A field guide to agent memory

One hard question:
what should an agent remember?

A code-grounded atlas of how open-source memory systems capture, store, retrieve, correct, forget, and trust the context that shapes an agent.

Open the comparison Browse the systems

Every analysis is pinned to an exact Git commit, so claims stay auditable as repositories evolve.

Every system in this atlas builds the ascent. Almost none completes the descent — which is why correction, not retrieval, is where memory fails.

129reports, over 128 repositories

14implementation paths per review

100%commit-pinned analysis

20reusable design patterns

The central finding

Retrieval is only half the memory problem.

Evidence before belief

The strongest systems preserve the raw event, message, or document before compressing it into a durable claim. Without evidence, correction becomes guesswork.

Read the design pattern

Scope before ranking

A beautifully ranked memory from the wrong user, project, or agent is still a serious failure.

Correction before scale

Update APIs are not enough. Serious memory needs contradiction, supersession, rejected values, and deletion that reaches every derived artifact.

The pattern library

Steal the architecture,
not the product.

Reusable patterns distilled from the implementation evidence: when they work, where they fail, what to test — and, for the ones only one or two systems implement, that the atlas is arguing rather than reporting.

01 Correction

Rejected-value tombstone

Keep negative memory so a known-wrong value cannot quietly return through extraction.

Explore pattern → 02 Provenance

Evidence before belief

Persist the source event before deriving the compact claim that shapes agent behavior.

Explore pattern → 03 Retrieval

Hybrid retrieval fusion

Combine semantic recall, exact matching, metadata, and bounded reranking.

Explore pattern → 04 Boundaries

Scope as a first-class key

Make ownership part of identity and access before relevance is ever scored.

Explore pattern →

Browse the pattern library

Ten minutes, three ways in

Start where your problem is.

Building a memory layer

The smallest serious stack

Four patterns in dependency order, each one making the next enforceable — and what you can safely defer.

Pattern library Choosing between systems

Which ones actually do X

Every reviewed system against the seven capabilities, filterable, with a link straight to the analysis.

Capability index Studying the field

The full comparison

Inclusion rule, the five divergences that matter, the lifecycle comparison, and commit-pinned evidence for all of it.

Comparative report

The repository atlas

Choose a system to inspect.

Has

Library-first01

Mem0

Pragmatic extraction, pluggable stores, hybrid retrieval, and a clean SDK surface.

Best idea: Additive extraction pipeline
Main risk: Extracted fact ≠ verified truth

Read analysis

Library primitives02

LangMem

Small, framework-native tools for managing structured memory and background reflection.

Best idea: Schema-driven store tools
Main risk: Policy remains application-owned

Read analysis

Representation service03

Honcho

Message streams become peer-centric observations and a compact working representation.

Best idea: Events → working representation
Main risk: Operational and consistency cost

Read analysis

Coding-agent local04

Engram

A compact SQLite and FTS5 memory with purposeful MCP tools and conflict-oriented writes.

Best idea: Topic-key upserts + conflict surfacing
Main risk: Agent discipline drives quality

Read analysis

Verbatim evidence05

MemPalace

Original text stays authoritative; extracted indexes guide retrieval without hiding evidence.

Best idea: Drawers are the retrieval floor
Main risk: Large, noisy raw stores

Read analysis

Compact graph-RAG06

Swafra

A tiny local hybrid retriever that now supersedes facts instead of deleting them — and re-asserts them the moment a new session mentions them again.

Best idea: Correction that reaches the ranker
Main risk: Supersession undone by the next session

Read analysis

Filesystem + git07

llm-wiki-memory

Inspectable Markdown memory with recoverable capture, explicit targets, and operational depth.

Best idea: Recoverable lifecycle capture
Main risk: Active atoms lack trust state

Read analysis

Operator-governed08

RainBox

Claims and evidence meet governed writes, rejected tombstones, review UI, and retrieval telemetry. The atlas author's own project — read as a self-assessment.

Best idea: Memory governance loop
Main risk: Compact claims lose nuance

Read analysis

Agent runtime09

Letta

Core, archival, and conversation memory are first-class parts of the running agent.

Best idea: Core vs archival vs recall
Main risk: Agent-editable core lacks trust model

Read analysis

Hosted product10

Supermemory

A polished public surface around documents, chunks, spaces, profiles, SDKs, and MCP.

Best idea: Product-grade API shape
Main risk: Core backend is a black box here

Read analysis

Verification-first11

Verel

Memory is an epistemic problem: candidate, verified, rejected, corroborated, and defensively recalled.

Best idea: Trust and usefulness are separate
Main risk: Correctness has a complexity cost

Read analysis

Memory service12

Hindsight

Source-backed facts and observations meet semantic, lexical, graph, and temporal recall.

