Tag: MCP

(Curation is Sovereignty)

Sovereign Synapse Series | Post 2

AI is polite by design. It prefaces its answers with “Certainly! I’d be happy to help” and closes with “I hope this information is useful.” In a casual chat, these conversational “handshakes” are harmless. In a Cognitive Estate—a permanent, local archive of your thoughts—they are a Prose Tax.

Last time, we successfully evacuated our intellectual history from the cloud. But once the data landed on local silicon, the reality of “raw” data set in. To turn a disorganized data dump into a high-fidelity archive, we must move from ingestion to Forensic Curation.

🛠️ Builder’s Note: The Roundtable Pivot

When I published Part 1, the community exploded with architectural feedback. While discussing the code, an engineer named WAB raised a critical long-term systems question: As a local memory store grows, multiple autonomous local agents will eventually read, write, and refactor these synapses. How does an agent running six months from now know that a specific memory chunk is a high-fidelity historical insight rather than a corrupted file or an adversarial local injection?

The solution was elegant: don’t just clean the data—sign it. By integrating an Ed25519 cryptographic layer at the moment of distillation, we move from simple file cleanup to establishing an immutable Chain of Custody for our thoughts.

But pushing a zero-trust cryptographic layer into a production pipeline meant surviving a rigorous multi-round systems audit. We didn’t just merge naive code. We engineered a canonical sorted-JSON payload structure to prevent newline field-injection attacks, enforced continuous POSIX owner-only permission validations to neutralize local forgery vectors, and ensured our verification paths were strictly side-effect free—guaranteeing that read operations never accidentally mutate disk state by generating blank keys. We subjected our architecture to enterprise-grade rigor before allowing a single byte to hit local silicon.

The Problem: Ghost Nodes and Corporate Boilerplate

OpenAI exports are not linear files; they are complex branching trees. A naive extractor often trips over “ghost nodes”—dangling references or messages with missing timestamps that cause standard scripts to crash. Our updated adapter now uses defensive null-guards to ensure these broken links don’t halt the evacuation.

Even when the extraction is stable, the result is cluttered. When you have thousands of files in your vault, you don’t want your local semantic search results polluted by generic AI pleasantries. You want the signal: the technical reasoning, the code, the breakthrough. If you don’t strip the prose at the edge, you pay an Interpretation Tax in downstream inference costs every single time an agent reads that memory.

The Build: The Structural Sieve & Signer

To solve this without destroying the original record, we built a Context-Cleaner that acts as a structural sieve. We pattern-match on the layout to separate the Preamble (the intro) from the Postamble (the outro).

Once the text is stripped of its corporate residue, we run it through our Zero-Trust Signer to seal the contract before it hits local storage.

# core/context_cleaner.py
import os
import re
import logging
import tempfile
from pathlib import Path
from datetime import datetime
from cryptography.hazmat.primitives.asymmetric import ed25519

_CORE_DIR = os.path.dirname(os.path.abspath(__file__))
_REPO_ROOT = os.path.abspath(os.path.join(_CORE_DIR, os.pardir))
DEFAULT_KEYS_DIR = os.path.abspath(os.path.join(_REPO_ROOT, "vault", "keys"))
_logger = logging.getLogger(__name__)

def _atomic_write_bytes(path: Path, data: bytes) -> None:
    """Writes data to path atomically via a temp file in the same directory.

    Guarantees os.replace stays on one filesystem to avoid cross-device EXDEV errors.
    """
    directory = path.parent
    directory.mkdir(parents=True, exist_ok=True)
    fd, tmp_path = tempfile.mkstemp(prefix=f".{path.name}.", suffix=".tmp", dir=str(directory))
    tmp = Path(tmp_path)
    try:
        with os.fdopen(fd, "wb") as handle:
            handle.write(data)
        os.replace(tmp, path)
    except Exception:
        tmp.unlink(missing_ok=True)
        raise

class ContextCleaner:
    """Heuristic-based scanner to identify and flag AI conversational noise."""

    @classmethod
    def verify_signature(
        cls,
        signature_hex: str,
        *,
        receipt_id: str,
        structural_signal: str,
        user_text: str,
        timestamp: datetime,
        keys_dir: Path | None = None,
    ) -> bool:
        """Adheres strictly to a boolean contract. Fails closed on permission or system errors."""
        from cryptography.exceptions import InvalidSignature
        from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey

        directory = resolve_keys_dir(keys_dir)
        try:
            public_key = Ed25519PublicKey.from_public_bytes(_load_public_key_bytes(directory))
            payload = _signing_payload(receipt_id, structural_signal, user_text, timestamp)
            public_key.verify(bytes.fromhex(signature_hex), payload)
            return True
        except (PermissionError, FileNotFoundError, RuntimeError) as exc:
            _logger.warning(
                "Cannot verify Sovereign Synapse signature: public signing key "
                "unavailable or inaccessible (%s). Ensure vault/keys/ is readable "
                "by this process or set SYNAPSE_KEYS_DIR with correct permissions.",
                exc,
            )
            return False
        except (InvalidSignature, ValueError, OSError):
            return False # Strictly fail closed

Defensive Engineering: Identity & Integrity

In our initial design, we used deterministic uuid5 hashing to solve idempotency and prevent duplicate files. Now, our deterministic asset ID is directly tied to our cryptographic provenance. By moving away from fragile Current Working Directory relative paths and forcing our key serialization to be strictly atomic, the ingestion engine guarantees that no mid-process crash or system context drift can corrupt or orphan our signed data.

By using the SHA-256 hash of the signed payload as our primary URN, our files don’t just have a repeatable name; they possess an unalterable Forensic Trace. If a rogue local process or a misconfigured local agent attempts to silently modify a synapse file in your vault, the signature validation fails immediately. The knowledge base becomes entirely self-verifying.

The Result: Signed Signal over Sentiment

By implementing defensive guards to handle “ghost nodes” and using the cryptographic Context-Cleaner, our Sovereign Synapse transitions from a text dump to a high-integrity reasoning ledger.

The 2024 conversation in my vault regarding Movesense Medical and MetaMotion R sensors is no longer just a text file. It is a permanent, cryptographically secured, asset. It is a part of my own intellectual history—entirely under my sovereign control, stripped of corporate residue, and ready for the local network.

Is your local AI memory running on trusted, signed contracts—or are you still paying a Prose Tax on corporate fluff?

Join the Architecture Discussion

The frameworks we are using to eliminate the Prose Tax and secure our cognitive estates are being formalized into an open-source standard.

The Sovereign Systems Specification & Glossary is now live under the MIT License on GitHub.

If you are building in the local-first or sovereign RAG space and want to propose updates, refine boundaries, or add new architectural vectors, check out the repository and open a Pull Request. Let’s map out the constraints of this discipline together.

The Sovereign Synapse Series

• The Great Export
• The Context Cleaner – This Post
• The Local Brain – Coming 9 June 2026
• The View from the Summit – Coming 16 June 2026
• The Synapse Navigator – Coming 30 June 2026
• The Analog Bridge – Coming 7 July 2026
• The Temporal Mirror – Coming 14 July 2026
• The Unbroken Voice – Coming 21 July 2026