The tab closes. The context window is gone. The next session starts blind.
Summary: The context window is the agent's working memory. I have agents running in Grok Bot, Claude Desktop, Claude Cowork, Codex Desktop, Grok Build, Claude Agent SDK, LangChain DeepAgents, and Claude Code. Each agent holds the lead, the draft, and the next action. It disappears when the session ends. A flat folder of notes is the common patch. It fails when the tree grows too large to read. Two rules hold it together: reads happen on the main thread; writes happen on a branch. This part explains what a second brain / LLM Wiki provides: a typed, git-native knowledge graph adds a type declaration per file, named relations between files, and a write boundary that puts a script between the model and the tree. Using a second brain/LLM Wiki lets you share data with Grok Bot.
Open the Grok Bot inbox. It does not look like a chatbot. It looks like a roster.
Chief of Staff. Media Consultant. Pipeline Sales. AI News Journalist. Client managers. A job-search agent. A consulting-leads agent.
Each conversation is a different actor. Each actor owns a different slice of the institutional graph. They do not share a prompt. They share a git-native knowledge tree with the laptop agents.
That is the design. Agentic AI at production scale shares a tree. Without a write contract, shared state becomes a clobber problem.
In a previous article, I had mentioned using OKF to create LLM wikis. And we did that for SDLC concepts. We did that for PKC concepts. We did that for architecture and deployment concepts. And we also did it for data engineering. So you have different vocabularies to build different concepts within a wiki LLM that we can then read later. Now, I started working with Grokbot, and I immediately fell in love. I was like, this is so cool. But then I have all these agents and jobs and whatnot running on my laptop. And I wanted to share information between Grokbot and what’s happening on my laptop using other agents, right? Claude, Grok, Codex. So I wanted a way to bridge them. So what I did was, for each agent in Grokbot, I defined a different vocabulary using these OKF plugins. And you can see these OKF plugins under Spillwave Solutions. There’s a whole list of them. And each of those maps to a different role my agents are in. And then they basically can read and write to these. And then I have things that are running on my laptop; they can read and write to the same concepts. This way they can share information. So I’m using the second brain to share information between agents running locally on my laptop for things that aren’t Grokbot, like Claude Code, Grok Build, Codex desktop, Claude Cowork, and various jobs I have running on my local machine. And routines. And now they’re editing and reading the same second brain.
Engineering Reliable Agentic AI Systems — Workshop
Engineering Reliable Agentic AI Systems
Saturday 29 August. Four hours. Hands-on the entire time. Please sign up.
Every module ends with work you keep and can run on Monday:
A working autonomous agent loop that runs on your machine in the first hour
A reusable evaluation harness that plans, executes, verifies, and iterates
A live research assistant built end-to-end over MCP
A production-ready architecture you can hand to your engineering org
This is a build session. You type for most of the four hours. You need comfort in a terminal. You do not need prior experience with agent frameworks.
Readers of this newsletter get 40 percent off with the code RICK40. The code expires on Friday 28 August, the day before the workshop. There is no discount on the day.
Reserve a spot. Add RICK40 in the promo code box on the registration form.
The AI Agent Memory Problem
What happens when the tab closes?
An AI agent session has working memory. That memory is the context window. It holds the lead, the draft, the next action. It is gone when the tab closes. The next session starts blind.
A folder of notes is the usual patch. That works until the tree is too large to read. Then AI agents guess. A file tree without types, without named links, and without a retrieval bound is not memory. It is a place to lose things.
The second brain adds three things a folder of notes cannot.
