kodelyth-ecc 1.7.2 → 1.7.3

package/videos/video-02-compound-memory.md

@@ -0,0 +1,301 @@
+# VIDEO 2 — "How the compound memory works"
+
+**Duration:** 8–10 minutes  
+**Platform:** YouTube (technical audience — engineers who care about architecture)  
+**Hook:** "Your AI has no memory. But yours does."  
+**Goal:** Drive installs + explain the unique differentiator  
+**Screen setup:** Terminal + code editor + browser (dashboard)
+
+---
+
+## FULL SCRIPT
+
+---
+
+### [0:00–0:20] COLD OPEN
+
+**[SCREEN: Two Claude Code sessions side by side — one with blank context, one with a memory recall injection]**
+
+**NARRATION:**
+> "This is your AI without memory."
+> "And this is your AI with Kodelyth ECC's compound memory."
+
+**[Left: clean AI asks basic questions about your stack]**
+**[Right: AI opens with — "I checked your memory — you've solved a similar Stripe webhook issue before. Raw body parser before signature validation. Want me to apply that?"]**
+
+**NARRATION:**
+> "Same model. Different context. Completely different output."
+> "Let me show you how this works — and why it compounds over time."
+
+**[TITLE CARD: Kodelyth ECC — Compound Memory Architecture]**
+
+---
+
+### [0:20–1:30] THE PROBLEM: AI HAS NO MEMORY
+
+**[SCREEN: Simple diagram — each AI session as an isolated bubble]**
+
+**NARRATION:**
+> "Here's the fundamental problem with AI coding tools."
+> "Every session is a blank slate."
+
+**[Draw/animate: session 1 bubble, session 2 bubble, session 3 — completely disconnected]**
+
+**NARRATION:**
+> "You solve a hard problem Monday. You close the chat. Tuesday — it's gone."
+> "You join a new project three months later. You hit the same bug pattern you fixed before. You debug it from scratch. Again."
+
+**[SCREEN: Typing the same question again]**
+
+**NARRATION:**
+> "This isn't a model problem. The models are brilliant. It's a context problem."
+> "The model never knew about that fix. You never told it."
+> "ECC closes that loop automatically."
+
+---
+
+### [1:30–3:00] THE THREE LAYERS
+
+**[SCREEN: Diagram — three stacked layers]**
+
+**NARRATION:**
+> "ECC's compound memory has three layers. Each one is independent. Together they stack."
+
+**[LAYER 1 — Project Lessons]**
+
+**[Show: tasks/lessons.md in code editor]**
+
+**NARRATION:**
+> "Layer one: tasks/lessons.md — your project's permanent rulebook."
+> "Every time you correct the AI — 'use pnpm not npm', 'never add try/catch without logging', 'we use Zod not Yup' — a hook at the end of the session extracts that correction and writes it here."
+
+**[SCREEN: Show correction being typed in chat → session ends → lessons.md showing new rule]**
+
+**NARRATION:**
+> "Next session starts — this file is injected before the first message. The AI already knows your rules. You never repeat yourself."
+
+**[SCREEN: Show lessons.md growing over time — week 1, month 1, month 3]**
+
+**NARRATION:**
+> "It compounds. Month one: 5 rules. Month three: 30 rules. The AI knows your tech stack, naming style, patterns you hate, tools you prefer. Zero ramp-up on every new task."
+
+---
+
+**[LAYER 2 — Global BM25 Memory]**
+
+**[SCREEN: ~/.kodelyth/memory/ in terminal]**
+
+**NARRATION:**
+> "Layer two: global memory. Stored at ~/.kodelyth/memory/. BM25 full-text search."
+
+**[SCREEN: Show memories.jsonl file, then show dashboard Memory tab]**
+
+**NARRATION:**
+> "BM25 is the algorithm that powers early Google. Keyword weighting, term frequency, document frequency. Pure math — no embeddings, no neural network, no API calls."
+> "Sub-millisecond recall. Zero dependencies. Works offline."
+
+**[SCREEN: Show capture flow — problem/approach/tags format]**
+
+**NARRATION:**
+> "When you capture a memory, it stores: problem statement, approach that worked, gotchas, tags, language, project."
+
+**[SCREEN: Show recall in action — type in dashboard search, results appear]**
+
+**NARRATION:**
+> "When you start a new session or type a prompt, ECC searches this store and injects relevant matches before your AI responds."
