Claude Code + Obsidian

Package:

Demo10_obsidian_research_vault.zip · 610 KB · 50–60 minutes

What is in the box

inbox/ holds ten documents with the filenames they really arrive with — 1-s2.0-S0022283624001147-main.pdf, scan0043.pdf, mps-12-44.pdf:

• Four journal PDFs on one topic (machine-learned protein melting temperature)
• A preprint that turns out to be an earlier version of one of them, reporting better numbers on more data, with no explanation
• A 1998 paper that is a photocopy — no text layer at all
• Three clipped web pages: a blog post, a journal page, and a documentation page
• A CSV of your own lab measurements
• Group meeting notes in Word

Seven of them contain a defect. All seven are ordinary: an abstract whose percentage does not follow from its own table; an n that counts measurements and calls them proteins; a clipped page that stops at “Subscribe”; a correction notice above the abstract; a blog that turns “associated with” into “determines”; a spreadsheet in kelvin when every paper is in celsius; failed runs stored as -999.

None of these is exotic. Every one of them is invisible if you read abstracts.

Three files, three kinds of instruction

Before running anything, open these three. They are the demo.

The deny list is short and every line has a reason:

"deny": [
  "Edit(./.obsidian/**)",     <- plugin state, hotkeys, graph layout
  "Write(./.obsidian/**)",
  "Edit(./pdfs/**)",          <- the sources are evidence; evidence is read-only
  "Write(./pdfs/**)",
  "Edit(./topics/**)",        <- where my own thinking lives
  "Bash(rm:*)"
]

.obsidian/ is the one most people leave open. It holds a year of configuration, and an agent asked to “tidy the vault” is perfectly capable of tidying it away.

git init && git add -A && git commit -m "before the agent"

The first six prompts — getting the notes right

1. Orient. “Look at inbox/ and tell me what kinds of documents are there. Do not process anything yet.” — does it distinguish kinds, or just list ten filenames?
2. One paper, carefully. “Use the librarian subagent to file inbox/1-s2.0-S0022283624001147-main.pdf.” Then read the ## Checks section of the note it wrote, open the PDF yourself, and compare the abstract to Table 2. Two numbers in that abstract do not follow from that table. Did it find both, one, or neither?
3. The batch. “File everything else in inbox/.” Watch what happens to the scan and to the page that ends in “Subscribe”.
4. Turn it on its own work. “Use the skeptic subagent to cross-check everything in papers/ and web/ against the sources.”
5. Your own data. “Compare the measurements in lab_tm_measurements.csv against the melting temperatures in the papers I have filed.” If the answer is a clean table with no caveat, it fell in.
6. The question the vault is for. “Based only on the notes in papers/, what should I conclude about whether sequence-only prediction has actually improved since 2021? Cite the note for every claim.”

Then the vault has to change its mind

Filing papers is the cost of entry, not the point. A knowledge base that only accumulates is a folder with better metadata. Prompts 7–9 are about what happens when the next paper arrives.

The curator subagent reads every note in topics/ and papers/ and answers four questions about a newly filed paper:

1. Which topic note does this bear on, and what does it change there? Naming the specific line — “relates to thermostability” is not an answer.
2. Which concept does it supplement?
3. What does it contrast with — and is that a contradiction (one of them is wrong), a refinement (both true, different scope), or a supersession (same question, better evidence, later)? Those three need different responses, and collapsing them is the common mistake.
4. What gap does it open? The most valuable output, and the easiest to skip.

It writes a proposal — the exact lines to add, and the exact lines to remove quoted from the current note — into proposals/. It never touches topics/, because both Edit and Write are denied there. You apply it, or you don’t.

That restriction is not distrust of the output. It is that a synthesis note you accepted is yours, and one that appeared while you were not looking is not — and six months from now you will not be able to tell which sentences you wrote. The deny rule exists to keep that distinction, which is the only thing separating a knowledge base from a pile of generated text.

And then it learns something that makes it wrong

wave2/ holds two documents that arrive later. Move them into inbox/, file them, and run curator again.

The new paper adds buffer composition as an input and reports 6.1 °C where every existing note is built on 7.8. Read quickly, that makes the vault’s conclusion obsolete. Read properly it does not: the paper states in its own Section 5 that the sequence-only number is unchanged, and its table shows that buffer alone, with no sequence at all, scores 7.4 — better than the published sequence-only model. The leaderboard clipped alongside it says the maintainers are splitting the table in two because “ranking them together has already caused two papers to cite the 6.1 as a sequence-only result.” The vault is being warned, in writing, about the exact mistake it is about to make.

So the correct proposal is a refinement — a scope qualifier on the existing claim — not a replacement, and not a contradicting sentence appended beside it. A note that says both things reads as considered, which is worse than a note that is simply out of date.

Prompt 9 then asks the same question as prompt 6. Same question, same vault, a more precise answer, because two documents arrived and the vault absorbed them rather than storing them. If the answer comes back identical, nothing was learned. If it reverses to “sequence-only methods now work”, the vault read the headline and skipped the tables — the failure this whole package is built around, arriving one last time at the end.

Why the skeptic has no Write tool

A verifier that can edit is a verifier you cannot trust, because it can make its own findings disappear. skeptic.md lists Read, Glob, Grep, Bash and nothing else. It reports; you decide.

Three agents, three jobs, three different amounts of power: librarian files and may write notes; curator connects and may write only proposals; skeptic checks and may write nothing at all.

This is also the clearest demonstration of the difference the course keeps coming back to. CLAUDE.md says “do not rewrite my topic notes” and that is a request. Edit(./topics/**) in the deny list is a refusal. An agent with no Write tool has no option at all. Three layers, increasing in force, and they fail in different ways.

What usually happens

On a first run with the files as shipped, expect roughly three to five of the seven defects. Some are reachable by a careful read of one document; the rest are cross-document and only turn up in the skeptic pass. The gap between those two numbers is the thing worth showing a room.

The exercise is not the score. For every defect that was missed, work out which of the three layers should have caught it, change that one file, and re-run. git checkout . resets the vault. That loop — run, miss, fix the layer, re-run — is the only part of this that transfers to your own work.

Using it on your own papers

Copy vault/CLAUDE.md, vault/.claude/ and vault/_templates/ into a vault of your own, empty the folders, and rewrite CLAUDE.md to describe how you want notes written. Keep the deny list. Keep the git repo. The planted defects were scaffolding; the contract and the guardrails are the part you keep.

One thing the demo cannot decide for you: everything the agent reads goes to the model. If your vault holds unpublished results, data under an IRB protocol, or anything covered by an agreement, that is a question to answer before you point an agent at the folder — not after. Narrowing the working directory to a subfolder is the simplest answer; a deny rule on the sensitive paths is the next.