Agent Memory Atlas

Library-first01

Mem0

Pragmatic extraction, pluggable stores, hybrid retrieval, and a clean SDK surface.

Best idea: Additive extraction pipeline
Main risk: Extracted fact ≠ verified truth

Read analysis

Library primitives02

LangMem

Small, framework-native tools for managing structured memory and background reflection.

Best idea: Schema-driven store tools
Main risk: Policy remains application-owned

Read analysis

Representation service03

Honcho

Message streams become peer-centric observations and a compact working representation.

Best idea: Events → working representation
Main risk: Operational and consistency cost

Read analysis

Coding-agent local04

Engram

A compact SQLite and FTS5 memory with purposeful MCP tools and conflict-oriented writes.

Best idea: Topic-key upserts + conflict surfacing
Main risk: Agent discipline drives quality

Read analysis

Verbatim evidence05

MemPalace

Original text stays authoritative; extracted indexes guide retrieval without hiding evidence.

Best idea: Supersede writes one instant to both sides of the handover
Main risk: Large, noisy raw stores, and a best-effort audit log

Read analysis

Compact graph-RAG06

Swafra

A tiny local hybrid retriever that now supersedes facts instead of deleting them — and re-asserts them the moment a new session mentions them again.

Best idea: Correction that reaches the ranker
Main risk: Supersession undone by the next session

Read analysis

Filesystem + git07

llm-wiki-memory

Inspectable Markdown memory with recoverable capture, explicit targets, and operational depth.

Best idea: Recoverable lifecycle capture
Main risk: Active atoms lack trust state

Read analysis

Operator-governed08

RainBox

Claims and evidence meet governed writes, rejected tombstones, review UI, and retrieval telemetry. The atlas author's own project — read as a self-assessment.

Best idea: Memory governance loop
Main risk: Compact claims lose nuance

Read analysis

Agent runtime09

Letta

Core, archival, and conversation memory are first-class parts of the running agent.

Best idea: Core vs archival vs recall
Main risk: Agent-editable core lacks trust model

Read analysis

Hosted product10

Supermemory

A polished public surface around documents, chunks, spaces, profiles, SDKs, and MCP.

Best idea: Product-grade API shape
Main risk: Core backend is a black box here

Read analysis

Verification-first11

Verel

Memory is an epistemic problem: candidate, verified, rejected, corroborated, and defensively recalled.

Best idea: Trust and usefulness are separate
Main risk: Correctness has a complexity cost

Read analysis

Memory service12

Hindsight

Source-backed facts and observations meet semantic, lexical, graph, and temporal recall.

Best idea: Four-arm task-specific fusion
Main risk: Derived belief lacks truth state

Read analysis

Temporal graph13

Graphiti

Episodes become a bi-temporal entity graph that preserves changing facts and history.

Best idea: Fact validity ≠ ingestion time
Main risk: Graph mistakes have wide impact

Read analysis

Observations, and a graph with a ceiling14

Mastra Observational Memory

Messages become dated observations, beside a scoped knowledge graph whose records carry a stamped ceiling on how widely they may ever be shared.

Best idea: A per-record scope ceiling, re-checked on every rescope
Main risk: Soft-deleted records nothing consults when the same fact is observed again

Read analysis

Memory substrate15

MemOS

Mountable cubes span textual, preference, skill, KV-cache, and parametric memory.

Best idea: Heterogeneous memory cubes
Main risk: Uneven module guarantees

Read analysis

Canonical Markdown16

Basic Memory

Human-editable notes stay authoritative while graph and hybrid-search indexes remain rebuildable.

Best idea: Source-of-truth projections
Main risk: Bidirectional sync complexity

Read analysis

Hook-native runtime17

agentmemory

Cheap lifecycle capture meets compact-first BM25, vector, and graph recall.

Best idea: Zero-LLM capture + expandable search
Main risk: Fuzzy supersession and broad surface

Read analysis

Proxy-intercepted team memory18

TencentDB Agent Memory

Four services behind a reverse proxy, isolating every layer on a team, user, agent and task key.

Best idea: Scope key as a SQL predicate, not a post-filter
Main risk: No committed tests anywhere in the tree

Read analysis

Knowledge-graph platform19

Cognee

Source-preserving pipelines build ontology-aware graph, vector, summary, and session memory.

Best idea: Provenance-aware pipeline rollback
Main risk: Cross-store and policy complexity

Read analysis

Hook-native sidecar20

Claude-Mem

A durable hook queue feeds structured observations and bounded project timelines across sessions.

Best idea: Commit before queue acknowledgement
Main risk: Generated observations activate directly

Read analysis

Evolving linked notes21

A-MEM

An LLM links new notes and revises nearby metadata in a compact Zettelkasten-inspired prototype.

Best idea: Adaptive note organization
Main risk: Rank position used as identity

Read analysis

Vector-symbolic22

Holographic

Facts become holographic phase vectors, so entities can be queried algebraically instead of by keyword.

Best idea: Deterministic hash-derived vectors
Main risk: Downvotes silently delete memory

Read analysis

Bounded runtime23

Hermes Agent

Hard-capped Markdown memory frozen into the prompt at session start to keep the cache warm.

Best idea: Frozen snapshot, consolidate in-turn
Main risk: Model writes are instantly authoritative

Read analysis

Context database24

OpenViking

Memory, resources, and skills share one filesystem hierarchy with three retrievable granularities.

Best idea: Hotness kept apart from truth
Main risk: Published numbers lack raw artifacts

Read analysis

Memory service25

Redis Agent Memory Server

TTL-scoped working memory promotes into deduplicated long-term memory with a real retention policy.

Best idea: Composite forgetting policy
Main risk: Deletion without tombstones

Read analysis

Curated knowledge26

ByteRover

A deterministic guard counts what an LLM rewrite would delete, then merges the loss back in.

Best idea: Structural-loss guard on rewrites
Main risk: Elastic License, not open source

Read analysis

Plugin memory27

OpenClaw

A nightly consolidation pass rewrites durable memory, and what survives it is decided by twenty-one English keyword regexes.

Best idea: Refuses to overwrite human notes
Main risk: Durability policy is a regex scorecard

Read analysis

Associative graph28

HippoRAG

Seeds a knowledge graph with query entities and lets PageRank diffuse relevance instead of planning hops.

Best idea: Diffusion instead of traversal
Main risk: No scope, trust, or temporal model

Read analysis

Procedural skills29

Voyager

Memory is a library of executable skills, written only once the environment confirms they worked.

Best idea: Verified-execution write gate
Main risk: Frozen 2023 artifact; no failure memory

Read analysis

The ancestor30

Generative Agents

The observation, reflection, and planning stream whose importance-recency-relevance score everything else still echoes.

Best idea: Reflection triggered by significance
Main risk: Its famous weights are hand-tuned

Read analysis

Verified memory31

Magic Context

Maps each memory to the files it describes and re-verifies it when git says those files changed.

Best idea: Verification against real code change
Main risk: No tombstones; large surface

Read analysis

Session substrate32

Pi

A branchable JSONL session tree with deterministic compaction manifests — and no memory contract at all.

Best idea: Deterministic file manifest on compaction
Main risk: Every plugin reinvents memory

Read analysis

Self-tuning policy33

MetaClaw

Replays past turns against candidate retrieval policies and promotes one only when it beats the incumbent.

Best idea: Promotion gate for retrieval policy
Main risk: Optimizes overlap proxies, not outcomes

Read analysis

Dual-cursor files34

nanobot

An append-only summary archive with separate write and consume cursors, and a Dream pass that won't advance after tool errors.

Best idea: Don't advance a cursor after failure
Main risk: Durable claims lack provenance

Read analysis

Daily distillation35

CowAgent

Conversations become dated daily files, then a nightly Deep Dream distils them into a ~30-entry MEMORY.md.

Best idea: Dated intermediate layer
Main risk: Newer-always-wins correction

Read analysis

Memory as policy36

GenericAgent

Four layers governed by written axioms — nothing enters memory that did not come from a successful tool call.

Best idea: ROI test for permanent context
Main risk: Prose rules, no enforcement

Read analysis

Evaluated memory37

open-cowork

Ships a memory benchmark that asserts what recall must not surface, not just what it must.

Best idea: Forbidden-hit eval assertions
Main risk: Harness committed, results are not

Read analysis

Reimplemented model38

Gini Agent

A local rebuild of the Hindsight model with bi-temporal units, rejected and conflicted states, and decisions kept as ADRs.

Best idea: Memory decisions written as ADRs
Main risk: Conflict state with no workflow

Read analysis

Local file corpus39

Moltis

Markdown chunked, embedded, and hybrid-searched, with sanitized session transcripts fed back into the corpus.

Best idea: No-embeddings mode as a constructor
Main risk: Transcripts rank beside curated notes

Read analysis

Graded personal40

Mercury Agent

Grades every memory on confidence, importance, and durability, with a subconscious tier and a learning pause switch.

Best idea: Durability split from importance
Main risk: Dismissal without a tombstone

Read analysis

Composable blocks41

LlamaIndex

One token budget split between chat history and pluggable memory blocks that each truncate themselves.

Best idea: Self-truncating memory blocks
Main risk: Capture depends on conversation length

Read analysis

Evaluated fabric42

Atomic Agent

Numbered invariants cited from the schema and append-only vote events — over three timestamp columns that always hold the same number, and a project boundary the model can switch off.

Best idea: Invariants as referenced artifacts
Main risk: A scope filter that defaults to off

Read analysis

Scoped provider SPI43

MateClaw

A provider contract that carries the owner key on every call, a recall query that filters personal facts by owner, and isolation tests that assert what a populated search must not return.

Best idea: Contradictions queue until a person resolves them
Main risk: The resolution verbs are read by nothing

Read analysis

Gated memory44

Waku Agent

A small model decides whether to retrieve at all, because irrelevant memory bends the answer. The agent and a person can both correct a stored fact — and the next consolidation pass can put it back.

Best idea: Abstaining from retrieval
Main risk: The gate is scored, but nothing fails when it decides wrongly

Read analysis

Rehearsable correction45

Memora

The supersession sweep defaults to a dry run, and the retrieval argument that decides whether corrected memories come back defaults to the safe answer — unfiltered is a string you have to type.

Best idea: The omitted argument is the safe one
Main risk: The shipped plugin stamps a type by keyword, unasked

Read analysis

Stochastic recall46

LoongFlow

The only memory here that samples instead of ranking — temperature set by how varied the store has become.

Best idea: Diversity drives the temperature
Main risk: Recall is not reproducible

Read analysis

Grounding-gated trust47

Core Memory

How a record is known sets a ceiling on how trusted it can ever become, so use alone cannot make a guess canonical.

Best idea: Grounding caps the trust ladder
Main risk: Correction is record-keyed

Read analysis

Resolved conflict48

Memanto

The only conflict pipeline here that ends in a decision — including "both are true" and a human-written reconciliation.

Best idea: Conflicts get resolved, not flagged
Main risk: Deletion without a tombstone

Read analysis

A delegated key is a ceiling, not a grant49

Memory Engine

A restricted key declares the access it wants per space and path, and the engine hands back only the intersection with what its holder already has — so over-declaring clamps down instead of escalating.

Best idea: Delegation intersected with live access, in SQL
Main risk: Governs access, not truth — and the log expires

Read analysis

Cross-harness handoff50

ai-memory

A handoff that expires, addressed between harnesses, carrying the open questions rather than the conclusions.

Best idea: Memory of what is not known
Main risk: Re-capture undoes deletion

Read analysis

Guarded consolidation51

ctx

The background pass may only write where it is sanctioned to, and the tests include a corruption corpus from a published paper.

Best idea: The pass proposes, a person disposes
Main risk: Folding away is not forgetting

Read analysis

No background work52

OptMem

860 lines, a log the code never edits, and detail that decays with age by geometry instead of policy.

Best idea: Consolidation asked, never scheduled
Main risk: No licence; nothing is fixable

Read analysis

Rewindable memory53

Memvid

Immutable frames in one file, so a fact can be read as of last March and a whole session can be replayed.

Best idea: Time travel from the format
Main risk: Loud claims, no artifacts

Read analysis

Heat-promoted tiers54

MemoryOS

The tiered architecture at its most legible — and its promotion score cannot tell importance from verbosity.

Best idea: The promotion rule is written down
Main risk: One scalar, three signals

Read analysis

Documented decisions55

memU

Ranks the slice and returns the file, and writes down why each schema decision was made.

Best idea: Search unit ≠ return unit
Main risk: Seven hosts, no scope key

Read analysis

Policy over machinery56

OpenWorker

A small scoped SQLite memory where every write is announced with an undo, and a human-authored rules block outranks anything the agent learned.

Best idea: A user rules block no tool can write, edit or delete
Main risk: memory_read fetches by integer id with no scope check

Read analysis

Team memory in git57

Qwen Code

Shared memory distributed by git pull, with secret-bearing writes refused even when the tier is switched off.

Best idea: A guard the flag cannot disable
Main risk: Forget does not survive re-extraction

Read analysis

Hooks, no contract58

OpenCode

The two hooks a memory plugin needs, both experimental, and no memory contract — so plugins read the database instead.

Best idea: A compaction hook
Main risk: Plugins couple to the schema

Read analysis

Cognitive-model recall59

NOOA Memory

ACT-R activation and the Ebbinghaus curve, with the score components of every retrieval stored on the record.

Best idea: Retrieval explains itself later
Main risk: The access log is capped

Read analysis

Memory of its own reasoning60

Neo4j Agent Memory

A third tier that records how the agent reasoned — and stores the failures, because the control flow catches them.

Best idea: Failures stored by default
Main risk: Bi-temporal only for preferences

Read analysis

Evaluated demo61

Elastic Atlas

A demo that measures itself more than most production systems here — a recall eval matched on id, plus a stress test.

Best idea: An eval you can rerun
Main risk: Ungated consolidation

Read analysis

Memory as an operand62

NemoClaw

Sandboxes other agents and snapshots their memory — credentials get scrubbed on backup, memory does not.

Best idea: A declared state contract
Main risk: Restore reinstates deletions

Read analysis

Verified quotes63

Daimon

Every memory is marked verbatim or inferred — and the quote is grepped against the transcript before the label sticks.

Best idea: Code falsifies the trust label
Main risk: One checkpoint is the memory

Read analysis

Scope tested by exclusion64

MIRIX

Six memory types, six writer agents, and the atlas's third test asserting a memory must not come back — reached through access control, not memory research.

Best idea: The cache query carries the scope key too
Main risk: A periodic pass hard-deletes what it rewrites

Read analysis

Scope in the primary key65

Memobase

The smallest useful description of a user — five sentences a subtopic, a token-budgeted context block, and the transcript deleted once it has been read.

Best idea: Tenant key in every primary key
Main risk: The evidence is gone by default

Read analysis

Reinforcement, inverted66

Memary

Forty lines of reinforcement by frequency — and the one line that reads the counts sorts ascending, so the rarest entities are the ones injected.

Best idea: Salience and belief kept apart
Main risk: A recall miss becomes a permanent belief

Read analysis

Provenance by foreign key67

Memori

Every fact names the conversations that produced it — and the dedupe key strips all non-ASCII, so facts in other scripts collapse into one row.

Best idea: Durable turn, best-effort extraction
Main risk: One hash for every non-Latin fact

Read analysis

Publishes its worst score68

ReMe

Committed per-category benchmark tables including a 26.7% and a 0.100 — plus CREATE/CORROBORATE/REFINE/CORRECT as a validated verb set.

Best idea: Corroboration as a first-class action
Main risk: The verb is checked, the edit is not

Read analysis

Forgetting curve69

PowerMem

Promote, archive, forget and reinforce as four separate decisions — evaluated during search, so reading a memory changes it.

Best idea: Decay rate varies by memory type
Main risk: The history table has no callers

Read analysis

Commitments, inferred70

MineContext

Watches your screen and writes down what it decides you promised — prospective memory inferred from what it saw rather than stated.

Best idea: Event time allowed to be future
Main risk: No tests, and no way to reject a todo

Read analysis

Outcome-gated learning71

Acontext

Nothing is learned until a task reaches success or failed — and three committed tests assert that a running task writes nothing.

Best idea: The execution gate, with tests
Main risk: A deleted skill can be re-distilled

Read analysis

Memory in weights72

Second Me

Documents to a versioned biography to LoRA weights — the atlas's only memory that is weights, and the only place deleting a memory cannot reach the belief.

Best idea: The derived layer is numbered
Main risk: Deletion stops at the vector store

Read analysis

Staged by rename73

TigrimOSR

A proposed skill waits on disk beside the live one, carrying its rationale and sources — but say no and nothing remembers you did.

Best idea: Approval escalates on who wrote it
Main risk: Rejections die with the process

Read analysis

Citations that resolve74

MemMachine

Keeps every raw episode and cites it from each derived fact — then acknowledges a session deletion it has only queued.

Best idea: Provenance you can actually follow
Main risk: Deleted is reported before it is true

Read analysis

Blinded index75

Buzz

The relay holding your agent's memory cannot read it, and cannot tell which memory it is holding — but it throws away every version it replaces.

Best idea: HMAC the index, not just the payload
Main risk: Replaceable events keep no history

Read analysis

User-defined schema76

Logseq

The only store here whose memory schema belongs to the user — and the agent writes into it live, unmarked, with no way to delete what it got wrong.

Best idea: The user defines what a memory is
Main risk: Agent writes are indistinguishable

Read analysis

A taint with one reader left77

OpenHuman

Every synced memory still carries a fail-closed provenance taint, but since the subconscious engine was removed, the only thing it changes is whether auto-recall fences a note as untrusted.

Best idea: One guarded handle, scopes intersected
Main risk: A tool refusal with no producer

Read analysis

Provider contract78

Google ADK

Requires the user scope on every call and offers no way to delete — while the sibling session service deletes fine.

Best idea: Scope in the signature, not the query
Main risk: Promotion into memory is one-way

Read analysis

Receipted memory79

Aukora Kernel

Forgetting erases the plaintext and keeps the chain provable — then the next write never checks what was forgotten.

Best idea: Receipt first, row second, both fsynced
Main risk: A rejection nothing reads back

Read analysis

Memory without identity80

AutoGen

A memory has no id, so the only deletion the protocol can express is wiping the whole store.

Best idea: Memory injects itself into context
Main risk: No id means no targeted delete

Read analysis

Addressed lifecycle81

GoodAI LTM

Dormant since 2024, and its interface still says "delete that one" — which neither 2026 framework contract can.

Best idea: Insert returns the key you correct by
Main risk: Delete removes, it does not reject

Read analysis

Cases and skills82

EverOS

Four scope keys pinned on one shared read path and proved disjoint end to end — while a deprecated fact stays re-derivable from the file that made it.

Best idea: One compile path for every read
Main risk: Correction lives in the projection

Read analysis

Unreviewed by design83

ECC

Trust is an enum with one value, and the schema says why — while a rejected status is filtered on read and set by nothing.

Best idea: Declaring the store non-authoritative
Main risk: A state machine with no transitions

Read analysis

Ask it to forget84

Skales

The bin icon confirms, computes the deletion, throws it away, and tells you to ask in chat — where no forget verb exists.

Best idea: Capture and recall with no model at all
Main risk: A delete button that cannot delete

Read analysis

Dispute has its own clock85

Project N.E.K.O.

Agreement and disagreement decay separately, a test proves a disputed memory never feeds back, and a second trust axis weighs who said it — with tests that the model cannot forge either.

Best idea: Disputation as its own signal
Main risk: "Never mention this" expires, and cannot be deleted

Read analysis

Memory people write by hand86

SillyTavern

Keyword-triggered entries a person authors, with sticky, cooldown and delay making activation a timed state machine — and negative keys saying when not to fire.

Best idea: Cooldown and sticky on a retrieval unit
Main risk: Imported lorebooks carry no author

Read analysis

Three memory systems, one repository87

RisuAI

A summarizer rewritten twice in three years, with every generation still in the tree — and each one fixing a failure the last one had in production.

Best idea: Summaries die with their source messages
Main risk: Three summarizers, zero memory tests

Read analysis

The guard the redirect walks past88

Soul of Waifu

A model rewrites the whole memory every four messages, and four guards stop that from destroying it — then a de-duplication step reassigns the filename two of those guards just checked.

Best idea: Repair a truncated response, and retry rather than default
Main risk: A validated filename replaced after validation

Read analysis

BM25 rediscovered by hand89

Z-Waif

Inverse document frequency, corpus-derived stopwords and length normalisation, written from scratch in while loops — plus a guard against the character's own words steering its recall.

Best idea: Cap the agent's own words in its own query
Main risk: A window score computed and never read

Read analysis

normalize_scores does not normalize90

VirtualWife

The Generative Agents retrieval function, ported faithfully except for the normalisation — so a 1-to-10 importance score outranks relevance and recency by construction.

Best idea: A scope key on every contract method, clear included
Main risk: Short-term recall drops the owner filter

Read analysis

Confidence computed, then dropped91

Helm

A first observation is capped at 0.7 and can only climb on independent repeats — then the recalled facts reach the model as (kind) key: value under "never contradict them", with the number stripped off.

Best idea: A provisional cap that corroboration alone can lift
Main risk: Three readers ignore the active-row predicate

Read analysis

Approval that lives in a prompt92

Agno

Six learning stores behind one machine, with fact supersession decided by a judged verdict against a configurable threshold — and a PROPOSE mode whose human approval is a sentence in the system prompt that the save_learning tool never checks.

Best idea: Supersession judged, thresholded, and reversible
Main risk: optimize_memories collapses every memory into one, apply=True by default

Read analysis

Six claims, zero result artifacts93

SimpleMem

Memory units that resolve their own pronouns and absolutise their own timestamps at write — stored in an add-only index whose single removal verb is clear(), beside a second subsystem holding the scope key and audit trail the first one lacks.

Best idea: Context-independence bought once, at extraction
Main risk: Six headline figures with no committed result artifact

Read analysis

A scope the model cannot name94

Pydantic AI Harness

Four tools over a Markdown notebook, with a scope key the model can neither name nor see — resolved from run context, absent from every tool signature and from the injected block — and three call sites that raise if the backend returns a path outside it.

Best idea: Verifying that your own store honoured the scope filter
Main risk: The receipts table clears its payload, so nothing records what a write changed

Read analysis

The scope key that only travels95

CAMEL

A three-part memory contract whose unit is the message rather than the fact — where every record carries an agent_id that no read path consults, and isolation comes from remembering to give each agent its own storage object.

