One memory for four tools is one place to poison

A video in this week’s feed opens on a promise that lands. Give ChatGPT the same memory Claude has and stop reexplaining yourself. Connect a memory service, tell one model something, ask another model the same question, and it already knows. The pitch closes with comment memory and I will send it, so grade the enthusiasm accordingly. The want underneath is real. On Hacker News the same day, someone shipped an agent memory library that is one SQLite file with no dependencies, built for the identical complaint.

Nobody enjoys introducing themselves to a machine four times before lunch.

Here is where I go unpopular. Portability is not the interesting property. Governance is.

The vault’s notes are blunt about it. Agent memory is governed context engineering, not one feature. A reliable system decides which instructions apply, which evidence enters active context, what gets summarized, what durable store survives across sessions, and how claims stay tied to their source. The read path is index first, then the relevant page, then a summary, then raw only when the source matters. Not everything, everywhere, always.

The same notes carry the line that makes me wary of one shared store sitting behind every model: persistent memory raises security risk, because a poisoned long term store or retrieval index can steer future behavior. One memory for four tools means one bad entry reaches four tools.

What is actually worth copying between them is small. Durable constraints, repo shape, done criteria, approval gates, and pointers to where the deeper context lives. That is a page, not a pile.

The want is legitimate. It just matters slightly less than knowing where a claim came from.