An assistant, not a record
I have never been a note-taking person. For years my notes were a place to put things so I would not forget them — no linking, no structure, none of the productivity machinery people build around Obsidian, and that has not changed. What changed is that since May 2026 a Claude agent has read and write access to the notes-vault, and it does that part instead of me: personal notes, projects, basic planning. I talk to it in a Discord channel.
Some evenings I type «Добраніч» — good night — into that channel, and my notes tidy themselves up while I go to bed. Some evenings I forget, and the next morning I type «Добраніч і добрий ранок» in a single message: good night and good morning, closing a day I never closed and opening the one I am in. The agent answers that it has queued a save and a health check. A couple of minutes later the results come back — what it filed, what it cleaned, what it found wrong.
To work from one word, the agent holds keys to everything I have written: it can write anywhere in the vault, and it never asks permission.
I did not build the structure
The obvious defence of that arrangement would be that I designed the vault carefully enough to survive it. I did not. The folder map, the naming conventions, the rules about what gets saved without asking and what has to be confirmed, the instruction file the agent reads before it touches anything — all of it was generated for me by obsidian-second-brain, an open-source skill that bootstraps exactly this setup. The convention that every note opens with a short block addressed to the next session came with it too. I did not write those rules. I accepted them.
What I wrote myself is one line of frontmatter:
layer: legacy # the frozen thing that exists today
layer: target # the thing being built to replace it
One of my projects is a rewrite: an older version that still runs, and a successor that is replacing it piece by piece. Both are described in the same vault, in notes that use the same words for different things — the old one passes shopping lists through to an external service, the new one keeps its own table. Nothing had gone wrong. It just seemed obvious that a search across both would eventually return the old design as an answer about the new one, so I tagged every note with which world it belongs to, and wrote down the rule that goes with the tag: when reasoning about the successor, treat the old notes as evidence about the present, never as a description of the target.
So my one contribution to the structure is not structure. It is a fence: a place where I decided in advance that the agent would be wrong, and took that ground away from it beforehand.
The channel is the whole product
An assistant I have to go somewhere to use is one more thing on the list of things to do, and what I do with lists like that is established. The part that makes this work is not the model or the vault. It is that talking to it costs nothing.
It lives in a Discord channel, chosen from two directions. I do not trust Telegram enough to route my notes through it. And Discord is the one messenger with a simple, official plugin for the agent — I did not have to write a bridge, maintain it, or trust my own bridge with the same keys. Fewer moving parts I own is itself a security position.
What goes through that channel during a day is not the tidy version. Ideas thrown in as they arrive, feature arguments about Pantensa, the product I am building, design generation, planning, personal things that have nothing to do with code. «Добраніч» is not the interaction — it is the closing command that files whatever the day produced.
Two things the polished version of this setup would leave out.
Writing to the vault is easier than reading it. There is an Obsidian app on my phone, but keeping a git-synced vault working there was more setup than I wanted, so I never finished it. When I actually need a full note away from my desk, I open the repository on GitHub and read the markdown there. The agent has better access to my notes on the move than I do.
And voice. Discord voice messages transcribe locally through a self-hosted speech model: record, transcribe, confirm the transcript, run the task. I built it, debugged it, and then never used it — dictating turned out not to be my way of thinking. It sits there, working, unused. I am keeping it, on the theory that the person who wants it later is me.
Why it needs the keys
An assistant that only appends could ask permission. Appending is safe: worst case the vault grows a note nobody reads. What this one does instead is edit what is already there. New information does not land at the bottom of a file as another entry — it goes back into the note that is now wrong, marks the superseded part as superseded, and leaves the correction where the next reader will hit it. A note in my vault about a piece of infrastructure carries a line saying the architecture below it was confirmed on a date, and that the recommendation above it is dead. I did not write that line. The agent wrote it over its own earlier advice.
That is what I want, and it cannot run behind a confirmation prompt. A prompt per edit turns a two-minute cleanup into a queue of yes, and I would stop within a week — the same way I stopped with linking, with tags, with every other habit this system exists to work around. The permission is not a shortcut. It is the feature.
Which leaves the real question: what happens when it rewrites them wrong.
Worth it for now
So far it has not. Nothing has been destroyed, nothing important has quietly turned into something false that I later acted on. That sentence is weaker than it sounds: I do not audit the vault. I do not read back what the agent filed to check it. I notice problems the way anyone notices problems in a tool they use daily — when something I need is not where it should be — and that has not happened. That is not the same as verified.