Best idea: Block, memory and context creator as three separate seams
Main risk: The vector half cannot delete one record, only all of them

Read analysis

The contract still declares no delete96

Microsoft Agent Framework

AutoGen's successor swaps a five-method Memory protocol for a two-method ContextProvider that declares neither deletion nor scope — beside a harness memory whose owner id is mandatory, traversal-checked, and asserted to stay inside its base path.

Best idea: Checking the resolved path never escaped the scope root
Main risk: Correction is an LLM rewriting the durable file with no diff

Read analysis

An LLM with a delete on the write path97

CrewAI

Memory as a filesystem — records at /company/team/user, views rooted at a subtree, and a committed test that a rooted view cannot recall its sibling's records — with a consolidation plan that lets a model delete what it decides is superseded.

Best idea: Scope as a path, with views callers hold instead of parameters they pass
Main risk: Model-authorised deletion with no tombstone and no audit

Read analysis

The model owns the schema98

Gobii

Durable memory is a SQLite file the agent designs and queries itself, sandboxed by a sqlite3 authorizer — and the eight tables the platform mounts into it are all dropped before saving, with each one's mortality written into the schema prompt the model reads.

Best idea: Telling the model which of its tables survive the cycle
Main risk: A model-authored schema no operator can write an erasure query against

Read analysis

One table, argued for99

Agent Memory on Supabase

551 lines of SQL carrying real validity-versus-record time, three-lane RRF recall, and an updated_at trigger that refuses to fire on a read — with the per-user row-level security shipped commented out.

Best idea: A content clock that a read cannot turn into a usage clock
Main risk: The enforced posture is server-sees-everything

Read analysis

Forgetting only in the index100

LivingFeed

A Korean-documented actor simulation that stores the four components of its importance score so the coefficients can be tuned by replay — and expires only the semantic index, never the episodic original.

Best idea: Storing a composite score's parts, not just its total
Main risk: A failed recall returns [], so amnesia looks like a quiet world

Read analysis

The contract that can say no101

Cosmonapse

The only memory contract in the atlas that can decline a query, shed load, miss a deadline and roll back its own writes — with a saga journal that lives in a process dictionary.

Best idea: A failure vocabulary in the interface, including refusal
Main risk: Compensation dies with the worker holding it

Read analysis

Memory that waits for a yes102

npcpy

Extracted memories land as pending_approval and reach no prompt until a person presses a key — approve, reject, edit, skip or defer — with build_context reading only what was approved.

Best idea: An approval state the retriever actually respects
Main risk: A rejection is recorded and never consulted again

Read analysis

Gitignored on purpose103

Juggler

One MEMORY.md per project, kept out of git so it is private to your checkout — maintained by a single remember/forget tool and rendered as a context item where every dated fact has its own delete control.

Best idea: Separating the file you write from the file the assistant writes
Main risk: forget matches by substring and returns no receipt

Read analysis

Mem0's shape, with a robot's memory beside it104

MagiCore

A .NET build of the Mem0 architecture — formerly Mem0Sharp — that keeps an event time beside every record time, writes a history entry for every mutation and replays robot evidence by capture time into beliefs that say when to look again, while the durable history collection is written and never read back and rollback is the one mutation the history omits.

Best idea: An event time the filter refuses to guess at
Main risk: An audit no reader reaches after a restart

Read analysis

The log is the authority105

GitLord

Every agent turn is a commit and every session is a branch, so history is inspectable, forkable and replayable — with the retrieval index built as a projection the code rebuilds from the log.

Best idea: An index you can regenerate from the record
Main risk: It stores what was said, never what is believed

Read analysis

A citation or an [unverified] tag106

agent-afk

A codebase fact written without a provenance citation is recalled with an [unverified] marker in the text the model reads — and superseding it without fresh evidence carries the old citation forward with a staleness warning.

Best idea: Shipping the verification verdict into the prompt, not dropping it
Main risk: The whole gate is behind an off-by-default flag

Read analysis

Approval on the read107

Cortex

A secret-classified hit needs a supervisor decision and then a human yes before it is returned — the only read gate in the atlas — beside a second, complete privacy policy that is exported and called by nothing.

Best idea: Asking a person whether the agent may be told this
Main risk: A 90-day retention default that nothing enforces

Read analysis

A decay curve per type108

Mnemopi

Fourteen memory types, each with its own Weibull shape and scale, recalled by four scored voices — and a provenance weight that trusts an unattributed memory more than one it knows came from a tool.

Best idea: A decay shape per type, not just a half-life
Main risk: unknown: 0.8 outranks tool: 0.5

Read analysis

A status for not knowing109

TokenMizer

When two decisions share a topic but the evidence will not say which replaced which, both are marked CONTESTED and stay visible — and a ground-truth suite asserts what fraction of a session's decisions the extractor actually recovers.

Best idea: Refusing to guess, and keeping both sides in view
Main risk: The redactor is tested; the rendered context block is not

Read analysis

One global file, one project slug110

ZeroStack

A Markdown memory in Rust whose global note deliberately follows the agent across projects while scratchpad, notes and daily logs are scoped by slug — with atomic writes and a one-version backup the search cannot see.

Best idea: Splitting scope by what should follow the user
Main risk: Two bad edits in a row lose the original

Read analysis

Verified forgetting, signed111

Lethe

Purge deletes from the row store, the vector index and the lexical index together — and the deletion is provable afterwards by an Ed25519 receipt anchored to a Merkle root over an append-only event log.

Best idea: A deletion a third party can verify without your database
Main risk: It hashes what it purged and never checks the hash on write

Read analysis

Deterministic continuity runtime112

CSM

Forty-six tables behind an OpenCode plugin, with no language model anywhere on the write path — and a table recording every candidate that nearly reached the context window, with the budget line that killed it.

Best idea: Per-item injection provenance: what was trimmed, omitted, and why
Main risk: Superseded and archived memories still answer searches

Read analysis

Work memory beside a code graph113

Graphify

An agent records how each answer turned out; a deterministic pass withholds the lesson until a second result corroborates it, and re-hashes the source file on every read to mark it stale.

Best idea: One save cannot mint a trusted lesson — corroboration is a gate
Main risk: The dead-end list is enforced by asking the model nicely

Read analysis

Multi-tenant lesson store114

LoreKit

Key-addressed lessons in Postgres behind row-level security, with an append-only audit log that records every mutation — and preserves none of the values it overwrote.

Best idea: An audit log made immutable by having no UPDATE or DELETE policy
Main risk: Five entrenchment guards, one of them enforced by code

Read analysis

Corroboration tiers in pure Perl115

CLIO

Every lesson is untrusted until two distinct agent-session pairs corroborate it — a tier that costs score, carries a badge into the prompt, and halves the age-out. The identity that made it unreachable is now wired, and a session restart counts as a second source.

Best idea: A trust tier enforced in scoring, in the prompt, and in decay
Main risk: A session restart is a distinct source, so one agent can self-corroborate

Read analysis

Keyword memory in a trigger116

AgentSwarms

A Postgres trigger derives the retrieval index from each memory's own content, and a GIN overlap ranks on it — no embedding anywhere on the path, in a platform that already runs pgvector elsewhere.

Best idea: The database derives the index, so no row can be unfindable
Main risk: Three lifecycle columns that nothing ever writes

Read analysis

Retrieval that reads the repo117

Empryo

Ranking signals taken from the codebase — file affinity, git co-change neighbours, dependency blast radius — fused with a deterministic embedder that needs no model and no network.

Best idea: Git co-change history as a memory relevance signal
Main risk: Re-saving a soft-deleted memory wakes it, and a test says so

Read analysis

CRUD, and no retrieval on purpose118

Dexto

A five-method memory contract that includes update and delete by id — the two most frameworks omit — and no search at all, because a person pins what should be in the prompt.

Best idea: Give a memory an id, and put delete in the interface
Main risk: No cap by default, so the whole store enters every prompt

Read analysis

A list of what the owner said no to119

Project Golem

Thirty-three lines that remember which proposals the owner rejected and tell the agent to avoid them — the shape this atlas keeps asking for, three entries deep.

Best idea: Record the rejection where the rejection already happens
Main risk: One accepted proposal clears every rejection before it

Read analysis

One document per workspace120

OpenYak

A single 200-line plain-text brief per project directory, rewritten whole by a model on a debounce keyed to the directory rather than the session, so two sessions cannot race — a subsystem the project has since deleted in a rewrite, read here at the commit where it exists.

Best idea: Debounce by the thing written, not by the writer
Main risk: Removed upstream; a ceiling with no floor while it lived

Read analysis

Memory sealed until a date121

Memento

An entry can be sealed at record time with a delivery date — outside transcription, indexing and the timeline until it arrives, then it enters the pipeline as if just recorded.

Best idea: Unreachable by state, not by a predicate every query must remember
Main risk: Deleting a recording nulls the provenance of facts derived from it

Read analysis

A suppression the write gate obeys122

Universal Memory Engine

Rejecting a candidate can write a suppression keyed on its canonical label, and four checks in the write gate refuse anything matching — the fourth working tombstone in this atlas.

Best idea: Reject and suppress are different verbs; only one binds the future
Main risk: The automatic path stamps event time with now

Read analysis

Ownership proved by signature123

Membase

Every hub write is signed, and the client refuses to file a memory under any owner but the address that signature recovers to — behind a retrieval filter that reads a distance as a similarity.

Best idea: The owner field is forced to the signer, with a warning when it had to be
Main risk: Raising the similarity threshold returns the least similar documents

Read analysis

The audit gates the delete124

Palazzo

A delete that cannot be written to the write-ahead log does not happen — the only audit in this atlas that is a precondition rather than a receipt. It also committed the benchmark showing it losing to its own prior art.

Best idea: An unwritable audit entry aborts the destruction
Main risk: The README's enum-validated schema does not exist

Read analysis

A chain you can verify125

Aura

The only hash-chained audit here — deletion shows as a sequence gap, insertion as a broken link, and sixteen tests prove it. The belief machine that would use it lives in a dictionary that empties on restart.

Best idea: An audit trail that fails verification if it is rewritten
Main risk: The trust states do not survive a restart

Read analysis

Enforcement by instruction126

MeMex Zero-RAG

The citation rule and the contradiction stop are sentences addressed to the model with no code path behind them; what has code is a page lifecycle of draft, active, stale and quarantine that the model can set and no search consults, and a confidence floor on an unranked substring scan.

Best idea: Sources immutable, wiki derived, git as the whole history
Main risk: A lifecycle status that nothing on the read path consults

Read analysis

A correction that loses its veto127

AgentRecall-X

A human correction can block the model outright — and a rule that keeps firing without being heeded is demoted out of its own veto by its measured precision. The only authority here that evidence can take away.

Best idea: Standing granted, exercised, measured, and withdrawn
Main risk: The agent judges whether it heeded the rule

Read analysis

Provenance that answers128

MemLedger

Every event names the hash of the policy that produced it, and a derived one must name its sources — enforced by a validator. Then the dedup lookup skips deleted records, so the fact you deleted comes back.

Best idea: The policy version is hashed into every event it influenced
Main risk: Nothing consults the history to refuse a write

Read analysis

A linter where the verbs should be129

TERSE Memory

Standing prohibitions live in a tier that is always loaded rather than retrieved, capped by a lint rule. The package is a linter and a scaffolder — and the three lint rules deferred to v0.2 are the epistemic ones.

Best idea: A "don't" tier that never depends on retrieval finding it
Main risk: Stale and duplicate checks are the ones deferred

Read analysis

A decision not to merge, kept130

Agentic Context Engine

When the consolidator decides two similar skills should stay separate, it stores the pair, the reasoning and the similarity — and the detector checks that before ever asking again. The only recorded "no" here that is consulted.

Best idea: A settled pair is never re-litigated
Main risk: The drift field is stored and never compared

Read analysis

The contract, not the store131

DeerFlow

Four memory backends behind one three-tier contract that replaced hasattr probing with defaulted hooks, and ships a no-op template to copy. Every backend must return the default one's shape, and unknown fields vanish silently.

Best idea: A tiered plugin contract with a compiled template
Main risk: One backend's schema became the interface

Read analysis

A fix that failed, ranked not removed132

EAN AgentOS

Hooks into four coding CLIs capture commits, commands and errors without a model deciding what mattered — and the table records whether each fix worked. Both recall paths sort on that flag instead of filtering it.

Best idea: Deterministic capture, and a record of what was tried
Main risk: The failed fix comes back one row lower

Read analysis

Deterministic first, model second133

M-flow

A query anchors on the finest node it can find and spreads over typed edges where every hop adds cost, so only coherent cheap paths compete. Three modules each put a zero-cost check in front of a model call.

Best idea: Every expensive step fronted by a cheap deterministic one
Main risk: A retrieval thesis with no retrieval number

Read analysis

Archive is routine, delete is deliberate134

memory-project

Forgetting has two speeds and two kinds of delete: a correction keeps the rejected claim’s embedding so the same wrong fact is caught coming back, and a secret purge rebuilds the store so it is genuinely gone.

Best idea: Two delete modes, opposite needs from the embedding
Main risk: A full rebuild on every purge

Read analysis

Scope suspended on purpose135

Hippo

Every memory gets a mass, a charge and a temperature — and the tenant boundary is enforced in the query, then deliberately dropped for consolidation behind a loopback gate.

Best idea: A digest-keyed tombstone the write path enforces
Main risk: The tombstone catches an exact repeat, not a paraphrase

Read analysis

Whose claim wins, in fifteen lines136

Echo Agent

Every memory records which write path created it, and a write is refused unless the actor outranks its target — so a model-inferred claim cannot overwrite one the user stated.

Best idea: Provenance as write authority, and as a suppression key
Main risk: Guards authority, not truth

Read analysis

Two tables, five collections, one graph137

7layermem

Seven memory types split across two SQLite tables, five Chroma collections and an optional Neo4j graph — a legible taxonomy over three storage engines, ranked by a constant per store rather than by what the search returned.

Best idea: Types separated by store
Main risk: Ranked by store, not by score

Read analysis

Arrives a candidate, not a fact138

CogniCore

A memory row starts in a candidate state and earns its way up, carrying a ledger of whether each retrieval was used or ignored.

Best idea: Unassessed is representable
Main risk: Scope filtered after the limit

Read analysis

Stores why it was wrong, and refuses it139

ALMA

An anti-pattern table holding the reason something was wrong and the better alternative — consulted before a write, on the one path the extractor, the miner and the consolidation pass do not use.

Best idea: Why bad, and what instead
Main risk: A guard on one door of six

Read analysis

One database per role140

PromptX

Engrams reached by the cue words indexed against them, in a spreading-activation network — with each role holding its own database file.

Best idea: Scope you cannot forget
Main risk: Strength is the only verdict

Read analysis

Symbolic memory, no model141

Nova AI

A hand-built concept graph with provenance on every edge, written only after the user answers "may I remember that?" — and a refusal keyed on the sentence itself, which the write path tests first and only a person can lift, out loud, on the record.

Best idea: Re-asserting a refused value asks the person
Main risk: Exact text only, so a paraphrase slips past

Read analysis

A tombstone only a human can set142

memsem

Its committed benchmark reproduces exactly — the corpus's cleanest checkable number. A rejected candidate writes a durable value-keyed suppression the write path obeys; automatic supersession writes none, so repetition wins on the path an extractor takes.

Best idea: The rejection check runs first, before anything is written
Main risk: Only a human can arm it

Read analysis

A standard, not a store143

Cambium

A governance standard for corpora maintained by LLM agents, whose checks report "nothing checked" rather than green — and whose automation may block a page but never promote one.

Best idea: A pass it refuses to fake
Main risk: Ships no corpus to govern

Read analysis

Claims audited against artifacts144

Perseus Vault

All seven marks, and a benchmark mean that recomputes exactly from three committed runs — beside a claims audit that retires what it cannot back and a tombstone that stores a digest rather than the value it refuses.

Best idea: A rejection that cannot leak
Main risk: Reach claimed in a comment

Read analysis

Governance as the product145

Provem

All seven marks, and a replay script that asserts every published number rather than printing it — over a governance layer that can sit on top of someone else's memory.

Best idea: Erasure that outlives the record
Main risk: Suppressed at read, not refused

Read analysis

Architecture as the memory146

ARGO

Its memory is an ArchiMate model of the system being built — canonical as JSON, wiped and rebuilt into Neo4j — with four times more test code than implementation.

Best idea: Retrieval that fails closed
Main risk: The graph is an index, not a memory

Read analysis

The capacity to refuse147

AMITY / Archangel-8

Refusal as a first-class outcome — metered by priority, hysteretic so it cannot flap, and returned with a reason. Underneath, an episode with no identifier.

Best idea: A refusal you can read
Main risk: Nothing stored can be named

Read analysis

Governed memory as a runtime148

MemoryOps AI

Tenancy enforced by the database rather than the query, and an audit chain that cannot fork — with the normalized key a tombstone needs already stored, and scoped to live rows only.

Best idea: Isolation below the caller
Main risk: A deletion one predicate short

Read analysis

Consolidation with no oracle149

DeepCode

Every conversational turn is event-sourced with typed provenance. Durable facts are markdown notes a scheduled LLM pass may delete, over a store with no history — and the only mechanical check is whether the file count changed.

Best idea: Typed provenance on every input
Main risk: A file count standing in for a check

Read analysis

A harness that edits itself, with an undo150

Prime Agent

The agent rewrites its own prompts, memories, skills and subagent specs from its trajectory — and every edit keeps a before-and-after snapshot, so a refinement made in one session can be rolled back from another.

Best idea: A background pass you can undo
Main risk: Undo without refusal

Read analysis

Provenance recorded twice, acted on once151

Mnemosyne

One SQLite file, one dependency, thirty tables. Two independent provenance fields — one that ranks an unknown origin above a known one, one that nothing reads — and a rejected fact that stays rejected because its primary key is a hash of itself.

Best idea: A tombstone that falls out of a hash primary key
Main risk: A trust field written on every path, read on none

Read analysis

Status decides what a memory may do152

Omi

A wearable that hears everything, over a hash-chained memory ledger — where an unreviewed fact may answer a question with a disclaimer, and only an accepted one may take an action that cannot be undone.

Best idea: Trust gates capability, not just recall
Main risk: Rejections keyed on rows, transcripts kept

Read analysis

Seven ways a write is refused153

Kiro Crew

A local workspace whose memory writes pass an ordered gate of seven typed refusals — and which scrubs credentials from a blocked injection's audit snippet, because the dashboard renders that snippet verbatim.

Best idea: Its own security log as an attack surface
Main risk: Refusals recorded, never consulted

Read analysis

fsck for a memory store154

mnemory

A self-hosted MCP memory server whose consistency checker screens stored memories for injection with a regex before any model reads them — and re-screens what already passed the filter at write time.

Best idea: Screen before the model, and screen again
Main risk: Correction is a penalty, and a verified state nothing filters on

Read analysis

Time doesn't validate, exposure doesn't validate155

Engram Alpha

Graph memory for coding assistants whose trust falls only when judged contradicting evidence lands — never from age, and never from being retrieved, because that would let a popular note certify itself.

Best idea: Retrieval moves nothing
Main risk: Deliveries graded, answers never

Read analysis

A source of truth that never hears a delete156

Helix AGI

A continuous single-agent runtime whose beliefs carry mass in an 8-D manifold and whose confidence is recomputed nightly from a written equation — beside an append-only journal that records every mutation except forgetting.

Best idea: Cutting the reachability-importance loop
Main risk: Deleted content still resolvable

Read analysis

Contradictions embeddings place far apart157

AIMAOS

A five-agent office whose duplicate detector matches phrasing skeletons with swapped value tokens — the case vector similarity is worst at, and the one where contradiction lives.

Best idea: A reversal is not corroboration
Main risk: The replaced value is stored, never read

Read analysis

The model never touches the state158

Aeris

A deterministic simulation engine whose only channel to a language model is a projection a validator rejects if it names an engine type — over a memory and belief store nothing in the engine ever writes to.

Best idea: Validating what the model may see
Main risk: The test suite is the only writer

Read analysis

One graph, three node kinds159

Mimir

A local-first Rust memory server where typed memories, doc chunks and code symbols are rows in one SQLite graph, ranked against each other in a single hybrid query; a deliberate deletion refuses its own return and its rewordings, a hash-only mutation ledger records who changed a memory and why, a review queue holds what the store will not decide, and recall answers as of a date on two separate time axes.

Best idea: A note and its symbol in one ranking
Main risk: Dedupe hash skips deleted rows

Read analysis

A memory policy with a fingerprint160

Cognis

An agent OS that owns no memory store and hashes the policy instead — backend, behaviour flags and instruction text in one fingerprint, stamped on the turn it governed.

Best idea: Which rules were in force, as a value
Main risk: Nothing epistemic crosses the seam

Read analysis

Memory about the agent, not the world161

Intaris

A guardrails service whose durable memory is a versioned risk profile of the agent itself, derived from its own audit history and read back before the next decision.

Best idea: A profile of the actor
Main risk: Mutable audit under a derived belief

Read analysis

Compiled truth over an append-only timeline162

brain.md

A markdown memory where every page holds current knowledge and its own provenance, one command rewrites the first while appending to the second, and a session hook injects the index — with tests asserting no page body can ride along.

Best idea: A rewrite that cannot skip its reason
Main risk: A funnel a text editor bypasses

Read analysis

A database whose primitives are cognitive163

MuninnDB

Decay, Hebbian learning and ACT-R activation implemented inside the storage engine — with a discrete trust label, valid time apart from record time, and per-engram provenance carrying the reason for every change.

Best idea: Provenance that records the reason
Main risk: A patent over the primitives

Read analysis

A tie against a published number164

iai-pme

A local-only personal memory whose contradiction is a new row and an edge, whose stale is a discount rather than a refusal, whose forgetting is a queue with an undo — and whose README describes a same-harness head-to-head that its own benchmarks page says was a comparison against a published figure.

Best idea: Both versions kept; validity derived from the corrector
Main risk: Two documents, one comparison, two stories

Read analysis

Conductance, not weight165

ostk-recall

A local recall service whose concept edges derive conductance from confidence and recency instead of storing it — and whose forget promises an anti-resurrection tombstone the write path never reads.

