memlog — /dev/memlog for LLM context-compaction audit

Kernel character-device + per-uid circular ring that captures "about-to-be-compacted" LLM context state so it survives process death. Per PRD-memlog.md v0.1.

Phases shipped:

• 0: char device + ring + atomic writes + memlog show
• 1: per-uid isolation, sysctl kernel.memlog.ring_size, uid filter ioctl

Deferred:

• 2: perf tracepoint memlog:record_written, libmemlog (C/Rust/Python)
• 3: Anthropic SDK integration
• 4: episode promote from memlog tails

Layout

memlog/
├── driver/                Kernel module (out-of-tree by default)
│   ├── memlog.c
│   ├── Kbuild
│   └── Makefile
├── include/uapi/linux/    UAPI header (mirror copy for the wintermute kernel)
│   └── memlog.h
├── cli/                   `memlog` userspace tool (Python, v0.1)
│   └── memlog
└── tests/
    └── test_basic.sh      Functional smoke test

Build (out-of-tree)

cd driver
make                                   # against /lib/modules/$(uname -r)/build
sudo make modules_install              # installs memlog.ko
sudo depmod -a
sudo groupadd -f memlog
sudo usermod -aG memlog "$USER"        # log out / back in
sudo modprobe memlog memlog_gid=$(getent group memlog | cut -d: -f3)

Then create the device node — udev rule (/etc/udev/rules.d/99-memlog.rules):

KERNEL=="memlog", GROUP="memlog", MODE="0660"

Run

cli/memlog stats
echo -n '{"hello":"world"}' | cli/memlog write   # any opaque blob ≤ 64 KB
cli/memlog show --limit 5
cli/memlog show --format json | jq .

Configure

# Resize the ring (bytes, min 64 KB, max 256 MB)
sudo sysctl kernel.memlog.ring_size=8388608

Test

bash tests/test_basic.sh

What's in the wintermute kernel

The driver is dropped into drivers/char/memlog/ as part of the linux-wintermute package build. The UAPI header lands at include/uapi/linux/memlog.h. See ../wintermute-kernel/.

License

GPL-2.0-only (kernel module); MIT-OR-Apache-2.0 (userspace CLI and bindings, to be added in Phase 2).