Types. A file declares what it is. A consulting lead is not a job lead. A job lead is not an opportunity. Without a declared type, a file is its filename and its text. AI agents reading a flat folder cannot confirm what any file represents. They infer. A ConsultingLead, a SalesLead, and a JobLead each belong to separate plugins in the type registry. Each carries a different type in its frontmatter.
brain.py writestamps that type against the registry before committing. A known identity that attempts to write a type owned by another plugin is refused. The type is in the file, not in the agent’s reading of it.Typed links. Files point at each other with a named relationship. A graph walk finds the neighbors of one node without reading the tree. A relation such as
belongs_toordepends_onis a named edge from one node to another. The pack command runs an outbound breadth-first search (BFS) from a single root node, following its edges. The defaults are 2 hops and 20 nodes. The walk stops on either bound: it stops expanding past the hop count, and it stops adding nodes once the node count is reached. A flat folder has no edges. An agent loading that folder must read all files or select by filename. Neither approach stays bounded as the tree grows. Typed links make the retrieval boundary exact and graph-shaped.A write boundary. The model proposes. A script commits the frontmatter. You can opt for a human reviews the diff. Three cases cause a write to be refused before it touches the tree. A write with no claimed identity is refused. A known identity writing a type owned by a different plugin is refused. A rostered actor writing a type on its deny list, or outside its allow list, is refused. After those checks pass, the write lands on a branch. A human can review the diff.
The write side is governed by branch, script, and an optional human diff. The read side has one rule: reads happen on main. At session start, the agent fast-forwards to the tip of main, then builds a pack: a bounded breadth-first search (BFS) walk that pulls only the nodes the session needs, not the whole tree.
Reads on Main: Agent Knowledge Graph Retrieval Without Embeddings
The Session-Start Hook
Reads happen on main. That is the first rule.
At the start of a session, the agent fetches origin and pulls main (from the second brain repo, which is a different repo than its home repo) with a fast-forward only. A session-start hook runs that pull. The hook skips the pull in three cases and prints the reason each time: when the working directory is not a git checkout, when HEAD is not main, or when the working tree is dirty. It never fights a write session. It never merges and never forces.
The pull is how a Claude Code laptop session sees what a Grok Bot merged. It is how a Grok Bot sees a decision a laptop agent recorded. The shared truth is the tip of main. Chat is not the shared truth. As docs/architecture.md states: “Session chat is working memory. It dies with the tab. Packs are how working memory borrows institutional memory without eating the tree.”
Multi-Hop Knowledge Retrieval: The Pack
After the pull, the AI agent packs. It does not dump the tree.
A pack is an outbound breadth-first search (BFS) walk from one named root node. The default is two hops and twenty nodes. The walk stops on either bound: it stops expanding past the hop count, and it stops adding nodes once the node count is reached. The output is one Markdown file. The header carries the hop count, the node count, and a generation timestamp.
Pack files are gitignored. They are working memory. They are rebuilt on demand. They are never committed.
Graph Walk vs. Semantic Search: No Embeddings on the Retrieval Path
Two bounds constrain the walk: hop count and node count. The walk does not reach the whole tree.
There are no embeddings on the retrieval path. Retrieval is a typed graph walk. Semantic search returns things that resemble the query. A typed graph walk returns the things that are actually connected. For pipeline state, connection beats resemblance.
Reading from main is the first rule. The second rule covers the other direction: writes never happen on main. The read path walks the graph to surface what is already connected. The write path routes every new node through a branch, a script, and a pull request before it can reach the shared tree.
Writes on a Branch: The Four-Step Write Path
The Four-Step Git Worktree Write Path
Writes never happen on main. That is the second rule.
Laptop agents and Grok Bot write the same tree. Concurrent writers on main cause clobber. Granted, GrokBot agents typically run in the cloud on another machine, but each AI agent gets a Git worktree. Isolation turns two writers into a merge, not a lost file. Even Laptop-based agents can read and write to the same second brain using the same technique. If you need to write on the 2nd brain repo, create a worktree, create a branch, make your writes, commit/push the changes, create a PR to main, and merge to main. To read the latest, switch to main and pull. Agents are informed to do some work, write a batch of changes, then do the dance described above.
The write path has four steps. Three of them are not the model.
