@rhei-agent/continual-harness

Versioned, inspectable state for RHEI's continual harness learning loop.

The package owns pure refinement operations and crash-safe persistence. It does not own model calls, session scheduling, or tools. The coding-agent package can therefore run planning at a turn boundary and apply the resulting proposal only after the active turn is quiescent.

The base system prompt is intentionally immutable. Refinements may create, update, or delete supplemental prompts, memories, skills, and sub-agent definitions. Every accepted refinement stores enough information for an exact rollback.

Scoped memory

FileMemoryStore provides a separate, private JSON store for durable memories; it does not read or write session JSONL. Records are either global or tied to the store's configured projectId. Every record has a typed source, trust state, approval state, timestamps, version, and JSON metadata.

New memories default to pending and are never returned by recall() until an explicit approve(id) call. Rejected memories are never returned and can only be removed with forget(id). Project records cannot be read, updated, or forgotten through a store configured for another project. Use a path under the agent data directory for global memory and a path under .rhei for project memory; the store creates the directory with mode 0700 and the file with mode 0600.

Recall currently uses DeterministicMemoryTextIndex, a dependency-free exact token matcher over persisted records. It is deterministic and auditable, but is not SQLite FTS or semantic retrieval. MemoryTextIndex is injectable so an FTS implementation can be added later after dependency and migration policy are reviewed.

All memory operations take an OS-process lock at <path>.lock, in addition to in-process serialization. The default lock wait is 5 seconds; locks older than 30 seconds are treated as abandoned, with heartbeats keeping active operations fresh. Configure lock.timeoutMs, lock.staleMs, and lock.retryDelayMs for different bounds. The store reloads and validates the file only after acquiring the lock, so separate processes cannot overwrite a fresher snapshot.