# NERF Memory Architecture

## Tri-Layer Search
1. **Symbolic** — SQLite structured queries (engagement_id, memory_type, tags, MITRE IDs)
2. **Lexical** — FTS5 full-text search with Porter stemming tokenizer
3. **Semantic** — LanceDB dense vector embeddings (sentence-transformers, optional)
4. **Fusion** — Reciprocal Rank Fusion: `RRF(d) = Σ 1/(k + rank_i(d))` where k=60

## Memory Types
finding | ioc | ttp | credential | host | network | config | note | decision | artifact

## Lifecycle
- Decay: importance × 0.98 per consolidation cycle
- Boost: +0.05 on access (capped at 1.0)
- Archive: when importance < 0.05
- Merge: Jaccard trigram similarity > 0.85 triggers deduplication
