Compartment

# Compartment

### Superior agentic memory, encrypted at rest.

Your AI agent forgets you the moment the session ends. Compartment ends
that. With Compartment, your AI agent gets better with experience: it keeps
every decision, preference and detail you give it, permanently, encrypted,
on your own computer. Hermes, Claude,  OpenClaw and other AI Agents can
install in one command. One fully-transferable memory store is shared
simultaneously by all agents on the computer. 100% offline: no network, no
API key, no cloud account, no telemetry. The embedding model ships inside
the package, and a full search returns in under 9 ms, beating the round-trip
a hosted memory charges you for. Every byte at rest is AEAD-encrypted, the
embedding vectors included, and only your passphrase opens it.

Unlike other agentic memory, we offer an option to start off with memory -
6,718 curated facts seeded at install: the physical constants and unit
conversions, 800+ hardware facts with real specs (Apple silicon, PCs, CPUs
and GPUs, phones, game consoles, Raspberry Pi, storage, displays,
connectors) to provide a map of computer geography, operating system
versions and release names, network ports and HTTP, file signatures,
character encodings, shell and Unix internals, git, regex, SQL and hashing,
ISO country, currency and time codes, and more. Allows an offline agent to
operate better without internet, and an online agent to operate faster and
more accurately.

**More secure, by construction.** Every byte at rest is
authenticated-encrypted, the embedding vectors included (most tools leave
those in the clear, and vectors can be inverted back toward text). Deletion
is cryptographic: destroy the record's key and it is gone, unrecoverable.
Tampering is detected, history is hash-chained, and the vault locks itself
on restart or power loss. It runs fully offline: a runtime guard aborts on
any network attempt, and CI proves it on three operating systems.

**Not one step harder.** One command installs it, creates the vault, and
wires your agent. No API key, no cloud account, no daemon. Unlock when you
want to use it; lock when you want it closed. By default an unlock stays
open for weeks (until restart or you lock it), like any app you leave
running. The security is free at the point of use because it falls out of
the architecture, not out of your patience: keeping plaintext off disk
forces the index into RAM, and a RAM-resident index is also the fastest one
there is. Secure and fast are the same choice here, and neither costs you a
configuration step.

#### What sets it apart

**Install it in one step**

- One command installs it, creates the vault, and wires your agent. No API
  key, no cloud account, no daemon.
- On the Mac, open one `.pkg` and you are done. Python, the embedding model
  and every dependency are inside it.
- A menu bar app runs the whole thing without a terminal: vault state,
  unlock, lock, and the last five memories it saved.
- Every feature toggles in that panel instead of a config file:
  model-independent capture, starter facts in search, auto-lock.
- Your vault ships full. The 6,718 seeded facts are ordinary memories,
  editable and forgettable, and one switch keeps them out of search.
- Runs under what you already use: Hermes ("no setup needed"), Claude Code
  and Desktop over MCP, OpenClaw, every MCP client, plus a CLI for scripts
  and cron.

**Remembers the right things**

- "OK" is a decision, and Compartment files it as one, with the question it
  answered. That is the record you need later.
- Decisions beat preferences, preferences beat machine details, machine
  details beat chatter. A fixed ranking, not a model's mood.
- It forgets nothing. Small talk is kept and ranked last.
- It replaces your host's built-in memory instead of fighting it: imports
  what Claude Code already wrote, then supersedes it.
- It captures even when the model does not cooperate. A hook writes the fact
  whether or not the model calls the tool.
- A graph, not a pile. Explicit relations with validity windows answer who
  worked where, and when.

**Search that beats a network call**

- 0.68 ms vector search. 8.8 ms for the full hybrid pipeline. A cloud memory
  spends longer than that saying hello.
- Exact below 20k records: recall = 1.0 by construction, not an
  approximation.
- Hybrid always: meaning and keywords, fused.
- One pinned embedding space, enforced every time the vault opens, so your
  comparisons stay valid forever.