Best idea: A promoted edge must earn its conductance
Main risk: The forget warning asserts what the code lacks

Read analysis

Written only from losses166

SESA

A self-play RL trainer whose only durable memory is a bank of skill cards distilled from the solver's failures — and scored by whether the cards it handed over won or lost, with a negative score deleting the card.

Best idea: A hurt counter wired to deletion, not ranking
Main risk: Eviction leaves nothing, so the card comes back

Read analysis

Grounding as the write gate167

OpenSRE

An SRE agent that will not store an infrastructure fact unless the words in it also appear in something the user typed — and redacts credentials out of the transcript before the extractor ever sees it.

Best idea: Positive evidence of user authorship, not a stop list
Main risk: Forget leaves no record and extraction runs every turn

Read analysis

The eval that beat the design168

ClawMem

A local SQLite memory layer that measured its own composite ranking against the raw channel score, lost by a factor of three, and shipped the negative result as the default.

Best idea: Metadata demoted to a tie-breaker, on measurement
Main risk: Invalidation removes a document with no query-time notice

Read analysis

Draft until a person says yes169

Memory Palace

Derived memory that starts as a draft, needs a token to be approved, and is unrecommendable until it is — beside an audit table that nothing writes to.

Best idea: Draft-by-default enforced on the read path and at the schema
Main risk: The rejection is keyed on the row, not the content

Read analysis

What memory may authorize170

Midas

No LLM at ingest, verbatim recall, and a deterministic gate deciding what a memory is allowed to justify — scored against an adversarial suite with a benign-pass floor beside it.

Best idea: A prohibition vetoes a confirmation in the same evidence set
Main risk: The gate believes the provenance stamp

Read analysis

Trust-graded correction171

YesMem

Supersession resistance proportional to what a memory has earned — and the user confirmation the highest tier depends on is written to a column nothing reads.

Best idea: Correction costs more for memory that has been used
Main risk: The proposal queue has no consumer, so corrections vanish

Read analysis

Correction keyed on the fact172

memory-lancedb-pro

Fact-keyed supersession over LanceDB with a real validity axis and a loop that suppresses memory the agent kept ignoring — and a pending state that was written out of existence.

Best idea: A fact key, so an update replaces instead of piling up
Main risk: An LLM admission score is now the only gate

Read analysis

A dismissal that cannot be re-proposed173

Wenlan

A dismissed mind-map node keeps its fingerprint, and a unique index makes re-proposing it a no-op — a value-keyed tombstone on the suggestion layer, with the fact layer left unprotected.

Best idea: A database constraint, not a policy, enforces the refusal
Main risk: It covers placement, not the claim underneath

Read analysis

Refused if the code is gone174

Kage

A memory citing code that does not exist is refused at write time, and one whose cited symbols changed is withheld until re-verified — tested by deleting the files and checking it disappears.

Best idea: Staleness from per-symbol hashes, not a TTL
Main risk: The scope field is validated and never read

Read analysis

Trust and freshness, separately175

Icarus

Three thousand lines that keep provenance and staleness in different fields, make rolled-back terminal, taint everything derived from a bad entry, and test that none of it comes back.

Best idea: Two axes, a transition table, one terminal state
Main risk: The verifier is a free string defaulting to manual

Read analysis

Forgetting with reasons176

OMEGA

A genuine point-in-time filter over validity intervals and a forgetting log that keeps why every deletion happened — beside a review flag that is set and never cleared.

Best idea: Every delete leaves a row naming the reason
Main risk: A negative streak becomes permanent invisibility

Read analysis

The database refuses the row177

Octopoda

Tenant isolation enforced by Postgres row-level security instead of by remembering the WHERE clause, and a hash-chained audit that lives inside the memory table because the app role cannot create one.

Best idea: USING and WITH CHECK, under a role that cannot bypass
Main risk: A version history nothing can query

Read analysis

Uncertain merges need a person178

Vestige

Merge candidates classified by record linkage into match, possible and non-match — the uncertain classes need confirmation, and every applied operation carries its own undo payload.

Best idea: Two thresholds, with the middle routed to a human
Main risk: The headline benchmark is on another branch

Read analysis

A project that audited itself179

Shodh-Memory

A 153,000-line Rust memory server whose most valuable artifact is a committed self-audit finding a dead resolver, a header contradicting its own code, and a gate the upsert path voids.

Best idea: Publish the audit, with the evidence rules on top
Main risk: The findings are real and unfixed at this commit

Read analysis

Learning what to inject180

Token Savior

A contextual bandit decides which memory to inject, trained on a ledger that records whether the agent acted on it, ignored it — or never saw it at all.

Best idea: was_visible separates ignored from never-shown
Main risk: Learned weights persist with no feature versioning

Read analysis

Scoring the writer, not the source181

Recall

An actor's stated confidence is scored against whether their writes survived, and the Brier error attenuates every future claim they make.

Best idea: Calibration measured per writer, not assumed per origin
Main risk: requiresReview is rendered and never set

Read analysis

Facts split by whether they decompose182

CORE

Statements split across two stores by aspect — the six that decompose into triples go to the graph, the six that carry voice stay whole — and contradiction writes an end timestamp, never an overwrite.

Best idea: A preference is not a triple, and is not stored as one
Main risk: A re-extracted statement becomes current again

Read analysis

A project that withdrew its own results183

YantrikDB

Four published benchmark conclusions withdrawn because the condition labelled "structured memory" was a 120-line simulator — beside module headers that say what is not built, three of which have gone stale around the code.

Best idea: A 501 that names the replication path it lacks
Main risk: Crypto-shred destroys a key nothing encrypts with

Read analysis

The log is the memory184

Vibe Cognition

Every mutation is appended to a JSONL journal before the graph is touched, so the graph is a projection — and a deletion is a tombstone line carrying who did it.

Best idea: Journal first, then mutate; the graph rebuilds
Main risk: Removed nodes are never un-embedded

Read analysis

Bets that resolve, holders that score185

GBrain

Two memories over one Postgres: a hot-memory facts table written by a provenance-requiring verb or an opt-in Stop-hook extractor, deduplicated by cosine and a classifier, decayed by kind and valid between two dates at read time; and a takes table of claims typed fact, take, bet or hunch that a proposal queue feeds only when a person accepts, whose bets resolve into a per-holder Brier score, with BrainBench in the tree.

Best idea: A person between the extractor and the knowledge table, and validity read at query time
Main risk: Two validity models: facts read their window, takes store one and never read its end

Read analysis

An audit that outlives its database186

SuperLocalMemory

A hash-chained audit log on its own database connection, so the record survives corruption of the store it audits — and an EU AI Act module that refuses to certify compliance.

Best idea: Decouple the audit from what it audits
Main risk: Access control defaults to allow-all

Read analysis

Validity you can declare187

NornicDB

A database whose Cypher surface can ask what it recorded, at one commit version, as valid at another instant — with validity declarable as a schema constraint and a Kalman filter over confidence.

Best idea: One query fixes both the validity and the record clock
Main risk: Vector search reaches neither clock

Read analysis

A word for "was never true"188

Empirica

1,268 resolved findings, exactly one recorded as an error — so the project added a word for "was never true" and wrote the argument down: what the surface does not name, the practitioner does not reach for.

Best idea: A vocabulary measured from its own store
Main risk: The tag that catches gaming is v0, routing deferred

Read analysis

Correction that goes backwards189

Hexis

When a worldview belief transforms, a sweep re-examines every memory the old belief caused to be rejected — the only system here that asks what a superseded belief was suppressing.

Best idea: An edge recording why something was rejected
Main risk: The sweep's verdict is an unvalidated model call

Read analysis

A refusal that survives key rotation190

Noosphere

A revoked capture is refused on the write path by an HMAC digest checked against every retained key version — the only rejected-value record here that reasons about the key used to compute its own key.

Best idea: Keep the old keys, or every revocation lapses
Main risk: The tombstone expires after ninety-one-one days

Read analysis

Fade unless used191

CortexGraph

Memories fade on an Ebbinghaus curve unless use reinforces them — and a committed spec argues the append-only log should go because "the data structure is fighting the biological model".

Best idea: Forgetting is the default, keeping is the exception
Main risk: LICENSE says AGPL, CITATION.cff says MIT

Read analysis

Every decision kept, accepted or not192

virtual-context

A self-reorganising tag vocabulary over a fact store whose every accept and reject is written to a decision ledger a database trigger refuses to let anyone edit.

Best idea: Append-only enforced by the schema, not the code
Main risk: The rejects are kept and never read

Read analysis

Forgetting that leaves a pointer193

MemoryBear

Low-activation memories merge into a summary node that keeps DERIVED_FROM edges to what it replaced — and each forgetting cycle records how many fusions failed.

Best idea: Fuse with provenance instead of deleting
Main risk: Every benchmark number is an image

Read analysis

Nothing mutable left194

Jumbo Context

One JSON file per event, atomically written, with thirteen aggregate streams and a rebuild the tests actually compare — and a review workflow whose reviewer is a daemon that spawns an agent.

Best idea: A versioned fixture porting the harness's own parser
Main risk: Agents cast the approvals and loggedBy is never set

Read analysis

Read mid-refactor195

NeuroCA

Three tiers, a lymphatic consolidator and neural tubules — with every integration test of the memory system skipped at module level because they "use the old memory architecture".

Best idea: forgotten as an explicit pre-deletion state
Main risk: Zero durable-backend coverage at this commit

Read analysis

Claims graded by evidence196

Project Athena

A README that grades its own claims from shipped to partially unfalsifiable, names personalization as the largest sycophancy amplifier, and cites the paper saying its own mechanism raises agreement by 45%.

Best idea: Publish what is proven and what is proposed
Main risk: Its anti-mythologizing convention is barely applied

Read analysis

Tests for an API that is not here197

mem9

A committed end-to-end suite specifies tombstone revival by dominating vector clock — against endpoints, a tombstone field and a clock that appear in no Go file in the repository.

Best idea: Asking what "deleted" means under concurrency
Main risk: The suite documents code that is not published

Read analysis

Check the plan before you run it198

AURORA

A query decomposition is checked against an adversarial prompt template before retrieval runs — and the README documents a retrieval-quality gate whose parameters the function does not take.

Best idea: Verify is phase four, before anything expensive
Main risk: The documented example would raise

Read analysis

A budget on how often memory may speak199

AIPass

Surfacing is governed by a pure function with a per-session cap, a minimum message gap and a cooldown — so a relevant memory can still be refused because it spoke too recently.

Best idea: Rate-limit recall, and return the reason
Main risk: An LLM dedup verdict that may delete

Read analysis

Search for what would refute the answer200

total-agent-memory

A second retrieval against an inverted query, scored for contradiction, so a strong conflict makes the question unanswerable instead of picking a side.

Best idea: Retrieve the refutation and let it win
Main risk: A headline delta between unlike metrics

Read analysis

A gate that tests whether the gate discriminates201

OmniMemory

A default-deny AST check with positive and negative controls over its own checker — added after a verifier demonstrated the laundering hole live — sitting above a lifecycle runtime that is a logged no-op.

Best idea: Prove the gate fails when violated
Main risk: A fail-fast turned into a silent success

Read analysis

SIGKILL the writer, then count the frames202

Wax

A harness that forks a child, kills it at a named point in the commit sequence, reopens the file and asserts the exact frame count — and fails if the child did not crash.

Best idea: Prove the commit protocol survives a kill
Main risk: An alias that flips the approval default

Read analysis

A leaderboard that puts someone else first203

TrueMemory

Three-run means with the individual runs published, a rival ranked above itself, the rubric's leniency disclosed, and the worst category printed at 19.5%.

Best idea: Publish the caveat that costs you the win
Main risk: Corrections found by regex, rebuilt each pass

Read analysis

You may not write until you prove you asked204

Daem0nMCP

Mutating tools are blocked by middleware until the agent holds a signed, expiring token proving it called context_check — consultation as a precondition, not a convention.

Best idea: A receipt proving memory was consulted
Main risk: The signing key ships as a default

Read analysis

A third verdict with nowhere to live205

PLTM

A four-judge jury returns approve, reject or quarantine on every write — and quarantine is stored by halving a float and appending a marker into a free-text field.

Best idea: Contradictions look like agreement to cosine
Main risk: A unit-test pass rate reported as accuracy

Read analysis

The collision policy is chosen by memory type206

Memoir

Working memory overwrites, episodic accumulates, semantic is confidence-gated and procedural is LLM-merged — the taxonomy path decides which, in a pure module with no store, no I/O and no model call.

Best idea: One collision policy per memory type
Main risk: A complete harness with no results run

Read analysis

Four defects found by running someone else's engine207

MemoMind

A downstream integrator's patch file against Hindsight — including a consolidator that copies single facts into observations, and a dedup threshold the model paraphrases past.

Best idea: Write down what broke, with the reason
Main risk: The installer turns off database auth

Read analysis

You may not record a lesson without two arguments against it208

GitMem

Scars are refused at write time unless the author supplies at least two counter-arguments, and a PreToolUse hook hard-blocks consequential actions until every surfaced scar is applied, ruled inapplicable, or refuted with a risk acknowledgment.

Best idea: A memory that carries its own rebuttal
Main risk: A suppression counter that cannot reach 3

Read analysis

Erase the content, keep the proof it existed209

Engram Provable

Crypto-shredding resolves right-to-erasure against an append-only audit chain — content becomes ciphertext under a discarded key, and the tamper-evident record of the erasure survives.

Best idea: Erasure that an append-only log survives
Main risk: The headline benchmark is off-repository

Read analysis

Retracting a fact should shake its whole story210

AgentWorkingMemory

A retraction propagates a contamination penalty weighted by how tightly the neighbourhood coheres — dense narrative clusters get 1.5×, isolated engrams 0.5× — because misinformation persists as a coherent story.

Best idea: Correct the narrative, not just the fact
Main risk: Asserted multipliers on a cascading penalty

Read analysis

How fast a fact goes stale depends on what kind of fact it is211

Second Brain

A durable/state/volatile classifier that abstains when unsure sets each memory's recency floor, so age becomes a tie-breaker instead of a gate.

Best idea: Decay by claim type, with a floor
Main risk: System verdicts in a writable tag array

Read analysis

The unflattering number is committed; the badge is not about it212

Context Mem

A gold 100% LongMemEval badge that means recall@5 with a judge blend, over a committed end-to-end QA result of 46.6% in the same repository.

Best idea: Forget by losing resolution, not by deleting
Main risk: A badge naming a metric it does not report

Read analysis

The session summary is a form, not a paragraph213

MoltBrain

Summaries are parsed into fixed fields — request, investigated, learned, completed, next steps — and observations are extracted from XML blocks the model emits, with no confidence, status or correction anywhere.

Best idea: A session summary with columns, not prose
Main risk: Nothing in the store can be wrong

Read analysis

The gap is not the issue. The metric is.214

Fidelis Memory

A benchmark writeup that refuses a favourable comparison, publishes the ablation where its own change hurt, and names an 8× cost miss in its flagship mode as a known limitation.

Best idea: Decline the comparison that flatters you
Main risk: Nothing can correct a stored passage

Read analysis

A charter its own published numbers do not yet meet215

TeleMem

Nine binding rules for any number the project publishes — including a grep baseline, adversarial judge validation, and an instruction to check whether you need a memory system at all.

Best idea: Publish the rules your numbers must meet
Main risk: The methodology ships; the runs do not

Read analysis

Regression tests for memory216

Mengram

Revising one learned procedure is checked against every other procedure that shares its surface, and a revision that would break a dependent is quarantined instead of promoted.

Best idea: Ask what depended on the memory you fixed
Main risk: A quarantine nobody can read

Read analysis

A path traversal it found in itself, with the payload printed217

OpenCode Memory

A committed security audit grading five findings in its own code, each with the exploit path, the fix, and the regression test that pins it — including the one it did not fix.

Best idea: Audit yourself and publish the payload
Main risk: The audit is pinned to an older commit

Read analysis

Truth as of a time218

LongMemory

Formerly OpenMemory, rewritten: strict recall is one query asking what was true at a moment — excluding superseded facts and anything under an unresolved contradiction — and not one committed test checks it.

Best idea: A contradicted fact is withheld from reasoning until resolved
Main risk: No test file anywhere, and the invariants are strings

Read analysis

Two benchmark tables that do not reconcile219

Ori Mnemos

A LinUCB bandit that learns which retrieval stages to skip per query type, under README and bench tables whose numbers disagree with no committed run to adjudicate.

Best idea: A pipeline that learns to skip itself
Main risk: Results gitignored, tables disagreeing

Read analysis

Decay decides what to prune, never what to rank220

YourMemory

An audit chain that logs memory ids and never their content, over a decay model deliberately kept out of the ranking formula because it would bury old-but-valid memories.

Best idea: An audit log that is not a copy of the data
Main risk: Contradiction detected, then overwritten

Read analysis

"You were wrong" and "the world changed" are different verdicts221

cortex-engine

A contradiction is adjudicated into five outcomes before it becomes a signal, and only the genuine one penalises confidence — a supersession is routed to bitemporal succession instead.

Best idea: Refutation and supersession, judged apart
Main risk: A dozen named mechanisms, none evaluated

Read analysis

A silent loss is worse than the bloat222

obsidian-mind

A byte budget on session-start injection that degrades the cheapest-to-lose sections to pointers and then names every one it dropped, ranked by value density rather than size.

Best idea: Name what the budget dropped
Main risk: No story for a note that went stale

Read analysis

Most of your session history is your tooling talking to itself223

vir

Three independent detectors decide which transcripts on your disk were sessions you actually drove — of 246 on the author's machine, about 20 were.

Best idea: Check whose logs those actually are
Main risk: Distillation outlives the source, unmeasured

Read analysis

A whitelisted shell for the memory repo224

DiffMem

The retrieval agent explores memory with grep, git log and git blame behind a thirteen-command allowlist that validates every segment of a chain — and then hands the string to a shell.

Best idea: Let git be the log you already have
Main risk: Validated by shlex, executed by a shell

Read analysis

A distilled skill is inert until a person installs it225

MemSearch

Procedural memory distilled from repeated workflows into candidates that never reach the agent's skill directory on their own — from a vector-database vendor whose vector database is the derived layer.

Best idea: Distilled, but inert until installed
Main risk: The ungated pass rewrites the durable notes

Read analysis

Strip the query from the document before you test retrieval226

mnemos

A held-out evaluation that removes each query's text from its own host chunk before indexing, so lexical search cannot win by finding the question inside the answer.

Best idea: An eval that cannot cheat by leakage
Main risk: A rejected ADR cites like a current one

Read analysis

The model retypes your text and the match fails227

Nocturne Memory

A fuzzy patch matcher that normalises curly quotes and dash variants to find an edit target, then uses a position map so the replacement lands in the original bytes.

Best idea: Match normalised, replace in the original
Main risk: In-place patching with no record

Read analysis

A run that only adds is a failure mode228

Claudest (claude-memory)

A consolidation protocol that must produce removals, settles retirements before clustering so nothing masks a removable entry, and verifies each deletion actually happened.

Best idea: Judge consolidation by what it removed
Main risk: The protocol is prose, enforced by nothing

Read analysis

The run log names a different dataset from the claim229

agentmemory V4

A world-record LongMemEval claim with the result file, the run log and a self-audit all committed — and all three name the oracle variant while the README says LongMemEval_S with no oracle access.

Best idea: Commit the log that lets you be checked
Main risk: The compared numbers are a different variant

Read analysis

Store only what you failed to predict230

memv

Importance emerges from prediction error — the model is asked what an episode should contain, and only the gap between that guess and the actual transcript is extracted.

Best idea: Surprise as the storage criterion
Main risk: The criterion itself is unmeasured

Read analysis

The baseline column is a constant with a comment231

MemCP

A published head-to-head report whose "Native" column is native_value=5.0 # Typical ~5% retention typed into the test, against a measured RLM column.

Best idea: Being misled costs more than helping earns
Main risk: A comparison column nobody measured

Read analysis

A canary secret in each of ten tenants232

ArcRift

An isolation test that plants a named secret in every project, spawns a live server, and asks each tenant for another's key under concurrent load — with the report committed.

Best idea: Ask the wrong tenant for the secret by name
Main risk: Seven capture platforms, three monitored

Read analysis

Salience by example, with an API key among the examples233

Memlayer

A storage gate that scores text against hand-written prototype sentences instead of asking a model — and one of the prototypes for what to remember is an API key.

Best idea: A decision boundary you can read and edit
Main risk: Credentials scored toward being stored

Read analysis

A hypothesis is not a fact, and gets its own table234

Stash

Proposed, testing, confirmed or rejected — with a verification plan, the fact that confirmed it, and the reason it was rejected, all in a table facts cannot be read from.

Best idea: Inferences live somewhere recall cannot reach
Main risk: One reasoner judges three things, unevaluated

Read analysis

The excerpt has to appear in the source235

knowledge-worker

A high-confidence claim must carry a supporting excerpt, and the excerpt is substring-matched against the source — a fabricated quote demotes the claim and the demotion is recorded with its reason.

Best idea: Check the quote against the source
Main risk: Catches invention, not misquotation

Read analysis

A schema that deleted its own dead fields, with receipts236

memory-ts

Seven metadata fields removed in one version, each with the evidence — "580 variants, never used", "always empty", "no logic implemented" — recorded in the schema's own history.

Best idea: Delete the fields nothing reads, and say why
Main risk: The curator is the product and is untested

Read analysis

An agent can leave a note for another agent237

MarsNMe

session_close(to, note) writes an addressed message that session_boot delivers and marks read — an indexed mailbox inside the memory store, with provenance enforced by a database CHECK.

Best idea: An addressed note, delivered once
Main risk: The constraint holds in one schema, not both

Read analysis

Correction that never reaches the retrieval lane238

breadcrumbs

A copy-and-adapt agent-ops kit whose sharpest artifact asks not whether a ledger entry is still true but whether it can ever be seen, with committed cases asserting that a superseded entry must never win the injection lane.

Best idea: Test that the correction reached the prompt, not just the row
Main risk: The fleet architecture its docs describe is not in the tree

Read analysis

Memory in CI, on an integrity lattice239

gh-aw

Three cross-run memory backends for a GitHub Actions workflow — a cache, a git branch, an issue comment — each restored through a gate that assumes the previous run of itself was compromised.

