Agent Memory Atlas

Library-first01

Mem0

Pragmatic extraction, pluggable stores, hybrid retrieval, and a clean SDK surface.

Best idea: Additive extraction pipeline
Main risk: Extracted fact ≠ verified truth

Read analysis

Library primitives02

LangMem

Small, framework-native tools for managing structured memory and background reflection.

Best idea: Schema-driven store tools
Main risk: Policy remains application-owned

Read analysis

Representation service03

Honcho

Message streams become peer-centric observations and a compact working representation.

Best idea: Events → working representation
Main risk: Operational and consistency cost

Read analysis

Coding-agent local04

Engram

A compact SQLite and FTS5 memory with purposeful MCP tools and conflict-oriented writes.

Best idea: Topic-key upserts + conflict surfacing
Main risk: Agent discipline drives quality

Read analysis

Verbatim evidence05

MemPalace

Original text stays authoritative; extracted indexes guide retrieval without hiding evidence.

Best idea: Supersede writes one instant to both sides of the handover
Main risk: Large, noisy raw stores, and a best-effort audit log

Read analysis

Compact graph-RAG06

Swafra

A tiny local hybrid retriever that now supersedes facts instead of deleting them — and re-asserts them the moment a new session mentions them again.

Best idea: Correction that reaches the ranker
Main risk: Supersession undone by the next session

Read analysis

Filesystem + git07

llm-wiki-memory

Inspectable Markdown memory with recoverable capture, explicit targets, and operational depth.

Best idea: Recoverable lifecycle capture
Main risk: Active atoms lack trust state

Read analysis

Operator-governed08

RainBox

Claims and evidence meet governed writes, rejected tombstones, review UI, and retrieval telemetry. The atlas author's own project — read as a self-assessment.

Best idea: Memory governance loop
Main risk: Compact claims lose nuance

Read analysis

Agent runtime09

Letta

Core, archival, and conversation memory are first-class parts of the running agent.

Best idea: Core vs archival vs recall
Main risk: Agent-editable core lacks trust model

Read analysis

Hosted product10

Supermemory

A polished public surface around documents, chunks, spaces, profiles, SDKs, and MCP.

Best idea: Product-grade API shape
Main risk: Core backend is a black box here

Read analysis

Verification-first11

Verel

Memory is an epistemic problem: candidate, verified, rejected, corroborated, and defensively recalled.

Best idea: Trust and usefulness are separate
Main risk: Correctness has a complexity cost

Read analysis

Memory service12

Hindsight

Source-backed facts and observations meet semantic, lexical, graph, and temporal recall.

Best idea: Four-arm task-specific fusion
Main risk: Derived belief lacks truth state

Read analysis

Temporal graph13

Graphiti

Episodes become a bi-temporal entity graph that preserves changing facts and history.

Best idea: Fact validity ≠ ingestion time
Main risk: Graph mistakes have wide impact

Read analysis

Observations, and a graph with a ceiling14

Mastra Observational Memory

Messages become dated observations, beside a scoped knowledge graph whose records carry a stamped ceiling on how widely they may ever be shared.

Best idea: A per-record scope ceiling, re-checked on every rescope
Main risk: Soft-deleted records nothing consults when the same fact is observed again

Read analysis

Memory substrate15

MemOS

Mountable cubes span textual, preference, skill, KV-cache, and parametric memory.

Best idea: Heterogeneous memory cubes
Main risk: Uneven module guarantees

Read analysis

Canonical Markdown16

Basic Memory

Human-editable notes stay authoritative while graph and hybrid-search indexes remain rebuildable.

Best idea: Source-of-truth projections
Main risk: Bidirectional sync complexity

Read analysis

Hook-native runtime17

agentmemory

Cheap lifecycle capture meets compact-first BM25, vector, and graph recall.

Best idea: Zero-LLM capture + expandable search
Main risk: Fuzzy supersession and broad surface

Read analysis

Proxy-intercepted team memory18

TencentDB Agent Memory

Four services behind a reverse proxy, isolating every layer on a team, user, agent and task key.

Best idea: Scope key as a SQL predicate, not a post-filter
Main risk: No committed tests anywhere in the tree

Read analysis

Knowledge-graph platform19

Cognee

Source-preserving pipelines build ontology-aware graph, vector, summary, and session memory.

Best idea: Provenance-aware pipeline rollback
Main risk: Cross-store and policy complexity

Read analysis

Hook-native sidecar20

Claude-Mem

A durable hook queue feeds structured observations and bounded project timelines across sessions.

Best idea: Commit before queue acknowledgement
Main risk: Generated observations activate directly

Read analysis

Evolving linked notes21

A-MEM

An LLM links new notes and revises nearby metadata in a compact Zettelkasten-inspired prototype — except the code indexes an insertion-ordered list with a vector rank, so the notes it rewrites are the oldest in the store rather than the neighbours the model was shown.

Best idea: Adaptive note organization
Main risk: Rank position used as identity, and the evolution test cannot fail

Read analysis

Vector-symbolic22

Holographic

Facts become holographic phase vectors, so entities can be queried algebraically instead of by keyword.

Best idea: Deterministic hash-derived vectors
Main risk: Downvotes silently delete memory

Read analysis

Bounded runtime23

Hermes Agent

Hard-capped Markdown memory frozen into the prompt at session start to keep the cache warm.

Best idea: Frozen snapshot, consolidate in-turn
Main risk: Model writes are instantly authoritative

Read analysis

Context database24

OpenViking

Memory, resources, and skills share one filesystem hierarchy with three retrievable granularities.

Best idea: Hotness kept apart from truth
Main risk: Published numbers lack raw artifacts

Read analysis

Memory service25

Redis Agent Memory Server

TTL-scoped working memory promotes into deduplicated long-term memory with a real retention policy.

Best idea: Composite forgetting policy
Main risk: Deletion without tombstones

Read analysis

Curated knowledge26

ByteRover

A deterministic guard counts what an LLM rewrite would delete, then merges the loss back in.

Best idea: Structural-loss guard on rewrites
Main risk: Elastic License, not open source

Read analysis

Plugin memory27

OpenClaw

A nightly consolidation pass rewrites durable memory, and what survives it is decided by twenty-one English keyword regexes.

Best idea: Refuses to overwrite human notes
Main risk: Durability policy is a regex scorecard

Read analysis

Associative graph28

HippoRAG

Seeds a knowledge graph with query entities and lets PageRank diffuse relevance instead of planning hops.

Best idea: Diffusion instead of traversal
Main risk: No scope, trust, or temporal model

Read analysis

Procedural skills29

Voyager

Memory is a library of executable skills, written only once the environment confirms they worked — and under one constructor argument, only once a person does.

Best idea: One signature for the model judge and the human one
Main risk: Frozen 2023 artifact; no failure memory

Read analysis

The ancestor30

Generative Agents

The observation, reflection, and planning stream whose importance-recency-relevance score everything else still echoes — and whose recency term is computed over a list sorted oldest-first, so it scores the least recently accessed memory highest.

Best idea: Reflection triggered by significance
Main risk: The recency term is inverted, and nothing tests it

Read analysis

Verified memory31

Magic Context

Maps each memory to the files it describes and re-verifies it when git says those files changed.

Best idea: Verification against real code change
Main risk: No tombstones; large surface

Read analysis

Session substrate32

Pi

A branchable JSONL session tree with deterministic compaction manifests — and no memory contract at all.

Best idea: Deterministic file manifest on compaction
Main risk: Every plugin reinvents memory

Read analysis

Self-tuning policy33

MetaClaw

Replays past turns against candidate retrieval policies and promotes one only when it beats the incumbent on eight measured deltas — and tunes how memory is found without ever touching whether it is believed.

Best idea: Promotion gate for retrieval policy
Main risk: The collector reads the half of the lineage nothing writes

Read analysis

Dual-cursor files34

nanobot

An append-only summary archive with separate write and consume cursors, and a Dream pass that won't advance after tool errors.

Best idea: Don't advance a cursor after failure
Main risk: Durable claims lack provenance

Read analysis

Daily distillation35

CowAgent

Conversations become dated daily files, then a nightly Deep Dream distils them into a ~30-entry MEMORY.md.

Best idea: Dated intermediate layer
Main risk: Newer-always-wins correction

Read analysis

Memory as policy36

GenericAgent

Four layers governed by written axioms — nothing enters memory that did not come from a successful tool call.

Best idea: ROI test for permanent context
Main risk: Prose rules, no enforcement

Read analysis

Evaluated memory37

open-cowork

Ships a memory benchmark that asserts what recall must not surface, not just what it must.

Best idea: Forbidden-hit eval assertions
Main risk: Harness committed, results are not

Read analysis

Reimplemented model38

Gini Agent

A local rebuild of the Hindsight model with bi-temporal units, four fused recall channels and decisions kept as ADRs — and a five-value trust vocabulary of which exactly one value is ever written.

Best idea: A scope test whose fixtures differ only in the key
Main risk: Three of five trust states have no writer

Read analysis

Local file corpus39

Moltis

Markdown chunked and hybrid-searched in one index, written by agent tools, model extraction turns and a raw session-log hook.

Best idea: A checkpoint before every agent memory write
Main risk: Prefetch ignores the agent scope

Read analysis

Graded personal40

Mercury Agent

Grades every memory on confidence, importance, and durability, with a subconscious tier and a learning pause switch.

Best idea: Durability split from importance
Main risk: Dismissal without a tombstone

Read analysis

Composable blocks41

LlamaIndex

One token budget split between chat history and pluggable memory blocks that each truncate themselves.

Best idea: Self-truncating memory blocks
Main risk: Capture depends on conversation length

Read analysis

Invariant-cited fabric42

Atomic Agent

Numbered invariants cited from the schema and a vote log beside a score it cannot rebuild — a score that, by default, evicts and hides facts on the model's own votes, over a project boundary the model can switch off.

Best idea: Invariants as referenced artifacts
Main risk: Model votes reach deletion by default

Read analysis

Scoped provider SPI43

MateClaw

A provider contract that carries the owner key on every call, a recall query that filters personal facts by owner, and isolation tests that assert what a populated search must not return.

Best idea: Contradictions queue until a person resolves them
Main risk: The resolution verbs are read by nothing

Read analysis

Gated memory44

Waku Agent

A small model decides whether to retrieve at all, because irrelevant memory bends the answer. The agent and a person can both correct a stored fact — and the next consolidation pass can put it back.

Best idea: Abstaining from retrieval
Main risk: The gate is scored, but nothing fails when it decides wrongly

Read analysis

Rehearsable correction45

Memora

The supersession sweep defaults to a dry run, and the retrieval argument that decides whether corrected memories come back defaults to the safe answer — unfiltered is a string you have to type.

Best idea: The omitted argument is the safe one
Main risk: The shipped plugin stamps a type by keyword, unasked

Read analysis

Stochastic recall46

LoongFlow

The only memory here that samples instead of ranking — temperature set by how varied the store has become.

Best idea: The selector is tested as a distribution
Main risk: The adaptive half is named in no test

Read analysis

Grounding-gated trust47

Core Memory

How a record is known sets a ceiling on how trusted it can ever become, so use alone cannot make a guess canonical.

