memory-capture-audit

Detect unauthorized edits to daily memory files and emit Drift incidents.

Updated Jun 23, 2026

Search Tags:#audit #memory #workspace #drift #incident #fingerprint

Ready to run

npx skills add https://github.com/Walliiee/agent-harness --skill memory-capture-audit

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: memory-capture-audit
Source: https://github.com/Walliiee/agent-harness/tree/main/skills/memory-capture-audit
Command: npx skills add https://github.com/Walliiee/agent-harness --skill memory-capture-audit

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill detects when a daily memory file was written outside the approved memory-capture flow, helping prevent silent drift, bloated logs, and broken provenance.

Core Features & Use Cases

Fingerprint Validation: Verifies that today's memory file contains the required mc:v1 header stamp and at least one mc:item marker.
Nightly Drift Prevention: Runs on a scheduled audit so violations are found before the file is finalized or committed.
Incident Emission: Raises a Drift incident when a freehand write is detected, making the problem visible and actionable.
Use Case: A teammate or agent edits memory/YYYY-MM-DD.md directly; the audit flags the bypass and records an incident for follow-up.

Quick Start

Ask the agent to run the memory capture audit for today's workspace and report any files missing the required fingerprints.

Frequently Asked Questions about memory-capture-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect unauthorized edits to daily memory files in my workspace?▼

To detect unauthorized edits to daily memory files, you can run a scheduled audit that checks each file for a valid mc:v1 header stamp and at least one mc:item marker. If these fingerprints are missing, a Drift incident is emitted for follow-up.

What is memory file drift and how does fingerprint validation prevent it?▼

Memory file drift occurs when daily logs are written outside an approved capture flow. Fingerprint validation prevents drift by enforcing that every memory file contains the required mc:v1 header stamp and mc:item markers before the file is committed.

How do I set up a scheduled audit to validate daily memory logs before commit?▼

You can set up a scheduled audit by configuring your workspace to run the memory-capture validation automatically. The audit checks daily memory files for the required mc:v1 header and mc:item markers, emitting a Drift incident on any violations before commit.

What happens when a teammate or agent bypasses the approved memory capture flow?▼

When a teammate bypasses the approved memory capture flow by editing a daily memory file directly, the nightly audit flags the bypass because the required mc:v1 header stamp or mc:item marker is missing. A Drift incident is then recorded for follow-up.

Can I run memory capture audits across multiple configured workspaces?▼

Yes, you can run memory capture audits across multiple configured workspaces. The scheduled audit validates daily memory logs in each workspace by checking for the required mc:v1 header stamp and mc:item markers, ensuring provenance is maintained everywhere.

What are the limitations of enforcing the memory-capture fingerprint standard?▼

The fingerprint standard requires daily memory files to include an mc:v1 header stamp and at least one mc:item marker. It is limited to validating daily logs before commit and does not retroactively fix files that already lack the required fingerprints without emitting a Drift incident.