-fleet-recall-crdb
    exit 1
  fi
  sleep 1
done
if [ "$FLEET_RECALL_CRDB_READY" -ne 1 ]; then
  docker logs ostk-fleet-recall-crdb
  exit 1
fi

docker exec ostk-fleet-recall-crdb \
  cockroach sql --insecure --host=127.0.0.1:26257 \
  --execute='
    CREATE DATABASE IF NOT EXISTS fleet_recall;
    CREATE USER IF NOT EXISTS fleet_migrator;
    ALTER USER fleet_migrator WITH LOGIN NOCREATEDB NOCREATEROLE;
    GRANT admin TO fleet_migrator;
  '

The SQL endpoint is 127.0.0.1:26257; the local DB Console is http://127.0.0.1:8081. The named volume keeps local data across container restarts.

This node has no TLS, authentication, replication, or production isolation. Fleet Recall accepts an insecure database URL only when FLEET_RECALL_ALLOW_INSECURE_LOCAL_DATABASE=1 and the host is loopback (or the Compose-only cockroach hostname). Production configuration must omit that escape hatch and use sslmode=verify-full.

3. Migrate and ingest through the private capability

Set every required runtime coordinate. Tenant, project, and agent are deployment authority, not request routing fields. The sample tenant is non-nil; generate a different stable UUID for every real fleet.

local_pg_scheme=postgresql
local_migrator_password=local-migrator-only
export FLEET_RECALL_DATABASE_URL="${local_pg_scheme}://fleet_migrator:${local_migrator_password}@127.0.0.1:26257/fleet_recall?sslmode=disable"
export FLEET_RECALL_ALLOW_INSECURE_LOCAL_DATABASE=1
export FLEET_RECALL_TENANT_ID=0198a849-f6ae-7d61-9800-000000000001
export FLEET_RECALL_PROJECT=quickstart
export FLEET_RECALL_AGENT=quickstart-agent
export FLEET_RECALL_MAX_CONNECTIONS=4
export FLEET_RECALL_EMBEDDING_MODEL=minishlab/potion-retrieval-32M
export FLEET_RECALL_EMBEDDING_MODEL_PATH="$FLEET_RECALL_MODEL_DIR"
export RUST_LOG=ostk_fleet_recall=info

This private URL is the only database capability in the process while it applies the embedded schema and loads the included non-sensitive corpus. Do not start the public demo yet:

"$FLEET_RECALL_BIN" migrate
"$FLEET_RECALL_BIN" ingest --input examples/demo.ndjson
"$FLEET_RECALL_BIN" health

The current embedded migrator applies versions 1 through 18 in three phases. Versions 1 through 11 execute without a wrapping SQL transaction because of CockroachDB schema-changer and schema-lock constraints; v10 and v11 are resumable only because they verify an exact committed index before SQLx records success. Versions 12 through 14 run transactionally on a dedicated migration session with autocommit_before_ddl = false. Versions 15 through 18 return to the resumable online-DDL policy, version conflict identity by detector, add the exact reconciliation/current-projection indexes, and add the Stage-4 evidence ledger, governed content store, relation projection, and read-only writer-authority view. Never run multiple migrators concurrently or run the migration files manually as a substitute for that policy. See migration and recovery rules before recovering a failed migration.

4. Establish the publication boundary and exercise the HTTP demo

Quiesce the private migrator, provision the fixed publication principal, run the complete cross-database/PUBLIC audit, apply and reapply the reviewed reader policy under the same change freeze, and only then enable the publication login. The checked-in boundary helper fails closed on an unexpected database, grant, owner, future default, role edge, or policy digest:

docker exec --interactive ostk-fleet-recall-crdb \
  /bin/sh -s < deploy/localstack/database-boundary.sh

unset FLEET_RECALL_DATABASE_URL
local_publication_password=local-publication-only
export FLEET_RECALL_PUBLICATION_DATABASE_URL="${local_pg_scheme}://fleet_publication:${local_publication_password}@127.0.0.1:26257/fleet_recall?sslmode=disable"

The demo now has only its publication URL. On every new and reused pooled connection it re-witnesses the fixed login, database, application name, and canonical search path before any recall SQL runs. Start the local server, wait for readiness, recall the ingested idea, and stop it:

"$FLEET_RECALL_BIN" demo --listen 127.0.0.1:8088 &
FLEET_RECALL_DEMO_PID=$!