Best idea: Grounding caps the trust ladder
Main risk: Correction is record-keyed

Read analysis

Resolved conflict48

Memanto

The only conflict pipeline here that ends in a decision — including "both are true" and a human-written reconciliation.

Best idea: Conflicts get resolved, not flagged
Main risk: Deletion without a tombstone

Read analysis

A delegated key is a ceiling, not a grant49

Memory Engine

A restricted key declares the access it wants per space and path, and the engine hands back only the intersection with what its holder already has — so over-declaring clamps down instead of escalating.

Best idea: Delegation intersected with live access, in SQL
Main risk: Governs access, not truth — and the log expires

Read analysis

Cross-harness handoff50

ai-memory

A single-use handoff baton between coding-agent sessions, claimed by one atomic update inside the receiving project; the automatic baton carries the user's prompts, not the agent's findings.

Best idea: One compare-and-set claims the baton, and only the claimant reads it
Main risk: Batons never expire by age and route on no recipient

Read analysis

Guarded consolidation51

ctx

The background pass may only write where it is sanctioned to, and the tests include a corruption corpus from a published paper.

Best idea: The pass proposes, a person disposes
Main risk: Folding away is not forgetting

Read analysis

No background work52

OptMem

860 lines, a log the code never edits, and detail that decays with age by geometry instead of policy.

Best idea: Consolidation asked, never scheduled
Main risk: No licence; nothing is fixable

Read analysis

Rewindable memory53

Memvid

Immutable frames in one file, so a fact can be read as of last March and a whole session can be replayed.

Best idea: Time travel from the format
Main risk: Loud claims, no artifacts; the delete test cannot fail

Read analysis

Heat-promoted tiers54

MemoryOS

The tiered architecture at its most legible — and its promotion score cannot tell importance from verbosity.

Best idea: The promotion rule is written down
Main risk: One scalar, three signals

Read analysis

Documented decisions55

memU

Ranks the slice and returns the file, and writes down why each schema decision was made.

Best idea: Search unit ≠ return unit
Main risk: Seven hosts, no scope key

Read analysis

Policy over machinery56

OpenWorker

A small scoped SQLite memory where every write is announced with an undo, and a human-authored rules block outranks anything the agent learned.

Best idea: A user rules block no tool can write, edit or delete
Main risk: memory_read fetches by integer id with no scope check

Read analysis

Team memory in git57

Qwen Code

Shared memory distributed by git pull, with secret-bearing writes refused even when the tier is switched off.

Best idea: A guard the flag cannot disable
Main risk: Forget does not survive re-extraction

Read analysis

Hooks, no contract58

OpenCode

The two hooks a memory plugin needs, both experimental, and no memory contract — so plugins read the database instead.

Best idea: A compaction hook
Main risk: Plugins couple to the schema

Read analysis

Cognitive-model recall59

NOOA Memory

ACT-R activation and the Ebbinghaus curve, with the score components of every retrieval stored on the record.

Best idea: Retrieval explains itself later
Main risk: The access log is capped

Read analysis

Memory of its own reasoning60

Neo4j Agent Memory

A third tier that records how the agent reasoned — and stores the failures, because the control flow catches them.

Best idea: Failures stored by default
Main risk: Bi-temporal only for preferences

Read analysis

Evaluated demo61

Elastic Atlas

Supersession that tells "no longer true" from "never true", validity dates beside record time, and a recall eval matched on id.

Best idea: Retraction split from change
Main risk: Retractions hidden from the writer

Read analysis

Memory as an operand62

NemoClaw

Sandboxes other agents and snapshots their memory — credentials get scrubbed on backup, memory does not.

Best idea: A declared state contract
Main risk: Restore reinstates deletions

Read analysis

Verified quotes63

Daimon

Every memory is marked verbatim or inferred — and the quote is grepped against the transcript before the label sticks.

Best idea: Code falsifies the trust label
Main risk: One checkpoint is the memory

Read analysis

Scope tested by exclusion64

MIRIX

Six memory types, six writer agents, and the atlas's third test asserting a memory must not come back — reached through access control, not memory research.

Best idea: The cache query carries the scope key too
Main risk: A periodic pass hard-deletes what it rewrites

Read analysis

Scope in the primary key65

Memobase

The smallest useful description of a user — five sentences a subtopic, a token-budgeted context block, and the transcript deleted once it has been read.

Best idea: Tenant key in every primary key
Main risk: The evidence is gone by default

Read analysis

Reinforcement, inverted66

Memary

Forty lines of reinforcement by frequency — and the one line that reads the counts sorts ascending, so the rarest entities are the ones injected.

Best idea: Salience and belief kept apart
Main risk: A recall miss becomes a permanent belief

Read analysis

Provenance by foreign key67

Memori

Every fact names the conversations that produced it — and the dedupe key strips all non-ASCII, so facts in other scripts collapse into one row.

Best idea: Durable turn, best-effort extraction
Main risk: One hash for every non-Latin fact

Read analysis

Publishes its worst score68

ReMe

Committed per-category benchmark tables with contradiction resolution lowest at 0.438 and 0.391 — plus CREATE/CORROBORATE/REFINE/CORRECT as a validated verb set.

Best idea: Corroboration as a first-class action
Main risk: A failed receipt still lands the edit

Read analysis

Forgetting curve69

PowerMem

Promote, archive, forget and reinforce as four separate decisions — evaluated during search, so reading a memory changes it.

Best idea: Decay rate varies by memory type
Main risk: The history table has no callers

Read analysis

Commitments, inferred70

MineContext

Watches your screen and writes down what it decides you promised — prospective memory inferred from what it saw rather than stated.

Best idea: Event time allowed to be future
Main risk: No tests, and no way to reject a todo

Read analysis

Outcome-gated learning71

Acontext

Nothing is learned until a task reaches success or failed — and three committed tests assert that a running task writes nothing.

Best idea: The execution gate, with tests
Main risk: A deleted skill can be re-distilled

Read analysis

Memory in weights72

Second Me

Documents to a versioned biography to LoRA weights — the atlas's only memory that is weights, and the only place deleting a memory cannot reach the belief.

Best idea: The derived layer is numbered
Main risk: Deletion stops at the vector store

Read analysis

Staged by rename73

TigrimOSR

A proposed skill waits on disk beside the live one, carrying its rationale and sources — but say no and nothing remembers you did.

Best idea: Approval escalates on who wrote it
Main risk: Rejections die with the process

Read analysis

Citations that resolve74

MemMachine

Keeps every raw episode and cites it from each derived fact — then acknowledges a session deletion it has only queued.

Best idea: Provenance you can actually follow
Main risk: Deleted is reported before it is true

Read analysis

Blinded index75

Buzz

The relay holding your agent's memory cannot read it, and cannot tell which memory it is holding — but it throws away every version it replaces.

Best idea: HMAC the index, not just the payload
Main risk: Replaceable events keep no history

Read analysis

User-defined schema76

Logseq

The only store here whose memory schema belongs to the user — and the agent writes into it live, unmarked, with no way to delete what it got wrong.

Best idea: The user defines what a memory is
Main risk: Agent writes are indistinguishable

Read analysis

A taint with one reader left77

OpenHuman

Every synced memory still carries a fail-closed provenance taint, but since the subconscious engine was removed, the only thing it changes is whether auto-recall fences a note as untrusted.

Best idea: One guarded handle, scopes intersected
Main risk: A tool refusal with no producer

Read analysis

Provider contract78

Google ADK

Requires the user scope on every call and offers no way to delete — while the sibling session service deletes fine.

Best idea: Scope in the signature, not the query
Main risk: Promotion into memory is one-way

Read analysis

Receipted memory79

Aukora Kernel

Forgetting erases the plaintext and keeps the chain provable — then the next write never checks what was forgotten.

Best idea: Receipt first, row second, both fsynced
Main risk: A rejection nothing reads back

Read analysis

Memory without identity80

AutoGen

A memory has no id, so the only deletion the protocol can express is wiping the whole store.

Best idea: Memory injects itself into context
Main risk: No id means no targeted delete

Read analysis

Addressed lifecycle81

GoodAI LTM

Dormant since 2024, and its interface still says "delete that one" — which neither 2026 framework contract can.

Best idea: Insert returns the key you correct by
Main risk: Delete removes, it does not reject; one knob has two defaults

Read analysis

Cases and skills82

EverOS

Four scope keys pinned on one shared read path and proved disjoint end to end — while a deprecated fact stays re-derivable from the file that made it.

Best idea: One compile path for every read
Main risk: Correction lives in the projection

Read analysis

Unreviewed by design83

ECC

Trust is an enum with one value, and the schema says why — while a rejected status is filtered on read and set by nothing.

Best idea: Declaring the store non-authoritative
Main risk: A state machine with no transitions

Read analysis

Ask it to forget84

Skales

In a v7 snapshot the project has withdrawn, the bin icon confirms, computes the deletion, throws it away, and tells you to ask in chat — where no forget verb exists and the request is saved as a memory.

Best idea: Capture and recall with no model at all
Main risk: A delete button that cannot delete

Read analysis

Dispute has its own clock85

Project N.E.K.O.

Agreement and disagreement decay separately, a test proves a disputed memory never feeds back, and a second trust axis weighs who said it — with tests that the model cannot forge either.

Best idea: Disputation as its own signal
Main risk: "Never mention this" expires, and cannot be deleted

Read analysis

Memory people write by hand86

SillyTavern

Keyword-triggered entries a person authors, with sticky, cooldown and delay making activation a timed state machine — and negative keys saying when not to fire.

Best idea: Cooldown and sticky on a retrieval unit
Main risk: Imported lorebooks carry no author

Read analysis

Three memory systems, one repository87

RisuAI

A summarizer rewritten twice in three years, with every generation still in the tree — and each one fixing a failure the last one had in production.

Best idea: Summaries die with their source messages
Main risk: Three summarizers, zero memory tests

Read analysis

The guard the redirect walks past88

Soul of Waifu

A model rewrites the whole memory every four messages, and four guards stop that from destroying it — then a de-duplication step reassigns the filename two of those guards just checked.

Best idea: Repair a truncated response, and retry rather than default
Main risk: A validated filename replaced after validation

Read analysis

BM25 rediscovered by hand89

Z-Waif

Inverse document frequency, corpus-derived stopwords and length normalisation, written from scratch in while loops — plus a guard against the character's own words steering its recall.

Best idea: Cap the agent's own words in its own query
Main risk: A window score computed and never read

Read analysis

normalize_scores does not normalize90

VirtualWife

The Generative Agents retrieval function, ported faithfully except for the normalisation — so a 1-to-10 importance score outranks relevance and recency by construction.

Best idea: A scope key on every contract method, clear included
Main risk: Short-term recall drops the owner filter

Read analysis

Confidence computed, then dropped91

Helm

A first observation is capped at 0.7 and can only climb on independent repeats — then the recalled facts reach the model as (kind) key: value under "never contradict them", with the number stripped off.

Best idea: A provisional cap that corroboration alone can lift
Main risk: Three readers ignore the active-row predicate

Read analysis

Approval that lives in a prompt92

Agno

Six learning stores behind one machine, with fact supersession decided by a judged verdict against a configurable threshold — and a PROPOSE mode whose human approval is a sentence in the system prompt that the save_learning tool never checks.