+> "It's like your AI checked your notes first."
+
+---
+
+**[LAYER 3 — Auto Chat Recall]**
+
+**[SCREEN: Diagram showing UserPromptSubmit hook intercepting messages]**
+
+**NARRATION:**
+> "Layer three: auto chat recall. This one is invisible — which is why it's powerful."
+> "Every message you type goes through a BM25 search before the AI sees it. If there's a relevant past memory, it's injected into the context automatically."
+> "You just type normally. The recall happens in the background."
+
+**[SCREEN: Terminal showing hook fires, memory injected, then AI response includes "based on your previous work..."]**
+
+**NARRATION:**
+> "Per-session repeat suppression — the same memory won't be injected twice in one session. Clean, no noise."
+
+---
+
+### [3:00–4:30] LIVE DEMO — THE FULL LOOP
+
+**[SCREEN: Terminal + Claude Code]**
+
+**NARRATION:**
+> "Let me show you the full loop. We're going to capture a solution, then recall it five minutes later in a fresh session."
+
+**[STEP 1: Session 1 — solve a problem]**
+
+**[TYPE in chat:]**
+```
+My Stripe webhook keeps returning 400 - invalid signature
+```
+
+**[Show AI helping solve it — raw body parser issue]**
+
+**[STEP 2: Capture the memory]**
+
+**[TYPE in chat:]**
+```
+/memory remember "Stripe webhook signature validation"
+```
+
+**[Show capture confirmation — problem/approach/tags saved]**
+
+**NARRATION:**
+> "Captured. Stored at ~/.kodelyth/memory/memories.jsonl. Let me show you exactly what got saved."
+
+**[Open terminal:]**
+```bash
+tail -1 ~/.kodelyth/memory/memories.jsonl | jq .
+```
+
+**[Show JSON output with problem, approach, tags, language]**
+
+---
+
+**[STEP 3: New session — fresh context]**
+
+**[Close Claude Code, reopen, fresh chat]**
+
+**[TYPE:]**
+```
+I need to add Stripe webhooks to my checkout flow
+```
+
+**[Show response — memory injected at the top:]**
+```
+I checked your memory — you solved a similar problem before:
+
+"Stripe webhook signature validation" (captured 2 min ago)
+→ Raw body parser must come before express.json() middleware
+→ Use stripe.webhooks.constructEvent() not manual sig parsing
+→ Test with stripe-cli forward, not curl
+
+Want me to apply this exact pattern?
+```
+
+**NARRATION:**
+> "Same session, different project. It recalled the fix before you even described the bug."
+> "In real usage, this gap is months. And the value compounds every session."
+
+---
+
+### [4:30–6:00] THE COST WIN — PROMPT CACHE
+
+**[SCREEN: Diagram — token costs, cache zone]**
+
+**NARRATION:**
+> "There's a financial angle to this that most people miss."
+
+**[Show Anthropic pricing: 3$/M input, 0.30$/M cached]**
+
+**NARRATION:**
+> "Anthropic charges 10% for cached tokens. OpenAI auto-caches prefixes over 1024 tokens."
+> "ECC's memory injection is designed as a stable prefix. The same content, in the same order, session after session."
+> "That prefix hits the cache. Every long session, the repeated context is 90% cheaper."
+
+**[SCREEN: Show example — 50,000 token session, 15,000 cached prefix]**
+
+**NARRATION:**
+> "If you do heavy AI coding sessions — hours per day — this adds up to real money over a month."
+
+---
+
+### [6:00–7:30] THE SELF-EVOLVING MEMORY (EVOLVE TAB)
+
+**[SCREEN: Dashboard → Evolve tab]**
+
+**NARRATION:**
+> "The memory system also closes its own learning loop."
+
+**[Show evolve tab with pending proposals]**
+
+**NARRATION:**
+> "ECC tracks which memories get recalled most often. When a pattern repeats enough times, it proposes a new skill — a permanent knowledge file that the AI uses on every relevant session."
+
+**[Show a proposal in the dashboard — pending status]**
+
+**NARRATION:**
+> "Nothing is ever auto-applied. You review, accept, edit, then commit."
+> "That's the design principle: the system proposes. You decide."
