Verified Memory
One lesson, from mistake to signed pack
A real RepoOps lesson walked stage by stage, every artifact named by file and checkable in the repo.
The mistake
On 2026-05-29 a session shipped the Accountability Loop program: seven pull requests merged to origin/main. But the agent worked in isolated worktrees, and the shared checkout the IDE had open never pulled. The user opened TODO.md, saw the pre-merge content with every checkbox unflipped, and asked where the updates were. From their seat, a whole day's work looked like it never happened.
What the user saw
## ⏳ Accountability Loop - [ ] A0a ... - [ ] A0b ... <- all merged remotely, - [ ] A0c ... invisible locally
The mistake is written down
The failure went into .claude/brain/errors.md the same day: symptom, the two-layer root cause (local main never advances on its own; the completion ritual stopped before touching the shared checkout), the fix, and a prevention rule with a concrete test. Not a postmortem that gets filed away: a file every future session can read and cite.
From .claude/brain/errors.md (condensed)
## 2026-05-29 - Shared canonical checkout went 8 commits stale because the build-phase ritual never pulled Prevention rule: "Done" is defined as: the user can see it in their IDE without doing anything. Not: the remote has it. Test: git -C <shared-checkout> rev-parse HEAD must equal rev-parse origin/main. If they diverge, the ritual didn't finish.
The lesson is minted
The error record became a structured lesson row in .claude/brain/lessons/lessons.jsonl: a trigger, what went wrong, the fix, and a source_defect back-pointer to the errors.md entry it came from. The row also carries outcome counters (times_recurred, prevented_count), so the lesson is accountable for whether it actually works.
The lesson row (condensed)
{
"id": "lesson-36894f7c5ddc7f38",
"trigger": "End of build-phase ritual without
fast-forwarding the shared canonical checkout",
"fix": "Add step 10b to the completion ritual:
fast-forward the shared checkout to origin/main;
stash user edits first; on conflict, stop.",
"source_defect": { "file": ".claude/brain/errors.md" },
"times_recurred": 0,
"created_at": "2026-05-29T15:20:15.646Z"
}The lesson is enforced, not archived
lib/agent-md-blocks.mjs regenerates the lesson into a managed block inside CLAUDE.md, the operating manual every agent session reads before it works. The completion ritual itself gained step 10b: fast-forward the shared checkout, verify HEAD equals origin/main, stop on conflict. The mistake is now structurally hard to repeat: the rule sits in the path of every future run.
From the CLAUDE.md managed block
### Lesson lesson-36894f7c5ddc7f38: End of build-phase ritual without fast-forwarding the shared canonical checkout (managed by lib/agent-md-blocks.mjs. Do not hand-edit.)
The claim earns a receipt
The Brain Wiki page that documents the lessons store cites .claude/brain/lessons/lessons.jsonl as a backticked source reference. The strict citation gate (scripts/brain-drift/check-wiki-citations.mjs, part of the required brain-drift CI job) resolves that citation against HEAD on every commit and fails the build if it breaks. So the claim carries a memory receipt: source file, claim line, resolution status, verification commit, CI timestamp. Below is the real receipt from the current audit, the same data /verified renders.
The live receipt (from the committed audit)
page: architecture/brain-and-mcp.md source: .claude/brain/lessons/lessons.jsonl line: L14 status: verified commit: f11fea55 CI: 2026-07-12T23:51:28+00:00
The signed pack
When memory travels, it travels accountable. A brain pack (lib/brain-pack/export.mjs) passes every lesson through the transfer redaction profile first, emits only allowlisted distilled fields, and stamps each item with a sha256 content hash plus a pack-level manifest hash. Marketplace bundles carry an ed25519 signature (lib/federation/sign-node.mjs), and npx repoops installverifies it or rejects the pack. Even a verified install lands held for human review, never active silently. The lesson that started as one team's bad afternoon ships as an artifact someone else can trust.
What an install verifies
signature: VERIFIED ed25519 - signer a1b2c3d4... items: each carries kind + sha256 content_hash redaction: transfer profile (stricter than strict) landing: HELD for review. Nothing activates silently.
This audit runs on us first
The receipt above comes from RepoOps auditing its own brain. See the full checker output, red rows included.