Best idea: Supersession judged, thresholded, and reversible
Main risk: optimize_memories collapses every memory into one, apply=True by default

Read analysis

Six claims, zero result artifacts93

SimpleMem

Memory units that resolve their own pronouns and absolutise their own timestamps at write — stored in an add-only index whose single removal verb is clear(), beside a second subsystem holding the scope key and audit trail the first one lacks.

Best idea: Context-independence bought once, at extraction
Main risk: Six headline figures with no committed result artifact

Read analysis

A scope the model cannot name94

Pydantic AI Harness

Four tools over a Markdown notebook, with a scope key the model can neither name nor see — resolved from run context, absent from every tool signature and from the injected block — and three call sites that raise if the backend returns a path outside it.

Best idea: Verifying that your own store honoured the scope filter
Main risk: Receipts hold digests, never content, so nothing records what a write changed

Read analysis

The scope key that only travels95

CAMEL

A three-part memory contract whose unit is the message rather than the fact — where every record carries an agent_id that no read path consults, and isolation comes from remembering to give each agent its own storage object.

Best idea: Block, memory and context creator as three separate seams
Main risk: The vector half cannot delete one record, only all of them

Read analysis

The contract still declares no delete96

Microsoft Agent Framework

AutoGen's successor swaps a five-method Memory protocol for a two-method ContextProvider that declares neither deletion nor scope — beside a harness memory whose owner id is mandatory, traversal-checked, and asserted to stay inside its base path.

Best idea: Checking the resolved path never escaped the scope root
Main risk: Correction is an LLM rewriting the durable file with no diff

Read analysis

An LLM with a delete on the write path97

CrewAI

Memory as a filesystem — records at /company/team/user, views rooted at a subtree, and a committed test that a rooted view cannot recall its sibling's records — with a consolidation plan that lets a model delete what it decides is superseded.

Best idea: Scope as a path, with views callers hold instead of parameters they pass
Main risk: Model-authorised deletion with no tombstone and no audit

Read analysis

The model owns the schema98

Gobii

Durable memory is a SQLite file the agent designs and queries itself, sandboxed by a sqlite3 authorizer — and the eight tables the platform mounts into it are all dropped before saving, with each one's mortality written into the schema prompt the model reads.

Best idea: Telling the model which of its tables survive the cycle
Main risk: A model-authored schema no operator can write an erasure query against

Read analysis

One table, argued for99

Agent Memory on Supabase

551 lines of SQL carrying real validity-versus-record time, three-lane RRF recall, and an updated_at trigger that refuses to fire on a read — with the per-user row-level security shipped commented out.

Best idea: A content clock that a read cannot turn into a usage clock
Main risk: The enforced posture is server-sees-everything

Read analysis

Forgetting only in the index100

LivingFeed

A Korean-documented actor simulation that stores the four components of its importance score so the coefficients can be tuned by replay — and expires only the semantic index, never the episodic original.

Best idea: Storing a composite score's parts, not just its total
Main risk: A failed recall returns [], so amnesia looks like a quiet world

Read analysis

The contract that can say no101

Cosmonapse

The only memory contract in the atlas that can decline a query, shed load, miss a deadline and roll back its own writes — with a saga journal that lives in a process dictionary.

Best idea: A failure vocabulary in the interface, including refusal
Main risk: Compensation dies with the worker holding it

Read analysis

Memory that waits for a yes102

npcpy

Extracted memories land as pending_approval and reach no prompt until a person presses a key — approve, reject, edit, skip or defer — with build_context reading only what was approved.

Best idea: An approval state the retriever actually respects
Main risk: A rejection is recorded and never consulted again

Read analysis

Gitignored on purpose103

Juggler

One MEMORY.md per project, kept out of git so it is private to your checkout — maintained by a single remember/forget tool and rendered as a context item where every dated fact has its own delete control.

Best idea: Separating the file you write from the file the assistant writes
Main risk: forget matches by substring and returns no receipt

Read analysis

Mem0's shape, with a robot's memory beside it104

MagiCore

A .NET build of the Mem0 architecture — formerly Mem0Sharp — that keeps an event time beside every record time, writes a history entry for every mutation and replays robot evidence by capture time into beliefs that say when to look again, while the durable history collection is written and never read back and rollback is the one mutation the history omits.

Best idea: An event time the filter refuses to guess at
Main risk: An audit no reader reaches after a restart

Read analysis

The log is the authority105

GitLord

Every agent turn is a commit and every session is a branch, so history is inspectable and forkable — with a JSON index and a vector index both rebuilt from the log rather than kept beside it.

Best idea: An index you can regenerate from the record
Main risk: It stores what was said, never what is believed

Read analysis

A citation or an [unverified] tag106

agent-afk

A codebase fact written without a provenance citation is recalled with an [unverified] marker in the text the model reads — and superseding it without fresh evidence carries the old citation forward with a staleness warning.

Best idea: Shipping the verification verdict into the prompt, not dropping it
Main risk: The whole gate is behind an off-by-default flag

Read analysis

Approval on the read107

Cortex

A secret-classified hit needs a supervisor decision and then a human yes before it is returned — the only read gate in the atlas — beside a second, complete privacy policy that is exported and called by nothing.

Best idea: Asking a person whether the agent may be told this
Main risk: Three of five retrieval arms take no session parameter

Read analysis

A decay curve per type108

Mnemopi

Fourteen memory types, each with its own Weibull shape and scale, recalled by four scored voices — and a provenance weight that trusts an unattributed memory more than one it knows came from a tool.

Best idea: A decay shape per type, not just a half-life
Main risk: unknown: 0.8 outranks tool: 0.5

Read analysis

A status for not knowing109

TokenMizer

When two decisions share a topic but the evidence will not say which replaced which, both are marked CONTESTED and stay visible — and a ground-truth suite asserts what fraction of a session's decisions the extractor actually recovers.

Best idea: Refusing to guess, and keeping both sides in view
Main risk: The redactor is tested; the rendered context block is not

Read analysis

One global file, one project slug110

ZeroStack

A Markdown memory in Rust whose global note deliberately follows the agent across projects while scratchpad, notes and daily logs are scoped by slug — with atomic writes, a one-version backup the search cannot see, and an editor command that empties the global file before opening it.

Best idea: Splitting scope by what should follow the user
Main risk: Opening the editor empties the global memory

Read analysis

Verified forgetting, signed111

Lethe

Purge deletes from the row store, the vector index and the lexical index together — and the deletion is provable afterwards by an Ed25519 receipt anchored to a Merkle root over an append-only event log.

Best idea: A deletion a third party can verify without your database
Main risk: It hashes what it purged and never checks the hash on write

Read analysis

Deterministic continuity runtime112

CSM

Forty-six tables behind an OpenCode plugin, with no language model anywhere on the write path — and a table recording every candidate that nearly reached the context window, with the budget line that killed it.

Best idea: Per-item injection provenance: what was trimmed, omitted, and why
Main risk: Retired lessons from every project reach the prompt on every turn

Read analysis

Work memory beside a code graph113

Graphify

An agent records how each answer turned out; a deterministic pass withholds the lesson until a second result corroborates it, and re-hashes the source file on every read to mark it stale.

Best idea: One save cannot mint a trusted lesson — corroboration is a gate
Main risk: The dead-end list is enforced by asking the model nicely

Read analysis

Multi-tenant lesson store114

LoreKit

Key-addressed lessons in Postgres behind row-level security, with an append-only audit log that records every mutation — and preserves none of the values it overwrote.

Best idea: An audit log made immutable by having no UPDATE or DELETE policy
Main risk: Five entrenchment guards, one of them enforced by code

Read analysis

Corroboration tiers in pure Perl115

CLIO

Every lesson is untrusted until two distinct agent-session pairs corroborate it — a tier that badges the entry in the prompt, orders eviction and cuts the age-out to a third. Selection for the prompt ignores it, and the model's own tool can name both corroborating sources.

Best idea: A trust tier carried into the prompt, the eviction order and the decay schedule
Main risk: The model can name both sources that promote an entry

Read analysis

Keyword memory in a trigger116

AgentSwarms

A Postgres trigger derives the retrieval index from each memory's own content, and a GIN overlap ranks on it — no embedding anywhere on the path, in a platform that already runs pgvector elsewhere.

Best idea: The database derives the index, so no row can be unfindable
Main risk: Three lifecycle columns that nothing ever writes

Read analysis

Retrieval that reads the repo117

Empryo

Ranking signals taken from the codebase — file affinity, git co-change neighbours, dependency blast radius — fused with a deterministic embedder that needs no model and no network.

Best idea: Git co-change history as a memory relevance signal
Main risk: Re-saving a soft-deleted memory wakes it, and a test says so

Read analysis

CRUD, and no retrieval on purpose118

Dexto

A five-method memory contract that includes update and delete by id — the two most frameworks omit — and no search at all, because a person pins what should be in the prompt.

Best idea: Give a memory an id, and put delete in the interface
Main risk: No cap by default, so the whole store enters every prompt

Read analysis

A list of what the owner said no to119

Project Golem

Thirty-three lines that remember which proposals the owner rejected and tell the agent to avoid them — the shape this atlas keeps asking for, three entries deep.

Best idea: Record the rejection where the rejection already happens
Main risk: One accepted proposal clears every rejection before it

Read analysis

One document per workspace120

OpenYak

A single 200-line plain-text brief per project directory, rewritten whole by a model on a debounce keyed to the directory rather than the session, so two sessions cannot race — a subsystem the project has since deleted in a rewrite, read here at the commit where it exists.

Best idea: Debounce by the thing written, not by the writer
Main risk: Removed upstream; a ceiling with no floor while it lived

Read analysis

Memory sealed until a date121

Memento

An entry can be sealed at record time with a delivery date — outside transcription, indexing and the timeline until it arrives, then it enters the pipeline as if just recorded.

Best idea: Unreachable by state, not by a predicate every query must remember
Main risk: Deleting a recording nulls the provenance of facts derived from it

Read analysis

A suppression the write gate obeys122

Universal Memory Engine

Rejecting a candidate can write a suppression keyed on its canonical label, and four checks in the write gate refuse anything matching — the fourth working tombstone in this atlas.

Best idea: Reject and suppress are different verbs; only one binds the future
Main risk: The automatic path stamps event time with now

Read analysis

Ownership proved by signature123

Membase

Every hub write is signed, and the client refuses to file a memory under any owner but the address that signature recovers to — behind a retrieval filter that reads a distance as a similarity.

Best idea: The owner field is forced to the signer, with a warning when it had to be
Main risk: Raising the similarity threshold returns the least similar documents

Read analysis

The audit gates the delete124

Palazzo

A delete that cannot be written to the write-ahead log does not happen — the only audit in this atlas that is a precondition rather than a receipt. It also committed the benchmark showing it losing to its own prior art.

Best idea: An unwritable audit entry aborts the destruction
Main risk: The README's enum-validated schema does not exist

Read analysis

A chain you can verify125

Aura

A hash-chained receipt audit — deletion shows as a sequence gap, insertion as a broken link, and sixteen tests check it, passing when run at the first pin. The belief machine that would use it lives in a dictionary that empties on restart.