The technical fence is real. Everything runs in one container that has the vault and nothing else, the vault is a git repository, and every edit the agent makes is a commit I can read or revert. That is the part I would point at if someone asked whether this is reckless.
It is not the part that actually holds. The vault was never my source of truth — it is an assistant. Things I genuinely cannot afford to lose or to have subtly rewritten do not live there — they are in a plain notebook, sometimes duplicated into Obsidian and sometimes not. I never decided that as a policy. I noticed it as a fact, and only while writing this. The agent has keys to everything in the system, and what makes that survivable is that I never put everything in.
The leak I know about is not in the vault. Running an agent with permission prompts disabled means the channel that talks to it is a channel that runs commands. Everything above about the agent being trustworthy assumes the only person typing into it is me, and that assumption holds because of how the box is reachable, not because of anything the agent enforces. Reachability rots quietly: a line in a compose file that publishes a port instead of keeping it on an internal network looks almost identical to the line that does not. I know where mine is. I have not changed it.
So: an agent that can rewrite anything I have written, that never asks, that I do not audit, on a box whose boundary rests on an assumption I carry rather than enforce. Against that, the only system of notes I have ever kept for more than a month — because the part I was never going to do is done by something that does not get tired of doing it.
Worth it for now, and «for now» is the term of the deal, not a hedge. It holds while the vault stays the assistant and not the record, while the box stays unreachable, while nothing in there is something I cannot lose. Three separate things that can each stop being true, and none of them will announce it.
A Vault That Rewrites Itself: obsidian-second-brain and the Karpathy LLM Wiki Pattern
Two tools most of us own ignore each other completely. An Obsidian vault with hundreds of notes nobody rereads. An AI agent in the terminal whose every session starts from zero, as if the past never happened. The obsidian-second-brain repository glues them together: 4.7k stars, MIT, authored by Eugeniu Ghelbur. The README's own formula: an evolution of Karpathy's LLM Wiki pattern, a vault that rewrites itself.
Here's a review, plus why I read the whole thing with deja vu: my business CRM runs on the same pattern.
The pattern first
Karpathy's LLM Wiki idea: a knowledge base in wiki form, maintained by an LLM. The model adds pages and links them, flags contradictions for manual resolution, surfaces patterns on request. The human owns the knowledge, the model maintains it.
The weak spot: it's passive. The wiki grows when you ask, and contradictions sit until you resolve them. This repo pushes the pattern into active form.
Four layers, 47 commands
The repo gives a CLI agent (Claude Code, Codex, Gemini CLI and four more) a command set that operates directly on your vault.
- Operations (30). Ingest URLs, PDFs, audio, screenshots into normalized notes. /obsidian-reconcile resolves contradictions. /obsidian-health lints the vault. /obsidian-architect documents a codebase into notes.
- Thinking tools (9). The part I care about most. /obsidian-challenge makes the vault argue with you from your own history. /obsidian-emerge hunts unnamed patterns. /obsidian-connect bridges knowledge domains.
- Context (1). /obsidian-world loads identity and state with token budgets, from a light L0 to a full L3.
- Research (7). Vault-first: /research-deep scans your notes first and researches only the gaps outside.
Plus four scheduled agents: morning, night, a Friday review, a Sunday health check. The vault lives without you. That's the design goal.
The part that's actually engineering
Two rules separate this from "plug GPT into notes".
Open Knowledge Metabolism. Every fact must be timeless, dated, or a pointer. Slow-changing knowledge lives in the note; fast-changing facts link to a live source with an "as of" date. There's a spec and a linter.
Bi-temporal facts. The vault remembers when a fact was true and when it learned about it. It sounds academic until someone asks "when did this stop being true", and someone always asks.
Add the inversion I like most: an AI-first note format, notes written for an agent to read, with frontmatter, recency markers and verbatim sources. For decades we adapted machines to documents. Here documents adapt to the machine.
And the restraint: bounded recall through a hook, at most four notes of roughly 900 characters per prompt, so memory doesn't eat the context window. 763 tests in CI, eight builds per platform. It's built like infrastructure, not like a prompt collection.