Best idea: Low-trust runs read high-trust memory, never the reverse
Main risk: The trust label describes the writer, not the claim

Read analysis

Session knowledge across seventeen harnesses240

Context Mode

A tool-output sandbox whose real durable artifact is a per-project SQLite event log, replayed into the next session as a session_knowledge block — with a committed test that another session's events must not appear in it.

Best idea: The cross-project parameter is absent from the tool schema
Main risk: No correction, and the only delete destroys the store

Read analysis

Procedural memory, and nothing else241

Ollama

A local inference runtime that grew an agent mode whose only durable memory is a skill catalog on disk — advertised by name in the prefix, loaded on demand, and gated by approval when the model asks for it.

Best idea: Approval on recall, because instructions steer the run
Main risk: Nothing the agent learns survives the run

Read analysis

Memory as a link graph, with an integrity checker242

Serena

Markdown memories that cite each other by name, a checker that reports every link pointing at nothing, and a rename that rewrites every reference to the file it moved.

Best idea: Referential integrity over the memory store
Main risk: Links are checked outward, never inward

Read analysis

A recipe that links notes on the way in243

claude-code-memory-setup

A guide and a 387-line importer that file exported Claude Code transcripts into a tagged Obsidian vault, inserting wikilinks to existing notes as they write.

Best idea: A new note joins the graph without anyone curating it
Main risk: The rewrite is silent, and the guard is a length check

Read analysis

A full memory system inside a router244

vLLM Semantic Router

An Envoy-layer router with 10,777 lines of memory beneath it: typed memories, four backends, a no-LLM injection gate, and a committed test documenting that it cannot detect a contradiction yet.

Best idea: A characterisation test for the mechanism it hasn't built
Main risk: Contradicting facts both stored, both retrievable

Read analysis

A guard on the retrieval path, off by default245

ruflo

A swarm meta-harness whose memory package screens retrieved chunks for prompt injection before they reach an agent's context, cites the paper for why, and ships that defence disabled.

Best idea: Guard the retrieval path, and never truncate a chunk
Main risk: The only content defence is off by default

Read analysis

Cross-session continuity, fenced as data246

token-optimizer

A waste-detection plugin whose real memory is a checkpoint written at context-fill bands and recovered into a later session on topic match — injected behind a trust=data sentinel, with another project's decisions dropped and the dropping disclosed.

Best idea: The fence is tested against forged copies of itself
Main risk: Nothing is corrected, and nothing prunes the store

Read analysis

The state machine is a regex over the card's own prose247

klypix-mcp

One ZIP canvas committed beside the code, holding a project's decisions for nine coding agents at once — where a card is current or superseded according to a marker in its own text and the title of the container it sits in.

Best idea: The benchmark runs a negative control and can call itself inconclusive
Main risk: Rename one container and every retired decision reads as current

Read analysis

A decision ledger that validates before it appends248

agent-mesh

A hash-chained append-only event log whose decision records carry tiers and executable verification commands, validated at append so a malformed event never lands and run through argv rather than a shell — with a reviewer quorum that withholds promotion until enough named reviewers accept the current revision, while the grounding packet an agent receives still never reads the decision store at all.

Best idea: An acceptance below quorum is logged and promotes nothing
Main risk: No decision reaches the agent automatically

Read analysis

A conversation handle in a request header249

SmythOS SRE

An agent runtime whose access check is a decorator nobody can forget — guarding a conversation transcript that is written team-scoped and fetched across processes by an id the client supplies in an HTTP header.

Best idea: Scope enforced by a decorator, not by a query clause
Main risk: The default account connector puts everyone in one team

Read analysis

Memory of what was seen250

Qwen MM Plugins

A four-level graph built once over hours of footage and searched by dense-plus-BM25 fusion — with no way to correct a wrong extraction, and a skill that tells the agent to go back and watch the video.

Best idea: The tool description teaches the retriever's failure mode
Main risk: Nothing can be deleted, updated or superseded

Read analysis

A refusal keyed on the content hash251

remem-mcp

A local-first MCP memory server whose capture path hashes the redacted content, looks it up among rejected rows, and refuses the write with the stored reason — behind a session key applied to the BM25 and vector arms alike.

Best idea: A refusal keyed on the content hash, consulted before every capture
Main risk: The model can set override_rejection on itself

Read analysis

Branches are kept, versions are not252

Windie Sandbox

A conversation stored as one shared message tree, where forking preserves every branch for the cost of one row — and editing overwrites the message in place, rewriting the history of every branch below it.

Best idea: A fork costs one insert at any history depth
Main risk: An edit is a one-way door with no prior version kept

Read analysis

Which copy of the record gets scored253

PLUR1BUS

An OpenClaw memory plugin with fifty config groups over one unusually careful correction path — where a change needs evidence, a new embedding and an event log entry, now with a real-world validity window and a content-fingerprint tombstone that blocks re-capturing a forgotten value.

Best idea: Corrections demand evidence and are written before the old row is retired
Main risk: Contradiction is a ranking penalty, not a filter, so a flagged conflict still reaches the prompt

Read analysis

The gate refuses what the query selects254

OmniIntelligence

Patterns learned from coding sessions, moved by an evidence ladder that only ever increases — enforced in the WHERE clause — with demotion deliberately harder than promotion and a 20-point band between them. Four of its best mechanisms are not wired to anything.

Best idea: Demotion needs more evidence than promotion, and the band is bounded against override
Main risk: The cold-start path selects exactly what the reducer refuses

Read analysis

Memory under a standing trial255

OmniClaude

The injection half of a closed loop, and the only system here that holds out a control cohort: one session in five receives no memory at all, and still writes a record saying so. At this commit every injection hook is disabled on purpose, to measure the baseline.

Best idea: A control arm that leaves a record carrying the experiment's own parameters
Main risk: Cohort identity is the session, so both arms share a store the treated arm teaches

Read analysis

A gate that is control flow256

Hillock

A small local prototype where the model is never asked a question the symbolic layer could not answer — the refusal is a return statement, not a prompt. It publishes every version's scores including the ones that fell, and raised its gate until the benchmark's own questions stopped clearing it.

Best idea: The un-evidenced question never reaches the model
Main risk: The threshold was raised past the benchmark

Read analysis

A tombstone that blocks the close257

Memory Compiler

Four Markdown files and an 848-line validator that refuses to seal a session while a rejected value has been reasserted verbatim — and whose collision scan ignores anything under twelve characters, which is both tombstones in its own worked example.

Best idea: A rejected value reasserted in canonical memory blocks the session close
Main risk: The noise floor excludes dates, prices and colours — most of what gets corrected

Read analysis

Deletion residue as a partition258

Agent Memory (MythologIQ)

A governed-memory reference architecture whose deletion metric is a four-way residue partition with one cell that must stay empty — verified by a sweep that re-derives what survived instead of asking the purge whether it finished.

Best idea: Residue is allowed; residue you did not declare is a failed deletion
Main risk: Every property is demonstrated against an in-memory substrate

Read analysis

Forgetting by scheduled reversion259

ODS

A deployment system for a local AI stack whose one memory component resets an agent's MEMORY.md to an operator-authored baseline every few hours — archiving the scratch notes below a --- the agent itself can accidentally move.

Best idea: The authority boundary is a position in a file, enforced by overwriting
Main risk: The boundary is the last separator, and on the shipped baselines only the agent ever draws one

Read analysis

No citation, no memory260

NeuraKeep

A local-first MCP memory layer whose write gate blocks any event, fact or failure arriving without a source and a section citation, and where nothing becomes durable without a person applying a proposal — but whose agent-facing search reads every space when the model omits one.

Best idea: A memory that cannot cite its source is never created
Main risk: An optional space argument on the tool the model drives

Read analysis

Programmatic memory261

PRO-LONG

An ARC-AGI-3 harness whose entire memory is one append-only text log the coding agent greps, shipped with the flags that remove it and the committed runs that price what it buys.

Best idea: The ablation is a flag, and the arm is committed
Main risk: Sync offset read from a file the agent may write

Read analysis

Recorder as actuator262

arc-code

An ARC-AGI-3 harness whose log cannot be bypassed, because the process that writes it is the only one holding the key — plus 191 sessions analysed for how a file-based agent memory fails.

Best idea: The thing that causes the effect writes the record
Main risk: Change detected by file size, not by digest

Read analysis

Decision ledger263

OmniNode Knowledge Base

A typed decision ledger with a status enum per artifact kind and five CI-gated checks — none of which covers the rule the project leads with, that an accepted claim carries an evidence artifact.

Best idea: A status vocabulary per artifact type, schema-generated
Main risk: The stated invariants are the unchecked ones

Read analysis

Status that governs264

MindCache

A four-type memory in a self-reorganizing topic tree whose decision status is filtered where retrieval candidates are assembled — under two benchmark badges no committed artifact scores.

Best idea: Filter the status where candidates are gathered
Main risk: A "Passed" badge with no scored artifact

Read analysis

Shared across agents265

OpenAkashic

A single public memory every agent can read and write, where a superseded note is dropped before indexing on one read path and merely demoted on the other — by a penalty its own confirmations pay back.

Best idea: Search that returns its own epistemic next step
Main risk: A fixed demotion against cumulative evidence

Read analysis

Local terminal agent266

Otis

A local coding agent whose durable memory is a resumable session log and skills cloned from a git URL with no revision — in a repository that aborts its own update on a checksum mismatch.

Best idea: Compaction keeps the messages it replaced
Main risk: Procedural memory pinned to a URL, not a commit

Read analysis

Ledger of intent267

Ouroboros

A spec-first agent OS that stores no facts about the world — only what it believes the user asked for, on whose authority, and what displaced the answer before it.

Best idea: An adopted fact cannot become a requirement
Main risk: The belief expires with the build

Read analysis

Portable memory format268

memoir-cli

A published format spec whose merge semantics get deletion right, over a federation of other tools' memory directories — where the tombstone it argues hardest for has no shipped writer.

Best idea: Monotonic tombstones, date-independent by design
Main risk: No user surface can create one

Read analysis

The search it ships turned off269

DeepSeek Harness

An agent harness whose durable memory is an append-only session log where nothing is overwritten — and whose cross-session full-text search and five model-facing history tools are both real, both carefully authorized, and both absent from every shipped composition.

Best idea: Compaction shadows, and the shadow stays searchable
Main risk: The searchable history is off by default, twice

Read analysis

Scope is the directory name270

Mobius

A source-available team platform driving Claude Code and Codex in tmux, whose memory is markdown files partitioned by a user= and project= path segment — where the write path was containment-checked and the read path was not.

Best idea: One file format for skills and memories
Main risk: A scope key that is also a filesystem path

Read analysis

Corrections into preferences271

Open Second Brain

An Obsidian-vault memory whose nightly pass promotes repeated corrections into preferences on a Wilson lower bound, demotes them through a probation state, and lets a user's rejection suppress the signals that would regrow the rule.

Best idea: Confidence is a lower bound, not an average
Main risk: The counters are self-reported

Read analysis

Fifty runs of a closed graph272

Zep

The client half of a hosted temporal knowledge graph, whose fifty committed LoCoMo runs grade retrieval sufficiency separately from answer correctness and show accuracy-given-a-complete-context flat at 92 percent across a 5.8x swing in retrieved tokens.

Best idea: Grade the retrieval, not just the answer
Main risk: The mechanism is behind an API

Read analysis

The forgetting curve, inverted273

MemoryBank

The reference implementation of the Ebbinghaus forgetting curve in agent memory, whose retention formula is missing a pair of parentheses — so recalling a memory makes it exponentially more likely to be deleted, stochastically, in place, for every user, at startup.

Best idea: Recall-strengthened decay as a primitive
Main risk: The curve points the wrong way

Read analysis

Memory as a plan after failure274

Reflexion

Verbal reinforcement learning whose entire memory is a per-environment list of plans written only after failures, persisted as JSON and reloaded on resume — read three at a time, so the store grows forever while the readable window never does.

Best idea: Split the actor from the reflector
Main risk: Old plans sink but never leave

Read analysis

A conformance suite for the other half275

LangGraph

A namespaced key-value memory store with TTL and semantic search behind three backends, shipped beside a portable conformance suite that validates the thread-scoped checkpointer and not the store — which is where the three backends disagree.

Best idea: The scope is half the primary key
Main risk: The untested half is the durable one

Read analysis

The memory it deprecated276

LangChain

The framework that named the memory vocabulary everyone still uses has removed all of it: version 1 owns no store, and the ten classic memory classes survive in a legacy package under a removal notice.

Best idea: The window/memory split, as a package boundary
Main risk: An empty summary deletes the entity

Read analysis

Thirty reference implementations277

Agent Memory Techniques

A teaching corpus of thirty runnable notebooks whose forgetting curve is the one the paper it cites got backwards, whose right-to-forget delete fans out across four stores and writes a receipt, and whose contradiction rate divides by every pair it never compared.

Best idea: Decay by half-life, and archive what you prune
Main risk: A rate whose denominator was never measured

Read analysis

A dream that deletes what it read278

Grok Build

A Rust coding agent whose markdown memory is consolidated by a dream pass that overwrites the project memory file with a character-truncated model response and then deletes the session logs it read — beside the most careful read path here, which stamps every recalled memory with its own age.

Best idea: Injected memory carries its own age
Main risk: Consolidation overwrites, then destroys its sources

Read analysis

Postmortems in the comment above the fix279

RunarForge

A four-layer memory for coding agents whose graduation sweep reads the newest five hundred entries and therefore cannot see the old ones it exists to archive — in a codebase that documents its own past failures, with counts, in the comment above each fix.

Best idea: One redaction chokepoint, ordered before truncation
Main risk: Graduation pages by recency over an aging ladder

Read analysis

The finding is the memory unit280

REDCELL

A pentest agent whose durable memory is a table of findings, loot and hosts that a human triages — verify, dismiss, merge — and that the agent reads back wholesale on reopen, where a dismissed false positive is the clearest example of a corrected memory in the atlas.

Best idea: A memory unit that is a claim a human can reject
Main risk: Recall is a paste capped at forty by recency

Read analysis

A schema the agent's prompt cannot override281

Neuron

Markdown-as-memory for coding agents whose CLI refuses a write that violates a per-category schema no matter what the agent's prompt says, with a SQLite index rebuilt from the files and a recall hook the harness runs instead of the model.

Best idea: Schema enforced on the write path, below the prompt
Main risk: Markdown truth a parser edge case can corrupt

Read analysis

When the embedding model changes, rebuild282

WindieOS

A desktop-agent runtime whose local two-tier episodic/semantic memory stamps every FAISS index with the embedding space that built it — and, when the SDK's embedding model or dimension changes, clears the vectors and re-embeds from SQLite rather than comparing across incompatible spaces.

Best idea: Refuse to compare vectors across embedding spaces
Main risk: No episodic-to-semantic delete cascade

Read analysis

A quarantine that checks the base rate before it blames283

Sonder Runtime

A self-modifying agent runtime whose distilled lessons are scored by the outcomes that followed them and quarantined when a loss run is statistically improbable for the lesson's own retrieval-frequency band — with blame deduplicated across co-retrieved lessons and a probation path back.

Best idea: Outcome-gated quarantine with a base-rate test
Main risk: Only as good as its outcome signal

Read analysis

Surface the memory when its basis drifts284

GMR

A grounding runtime that binds a memory to the observable facts it depends on, re-observes them with a versioned probe, and surfaces the bound memories when the fact's content hash crosses a declared transition — journalling a probe failure apart so an outage never masquerades as a change.

Best idea: Re-check the fact a memory depends on, not its age
Main risk: Grounds and surfaces; never decides correctness

Read analysis

A daemon mines the thinking blocks285

Continuous Claude

A Claude Code layer whose background daemon spawns a headless model to distill typed learnings from a finished session's thinking blocks — the reasoning, not the actions — embeds them into a pgvector store, and recalls them into later sessions by hybrid RRF. A real cross-session loop wrapped in more design than the code delivers.

Best idea: Learn from the thinking blocks, not the transcript
Main risk: Global unscoped recall; the design overshoots the code

Read analysis

A trust model written and never read286

MCP-Memory

An MCP server storing memory as Open Knowledge Format markdown indexed in SQLite FTS5. It serializes OKF's verified, status and stale_after trust-and-lifecycle fields faithfully — and no read path consults any of them.

Best idea: Human-readable OKF records, namespace-scoped on read
Main risk: The trust and lifecycle fields are inert

Read analysis

Refuses to load if the chain was tampered287

MentisDB

A Rust memory daemon whose thoughts are an append-only, SHA-256 hash-chained log verified on open — a tampered chain refuses to load. Corrected only by appending a supersession, recalled by BM25, vector and PageRank together, beside a git-like, Ed25519-signed skill registry.

Best idea: Verify the chain on open; refuse a tampered history
Main risk: Tamper-evidence is detection, not prevention

Read analysis

Rules read at the moment they bind288

Monet

A local-first SQLite concept-graph for coding agents: principles always in front of the model, rules bound to named stages read when a matching tool call fires, corrections governed by a human declare/ratify/resolve loop. Marketed as a clean trio, built as a graph with a gate.

Best idea: Declare vs propose: humans gate the constraining memories
Main risk: Stage-binding is lexical and agent-pulled, not enforced

Read analysis

One local memory, injected into every agent289

Memmy

A local-first SQLite memory hub from the MemOS team that distills a layered L1→L2→L3→Skill store from every connected agent's turns, shares it across Claude Code, Codex, Cursor and others through one daemon plus an injected per-agent CLI skill, and induces anti-pattern "avoid" policies from failures.

Best idea: One shared brain via an injected per-agent CLI skill
Main risk: The shared recall has no scope, by design

Read analysis

No vector DB — the model is the retriever290

Always-On Memory Agent

A Gemini/ADK memory agent that stores structured memories in SQLite, never embeds or searches them, and loads a recent window for the model to read — with an always-on daemon that consolidates memories into cross-cutting insights on a timer, the way sleep is said to.

Best idea: Replace retrieval with a read; consolidate on a timer
Main risk: Recall is a recency window, not relevance

Read analysis

Shell history as memory291

NexusMem

Records what actually happened on the machine — shell commands with their exit codes, git patches, docs, transcripts — into local SQLite, and ranks a token-budgeted slice back out without a model touching it on the way. A git pre-commit hook asks the store what already failed in the files you staged, which is memory arriving without anyone querying for it.

Best idea: A human verdict a re-sync is structurally unable to overwrite
Main risk: That verdict is a 0.3 multiplier, and nothing filters on it

Read analysis

Memory that can die292

feltstate

Facts decay, corrections supersede, retractions stay on disk for audit, and a real death removes the rows from the live store and every snapshot under a crash-safe transaction — witnessed by a hash-linked ledger that alarms when a row disappears without a tombstone vouching for it.

Best idea: Seal only what should never change, so living isn't tampering
Main risk: Retract hides; re-assert the value and it comes back live

Read analysis

Memory inside the prefix cache293

Reasonix

Memory folds into the cached system prompt once at boot, so it costs nothing per turn — and a mid-session forget cannot edit it, so it queues an instruction telling the model to disregard what it already loaded. Its committed benchmark is the corpus's most complete, down to a memory-off arm and a column for when memory hurt.

Best idea: A subject key naming which question a fact answers
Main risk: Retraction is an instruction the model may or may not honour

Read analysis

Gravity instead of cosine294

Cognitive Spatial Memory

Helix AGI's spatial engine published as a standalone library: embeddings projected into a fixed 8D manifold and ranked by temperature × mass ÷ distance², so a faded memory is outweighed rather than cut off by a threshold. Its own docstring names the parent it came from.

Best idea: Recency as a force, so nothing is excluded by a cutoff
Main risk: No delete path exists anywhere in the package

Read analysis

Scope on every retrieval arm295

kube-coder

A per-workspace SQLite memory shared by a dashboard and an MCP server, whose namespace filter is applied to the FTS pass, the LIKE fallback and the vector hits alike — so a high-scoring out-of-scope memory can never be fused back in. Its scope tests attack prefix-sharing siblings and SQL wildcard escapes.

Best idea: Scope every arm of a fused retriever, and test the escapes
Main risk: Upsert clears the delete flag it wrote

Read analysis

Verify the rewrite, not the model296

Munder Difflin

Per-agent markdown memory in three regions — pinned facts, a rolling recursive summary, the newest sections verbatim — condensed by a headless model behind a six-check gate that requires the kept sections to round-trip byte-for-byte and leaves the original untouched on any failure.

Best idea: Back up first, then verify the rewrite against stated properties
Main risk: That gate is exported, pure, and has no test at all

Read analysis

Lessons refused at write time297

Hats

Five memory layers separated by lifetime and owner, where a lesson the agent distilled from its own failure is refused before it is stored if it would widen what the agent may touch — by a rule file that names the function doing the refusing, and a registry that will not load a rule whose enforcement point does not exist.

Best idea: Refuse the memory at the door, not at the query
Main risk: The hash-chained audit log records no memory change

Read analysis

Redaction ordered ahead of persistence298

ByteChef

A workflow platform where agent memory is a socket on the canvas — a knowledge base behind a decorator that AND-s its scope key into every search, and nine interchangeable chat-memory backends. Masking is ordered one step upstream of the write, so what persists is the masked text.

Best idea: Redaction ordered upstream of the chat-memory write
Main risk: Tenant and environment both default to a live target

Read analysis

A stop hook that will not let the session end299

growmos

A dependency-free knowledge graph in JSONL beside your repo, where the edge id is a hash of the triple so a second document corroborates instead of duplicating — and the graph stays current because a Stop hook blocks the session while work is pending, not because the agent chose to.

Best idea: Maintenance enforced by control flow, not asked for in a prompt
Main risk: A merge deletes, and nothing records what was there

Read analysis

An index of what it knows it knows300

Hipocampus

The top of its compaction tree is not a summary but a topic index, injected every session so the agent can judge whether searching its own memory is worth doing — the failure it names is the one no query fixes, where you ask about payment flow and the rate-limit decision three weeks ago is never looked for.

Best idea: An index that answers "do I know about this?" before any search
Main risk: Leaves are permanent, so nothing can be corrected

Read analysis

A prior that updates from outcomes301

MemHarness

Every record keeps the situation it was distilled from, so a policy trained with GRPO can compare then with now and reject a memory that does not fit instead of pasting it — and a record's standing is the smoothed rate at which episodes that used it succeeded.

Best idea: Retrieval that can decline what it fetched
Main risk: Six thousand lines of memory with no test of its own

Read analysis

Invalidation with a reason, and no key on the value302

Potpie

A context graph over a codebase and its development lifecycle, where every mutation carries provenance and a withdrawal stamps valid_to rather than deleting — and the refusal is keyed on the row, not the value.