Best idea: An audit trail that fails verification if it is rewritten
Main risk: The trust states do not survive a restart

Read analysis

Enforcement by instruction126

MeMex Zero-RAG

The citation rule and the contradiction stop are sentences addressed to the model with no code path behind them; what has code is a page lifecycle of draft, active, stale and quarantine that the model can set and no search consults, and a confidence floor on an unranked substring scan.

Best idea: Sources immutable, wiki derived, git as the whole history
Main risk: A lifecycle status that nothing on the read path consults

Read analysis

A correction that loses its veto127

AgentRecall-X

A human correction can block the model outright — and a rule that keeps firing without being heeded is demoted out of its own veto by its measured precision. The only authority here that evidence can take away.

Best idea: Standing granted, exercised, measured, and withdrawn
Main risk: The agent judges whether it heeded the rule

Read analysis

Provenance that answers128

MemLedger

Every event names the hash of the policy that produced it, and a derived one must name its sources — enforced by a validator. Then the dedup lookup skips deleted records, so the fact you deleted comes back.

Best idea: The policy version is hashed into every event it influenced
Main risk: Nothing consults the history to refuse a write

Read analysis

A linter where the verbs should be129

TERSE Memory

Standing prohibitions live in a tier that is always loaded rather than retrieved, capped by a lint rule. The package is a linter and a scaffolder — and the three lint rules deferred to v0.2 are the epistemic ones.

Best idea: A "don't" tier that never depends on retrieval finding it
Main risk: Stale and duplicate checks are the ones deferred

Read analysis

A decision not to merge, kept130

Agentic Context Engine

When the consolidator decides two similar skills should stay separate, it stores the pair, the reasoning and the similarity — and the detector checks that before ever asking again. The only recorded "no" here that is consulted.

Best idea: A settled pair is never re-litigated
Main risk: The drift field is stored and never compared

Read analysis

The contract, not the store131

DeerFlow

Four memory backends behind one three-tier contract that replaced hasattr probing with defaulted hooks, and ships a no-op template to copy. Every backend must return the default one's shape, and unknown fields vanish silently.

Best idea: A tiered plugin contract with a compiled template
Main risk: One backend's schema became the interface

Read analysis

A fix that failed, ranked not removed132

EAN AgentOS

Hooks into four coding CLIs capture commits, commands and errors without a model deciding what mattered — and the table records whether each fix worked. Both recall paths sort on that flag instead of filtering it.

Best idea: Deterministic capture, and a record of what was tried
Main risk: The failed fix comes back one row lower

Read analysis

Path-cost graph recall133

M-flow

A query anchors on the finest node it can find, and an episode ranks by its cheapest path, where each edge costs its own text’s distance to the query. The procedural gates its modules describe are never imported.

Best idea: Edge cost measured against the query, minimum over paths
Main risk: Procedural governance modules with no caller

Read analysis

Archive is routine, delete is deliberate134

memory-project

Forgetting has two speeds and two kinds of delete: a correction keeps the rejected claim’s embedding so the same wrong fact is caught coming back, and a secret purge rebuilds the store so it is genuinely gone.

Best idea: Two delete modes, opposite needs from the embedding
Main risk: A full rebuild on every purge

Read analysis

Scope suspended on purpose135

Hippo

Every memory gets a mass, a charge and a temperature — and the tenant boundary is enforced in the query, then deliberately dropped for consolidation behind a loopback gate.

Best idea: A digest-keyed tombstone the write path enforces
Main risk: The tombstone catches an exact repeat, not a paraphrase

Read analysis

Whose claim wins, in fifteen lines136

Echo Agent

Every memory records which write path created it, and a write is refused unless the actor outranks its target — so a model-inferred claim cannot overwrite one the user stated.

Best idea: Provenance as write authority, and as a suppression key
Main risk: Guards authority, not truth

Read analysis

Two tables, five collections, one graph137

7layermem

Seven memory types split across two SQLite tables, five Chroma collections and an optional Neo4j graph — a legible taxonomy over three storage engines, ranked by a constant per store rather than by what the search returned.

Best idea: Types separated by store
Main risk: Ranked by store, not by score

Read analysis

Arrives a candidate, not a fact138

CogniCore

A memory row starts in a candidate state and earns its way up, carrying a ledger of whether each retrieval was used or ignored.

Best idea: Unassessed is representable
Main risk: Scope filtered after the limit

Read analysis

Stores why it was wrong, and refuses it139

ALMA

An anti-pattern table holding the reason something was wrong and the better alternative — consulted before a write, on the one path the extractor, the miner and the consolidation pass do not use.

Best idea: Why bad, and what instead
Main risk: A guard on one door of six

Read analysis

One database per role140

PromptX

Engrams reached by the cue words indexed against them, in a spreading-activation network — with each role holding its own database file.

Best idea: Scope you cannot forget
Main risk: Strength is the only verdict

Read analysis

Symbolic memory, no model141

Nova AI

A hand-built concept graph with provenance on every edge, written only after the user types yes to "may I remember that?" — and a refusal keyed on the sentence itself, which the main write path tests first and only a person can lift, on the record.

Best idea: Re-asserting a refused value asks the person
Main risk: Two write paths go around the refusal

Read analysis

A tombstone only a human can set142

memsem

Its committed benchmark reproduces exactly — the corpus's cleanest checkable number. A rejected candidate writes a durable value-keyed suppression the write path obeys; automatic supersession writes none, so repetition wins on the path an extractor takes.

Best idea: The rejection check runs first, before anything is written
Main risk: Only a human can arm it

Read analysis

A standard, not a store143

Cambium

A governance standard for corpora maintained by LLM agents, whose checks report "nothing checked" rather than green — and whose automation may block a page but never promote one.

Best idea: A pass it refuses to fake
Main risk: Ships no corpus to govern

Read analysis

Claims audited against artifacts144

Perseus Vault

All seven marks, and a benchmark mean that recomputes exactly from three committed runs — beside a claims audit that retires what it cannot back and a tombstone that stores a digest rather than the value it refuses.

Best idea: A rejection that cannot leak
Main risk: Reach claimed in a comment

Read analysis

Governance as the product145

Provem

All seven marks, and a replay script that asserts every published number rather than printing it — over a governance layer that can sit on top of someone else's memory.

Best idea: Erasure that outlives the record
Main risk: Suppressed at read, not refused

Read analysis

Architecture as the memory146

ARGO

Its memory is an ArchiMate model of the system being built — canonical as JSON, wiped and rebuilt into Neo4j — with four times more test code than implementation.

Best idea: Retrieval that fails closed
Main risk: The graph is an index, not a memory

Read analysis

The capacity to refuse147

AMITY / Archangel-8

Refusal as a first-class outcome — metered by priority, hysteretic so it cannot flap, and returned with a reason. Underneath, an episode with no identifier.

Best idea: A refusal you can read
Main risk: Nothing stored can be named

Read analysis

Governed memory as a runtime148

MemoryOps AI

Tenancy enforced by the database rather than the query, and an audit chain that cannot fork — with the normalized key a tombstone needs already stored, and scoped to live rows only.

Best idea: Isolation below the caller
Main risk: A deletion one predicate short

Read analysis

Consolidation with no oracle149

DeepCode

Every conversational turn is event-sourced with typed provenance. Durable facts are markdown notes a scheduled LLM pass may delete, over a store with no history — and the only mechanical check is whether the file count changed.

Best idea: Typed provenance on every input
Main risk: A file count standing in for a check

Read analysis

A harness that edits itself, undoable on one path150

Prime Agent

The agent rewrites its own prompts, memories, skills and subagent specs. Every /refine edit keeps a before-and-after snapshot and rolls back by id; the kernel calls it is also handed write the same file with neither.

Best idea: A background pass you can undo
Main risk: A second write door outside the undo

Read analysis

Provenance recorded twice, acted on once151

Mnemosyne

One SQLite file, one dependency, thirty tables. Two independent provenance fields — one that ranks an unknown origin above a known one, one that nothing reads — and a rejected fact that stays rejected because its primary key is a hash of itself.

Best idea: A tombstone that falls out of a hash primary key
Main risk: A trust field written on every path, read on none

Read analysis

Status decides what a memory may do152

Omi

A wearable that hears everything, over a hash-chained memory ledger — where an unreviewed fact may answer a question with a disclaimer, and only an accepted one may take an action that cannot be undone.

Best idea: Trust gates capability, not just recall
Main risk: Rejections keyed on rows, transcripts kept

Read analysis

Seven ways a write is refused153

Kiro Crew

A local workspace whose memory writes pass an ordered gate of seven typed refusals — and which scrubs credentials from a blocked injection's audit snippet, because the dashboard renders that snippet verbatim.

Best idea: Its own security log as an attack surface
Main risk: Refusals recorded, never consulted

Read analysis

fsck for a memory store154

mnemory

A self-hosted MCP memory server whose consistency checker screens stored memories for injection with a regex before any model reads them — and re-screens what already passed the filter at write time.

Best idea: Screen before the model, and screen again
Main risk: Correction is a penalty, and a verified state nothing filters on

Read analysis

Time doesn't validate, exposure doesn't validate155

Engram Alpha

Graph memory for coding assistants whose trust falls only when judged contradicting evidence lands — never from age, and never from being retrieved, because that would let a popular note certify itself.

Best idea: Retrieval moves nothing
Main risk: Deliveries graded, answers never

Read analysis

A source of truth that never hears a delete156

Helix AGI

A continuous single-agent runtime whose beliefs carry mass in an 8-D manifold and whose confidence is recomputed nightly from a written equation — beside an append-only journal that records every mutation except forgetting.

Best idea: Cutting the reachability-importance loop
Main risk: Deleted content still resolvable

Read analysis

Contradictions embeddings place far apart157

AIMAOS

A five-agent office whose duplicate detector matches phrasing skeletons with swapped value tokens — the case vector similarity is worst at, and the one where contradiction lives.

Best idea: A reversal is not corroboration
Main risk: The replaced value is stored, never read

Read analysis

The model never touches the state158

Aeris

A deterministic simulation engine whose only channel to a language model is a projection a validator rejects if it names an engine type — over a memory and belief store nothing in the engine ever writes to.

Best idea: Validating what the model may see
Main risk: The test suite is the only writer

Read analysis

One graph, three node kinds159

Mimir

A local-first Rust memory server where typed memories, doc chunks and code symbols are rows in one SQLite graph, ranked against each other in a single hybrid query; a deliberate deletion refuses its own return and its rewordings, a hash-only mutation ledger records who changed a memory and why, a review queue holds what the store will not decide, and recall answers as of a date on two separate time axes.

Best idea: A note and its symbol in one ranking
Main risk: Dedupe hash skips deleted rows

Read analysis

A memory policy with a fingerprint160

Cognis

An agent OS that owns no memory store and hashes the policy instead — backend, behaviour flags and instruction text in one fingerprint, stamped on the turn it governed.

Best idea: Which rules were in force, as a value
Main risk: Nothing epistemic crosses the seam

Read analysis

Memory about the agent, not the world161

Intaris

A guardrails service whose durable memory is a versioned risk profile of the agent itself, derived from its own audit history and read back before the next decision.