Claim. The agent claims an identity and a ContentPack. A ContentPack is the job function. It owns a closed set of types. The pack plus the claimed actor is the permission. A pack schema alone does not enforce actor uniqueness. A write with no claimed identity is refused. A known identity writing another plugin’s type is refused. An author string that matches no known identity passes both checks without failing. An unowned type is refused. The script rejects the write. The model does not get a vote.
Isolate. The agent opens a fresh git worktree for this session. The branch shape is
brain/<actor-slug>/<session-id>. Reads still come frommain. The agent never packs another agent’s unmerged work. It never reuses another actor’s worktree or branch.Write through scripts. The model supplies type, title, body, and links. The script stamps frontmatter against the type registry. It emits a write event. It stamps
links: []. Relation validation is a separate step. A separatebrain.py validatecall refuses an unknown relation, a broken link, a missingtype, and a missingtitle. Skipping the script is why handwritten agent notes rot. The model writes slightly different frontmatter every time. Six weeks later, nothing queries cleanly.Close. Commit. Push to the existing remote. Open a ready pull request. Merge when checks are green. Never invent a remote. Never write to
main. Never overwrite. Never force-push. If the same slug is already in an open pull request, stop. Refresh from currentmain. Revalidate. Do not smash it through.
Three Levels of Write Provenance
The human can reads the diffs. Provenance lives in git history. The commit message carries the actor. A write event records the details of the write. A one-line log records the batch for a person. Three levels. One review.
Git Worktree Isolation: Concurrency Safety, Not a Security Boundary
Isolation is a worktree, a branch, and a pull request. It is not a sandbox. It is not a shared-runtime security boundary. All Grok Bots share one Linux machine. Separate chats are not a security boundary.
Those three refusal cases depend on two data structures: the actor roster and the type registry. The roster holds each actor’s identity string and permitted write targets. The registry records which plugin owns each of the 45 types across the knowledge tree. Access control at write time runs against both.
AI Agent Access Control: The Roster, the Registry, and the Lane Handoffs
The system enforces AI agent access control at two levels. The first level is the pack. The second level is the actor allowlist. Both together define who writes what into the shared knowledge tree.
The Actor Roster and Fail-Closed AI Agent Allowlist Policy
Who decides what each actor can write?
The roster holds 13 actors. Nine are safe to name: Chief of Staff, Spillwave CTO, R&D Architect, Media Consultant, AI News Journalist, Spillwave GTM, Pipeline Sales, Consulting, and Job Search. Four more are client managers. Their accounts are not named.
Each actor has an identity string. Examples: grok-bot/content-media, grok-bot/news-digest, grok-bot/sales-pipeline. Each actor record carries a pack, a bundle, concept_roots, a writes_allow list, and often a writes_deny list.
The pack schema does not enforce actor uniqueness. The roster does. The roster note reads: “Unique actors are policy, not pack-schema enforcement. This file is the private roster. Validation must fail on duplicate actor values.”
Two actors share one pack by design. Chief of Staff and Spillwave CTO both use the executive-coordination pack. The roster comment for Spillwave CTO reads: “Identical pack authority with Chief of Staff. Actor allowlist is the extra fence.” DailyDigest belongs to executive-coordination. It is Chief-of-Staff-only. The pack does not enforce that. The actor allowlist does.
The Type Registry and Multi-Agent System Permissions
The type registry holds 45 types across 9 plugins. It has 38 catalogs and 42 distinct relation names. The knowledge tree holds 295 Markdown nodes.
Each plugin owns a closed set of types:
second-brain-core(5): AgentIdentity, Concept, ContextPack, TypedEdge, WriteEventcontent-media(5): Article, Draft, Headline, Series, Subscribernews-digest(5): Digest, FollowUpCandidate, NewsItem, Source, Topicexecutive-coordination(5): ActionItem, Blocker, DailyDigest, Decision, Priorityaccount-management(6): AccountPlan, Client, Commitment, Contact, Deliverable, Stakeholdergtm-positioning(6): Campaign, IdealCustomerProfile, MessagingPillar, Offer, PositioningStatement, ProofPointconsulting-leads(5): ConsultingLead, DiscoveryCall, EngagementType, QualificationNote, Scopesales-pipeline(4): NextAction, Opportunity, SalesLead, Stageexecutive-job-search(4): CompanyTarget, JobLead, Role, TargetCriteria
Each type declares its plugin, its folder, and its allowed relations. Article and Draft belong to content-media. NewsItem and FollowUpCandidate belong to news-digest. That is the mechanical reason the articles actor cannot write a NewsItem. A known identity writing a type owned by a different plugin is refused.
