DEV Community

Igor Ganapolsky
Igor Ganapolsky

Posted on

Why Passive AI Agent Memory Fails (and How We Built a 0.042ms PreToolUse Firewall + 3-Arm RRF Recall)

Most AI coding agent memory tools only solve passive recall. Even if your memory store remembers that git push --force or an unguarded migration broke production yesterday, passive recall cannot stop an RL-trained coding agent from executing the exact same destructive command today.

Here is how we combined Zero-LLM 3-Arm Reciprocal Rank Fusion (RRF, k=60), TokenGate Learned Prefill Pruning (arXiv:2610.26754), ARC-AGI-3 Adaptation Gap Guardrails (arXiv:2610.30499), and in-toto Witness DSSE Supply-Chain Attestation into a single sub-0.05ms PreToolUse firewall in ThumbGate v1.39.

1. Measured Production Benchmarks

Metric Measured Latency / Savings
Compiled PreToolUse Guard Eval (p95) 0.042 ms (p50: 0.017 ms)
State-Backed PreToolUse Eval (p95) 0.120 ms (p50: 0.021 ms)
Agent Context & Recall Token Spend -64% (AKV rolling drop + -40% compact tabular recall)
LLM Calls to Store or Recall Memory 0 calls ($0.00 hot-path LLM tax)

2. Active PreToolUse Firewall vs. Passive Recall

  1. 3-Arm RRF (k=60) + Access-Damped Decay: Fuses FTS5 BM25, cosine vector KNN, and temporal windows in 6.8ms read-only mode while keeping Critical prevention rules at decay multiplier m = 0.0.
  2. DSSE Supply-Chain Provenance + Key Separation: Emits Materials -> CommandRun -> Products DSSE envelopes while enforcing functionaryKeyId !== policySignerKeyId and quarantining untrusted ~/Downloads/** inputs before execution.
  3. ARC-AGI-3 Adaptation Gap Gate: Blocks self-revisions that overfit development tasks or fall into the Cheaper / RHAE-down cost-contraction trap.

3. Get the Production Rule-Pack, Playbook, or Pro Tier

Top comments (0)