Best idea: A profile of the actor
Main risk: Mutable audit under a derived belief

Read analysis

Compiled truth over an append-only timeline162

brain.md

A markdown memory where every page holds current knowledge and its own provenance, one command rewrites the first while appending to the second, and a session hook injects the page listing — with tests asserting no page body can ride along.

Best idea: A rewrite that cannot skip its reason
Main risk: A funnel a text editor bypasses

Read analysis

A database whose primitives are cognitive163

MuninnDB

Decay, Hebbian learning and ACT-R activation implemented inside the storage engine — with a discrete trust label, valid time apart from record time, and per-engram provenance carrying the reason for every change.

Best idea: Provenance that records the reason
Main risk: A patent over the primitives

Read analysis

A tie against a published number164

iai-pme

A local-only personal memory whose contradiction is a new row and an edge, whose stale is a discount rather than a refusal, whose forgetting is a queue with an undo — and whose README describes a same-harness head-to-head that its own benchmarks page says was a comparison against a published figure.

Best idea: Both versions kept; validity derived from the corrector
Main risk: Two documents, one comparison, two stories

Read analysis

Conductance, not weight165

ostk-recall

A local recall service whose concept edges derive conductance from confidence and recency instead of storing it — and whose forget promises an anti-resurrection tombstone the write path never reads.

Best idea: A promoted edge must earn its conductance
Main risk: The forget warning asserts what the code lacks

Read analysis

Written only from losses166

SESA

A self-play RL trainer whose only durable memory is a bank of skill cards distilled from the solver's failures — and scored by whether the cards it handed over won or lost, with a negative score deleting the card.

Best idea: A hurt counter wired to deletion, not ranking
Main risk: Eviction leaves nothing, so the card comes back

Read analysis

Grounding as the write gate167

OpenSRE

An SRE agent that will not store an infrastructure fact unless the words in it also appear in something the user typed — and redacts credentials out of the transcript before the extractor ever sees it.

Best idea: Positive evidence of user authorship, not a stop list
Main risk: Forget leaves no record and extraction runs every turn

Read analysis

The eval that beat the design168

ClawMem

A local SQLite memory layer that measured its own composite ranking against the raw channel score, lost by a factor of three, and shipped the negative result as the default.

Best idea: Metadata demoted to a tie-breaker, on measurement
Main risk: Invalidation removes a document with no query-time notice

Read analysis

Draft until a person says yes169

Memory Palace

Derived memory that starts as a draft, needs a token to be approved, and is unrecommendable until it is — beside an audit table that nothing writes to.

Best idea: Draft-by-default enforced on the read path and at the schema
Main risk: The rejection is keyed on the row, not the content

Read analysis

What memory may authorize170

Midas

No LLM at ingest, verbatim recall, and a deterministic gate deciding what a memory is allowed to justify — scored against an adversarial suite with a benign-pass floor beside it.

Best idea: A prohibition vetoes a confirmation in the same evidence set
Main risk: The gate believes the provenance stamp

Read analysis

Trust-graded correction171

YesMem

Supersession resistance proportional to what a memory has earned — and the user confirmation the highest tier depends on is written to a column nothing reads.

Best idea: Correction costs more for memory that has been used
Main risk: The proposal queue has no consumer, so corrections vanish

Read analysis

Correction keyed on the fact172

memory-lancedb-pro

Fact-keyed supersession over LanceDB with a real validity axis and a loop that suppresses memory the agent kept ignoring — and a pending state that was written out of existence.

Best idea: A fact key, so an update replaces instead of piling up
Main risk: An LLM admission score is now the only gate

Read analysis

A dismissal that cannot be re-proposed173

Wenlan

A dismissed mind-map node keeps its fingerprint, and a unique index makes re-proposing it a no-op — a value-keyed tombstone on the suggestion layer, with the fact layer left unprotected.

Best idea: A database constraint, not a policy, enforces the refusal
Main risk: It covers placement, not the claim underneath

Read analysis

Refused if the code is gone174

Kage

A memory citing code that does not exist is refused at write time, and one whose cited symbols changed is withheld until re-verified — tested by deleting the files and checking it disappears.

Best idea: Staleness from per-symbol hashes, not a TTL
Main risk: The scope field is validated and never read

Read analysis

Trust and freshness, separately175

Icarus

Three thousand lines that keep provenance and staleness in different fields, make rolled-back terminal, taint everything derived from a bad entry, and test that none of it comes back.

Best idea: Two axes, a transition table, one terminal state
Main risk: The verifier is a free string defaulting to manual

Read analysis

Forgetting with reasons176

OMEGA

A genuine point-in-time filter over validity intervals and a forgetting log that keeps why every deletion happened — beside a review flag that is set and never cleared.

Best idea: Every delete leaves a row naming the reason
Main risk: A negative streak becomes permanent invisibility

Read analysis

The database refuses the row177

Octopoda

Tenant isolation enforced by Postgres row-level security instead of by remembering the WHERE clause, and a hash-chained audit that lives inside the memory table because the app role cannot create one.

Best idea: USING and WITH CHECK, under a role that cannot bypass
Main risk: A version history nothing can query

Read analysis

Uncertain merges need a person178

Vestige

Merge candidates classified by record linkage into match, possible and non-match — the uncertain classes need confirmation, and every applied operation carries its own undo payload.

Best idea: Two thresholds, with the middle routed to a human
Main risk: The headline benchmark is on another branch

Read analysis

A project that audited itself179

Shodh-Memory

A 153,000-line Rust memory server whose most valuable artifact is a committed self-audit finding a dead resolver, a header contradicting its own code, and a gate the upsert path voids.

Best idea: Publish the audit, with the evidence rules on top
Main risk: The findings are real and unfixed at this commit

Read analysis

A bandit on the index180

Token Savior

A contextual bandit reorders the memory index tool and learns from what the agent fetches, while every automatic injection hook scopes itself to whichever project holds the most memories.

Best idea: Reward the fetch, with the features kept from ranking time
Main risk: Hooks pick the project with the most rows, not the session's

Read analysis

Scoring the writer, not the source181

Recall

An actor's stated confidence is scored against whether their writes survived, and the Brier error attenuates every future claim they make.

Best idea: Calibration measured per writer, not assumed per origin
Main risk: requiresReview is rendered and never set

Read analysis

Facts split by whether they decompose182

CORE

Statements split across two stores by whether they decompose — world facts become Neo4j triples, the user's voice stays whole in Postgres — and a model-judged contradiction stamps an end time that nothing guards against a second stamp.

Best idea: A preference is not a triple, and is not stored as one
Main risk: A model judges contradiction without seeing what is closed

Read analysis

A project that withdrew its own results183

YantrikDB

Four published benchmark conclusions withdrawn because the condition labelled "structured memory" was a 120-line simulator — beside module headers that say what is not built, three of which have gone stale around the code.

Best idea: A 501 that names the replication path it lacks
Main risk: Crypto-shred destroys a key nothing encrypts with

Read analysis

The log is the memory184

Vibe Cognition

Each change is appended to its writer's own JSONL journal file before the graph moves, and a file that a checkout rolls back cannot shrink the graph: the writer's lost lines are appended back.

Best idea: Journal first; a rollback is repaired, not obeyed
Main risk: The agent picks whose personal constraints it sees

Read analysis

Bets that resolve, holders that score185

GBrain

Two memories over one Postgres: a hot-memory facts table written by a provenance-requiring verb or an opt-in Stop-hook extractor, deduplicated by cosine and a classifier, decayed by kind and valid between two dates at read time; and a takes table of claims typed fact, take, bet or hunch that a proposal queue feeds only when a person accepts, whose bets resolve into a per-holder Brier score, with BrainBench in the tree.

Best idea: A person between the extractor and the knowledge table, and validity read at query time
Main risk: Two validity models: facts read their window, takes store one and never read its end

Read analysis

An audit that outlives its database186

SuperLocalMemory

A hash-chained audit log on its own database connection, so the record survives corruption of the store it audits — and an EU AI Act module that refuses to certify compliance.

Best idea: Decouple the audit from what it audits
Main risk: Access control defaults to allow-all

Read analysis

Validity you can declare187

NornicDB

A database whose Cypher surface can ask what it recorded, at one commit version, as valid at another instant — with validity declarable as a schema constraint and a Kalman filter over confidence.

Best idea: One query fixes both the validity and the record clock
Main risk: Vector search reaches neither clock

Read analysis

A word for "was never true"188

Empirica

1,268 resolved findings, exactly one recorded as an error — so the project added a word for "was never true" and wrote the argument down: what the surface does not name, the practitioner does not reach for.

Best idea: A vocabulary measured from its own store
Main risk: The tag that catches gaming is v0, routing deferred

Read analysis

Correction that goes backwards189

Hexis

When a worldview belief transforms, a sweep re-examines every memory the old belief caused to be rejected — the only system here that asks what a superseded belief was suppressing.

Best idea: An edge recording why something was rejected
Main risk: The sweep's verdict is an unvalidated model call

Read analysis

A refusal that survives key rotation190

Noosphere

A revoked capture is refused on the write path by an HMAC digest checked against every retained key version — the only rejected-value record here that reasons about the key used to compute its own key.

Best idea: Keep the old keys, or every revocation lapses
Main risk: The tombstone expires after ninety-one-one days

Read analysis

Fade unless used191

CortexGraph

Memories fade on an Ebbinghaus curve unless use reinforces them — and a committed spec argues the append-only log should go because "the data structure is fighting the biological model".

Best idea: Forgetting is the default, keeping is the exception
Main risk: LICENSE says AGPL, CITATION.cff says MIT

Read analysis

Every decision kept, accepted or not192

virtual-context

A self-reorganising tag vocabulary over a fact store whose every accept and reject is written to a decision ledger a database trigger refuses to let anyone edit.

Best idea: Append-only enforced by the schema, not the code
Main risk: The rejects are kept and never read

Read analysis

Forgetting that leaves a pointer193

MemoryBear

Low-activation memories merge into a summary node that keeps DERIVED_FROM edges to what it replaced — and each forgetting cycle records how many fusions failed.

Best idea: Fuse with provenance instead of deleting
Main risk: Every benchmark number is an image

Read analysis

Nothing mutable left194

Jumbo Context

One JSON file per event, atomically written, with thirteen aggregate streams and a rebuild the tests actually compare — and a review workflow whose reviewer is a daemon that spawns an agent.

Best idea: A versioned fixture porting the harness's own parser
Main risk: Agents cast the approvals and loggedBy is never set

Read analysis

Read mid-refactor195

NeuroCA

Three tiers, a lymphatic consolidator and neural tubules — with every integration test of the memory system skipped at module level because they "use the old memory architecture".

Best idea: forgotten as an explicit pre-deletion state
Main risk: Zero durable-backend coverage at this commit

Read analysis

Claims graded by evidence196

Project Athena

A README that grades its own claims from shipped to N=1, docs that cite the paper saying its own mechanism raises agreement sycophancy by 45%, and a labelling convention no code reads.

