Capture without granting trust
Notes and messages can enter through a simple edge, but capture alone does not make them durable knowledge or give them authority over the system.
Open-source project · Local-first system design
Ryuk Memory OS
A local-first memory system that keeps untrusted input away from durable personal knowledge until it has been sanitised, reviewed and approved.
Interactive walkthrough
How untrusted input becomes reviewed memory
The system does not give a model direct write access to canonical memory. Each boundary has a specific purpose.
Capture edgeuntrusted input
Source registryidentity + provenance
Sanitiserdeterministic rules
untrusted zone → review boundary → trusted zone
Review queuehuman decision
Trusted writersingle write path
Git-backed memoryMarkdown + history
Keep source identity attached
The source registry records where material came from so later memory entries can retain evidence and avoid becoming anonymous assertions.
Apply predictable sanitisation
Deterministic rules remove or transform material before review. This step is intentionally separate from model judgement.
Require a human decision
A review queue lets the user approve, edit or reject proposed memory. Untrusted input cannot cross the boundary automatically.
Use one controlled writer
Only a trusted component can modify canonical memory. Models may propose content, but do not receive a general write capability.
Store memory in inspectable formats
Approved memory is written as Markdown under Git, with searchable metadata and provenance so changes remain understandable and reversible.
Design decisions
Trust boundaries before model capability
Canonical memory stays human-reviewed
The system prioritises durable, inspectable memory over frictionless automatic capture.
Plain files remain the source of truth
Markdown and Git make memory portable, reviewable and recoverable without depending on a proprietary database interface.
Provenance travels with the memory
Reviewed entries retain evidence about their origin, supporting later verification and reducing context loss.
Why this matters
Personal memory systems contain sensitive context and influence later decisions. The architecture makes trust explicit instead of assuming every captured item is safe or correct.
What the repository contains
- Source registry and capture workflow
- Deterministic sanitisation
- Human review queue
- Trusted writer and provenance
- Git-backed Markdown storage
- Search and evidence-pack functionality