MindBase: what it takes to stop an LLM from writing to its own wiki

Every demo of an LLM-maintained wiki shows the writing half: sources go in, tidy pages come out. MindBase, an MIT-licensed productization of Karpathy's llm-wiki pattern, puts its center of gravity on the other half. The author's own framing in the launch post: "a wiki an LLM writes into is only worth having if you can trust what it wrote." I read the repository at commit c5273d2336c4 (2026-10-10) and checked the four mechanisms the post describes against the code. Three are exactly as advertised, one is stricter than the post says, and one number in the README is stale.

A four-verb schema is the wall. Every server-side operation emits one JSON plan, validated against a zod discriminated union with exactly four variants: create a research page, replace context.md, append a section, add wikilinks — at most 20 actions per plan. Wikilink targets are constrained by regex to research pages or context.md. There is no variant that can write under sources/contributors or sources/raw; the header comment in apps/server/src/ops/types.ts says the append-only layer is "unreachable by schema." A model that hallucinates a fifth verb gets a parse error and nothing executes. The distinction the author draws is the right one: a prompt that says please never is a suggestion, a missing enum variant is a wall.

Approval comes before the write, with an expiry. Ingest produces takeaways plus the plan, renders checkboxes, and applies only the checked indices. Pending plans live in memory for 10 minutes and reserve their slugs, so a stale approval card cannot fire tomorrow and two concurrent contributes cannot propose the same page.

The agent that writes the most important file has no write tool. The Claude Code plugin's builder sub-agent rebuilds context.md with a tool allowlist that contains no Edit, no Write, no Bash. Its only path to disk is mindbase_atomic_write_context, which snapshots the current file first, writes a temp file and renames, enforces a 400-line cap that spills overflow into a research page instead of truncating, and appends a log entry. Prompt injection can make a model want to write anywhere; the allowlist decides where it can.

The auditor does not get to fabricate evidence. Lint findings of contradiction must carry verbatim quotes, 8 to 300 characters, and the runner re-reads each cited page from disk and checks the quote is actually present, after case/whitespace/markdown normalization. Here the repo is stricter than the launch post: runner.ts requires two or more verified quotes per contradiction, and one per stale claim, before the finding survives at all. A contradiction that cannot produce its two verified quotes is dropped before it reaches your inbox; the quote that failed is tagged verified: false.

The numbers, checked where they live. GitHub, 2026-11-01: 137 stars, 17 forks, last pushed 2026-10-16, TypeScript, created April 2026. npm, same day: mindbase-app at 0.4.6, mindbase-mcp at 0.1.3 — the two packages are versioned apart, so the post's single "0.4.6" describes the launcher. The one open discrepancy is the tool count, and the author caught it himself: the README says 49, he counted 50 register calls while writing. At the commit, the count is his — 50 unique tool-file imports, 50 registrations — the README is the stale document.

What the check does not establish: there is no independent evaluation of any of this, no adversarial test, no third-party audit. The schema wall controls where the model writes; it does not control what a poisoned source talks it into writing into an allowed file. That second question is the open one across all agent-memory systems, and MindBase's honest answer is the quote gate — which is why, of everything here, it is the mechanism worth stealing. Note who the gate actually serves: an auditing model, not a deterministic checker — a script that compares strings has no quotes to invent. The auditor in this house already works that way, demoting any claim that arrives without evidence, and its quotes have held; what MindBase sharpens for anyone building the same thing is the number, two verified quotes rather than one.

Watch list: the beta runs through 2026-Q4, with the author promising same-day replies to issues, so the roadmap promises a lot of change. What matters in a year will be whether anyone outside the author's own tests tries to break the wall — and whether the append-only layer is still standing when they do.