+
+**[Show CLI:]**
+```bash
+npx kodelyth-ecc evolve analyze
+npx kodelyth-ecc evolve list
+npx kodelyth-ecc evolve show <id>
+npx kodelyth-ecc evolve accept <id>
+```
+
+**NARRATION:**
+> "The evolve CLI is your interface to the proposal pipeline."
+
+---
+
+### [7:30–8:30] PRIVACY — EVERYTHING LOCAL
+
+**[SCREEN: Terminal]**
+
+**NARRATION:**
+> "One thing I want to be explicit about."
+
+**[TYPE:]**
+```bash
+ls -la ~/.kodelyth/memory/
+```
+
+**[Show the files — memories.jsonl, indexes]**
+
+**NARRATION:**
+> "That's everything. A JSONL file on your disk."
+> "No API call leaves your machine for memory operations. No server. No account. No sync unless you set it up yourself."
+
+**[TYPE:]**
+```bash
+npx kodelyth-ecc verify
+```
+
+**[Show sha256 manifest verification running]**
+
+**NARRATION:**
+> "You can verify the entire installed toolkit against a sha256 manifest any time. Every file, every agent, every hook — verifiable."
+
+---
+
+### [8:30–9:00] CTA
+
+**NARRATION:**
+> "The memory layer is what makes ECC different from every other toolkit."
+> "It's not a feature you toggle on. It's infrastructure that builds over time and saves you real hours."
+
+**[SCREEN: npm install command]**
+
+**[TYPE:]**
+```
+npx kodelyth-ecc
+```
+
+**NARRATION:**
+> "github.com/sifxprime/kodelyth-ecc — link in description."
+> "Next video: Devil Mode. 8 adversarial agents that read your code like an attacker. I'll show you what they find on a real project."
+
+**[END CARD: subscribe, next video preview, github link]**
+
+---
+
+## B-ROLL / EDITING NOTES
+
+- Animate the three-layer diagram with Figma or simple CSS animation
+- Show REAL `memories.jsonl` content (blur personal project names if needed)
+- The BM25 recall response must be real — test it, record it
+- Dashboard footage: real session on localhost:5747
+- Show the `jq` pipe — this builds technical credibility
+- Music: same lo-fi track as Video 1 for consistency
+- Thumbnail: "Your AI remembered. 5 months later. Different project." + memory icon

package/videos/video-03-devil-mode.md

@@ -0,0 +1,294 @@
+# VIDEO 3 — "Devil Mode: I audited my own codebase with 8 adversarial agents"
+
+**Duration:** 10–12 minutes  
+**Platform:** YouTube (security engineers, senior devs, indie hackers pre-launch)  
+**Hook:** Real adversarial findings on a real project — not a demo, an actual audit  
+**Goal:** Show that ECC's devil mode produces real security value, not theater  
+**Screen setup:** Terminal + code editor + Claude Code/Windsurf on right
+
+---
+
+## FULL SCRIPT
+
+---
+
+### [0:00–0:25] COLD OPEN — Start with a finding
+
+**[SCREEN: Claude Code showing a live devil-mode result]**
+
+**NARRATION:**
+> "This is a real finding."
+
+**[Show output — e.g., a secret in a config file, or a GPL dep, or a prompt injection vector]**
+
+**NARRATION:**
+> "I ran 8 adversarial agents on my own project. In parallel. They found this in under 3 minutes."
+> "And I had already done a 'security review' the week before."
+
+**[TITLE CARD: Devil Mode — 8 adversarial agents. Attacker mindset.]**
+
+---
+
+### [0:25–1:30] WHY SECURITY REVIEWS FAIL
+
+**[SCREEN: Simple diagram]**
+
+**NARRATION:**
+> "Most security reviews fail for a simple reason."
+> "The person doing the review is the same person who wrote the code."
+> "You can't unsee what you built. You have blind spots in exactly the places that matter."
+
+**[Draw: developer → reviews own code → misses the thing they built]**
+
+**NARRATION:**
+> "An attacker has no such blind spot. They come in cold. They look at your code the way a stranger would."
+> "Devil mode is that stranger."
+
+**[SCREEN: List the 8 agents]**
+
+**NARRATION:**
+> "8 agents. Each one with a specific attack surface. All running in parallel."
+> "Let me walk you through each one — then we'll run them live."
+
+---
+
+### [1:30–4:30] THE 8 AGENTS — QUICK TOUR
+
+**[Show each agent as a card — name + what it hunts + one real grep pattern]**
+
+**[AGENT 1: secret-hunter]**
+
+**NARRATION:**
+> "Secret hunter. This one looks for leaked credentials."