Best idea: An invalidation cannot be recorded without a reason, and deletes nothing
Main risk: Nothing is keyed on the value, so a re-derived claim is a new entity rather than a refused write

Read analysis

A gate that drops the sentence it cannot quote303

repowise

A codebase index whose decision records are refused unless a verbatim span of the source supports them, published with a sealed benchmark split and the rows it loses — and a scope boundary that lives in which database you opened rather than in the query.

Best idea: An ungrounded rationale is cleared, not flagged, and a candidate with nothing quotable is rejected
Main risk: The gate cannot check a producer that recorded no source span, and labels that case the same as a failed check

Read analysis

Five tiers of how-we-know, and the best one is discounted304

Gortex

A code knowledge graph where every edge records how it was resolved, from compiler-grade down to text-matched — and where the most trusted tier is deliberately attenuated for ranking, because abundant evidence and reliable evidence are not the same thing.

Best idea: One provenance ladder weighted twice: once for belief, once for authority
Main risk: The populated benchmarks grade the project on its own repository; the externally graded one is still a template

Read analysis

Compaction that rewrites pointers, never bodies305

TrueForge

An agent harness whose context log is append-only and written exactly once, with each turn holding an ordered list of pointers into it — so compaction and forking are both changes to which messages are in force, and no message is ever destroyed to make room.

Best idea: Message identity and message position in separate tables, so fork and compaction are one copy path
Main risk: Every superseded body is retained and addressable, and nothing ever reads one back

Read analysis

It publishes the number where it loses306

lossless-context-mcp

A content-addressed archive of every file version an agent was shown, hook-fed so a compaction cannot destroy the working set — and a benchmark whose headline result is that its own compression saves nothing on real sessions.

Best idea: Losslessness as a mandatory second metric, and the unflattering real-session number as the headline
Main risk: The measured feature is the one that does not pay; the features that justify it are scored by nothing

Read analysis

The block outlives the reason for it307

KAISEN

An evolutionary coding harness whose project memory is four plain files — and whose durable visited-set of code hashes grows without bound while the history explaining why anything was skipped is a 500-entry ring.

Best idea: Failure feedback hoisted above chronology, so a repeated mistake is read first
Main risk: A permanent refusal whose explanation ages out of a bounded history

Read analysis

A read failure and an empty store are the same value308

fx

A coding agent in Zig whose durable memory is a flat JSON array of strings — with a tool description that forbids writing anything the user did not ask to persist, and a loader that answers every read error with “no memories” just before the next save overwrites the file.

Best idea: The memory-write consent rule is stated in the tool description, where the writer reads it
Main risk: Four read failures share one answer, and the next save overwrites the file it could not read

Read analysis

Every store has a hook except the one holding beliefs309

OpenWolf

Per-project memory for coding agents where seven lifecycle hooks maintain the file map, the action log and the bug index — and the file holding preferences and corrections is replaced wholesale by a weekly model call whose output is routed by a substring check.

Best idea: A read hook that denies a duplicate file read, disarmed after compaction
Main risk: The weekly reflection replaces the belief store with model stdout, with no diff, floor or record

Read analysis

The rebuild is what reverts the corrections310

sift-kg

Documents become an entity graph a coding agent queries as structured memory — with a real human review between the model's merge proposals and the store, and a build that regenerates the graph from extractions the review never touched.

Best idea: Extractions are kept per document, so the graph is genuinely rebuildable
Main risk: Merge decisions are truncated on the next resolve, and the rebuild discards the rest

Read analysis

The session knows who is asking; the store does not311

Outworked

A macOS app that runs Claude agents as pixel-art employees, over a SQLite key-value memory whose remember, recall and forget tools are mounted into every agent — and take the scope from the model's own argument.

Best idea: A zero-LLM write path and a scope vocabulary stated in the tool description
Main risk: One agent can read or overwrite another's private scope by passing its name

Read analysis

A review flag whose only writer sets it true312

Corbell

A multi-repo architecture graph plus design decisions extracted from a team's ADRs, served to an agent over MCP — where the confirmation gate on which documents count is open by default and its answers do not survive the next scan.

Best idea: Every extracted decision names the file it came from
Main risk: A forgiving loader and an overwriting saver turn a corrupt store into an empty one

Read analysis

The model may write meaning and never facts313

Portable Handoff

One Markdown capsule between sessions, where local code supplies git state and hashes, the model supplies the meaning, and any trust label its source cannot support is rewritten at parse time.

Best idea: Trust is capped by provenance on read, so a capsule cannot declare itself verified
Main risk: Five trust states, and no read path filters on any of them

Read analysis

The client is readable, the store is not314

MemoraX Code

Memory middleware for four coding agents that redacts credentials before the payload leaves the machine and refuses a scope it cannot resolve — over a hosted store whose ranking, correction and deletion live behind two HTTP endpoints.

Best idea: Redaction before transmission, with an allowlist so placeholders survive
Main risk: No delete anywhere in the client, and none in the surface it speaks

Read analysis

The path is the schema315

agents-memory

A markdown store whose folder layout is its taxonomy, published as an ABI with a mutability rule per kind — and a search that returns a file-and-line id the delete accepts back.

Best idea: One home per fact, no dump files, and recall returns an address you can delete
Main risk: That address is a line number, so one deletion renumbers every id below it

Read analysis

The verdict outranks the score316

Heimdall

A verification layer over someone else's store: every search hit is checked against its anchor path at read time and labelled STRONG, REBUILT, WEAK or STALE — and results sort by verdict first, with similarity only breaking ties.

Best idea: A verified hit cannot be buried by a better-scoring unverified one
Main risk: A failed path check deletes the node, and nothing about trust is ever persisted

Read analysis

The note-taker proposes; a person promotes317

Hestia

A self-hosted household brain whose memory is one markdown file per fact — where background extraction lands in a review inbox rather than the live store, and the bypass is off by default.

Best idea: Passive extraction may only propose, and the review step is the default path
Main risk: Nothing can mark a promoted fact wrong, and a deleted one looks novel again

Read analysis

Tests that the memory is plugged in318

NanoClaw

A per-agent container host whose durable memory is plain Markdown with no machinery at all, beside a conversation layer carrying a stated audience invariant and twenty committed cases about what must never reach which session.

Best idea: A test asserting the boot call is wired, written because the unit test stays green without it
Main risk: All the enforcement guards the transient layer; the durable one has the wider audience

Read analysis

Two tiers, one reviewed319

Muninn

A self-hosted multi-bot assistant whose extracted memories are written by a model with no review and no delete, beside a wiki tier where every drafted page waits in an approval queue behind a hash check — and a committed golden-set eval scoring the retrieval both depend on.

Best idea: The scope predicate sits inside both arms of the fused query, not around the join
Main risk: A model assigns the access-control label, once, and nothing can change it

Read analysis

A policy the store predates320

AgentDatabase

A canonical JSONL memory store with bitemporal projection, an in-record transition log, a machine-readable forgetting policy that makes abstention a first-class answer, and a 160-case gold benchmark — whose entire live content was written by an import the policy now forbids.

Best idea: Abstention returns UNKNOWN with a reason code and the conditions that would have permitted an answer
Main risk: A deterministic filter scores 1.0 on a gold set the same repository generates

Read analysis

The whole transcript, every turn321

AuraOS

A two-day-old local-first harness that splices an identity folder and a user's entire append-only transcript into every prompt — with the caller naming which transcript, and a distillation pass whose output nothing reads.

Best idea: A distillation prompt that asks to preserve contradictions and uncertainty rather than flatten them
Main risk: The caller names the memory it reads and writes, and the path is unsanitized

Read analysis

Memory the agent rates itself322

MeTTaClaw

An agent in MeTTa whose long-term memory is written only by its own tool call, where the model promotes and demotes its own memories by timestamp and recall returns a reinforcement slice beside a similarity slice rather than blending them.

Best idea: The utility signal is a tool call the model makes, not a counter the retriever increments
Main risk: The rater is the model whose recall the rating improves, and there is not one test

Read analysis

The fork that removed the ledger323

OmegaClaw

A neural-symbolic agent whose long-term memory is written only when the model calls remember — with a live test that sends a fact-shaped sentence and asserts no vector was written, and its explicit-remember twin as the control.

Best idea: A negative write test run against a real model, with its positive control on the same counter
Main risk: Nothing can be said about a memory after it is written — no delete, no status, not even a demote

Read analysis

No LLM in the write path324

GENOME

A memory layer that embeds locally and calls no model to store, so every mutation can be journalled and the store replayed exactly — and whose published feature audit reports one of its own features as harmful.

Best idea: A deterministic write path is what makes an audit log worth having
Main risk: That same journal keeps a deleted memory's text, and replay rebuilds it

Read analysis

A blocking consent gate325

Graphnosis

A local-first encrypted cortex whose MCP surface stops and waits for a human click before a client reads a sensitive tier — and whose corrections stay previews until someone approves them.

Best idea: A gate whose passphrase is never returned to the client asking
Main risk: Deletion is a confidence value that decay and reinforcement also write

Read analysis

Five states, one wired326

Arcon

A local-first companion whose write path classifies every candidate four ways without a model — and whose five-value status vocabulary has exactly one value both written and read.

Best idea: A deterministic four-way admission decision at the door
Main risk: A conflicting memory is withheld from every read and can never be confirmed

Read analysis

A threshold with no consumer327

AI Agent Automation

A local-first workflow platform whose per-agent vector memory is retrieved by a function declaring a similarity floor that its body never reads — while a caller passes one in.

Best idea: The row records which provider and model made its vector
Main risk: Every top-k hit reaches the prompt however badly it scored

Read analysis

A control that proves the metric can move328

Silica

A transactional write path over a markdown vault whose contradictions stay visible until a person resolves them — and whose eval harness refuses to run a gate whose metric cannot fail.

Best idea: A negative control on the metric, not the system
Main risk: A contested claim is labelled rather than withheld

Read analysis

The substrate wins none of six329

RCK

A symbolic reasoning kernel whose stored denials block derivation rather than only retrieval — and whose own paper measures its central architectural bet against a plain index and withdraws two published claims.

Best idea: A refusal that also refuses the inference that would regenerate it
Main risk: The write-ahead log is truncated at every checkpoint

Read analysis

The durable half is not the memory package330

AutoResearchClaw

An autonomous research pipeline whose three memory categories are built inside the run directory — and whose one store that outlives a run is a skill file the code itself labels cross-run.

Best idea: The prompt overlay names which of its two halves is durable
Main risk: A cross-run store constructed at a per-run path

Read analysis

Default-deny on claim status331

Weave

A Rust knowledge-graph app whose MCP memory service stores evidence-backed claims with five statuses, recalls only the active ones by default, and audits the claims it rejects as well as the ones it keeps.

Best idea: The narrow status set is the default and the wide one takes an argument
Main risk: Nothing reads the rejected set before admitting a new claim

Read analysis

Authority caps the actor332

aimee

A two-service C runtime whose memory splits into typed facts and episodic rows, gates recall on per-fact confidence and PII sensitivity, and writes mutations to a hash-chained append-only store.

Best idea: A refusal the runtime role is forbidden to delete, checked at startup
Main risk: Over a million lines; the traced fraction is small and the report says so

Read analysis

The gate is not a prompt333

Fireweed MCP

An MCP memory server that admits a claim only when deterministic functions find its cited evidence supports it, binds what survives to a byte range in the source, and abstains by name when a query has no grounding.

Best idea: A Merkle-bound source lets one subject be redacted without breaking anyone else's receipt
Main risk: The zero-dependency install hand-rolls an unauthenticated cipher

Read analysis

Derived namespace334

OpenCompany

A self-hosted agent-workflow canvas whose durable memory is an explicitly invoked tool over a namespace the backend derives from authenticated identity.

Best idea: The scope key is hashed from authenticated context and absent from the tool schema
Main risk: A forgotten fact leaves no record any write path consults

Read analysis

Unused scope key335

AgenticTrading

A multi-agent trading stack whose Neo4j memory service stamps an agent_id on every node and filters on it only when a caller asks.

Best idea: The graph schema is asserted up front, not grown from writes
Main risk: The search four agent pools share carries no scope predicate

Read analysis

The audit watches the read336

OpenExecutive

A virtual executive team whose episodic memory is extracted in the background, scoped to a conversation thread on the way into the prompt, and editable by a person.

Best idea: The scoping test asserts on the rendered prompt, not on the query
Main risk: Fourteen audit event types, all of them reads

Read analysis

Nine regexes and no way back337

Matrix OS

An agent operating system whose memory is a six-column SQLite table filled by pattern matching, with no scope, no status, and an export path only tests call.

Best idea: Capture costs no model call and reads only the user's turns
Main risk: Two patterns match ordinary speech and no field can mark the result doubtful

Read analysis

Snapshots that know what the harness wrote338

Tycho

A self-directed ARC-AGI-3 harness whose agent workspace is content-addressed and versioned, with the harness's own observations excluded from the snapshot and preserved across a restore.

Best idea: The snapshot boundary separates what the agent concluded from what the harness observed
Main risk: The world model is code with no way to mark a rule falsified

Read analysis

A briefing for the successor339

Retrodict

An ARC-AGI-3 agent whose entire durable memory is one model-authored markdown file, governed by a prompt that ranks the raw log above it.

Best idea: The prompt states why a raw log is not memory, then bounds what replaces it
Main risk: No harness code touches the one file the design depends on

Read analysis

Twenty-five hundred words of you340

Polyphony ARC

An ARC-AGI-3 harness that compacts a session into a bounded handoff summary and tells the successor the summary is not authoritative — the files are.

Best idea: The word bound is stated with the stakes, and files outrank the summary in the listing's own heading
Main risk: No tests at all, and nothing records what a compaction dropped

Read analysis

Six thousand characters, oldest lines first341

OpenHands SDK

OpenHands V1's durable memory is two agent-maintained markdown indexes under a shared character budget, off by default — beside a much larger body of context-window machinery that is not memory.

Best idea: The truncation notice is charged to the budget, so the model can see its index is a fragment
Main risk: No schema, no writer in code, and no record of what truncation dropped

Read analysis

As of May, and a receipt for it342

MemBukkit

A fact store whose answers are dated — supersession instead of deletion, an as-of read filter, and a receipt naming every fact used — with the record-time axis its temporal claim would need still absent.

Best idea: Deleting a correction revives what it superseded
Main risk: One time axis, so it can say what was true and not what it believed

Read analysis

Immutability the database enforces343

Habitus AI

A zero-dependency SQLite memory whose canonical records are made immutable by triggers, whose edge weights are conserved by a checked invariant, and whose learning refuses to run on an unverified outcome.

Best idea: Immutability is a property of the file, not of the write method
Main risk: The shipped dense space is a hash, and the README does not say so

Read analysis

The index is the retriever344

OpenKB

A knowledge base compiled into a wiki of markdown pages with no embeddings anywhere, where retrieval is an agent walking an index and the write path is journaled like a database.

Best idea: Journaled, fsync'd, rollback-capable writes over a markdown tree
Main risk: The linter finds contradictions and no field on the page changes

Read analysis

The refusals are recorded too345

Veracium

A provenance-typed memory whose third-party claims are quarantined by construction, whose audit record is a precondition for the state change rather than a consequence of it, and which keeps a durable log of the corrections it declined to make.

Best idea: If the audit row cannot commit, the state change does not happen
Main risk: The specification apparatus is larger than the mechanism

Read analysis

One turn to save, then the cut346

MerchantBench

A 366-day merchant simulation whose only agent memory is one overwritable Markdown document, warned once before each context truncation and never re-injected afterwards — while the human baseline that beat every model had the same document on screen at every activation.

Best idea: Every overwrite appends its full superseded text
Main risk: One advisory turn before an unconditional truncation

Read analysis

Many patterns, one memory floor347

All Agentic Architectures

A teaching catalog of 38 LangGraph architectures over a 497-line memory package — whose two persistent backends are exactly the two configurations its flagship dual-memory architecture retrieves nothing from.

Best idea: An unsupported query raises instead of returning nothing
Main risk: Two parameters the default backend silently discards

Read analysis

The second ingestion348

Agentic GraphRAG Blueprint

An Azure GraphRAG reference architecture whose community reports are keyed by a fingerprint of their own inputs, so stale ones are removable — and where nothing else in the store ever is.

Best idea: A derived artifact keyed by a hash of its inputs
Main risk: Positional chunk ids leak when a document shrinks

Read analysis

The ledger and the notes349

BrainAPI

An event-centric knowledge graph over six datastores, where an event accumulates legs and an attribute is replaced — and whose committed LoCoMo run recomputes exactly while its own notes say the number needs a cold re-run first.

Best idea: The correction rule falls out of making an event a node
Main risk: The ledger drops every caveat the run notes recorded

Read analysis

Findable before it is written350

MOTH Memory Template

A file-based memory format whose real contribution is asking, before a record is written, whether a later question would find it — and whether it would win — measured by tools that ship, over an architecture that mostly does not.

Best idea: Two write-time verdicts, because unreachable and unrankable differ
Main risk: The gate models the ranker instead of calling it, and the ranker moved

Read analysis

Two clocks, one checked351

AI Workflow Workspace

A token-efficient agent workflow whose three memory surfaces meet at one deterministic router — which hash-validates a code-index row before it will route on it, and answers a two-keyword cache hit with an instruction to stop investigating.

Best idea: The read returns a next step, not a result set
Main risk: Freshness covers the index and excludes the memories

Read analysis

Supersede, retract, forget352

Areev

A content-addressed grain store where world time and knowledge time are selectable at query time and every review decision is hash-chained with a mandatory reason — where a retraction is withheld at context assembly and ranked everywhere else, and one correction verb means two different things depending on which substrate answers.

Best idea: The temporal axis is a query parameter, not a convention
Main risk: One verb, two meanings, no case covering it

Read analysis

Learned judgement353

Citra Decision System

Turns officer corrections into scoped, provenanced clauses, governs them with a ten-value status the read query filters on — and publishes the run where three of its four seeded judgements measurably did nothing.

Best idea: The status is in the query, not on the score
Main risk: Parking a clause frees the evidence that re-forms it

Read analysis

Agent-native vault354

Hatchdoor

Markdown is the only record and the index is disposable, so a correction is a file edit — but a delete is a move into a folder nothing empties.

Best idea: The atomic exchange is the commit point
Main risk: A declared debounce ceiling nothing reads

Read analysis

Agent-runtime memory355

Animus

Seven time-named layers over a new/current/deprecated state the prompt assembler actually filters on — beside an ontology nothing in the tree can correct.

Best idea: A state spent on filtering, not on ranking
Main risk: A scope column no code ever writes

Read analysis

Four types, one label356

RAGFlow Memory

A per-tenant message index where the memory predicate is overwritten inside every backend adapter — beside a four-type taxonomy that is whatever JSON key the model returned.

Best idea: Scope resolved before the query, forced under it
Main risk: A type system no query ever reads

Read analysis

Its memory, the platform's corrections357

openvurp

A wallet of user-created agents where each keeps its own SQLite FTS5 memory, lessons and replayed corrections under a per-agent directory — but a correction typed to an agent lands in the platform's learning log, the nightly fade runs on the platform's store alone, and the mirror replays an agent's corrections against the platform's lessons.

Best idea: A correction becomes a test case replayed at night
Main risk: The memory is scoped; the learning is not

Read analysis

Who confirmed it, and until when358

Open Knowledge Format

A Google Cloud specification for agent-written knowledge as markdown bundles — who generated a concept, who verified it, when it goes stale, and a sanctioned computation a consumer can attest — whose every trust state is advisory: the one consumer in the tree draws badges, and a regeneration keeps a human's signature on text the human never saw.

Best idea: Verified is not the same field as generated
Main risk: States that nothing reads

Read analysis

Dead ends that stay dead359

OmniMem

A self-hosted MCP memory server on Valkey whose episodic memories carry effort, outcome and a graveyard of abandoned approaches, checked by keyword before any recall is embedded and suppressed as a topic when a costly approach dies — while a contradiction, once recorded on both rows, is cleared by nothing.

Best idea: The graveyard speaks first
Main risk: Links that nothing clears

Read analysis

A scene graph that fuses before it persists360

Chronotope

A numpy-only Python library that turns object detections into a single-file SQLite scene graph through a deterministic fusion arbiter — merge, create or reject each observation, with every mutator fusing the staged rows before it commits — where a rejected observation stays as a row nothing reads and a forgotten node leaves no record.

Best idea: No observation persists without a node
Main risk: Refused evidence nothing can find

Read analysis

A scene graph the robot edits after every grasp361

DovSG

The RA-L 2025 mobile-manipulation code whose 3D scene graph is repaired locally after each pick and place — remembered voxels the new depth contradicts are deleted, objects that lose half their voxels are dropped, their subtrees cut and the rest rebuilt — and whose planner and navigator never read the graph they maintain.

Best idea: Delete by depth disagreement, locally
Main risk: A graph nothing consults

Read analysis

Fifty sentences behind the static prompt362

OpenMake LLM

A self-hosted AI workspace whose cross-conversation memory is a per-user table of up to fifty sentences injected after the static system prompt — typed into a settings tab or extracted behind two switches that default to off — gated by a stored toggle the client can only tighten, tombstoned on delete, audited on the tab's path and not the extractors', and invisible to a data export that still queries the columns of the table dropped in May 2026.

Best idea: A delete the extractors remember, behind a toggle the client cannot loosen
Main risk: An export that has never returned a memory

Read analysis

Wire-dark bi-temporal facts in an abandoned harness363

ELAI

An abandoned, privacy-filtered Rust agent harness whose memory crate is a bi-temporal SQLite fact table with per-type trust decay, evidence enforced at insert, judged contradiction closure and a compile-time role firewall on injection — where the only conversational writer sits behind a flag that expired before publication, the automatic extractor stores nothing, and the trust tiers the tests defend filter no live query.

Best idea: A role allowlist that fails to compile when a role is added without a decision
Main risk: A crate wired to almost nothing, in an archive nobody maintains

Read analysis

A ladder every proposal must climb364

Argos

A Hermes memory plugin and standalone MCP/REST server — DuckDB records, a Kùzu entity graph, local embeddings — where every extracted fact is a proposal whose top rung automatic review cannot write, deletion and rejection leave ledgers both write paths consult, versions chain with as-of reads, and the benchmark numbers recompute from committed files that the project's own audit says never formed a chain.

