Selvedge

selvedge.sh  ·  PyPI  ·  GitHub

Long-term memory for AI-coded codebases — including what was already tried and rejected.

Line attribution tells you who wrote something. Selvedge tells your agent what not to write next: the approaches this codebase already tried, reverted, and why. It's a git blame for AI agents, for the why rather than which model touched which line — captured live, by the agent, as the change happens, so nothing downstream has to guess at it.

Selvedge is a local MCP server. AI coding agents (Claude Code, Cursor, Copilot) call it as they work to log structured change events with reasoning. Your data stays in a SQLite file under .selvedge/ next to your code.

Local-first by default, team-server by choice, zero-LLM always.

Six months ago, your AI agent added a column called user_tier_v2. You don't know why. git blame points to a commit from claude-code with a generated message that says "Update schema." The session that made the change is long gone — and so is the prompt that produced it.

With Selvedge, you run this instead:

$ selvedge blame user_tier_v2

  user_tier_v2
  Changed     2025-10-14 09:31:02
  Agent       claude-code
  Commit      3e7a991
  Reasoning   User asked to add a grandfathering flag for legacy free-tier
              users during the pricing migration. Stores the original tier
              so we can backfill discounts without touching billing history.

That reasoning was captured by the agent in the moment — written into Selvedge from the same context that produced the change. Not inferred from the diff afterward by a second LLM. Not a hand-typed commit message.

Who Selvedge is for

Selvedge has two audiences. Same tool, same pip install, same SQLite file under .selvedge/. Different scale of pain.

Teams running long-term, AI-coded codebases. When the project is big enough that you (or someone else) will touch it again in six months, twelve months, three years — but most of it was written by an agent whose context evaporated the day each PR shipped. git blame tells you what changed. Selvedge tells you why — even after the agent session, the prompt template, the developer who asked for it, and the model version are all long gone. This is the original use case: production codebases, schema decisions, migrations, dependency changes that need an audit trail that survives turnover.

Solo developers using Claude Code on everyday projects. Side projects, weekend builds, the small internal tool you keep poking at. You don't need enterprise governance — you just need to remember why you (or your agent) did the thing you did yesterday, last week, last sprint. Run selvedge init once. Add four lines to your CLAUDE.md. From then on, selvedge blame is muscle memory — a way to talk to your past self when your past self was an LLM.

If you've ever come back to your own AI-built project and thought "what was this for again?", Selvedge is the missing piece.

The problem

Human-written code leaks intent everywhere — commit messages, PR descriptions, inline comments, the Slack thread that preceded it. AI-written code doesn't. The agent has perfect clarity about why it made each decision, but that context lives in the prompt and evaporates when the conversation ends.

Six months later, your team is debugging a schema decision with no trail. git blame tells you what changed and when. It can't tell you why.

Selvedge captures the why — live, by the agent itself, as the change is made. The diff is git's job. The why is Selvedge's.

What's new in v0.3.11

Abandoned alternatives are first-class, and the log can prove itself.

Rejections and reverts are now stated outcomes, not inferences. change_type="reject" records "we considered this and decided against it" without writing the change — the counterpart to revert for paths never taken. prior_attempts reads both as a new confidence: "exact" tier; the old proximity heuristic drops to tiebreaker. And the expires_when column that shipped dormant in v0.3.8 gets its evaluator: a closed, machine-checkable grammar — library:NAME>=VERSION, entity:PATH:changes, date:ISO, manual:LABEL — validated at write time, evaluated locally by selvedge stale with no network and no LLM. A rejection stored with the condition that would invalidate it is a decision that knows when to die.

The event log is now tamper-evident. Every logged event gets a SHA-256 chain record in a sidecar table, same transaction, over every field except the late-bound git_commit (git already witnesses that one). Two new selvedge verify checks: chain_intact fails hard when a chained row was edited, deleted, or reordered out-of-band — the check names the exact sequence number — and chain_coverage warns (never fails) about rows that predate the chain. Legitimate operations append boundary records instead of breaking the chain, so migrate-paths and a destructive-gated prune verify clean while a silent sqlite3 edit does not. selvedge verify --json publishes the attestation manifest. Honest scope, stated in the module itself: this detects casual and accidental modification and produces an independently verifiable export; it is not proof against a motivated local attacker.

Also: the PreCompact reminder now distinguishes "edited with no log" from "log exists but was truncated," and both hook surfaces have their determinism pinned byte-for-byte in tests; capture-time nudges suggest recording the invalidating condition when a reject/revert lands without one; selvedge supersede gains -d/--diff, --revisit-after, and --expires-when (#31); and an id-less supersede no longer re-opens every earlier revert on the path (#30). Tests 984 → 1114.

What's new in v0.3.10

The memory comes to the agent, and the store gets its dials. Two themes, shipped together because the config half is what the rest needed to read settings from.

Delivery. Selvedge already blocked re-edits of reverted entities. What was missing was delivery when there is nothing to veto. Two new hooks:

• SessionStart injects a compact digest as a session begins — decisions due for a revisit, entities that were tried and reverted, recent changesets.
• PreCompact fires just before context compaction destroys this session's reasoning and names the watched entities you edited but never logged.

Both are quiet when they have nothing to say, size-capped, read-only, and templated. Neither can block anything — PreCompact deliberately declines the veto the hook API offers it. This is the answer to a measured failure mode: "Delivery, Not Storage" (arXiv:2607.20972) recorded a pull-model memory tool going unused entirely (zero voluntary memory operations across 114 turns against a pre-seeded store) while deterministic injection landed every time.

selvedge export --format markdown renders the store as a reviewable digest to commit next to it, so captured intent shows up in a pull request instead of hiding inside a binary. Deterministic — regenerating with no new events is a zero-line diff.

Config. .selvedge/config.toml is now first-class, with a canonical precedence chain that selvedge doctor prints per setting. It brings:

• selvedge prune --include-events — the first path that can delete captured reasoning, so it needs both a confirmation and SELVEDGE_DESTRUCTIVE=1. Neither alone is enough, because --yes in a cron entry defeats a prompt and a shell profile defeats an env var. Events retention defaults to never.
• Event-size bounds (diff_bytes, reasoning_bytes) that truncate loudly — a marker in the text, a warning at write time, a count in selvedge stats.
• Secret-shape warnings at log_change, extendable via redaction_patterns, plus a doctor row that scans what's already stored. Warn, never reject.

Also: five review issues closed. The enforcement hook's allow path is 40% faster (33.6 ms → 20.1 ms per gated call) and SELVEDGE_HOOK_DISABLE=1 finally short-circuits before the imports it was documented to skip; log_change no longer discards revisit_after / constraint / stale_when on renames and supersedes; the CLI's --json and the MCP tools now return identical structures; and the Docker image no longer ships the maintainer's own database. Tests 826 → 984.

Where Selvedge fits