The principle to steal
"Your vault outlives any CLI." Agents change every six months. Knowledge in markdown belongs to none of them. Switch the tool, keep the files. A rare case where the right architecture is also the cheapest one.
The deja vu: our CRM runs on this pattern
I've been building business automation for 14 years, and my company's CRM is a production implementation of the same idea, on business entities instead of notes. What exists today, not on a roadmap:
- The vault is the source of truth. Clients, deals, tasks, invoices, infrastructure and correspondence: markdown with frontmatter in an Obsidian vault. A task tagged urgent and important lands in the right quadrant of an Eisenhower matrix on the dashboard, automatically, like this:
---
title: "Connect payment webhook to the CRM"
urgent: true
important: true
hours: 3
---
- Agents read and write directly. A board of director roles works on the same files: a CEO holds the weekly plan, a CFO holds cash and price floors, a commercial director holds receivables. Decisions land in a shared journal, a human approves what matters.
- Panels read, the vault stays. A promotion dashboard compiles semantics, content coverage, five social networks and traffic into one JSON file that both the agent and the owner read. The vault never becomes a database you can't open.
- Data discipline. Sensitive client fields are encrypted in a vault that locks itself, and the company is a registered personal-data operator.
How a business version differs
The cost of an error. In a personal knowledge base a wrong note costs a reread. In business, an agent that records a payment wrong or leaks personal data costs money and reputation. So triple down on what the personal version treats as optional: human approval of critical actions, encrypted personal data, and a decision log that shows who did what and why.
In about two years the pattern has traveled from a tweet to systems with hundreds of tests, and to CRMs companies actually run on, If you've got an Obsidian vault full of knowledge, this repo is the shortest path to giving your agents persistent memory. If you're running a business, the same pattern works there too, just bring the discipline along.
---
This article was prepared with AI assistance (drafting and adaptation) and reviewed by the author before publishing.
Originally published at automata.sale
tags: aiagents, obsidian, knowledgebase, productivity
Mentions
@elbyron0 Gracias por incluir obsidian-second-brain. El enlace tiene un error y da 404. Este es el bueno: eugeniughelbur/obsidian-second-brain
@Bober_smart Thanks for including obsidian-second-brain. The #3 link has a typo, so it 404s. Here's the real one: eugeniughelbur/obsidian-second-brain
It's off by default. One line in the config turns it on. Repo: eugeniughelbur/obsidian-second-brain The post that started it: theaioperator.io
@imryven Thanks for including obsidian-second-brain. Repo for anyone who wants it: eugeniughelbur/obsidian-second-brain
@BercusNA @yurshevv Here's the real one: eugeniughelbur/obsidian-second-brain
An assistant, not a record I have never been a note-taking person. For years my notes were a place to put things so I would not forget them — no linking, no structure, none of the productivity machinery people build around Obsidian, and that has not changed. What changed is that since May 2026 a Claude agent has read and write access to the notes-vault, and it does that part instead of me: personal notes, projects, basic planning. I talk to it in a Discord channel. Some evenings I type «Добраніч» — good night — into that channel, and my notes tidy themselves up while I go to bed. Some evenings I forget, and the next morning I type «Добраніч і добрий ранок» in a single message: good night and good morning, closing a day I never closed and opening the one I am in. The agent answers that it has queued a save and a health check. A couple of minutes later the results come back — what it filed, what it cleaned, what it found wrong. To work from one word, the agent holds keys to everything I have written: it can write anywhere in the vault, and it never asks permission. I did not build the structure The obvious defence of that arrangement would be that I designed the vault carefully enough to survive it. I did not. The folder map, the naming conventions, the rules about what gets saved without asking and what has to be confirmed, the instruction file the agent reads before it touches anything — all of it was generated for me by obsidian-second-brain, an open-source skill that bootstraps exactly this setup. The convention that every note opens with a short block addressed to the next session came with it too. I did not write those rules. I accepted them. What I wrote myself is one line of frontmatter: layer: legacy # the frozen thing that exists today layer: target # the thing being built to replace it One of my projects is a rewrite: an older version that still runs, and a successor that is replacing it piece by piece. Both are described in the same vault, in notes that use the same words for different things — the old one passes shopping lists through to an external service, the new one keeps its own table. Nothing had gone wrong. It just seemed obvious that a search across both would eventually return the old design as an answer about the new one, so I tagged every note with which world it belongs to, and wrote down the rule that goes with the tag: when reasoning about the successor, treat