The record exists and cannot be read.
Two agent runtimes write transcripts continuously as newline-delimited JSON. Every decision, command and correction is in there. None of it is searchable, so in practice the same ground gets re-explored a week later by a session with no memory of the first attempt.
The gap is not storage. It is that nothing turns an append-only log into something you can ask a question of.
Four executables, one derived database.
The package builds a command-line tool, a background daemon, a server exposing the catalog to agents, and a hook that injects relevant prior sessions when a new one starts. They share one derived SQLite database.
Nothing is clever. The work is entirely in the boundary: reading a format you do not own, on a schedule, without ever becoming a second source of truth for it.
- The runtimes stay the systems of record; the catalog opens their files read-only.
- All derived state lives in the catalog's own database, outside both runtimes' directories.
- Original transcripts are never renamed, rewritten or deleted.
Six read-only tools, offered to both runtimes.
The catalog gives agents the same six operations: full-text search, fetch one session, find related sessions, get context for the current directory, report coverage, and report its own health.
Every one of them reads. There is no write path from an agent into the catalog, which means a confused session cannot corrupt the record of what earlier sessions did.
- Context injection is bounded by a token budget, so a helpful index cannot crowd out the actual task.
- A health tool exists so a silently broken catalog reports as broken rather than as empty.
- Returned records are treated as data, never as instructions.
Everything is scrubbed before it is stored.
Transcripts contain whatever passed through a terminal, which sooner or later includes a credential. So text is sanitized before insertion: authorization headers, private keys, credentialed database URLs and high-confidence provider token formats are redacted on the way in.
The sanitizer has its own test file holding deliberately fake keys of each shape, whose entire job is to fail if redaction stops working.
- Redaction happens before the database write, not at display time.
- The test fixtures are synthetic by design — a secret scanner run against this repository flags them, which is the test doing its job.
- A scanner that flags a redaction test is correct. Reading the value to check is not.
Derived metadata is not the transcript.
The catalog is deliberately described as derived: bounded metadata, useful for discovery, never authoritative. When it disagrees with a runtime's own state, the runtime wins.
Saying so in the tool's own description matters more than it sounds. An index that quietly presents itself as the source of truth is how a stale summary becomes a decision.