Best idea: Publish what is enforced in code and what is prompt
Main risk: Its anti-mythologizing convention is prose no code reads

Read analysis

Tests for an API that is not here197

mem9

A committed end-to-end suite specifies tombstone revival by dominating vector clock — against endpoints, a tombstone field and a clock that appear in no Go file in the repository.

Best idea: Asking what "deleted" means under concurrency
Main risk: The suite documents code that is not published

Read analysis

Check the plan before you run it198

AURORA

A query decomposition is checked against an adversarial prompt template before retrieval runs — and the README documents a retrieval-quality gate whose parameters the function does not take.

Best idea: Verify is phase four, before anything expensive
Main risk: The documented example would raise

Read analysis

A budget on how often memory may speak199

AIPass

Surfacing is governed by a pure function with a per-session cap, a minimum message gap and a cooldown — so a relevant memory can still be refused because it spoke too recently.

Best idea: Rate-limit recall, and return the reason
Main risk: An LLM dedup verdict that may delete

Read analysis

Search for what would refute the answer200

total-agent-memory

A second retrieval against an inverted query, scored for contradiction, so a strong conflict makes the question unanswerable instead of picking a side.

Best idea: Retrieve the refutation and let it win
Main risk: A headline delta between unlike metrics

Read analysis

A gate that tests whether the gate discriminates201

OmniMemory

A default-deny AST check with positive and negative controls over its own checker, an expire command that yields an outcome event or a nack, and a retrieval node that can only serve unseeded test doubles.

Best idea: Prove the gate fails when violated
Main risk: Retrieval has no working backend

Read analysis

SIGKILL the writer, then count the frames202

Wax

A harness that forks a child, kills it at a named point in the commit sequence, reopens the file and asserts the exact frame count — and fails if the child did not crash.

Best idea: Prove the commit protocol survives a kill
Main risk: Nothing establishes who may approve

Read analysis

A leaderboard that puts someone else first203

TrueMemory

Three-run means with the individual runs published, a rival ranked above itself, the rubric's leniency disclosed, and the worst category printed at 19.5%.

Best idea: Publish the caveat that costs you the win
Main risk: Corrections found by regex, rebuilt each pass

Read analysis

You may not write until you prove you asked204

Daem0nMCP

Mutating tools are blocked by middleware until the agent holds a signed, expiring token proving it called context_check — consultation as a precondition, not a convention.

Best idea: A receipt proving memory was consulted
Main risk: The signing key ships as a default

Read analysis

A third verdict with nowhere to live205

PLTM

A four-judge jury returns approve, reject or quarantine on every write — and quarantine is stored by halving a float and appending a marker into a free-text field.

Best idea: Contradictions look like agreement to cosine
Main risk: A unit-test pass rate reported as accuracy

Read analysis

The collision policy is chosen by memory type206

Memoir

Working memory overwrites, episodic accumulates, semantic is confidence-gated and procedural is LLM-merged — the taxonomy path decides which, in a pure module with no store, no I/O and no model call.

Best idea: One collision policy per memory type
Main risk: A complete harness with no results run

Read analysis

Four defects found by running someone else's engine207

MemoMind

A downstream integrator's patch file against Hindsight — including a consolidator that copies single facts into observations, and a dedup threshold the model paraphrases past.

Best idea: Write down what broke, with the reason
Main risk: The installer turns off database auth

Read analysis

You may not record a lesson without two arguments against it208

GitMem

Scars are refused at write time unless the author supplies at least two counter-arguments, and a PreToolUse hook hard-blocks consequential actions until recalled scars are applied, ruled inapplicable, or refuted with a risk acknowledgment — a gate that counts confirmations rather than matching them to scars.

Best idea: A memory that carries its own rebuttal
Main risk: A confirmation gate that counts instead of matching

Read analysis

Erase the content, keep the proof it existed209

Engram Provable

Crypto-shredding resolves right-to-erasure against an append-only audit chain — content becomes ciphertext under a discarded key, and the tamper-evident record of the erasure survives.

Best idea: Erasure that an append-only log survives
Main risk: The headline benchmark is off-repository

Read analysis

Retracting a fact should shake its whole story210

AgentWorkingMemory

A retraction propagates a contamination penalty weighted by how tightly the neighbourhood coheres — dense narrative clusters get up to 1.5×, sparse ones 0.5× — because misinformation persists as a coherent story.

Best idea: Correct the narrative, not just the fact
Main risk: Asserted multipliers on a cascading penalty

Read analysis

How fast a fact goes stale depends on what kind of fact it is211

Second Brain

A durable/state/volatile classifier that abstains when unsure sets each memory's recency floor, so age becomes a tie-breaker instead of a gate.

Best idea: Decay by claim type, with a floor
Main risk: System verdicts in a writable tag array

Read analysis

The unflattering number is committed; the badge is not about it212

Context Mem

A gold 100% LongMemEval badge that means recall@5 with a judge blend, over a committed end-to-end QA result of 46.6% in the same repository.

Best idea: Forget by losing resolution, not by deleting
Main risk: A badge naming a metric it does not report

Read analysis

The session summary is a form, not a paragraph213

MoltBrain

Summaries are parsed into fixed fields — request, investigated, learned, completed, next steps — and observations are extracted from XML blocks the model emits, with no confidence, status or correction anywhere.

Best idea: A session summary with columns, not prose
Main risk: Nothing in the store can be wrong

Read analysis

The gap is not the issue. The metric is.214

Fidelis Memory

A local verbatim memory whose corrections supersede without erasing, whose time-aware recall demotes rather than hides, and whose benchmark writeup declines the flattering comparison.

Best idea: Decline the comparison that flatters you
Main risk: Every status is advisory; nothing is withheld

Read analysis

A charter its own published numbers do not yet meet215

TeleMem

Nine binding rules for any number the project publishes — including a grep baseline, adversarial judge validation, and an instruction to check whether you need a memory system at all.

Best idea: Publish the rules your numbers must meet
Main risk: The methodology ships; the runs do not

Read analysis

Regression tests for memory216

Mengram

Revising one learned procedure is checked against every other procedure that shares its surface, and a revision that would break a dependent is quarantined instead of promoted.

Best idea: Ask what depended on the memory you fixed
Main risk: A quarantine nobody can read

Read analysis

A path traversal it found in itself, with the payload printed217

OpenCode Memory

A committed security audit grading five findings in its own code, each with the exploit path, the fix, and the regression test that pins it — including the one it did not fix.

Best idea: Audit yourself and publish the payload
Main risk: The audit is pinned to an older commit

Read analysis

Truth as of a time218

LongMemory

Formerly OpenMemory, rewritten: strict recall is one query asking what was true at a moment — excluding superseded facts and anything under an unresolved contradiction — and not one committed test checks it.

Best idea: A contradicted fact is withheld from reasoning until resolved
Main risk: No test file anywhere, and the invariants are strings

Read analysis

Two benchmark tables that do not reconcile219

Ori Mnemos

A LinUCB bandit that learns which retrieval stages to skip per query type, under README and bench tables whose numbers disagree with no committed run to adjudicate.

Best idea: A pipeline that learns to skip itself
Main risk: Results gitignored, tables disagreeing

Read analysis

Decay decides what to prune, never what to rank220

YourMemory

An audit chain that logs memory ids and never their content, over a decay model deliberately kept out of the ranking formula because it would bury old-but-valid memories.

Best idea: An audit log that is not a copy of the data
Main risk: Contradiction detected, then overwritten

Read analysis

"You were wrong" and "the world changed" are different verdicts221

cortex-engine

A contradiction is adjudicated into five outcomes before it becomes a signal, and only the genuine one penalises confidence — a supersession is routed to bitemporal succession instead.

Best idea: Refutation and supersession, judged apart
Main risk: A dozen named mechanisms, none evaluated

Read analysis

A silent loss is worse than the bloat222

obsidian-mind

A byte budget on session-start injection that degrades the cheapest-to-lose sections to pointers and then names every one it dropped, ranked by value density rather than size.

Best idea: Name what the budget dropped
Main risk: Correction is a sweep someone runs

Read analysis

Find out whose transcripts these are before distilling them223

vir

Three independent detectors keep agent-internal runs out of a vault distilled from transcripts, and rules mined across sessions wait for a person, who can refuse one for good.

Best idea: Check whose logs those actually are
Main risk: Notes serve before anyone reviews them

Read analysis

A whitelisted shell for the memory repo224

DiffMem

The retrieval agent explores memory with grep, git log and git blame behind a thirteen-command allowlist whose splitters miss two of the shell's separators — and then hands the string to a shell.

Best idea: Let git be the log you already have
Main risk: Validated by shlex, executed by a shell

Read analysis

A distilled skill is inert until a person installs it225

MemSearch

Procedural memory distilled from repeated workflows into candidates that never reach the agent's skill directory on their own — from a vector-database vendor whose vector database is the derived layer.

Best idea: Distilled, but inert until installed
Main risk: The ungated pass rewrites the durable notes

Read analysis

Strip the query from the document before you test retrieval226

mnemos

A single cgo-free Go binary that indexes a project's documents into SQLite and serves cited BM25 hits over MCP, with a leakage-controlled held-out retrieval eval.

Best idea: An eval that cannot cheat by leakage
Main risk: The collection is a filter the model may omit

Read analysis

The model retypes your text and the match fails227

Nocturne Memory

A fuzzy patch matcher that normalises curly quotes and dash variants to find an edit target, then uses a position map so the replacement lands in the original bytes.

Best idea: Match normalised, replace in the original
Main risk: In-place patching with no record

Read analysis

A run that only adds is a failure mode228

Claudest (claude-memory)

A consolidation protocol that must produce removals, settles retirements before clustering so nothing masks a removable entry, and verifies each deletion actually happened.

Best idea: Judge consolidation by what it removed
Main risk: The protocol is prose, enforced by nothing

Read analysis

The run log names a different dataset from the claim229

agentmemory V4

A world-record LongMemEval claim with the result file, the run log and a self-audit all committed — and all three name the oracle variant while the README says LongMemEval_S with no oracle access.

Best idea: Commit the log that lets you be checked
Main risk: The compared numbers are a different variant

Read analysis

Store only what you failed to predict230

memv

Importance emerges from prediction error — the model is asked what an episode should contain, and only the gap between that guess and the actual transcript is extracted.

Best idea: Surprise as the storage criterion
Main risk: The criterion itself is unmeasured

Read analysis

The baseline column is a constant with a comment231

MemCP

A published head-to-head report whose "Native" column is native_value=5.0 # Typical ~5% retention typed into the test, against a measured RLM column.

Best idea: Being misled costs more than helping earns
Main risk: A comparison column nobody measured

Read analysis

A canary secret in each of ten tenants232

ArcRift

An isolation test that plants a named secret in every project, spawns a live server, and asks each tenant for another's key under concurrent load — with the report committed.

Best idea: Ask the wrong tenant for the secret by name
Main risk: Seven capture platforms, three monitored

Read analysis

Salience by example, with an API key among the examples233

Memlayer

A storage gate that scores text against hand-written prototype sentences instead of asking a model — and one of the prototypes for what to remember is an API key.

Best idea: A decision boundary you can read and edit
Main risk: Credentials scored toward being stored

Read analysis

A hypothesis is not a fact, and gets its own table234

Stash

Proposed, testing, confirmed or rejected — with a verification plan, the fact that confirmed it, and the reason it was rejected, all in a table facts cannot be read from.

