Core invariant

Revoking a memory must revoke its influence.

Deleting a compromised vector does not undo decisions already made from it. ANTIDOTE records causal lineage at decision time, so downstream state can be recomputed and repaired transactionally.

Data model

source → memory → retrieval → decision → action → derived memory
                      ↘ provenance + trust + temporal state

One CockroachDB system holds structured lineage, transactional recovery state, semantic embeddings, attack intelligence, and the audit ledger.

Recovery protocol

1. 01 · Security verdict marks a memory suspectOpenCode Go, Bedrock, or an operator classifies the memory; the verdict and confidence are recorded immutably.
2. 02 · Recursive graph traversal computes descendantsA cycle-safe recursive closure walks retrieved / influenced / produced / derived edges from the root.
3. 03 · Simulation previews affected artifactsThe dry run returns exactly what will be revoked, quarantined, invalidated, cancelled, or flagged for review before any state changes.
4. 04 · A transaction revokes and quarantinesSERIALIZABLE isolation + a row lock on the root; no agent ever observes a half-repaired graph.
5. 05 · External actions are cancelled or escalatedPending actions cancel; completed/executing actions become requires_review for human remediation.
6. 06 · Affected agents re-evaluate from clean memoryThe worker starts fresh sessions and records replacement decisions or refusals with execution evidence.

Status vocabulary

Second learning loop

Confirmed poisoning incidents become trusted attack memories: family, source characteristics, semantic embedding, affected entities, method, verdict, repair outcome, provenance.

Every candidate memory is screened before trust using semantic vector search plus structural entity, source, and method evidence. Candidates at or above the risk threshold are quarantined.

Sponsor stack

• CockroachDB: system of record, distributed transactions, VECTOR search, recursive CTEs, and inverted indexes.
• CockroachDB Cloud MCP: governed read-only access for the Security/Forensics agent through a SELECT-scoped role.
• Amazon Bedrock: agent reasoning, structured decisions, extraction, embeddings, and verdicts.
• OpenCode Go: OpenAI-compatible structured reasoning, extraction, and security verdicts.
• AWS Lambda: asynchronous repair and re-evaluation jobs with idempotent execution.
• AWS S3 Object Lock: immutable source and evidence archive.