the old notes as evidence about the present, never as a description of the target. So my one contribution to the structure is not structure. It is a fence: a place where I decided in advance that the agent would be wrong, and took that ground away from it beforehand. The channel is the whole product An assistant I have to go somewhere to use is one more thing on the list of things to do, and what I do with lists like that is established. The part that makes this work is not the model or the vault. It is that talking to it costs nothing. It lives in a Discord channel, chosen from two directions. I do not trust Telegram enough to route my notes through it. And Discord is the one messenger with a simple, official plugin for the agent — I did not have to write a bridge, maintain it, or trust my own bridge with the same keys. Fewer moving parts I own is itself a security position. What goes through that channel during a day is not the tidy version. Ideas thrown in as they arrive, feature arguments about Pantensa, the product I am building, design generation, planning, personal things that have nothing to do with code. «Добраніч» is not the interaction — it is the closing command that files whatever the day produced. Two things the polished version of this setup would leave out. Writing to the vault is easier than reading it. There is an Obsidian app on my phone, but keeping a git-synced vault working there was more setup than I wanted, so I never finished it. When I actually need a full note away from my desk, I open the repository on GitHub and read the markdown there. The agent has better access to my notes on the move than I do. And voice. Discord voice messages transcribe locally through a self-hosted speech model: record, transcribe, confirm the transcript, run the task. I built it, debugged it, and then never used it — dictating turned out not to be my way of thinking. It sits there, working, unused. I am keeping it, on the theory that the person who wants it later is me. Why it needs the keys An assistant that only appends could ask permission. Appending is safe: worst case the vault grows a note nobody reads. What this one does instead is edit what is already there. New information does not land at the bottom of a file as another entry — it goes back into the note that is now wrong, marks the superseded part as superseded, and leaves the correction where the next reader will hit it. A note in my vault about a piece of infrastructure carries a line saying the architecture below it was confirmed on a date, and that the recommendation above it is dead. I did not write that line. The agent wrote it over its own earlier advice. That is what I want, and it cannot run behind a confirmation prompt. A prompt per edit turns a two-minute cleanup into a queue of yes, and I would stop within a week — the same way I stopped with linking, with tags, with every other habit this system exists to work around. The permission is not a shortcut. It is the feature. Which leaves the real question: what happens when it rewrites them wrong. Worth it for now So far it has not. Nothing has been destroyed, nothing important has quietly turned into something false that I later acted on. That sentence is weaker than it sounds: I do not audit the vault. I do not read back what the agent filed to check it. I notice problems the way anyone notices problems in a tool they use daily — when something I need is not where it should be — and that has not happened. That is not the same as verified. The technical fence is real. Everything runs in one container that has the vault and nothing else, the vault is a git repository, and every edit the agent makes is a commit I can read or revert. That is the part I would point at if someone asked whether this is reckless. It is not the part that actually holds. The vault was never my source of truth — it is an assistant. Things I genuinely cannot afford to lose or to have subtly rewritten do not live there — they are in a plain notebook, sometimes duplicated into Obsidian and sometimes not. I never decided that as a policy. I noticed it as a fact, and only while writing this. The agent has keys to everything in the system, and what makes that survivable is that I never put everything in. The leak I know about is not in the vault. Running an agent with permission prompts disabled means the channel that talks to it is a channel that runs commands. Everything above about the agent being trustworthy assumes the only person typing into it is me, and that assumption holds because of how the box is reachable, not because of anything the agent enforces. Reachability rots quietly: a line in a compose file that publishes a port instead of keeping it on an internal network looks almost identical to the line that does not. I know where mine is. I have not changed it. So: an agent that can rewrite anything I have written, that never asks, that I do not audit, on a box whose boundary rests on an assumption I carry rather than enforce. Against that, the only system of notes I have ever kept for more than a month — because the part I was never going to do is done by something that does not get tired of doing it. Worth it for now, and «for now» is the term of the deal, not a hedge. It holds while the vault stays the assistant and not the record, while the box stays unreachable, while nothing in there is something I cannot lose. Three separate things that can each stop being true, and none of them will announce it.
