The Capsule Specification.
A capsule is the permanent asset behind a Retenta: corpus + manifest + eval set + write log. Embeddings and indexes are disposable build artifacts, rebuildable at any time. We publish the format openly because portability only counts if you can read and rebuild it without us.
The stack is disposable. The memory is permanent.
What's in a capsule
Corpus
Content-addressed source text — every chunk keyed by its SHA-256, including audio transcribed to text on build. This is what your agent remembers; the embeddings and index are rebuilt from it.
Manifest
Records what built the disposable layer: capsule version, engine, the embedding model, and the corpus + manifest hashes — so any version knows exactly what produced its index.
Eval set
The cases your capsule is graded against, plus the latest run. Every version is scored by an LLM judge; the score and pass/fail travel with the capsule.
Write log
Append-only. Every write carries provenance — agent, session, source — and every revert is a tombstone entry. Nothing is ever hard-deleted from the log.
The export bundle
GET /capsules/:id/export returns the whole capsule as a single archive — plus a rematerialize/ directory that rebuilds the disposable layer on another target, and an eval-parity report comparing scores before and after.
maple-harbor.capsule/
manifest.json # version, engine, embedding model, hashes, eval score
corpus/ # content-addressed source text, incl. transcribed audio (sha256 filenames)
evals/ # the eval set + the latest run
writes_log.jsonl # append-only — provenance + revert markers
rematerialize/ # scripts to rebuild on pgvector + one more target
eval-parity.json # eval scores: original engine vs. re-materializedThe manifest
Content-addressed and self-describing. The manifest records the embedding model that built the index, the corpus and manifest hashes, the parent version, and the eval score — so any version is reproducible and every build is traceable to what produced it.
{
"retenta": "0.1",
"capsule": "maple-harbor",
"version": "v14",
"parent": "v13",
"engine": "cloudflare-native",
"embedding_model": "@cf/baai/bge-base-en-v1.5",
"corpus_hash": "sha256:2f0a…",
"manifest_hash": "sha256:9c31…",
"eval": { "score": 0.94, "passed": true, "gate": 0.90 }
}The write log
A capsule is memory an agent writes to, not just reads. Every write is an append-only entry with provenance; a revert is a new tombstone entry that also removes the vector. The log is the audit trail — nothing is ever hard-deleted.
{"ts":"2026-07-19T04:12:03Z","op":"write","agent":"claude-loop",
"session":"s_8a1","source":"nightly-triage","id":"w_123"}
{"ts":"2026-07-19T05:40:11Z","op":"revert","reverts":"w_123","id":"w_140"}The guarantees
Portability
Export and re-materialize on any vector database, embedding model, or cloud. Answer quality may differ by engine; governance behavior may not — and an eval-parity report proves it.
The eval set travels with it
Your eval set is part of the capsule, not the platform. A version can be graded and gated wherever the capsule is rebuilt; below-threshold versions are created but never promoted, so the format itself carries the quality bar.
Git-friendly versioning
Content-addressed and text-first: pin, diff, and revert. Production serves the version you pinned, and the log records which version answered every query.
Own the memory. Rent the stack.
Build a capsule, fill it, and export it whenever you like — the format is yours to read and rebuild, with or without us.