Best idea: Four-arm task-specific fusion
Main risk: Derived belief lacks truth state

Read analysis

Temporal graph13

Graphiti

Episodes become a bi-temporal entity graph that preserves changing facts and history.

Best idea: Fact validity ≠ ingestion time
Main risk: Graph mistakes have wide impact

Read analysis

Context compaction14

Mastra Observational Memory

Messages become dated observations, reflected and pre-buffered before context limits bite.

Best idea: Range-aware buffered activation
Main risk: Progressive summary drift

Read analysis

Memory substrate15

MemOS

Mountable cubes span textual, preference, skill, KV-cache, and parametric memory.

Best idea: Heterogeneous memory cubes
Main risk: Uneven module guarantees

Read analysis

Canonical Markdown16

Basic Memory

Human-editable notes stay authoritative while graph and hybrid-search indexes remain rebuildable.

Best idea: Source-of-truth projections
Main risk: Bidirectional sync complexity

Read analysis

Hook-native runtime17

agentmemory

Cheap lifecycle capture meets compact-first BM25, vector, and graph recall.

Best idea: Zero-LLM capture + expandable search
Main risk: Fuzzy supersession and broad surface

Read analysis

Layered symbolic context18

TencentDB Agent Memory

Raw conversations, structured records, scenes, persona, and navigable tool-output maps.

Best idea: Progressive disclosure with drill-down
Main risk: Non-atomic stores and thin core tests

Read analysis

Knowledge-graph platform19

Cognee

Source-preserving pipelines build ontology-aware graph, vector, summary, and session memory.

Best idea: Provenance-aware pipeline rollback
Main risk: Cross-store and policy complexity

Read analysis

Hook-native sidecar20

Claude-Mem

A durable hook queue feeds structured observations and bounded project timelines across sessions.

Best idea: Commit before queue acknowledgement
Main risk: Generated observations activate directly

Read analysis

Evolving linked notes21

A-MEM

An LLM links new notes and revises nearby metadata in a compact Zettelkasten-inspired prototype.

Best idea: Adaptive note organization
Main risk: Rank position used as identity

Read analysis

Vector-symbolic22

Holographic

Facts become holographic phase vectors, so entities can be queried algebraically instead of by keyword.

Best idea: Deterministic hash-derived vectors
Main risk: Downvotes silently delete memory

Read analysis

Bounded runtime23

Hermes Agent

Hard-capped Markdown memory frozen into the prompt at session start to keep the cache warm.

Best idea: Frozen snapshot, consolidate in-turn
Main risk: Model writes are instantly authoritative

Read analysis

Context database24

OpenViking

Memory, resources, and skills share one filesystem hierarchy with three retrievable granularities.

Best idea: Hotness kept apart from truth
Main risk: Published numbers lack raw artifacts

Read analysis

Memory service25

Redis Agent Memory Server

TTL-scoped working memory promotes into deduplicated long-term memory with a real retention policy.

Best idea: Composite forgetting policy
Main risk: Deletion without tombstones

Read analysis

Curated knowledge26

ByteRover

A deterministic guard counts what an LLM rewrite would delete, then merges the loss back in.

Best idea: Structural-loss guard on rewrites
Main risk: Elastic License, not open source

Read analysis

Plugin memory27

OpenClaw

Memory ships as swappable extensions, with heavy work spent keeping the runtime's own envelope out of it.

Best idea: Scope that cannot be dropped
Main risk: Vector-only reference backend

Read analysis

Associative graph28

HippoRAG

Seeds a knowledge graph with query entities and lets PageRank diffuse relevance instead of planning hops.

Best idea: Diffusion instead of traversal
Main risk: No scope, trust, or temporal model

Read analysis

Procedural skills29

Voyager

Memory is a library of executable skills, written only once the environment confirms they worked.

Best idea: Verified-execution write gate
Main risk: Frozen 2023 artifact; no failure memory

Read analysis

The ancestor30

Generative Agents

The observation, reflection, and planning stream whose importance-recency-relevance score everything else still echoes.

Best idea: Reflection triggered by significance
Main risk: Its famous weights are hand-tuned

Read analysis

Verified memory31

Magic Context

Maps each memory to the files it describes and re-verifies it when git says those files changed.

Best idea: Verification against real code change
Main risk: No tombstones; large surface

Read analysis

Session substrate32

Pi

A branchable JSONL session tree with deterministic compaction manifests — and no memory contract at all.

Best idea: Deterministic file manifest on compaction
Main risk: Every plugin reinvents memory

Read analysis

Self-tuning policy33

MetaClaw

Replays past turns against candidate retrieval policies and promotes one only when it beats the incumbent.

Best idea: Promotion gate for retrieval policy
Main risk: Optimizes overlap proxies, not outcomes

Read analysis

Dual-cursor files34

nanobot

An append-only summary archive with separate write and consume cursors, and a Dream pass that won't advance after tool errors.