**Encrypted, offline, and yours**

- Every byte at rest is AEAD-encrypted, embedding vectors included. Most
  tools leave vectors in the clear, and vectors invert back toward text.
- Only your passphrase opens it. Compartment generates no password, no seed,
  no recovery phrase, and holds no credential you do not.
- Add a keyfile and unlock takes two factors. Both feed Argon2id together,
  so it is arithmetic, not a policy check.
- `forget --shred` destroys the record's key. The content is mathematically
  unrecoverable, not marked deleted.
- Restart or power loss locks it, and the agent has a panic lock that clears
  every credential instantly.
- 100% offline. A runtime guard aborts on any network attempt, and CI proves
  it on Linux, macOS and Windows. Zero open ports. No telemetry, ever.
- No LLM inside. Embeddings run locally in under 300 MB, and judgment stays
  with the model you already pay for.
- Tamper-evident: hash-chained audit log, sealed journal, verified kill-9
  crash recovery.
- One portable file. Move a locked vault anywhere, and `lock --sign` seals
  it with an Ed25519 manifest anyone can verify without a credential.
- `compartment dash` puts the entire vault on a local page: 127.0.0.1 only,
  random token, read-only.

## The memory logic

Full write-path, decision math, and comparisons in
[docs/MEMORY.md](docs/MEMORY.md). The load-bearing ideas:

**Nearly everything is stored; nothing important is buried.** Only empty
turns are dropped. A bare "OK" is not noise, it is a decision: when the
agent asks *"Want me to send this reply to the client now?"* and the user
answers *"OK"*, Compartment resolves the question from the conversation and
stores
`[decision 2026-07-20] Approved (answered "OK"): Want me to send this
reply to the client now?` at the top importance tier. Asking *"did the
user say to email the client?"* later retrieves exactly that record.

**Deterministic importance tiers rank recall**: decisions/consent 0.90,
personal facts and preferences 0.80, the user's machine and configuration
0.75, other substantive statements 0.55, pleasantries 0.20 (kept, ranked
last). The fused score is
`RRF(vector) + RRF(keyword) + 0.02·cosine + 0.006·importance`: cosine
magnitude keeps the genuinely best match on top, importance settles
near-ties in favor of what matters. The agent learns the user and the
computer first, the world second, and forgets nothing.

**One memory, not two.** Agent hosts increasingly ship a memory of their
own - Claude Code keeps per-project Markdown files with an auto-loaded
index. Two memories means facts land in whichever one the model happened to
think of, and neither is complete. Compartment takes over on install: it imports
what the file memory already holds, and both the MCP handshake and the
managed CLAUDE.md block tell the model that compartment supersedes it - write
every new memory here, treat the files as a read-only archive. One vault,
encrypted, shared by every agent and project on the machine. Nothing is
deleted; the files stay exactly where they were.

**Capture that does not depend on the model.** Instructions are a request,
and a host that declares its own memory in its system prompt outranks
anything a tool says. So `compartment integrate claude` also installs a
`PostToolUse` hook: when Claude Code writes a memory file, the fact lands in
the vault whether or not the model ever thought about compartment. The hook is
additive and idempotent (your other hooks are untouched, settings.json is
backed up first), it exits successfully no matter what - a memory tool must
never break your editor - and it stays quiet when the vault is locked.
`compartment hook status | install | uninstall`, or `integrate claude --no-hooks`.

<p align="center">
  <img src="https://raw.githubusercontent.com/MaxFreedomPollard/Compartment/main/docs/images/menubar-panel.png" width="330"
       alt="The Compartment panel in the macOS menu bar.">
  <img src="https://raw.githubusercontent.com/MaxFreedomPollard/Compartment/main/docs/images/windows-tray-panel.png" width="330"
       alt="The Compartment panel in the Windows notification area.">
</p>

**A menu bar and system tray app.** Download **Compartment.pkg** from the
[latest release](https://github.com/MaxFreedomPollard/Compartment/releases/latest)
and open it - the installer asks whether you also want the menu bar utility,
and everything (Python included) is self-contained, so there is nothing to
install first. From a checkout, `pip install 'compartment[menubar]'`
then `compartment menubar` does the same thing; on Windows,
`pip install 'compartment[tray]'` then `compartment tray`. Either way it puts
Compartment in the status bar: click the icon and a
panel shows whether the vault is open, how much it has learned, the three
settings worth changing day to day (capture hook, whether starter facts join
searches, auto-lock), and the last five things it remembered. Unlock, lock and
change your passphrase there too, without opening a terminal. No dock icon,
no window to manage, and it holds no vault in memory - state comes from the
CLI, so an idle app costs nothing.

**See what it just learned.** `compartment recent` lists the newest memories,
newest last, hiding the thousands of seeded starting facts so the handful
that real use produced are actually visible - and `compartment status` reports
`organic_records` beside the total, so a vault that has learned nothing can
never look busy. Same view over MCP as `memory_recent`.

**One pinned embed