Best idea: Tombstone and rejection ledger consulted on both write paths
Main risk: Headline benchmarks ran with the supersession machinery idle

Read analysis

Markdown memories under a code index365

Reporecall

A Claude Code hook daemon and MCP server that indexes frontmatter markdown — the agent's own memory directory read-only beside a writable one — into SQLite FTS5 and injects it under per-class budgets, where archival and supersession live in the index row and not the file, a promoted fact is a copy compaction supersedes, and the project's source repository no longer resolves.

Best idea: Rank the agent's own memory files into the prompt at zero token cost
Main risk: Lifecycle state the next file edit resets

Read analysis

Wires are the context366

ThoughtDAG

An editable context graph — desktop app, harness plugin, read-only CLI — where what the model sees is exactly what wires into the node, one compiler feeds the preview and the request, each generation records its upstream fingerprint and a hash of what was sent, stale answers are marked and replayed, an ambient memory is admitted behind a constitution in code with an undo, and a committed benchmark shows when deleting a wrong turn's source is not enough.

Best idea: One compiler for the preview and the request, hashed at dispatch
Main risk: Stale is a label the model is asked to respect, and archive leaves no record

Read analysis

Real at rest, fake on the wire367

OpenMasq

The cross-conversation memory of a redacting desktop chat client — one card per entity and a profile, extracted by the same model from the pseudonymised transcript it already saw and un-redacted locally through the conversation's vault, admitted only when the entity appears verbatim in the real text, merged by attribute replacement with a restorable history, selected client-side on real values and re-redacted on every injection, searchable by the model through a lexical tier topped up by an on-device embedder, and reviewed in an inbox that empties by confirming.

Best idea: Extract from the wire the model already saw, and let the vault filter hallucinations
Main risk: Nothing a card knows about itself keeps it out of a prompt

Read analysis

A second brain with a daily cap368

no_human

The learning store inside a ticket-to-pull-request coding agent — rules, skills, facts and anti-patterns in one SQLite table, proposed only from labelled failure signals, screened for duplicates, personal data, provenance and vendor terms, activated ten a day with a kill switch, injected through one chokepoint that scopes by remote hash, matches tags on word boundaries and ranks by importance, recency and use, with an injection-to-outcome ledger and an append-only event trail; nothing is ever deleted, and a reviewer never reads a rule distilled from its own verdicts.

Best idea: One install site, proven by parsing, with a guard that can fail
Main risk: Auto-activation on by default with a daily cap as the only ceiling

Read analysis

The open half of a closed memory369

Engram Format

The published storage crate behind a closed memory product — a SQLCipher vault with a documented schema, an FTS5 index and a vector table, a capture pipeline that skips noise, strengthens a verbatim duplicate and refuses a near-verbatim paraphrase, a quarantine of imagined-and-ungrounded rows that some read paths honour and the defaults do not, an Ebbinghaus decay and a retrieval-count promotion, and a sync envelope with tombstones and last-write-wins; the daemon, the relay and every user surface are elsewhere.

Best idea: Typed write outcomes and a curated bypass past the dedupe gate
Main risk: A quarantine the default read path ignores

Read analysis

Muninn keeps the facts370

Khoj

The long-term memory of a self-hostable personal AI — one Postgres row per first-person fact with a pgvector embedding, extracted after every non-automated turn by a prompt that may create facts and delete them by id, recalled as the ten most recent facts of the week plus the ten nearest by cosine, scoped per user and per custom agent, injected as a dated list the model is told to ignore when irrelevant; the extractor only ever sees the facts recall found, so a fact it did not retrieve it cannot retire.

Best idea: Scope on both recall arms, tested with the excluded facts present
Main risk: The extractor sees only what recall retrieved, so stale facts persist

Read analysis

Five global, twenty per workspace371

AnythingLLM

The personalisation memory of a self-hosted RAG chat application — one-sentence facts scoped to a workspace or global and capped at twenty and five, extracted every few hours by an observer and a reflector over an idle user's last twenty chats, appended to every system prompt with the five workspace facts a reranker puts closest to the message; a chat is marked processed whether extraction succeeded or failed, and the public embed widget gets the owner's facts in single-user mode.

Best idea: An observer that proposes and a reflector that sees the rows
Main risk: Chats consumed on failure; the embed widget gets the owner's facts

Read analysis

Notes an assistant may edit, one tool at a time372

Joplin

The AI service inside a nine-year-old note application — a chat scoped to the open note that edits it through anchored tools, reaches the rest of the notebook through eleven global tools each switched off by default, a background indexer that rides the app's change feed into a sqlite-vec index and rebuilds itself when the model changes, a token budget that refuses rather than truncates, and an MCP server that hands the same gated tools to outside agents; the notes are the memory, and the assistant keeps none of its own.

Best idea: Every capability beyond the open note is a switch, and the refusal names it
Main risk: The assistant remembers nothing and attributes nothing

Read analysis

One predicate before every page373

Memos

A self-hosted note service whose memos carry a creator, a visibility and a space that the storage driver renders as one WHERE clause before LIMIT on every list and count, so a row the caller may not read is neither returned nor counted; a two-user test asserts the viewer's list by id; and an MCP server that is an allowlist over the REST API forwards the caller's bearer token unchanged. A memo is a note: no state, no provenance beyond its creator, a hard delete, and a default audience of everyone logged in.

Best idea: The audience is a SQL predicate appended before the page
Main risk: A memo is a note, and PROTECTED is everyone logged in

Read analysis

The hash is the write precondition374

SilverBullet

A Markdown wiki whose file API returns a SHA-256 ETag on every read and demands it back on every write, fails closed on any precondition it cannot evaluate, merges three ways under a per-path lock when two writers collide and otherwise writes both sides into the page between markers for a person, and commits each quiet period to git under the account, client or external process that made the change. Every capability mark is withheld on definitions; the write contract is what the report is for.

Best idea: Name content by its hash and make the hash the write precondition
Main risk: Write access is code execution in every reader's browser

Read analysis

A snapshot before the first write375

SiYuan

A local-first block notebook whose kernel runs an agent over thirty-three tools that each declare whether an action writes locally, sends data out or costs money; any of the three waits for the person unless always-allowed, the first local write of a chat takes a data-repository snapshot recorded in the session, sessions are JSON files saved under an expected revision with orphaned-turn recovery, and compaction injects its summary as untrusted historical memory. Semantic search is a remote embedding and a full scan; nothing is a memory with a state.

Best idea: Confirmation by declared effect, then a snapshot
Main risk: Always-allow is one click

Read analysis

One registry for the chat and the MCP376

Trilium Notes

A hierarchical note application whose twenty-one assistant tools are defined once with a mutates flag and executed by the in-app chat, the public MCP route behind an ETAPI token, the person's own Claude Code with every built-in tool disabled, and a Copilot agent on a loopback endpoint; a revision marked llm precedes every content edit and the column persists, but the mark covers three tools and no test asserts it. No embedding, no index, and the assistant remembers nothing but the chat note.

Best idea: One tool registry with a mutates flag serves four consumers
Main risk: The assistant's mark covers three tools and no test

Read analysis

A checkpoint before compaction377

VISTA

A harness that plays ARC-AGI-3 games through Claude Code or Codex, archives every environment frame so the model can re-inspect original evidence through bounded read-only tools, keeps a per-game GUIDE.md and WORKING.md with a provenance stamp on every write, blocks the runtime's compaction with a hook until the model has saved a non-empty continuation checkpoint, and rebuilds a fresh context from the files and the exact last event; every recovery path fails closed under test, and the memory is one game deep.

Best idea: Compaction waits for the model's own checkpoint
Main risk: The checkpoint gate is syntactic

Read analysis

Discovery proposes, authority decides378

Velantrim Crystal

A local-first evidence and memory kernel where a fact enters as Observed, is refused on sight when it contains a claim pattern a curator has recorded as rejected, passes a truth gate that never lets model output become a world fact, grounds an answer only when VERIFIED, canonical and unrestricted, waits for a curator otherwise, and leaves every compliance event in a hash-chained audit log with a checkpoint against a deleted tail; erasure is physical and cascades over derived facts, with a content-free receipt that does not feed the rejection memory.

Best idea: Model output can never become a world fact, as an invariant
Main risk: Erasure does not tell the rejection memory

Read analysis

Three tools over a knowledge graph379

Forgetful

A self-hosted MCP memory server for coding agents — one Zettelkasten-shaped row per memory with nine provenance columns, embedded in-process by FastEmbed, stored in SQLite or Postgres, auto-linked on create to its three nearest neighbours with no distance floor, retrieved by a dense top-20 that a local cross-encoder cuts to k and a one-hop walk widens, re-sorted by importance under an 8,000-token cap, isolated per user by a WHERE clause on both backends, obsoleted but never deleted, and audited by an event bus that is off by default; the sparse leg, the rank fusion and the 0.7 threshold the README and the agent's own skill describe are not in the tree.

Best idea: Three meta-tools over 152 operations, with discovery text built from the feature flags
Main risk: The retrieval the agent is told about is not the retrieval that runs

Read analysis

Notes as a graph, answers as citations380

Kwipu

A local Graph RAG over a folder of Markdown notes — LlamaIndex's property graph on Ollama — where every wikilink and frontmatter key becomes a relation in code before a model extracts its own, four retrievers answer under a prompt that must cite files, an edited note is re-indexed in place, and a wikilink's triple has no document behind it, so a removed link stays a relation until a deletion forces the full rebuild.

Best idea: Triples from the note's own structure before triples from a model
Main risk: A triple outlives its link, and the MCP server never watches the folder

Read analysis

A harness that keeps its rulings381

craft

A Claude Code plugin whose memory is files under .craft/: learnings recorded with a quote, a date and a count at pending, listed and approved by a person in a reflect drain before they are copied into .claude/ for Claude Code to load; locked decisions and tokens behind a confirm step and a sole merge writer; notes indexed into every session; a write gate on the file tools beside a hook that approves every shell command; and a story field pointing at decision records nothing writes.

Best idea: Pending means never injected; a person approves before promotion
Main risk: Every Bash command outside a short blocklist is auto-approved

Read analysis

One vector that forgets on a schedule382

holomem

A 423-line holographic memory — every fact a weighted triple in one fixed-size complex vector rebuilt from a plain fact list — where an unconfirmed fact halves every 45 days, a contradicted one is damped rather than deleted, a second trace answers what was true in a given month, and a z-score margin says when to stay silent; a committed capacity sweep the README recomputes from exactly, and nothing that persists.

Best idea: A confidence gate in units of the trace's own noise
Main risk: No store, no scope, no record; the fact list is yours to keep

Read analysis

Recall is an action the mind must choose383

HUMANs

A persistent local agent around one SQLite file whose canonical records are immutable by trigger and corrected only by a superseding record, whose speech model sees the current utterance and nothing stored, whose recall is a selected one-use LOOK returned through a receipt, and whose language memory admits only what was heard — with a committed test that seen and noticed text stays out. The shipped command line can add a fact and cannot retire one.

Best idea: The model is shown the current utterance and nothing stored
Main risk: Supersession has no writer on the command line

Read analysis

Learnings the model writes and the person never sees loaded384

Pro Workflow

A Claude Code plugin whose self-correcting memory is a SQLite table of rules with an FTS5 index, written by a Stop hook that parses [LEARN] blocks out of the assistant's reply and filtered by project on every read — and whose session-start hook prints the loaded learnings to stderr, which the harness shows the person and never the model.

Best idea: A project filter in the query
Main risk: The loading step reaches the person, not the model

Read analysis

A team's learnings, voted on by the agents that used them385

teamai-cli

Tencent's CLI for distributing a team's skills, rules and knowledge to ten coding agents from a git repository — learnings as Markdown pushed through a merge request, filed at a shared root or under a project namespace the index admits only for that project's members, votes that count only what the transcript shows was recalled, a confidence that prunes and promotes, and a review queue with a risk on each machine-written section. A learning deleted upstream is reconciled out of every member’s cache; nothing records that the team rejected it.

Best idea: An upvote only for a document the transcript shows was recalled
Main risk: Forgetting is the absence of a file, not a record of a decision

Read analysis

The directory is the memory unit386

EvoX Genesis

An Elixir system for long-horizon autonomous software evolution whose memory is a tree of per-directory CONTEXT.md files — written by agents, versioned in git, and read by each agent as the chain from the repository root down to its own node, with the skills it may call named in those same files' frontmatter. Agents are finite-lived and the tree is not; a rejected proposal is a deleted branch that leaves no record of what it proposed.

Best idea: Scope is the directory, so it cannot drift from what it scopes
Main risk: The function that assembles the memory has no test

Read analysis

A decision chain no edit can rewrite387

MemContinuum

A decision store for Claude Code projects where every ruling is an append-only link in a per-topic chain, a git hook runs the linter's frozen-body check on every commit and refuses an edit to a link already recorded, the authority on each ruling decides whether a drift violation fails the run or only informs, and a pre-edit hook hands the whole chain — including what was declined — to the model before it touches a governed file.

Best idea: Append-only enforced by a diff against a git ref
Main risk: The declined ruling is delivered and consulted by nothing

Read analysis

A memory that must be voted in388

SAGE

A Go memory node on a vendored CometBFT chain where a submitted memory is stored as proposed and becomes readable only after a vote commits it, recall reads committed rows alone, a deprecated memory's exact bytes are refused on resubmission, and confidence decays on a curve evaluated at read time with the floor applied across every candidate before the top-K trim. On the default single-node install, the vote that decides admission is one key applying three string heuristics.

Best idea: A memory is unreadable until something votes it in
Main risk: Single-node consensus is three string heuristics

Read analysis

A draft is written but not injected389

PLUR

A local-first shared memory where the agent authors plain-text engrams into a YAML file that is the source of truth, a commitment of draft withholds one from injection while leaving it retrievable, validity time sits beside record time and both are filtered on read, and every mutation appends to a monthly history that never syncs. A retired engram is deliberately invisible to the dedup that would have stopped it coming back.

Best idea: Retrievable but never injected, enforced in the injector
Main risk: Nothing in the repository can approve a draft

Read analysis

Facts with a validity window390

OpenZync Core

A FastAPI memory backend where one LLM call turns a message into fact triples carrying a validity window, every retrieval filters on that window through a single shared predicate with an as-of parameter threaded end to end, and row-level security backs the tenant key the search SQL itself leaves to the auth layer. A retracted fact is invisible to the conflict scan that would have caught it coming back.

Best idea: One temporal predicate every read path imports
Main risk: The write path cannot see what was retracted

Read analysis

Five tiers, one SQLite file, no vectors391

Sibyl Memory

A local memory engine of five tier-specific tables in one SQLite file, retrieved through FTS5 with a folded-trigram fallback and no embeddings anywhere, where a zero result names which of five causes produced it rather than looking like an empty store. Every query carries a tenant key its own authors flag in a lock comment as a post-filter on an unindexed column.

Best idea: A zero result that names its cause
Main risk: Tenant isolation is a post-filter, as the authors say

Read analysis

One markdown baton, rolled back on failure392

Auto Company

Fourteen agent personas driven by a shell loop whose entire cross-session memory is one markdown consensus file — backed up before each cycle, validated afterwards for three required headings, kept when a timed-out cycle still updated it, and restored from the backup whenever the cycle failed. No capability marks, and the guard worth copying is the one with no test.

Best idea: A transaction around a markdown memory
Main risk: Validation reads headings, and there is no history

Read analysis

An accepted finding, ratcheted393

ripwire

A C++ code-context engine whose memory is two committed sidecars: a ledger of deliberately accepted quality findings, each keyed to a symbol and pinned at the magnitude it was accepted at so it resurfaces the moment the finding worsens, with a content hash that re-files it across a rename and refuses to across a rewrite; and a field-notes file surfaced beside the symbol it names.

Best idea: An acceptance that is a floor, not an exemption
Main risk: The key is a location, and a move destroys it

Read analysis

Deciding what to write without an LLM394

SAGE Novelty Gate

A mem0 fork that routes each candidate fact by vector arithmetic instead of a per-write model call.

Best idea: Published numbers recompute from committed artifacts
Main risk: A discarded candidate leaves no record at all

Read analysis

The store owns the index, not the text395

OpenContext

Memory is Markdown files; SQLite indexes them and the agent is handed a path to read.

Best idea: Index the files, never hold a second copy
Main risk: No scope key anywhere on the read path

Read analysis

The gate is the context; the memory is underneath396

Artesian

A Rust context governor over a durable store — a memory’s id hashes its content together with its project, user and session keys, both backends push that key into their own filter, and a CI gate proves one project’s private memory stays out of another’s query.

Best idea: Identity is the value and its address, hashed together
Main risk: Eviction and its audit log run on one backend only

Read analysis

The schema rejects a thin memory at the door397

Context Keeper

Typed project memory whose server refuses a decision without forty characters of problem and sixty of rationale — then serves it through a ranked path that flags its own weak answers and an exact path that never guesses.

Best idea: A character floor the store enforces at capture
Main risk: The conflict check skips everything you deprecated

Read analysis

Compile once, then serve the same bytes398

Statewave

Append-only episodes compile into typed memories with a validity window separate from their record time; assembly reads the compiled set inside a token budget and writes a receipt naming every entry it chose.

Best idea: A tenant invariant enforced by parsing your own source
Main risk: Tombstoned means expired, so a lapsed claim recompiles

Read analysis

A rejected skill is remembered by its fingerprint399

Caura

Fleet memory where a rejection is written down by value and consulted before the distiller proposes again, every mutation appends to a per-tenant hash chain, and a person approves a candidate skill before any agent sees it.

Best idea: A poison table the next distillation run must consult
Main risk: Two governance marks sit behind one feature flag

Read analysis

Trust is a triple the runtime derives, never a field a caller sets400

ShisaD

A security-first agent daemon whose memory looks up every entry’s trust band in a validated matrix of origin, channel and confirmation — raising on an unknown combination — and admits only elevated entries to the identity surface.

Best idea: An unenumerated provenance raises instead of defaulting
Main risk: It refuses poisoned writes without remembering the refusal

Read analysis

Quarantine tags the contradiction and recall returns it anyway401

MCP Memory Service

A belief table with a candidate-to-active-to-superseded ladder filtered in SQL, beside a memory row whose quarantine flag no retrieval path reads — so the contradiction it detects is labelled and still returned.

Best idea: Promotion needs a confidence floor and a provenance floor
Main risk: The quarantine flag filters nothing

Read analysis

Compress before you store, consolidate while you sleep402

LightMem

An ICLR 2026 reference implementation whose three-stage ladder compresses and segments before anything is stored and consolidates offline — keeping the pre-compression text on the row, and recording nothing when consolidation rewrites or deletes.

Best idea: Filter with a small model before you embed anything
Main risk: Consolidation hard-deletes and overwrites, unrecorded

Read analysis

The memory was already on disk; nobody had indexed it403

deja-vu

Every memory tool starts empty and records forward; this one indexes the session transcripts your agents already wrote — stripping secrets as it builds, and telling you in prose when a session says an approach was backed out rather than calling that a state.

Best idea: Index the history already on disk instead of starting empty
Main risk: No project boundary, deliberately — one index answers everything

Read analysis

A year of one person’s system, published as a blueprint404

Context Infrastructure

Daily observations an agent appends under three retention marks, promoted weekly into rule files against a threshold the prompt states — and then deleted from the log that justified them.

Best idea: The promotion bar is stated where the promotion happens
Main risk: Consolidation rewrites away its own evidence

Read analysis

A ledger of who did what, and the payloads live elsewhere405

CommonGround Kernel

An append-only ledger where every row names the actor and the cause that produced the event, and the project key is part of every primary key rather than a filter to remember — with the payloads in a submodule this repository does not contain.

Best idea: Two nullable columns make the audit answer “why”
Main risk: The content store is a submodule that is not here

Read analysis

Harness scaffolding is stored and kept out of the index406

pond

Every agent session ingested losslessly into Lance storage you own — with each message part marked conversational or injected, and only the conversational half contributing to what can be found.

Best idea: Store the scaffolding; never index it as speech
Main risk: A lossless archive with no redaction at ingest

Read analysis

Recall hands back the replacement, not the superseded memory407

LWC

A source-grounded wiki over a temporal memory: every lexical hit is walked forward through the supersedes chain, so a query matching an old decision answers with the one that replaced it — and eviction spares anything still marked unresolved.

Best idea: Resolve supersession on the read path, and label the result
Main risk: The provenance ladder and the validity interval reach no query

Read analysis

The third answer to a transcript already on disk408

continuity v2

An index over the JSONL sessions the harness already writes, whose best tool returns the conversation around a match rather than the match — and whose second-best asks, read-only, whether the index has fallen behind its source.

Best idea: Return the thread around the hit, not the hit
Main risk: No tests, no redaction, and a checkpoint with no owner

Read analysis

A claim about code, accountable to the code409

Memspec

Memories are markdown files under version control, each anchored to the git blob SHAs of the files it depends on — so when the code moves, the claim is flagged for a person instead of quietly rotting.

Best idea: Detect staleness against the repository, not the calendar
Main risk: Every honesty mechanism here waits on an operator

Read analysis

The reranker was off for three months, and the docs say so410

Somnigraph

A heavily tuned personal memory server for Claude Code — feedback-shaped hybrid retrieval, biological decay, sleep consolidation — whose most valuable artifact is a documentation set that records its own silent regression in full.

Best idea: Every constant carries the study that set it
Main risk: Extensive benchmarks, and no test suite at all

Read analysis

A human forget that consolidation cannot undo411

Slowave

A local memory layer whose core makes no LLM call — and whose consolidation pass looks up what a person deleted by embedding before forming anything, so a suppressed claim is neither reinforced back nor quietly rebuilt in different words.

Best idea: A forget the rebuild pass is written to respect
Main risk: Judged benchmark numbers with no records in the tree

Read analysis

Every read carries the project key except the one that forks412

UltraContext

A git-shaped store for the sessions five coding agents already write — every change a new version head naming its operation and the nodes it touched — that can write a session back out in another agent’s own format.

Best idea: Writers, not just parsers — continuity as a file
Main risk: The fork path resolves its source without the project key

Read analysis

A port that kept the approval queue and lost the frozen prompt413

Khabeer

Hermes Agent’s bounded-file memory ported into a Termux-based Android app — two capped Markdown files, substring edits, a threat scan and a staged write-approval list a person works from the Memory page.