Best idea: Don't advance a cursor after failure
Main risk: Durable claims lack provenance

Read analysis

Daily distillation35

CowAgent

Conversations become dated daily files, then a nightly Deep Dream distils them into a ~30-entry MEMORY.md.

Best idea: Dated intermediate layer
Main risk: Newer-always-wins correction

Read analysis

Memory as policy36

GenericAgent

Four layers governed by written axioms — nothing enters memory that did not come from a successful tool call.

Best idea: ROI test for permanent context
Main risk: Prose rules, no enforcement

Read analysis

Evaluated memory37

open-cowork

Ships a memory benchmark that asserts what recall must not surface, not just what it must.

Best idea: Forbidden-hit eval assertions
Main risk: Harness committed, results are not

Read analysis

Reimplemented model38

Gini Agent

A local rebuild of the Hindsight model with bi-temporal units, rejected and conflicted states, and decisions kept as ADRs.

Best idea: Memory decisions written as ADRs
Main risk: Conflict state with no workflow

Read analysis

Local file corpus39

Moltis

Markdown chunked, embedded, and hybrid-searched, with sanitized session transcripts fed back into the corpus.

Best idea: No-embeddings mode as a constructor
Main risk: Transcripts rank beside curated notes

Read analysis

Graded personal40

Mercury Agent

Grades every memory on confidence, importance, and durability, with a subconscious tier and a learning pause switch.

Best idea: Durability split from importance
Main risk: Dismissal without a tombstone

Read analysis

Composable blocks41

LlamaIndex

One token budget split between chat history and pluggable memory blocks that each truncate themselves.

Best idea: Self-truncating memory blocks
Main risk: Capture depends on conversation length

Read analysis

Evaluated fabric42

Atomic Agent

Numbered invariants cited from the schema, append-only vote events, and new memory features shipped off by default.

Best idea: Invariants as referenced artifacts
Main risk: Campaign results not committed

Read analysis

Scoped provider SPI43

MateClaw

A provider contract that carries the owner key on every call, with retry and metrics added as decorators.

Best idea: Scope on the provider contract
Main risk: Still no deletion hook

Read analysis

Gated memory44

Waku Agent

A small model decides whether to retrieve at all, because irrelevant memory bends the answer.

Best idea: Abstaining from retrieval
Main risk: The gate itself is unmeasured

Read analysis

Rehearsable correction45

Memora

The supersession sweep defaults to a dry run, so a correction pass can be read before it changes anything.

Best idea: Correction you preview first
Main risk: Hidden, not tombstoned

Read analysis

Stochastic recall46

LoongFlow

The only memory here that samples instead of ranking — temperature set by how varied the store has become.

Best idea: Diversity drives the temperature
Main risk: Recall is not reproducible

Read analysis

Grounding-gated trust47

Core Memory

How a record is known sets a ceiling on how trusted it can ever become, so use alone cannot make a guess canonical.

Best idea: Grounding caps the trust ladder
Main risk: Correction is record-keyed

Read analysis

Resolved conflict48

Memanto

The only conflict pipeline here that ends in a decision — including "both are true" and a human-written reconciliation.

Best idea: Conflicts get resolved, not flagged
Main risk: Deletion without a tombstone

Read analysis

Agents as principals49

Memory Engine

The agent has its own credentials and grants, and a clamp makes over-granting it harmless by construction.

Best idea: Agent grants clamp to their owner
Main risk: Governs access, not truth

Read analysis

Cross-harness handoff50

ai-memory

A handoff that expires, addressed between harnesses, carrying the open questions rather than the conclusions.

Best idea: Memory of what is not known
Main risk: Re-capture undoes deletion

Read analysis

Guarded consolidation51

ctx

The background pass may only write where it is sanctioned to, and the tests include a corruption corpus from a published paper.

Best idea: A write scope for the nightly job
Main risk: Folding away is not forgetting

Read analysis

No background work52

OptMem

860 lines, a log the code never edits, and detail that decays with age by geometry instead of policy.

Best idea: Consolidation asked, never scheduled
Main risk: No licence; nothing is fixable

Read analysis

Rewindable memory53

Memvid

Immutable frames in one file, so a fact can be read as of last March and a whole session can be replayed.

Best idea: Time travel from the format
Main risk: Loud claims, no artifacts

Read analysis

Heat-promoted tiers54

MemoryOS

The tiered architecture at its most legible — and its promotion score cannot tell importance from verbosity.

Best idea: The promotion rule is written down
Main risk: One scalar, three signals

Read analysis

Documented decisions55

memU

Ranks the slice and returns the file, and writes down why each schema decision was made.