+> "Not just obvious API keys — it digs into git history. Leaked secrets don't disappear when you delete the file. They live in every commit before you noticed."
+
+**[SCREEN: Show bash pattern — `git log -p --all | grep -E 'AKIA|ghp_|sk-|SG\.'`]**
+
+**NARRATION:**
+> "AWS keys, GitHub tokens, Stripe secret keys, SendGrid API keys. All have distinctive prefixes. It knows them."
+
+---
+
+**[AGENT 2: supply-chain-auditor]**
+
+**NARRATION:**
+> "Supply chain auditor. Your biggest attack surface is probably your node_modules."
+> "It checks for typosquats — packages named almost like popular ones. It checks lockfile drift — packages that changed without a lockfile update. It reads install scripts."
+
+**[SCREEN: Show a package with an install script that makes a network call]**
+
+---
+
+**[AGENT 3: license-violation-finder]**
+
+**NARRATION:**
+> "License violation finder. If you're going open source, one GPL dependency contaminates your whole project under copyleft law."
+> "This agent maps your dependency tree, identifies AGPL and GPL licenses, and flags anything that creates legal risk before you flip the repo public."
+
+---
+
+**[AGENT 4: prompt-injection-hunter]**
+
+**NARRATION:**
+> "Prompt injection hunter. This one is for AI-powered features."
+> "If your app takes user input and feeds it to an LLM — a chatbot, a RAG pipeline, a tool-calling agent — that input path is an attack surface."
+> "Indirect injection. System prompt leak. Tool hijacking. This agent reads every LLM integration looking for those patterns."
+
+---
+
+**[AGENT 5: jailbreak-tester]**
+
+**NARRATION:**
+> "Jailbreak tester. This one red-teams your AI features live."
+> "It doesn't just read code — it sends adversarial inputs to your running AI and checks if your guardrails hold."
+
+---
+
+**[AGENT 6: code-stealer-detector]**
+
+**NARRATION:**
+> "Code stealer detector. If you're shipping commercial software, you need to know if any block of code was copy-pasted from somewhere with a license that conflicts with yours."
+> "This is especially critical for AI-generated code — Copilot and similar tools sometimes reproduce licensed training data."
+
+---
+
+**[AGENT 7: backdoor-hunter]**
+
+**NARRATION:**
+> "Backdoor hunter. This one looks for malicious code patterns."
+> "Obfuscated eval. Suspicious base64. Functions that encode URLs at runtime. Unexplained outbound connections."
+> "If you received code from a contractor or vendored a library — this is the scan you run first."
+
+---
+
+**[AGENT 8: chaos-engineer]**
+
+**NARRATION:**
+> "Chaos engineer. Not a security agent in the traditional sense — an adversarial reliability agent."
+> "It asks: what happens when your database goes down? When your message queue fills up? When a downstream API times out at the worst moment?"
+> "It maps your hidden assumptions and turns them into fault injection scenarios before your users find them."
+
+---
+
+### [4:30–7:30] LIVE AUDIT — REAL PROJECT
+
+**[SCREEN: Terminal — running on a real sample project]**
+
+**NARRATION:**
+> "Let's run it. I'm going to use a real project — a Next.js SaaS starter I've been building."
+
+**[TYPE in Claude Code / Windsurf chat:]**
+```
+/devil-mode --pre-public
+```
+
+**[Show the agents firing — show output appearing in real time]**
+
+**NARRATION:**
+> "Watch the agents fan out in parallel. Each one is running its own playbook simultaneously."
+
+**[Wait for results — narrate as they come in:]**
+
+**[Finding 1: secret-hunter]**
+
+**NARRATION:**
+> "Secret hunter flagged something. Let's look."
+
+**[Show: a .env.example file that was committed with a real key accidentally]**
+
+**NARRATION:**
+> "Committed 3 months ago. I removed it, but it's in git history. Anyone who clones this repo can find it with `git log -p`."
+> "This would have been a problem if I went public. Now it's not."
+
+**[REMEDIATION shown: `git filter-branch` or BFG Repo Cleaner command]**
+
+---
+
+**[Finding 2: supply-chain-auditor]**
+
+**NARRATION:**
+> "Supply chain flagged a package. Let me check."