Best idea: Pending writes as a page that survives restart, each with its origin
Main risk: The prompt is re-read from disk every tool step, so it is never frozen

Read analysis

A correction that repetition can undo414

Memora Engine

A Postgres memory service whose conflict pass supersedes a contradicted memory and keeps the reason, with a committed evaluation that asserts no superseded or archived memory reaches a populated top five.

Best idea: A leak test that fails if the status filter is removed
Main risk: Deduplication skips superseded values, so they return as new

Read analysis

A scoped notebook for handing work between agents415

ContextMeld

A desktop app that indexes Claude Code and Codex history and keeps memories a person writes, scoped global, per project or per agent, filtered by that scope when a handoff package is built.

Best idea: A closed scope set, filtered where memory reaches an agent
Main risk: The filter lives in the view, not the query

Read analysis

A global memory the model writes and every session reads416

AgentOS (Tanglies)

A FastAPI agent platform whose long-term memory is one SQLite table the model writes with a tool and the runtime recalls into every system prompt by default, keyword-matched with Chinese bigrams.

Best idea: CJK bigrams where FTS5 will not tokenise Chinese
Main risk: No scope, automatic recall, and a web fetch tool always on

Read analysis

Change candidates only the person can confirm417

Memory Garden

A retrospection agent over an Obsidian vault that proposes changes in a person’s stated views as candidates, lets only the person confirm or deny them, and skips a denied pair on later scans.

Best idea: The model proposes; only the person confirms
Main risk: A denial keyed on the file revision returns after any edit

Read analysis

Markdown notes, a local model, and a bounded index per project418

Kept

A Rust memory for coding agents made of Markdown files, searched by a CPU embedding model, with a prompt hook on every request and one generated MEMORY.md per project that excludes archived notes.

Best idea: A 17 KB session index per project, compacted oldest first
Main risk: The per-prompt hook ranks notes from every project

Read analysis

A tested session boundary over an exact-match store419

Hivemind

A Go daemon serving memory over MCP whose session scope is a real, tested read filter, and whose only embedder is a hash that finds a memory only by its exact text.

Best idea: An isolation test that pins identical vectors across sessions
Main risk: A placeholder embedder turns search into exact match

Read analysis

Per-agent Markdown memory behind a frozen prompt section420

Nuum

A local-first desktop for persistent agents whose memory is Markdown per agent, written by a tool and a post-turn extractor, and injected into a system-prompt section frozen per epoch to keep the prefix cache warm.

Best idea: Only user-requested writes break the frozen memory section
Main risk: Background removals stay in the prompt until the next epoch

Read analysis

Candidates only a promote can release421

Scope Recall

A Hermes memory provider over SQLite truth and a rebuildable LanceDB companion that journals every turn, digests it into candidates ordinary recall cannot see, and filters every lane by scope and lifecycle — with the promote that releases a candidate available to the model itself.

Best idea: One scope and one lifecycle predicate on every recall lane
Main risk: The model can promote its own candidates

Read analysis

Measured fusion recall over a soft-delete lifecycle422

Uteke

A single-binary Rust memory engine with local embeddings, weighted fusion of vector and keyword recall, and a tested namespace filter, whose corrections are soft deletes that time travel cannot see and a thirty-day prune erases.

Best idea: Weighted fusion tuned in the open, with recomputable raw results
Main risk: Retired values leave no trace and can be written back

Read analysis

A tested project boundary under a one-hour default423

dsh-ai-memory

A Rust and SQLite memory crate wrapped as a DeepSeek Harness plugin that packs project-scoped recall into a token-budgeted system-prompt section before every model call.

Best idea: Project bound at session open, never a tool argument
Main risk: The default preset deletes working notes instead of promoting them

Read analysis

A durable queue and MCP tools over Graphiti on FalkorDB424

Janus-Graph

An MCP memory service that queues agent episodes in SQLite and feeds them to Graphiti on an embedded FalkorDB, filtering recall to facts whose validity interval is still open.

Best idea: A durable queue and dead-letter path in front of graph extraction
Main risk: A repair fallback turns one malformed edge into no facts

Read analysis

Staleness proved by a commit receipt, never deleted425

Claude Self-Reflect

A single Rust binary that indexes Claude Code's own transcripts into SQLite with FTS5 and an in-process HNSW index, and flags a hit stale only when a content-hash witness at a git commit proves it.

Best idea: Staleness from BLAKE3 stamps and git ancestry, with named abstentions
Main risk: A chunk proven stale still returns, unlabelled on the injection path

Read analysis

Two clocks read as carefully as they are written426

Utopia

A Rust binary over one Postgres that extracts ontology-typed entities and bitemporal facts from documents and from sentences an agent records over MCP, and keeps every remembered fact off the graph until a person confirms it.

Best idea: Automatic merges gated on what undo cannot recall
Main risk: The confirmation queue and its rejected-triple key skip bulk ingest

Read analysis

A shared team memory that mines traces into skills427

Hivemind (Activeloop)

A hook layer for seven coding agents that writes every turn into a Deeplake workspace, lets the agent grep that store as a filesystem, and mines recent sessions into SKILL.md files that install themselves on every teammate's machine.

Best idea: Correct a skill from the user's next message, judged against sycophancy
Main risk: The improved skill reaches every teammate with no review and no measurement

Read analysis

A memory contract bolted to a graph database428

RushDB

A schema-free graph and vector database on Neo4j whose agent memory is a 600-line client package — episodes and facts with deterministic ids and a five-field scope filter applied before similarity — while the server below it knows nothing about memory.

Best idea: A filter in the query picks exact scoring over the ANN index
Main risk: The outbox, the timeout and the fact deactivation are someone else's code

Read analysis

An exact-quote gate in front of the graph429

Signet AI

A local daemon under ten coding harnesses that captures transcripts as immutable episodic evidence and lets a background dreaming pass derive a semantic graph from them only by citing a verbatim quote it re-resolves against the store.

Best idea: Consolidation writes rejected unless the quote resolves
Main risk: The published benchmark number has no committed artifact

Read analysis

A headline number held to a test that parses the README430

GrayMatter

A single static Go binary — bbolt facts, an inverted index and an embedded vector store behind a CLI, a seven-tool MCP server and a daemon — whose supersession is latched against stale snapshots and whose published token table fails CI when it stops matching a live run.

Best idea: Published numbers parsed out of the README and failed against a live run
Main risk: A forgotten value can be written straight back as new

Read analysis

A revision layer whose status nothing reads431

Membrane

A Go memory substrate storing six typed record classes in one Postgres and pgvector schema, retrieved as a byte-bounded entity graph behind a scope and sensitivity gate, and revised through supersede, fork, merge, contest and retract.

Best idea: A retrieval budget sized in SQL and re-enforced above the store
Main risk: Retraction is a salience of zero that prune then deletes with the audit log

Read analysis

A review layer that outlives the graph it corrects432

MARM Memory

A local-first MCP memory server for coding agents over one SQLite file, with an exact lexical lane that is never semantically reranked and a concept graph whose removals leave name-keyed suppressions a full rebuild cannot undo.

Best idea: Human verdicts in the tables a rebuild does not drop
Main risk: Every memory is HTML-escaped on write, with no inverse

Read analysis

A shared org memory where the ACL is the query433

Lobu

An event-sourced Postgres memory for a whole organisation's agents, whose every read compiles its scope from one value — tenant, connection owner, then the source system's own ACL mirrored as SQL and failing closed while the sync is stale — and whose corrections are appended rows that a view hides and nothing ever deletes.

Best idea: One predicate compiler, with the upstream ACL joined at read time
Main risk: Correction only masks the record; the value can be written back

Read analysis

Memory that ships as a template434

Create Context Graph

A Neo4j Labs CLI that generates a whole agent application around a three-tier context graph, with thirteen connectors that import real SaaS and local-session history — and, on its default hosted backend, relationships encoded into a text field that nothing in the tree reads back.

Best idea: A watermark that advances only after the batch lands
Main risk: Encoded edges no reader parses, and nothing can be deleted

Read analysis

Skills as curated procedural memory435

SkillCorpus

A pipeline that crawls public SKILL.md files into a SQLite library and judges each one with an LLM whose verdict is cached under the hash of the body it judged, so a re-crawl cannot re-admit what was excluded — and a per-turn engine that fuses a local BM25 pool with a remote catalog and lets a gate put at most two skills into the agent's context.

Best idea: Curation verdicts keyed on the content hash, re-derived every build
Main risk: Third-party instructions injected verbatim behind one build-time opinion

Read analysis

Graph-native context and provenance436

Semantica

A graph-native context platform whose graph keeps validity time beside record time and separates retraction from erasure from retroactive correction — sitting beside an agent-memory store whose filter predicate knows three keys and answers True to every other, so the scoped delete its docstring shows empties the store.

Best idea: Retract, purge, receipt, revise — four words for four removals
Main risk: A filter that ignores unknown keys, behind delete and recall

Read analysis

Symbolic memory, no embeddings437

KITE by Memoket

A conversational memory with no vector stack at all: sessions become dated facts under a topic taxonomy in one readable XML file, a question compiles into an inspectable select-filter-sort plan over posting lists, and contradiction is settled by sorting on event time — because nothing here can edit, supersede or delete a fact once written.

Best idea: A benchmark contract a sceptic could run, seals and all
Main risk: No delete, no correction, and the sealed rows are unpublished

Read analysis

LLM-supervised local memory438

Mnemon

A single Go binary that implements MAGMA's four-graph memory over one SQLite file and calls no model of its own — importance, links and forget decisions arrive as arguments the host agent chose — with a decay formula whose automatic deleter reads a column only an agent-invoked command refreshes.

Best idea: Deviations from the paper it implements, in a table
Main risk: Auto-prune orders by a score nothing on that path recomputes

Read analysis

Policy as the memory layer439

flow

A Go task manager for Claude Code whose durable memory is five markdown files the binary never parses — an unusually well-written policy carried entirely by prompt text, with a stats command that mines session transcripts to count how often the model actually read what it wrote.

Best idea: Counting reads of the memory from the harness's own transcripts
Main risk: Every guarantee is a sentence; three artifacts disagree on the read path

Read analysis

Honest about its own recall440

Prism

Session memory for coding agents whose distinctive work is nine contract tests on the seam between what retrieval did and what the agent is told about it — written after a health check hardcoded a zero and reported HEALTHY through an outage where every semantic query returned nothing.

Best idea: Tests that pin what the system says about its own retrieval
Main risk: The memories keep no mutation record; only live state does

Read analysis

A graph that audits its own wiring441

basemode

A Rust binary that maps a workspace into an RDF graph and injects slices at four Claude Code hook moments — whose supersession module opens by recording, with a date and a quad count, that the predicate it implements had been declared for months and never once written.

Best idea: Comments that audit the code's own wiring, dated and counted
Main risk: The workspace key is written but not filtered on when serving

Read analysis

Approval a bearer token cannot grant442

Engraphis

Every write is stamped pending unless it came from a local agent, and the only way to approved is a browser session with a CSRF token and a written reason — so an agent cannot bless its own memory.

Best idea: Make the approver a different kind of caller
Main risk: No memory of what was refused

Read analysis

A rejection you cannot tell from silence443

OwnMem

Memory as markdown in the repository, where refusing a candidate requires a reason and keeps the summary — and the schema forbids the system from ever promoting a change to its own governance.

Best idea: Keep the refusal, keyed on what was observed
Main risk: Scope raises a score and hides nothing

Read analysis

Ten mechanisms from the psychology, one from the rubric444

AgentOS

Retrieval-induced forgetting, reconsolidation and feeling-of-knowing, each citing the paper it implements — over a store with no epistemic status, no review surface and no record of a correction.

Best idea: Cite the paper in the file that implements it
Main risk: Correction that only lowers a weight

Read analysis

A secret gate that will not quote the secret445

Memex

A Zettelkasten of markdown cards whose write and query paths both pass a credential detector — tested for what it must allow as well as what it must refuse, and asserted never to echo the token it rejected.

Best idea: Screen the query, not just the write
Main risk: Archiving records that it left, not that it was wrong

Read analysis

AS OF, in a query language of its own446

MenteDB

A Rust memory engine with a WAL, HNSW and BM25 under a query language where record time and validity are both fields — so a superseded fact is visible when you ask about a moment it was true.

Best idea: Judge a memory against the instant asked for
Main risk: The main recall takes only a query string

Read analysis

A blocklist that survives paraphrase447

CASS

Forgetting a rule writes its text to a blocklist, and any later bullet within 0.85 token overlap is blocked on merge — beside five typed audit writers with no caller outside their own tests.

Best idea: Match the blocklist fuzzily, not by hash
Main risk: A green test suite over an unwired audit log

Read analysis

The prompt was measured and replaced with a door448

Compartment

An encrypted offline vault whose audit chain anchors its own length against truncation — and whose memory-shape rule moved from the MCP handshake into a refusal after the handshake version measured a 1,938-character median.

Best idea: Anchor the chain's length outside the chain
Main risk: Supersession keyed on an id, not content

Read analysis

The ladder protects the wrong end449

Mnemo Cortex

Seals the testimony and lets the filing change — then ranks "this is false" at the bottom of the confidence ladder, where any ordinary write outranks it.

Best idea: Seal only the half that must not change
Main risk: The rejection state is the easiest to overwrite

Read analysis

The transaction clock set to the valid clock450

Lemmalog

Memory as a deductive database — proof trees, semiring provenance, scoped retraction — whose shipped tuple carries an asserted_at position every write sets equal to valid_from and no rule reads.

Best idea: A hypothetical that proves it left no trace
Main risk: The second clock is allocated, not running

Read analysis

The default account filter is a closed one451

Linggen Memory

A LanceDB memory whose account scope defaults to the owner's rows as a WHERE clause — and whose condense stage computes supersession chains mechanically, leaving the merge decision to the agent that asked.

Best idea: Default the enum to the restrictive variant
Main risk: Supersession that points forward and says nothing

Read analysis

Invalidation keyed on a hash of the file's mtime452

XERJ

A Rust search engine whose agent-memory API is one reserved index per namespace, with bitemporal graph edges over those memories — and an edge id that changes when the source file is saved, so the invalidation stops applying.

Best idea: Two clocks filled from two different sources
Main risk: A rejected claim returns under a new identity

Read analysis

A silence verdict that scored zero453

Rekal

Coding sessions captured at every commit and carried to teammates by git itself — with a committed benchmark showing the recall gate injected on all 1,888 questions and abstained on none of the 446 that had no answer.

Best idea: Rank on the drill edge, not the ranker's own output
Main risk: The abstention branch is measured dead

Read analysis

Every seam for approval except the approver454

OpenLore

Shared Markdown served to agents over SSH as a scope-filtered virtual filesystem — with a complete human-approval protocol whose only non-test callers live in three test files.

Best idea: A nested docset overrides its ancestor grant
Main risk: The approver is a plugin that isn't here

Read analysis

The absent actor role is the privileged one455

Agent-MemoryForge

A multi-tenant memory plane whose private tiers are filtered per hit against the owner stored on the record — and whose actor role defaults to system, which is on the privileged list.

Best idea: Markdown is authoritative, the index is rebuildable
Main risk: Omitting a field grants privileged reads

Read analysis

Memory built to drift456

SelMem

A memory organ that degrades what it stores on purpose — gists blur, forgotten scenes keep colouring what comes next — so that two instances on one corpus stop sharing a past.

Best idea: One text that may drift, one frozen at encode to drift away from
Main risk: The one state exempt from all of it has no writer

Read analysis

A guess waits to be confirmed457

WeKnora

An inferred memory is written pending and no prompt can reach it until a person confirms — and rejecting one records a fingerprint the extractor checks before it writes.

Best idea: A status that holds a guess out of every prompt until confirmed
Main risk: The validity interval is written at five sites and read by none

Read analysis

The key decides the scope458

Halofy

An organization memory kernel where identity comes only from the API key, every read is an enumerated list of ancestor namespaces, and every outcome is hash-chained into the audit log in the same transaction — while the write-time dispute quarantine its documents describe is never created.

Best idea: Server-owned identity and an IN-list ACL on every read
Main risk: A documented dispute quarantine with no producer

Read analysis

Draft, share, anchor459

OriginTrail DKG V10

Agent memory as RDF in three layers — a private per-agent draft, a gossip-shared graph, and chain-anchored Knowledge Assets whose trust only the protocol writes — recalled by a keyword scan that ranks by layer and never asks for trust.

Best idea: An explicit private-to-shared-to-anchored progression
Main risk: Default recall ignores the trust levels

Read analysis

A textbook that commits its receipts460

AI Agents in Depth

A book's memory chapter that builds user memory four ways and commits hashed run evidence for each on one sixty-case suite — where enhanced notes edge out the structured cards the chapter builds toward.

Best idea: An experiment ledger with hashed, credential-free receipts
Main risk: Single runs, and a fixture table that contradicts them

Read analysis

Consolidation with receipts461

dsh-mneme

A DeepSeek Harness memory plugin whose background consolidation writes a replayable receipt for every run and every merge it commits — with conflict freezing and scope isolation built, tested, and off by default.

Best idea: Content-addressed receipts for automated rewrites
Main risk: Every protection defaults to off

Read analysis

A corrections log beside the code462

widemem.ai

A Mem0-shaped Python library that never lets a medication decay, returns a confidence level so an agent can abstain, and holds its write history complete with a source-walking test — while a search with no user id reads across users.

Best idea: Claims gated by tests, corrections logged in public
Main risk: Unscoped search reads every user

Read analysis

A graph the agent thinks in463

kaeru

A Rust graph engine where an agent records hypotheses, verdicts, reviews and reasoning trails, never overwrites a node, and can read any node as it stood at a past second — along record time only, and with verdicts recall does not consult.

Best idea: Validity-keyed nodes plus an audit node per mutation
Main risk: Refuted claims recall like supported ones

Read analysis

Guidelines learned from trajectories464

ALTK-Evolve

IBM's on-the-job learning for agents: guidelines extracted from finished trajectories, merged by LLM conflict resolution, and injected as a small support-weighted dose per task — with corrections that delete rather than supersede.

Best idea: Core lessons plus a dose from similar tasks
Main risk: Conflict resolution deletes without a record

Read analysis

A governance layer over empty tables465

Open Brain

A Postgres memory service for coding agents with a full assertion model — statuses, validity windows, reviewed proposals, reversible executions, tombstones — that nothing in the service ever writes; what runs is a pgvector memory table and an event log.

Best idea: Review, apply and reverse for every automated change
Main risk: No producer for assertions, projects or tasks

Read analysis

Written only on verbatim evidence466

distill-kura

A dependency-free Python memory, one Markdown store per agent mode, where a model recalls by reading the whole index and every write must carry quotes found verbatim in the transcript — numbers from tools, decisions from the human.

Best idea: Evidence classes decide what a memory may claim
Main risk: A retired memory is still recalled

Read analysis

Governed corrections, ungoverned defaults467

Waggle

Project memory for coding agents: verbatim turns, deterministically extracted nodes with evidence spans and validity windows, and a browser workflow where a person approves the exact text of a correction — while the default hybrid query ignores validity.

Best idea: Apply only the approved text, or mark it stale
Main risk: Superseded nodes reach agents through hybrid hits

Read analysis

A vector database that gardens its memories468

KektorDB

A Go vector database with HNSW, BM25, a time-stamped property graph and an LLM gardener that consolidates and reflects — where superseded and consolidated memories are hidden by one recall tool and returned by the others.

Best idea: Evolve memories on a crash-safe engine
Main risk: Historical flags read by one tool of four

Read analysis

Retrieval measured against itself469

claude-mem-lite

A Claude Code memory plugin on one SQLite file: batched hook capture enriched by Haiku, heavily tuned FTS5 recall gated by a CI benchmark, and retractions kept as tombstones every read path excludes — though the automatic save still dedups against them.

Best idea: One live predicate, pinned by a test
Main risk: Auto-capture dedup reads tombstones

Read analysis

One brain, stored in two places470

EGC

A local runtime that installs shared memory, a command guard and a session bus into twenty coding tools — with encrypted per-branch project state beside plaintext decisions and lessons that every project’s queries return.

Best idea: Encrypted project state per git branch
Main risk: Decisions and lessons ignore the project

Read analysis

An event log that remembers what failed471

projectmem

A local-first memory for coding agents that appends every issue, attempt, fix and decision to one JSONL log, warns before a commit repeats a failure, and promotes lessons to a machine-wide store that ignores their later corrections.

Best idea: Warnings at commit time from recorded failures
Main risk: Global gotchas never learn of a supersession

Read analysis

Every summary keeps its source472

StrataGate

A DeepSeek Harness memory that seals conversation verbatim before any model call, derives decaying layers, time-aware event cards and a current-state graph from it, and reinforces only evidence an answer actually used.

Best idea: Reinforcement only from use receipts
Main risk: Superseded events injected without their status

Read analysis

A steward for engineering memory473

agent-memory-mcp

A Go MCP server for engineering agents with typed decisions, runbooks and incidents, a document index, session close as a reviewable plan and a steward that queues conflicts — whose as-of recall cannot see superseded entries.

Best idea: Session close as a plan a person can review
Main risk: Temporal recall built on a filter that hides history

Read analysis

Links that explain an answer474

VelesDB

A Rust vector, graph and columnar database whose memory server stores facts with no model call, returns the evidence trail behind a recall and compiles context under a budget — while forgotten facts leave their extracted attributes on the entity.

Best idea: No model on the write path; why() shows the trail
Main risk: Entity attributes outlive the fact that stated them

Read analysis

Three tiers composed per turn475

dsh-mnemon

A DeepSeek Harness plugin that pins one view per turn from bounded runtime memory, documents and provider-backed memory spaces, and archives overflow only after verifying every entry landed — while branch-scoped memory leaks across branches after archival.

Best idea: Host-verified archival between tiers
Main risk: Branch scope fails open

Read analysis

Owner scoping with two exits476

yantrikdb-hermes-plugin

A Hermes Agent memory provider over an in-process YantrikDB engine that scopes every recall to the agent and optionally the person — while the shared-brain mirror and id-only forget both cross the person boundary it guards elsewhere.