Best idea: Search unit ≠ return unit
Main risk: Seven hosts, no scope key

Read analysis

Policy over machinery56

OpenWorker

260 lines of memory and one paragraph of policy — written because models without rules either never save or save noise.

Best idea: The when-to-remember policy
Main risk: Nothing enforces it

Read analysis

Team memory in git57

Qwen Code

Shared memory distributed by git pull, with secret-bearing writes refused even when the tier is switched off.

Best idea: A guard the flag cannot disable
Main risk: Forget does not survive re-extraction

Read analysis

Hooks, no contract58

OpenCode

The two hooks a memory plugin needs, both experimental, and no memory contract — so plugins read the database instead.

Best idea: A compaction hook
Main risk: Plugins couple to the schema

Read analysis

Cognitive-model recall59

NOOA Memory

ACT-R activation and the Ebbinghaus curve, with the score components of every retrieval stored on the record.

Best idea: Retrieval explains itself later
Main risk: The access log is capped

Read analysis

Memory of its own reasoning60

Neo4j Agent Memory

A third tier that records how the agent reasoned — and stores the failures, because the control flow catches them.

Best idea: Failures stored by default
Main risk: Bi-temporal only for preferences

Read analysis

Evaluated demo61

Elastic Atlas

A demo that measures itself more than most production systems here — a recall eval matched on id, plus a stress test.

Best idea: An eval you can rerun
Main risk: Ungated consolidation

Read analysis

Memory as an operand62

NemoClaw

Sandboxes other agents and snapshots their memory — credentials get scrubbed on backup, memory does not.

Best idea: A declared state contract
Main risk: Restore reinstates deletions

Read analysis

Verified quotes63

Daimon

Every memory is marked verbatim or inferred — and the quote is grepped against the transcript before the label sticks.

Best idea: Code falsifies the trust label
Main risk: One checkpoint is the memory

Read analysis

Scope tested by exclusion64

MIRIX

Six memory types, six writer agents, and the atlas's third test asserting a memory must not come back — reached through access control, not memory research.

Best idea: The cache query carries the scope key too
Main risk: A periodic pass hard-deletes what it rewrites

Read analysis

Scope in the primary key65

Memobase

The smallest useful description of a user — five sentences a subtopic, a token-budgeted context block, and the transcript deleted once it has been read.

Best idea: Tenant key in every primary key
Main risk: The evidence is gone by default

Read analysis

Reinforcement, inverted66

Memary

Forty lines of reinforcement by frequency — and the one line that reads the counts sorts ascending, so the rarest entities are the ones injected.

Best idea: Salience and belief kept apart
Main risk: A recall miss becomes a permanent belief

Read analysis

Provenance by foreign key67

Memori

Every fact names the conversations that produced it — and the dedupe key strips all non-ASCII, so facts in other scripts collapse into one row.

Best idea: Durable turn, best-effort extraction
Main risk: One hash for every non-Latin fact

Read analysis

Publishes its worst score68

ReMe

Committed per-category benchmark tables including a 26.7% and a 0.100 — plus CREATE/CORROBORATE/REFINE/CORRECT as a validated verb set.

Best idea: Corroboration as a first-class action
Main risk: The verb is checked, the edit is not

Read analysis

Forgetting curve69

PowerMem

Promote, archive, forget and reinforce as four separate decisions — evaluated during search, so reading a memory changes it.

Best idea: Decay rate varies by memory type
Main risk: The history table has no callers

Read analysis

Commitments, inferred70

MineContext

Watches your screen and writes down what it decides you promised — the second system here to model prospective memory, and the first to guess at it.

Best idea: Event time allowed to be future
Main risk: No tests, and no way to reject a todo

Read analysis

Outcome-gated learning71

Acontext

Nothing is learned until a task reaches success or failed — and three committed tests assert that a running task writes nothing.

Best idea: The execution gate, with tests
Main risk: A deleted skill can be re-distilled

Read analysis

Memory in weights72

Second Me

Documents to a versioned biography to LoRA weights — the atlas's only parametric memory, and the only place deleting a memory cannot reach the belief.

Best idea: The derived layer is numbered
Main risk: Deletion stops at the vector store

Read analysis

Staged by rename73

TigrimOSR

A proposed skill waits on disk beside the live one, carrying its rationale and sources — but say no and nothing remembers you did.

Best idea: Approval escalates on who wrote it
Main risk: Rejections die with the process

Read analysis

Citations that resolve74

MemMachine

Keeps every raw episode and cites it from each derived fact — then acknowledges a session deletion it has only queued.

Best idea: Provenance you can actually follow
Main risk: Deleted is reported before it is true

Read analysis

Blinded index75

Buzz

The relay holding your agent's memory cannot read it, and cannot tell which memory it is holding — but it throws away every version it replaces.