A Vault That Rewrites Itself: obsidian-second-brain and the Karpathy LLM Wiki Pattern Two tools most of us own ignore each other completely. An Obsidian vault with hundreds of notes nobody rereads. An AI agent in the terminal whose every session starts from zero, as if the past never happened. The obsidian-second-brain repository glues them together: 4.7k stars, MIT, authored by Eugeniu Ghelbur. The README's own formula: an evolution of Karpathy's LLM Wiki pattern, a vault that rewrites itself. Here's a review, plus why I read the whole thing with deja vu: my business CRM runs on the same pattern. The pattern first Karpathy's LLM Wiki idea: a knowledge base in wiki form, maintained by an LLM. The model adds pages and links them, flags contradictions for manual resolution, surfaces patterns on request. The human owns the knowledge, the model maintains it. The weak spot: it's passive. The wiki grows when you ask, and contradictions sit until you resolve them. This repo pushes the pattern into active form. Four layers, 47 commands The repo gives a CLI agent (Claude Code, Codex, Gemini CLI and four more) a command set that operates directly on your vault. - Operations (30). Ingest URLs, PDFs, audio, screenshots into normalized notes. /obsidian-reconcile resolves contradictions. /obsidian-health lints the vault. /obsidian-architect documents a codebase into notes. - Thinking tools (9). The part I care about most. /obsidian-challenge makes the vault argue with you from your own history. /obsidian-emerge hunts unnamed patterns. /obsidian-connect bridges knowledge domains. - Context (1). /obsidian-world loads identity and state with token budgets, from a light L0 to a full L3. - Research (7). Vault-first: /research-deep scans your notes first and researches only the gaps outside. Plus four scheduled agents: morning, night, a Friday review, a Sunday health check. The vault lives without you. That's the design goal. The part that's actually engineering Two rules separate this from "plug GPT into notes". Open Knowledge Metabolism. Every fact must be timeless, dated, or a pointer. Slow-changing knowledge lives in the note; fast-changing facts link to a live source with an "as of" date. There's a spec and a linter. Bi-temporal facts. The vault remembers when a fact was true and when it learned about it. It sounds academic until someone asks "when did this stop being true", and someone always asks. Add the inversion I like most: an AI-first note format, notes written for an agent to read, with frontmatter, recency markers and verbatim sources. For decades we adapted machines to documents. Here documents adapt to the machine. And the restraint: bounded recall through a hook, at most four notes of roughly 900 characters per prompt, so memory doesn't eat the context window. 763 tests in CI, eight builds per platform. It's built like infrastructure, not like a prompt collection. The principle to steal "Your vault outlives any CLI." Agents change every six months. Knowledge in markdown belongs to none of them. Switch the tool, keep the files. A rare case where the right architecture is also the cheapest one. The deja vu: our CRM runs on this pattern I've been building business automation for 14 years, and my company's CRM is a production implementation of the same idea, on business entities instead of notes. What exists today, not on a roadmap: - The vault is the source of truth. Clients, deals, tasks, invoices, infrastructure and correspondence: markdown with frontmatter in an Obsidian vault. A task tagged urgent and important lands in the right quadrant of an Eisenhower matrix on the dashboard, automatically, like this: --- title: "Connect payment webhook to the CRM" urgent: true important: true hours: 3 --- - Agents read and write directly. A board of director roles works on the same files: a CEO holds the weekly plan, a CFO holds cash and price floors, a commercial director holds receivables. Decisions land in a shared journal, a human approves what matters. - Panels read, the vault stays. A promotion dashboard compiles semantics, content coverage, five social networks and traffic into one JSON file that both the agent and the owner read. The vault never becomes a database you can't open. - Data discipline. Sensitive client fields are encrypted in a vault that locks itself, and the company is a registered personal-data operator. How a business version differs The cost of an error. In a personal knowledge base a wrong note costs a reread. In business, an agent that records a payment wrong or leaks personal data costs money and reputation. So triple down on what the personal version treats as optional: human approval of critical actions, encrypted personal data, and a decision log that shows who did what and why. In about two years the pattern has traveled from a tweet to systems with hundreds of tests, and to CRMs companies actually run on, If you've got an Obsidian vault full of knowledge, this repo is the shortest path to giving your agents persistent memory. If you're running a business, the same pattern works there too, just bring the discipline along. --- This article was prepared with AI assistance (drafting and adaptation) and reviewed by the author before publishing. Originally published at automata.sale tags: aiagents, obsidian, knowledgebase, productivity