Facts that bind at write time
A reminder decays. A rail at write time does not.
The model had the rule. It ignored it anyway.
At the start of a long coding session we inject a clear constraint: MUST NOT hardcode founder-specific data. Hours later the agent was still writing. The reminder sat at the top of context, unread in practice. What actually stopped the leak was a check at the moment of action — a guard that ran against the pending write, not against a banner from session start.
That gap is the launch story.
The problem
You tell an AI tool your standards once. Claude Code, Cursor, Kiro, Claude Desktop, Antigravity — same pattern. The model nods. Then it drifts. A fact that only informs gets treated like optional background. When the write happens, the rule is gone from the working set.
Session-start context is necessary. It is not enough.
What Nora is
Nora is grounding and verification for AI coding — local-first, portable across those tools, built on the open Factlet protocol.
Before the model writes, grounding supplies the facts that govern the work. After it writes, verification checks the output against those same facts. Same factbook everywhere; switch tools and the rails stay.
The one-liner we use on kernora.ai: turn your rules, facts, and standards into the rails your AI runs on.
The idea: factlets as directives
This cycle we stopped treating factlets as statements you hope the model remembers.
A fact that only informs gets ignored at the moment it matters. A fact that directs — MUST NOT hardcode secrets, do not contradict decision X, re-check that every call site was updated — can bind.
Directive factlets carry an actionable clause: do / do-not / check. Grounding has something concrete to inject. Enforcement has something concrete to match.
Field evidence for this is small-N implementer experience on our own codebase, not a controlled study. We are publishing what we saw, not a general claim about every team.
Point-of-action enforcement — what we're building
Status (July 2026): what's solid on the free tier today is local-first session capture and zero-egress. The session-start grounding and write-time enforcement hooks are in active hardening and not yet reliable in the stock install — we're shipping those fixes next and will update this post when they land. We would rather say this than claim a rail that doesn't hold.
The design adds a second rail — verification at the action:
- Pre-write MUST-NOT blocking — before a Write/Edit tool call runs, a pre-write hook is designed to match the pending content against directive MUST-NOT factlets and block with a cited rule.
- Post-output secret scanner — after a tool runs, a companion check warns when output accidentally prints secrets.
The shape is ground before / verify after, plus bind at write. Fail-open on matcher errors is a design constraint: an enforcement bug must never freeze every edit.
Trust you can read
Every factlet states its basis:
| Basis | Meaning |
|---|---|
| execution-proof | Evidence from a build, script, or similar check |
| human-confirmed | A person signed it |
| agent-asserted | An AI wrote it down |
Most AI memory is agent-asserted and does not say so. Nora says so. verified stays reserved for execution proof or human confirmation — citation alone does not inflate a fact into “proven.”
Numbers we will defend
Only claims with a source:
- Without a factbook, three frontier models contradicted documented team decisions 12 times in 18 answers. With one: 0 across 36. N=6 tasks, counted from published raw run logs — factlet-ai/evals (2026-05). Recount it yourself. Small-N; open methodology.
- Grounding latency is hard-capped at 250ms in the hook; over-budget lookups are skipped.
- 0 bytes to Kernora servers. Telemetry is off by default on every tier.
- Free / Lite: 15 MCP tools. Pro: 62 MCP tools. License checks fail closed — if Nora cannot prove your tier, you get Lite.
No “5×.” No invented percentages.
Factlet vendor extensions
We opened two RFCs on the open Factlet protocol. Both are now merged as optional vendor-extension fields — still optional and vendor-namespaced, not required core:
- RFC 0014 —
x_directive/x_shape(vendor-extension fields for directive factlets) — factlet-ai/spec#12 - RFC 0015 —
x_check(machine-executable check field for enforcement) — factlet-ai/spec#13
Kernora ships an implementation. The RFCs ask the open standard whether the shape should travel beyond one product.
Try it
curl -fsSL https://kernora.ai/install | bash
Then open your project, run kernora generate, and work in Claude Code, Cursor, Kiro, Claude Desktop, or Antigravity. Dashboard (optional): http://localhost:2742.
- Product: kernora.ai
- Security / zero-egress: kernora.ai/security
- Source: github.com/kernora-ai/nora
- Changelog: v2.8.1 — session capture + grounding, zero-egress; write-time enforcement in development
A reminder decays. A rail at write time does not.