Best idea: HMAC the index, not just the payload
Main risk: Replaceable events keep no history

Read analysis

User-defined schema76

Logseq

The only store here whose memory schema belongs to the user — and the agent writes into it live, unmarked, with no way to delete what it got wrong.

Best idea: The user defines what a memory is
Main risk: Agent writes are indistinguishable

Read analysis

Taint-gated memory77

OpenHuman

Every memory carries where it came from, and that label decides what it is allowed to cause — the atlas's only answer to memory as an injection surface.

Best idea: Label blast radius, not just belief
Main risk: Delete, re-sync, and it is back

Read analysis

Provider contract78

Google ADK

Requires the user scope on every call and offers no way to delete — while the sibling session service deletes fine.

Best idea: Scope in the signature, not the query
Main risk: Promotion into memory is one-way

Read analysis

Receipted memory79

Aukora Kernel

Forgetting erases the plaintext and keeps the chain provable — then the next write never checks what was forgotten.

Best idea: Receipt first, row second, both fsynced
Main risk: A rejection nothing reads back

Read analysis

Memory without identity80

AutoGen

A memory has no id, so the only deletion the protocol can express is wiping the whole store.

Best idea: Memory injects itself into context
Main risk: No id means no targeted delete

Read analysis

Addressed lifecycle81

GoodAI LTM

Dormant since 2024, and its interface still says "delete that one" — which neither 2026 framework contract can.

Best idea: Insert returns the key you correct by
Main risk: Delete removes, it does not reject

Read analysis

Cases and skills82

EverOS

Four scope keys pinned on one shared read path and proved disjoint end to end — while a deprecated fact stays re-derivable from the file that made it.

Best idea: One compile path for every read
Main risk: Correction lives in the projection

Read analysis

Unreviewed by design83

ECC

Trust is an enum with one value, and the schema says why — while a rejected status is filtered on read and set by nothing.

Best idea: Declaring the store non-authoritative
Main risk: A state machine with no transitions

Read analysis

Ask it to forget84

Skales

The bin icon confirms, computes the deletion, throws it away, and tells you to ask in chat — where no forget verb exists.

Best idea: Capture and recall with no model at all
Main risk: A delete button that cannot delete

Read analysis

Dispute has its own clock85

Project N.E.K.O.

Agreement and disagreement decay separately, and a test proves a disputed memory never feeds back — from a companion app, not a research lab.

Best idea: Disputation as its own signal
Main risk: "Never mention this" expires in 3 days

Read analysis

Memory people write by hand86

SillyTavern

Keyword-triggered entries a person authors, with sticky, cooldown and delay making activation a timed state machine — and negative keys saying when not to fire.

Best idea: Cooldown and sticky on a retrieval unit
Main risk: Imported lorebooks carry no author

Read analysis

Three memory systems, one repository87

RisuAI

A summarizer rewritten twice in three years, with every generation still in the tree — and each one fixing a failure the last one had in production.

Best idea: Summaries die with their source messages
Main risk: Three summarizers, zero memory tests

Read analysis

Rollback that nothing calls88

Soul of Waifu

A model rewrites the whole memory every four messages, and three guards stop that from destroying it — plus a correct restore API with no caller anywhere.

Best idea: Reject the write when the model returns too little
Main risk: Backups you cannot restore from

Read analysis

BM25 rediscovered by hand89

Z-Waif

Inverse document frequency, corpus-derived stopwords and length normalisation, written from scratch in while loops — plus a guard against the character's own words steering its recall.

Best idea: Cap the agent's own words in its own query
Main risk: A window score computed and never read

Read analysis

normalize_scores does not normalize90

VirtualWife

The Generative Agents retrieval function, ported faithfully except for the normalisation — so a 1-to-10 importance score outranks relevance and recency by construction.

Best idea: A scope key on every contract method, clear included
Main risk: Short-term recall drops the owner filter

Read analysis

Confidence computed, then dropped91

Helm

A first observation is capped at 0.7 and can only climb on independent repeats — then the recalled facts reach the model as (kind) key: value under "never contradict them", with the number stripped off.

Best idea: A provisional cap that corroboration alone can lift
Main risk: Three readers ignore the active-row predicate

Read analysis

Approval that lives in a prompt92

Agno

Six learning stores behind one machine, with fact supersession decided by a judged verdict against a configurable threshold — and a PROPOSE mode whose human approval is a sentence in the system prompt that the save_learning tool never checks.

Best idea: Supersession judged, thresholded, and reversible
Main risk: optimize_memories collapses every memory into one, apply=True by default

Read analysis

Six claims, zero result artifacts93

SimpleMem

Memory units that resolve their own pronouns and absolutise their own timestamps at write — stored in an add-only index whose single removal verb is clear(), beside a second subsystem holding the scope key and audit trail the first one lacks.