One Graph, Several Lanes: AI Agent Role-Based Access Control in Practice
A plugin on a host is only a loader. Claude Code, Codex, Cursor, and Grok Bot can all touch the same catalogs. They must claim identity. They must pull main. They must pack first. They must write through scripts. Agent Plugins 1.0.0 is a package format for skills and Model Context Protocol (MCP) servers. It is a host binding. It is not this write policy.
The Media Consultant actor has writes_allow: Article, Draft, Series, Headline, Outline. It has writes_deny: PositioningStatement, NewsItem, FollowUpCandidate. The AI News Journalist has writes_allow: NewsItem, Digest, FollowUpCandidate, Source.
The deny list is the mechanism. The articles actor packs a FollowUpCandidate that the news actor wrote. The articles actor cannot write that type itself. The news actor writes it. The articles actor reads it through the pack. The articles actor then works the draft in the local satellite and writes an Article when the URL exists.
status: ready means the draft is waiting on a public URL. status: published means the URL is in the record. Two public copies of one piece link with related_to. Do not invent a new relation name.
Lane Handoffs Across the Multi-Agent Pipeline
Consulting qualifies inbound. Sales takes over when there is a real opportunity. Account management takes over after signature. It stays off the outreach machine. The job search only promotes interviews and offers. The daily scan firehose stays in the satellite tree.
A hold is a machine-readable state. It stops an outreach bot from sending into a thread where the ball is not on our side. A no-bid is written down. An opportunity that stops being mentioned looks identical to one that was forgotten. A dead node, with its reason attached, prevents a future agent from reviving it.
A tracker entry without a verification date is a claim, not a fact.
Lane ownership determines which actor can write a given type. Where the written record lives after it is written is a separate question with its own boundary. The satellite holds high-volume working records. The shared tree holds only the durable institutional nouns that other lanes need to pack.
On my local machine, I have an agentic workflow to help me manage articles that I’m writing. Helps me do research and other things. On my Grokbot, I have a media manager that helps me promote and keeps track of Substack and Medium statistics and whatnot. When I schedule or plan articles on my laptop, I want the media manager running on Grokbot to have access to them. So it’s two different systems that I want to have the same information.
Local system to manage and plan articles (outlines, ideas, etc.) on the laptop versus media manager running in Grokbot that manages Substack and Medium stats. I also have other systems to manage leads, contracts, contacts, etc. I want that data available via my local jobs and via Grokbot.
Two Trees and a Shared Second Brain for AI Agents
What satellite trees keep local, what they promote, and five things the shared tree is not
Session chat is working memory. It dies with the tab. The second brain is institutional memory. It survives.
Summary: This part defines the boundary between two satellite trees and a shared second brain for AI agents. Drafts stay in the satellite. Durable institutional nouns get promoted to the shared tree. Three failure modes break that boundary: status drift, entity duplication, and promotion pressure. The part closes by naming five things the system is not: not a vector database, not a customer relationship manager (CRM), not autonomous, not Agent Plugins 1.0.0, and not Agent-to-Agent (A2A).
Two satellite trees and one shared second-brain checkout
There is a local satellite tree and a shared second-brain checkout.
The satellite holds high-volume working records. People. Companies. Interactions. Daily job-scan hits. Draft revisions. Most of that is nobody else’s business.
The shared tree holds institutional nouns that other AI agents need. A published article. A consulting inbound that actually qualifies. A job lead that is in interview or offer state. An opportunity with a buyer and a number. A hold that must stop outreach.