Best idea: Inferences live somewhere recall cannot reach
Main risk: One reasoner judges three things, unevaluated

Read analysis

The excerpt has to appear in the source235

knowledge-worker

A high-confidence claim must carry a supporting excerpt, and the excerpt is substring-matched against the source — a fabricated quote demotes the claim and the demotion is recorded with its reason.

Best idea: Check the quote against the source
Main risk: Catches invention, not misquotation

Read analysis

A schema that deleted its own dead fields, with receipts236

memory-ts

Seven metadata fields removed in one version, each with the evidence — "580 variants, never used", "always empty", "no logic implemented" — recorded in the schema's own history.

Best idea: Delete the fields nothing reads, and say why
Main risk: The curator is the product and is untested

Read analysis

An agent can leave a note for another agent237

MarsNMe

session_close(to, note) writes an addressed message that session_boot delivers and marks read — an indexed mailbox inside the memory store, with provenance enforced by a database CHECK.

Best idea: An addressed note, delivered once
Main risk: The constraint holds in one schema, not both

Read analysis

Correction that never reaches the retrieval lane238

breadcrumbs

A copy-and-adapt agent-ops kit whose sharpest artifact asks not whether a ledger entry is still true but whether it can ever be seen, with committed cases asserting that a superseded entry must never win the injection lane.

Best idea: Test that the correction reached the prompt, not just the row
Main risk: The fleet architecture its docs describe is not in the tree

Read analysis

Memory in CI, on an integrity lattice239

gh-aw

Three cross-run memory backends for a GitHub Actions workflow — a cache, a git branch, an issue comment — each restored through a gate that assumes the previous run of itself was compromised.

Best idea: Higher-trust workflows never read lower-trust memory
Main risk: The trust label describes the writer, not the claim

Read analysis

Session knowledge across seventeen harnesses240

Context Mode

A tool-output sandbox whose real durable artifact is a per-project SQLite event log, replayed into the next session as a session_knowledge block — with a committed test that another session's events must not appear in it.

Best idea: The cross-project parameter is absent from the tool schema
Main risk: No correction, and the only delete destroys the store

Read analysis

Procedural memory, and nothing else241

Ollama

A local inference runtime that grew an agent mode whose only durable memory is a skill catalog on disk — advertised by name in the prefix, loaded on demand, and gated by approval when the model asks for it.

Best idea: Approval on recall, because instructions steer the run
Main risk: Nothing the agent learns survives the run

Read analysis

Memory as a link graph, with an integrity checker242

Serena

Markdown memories that cite each other by name, a checker that reports every link pointing at nothing, and a rename that rewrites every reference to the file it moved.

Best idea: Referential integrity over the memory store
Main risk: Links are checked outward, never inward

Read analysis

A recipe that links notes on the way in243

claude-code-memory-setup

A guide, a 387-line importer that cron runs nightly and a SessionEnd hook that file Claude Code sessions into a tagged Obsidian vault, inserting wikilinks to existing notes as they write.

Best idea: A new note joins the graph without anyone curating it
Main risk: The rewrite is silent, and the guard is a length check

Read analysis

A full memory system inside a router244

vLLM Semantic Router

An Envoy-layer router with 10,777 lines of memory beneath it: typed memories, four backends, a no-LLM injection gate, and a committed test documenting that it cannot detect a contradiction yet.

Best idea: A characterisation test for the mechanism it hasn't built
Main risk: Contradicting facts both stored, both retrievable

Read analysis

A guard on the retrieval path, off by default245

ruflo

A swarm meta-harness whose memory package screens retrieved chunks for prompt injection before they reach an agent's context, cites the paper for why, and ships that defence disabled.

Best idea: Guard the retrieval path, and never truncate a chunk
Main risk: The only content defence is off by default

Read analysis

Cross-session continuity, fenced as data246

token-optimizer

A waste-detection plugin whose real memory is a checkpoint written at context-fill bands and recovered into a later session on topic match — injected behind a trust=data sentinel, with another project's decisions dropped and the dropping disclosed.

Best idea: The fence is tested against forged copies of itself
Main risk: Nothing is corrected, and nothing prunes the store

Read analysis

The state machine is a regex over the card's own prose247

klypix-mcp

One ZIP canvas committed beside the code, holding a project's decisions for nine coding agents at once — where a card is current or superseded according to a marker in its own text and the title of the container it sits in.

Best idea: The benchmark runs a negative control and can call itself inconclusive
Main risk: Rename one container and every retired decision reads as current

Read analysis

A decision ledger that validates before it appends248

agent-mesh

A hash-chained append-only event log whose decision records carry tiers and executable verification commands, validated at append so a malformed event never lands and run through argv rather than a shell — with a reviewer quorum that withholds promotion until enough named reviewers accept the current revision, while the grounding packet an agent receives still never reads the decision store at all.

Best idea: An acceptance below quorum is logged and promotes nothing
Main risk: No decision reaches the agent automatically

Read analysis

A conversation handle in a request header249

SmythOS SRE

An agent runtime whose access check is a decorator nobody can forget — guarding a conversation transcript that is written team-scoped and fetched across processes by an id the client supplies in an HTTP header.

Best idea: Scope enforced by a decorator, not by a query clause
Main risk: The default account connector puts everyone in one team

Read analysis

Memory of what was seen250

Qwen MM Plugins

A four-level graph built once over hours of footage and searched by dense-plus-BM25 fusion — with no way to correct a wrong extraction, and a skill that tells the agent to go back and watch the video.

Best idea: The tool description teaches the retriever's failure mode
Main risk: Nothing can be deleted, updated or superseded

Read analysis

A refusal keyed on the content hash251

remem-mcp

A local-first MCP memory server whose capture path hashes the redacted content, looks it up among rejected rows, and refuses the write with the stored reason — behind a session key applied to the BM25 and vector arms alike.

Best idea: A refusal keyed on the content hash, consulted before every capture
Main risk: The model can set override_rejection on itself

Read analysis

Branches are kept, versions are not252

Windie Sandbox

A conversation stored as one shared message tree, where forking preserves every branch for the cost of one row — and editing overwrites the message in place, rewriting the history of every branch below it.

Best idea: A fork costs one insert at any history depth
Main risk: An edit is a one-way door with no prior version kept

Read analysis

Which copy of the record gets scored253

PLUR1BUS

An OpenClaw memory plugin with fifty-five config groups over one unusually careful correction path — where a change needs evidence, a new embedding and an event log entry — beside a real-world validity window and a content-fingerprint tombstone that every card writer consults.

Best idea: Corrections demand evidence and are written before the old row is retired
Main risk: Contradiction is a ranking penalty, not a filter, so a flagged conflict still reaches the prompt

Read analysis

The gate refuses what the query selects254

OmniIntelligence

Patterns learned from coding sessions, moved by an evidence ladder that only ever increases — enforced in the WHERE clause — with demotion deliberately harder than promotion and a 20-point band between them. Four of its best mechanisms are not wired to anything.

Best idea: Demotion needs more evidence than promotion, and the band is bounded against override
Main risk: The cold-start path selects exactly what the reducer refuses

Read analysis

Memory under a standing trial255

OmniClaude

The injection half of a closed loop, and the only system here that holds out a control cohort: one session in five receives no memory at all, and still writes a record saying so. The injection hooks are disabled on purpose to measure the baseline — and registration turns out to be one of four ways a hook here goes dark, three of them invisible to the repository.

Best idea: A control arm that leaves a record carrying the experiment's own parameters
Main risk: Cohort identity is the session, so both arms share a store the treated arm teaches

Read analysis

A gate on what the model sees256

Hillock

A small local triple store whose hypervector gate decides which facts may reach the model, and in strict mode returns a fixed refusal without calling it. The default mode sends blocked questions to the model anyway, and the gate averages over query tokens, so a four-word question blocks against its own exact fact.

Best idea: No stored fact reaches the model without clearing the gate
Main risk: The gate's score falls with question length, and the default mode asks the model anyway

Read analysis

A tombstone that blocks the close257

Memory Compiler

Four Markdown files and an 848-line validator that refuses to seal a session while a rejected value has been reasserted verbatim — and whose collision scan ignores anything under twelve characters, which is both tombstones in its own worked example.

Best idea: A rejected value reasserted in canonical memory blocks the session close
Main risk: The noise floor excludes dates, prices and colours — most of what gets corrected

Read analysis

Deletion residue as a partition258

Agent Memory (MythologIQ)

A governed-memory reference architecture whose deletion metric is a four-way residue partition with one cell that must stay empty — verified by a sweep that re-derives what survived instead of asking the purge whether it finished.

Best idea: Residue is allowed; residue you did not declare is a failed deletion
Main risk: Every property is demonstrated against an in-memory substrate

Read analysis

Forgetting by scheduled reversion259

ODS

A deployment system for a local AI stack whose one memory component resets an agent's MEMORY.md to an operator-authored baseline every few hours — archiving the scratch notes below a --- the agent itself can accidentally move.

Best idea: The authority boundary is a position in a file, enforced by overwriting
Main risk: The boundary is the last separator, and on the shipped baselines only the agent ever draws one

Read analysis

No citation, no memory260

NeuraKeep

A local-first MCP memory layer whose write gate blocks any event, fact or failure arriving without a source and a section citation, and where nothing becomes durable without a person applying a proposal — but whose agent-facing search reads every space when the model omits one.

Best idea: A memory that cannot cite its source is never created
Main risk: An optional space argument on the tool the model drives

Read analysis

Programmatic memory261

PRO-LONG

An ARC-AGI-3 harness whose entire memory is one append-only text log the coding agent greps, shipped with the flags that remove it and the committed runs that price what it buys.

Best idea: The ablation is a flag, and the arm is committed
Main risk: Sync offset read from a file the agent may write

Read analysis

Recorder as actuator262

arc-code

An ARC-AGI-3 harness whose log cannot be bypassed, because the process that writes it is the only one holding the key — plus 191 sessions analysed for how a file-based agent memory fails.

Best idea: The thing that causes the effect writes the record
Main risk: Change detected by file size, not by digest

Read analysis

Decision ledger263

OmniNode Knowledge Base

A typed decision ledger with a status enum per artifact kind and eight CI-gated checks — none of which covers the rule the project leads with, that an accepted decision references its evidence artifact.

Best idea: A status vocabulary per artifact type, schema-generated
Main risk: The stated invariants are the unchecked ones

Read analysis

Status that governs264

MindCache

A four-type memory in a self-reorganizing topic tree whose decision status is filtered where retrieval candidates are assembled — under two benchmark badges no committed artifact scores.

Best idea: Filter the status where candidates are gathered
Main risk: A "Passed" badge with no scored artifact

Read analysis

Shared across agents265

OpenAkashic

A single public memory every agent can read and write, where a superseded note is dropped before indexing on one read path and merely demoted on the other — by a penalty its own confirmations pay back.

Best idea: Search that returns its own epistemic next step
Main risk: A fixed demotion against cumulative evidence

Read analysis

Local terminal agent266

Otis

A local coding agent whose memory is a session log, a Markdown fact store recalled across every workspace, and skills cloned from a git URL with no revision — in a repository that checksums its own binary and its bundled skill.