Best idea: Context-independence bought once, at extraction
Main risk: Six headline figures with no committed result artifact

Read analysis

A scope the model cannot name94

Pydantic AI Harness

Four tools over a Markdown notebook, with the namespace resolved from run context and never exposed as a tool argument — and a toolset that raises if the backend returns a path outside the scope it asked for.

Best idea: Verifying that your own store honoured the scope filter
Main risk: The receipts table clears its payload, so nothing records what a write changed

Read analysis

The scope key that only travels95

CAMEL

A three-part memory contract whose unit is the message rather than the fact — where every record carries an agent_id that no read path consults, and isolation comes from remembering to give each agent its own storage object.

Best idea: Block, memory and context creator as three separate seams
Main risk: The vector half cannot delete one record, only all of them

Read analysis

The contract still declares no delete96

Microsoft Agent Framework

AutoGen's successor swaps a five-method Memory protocol for a two-method ContextProvider that declares neither deletion nor scope — beside a harness memory whose owner id is mandatory, traversal-checked, and asserted to stay inside its base path.

Best idea: Checking the resolved path never escaped the scope root
Main risk: Correction is an LLM rewriting the durable file with no diff

Read analysis

An LLM with a delete on the write path97

CrewAI

Memory as a filesystem — records at /company/team/user, views rooted at a subtree, and a committed test that a rooted view cannot recall its sibling's records — with a consolidation plan that lets a model delete what it decides is superseded.

Best idea: Scope as a path, with views callers hold instead of parameters they pass
Main risk: Model-authorised deletion with no tombstone and no audit

Read analysis

The model owns the schema98

Gobii

Durable memory is a SQLite file the agent designs and queries itself, sandboxed by a sqlite3 authorizer — and the eight tables the platform mounts into it are all dropped before saving, with each one's mortality written into the schema prompt the model reads.

Best idea: Telling the model which of its tables survive the cycle
Main risk: A model-authored schema no operator can write an erasure query against

Read analysis

One table, argued for99

Agent Memory on Supabase

551 lines of SQL carrying real validity-versus-record time, three-lane RRF recall, and an updated_at trigger that refuses to fire on a read — with the per-user row-level security shipped commented out.

Best idea: A content clock that a read cannot turn into a usage clock
Main risk: The enforced posture is server-sees-everything

Read analysis

Forgetting only in the index100

LivingFeed

A Korean-documented actor simulation that stores the four components of its importance score so the coefficients can be tuned by replay — and expires only the semantic index, never the episodic original.

Best idea: Storing a composite score's parts, not just its total
Main risk: A failed recall returns [], so amnesia looks like a quiet world

Read analysis

The contract that can say no101

Cosmonapse

The only memory contract in the atlas that can decline a query, shed load, miss a deadline and roll back its own writes — with a saga journal that lives in a process dictionary.

Best idea: A failure vocabulary in the interface, including refusal
Main risk: Compensation dies with the worker holding it

Read analysis

Memory that waits for a yes102

npcpy

Extracted memories land as pending_approval and reach no prompt until a person presses a key — approve, reject, edit, skip or defer — with build_context reading only what was approved.

Best idea: An approval state the retriever actually respects
Main risk: A rejection is recorded and never consulted again

Read analysis

Gitignored on purpose103

Juggler

One MEMORY.md per project, kept out of git so it is private to your checkout — maintained by a single remember/forget tool and rendered as a context item where every dated fact has its own delete control.

Best idea: Separating the file you write from the file the assistant writes
Main risk: forget matches by substring and returns no receipt

Read analysis

Mem0's shape, audited104

Mem0Sharp

A from-scratch .NET build of the Mem0 architecture whose Postgres store writes an append-only history row carrying the old and the new text for every mutation — the record the original's reviewed code does not earn.

Best idea: An event, old, new row on every mutation
Main risk: Nothing reads that history on the write path

Read analysis

The log is the authority105

GitLord

Every agent turn is a commit and every session is a branch, so history is inspectable, forkable and replayable — with the retrieval index built as a projection the code rebuilds from the log.

Best idea: An index you can regenerate from the record
Main risk: It stores what was said, never what is believed

Read analysis

A citation or an [unverified] tag106

agent-afk

A codebase fact written without a provenance citation is recalled with an [unverified] marker in the text the model reads — and superseding it without fresh evidence carries the old citation forward with a staleness warning.

Best idea: Shipping the verification verdict into the prompt, not dropping it
Main risk: The whole gate is behind an off-by-default flag

Read analysis

Approval on the read107

Cortex

A secret-classified hit needs a supervisor decision and then a human yes before it is returned — the only read gate in the atlas — beside a second, complete privacy policy that is exported and called by nothing.

Best idea: Asking a person whether the agent may be told this
Main risk: A 90-day retention default that nothing enforces

Read analysis

A decay curve per type108

Mnemopi

Fourteen memory types, each with its own Weibull shape and scale, recalled by four scored voices — and a provenance weight that trusts an unattributed memory more than one it knows came from a tool.