+
+**[Show: a dep with an install script that makes a network call to a third-party analytics service]**
+
+**NARRATION:**
+> "This package phones home on install. I had no idea. It's not malicious but it's not something I want happening silently."
+
+---
+
+**[Finding 3: license-violation-finder]**
+
+**NARRATION:**
+> "License finder flagged one. LGPL-2.1 in a transitive dependency."
+> "For my use case — commercial SaaS — this is fine if I keep it as a library. It's flagging for awareness, not as a blocker."
+> "But if I was statically linking it, different story."
+
+---
+
+**[Summary]**
+
+**[Show the aggregated report:]**
+
+```
+CRITICAL (1):  Leaked secret in git history — rotate STRIPE_SECRET_KEY immediately
+HIGH     (1):  Dependency phones home on install — audit or replace
+MEDIUM   (1):  LGPL transitive dep — review linking model
+LOW      (2):  Two advisory items
+```
+
+**NARRATION:**
+> "Three real findings I would have missed. The most important one — the leaked key — would have been a serious problem post-launch."
+> "This took 3 minutes. Not 3 hours. Not a contractor invoice."
+
+---
+
+### [7:30–8:30] THE THREE FLAGS
+
+**[SCREEN: Terminal]**
+
+**NARRATION:**
+> "Devil mode ships with three flags for different situations."
+
+**[TYPE and explain each:]**
+
+```bash
+/devil-mode               # Default: 4 agents (secret, supply-chain, backdoor, prompt-injection)
+/devil-mode --pre-public  # Before going open source: adds license + code-stealer
+/devil-mode --pre-launch  # Before production launch: adds jailbreak-tester + chaos-engineer
+/devil-mode --all         # All 8 agents simultaneously
+```
+
+**NARRATION:**
+> "I recommend --pre-public every time you plan to open-source something. Non-negotiable."
+> "--all for post-incident sweeps or high-stakes launches."
+
+---
+
+### [8:30–9:30] INDIVIDUAL AGENTS
+
+**[SCREEN: Claude Code]**
+
+**NARRATION:**
+> "You can also call individual agents if you only need one angle."
+
+**[TYPE:]**
+```
+use secret-hunter
+```
+
+**[Show it running]**
+
+**NARRATION:**
+> "Same agent, just one of them."
+> "Useful when you added a new feature and only need the prompt injection sweep."
+
+---
+
+### [9:30–10:00] HOW IT'S DIFFERENT FROM A LINTER
+
+**NARRATION:**
+> "A question I get: how is this different from running a security linter?"
+
+**[SCREEN: Split — linter output vs devil-mode output]**
+
+**NARRATION:**
+> "Linters catch syntax-level issues. SQL injection patterns. Known unsafe API calls. Static analysis."
+> "Devil mode catches semantic issues. Why is this code making an outbound call? Why does this install script exist? Is this base64 innocent or suspicious? What happens to this system under adversarial conditions?"
+> "Different tool. Different attack surface. You want both."
+
+---
+
+### [10:00–10:30] CTA
+
+**NARRATION:**
+> "If you're shipping software and you haven't run something like this — run it today."
+
+**[TYPE:]**
+```bash
+npx kodelyth-ecc
+```
+
+**[Then in chat:]**
+```
+/devil-mode --pre-public
+```
+
+**NARRATION:**
+> "github.com/sifxprime/kodelyth-ecc — zero telemetry, everything local, MIT license."
+> "Next video: the MCP server — how to give LangGraph, AutoGen, or Claude Desktop access to all 70 agents and local memory. In one command."
+
+**[END CARD]**
+
+---
+
+## B-ROLL / EDITING NOTES
+
+- **USE A REAL PROJECT** — the credibility of this video depends on real findings, not demo setups
+- If you don't want to show your own project, create a realistic sample project with planted issues
+- Plant: one expired/rotated key in git history, one dep with install script, one GPL dep
+- Record the `/devil-mode` run uncut — the waiting time builds tension and authenticity
+- Show the `git log -p | grep` command for the secret finding
+- Show BFG Repo Cleaner remediation or `git filter-branch` command
+- Diagram for "attacker mindset vs author mindset" — 30-second simple animation
+- Thumbnail: red background + "I ran 8 attackers on my own code" + devil emoji or adversarial icon
+- This video will get shared in security communities — keep it technically precise