FLEET_RECALL_DEMO_READY=0
for _attempt in $(seq 1 120); do
  if curl --fail --silent http://127.0.0.1:8088/healthz >/dev/null; then
    FLEET_RECALL_DEMO_READY=1
    break
  fi
  if ! kill -0 "$FLEET_RECALL_DEMO_PID" 2>/dev/null; then
    wait "$FLEET_RECALL_DEMO_PID"
    exit 1
  fi
  sleep 1
done
if [ "$FLEET_RECALL_DEMO_READY" -ne 1 ]; then
  kill "$FLEET_RECALL_DEMO_PID" 2>/dev/null || true
  wait "$FLEET_RECALL_DEMO_PID" || true
  exit 1
fi

curl --fail --silent --show-error http://127.0.0.1:8088/api/status | jq
curl --fail --silent --show-error \
  --header 'content-type: application/json' \
  --data '{"query":"What happens when fleet agents disagree?","limit":5}' \
  http://127.0.0.1:8088/api/recall | jq

kill "$FLEET_RECALL_DEMO_PID"
wait "$FLEET_RECALL_DEMO_PID" || true

The HTTP service exposes only /, /healthz, /api/status, and bounded POST /api/recall. It is a hackathon demonstrator, not an authenticated multi-tenant control plane.

5. Exercise the MCP server

serve speaks newline-delimited JSON-RPC/MCP on stdin/stdout. The following is a complete direct smoke exchange. Keep each JSON request on one physical line; the initialized notification intentionally has no response. The public capability is removed first because MCP includes the private remember tool; the boundary helper provisioned this DML-only writer without DDL authority.

unset FLEET_RECALL_PUBLICATION_DATABASE_URL
local_writer_password=local-writer-only
export FLEET_RECALL_DATABASE_URL="${local_pg_scheme}://fleet_writer:${local_writer_password}@127.0.0.1:26257/fleet_recall?sslmode=disable"

"$FLEET_RECALL_BIN" serve <<'JSONRPC'
{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"readme-smoke","version":"1.0.0"}}}
{"jsonrpc":"2.0","method":"notifications/initialized","params":{}}
{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}
{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"recall","arguments":{"action":"search","scope":{"project":"quickstart","agent":"quickstart-agent","session_id":"readme","privacy_tier":"t1_project"},"query":"How does fleet memory survive agent restarts?","kind":"chunk","limit":5}}}
{"jsonrpc":"2.0","id":4,"method":"tools/call","params":{"name":"remember","arguments":{"action":"record","scope":{"project":"quickstart","agent":"quickstart-agent","session_id":"readme","privacy_tier":"t1_project"},"idempotency_key":"readme/single-migrator/v1","kind":"decision","text":"Fleet schema migration runs through one dedicated migrator before serving traffic.","subject":"fleet deployment","predicate":"migration strategy","value":"single dedicated migrator","actor":"quickstart-agent"}}}
{"jsonrpc":"2.0","id":5,"method":"tools/call","params":{"name":"recall","arguments":{"action":"search","query":"How should schema migration run?","kind":"claim","limit":5}}}
JSONRPC

Rerunning the same remember request with the same tenant-wide idempotency key returns the stored mutation with idempotent_replay set and does not create a second durable mutation. A changed full request using that key is rejected. This is at-most-one committed mutation behavior, not exactly-once response delivery; after an ambiguous response, retry the same full request and key.

Most stdio MCP clients use a configuration shaped like the following. Replace the absolute paths and digest; this example deliberately contains only local, insecure development credentials. Client-specific configuration file names and top-level keys vary.

{
  "mcpServers": {
    "ostk-fleet-recall": {
      "command": "/absolute/path/to/ostk-fleet-recall/target/debug/ostk-fleet-recall",
      "args": ["serve"],
      "env": {
        "FLEET_RECALL_DATABASE_URL": "REPLACE_WITH_PRIVATE_WRITER_URL",
        "FLEET_RECALL_ALLOW_INSECURE_LOCAL_DATABASE": "1",
        "FLEET_RECALL_TENANT_ID": "0198a849-f6ae-7d61-9800-000000000001",
        "FLEET_RECALL_PROJECT": "quickstart",
        "FLEET_RECALL_AGENT": "quickstart-agent",
        "FLEET_RECALL_MAX_CONNECTIONS": "4",
        "FLEET_RECALL_EMBEDDING_MODEL": "minishlab/potion-retrieval-32M",
        "FLEET_RECALL_EMBEDDING_MODEL_PATH": "/absolute/path/to/ostk-fleet-recall/.models/potion-retrieval-32M-6fc8051fab2a1e0ee76689cf08c853792ac285e7",
        "FLEET_RECALL_EMBEDDING_MODEL_SHA256": "PASTE_MODEL_DIGEST_HERE",
        "RUST_LOG": "ostk_fleet_recall=info"
      }
    }
  }
}