Best idea: A decay shape per type, not just a half-life
Main risk: unknown: 0.8 outranks tool: 0.5

Read analysis

A status for not knowing109

TokenMizer

When two decisions share a topic but the evidence will not say which replaced which, both are marked CONTESTED and stay visible — and a ground-truth suite asserts what fraction of a session's decisions the extractor actually recovers.

Best idea: Refusing to guess, and keeping both sides in view
Main risk: The redactor is tested; the rendered context block is not

Read analysis

One global file, one project slug110

ZeroStack

A Markdown memory in Rust whose global note deliberately follows the agent across projects while scratchpad, notes and daily logs are scoped by slug — with atomic writes and a one-version backup the search cannot see.

Best idea: Splitting scope by what should follow the user
Main risk: Two bad edits in a row lose the original

Read analysis

Verified forgetting, signed111

Lethe

Purge deletes from the row store, the vector index and the lexical index together — and the deletion is provable afterwards by an Ed25519 receipt anchored to a Merkle root over an append-only event log.

Best idea: A deletion a third party can verify without your database
Main risk: It hashes what it purged and never checks the hash on write

Read analysis

Deterministic continuity runtime112

CSM

Forty-six tables behind an OpenCode plugin, with no language model anywhere on the write path — and a table recording every candidate that nearly reached the context window, with the budget line that killed it.

Best idea: Per-item injection provenance: what was trimmed, omitted, and why
Main risk: Superseded and archived memories still answer searches

Read analysis

Work memory beside a code graph113

Graphify

An agent records how each answer turned out; a deterministic pass withholds the lesson until a second result corroborates it, and re-hashes the source file on every read to mark it stale.

Best idea: One save cannot mint a trusted lesson — corroboration is a gate
Main risk: The dead-end list is enforced by asking the model nicely

Read analysis

Multi-tenant lesson store114

LoreKit

Key-addressed lessons in Postgres behind row-level security, with an append-only audit log that records every mutation — and preserves none of the values it overwrote.

Best idea: An audit log made immutable by having no UPDATE or DELETE policy
Main risk: Five entrenchment guards, one of them enforced by code

Read analysis

Corroboration tiers in pure Perl115

CLIO

Every lesson is untrusted until two distinct agent-session pairs corroborate it — a tier that costs score, carries a badge into the prompt, and halves the age-out. The identity that made it unreachable is now wired, and a session restart counts as a second source.

Best idea: A trust tier enforced in scoring, in the prompt, and in decay
Main risk: A session restart is a distinct source, so one agent can self-corroborate

Read analysis

Keyword memory in a trigger116

AgentSwarms

A Postgres trigger derives the retrieval index from each memory's own content, and a GIN overlap ranks on it — no embedding anywhere on the path, in a platform that already runs pgvector elsewhere.

Best idea: The database derives the index, so no row can be unfindable
Main risk: Three lifecycle columns that nothing ever writes

Read analysis

Retrieval that reads the repo117

Empryo

Ranking signals taken from the codebase — file affinity, git co-change neighbours, dependency blast radius — fused with a deterministic embedder that needs no model and no network.

Best idea: Git co-change history as a memory relevance signal
Main risk: Re-saving a soft-deleted memory wakes it, and a test says so

Read analysis

CRUD, and no retrieval on purpose118

Dexto

A five-method memory contract that includes update and delete by id — the two most frameworks omit — and no search at all, because a person pins what should be in the prompt.

Best idea: Give a memory an id, and put delete in the interface
Main risk: No cap by default, so the whole store enters every prompt

Read analysis

A list of what the owner said no to119

Project Golem

Thirty-three lines that remember which proposals the owner rejected and tell the agent to avoid them — the shape this atlas keeps asking for, three entries deep.

Best idea: Record the rejection where the rejection already happens
Main risk: One accepted proposal clears every rejection before it

Read analysis

One document per workspace120

OpenYak

A single 200-line plain-text brief per project directory, rewritten whole by a model on a debounce keyed to the directory rather than the session, so two sessions cannot race.

Best idea: Debounce by the thing written, not by the writer
Main risk: A ceiling with no floor — a short rewrite replaces a full one

Read analysis

Memory sealed until a date121

Memento

An entry can be sealed at record time with a delivery date — outside transcription, indexing and the timeline until it arrives, then it enters the pipeline as if just recorded.

Best idea: Unreachable by state, not by a predicate every query must remember
Main risk: Deleting a recording nulls the provenance of facts derived from it

Read analysis

A suppression the write gate obeys122

Universal Memory Engine

Rejecting a candidate can write a suppression keyed on its canonical label, and four checks in the write gate refuse anything matching — the fourth working tombstone in this atlas.