Drafts stay local. Records get promoted. The articles agent never copies a working draft into the shared tree. It writes a short typed record that points at the public URL. The consulting agent does not copy the people-and-deals graph into the shared tree. It promotes a durable noun.
That boundary is why the system does not collapse. A shared brain that accepts everything becomes the same unreadable pile. Now it is unreadable for the whole organization. The value of the shared tree is inverse to its size. Its job is to stay small enough to pack.
What breaks: status drift, entity duplication, and promotion pressure
The trees drift. A shared hold can be true at 03:00 and stale by afternoon. Status is verified. It is never cached. Trackers are a cache. The mailbox and the calendar are the source of truth. Any status the current session could not confirm is unverified. A confident stale fact is worse than a missing one.
Entities duplicate. Two slugs for one person are ordinary entropy. The contact card gets merged. The graph node does not. That needs a reconcile pass, not good intentions.
Promotion pressure is constant. More in the shared tree feels safer. It is not. Every satellite rule is a guard against this. The guards need enforcing.
What this shared second-brain system is not
It is not a vector database. There are no embeddings on the retrieval path. Retrieval is a typed graph walk from a named root. It is deterministic. It is reviewable.
It is not a customer relationship management (CRM) system. There is no schema migration, no server, and no vendor. It is Markdown, YAML, and git. A person can read any node. A person can undo any agent write with git revert.
Note that the default mode is for the agent to do a PR and just merge it for most agents, but you can gate it.
This is a write policy. A marketplace install is a loader. This is not.
It is not Agent-to-Agent (A2A). A2A is how agents talk to other agents. This is how agents write into one reviewable graph.
Isolation is not a security boundary
A worktree, a branch, and a pull request give concurrency safety and human reviews for safety (optional). They are not a sandbox. All hosted Grok Bots share one Linux machine. Separate chats are not a security boundary.
Agents need a role, a pack, and a place
Agentic AI needs a role, a pack, an identity, and a place where the work does not disappear when the session ends.
AI agents pull main to see the graph. They write on a branch so they do not smash it.
Session chat is working memory, and it dies when the tab is closed. The second brain is institutional memory, and it survives. Packs are how one borrows from the other without eating the whole tree.
Further reading
When the Decision Already Happened: Creating a Second Brain for Your SDLC Project. The project-level version of this idea. Typed nodes for decisions instead of pipeline state.
Loop Engineering: The Git-Native Fishbowl That Finally Makes Spec-Driven Development Work. Why git is the substrate. Branch isolation and human diff review as the loop boundary.
The 7 Types of Agent Memory (and Why 2 of Them Aren’t Memory): The taxonomy behind the working-memory and institutional-memory split used here.
Eight Agent Memory Systems. None of Them Solve the Whole Problem. The survey of what is on the market, and why a typed git tree is a different answer.
Universal Agent Workflow That You Can Plug Into Any Harness. The host-agnostic argument: Claude Code, Grok Build, Codex, and Cursor on one contract.
Rick Hightower is a Claude Certified Architect, former Senior Distinguished Engineer, and author of Manning’s Harness Engineering book. Through Spillwave he sits as a resident architect for production agents: harness engineering, loop engineering, 4-16 weeks, Austin and remote.
Engineering Reliable Agentic AI Systems — Workshop
The free hour earlier this week covered the architecture. It stopped short of the evaluation harness and the graders. That build is the point of the paid workshop.
Engineering Reliable Agentic AI Systems
Saturday 29 August. Four hours. Hands-on the entire time.
Every module ends with work you keep and can run on Monday:
A working autonomous agent loop that runs on your machine in the first hour
A reusable evaluation harness that plans, executes, verifies, and iterates
A live research assistant built end-to-end over MCP
A production-ready architecture you can hand to your engineering org
This is a build session. You type for most of the four hours. You need comfort in a terminal. You do not need prior experience with agent frameworks.