Do not put a production CockroachDB URL into a checked-in MCP configuration. Use the client's secret/environment facility and a TLS URL instead.

Ingestion contract

ingest --input PATH reads NDJSON; --input - (the default) reads stdin:

"$FLEET_RECALL_BIN" ingest --input examples/demo.ndjson
"$FLEET_RECALL_BIN" ingest --input - < examples/demo.ndjson

Each nonblank line is one object:

{"source":"markdown","source_id":"demo/architecture","text":"Fleet Recall keeps durable semantic memory in CockroachDB.","chunk_index":0,"facets":{"tags":["demo","architecture"]},"role":"primary"}

Required fields are source, source_id, and nonblank text. Optional fields are source_config_id (default fleet:ndjson:v1), chunk_index (default 0), RFC 3339 ts, role (primary, evolution, or usage), links, facets, and object-valued extra. Unknown fields are rejected. Input cannot provide tenant, project, agent, session, privacy, chunk ID, embedding, stale state, or internal claim, conflict, or transcript-projection metadata. Trusted deployment configuration supplies scope; the importer derives stable chunk/content/embedding-input hashes.

The importer accepts at most 10,000 records, 1 MiB per physical line, 64 MiB total input, and 256 KiB text per record, with additional facet/link bounds. It also caps each whitespace-delimited text lexeme at 16,000 UTF-8 bytes, below CockroachDB's 16,383-byte TSVECTOR lexeme limit. It parses, validates, deduplicates, embeds, and vector-validates the full input before the first chunk write. Upserts use stable IDs, so rerunning the same import is safe. A database failure can leave a valid prefix applied; rerunning converges that prefix and the remaining rows.

Trust and safety boundaries

• A process is bound to one non-nil tenant, project, trusted agent, and current t1_project privacy tier. MCP may repeat project, agent, actor, or privacy as exact assertions; it cannot redirect them. Tenant is never a wire field.
• Session is a caller-selected subdivision under the trusted agent, not an authorization principal. Privacy narrowing is rejected because durable owner/tier row visibility is not implemented yet.
• Actor provenance is derived from the trusted deployment agent. A supplied remember.actor is only an exact assertion and is stripped at the MCP edge.
• MCP frames, tool results, searches, conflict projections, claim passages, ingestion, and HTTP bodies/results are bounded. Backend details are redacted from protocol errors.
• Recalled chunks, claims, transcripts, telemetry, and Markdown are untrusted evidence, not instructions or authorization. Consumers must verify sources and apply external agent/operator policy before acting on them.
• Corpus rows use one registered 512-dimension embedding generation per tenant/project. A mismatched model path, digest, vector dimension, or active registry identity fails closed.
• Claim, support, conflict, receipt, corpus projection, and audit-event changes commit in one serializable mutation. Only CockroachDB SQLSTATE 40001 automatically retries the complete transaction.
• The serving and Stage-2 local --insecure database escape is development-only. Cloud and other non-loopback URLs must use TLS verification; Stage-3 activation always requires sslmode=verify-full, even on loopback.
• The HTTP demo exposes no MCP, ingest, bootstrap, activation, or mutation route. It also accepts only FLEET_RECALL_PUBLICATION_DATABASE_URL and rejects every private writer/control/test database variable. Its exact fleet_publication_reader role can read only the eight status/recall tables; it has no sequences, DML, DDL, system, delegation, or private-table authority. New and reused pool connections re-witness the fixed fleet_publication login, fleet_recall database, ostk-fleet-recall-publication application name, and canonical search path. Do not expose a future mutation route publicly without workload identity, authorization, rate limiting, and production network controls.
• Migrations 12 through 14 reserve durable successor state, and a private successor repository, workstation CLI, and reviewed one-shot logical-role policy exist. The deny-only quarantine keeps their three tables away from runtime and the prior private roles. Only a separately provisioned login in the hardened fleet_registry_successor_activation role may receive the policy's exact table surface during an exclusive local ceremony; no AWS, image, startup, or serving credential is authorized. Repository code and contracts alone do not authorize a production write.
• The v2 conflict detector is proposition-aware: different affirmative values conflict; affirmation and negation conflict only for the same exact value; two negations are compatible. Legacy detector rows are immutable. The apply-only reconciliation CLI appends a separately versioned v2 lineage and preserves the legacy row, memberships, receipts, and transition history.