Best idea: Namespace from the host session, not the model
Main risk: Shared brain and forget cross owners

Read analysis

Two clocks, one fenced lane477

inite-brain

A per-tenant SurrealDB memory service whose facts carry real-world validity and knowledge time on separate columns, with a parity test binding the profile and the search lane to the same instant — while the per-user fence on the timeline and the contradiction list is off by default.

Best idea: Two clocks, pinned by a parity test
Main risk: User fence stops at the search lane

Read analysis

Rejections that stick478

goodmemory

A memory layer for installed coding agents that identifies a writeback candidate by a hash of its own content, so a sentence a person rejected is refused forever — while recall and export enforce workspace scope by two different rules.

Best idea: A tombstone keyed on content, not a row
Main risk: Two scope fences, two rules

Read analysis

Every read fenced, one write unchecked479

memorix

A local-first shared memory for coding agents that checks visibility at every seam returning a record and promotes memories only through CLI review — while the transfer tool’s import inserts arbitrary records verbatim.

Best idea: The visibility check at every read seam
Main risk: Import trusts its payload

Read analysis

Both clocks in the WHERE480

dense-mem

A self-hosted Go memory service whose recall gates real-world validity and knowledge time together and replays a claim’s transition history to answer what was believed then — while a verifier model, not a person, decides what becomes fact.

Best idea: Point-in-time status replayed from a ledger
Main risk: The governor is a model

Read analysis

A death certificate the importer reads481

loreai

An LLM proxy that distils sessions into versioned knowledge, deletes by appending a death certificate both import lanes consult, and detects contradictions without resolving them — while the approval that decides team sharing is excluded from sync.

Best idea: A deletion later writes must read
Main risk: The sharing decision is not synced

Read analysis

Validity on the edges, none on the claims482

mazemaker

A C++ and Python associative memory with a sleep-cycle consolidation engine whose supersession fires only when two similar memories carry different numbers, and which demotes the older one by half a point rather than filtering it.

Best idea: Sampling the slices recency never reaches
Main risk: Correction needs a digit, and never filters

Read analysis

A boundary the caller cannot drop483

memtomem

A markdown-first memory whose scope rule is a SQL fragment that is never empty, with a registry test that fails when a new read surface forgets it — and no status on a chunk, so belief is your repository’s history.

Best idea: A scope fragment that cannot be dropped
Main risk: The store models no belief

Read analysis

Proposals a person applies484

tracedecay

A Rust code-intelligence daemon whose fact store proposes every deletion as a review-required candidate and applies none of them alone — and then hard-deletes by policy, keeping no record that a fact was ever rejected.

Best idea: Deletions that carry their own review flag
Main risk: A hard delete leaves no record

Read analysis

A purge that later writes collide with485

titen

A Bun and SQLite memory with no model or embedding provider on any path, whose purge record makes a later claim citing that evidence fail on a primary key rather than be refused in application code.

Best idea: A tombstone enforced by a constraint
Main risk: The guard covers the first cited source

Read analysis

A fence with no test486

llm-memory-api

A Postgres memory and multi-agent deliberation service whose discussion outcomes are constrained by the database — and whose readable-namespace filter is called with the wrong arity at one of eight sites, in a permission service no test covers.

Best idea: Deliberation with a constrained outcome
Main risk: One call site wrong, no test on the fence

Read analysis

A history that says if it is intact487

demarkus

Versioned markdown over QUIC where every version is hash-chained and the history response reports whether the chain actually verified — with capability tokens the server holds only as hashes, and no model of belief at all.

Best idea: Integrity reported on the read
Main risk: Versioning is not belief

Read analysis

Narrow by default, widened on purpose488

people-context

A local-first store of memory about the people in your life, where a four-level sensitivity bounds what an ordinary read discloses and imports stage for review, committing only by the ids a person names.

Best idea: The narrow set is the default
Main risk: Personal data no mechanism can consent for

Read analysis

Two halves, one detached HEAD489

state-memory-mcp

A deterministic SQLite graph for workflow state that logs both sides of every mutation — and on a detached HEAD reads nothing while writing under main, with neither half reporting it.

Best idea: Before and after in one event row
Main risk: Read and write disagree, silently

Read analysis

One rule, keyed on the operation490

the-librarian

A markdown-and-git vault curated by a resident agent, where every apply-propose-skip verdict comes from one function keyed on what the operation does rather than on what the model said about its own risk.

Best idea: Never ask the model to grade its own edit
Main risk: Confidence alone still decides a merge

Read analysis

The database holds the ACL491

akb

A git-backed knowledge vault where agents run their own SQL and PostgreSQL enforces vault isolation through a transaction-scoped role — with a token scope that intersects the user ACL and can only subtract.

Best idea: Enforcement in the database, not the app
Main risk: A scoped token bounds writes, not reads

Read analysis

A write boundary in a comment492

jaz

A personal always-on agent host whose memory injects two horizon files every turn — one documented as dream-maintained and read-only for agents, though neither write path distinguishes it from the other.

Best idea: Inject the considered view, don’t retrieve it
Main risk: Nothing enforces the read-only horizon

Read analysis

Recency read off a moving position493

agentrt

A C11 agent-runtime substrate whose memory daemon keeps records in a fixed-size array and reports newest-first by array position — which its swap-with-tail delete permanently scrambles.

Best idea: A context ledger with replayable transitions
Main risk: One delete destroys the recency order

Read analysis

An evidence model, and two ways past it494

inno-agent

A personal learning agent that derives mastery from typed, weighted evidence and gates teaching on a misconception status — beside two tools that write the same fields with none of that discipline.

Best idea: Weight evidence by what the learner did
Main risk: Evidence ids nothing ever resolves

Read analysis

Approval as a state, not an event495

oh-my-hermes

An operating layer over Hermes Agent where nothing reaches a prompt without an admission state — staged, decided per item, and re-checked at the write and again at replay.

Best idea: Re-check admission at the point of use
Main risk: The evidence expires before the state

Read analysis

One concept, two lifecycle columns496

bitterbot-desktop

A local-first agent whose knowledge graph does real as-of belief revision, and whose chunk store carries two lifecycle columns whose mappings are not inverses.

Best idea: Close the interval, keep an as-of read
Main risk: A filter on a value its column never holds

Read analysis

The limits are in the doc comment497

yantrikdb-engine

The embeddable Rust engine behind YantrikDB’s server and Hermes plugin: decay, consolidation and an as-of recall whose header lists the three things it cannot reconstruct.

Best idea: Reading history must not count as use
Main risk: Scope is an Option, not a guarantee

Read analysis

Coverage as a compile error498

nodedb

A multi-model database pitched as agent memory, whose row-level policies are injected into physical plans by a walker exhaustive over every engine’s own op enum.

Best idea: An un-run check reads as “never ran”
Main risk: The memory vocabulary has no code behind it

Read analysis

Unknown renders as most certain499

openconcho

A desktop and web client for self-hosted Honcho that browses, creates and permanently deletes the conclusions a memory server has drawn about you.

Best idea: A delete button on an inferred belief
Main risk: A missing level renders as explicit

Read analysis

Tier three is an LLM500

ox

A CLI whose team memory is a shared git repository, where a conflict the safe-prefix rule won’t touch is merged by an LLM that only has to remove the conflict markers.

Best idea: A rule documented with its evidence
Main risk: The merge check is syntactic only

Read analysis

A test that parses its own source501

maximem-synap-sdk

Client SDKs for a hosted memory service, where Python proves every method taking a customer id checks it by walking its own AST — and TypeScript ships the guard without the proof.

Best idea: Assert coverage, then assert it isn’t vacuous
Main risk: The other SDK misses two call sites

Read analysis

The count nobody reads502

syke

A local memory agent that brackets every unsupervised LLM rewrite of its graph with a fingerprint, a snapshot and a gate — which counts the memories deleted and raises nothing.

Best idea: A creation time that may not change
Main risk: Deletion is outside the gate

Read analysis

Index the shape, not the secret503

sivtr

A Rust memory space over the terminal output and agent transcripts already on your disk, which records that a session holds credential-shaped strings without storing them.

Best idea: One scan, two outputs, two paths
Main risk: The eval corpus isn’t committed

Read analysis

Two status axes, not one504

eliot-memory-os

A pre-alpha Rust control plane whose claim cards separate how well founded a belief is from whether it is live, and which let only an operator promote a candidate.

Best idea: Epistemic status apart from lifecycle
Main risk: Every invariant lives in Rust alone

Read analysis

Its own numbers, tested505

neuralmind

Persistent memory and context compression for coding agents, with a hash-chained audit that survives rotation and a test refusing any website ratio without a reproduction command.

Best idea: Gate published claims in CI
Main risk: A hole in the chain verifies clean

Read analysis

The retired value, refused on return506

inspeximus

An agent memory that keeps a ledger of the values each key has retired and retires a matching write on arrival — with the guard’s own defeat condition in the comment above it.

Best idea: A tombstone keyed on the value
Main risk: An echo that hides the value gets through

Read analysis

A closed interval stays closed507

pi-memory

A Pi extension whose facts carry a validity interval apart from when they were recorded, and whose resolve path refuses to move a contradicted fact back to a live standing.

Best idea: Terminal means terminal, with the alternative
Main risk: Retrieval labels instead of withholding

Read analysis

No delete, and a notice with every answer508

mandalore

A Git-backed memory where every change is a new validated revision with its author and reason, nothing can be deleted, and recall tells the model that absence is not proof.

Best idea: Put the disclaimer in the payload
Main risk: The privacy label is never honoured

Read analysis

The wire never writes your verdict509

kannaka-memory

A hyperdimensional swarm memory whose prose promises wave interference, and whose single write chokepoint refuses to let a remote peer set or clear the hallucination flag.

Best idea: Overwrite the flag, don’t validate it
Main risk: A bespoke non-OSI licence

Read analysis

It ablated its own memory510

chump

A fleet coordinator that shipped a flag to switch its own memory injection off, ran the A/B, and published the null — then checked a second way and agreed with itself.

Best idea: Build the off-switch, publish the null
Main risk: The results moved to a private repo

Read analysis

The decay policy in one table511

longterm-memory-mcp

A fully local MCP memory server whose forgetting is a six-row half-life table with floors and protected tags, persisted only when the change crosses half a point.

Best idea: A decay policy a user can read
Main risk: Nothing in it is epistemic

Read analysis

Corroboration must cross a source class512

agent-memory-guard

A defensive middleware that wraps a host’s memory writes with eleven detectors, including one that refuses to let an agent corroborate itself — if the caller labels the write.

Best idea: A restatement is not a second source
Main risk: Unlabelled writes skip the check

Read analysis

Hidden survives a rewrite513

a-memory

A four-tier local store where a re-save with no visibility argument re-reads the stored flag, so a quarantined key cannot be un-hidden by writing to it again.

Best idea: A missing argument keeps the stored flag
Main risk: The ledger drops rows silently

Read analysis

An update the input cannot request514

memex

A Markdown memory for coding agents with a CI gate that fails when memory went unused, and a write path where every call makes a new page because no input carries a slug.

Best idea: Memory activity as an exit code
Main risk: Nothing can update a memory

Read analysis

A guard that expects to be evaded515

yacmemo

A Markdown memory server that strips the dates and –2 suffixes off a title before checking it for duplicates, counts every override, and hides nothing from search.

Best idea: Normalise away the evasion first
Main risk: Git is the only complete record

Read analysis

A gate that declines to decide516

levh

A decaying local memory whose admission gate holds the candidates it will not judge in a queue that no shipped client can drain.

Best idea: Two refusals, two different paths
Main risk: No surface drains the queue

Read analysis

A claim about authority is not authority517

anda-db

A Rust knowledge-graph memory where grants are rows the query language cannot reach, belief is computed rather than stored, and erasing a source blocks its digest from ever being re-published.

Best idea: Content cannot grant authority
Main risk: No smaller entry point exists

Read analysis

A filter reading fields nothing writes518

temporalstore

A serious Rust storage engine with a ranked context pack above it, whose validity field has no writer and whose headline token saving divides by a corpus the baseline never read.

Best idea: Lexical and cosine on one scale
Main risk: Deprecated fields still filtered on

Read analysis

Hidden and absent answer alike519

mushroomdb

An embedded graph where a relationship is a rule that derives and retracts its own edges with the evidence attached, and a role token’s mask can only ever be narrowed.

Best idea: Every permission failure denies
Main risk: MCP takes the role as an argument

Read analysis

One rule, one place, every path520

flair

An identity and memory substrate whose read-scoping lives in a single helper, written that way after the same rule, copied per path, leaked one agent’s memories to every other.

Best idea: The scattered rule was the leak
Main risk: Only “private” separates agents

Read analysis

Proving absence by building the other corpus521

theurian

A read-only decision record whose absence proof compares three deployments on the wire, so a withheld row cannot be inferred from a count, a score or a page boundary.

Best idea: Absence proved, not asserted
Main risk: Nothing checks the merge happened

Read analysis

Ignored means quieter, not louder522

yantrik-os

A desktop OS whose shell is an agent, with an LLM-free cognition loop whose speaking threshold rises when its suggestions go unheeded.

Best idea: Ignored raises the bar
Main risk: The memory lives in another repo

Read analysis

The first writer is the source523

huiran-cerebro

A single-file personal memory hub whose dedup marks the later duplicate merged instead of deleting it, keeps the earlier one, and shows you the pairs before it acts.

Best idea: Mark the duplicate, keep the first
Main risk: No tests under an in-place pass

Read analysis

It strips its own context block524

light-mem

A hook-driven memory for four coding agents that redacts before storing, removes its own injected block so it cannot re-ingest itself, and tells a missing prompt from a redacted one.

Best idea: Do not re-ingest your own output
Main risk: Two stores, one audit log

Read analysis

A promise the filename cannot keep525

bifrost

An agent runtime whose 148-line memory layer keys one Memvid file per session, under a tool that tells the model it is searching its absolute long-term memory.

Best idea: Read key and write key agree
Main risk: Session is in the filename

Read analysis

Provenance you cannot leave blank526

mnemora

A cognitive layer for underneath an agent framework, where a memory’s origin is the tag of a union rather than a flag, and a contested memory is still recalled.

Best idea: Provenance as a type, not a field
Main risk: The tenant string is the caller’s

Read analysis

A veto is an Option, not a zero527

chitta-field

An SDR-backed associative memory whose excluding statuses return None rather than a low weight, and whose contradiction detector compares claims instead of text.

Best idea: Exclusion the compiler can check
Main risk: The hash chain is per writer

Read analysis

It tells you what it held back528

mnemonic

A markdown-and-git memory server whose recall reports how many weak matches it suppressed and whether it widened — and where omitting the scope is the stricter path.

Best idea: Disclose the suppressed count
Main risk: Superseded only fades faster

Read analysis

Guards that say what they are not529

nougenshards

A local memory that harvests other AI tools’ traces into encrypted SQLite, redacts before embedding, and labels its sandbox and denylist as speed bumps rather than boundaries.

Best idea: A guard that disclaims itself
Main risk: One store, everything, no isolation

Read analysis

No approval banked in advance530

edda

A tamper-evident ledger for coding agents that refuses to write a chain break, keeps capability material out of its events, and ignores any verdict recorded before the gate opened.

Best idea: Subject, commit, and a time window
Main risk: The approver is a label

Read analysis

Declare how you knew, not how sure531

osiris

An event-sourced entity graph where a fact’s confidence is a projection of how it was obtained, and corroboration is recomputed at read time rather than stored.

Best idea: Corroboration nobody can claim
Main risk: Classes rank, never withhold

Read analysis

It says what the baseline already wins532

holo-invariant

A continuity framework whose benchmark pins its fixture by hash, scores the naive alternative on the same target, and publishes which metrics that alternative passes.

Best idea: Score the trivial baseline too
Main risk: Not a store an agent writes to

Read analysis

A flag the caller cannot write533

codemem

A coding memory whose semantic search has the scope-enforcement flag removed by type, and whose attribution layer refuses a causal claim without a preregistered randomized contrast.

Best idea: Subtract the flag from the type
Main risk: The epistemics are not yet wired

Read analysis

The exit shipped before the entrance534

tessellum

A typed-note knowledge system whose re-derivation gate blinds the claim, pins the model so it cannot certify itself, and quarantines rather than retracts when it cannot tell.

Best idea: Demotion before promotion
Main risk: Not a store an agent writes to

Read analysis

A fact gets a table, not a threshold535

neoth

A local-first AI daemon whose operator-asserted facts live in a decay-immune table ordered ahead of episodic memory, and drop out of recall when a contradiction demotes them.

Best idea: An importance score is not a fact
Main risk: Scope tags, it does not isolate

Read analysis

The disclosure was the leak536

hungry-hippa

A local memory runtime that reports what it excluded and why — and whose own test suite records that, to an unauthorised caller, that report answered whether a memory exists.

Best idea: Identity decides, never a label
Main risk: The log is code, not a trigger

Read analysis

A malformed ACL grants nothing537

cortana

A local-first second brain whose search validates each row’s access list in SQL before matching it, and which starts query-only until each capability is separately authorised.

Best idea: Check the ACL’s shape, then match
Main risk: The approver is a string

Read analysis

The build checks the README’s numbers538

cortex-hypermnesia

A local memory server with no model in the retrieval loop, supersession published as a view, and a CI gate whose exemption list is itself pinned by a test.

Best idea: Gate your own advertised counts
Main risk: Curation is automated, not human

Read analysis

Two time axes, one clock539

engram-cognitive

A single-file Python memory with episodes, superseded facts and an entity graph, whose published numbers are recomputed by a CI gate and whose gates are pinned to the release workflow by a test.

Best idea: Test that the gates run where bytes ship
Main risk: One clock writes both time columns

Read analysis

Now is AsOf(now), not a branch540

claudinio-brain

A bitemporal knowledge graph in one SQLite file where valid time comes from the caller, a retraction means never-true rather than no-longer-true, and a linter reports facts retrieval cannot reach.

Best idea: One read arm for now and then
Main risk: Scope is an argument you can forget

Read analysis

Its negative set was inside its own corpus541

re-call

Agent memory on your own PostgreSQL where every hit carries one of eleven verdicts, strict mode refuses instead of answering, and 162 dated preregistrations say what was going to be measured.

Best idea: Measure whether you ingest your own eval set
Main risk: A degraded mode that still ships

Read analysis

The trust field that promotes542

okf-agent-memory

An Open Knowledge Format implementation keeping memory as repository markdown, where status and staleness are validated but never read, and governance multiplies the rank instead.

Best idea: A log the MCP path cannot switch off
Main risk: Deprecated ranks like stable

Read analysis

The database is a replay543

loreweave

A temporal knowledge engine over a markdown vault where fact lines are the durable record, queried by both valid time and transaction time, and the index can be wiped and rebuilt.

Best idea: Make the index disposable
Main risk: No scope key anywhere

Read analysis

It publishes the bypass that works544

temvera

A PVLDB artifact whose reference substrate is a bitemporal belief ledger with signed evidence and crypto-shredded payloads, beside a harness that rechecks every printed figure offline.

Best idea: Commit the attack that succeeds
Main risk: Nothing reads the deletion receipts back

Read analysis

An empty scope shows the global layer545

mindreader

A Rust MCP memory over Neo4j where the agent curates what it keeps, visibility is checked on both endpoints of every relationship, and correction edges are barred from search.

Best idea: Omitting the scope narrows, not widens
Main risk: The epistemic tiers only rank

Read analysis

An audit chain that forgets on purpose546

verimem

An AGPL memory where writes pass an admission gate, recall SQL drops three stored statuses, and the hash-chained mutation log records the deletion without recording what was deleted.

Best idea: Keep content out of the immutable chain
Main risk: Scope is assembled by the caller

Read analysis

The predicate test parses your source547

anatid

A DuckDB memory whose tenant and bitemporal predicates live in one module, whose indexes may only narrow, and whose erasure chases copies outside the memory graph.

Best idea: Fail the build on a hand-written predicate
Main risk: Time is the only axis of doubt

Read analysis

Only the human may settle it548

memhtml

A git tree of semantic HTML, one fact per file, with a rebuildable index, four arms sharing one scope filter, and a curation pass that commits to a branch only a person may merge.

Best idea: Curation arrives as reviewable diffs
Main risk: The audit trail is git history

Read analysis

Both axes, one read path549

bwmem

A per-user memory SDK on Postgres whose facts carry both time axes, whose database-constrained status keeps three of four values out of every read, and whose corrections table names both values.

Best idea: The as-of read is the ordinary read
Main risk: Nothing purges the corrections log

Read analysis

The approver is resolved, not asserted550

huqan

A local gate between what an agent proposes and the state it would change, where a memory write is held until an authenticated person decides and every decision leaves a receipt.

Best idea: Never take the approver from the request
Main risk: It needs two people to mean much

Read analysis

Keep what the merge destroyed551

ontomem

A consolidating memory that merges extractions into one record per key, with a ledger of pre-merge inputs so removing a document re-merges the survivors instead of deleting everything it touched.

Best idea: Exact rollback from kept inputs
Main risk: A record cannot say it is doubtful

Read analysis

One hard question:what should an agent remember?

Retrieval is only half the memory problem.

Evidence before belief

Scope before ranking

Correction before scale

Steal the architecture,not the product.

Rejected-value tombstone

Evidence before belief

Hybrid retrieval fusion

Scope as a first-class key

Start where your problem is.

Profile, stages, acceptance tests

Which ones actually do X

The full comparison

Choose a system to inspect.

Mem0

LangMem

Honcho

Engram

MemPalace

Swafra

llm-wiki-memory

RainBox

Letta

Supermemory

Verel

Hindsight

Graphiti

Mastra Observational Memory

MemOS

Basic Memory

agentmemory

TencentDB Agent Memory

Cognee

Claude-Mem

A-MEM

Holographic

Hermes Agent

OpenViking

Redis Agent Memory Server

ByteRover

OpenClaw

HippoRAG

Voyager

Generative Agents

Magic Context

Pi

MetaClaw

nanobot

CowAgent

GenericAgent

open-cowork

Gini Agent

Moltis

Mercury Agent

LlamaIndex

Atomic Agent

MateClaw

Waku Agent

Memora

LoongFlow

Core Memory

Memanto

Memory Engine

ai-memory

ctx

OptMem

Memvid

MemoryOS

memU

OpenWorker

Qwen Code

OpenCode

NOOA Memory

Neo4j Agent Memory

Elastic Atlas

NemoClaw

Daimon

MIRIX

Memobase

One hard question:
what should an agent remember?

Steal the architecture,
not the product.