Best idea: Reject and suppress are different verbs; only one binds the future
Main risk: The automatic path stamps event time with now

Read analysis

Ownership proved by signature123

Membase

Every hub write is signed, and the client refuses to file a memory under any owner but the address that signature recovers to — behind a retrieval filter that reads a distance as a similarity.

Best idea: The owner field is forced to the signer, with a warning when it had to be
Main risk: Raising the similarity threshold returns the least similar documents

Read analysis

The audit gates the delete124

Palazzo

A delete that cannot be written to the write-ahead log does not happen — the only audit in this atlas that is a precondition rather than a receipt. It also committed the benchmark showing it losing to its own prior art.

Best idea: An unwritable audit entry aborts the destruction
Main risk: The README's enum-validated schema does not exist

Read analysis

A chain you can verify125

Aura

The only hash-chained audit here — deletion shows as a sequence gap, insertion as a broken link, and sixteen tests prove it. The belief machine that would use it lives in a dictionary that empties on restart.

Best idea: An audit trail that fails verification if it is rewritten
Main risk: The trust states do not survive a restart

Read analysis

Enforcement by instruction126

MeMex Zero-RAG

The citation rule, the contradiction stop and the operation log are all sentences addressed to the model, and none has a code path. The search that is meant to compound is an unranked substring scan.

Best idea: Sources immutable, wiki derived, git as the whole history
Main risk: The git-ignored credentials file is tracked in git

Read analysis

A correction that loses its veto127

AgentRecall-X

A human correction can block the model outright — and a rule that keeps firing without being heeded is demoted out of its own veto by its measured precision. The only authority here that evidence can take away.

Best idea: Standing granted, exercised, measured, and withdrawn
Main risk: The agent judges whether it heeded the rule

Read analysis

Provenance that answers128

MemLedger

Every event names the hash of the policy that produced it, and a derived one must name its sources — enforced by a validator. Then the dedup lookup skips deleted records, so the fact you deleted comes back.

Best idea: The policy version is hashed into every event it influenced
Main risk: Nothing consults the history to refuse a write

Read analysis

A linter where the verbs should be129

TERSE Memory

Standing prohibitions live in a tier that is always loaded rather than retrieved, capped by a lint rule. The package is a linter and a scaffolder — and the three lint rules deferred to v0.2 are the epistemic ones.

Best idea: A "don't" tier that never depends on retrieval finding it
Main risk: Stale and duplicate checks are the ones deferred

Read analysis

Side-by-side synthesis

Stop comparing feature lists.
Compare memory lifecycles.

The comparative report traces capture, extraction, consolidation, retrieval, injection, correction, forgetting, persistence, and sharing across all one hundred and twenty-nine systems.

Read the comparative report

How the atlas is made

Read the code. Trace the state. Test the claims.

Inspect

Find the concrete schemas, functions, prompts, workers, adapters, tests, and evaluation artifacts.

Trace

Follow capture through storage, retrieval, context assembly, correction, and deletion.

Separate

Keep product claims, visible code, committed evidence, and open questions distinct.

Synthesize

Extract reusable patterns and blunt risks without pretending these systems solve the same problem.

Benchmarking memory → The atlas rubric → Per-repository method → Comparative method →

One hard question:what should an agent remember?

Retrieval is only half the memory problem.

Evidence before belief

Scope before ranking

Correction before scale

Steal the architecture,not the product.

Rejected-value tombstone

Evidence before belief

Hybrid retrieval fusion

Scope as a first-class key

Start where your problem is.

The smallest serious stack

Which ones actually do X

The full comparison

Choose a system to inspect.

Mem0

LangMem

Honcho

Engram

MemPalace

Swafra

llm-wiki-memory

RainBox

Letta

Supermemory

Verel

Hindsight

Graphiti

Mastra Observational Memory

MemOS

Basic Memory

agentmemory

TencentDB Agent Memory

Cognee

Claude-Mem

A-MEM

Holographic

Hermes Agent

OpenViking

Redis Agent Memory Server

ByteRover

OpenClaw

HippoRAG

Voyager

Generative Agents

Magic Context

Pi

MetaClaw

nanobot

CowAgent

GenericAgent

open-cowork

Gini Agent

Moltis

Mercury Agent

LlamaIndex

Atomic Agent

MateClaw

Waku Agent

Memora

LoongFlow

Core Memory

Memanto

Memory Engine

ai-memory

ctx

OptMem

Memvid

MemoryOS

memU

OpenWorker

Qwen Code

OpenCode

NOOA Memory

Neo4j Agent Memory

Elastic Atlas

NemoClaw

Daimon

MIRIX

Memobase

One hard question:
what should an agent remember?

Steal the architecture,
not the product.

Stop comparing feature lists.
Compare memory lifecycles.