Readers of this newsletter get 40 percent off with the code RICK40. The code expires on Friday 28 August, the day before the workshop. There is no discount on the day.
Reserve a spot. Add RICK40 in the promo code box on the registration form.
If the slot does not work, the repos stay public. I will keep writing this material here.
If this just showed up in your loop, read Harness Engineering or the Spillwave guides. To talk through a stand-up, book 30 minutes or write contact@spillwave.com.
Related Articles
If this article sparked ideas you want to follow further, these pieces cover the patterns directly:
Build a Second Brain for Your AI Coding Agents The companion piece that walks the same architecture from a slightly different angle and includes the free-hour framing.
From Session Memory to Compounding System, Graph Engineering and Second Brains for your Project Traces the exact journey the source article begins: why session-scoped memory is a dead end, and how a structured graph of typed nodes becomes a compounding institutional record that survives session boundaries. Read this for the project-level framing before diving into the git-native write policy.
Loop Engineering + Graph Engineering: Building a Compounding Second Brain with OKF-based LLM Wiki Shows how graph engineering and loop engineering combine to build a knowledge store that grows smarter with each agent pass; the OKF (Observation-Knowledge-Fact) model that underpins the typed-node approach used in the reads-on-main, writes-on-branch architecture.
Loop Engineering: The Session Illusion. Managing Loop State. Examines why every AI agent session feels continuous but is actually stateless, and how loop state management turns a sequence of blind sessions into a coherent workflow. Directly extends the source article’s argument that ‘session chat is working memory; it dies with the tab.’
Graph Engineering Is Two Ideas Wearing One Name Unpacks the distinction between retrieval graphs (typed walks, no embeddings) and generative knowledge graphs; the same distinction the source article draws when explaining why a bounded BFS walk beats semantic search for connected pipeline state.
One Memory Layer, Two Runtimes: Building a Cross-Framework Memory Bus Builds a shared memory layer that Claude Code, Grok Bot, and Codex agents can all read and write without stepping on each other: the same cross-actor coordination problem the source article solves with the actor roster, type registry, and git-worktree isolation.
If you are a paid subscriber, thank you. Your support makes this work possible.
If you are a free subscriber and find these articles useful, please consider upgrading. A paid subscription is $80 per year or $8 per month.
Free subscribers typically receive access to the full versions of paid articles after one to two months.
About the Author — Claude Certified Architect
Rick Hightower is a former Senior Distinguished Engineer at a Fortune 100 company, focusing on delivering ML / AI insights to front-line applications, and a practitioner building multi-agent production systems. Follow him on SubStack and Medium for more hands-on agent engineering content. You can also book him to speak and train your team: Check out Rick Hightower’s SpeakerHub.
Rick Hightower helps companies become AI-first through practical mentoring, executive and team training, and custom AI solution development. He is a former Senior Distinguished Engineer at a Fortune 100 company, where he focused on bringing ML and AI insights into real front-line business applications.
Subscribe to Rick’s newsletter to see videos and guides.
Rick is a Claude Certified Architect, AI systems practitioner, and builder of production multi-agent systems. He is currently working on authoring a book on Harness Engineering with Manning Publishing. He created Skilz, a universal agent skill installer supporting 30+ coding agents, including Claude Code, Gemini, Copilot, and Cursor, and co-founded one of the largest agentic skill marketplaces.
Today, Rick and the Spillwave team work with leaders and teams who want to move beyond AI experiments and build real AI capability inside their companies. He helps organizations adopt AI safely, train their people, redesign workflows, and build practical AI systems that create measurable business value.
Ready to make your company AI-first? Connect with Rick on LinkedIn, Substack, or Medium, book him to speak or train your team, or visit Spillwave to explore mentoring, training, and custom AI solutions for your organization.
If this helped you, please consider subscribing to my Substack newsletter.
Likes, comments, and shares really do make a difference. They help grow the channel, support the work, and get these ideas in front of more builders who are trying to understand AI agents, harness engineering, and production AI systems.
Thank you for reading and for helping the work reach more people.