See security and supply-chain policy and the architecture for the complete invariants.

Tests

The repository CI contract is reproducible on Rust 1.94:

cargo fmt --all -- --check
cargo check --locked --all-targets
cargo test --locked --all-targets
cargo clippy --locked --all-targets -- -D warnings

Database tests skip unless explicitly pointed at a disposable CockroachDB 26.2 database. Against the local quickstart database, run them serially. The plan test writes more than 10,000 fixture rows, so do not target shared or valuable data:

export FLEET_RECALL_TEST_DATABASE_URL="$FLEET_RECALL_DATABASE_URL"

cargo test --locked \
  store::cockroach::tests::live_cockroach_round_trip_when_configured \
  -- --nocapture --test-threads=1
cargo test --locked \
  ledger::cockroach::tests::live_claim_conflict_and_replay_when_configured \
  -- --nocapture --test-threads=1
cargo test --locked \
  store::cockroach::tests::live_cockroach_dense_plan_uses_vector_index_when_configured \
  -- --nocapture --test-threads=1

The final test asserts that representative dense, source-prefixed dense, and lexical queries select their intended CockroachDB indexes rather than proving only one-row functional behavior.

The authoritative migration correctness lane targets the pinned official CockroachDB v26.2.3 binary and covers fresh, interruption, catalog-drift, transactional rollback, successor-repository and successor-CLI state matrices, functional-polarity, conflict reconciliation, the publication reader, and all four private CLIs through migration 18 on one checksum-pinned TLS server. That complete local wrapper passed. The full role allow/deny/grant-option matrices remain separate Docker RBAC proofs. The current LocalStack production-image PUBLIC-03 smoke passed at commit cd6ecfca2c1a6d112ba058aad899a21aa34bb0f4; the older through-migration-9 run remains historical evidence only. None of these local results is AWS deployment evidence.

Deployment and project documentation

• LocalStack contract harness: builds the real image and exercises S3/Secrets Manager interfaces with local CockroachDB. It is an emulator preflight, not evidence of an AWS deployment.
• Optional OSTK adapter demo: can coordinate bounded OSTK model sessions through a checked-in non-native stdio bridge; Fleet Recall, its deterministic policy agent, and the default plan require no OSTK or LLM run.
• Reproducible terminal video: renders the four-pane tmux scenario with VHS from sanitized rehearsal evidence, a fresh verified standalone Fleet Recall MCP run, or an explicitly optional verified OSTK run.
• Cloud onboarding: explicit AWS/CockroachDB account, approval, cost, identity, TLS, model, and teardown gates.
• AWS Terraform runbook: dormant-by-default ECS/Fargate, ALB, CloudFront, ECR, S3, Secrets Manager, and CloudWatch infrastructure, including the four-step deterministic reference-agent proof flow and the sanitized record of the live submission deployment.
• Architecture, draft dynamic corpus and causal runtime architecture, migration operations, and security policy.
• CockroachDB Agent Skills audit and requirements/evidence matrix.
• Product/backend boundary ADR, Stage-4 runtime foundations ADR, delivery plan, and hackathon submission packet.

Cleanup

Stop the local database while preserving its named volume:

docker stop ostk-fleet-recall-crdb

Restart it later with docker start ostk-fleet-recall-crdb. Removing the container or volume is intentionally left as an explicit operator decision because the volume contains the local memory corpus.

License

Fleet Recall is available under either the Apache License 2.0 or MIT license. The pinned MinishLab model is separately published under MIT; see its linked model card for attribution and license metadata.

Source-linked demo evidence

The public recall cards render the bounded inline Markdown retained by the corpus and link every repository-backed documentation or code chunk to the immutable source commit and exact inclusive line range recorded at ingestion. Synthetic operations narratives remain visibly unlinked because they are generated evidence, not checked-in source files.