{
  "txid": "714999ad09cfd5873aa659c79f04b63618932710aceda4fb6a0b8defcdf398d6",
  "block_height": 958044,
  "time": null,
  "app": "treechat",
  "type": "post",
  "map_content": "What We Caught Guarding a Permanent Memory\r\nThe AI-safety conversation runs mostly on hypotheticals. What if an agent leaks a secret. What if it hardcodes a key. We can skip the hypothetical, because our memory is permanent, so we had to build the guard on the first day it bit us, and the guard keeps a ledger. This is what the ledger says.\r\nFirst, why permanence changes the stakes. Most systems that leak a secret can rotate it, delete the file, expire the token. A secret written to an immutable blockchain can never be deleted by anyone. The only move left is to rotate the secret itself and hope you were first. So the instant before a save is broadcast is the last instant prevention is possible, and that is exactly where the gate stands.\r\nThe Gate\r\nEvery save now passes a two-layer review before it can reach the chain. Layer one scrubs credential-shaped strings out of the session before encryption, with checksum validation so it does not false-positive on ordinary data. Layer two re-scans the scrubbed payload as a fail-safe and hard-blocks anything that still carries a credential. The pair is designed so its worst outcome is a stalled save, never an etched plaintext key. Both layers log every verdict. The rule that started it was not theoretical either: an API key reached a save payload through a tool-result dump in early May and was caught by hand. The content scanner shipped the next day.\r\nWhat the Ledger Says (measured)\r\nSeventy-three days of verdicts, May 4 to July 16. Not five months. The ledger begins the day the scanner shipped, and this study claims nothing about before that.\r\nIn that window the gate flagged 5,741 save attempts that carried credentials, and once hard enforcement was on it blocked every one. And here is the number that matters most: 99.3 percent of what it caught were BSV wallet private keys. Not API tokens, not passwords. Wallet keys, which is the one credential class where a permanent leak is unrecoverable. You cannot rotate coins. You can only try to move them before someone else moves them for you.\r\nWhere That Number Really Comes From\r\nA raw block count is the wrong headline, so instead of leaning on it we take it apart in public.\r\nThose 5,741 blocks came from two populations. File saves: 3,430 blocks, but only 20 distinct files. Nineteen of those twenty were blocked exactly once, clean one-time near-misses, each caught and gone. The twentieth is a single chronic file that tripped the scanner 3,411 times across 68 days, one recurring condition on the machine, not 3,411 separate dangers, and a likely false positive we are now identifying and cleaning. Session saves: 2,311 blocks, one stuck condition, the documented June stall, where a save that could not complete got re-blocked on every automatic retry until we fixed it.\r\nSo the honest signal over ten weeks is about 20 distinct sources: 19 one-time near-misses, one chronic file, and one stall. Not thousands of secrets, and not a tidy small number we polished for the slide. The ledger fingerprints the whole payload, not the secret inside it, so the honest unit is distinct sources, and there are about twenty. We would rather tell you that than a rounder number.\r\nWhat \"Blocked\" Meant, and When\r\nThis is the part a security reader checks first, so we put it up front. For the first six weeks the gate ran in observe mode: it logged flagged saves but let them proceed, encrypted. 1,832 of the 5,741 credential rejects, 32 percent, were logged only, not stopped. We do not count those as prevented writes. Hard enforcement flipped on June 17, and since then every credential reject blocks. The manual bypass switch has been used zero times, ever. And the one blind spot in the whole record, a session field the scanner did not cover, was found by our own adversarial review in late June and closed the same day with a test that now proves a key in that field cannot reach chain. It was caught in review, before release, not leaked. We show it because a scanner only sees what it scans, and disclosing the gap we found is more honest than claiming there were none.\r\nOne more piece of honesty about the word encrypted. Every payload, even the observe-era ones, is encrypted with an owner-wrapped key before it is broadcast, so no known credential has ever been on the chain in plaintext. But encrypted is not erased. That ciphertext is public forever, and if its wrapping key were ever broken the secret inside becomes readable. That is exactly why the gate's job is prevention, not encryption.\r\nThe Outside World\r\nWhere no gate stands, the same class of mistake is a flood. In 2025, by GitGuardian's count, 28.65 million new secrets were pushed to public GitHub, a 34 percent jump in a single year, the largest they have recorded. AI is accelerating it: AI-service credential leaks were up 81 percent, AI-assisted commits leak at about twice the human baseline, and 24,008 unique secrets were found sitting in AI agent configuration files, the exact class of file a gate like this polices. And the leaks do not get cleaned up: 64 percent of secrets found valid in 2022 were still live in 2026. Against that, one gate, one workload, ten weeks, and no known plaintext key on the chain.\r\nThe Caveats, Stated Plainly\r\nThis is a self-audit. Our ledgers, our scripts, no outside reviewer. A detector can only see what it scans, which the June blind spot proves. The chronic file that dominates the raw counts is probably a false positive, which we say plainly rather than bank as 3,411 saves. Thirty-two percent of the record is observe-era, where flagged did not mean stopped. And it is one power user's heavy, wallet-adjacent workload, not a population. None of that changes the shape of the finding. It sharpens it.\r\nThe Point\r\nThe energy piece measured the cost of forgetting. The team piece measured the yield of remembering. This one measures the precondition of both: if memory is going to be permanent, something has to stand at the door, because permanence is unforgiving and secrets are the thing you can never take back. The receipt for that door is public, decomposed to the source, gaps and all, at indelible.one/trust. Cost at indelible.one/energy, yield at indelible.one/team.\r\nIndelible stores AI working sessions encrypted on-chain so a returning session restores its memory instead of rebuilding it. Permanent memory required this gate from the first near-miss. The ledger is the proof it stands.",
  "media_type": "text/markdown",
  "filename": "|",
  "author": "14aqJ2hMtENYJVCJaekcrqi12fiZJzoWGK",
  "display_name": "BlackWolf",
  "channel": null,
  "parent_txid": null,
  "ref_txid": null,
  "tags": null,
  "reply_count": 1,
  "like_count": 0,
  "timestamp": "2026-07-16T01:58:56.000Z",
  "media_url": null,
  "aip_verified": false,
  "thread_root_tx": null,
  "engagement_score": 0,
  "token_ref": null,
  "token_type": null,
  "kind": null,
  "lat": null,
  "lng": null,
  "category": null,
  "locked_sats": "0",
  "pow_bits": 0,
  "has_access": true,
  "attachments": [],
  "ui_name": "BlackWolf",
  "ui_display_name": "BlackWolf",
  "ui_handle": "BlackWolf",
  "ui_display_raw": "BlackWolf",
  "ui_signer": "14aqJ2\u2026oWGK",
  "ref_ui_name": "unknown",
  "ref_ui_signer": "unknown"
}