Best idea: Compaction never rewrites the log
Main risk: Procedural memory pinned to a URL, not a commit

Read analysis

Ledger of intent267

Ouroboros

A spec-first agent OS that stores no facts about the world — only what it believes the user asked for, on whose authority, and what displaced the answer before it.

Best idea: An adopted fact cannot become a requirement
Main risk: The belief expires with the build

Read analysis

Portable memory format268

memoir-cli

A published format spec whose merge semantics get deletion right, over a federation of other tools' memory directories — where the tombstone it argues hardest for has no shipped writer.

Best idea: Monotonic tombstones, date-independent by design
Main risk: No user surface can create one

Read analysis

The search it ships turned off269

DeepSeek Harness

An agent harness whose durable memory is an append-only session log where nothing is overwritten — and whose cross-session full-text search and five model-facing history tools are both real, both carefully authorized, and both absent from every shipped composition.

Best idea: Compaction shadows, and the shadow stays searchable
Main risk: The searchable history is off by default, twice

Read analysis

Scope is the directory name270

Mobius

A source-available team platform driving Claude Code and Codex in tmux, whose memory is markdown files partitioned by a user= and project= path segment — where the write path was containment-checked and the read path was not.

Best idea: One file format for skills and memories
Main risk: A scope key that is also a filesystem path

Read analysis

Corrections into preferences271

Open Second Brain

An Obsidian-vault memory whose nightly pass promotes repeated corrections into preferences on a Wilson lower bound, demotes them through a probation state, and lets a user's rejection suppress the signals that would regrow the rule.

Best idea: Confidence is a lower bound, not an average
Main risk: The counters are self-reported

Read analysis

Fifty runs of a closed graph272

Zep

The client half of a hosted temporal knowledge graph, whose fifty committed LoCoMo runs grade retrieval sufficiency separately from answer correctness and show accuracy-given-a-complete-context flat at 92 percent across a 5.8x swing in retrieved tokens.

Best idea: Grade the retrieval, not just the answer
Main risk: The mechanism is behind an API

Read analysis

The forgetting curve, inverted273

MemoryBank

The reference implementation of the Ebbinghaus forgetting curve in agent memory, whose retention formula is missing a pair of parentheses — so recalling a memory makes it exponentially more likely to be deleted, stochastically, in place, for every user, at startup.

Best idea: Recall-strengthened decay as a primitive
Main risk: The curve points the wrong way

Read analysis

Memory as a plan after failure274

Reflexion

Verbal reinforcement learning whose entire memory is a per-environment list of plans written only after failures, persisted as JSON and reloaded on resume — read three at a time, so the store grows forever while the readable window never does.

Best idea: Split the actor from the reflector
Main risk: Old plans sink but never leave

Read analysis

A conformance suite for the other half275

LangGraph

A namespaced key-value memory store with TTL and semantic search behind three backends, shipped beside a portable conformance suite that validates the thread-scoped checkpointer and not the store — which is where the three backends disagree.

Best idea: The scope is half the primary key
Main risk: The untested half is the durable one

Read analysis

The memory it deprecated276

LangChain

The framework that named the memory vocabulary everyone still uses has removed all of it: version 1 owns no store, and the ten classic memory classes survive in a legacy package under a removal notice.

Best idea: The window/memory split, as a package boundary
Main risk: An empty summary deletes the entity

Read analysis

Thirty reference implementations277

Agent Memory Techniques

A teaching corpus of thirty runnable notebooks whose forgetting curve is the one the paper it cites got backwards, whose right-to-forget delete fans out across four stores and writes a receipt, and whose contradiction rate divides by every pair it never compared.

Best idea: Decay by half-life, and archive what you prune
Main risk: A rate whose denominator was never measured

Read analysis

A dream that deletes what it read278

Grok Build

A Rust coding agent whose markdown memory is consolidated by a dream pass that overwrites the project memory file with a character-truncated model response and then deletes the session logs it read — beside the most careful read path here, which stamps every recalled memory with its own age.

Best idea: Injected memory carries its own age
Main risk: Consolidation overwrites, then destroys its sources

Read analysis

Postmortems in the comment above the fix279

RunarForge

A four-layer memory for coding agents whose graduation sweep reads the newest five hundred entries and therefore cannot see the old ones it exists to archive — in a codebase that documents its own past failures, with counts, in the comment above each fix.

Best idea: One redaction chokepoint, ordered before truncation
Main risk: Graduation pages by recency over an aging ladder

Read analysis

The finding is the memory unit280

REDCELL

A pentest agent whose durable memory is a table of findings, loot and hosts that a human triages — verify, dismiss, merge — and that the agent reads back wholesale on reopen, where a dismissed false positive is the clearest example of a corrected memory in the atlas.

Best idea: A memory unit that is a claim a human can reject
Main risk: Recall is a paste capped at forty by recency

Read analysis

A schema the agent's prompt cannot override281

Neuron

Markdown-as-memory for coding agents whose CLI refuses a write that violates a per-category schema no matter what the agent's prompt says, with a SQLite index rebuilt from the files and a recall hook the harness runs instead of the model.

Best idea: Schema enforced on the write path, below the prompt
Main risk: Markdown truth a parser edge case can corrupt

Read analysis

When the embedding model changes, rebuild282

WindieOS

A desktop-agent runtime whose local two-tier episodic/semantic memory stamps every FAISS index with the embedding space that built it — and, when the SDK's embedding model or dimension changes, clears the vectors and re-embeds from SQLite rather than comparing across incompatible spaces.

Best idea: Refuse to compare vectors across embedding spaces
Main risk: No episodic-to-semantic delete cascade

Read analysis

A quarantine that checks the base rate before it blames283

Sonder Runtime

A self-modifying agent runtime that quarantines a distilled lesson when its loss run is improbable for its retrieval-frequency band, splitting blame across co-retrieved lessons.

Best idea: Outcome-gated quarantine with a base-rate test
Main risk: Only as good as its outcome signal

Read analysis

Surface the memory when its basis drifts284

GMR

A grounding runtime that binds a memory to the observable facts it depends on, re-observes them with a versioned probe, and surfaces the bound memories when the fact's content hash crosses a declared transition — journalling a probe failure apart so an outage never masquerades as a change.

Best idea: Re-check the fact a memory depends on, not its age
Main risk: Grounds and surfaces; never decides correctness

Read analysis

A daemon mines the thinking blocks285

Continuous Claude

A Claude Code layer whose background daemon spawns a headless model to distill typed learnings from a finished session's thinking blocks — the reasoning, not the actions — embeds them into a pgvector store, and recalls them into later sessions by hybrid RRF. A real cross-session loop wrapped in more design than the code delivers.

Best idea: Learn from the thinking blocks, not the transcript
Main risk: Global unscoped recall; the design overshoots the code

Read analysis

A trust model written and never read286

MCP-Memory

An MCP server storing memory as Open Knowledge Format markdown indexed in SQLite FTS5. It serializes OKF's verified, status and stale_after trust-and-lifecycle fields faithfully — and no read path consults any of them.

Best idea: Human-readable OKF records with a dated change log
Main risk: The trust and lifecycle fields are inert

Read analysis

Refuses to load if the chain was tampered287

MentisDB

A Rust memory daemon whose thoughts are an append-only, SHA-256 hash-chained log verified on open — a tampered chain refuses to load. Corrected only by appending a supersession, recalled by BM25, vector and PageRank together, beside a git-like, Ed25519-signed skill registry.

Best idea: Verify the chain on open; refuse a tampered history
Main risk: Tamper-evidence is detection, not prevention

Read analysis

Rules read at the moment they bind288

Monet

A local-first SQLite concept-graph for coding agents: principles always in front of the model, rules bound to named stages read when a matching tool call fires, corrections governed by a human declare/ratify/resolve loop. Marketed as a clean trio, built as a graph with a gate.

Best idea: Declare vs propose: humans gate the constraining memories
Main risk: Stage-binding is lexical and agent-pulled, not enforced

Read analysis

One local memory, injected into every agent289

Memmy

A local-first SQLite memory hub from the MemOS team that distills a layered L1→L2→L3→Skill store from every connected agent's turns, shares it across Claude Code, Codex, Cursor and others through one daemon plus an injected per-agent CLI skill, and induces anti-pattern "avoid" policies from failures.

Best idea: One shared brain via an injected per-agent CLI skill
Main risk: The shared recall has no scope, by design

Read analysis

No vector DB — the model is the retriever290

Always-On Memory Agent

A Gemini/ADK memory agent that stores structured memories in SQLite, never embeds or searches them, and loads a recent window for the model to read — with an always-on daemon that consolidates memories into cross-cutting insights on a timer, the way sleep is said to.

Best idea: Replace retrieval with a read; consolidate on a timer
Main risk: Recall is a recency window, not relevance

Read analysis

Shell history as memory291

NexusMem

Records what happened on the machine — shell and agent commands with their exit codes, git patches, docs — into local SQLite. When a Claude Code command fails, a hook says whether that same execution failed in this repository before, what was edited each time, and whether the fix that followed held.

Best idea: Recall keyed on an execution hash, worded by whether the recorded fix held
Main risk: Nothing withholds a memory, and a forgotten value stays in cleartext beside its hash-only tombstone

Read analysis

Memory that can die292

feltstate

Facts decay, corrections supersede, retractions stay on disk for audit, and a real death removes the rows from the live store and every snapshot under a crash-safe transaction — witnessed by a hash-linked ledger that alarms when a row disappears without a tombstone vouching for it.

Best idea: Seal only what should never change, so living isn't tampering
Main risk: Retract hides; re-assert the value and it comes back live

Read analysis

A cached prompt that names no fact293

Reasonix

The cached prompt carries a fixed memory protocol and the pinned fact bodies, so every other fact reaches the model through per-turn recall — and a forgotten pinned fact stays in that prompt until the next session. Its committed benchmark runs a memory-off arm with a column for when memory hurt, though one of its five must-not checks cannot pass.

Best idea: A subject key naming which question a fact answers
Main risk: A forgotten pinned fact stays in the prompt all session

Read analysis

Gravity instead of cosine294

Cognitive Spatial Memory

Helix AGI's spatial engine published as a standalone library: embeddings projected into a fixed 8D manifold and ranked by temperature × mass ÷ distance², so a faded memory is outweighed rather than cut off by a threshold. Its own docstring names the parent it came from.

Best idea: Recency as a force, so nothing is excluded by a cutoff
Main risk: No delete path exists anywhere in the package

Read analysis

Scope on every retrieval arm295

kube-coder

A per-workspace SQLite memory shared by a dashboard and an MCP server, whose namespace filter is applied to the FTS pass, the LIKE fallback and the vector hits alike — so a high-scoring out-of-scope memory can never be fused back in. Its scope tests attack prefix-sharing siblings and SQL wildcard escapes.

Best idea: Scope every arm of a fused retriever, and test the escapes
Main risk: Upsert clears the delete flag it wrote

Read analysis

Verify the rewrite, not the model296

Munder Difflin

Per-agent markdown memory in three regions — pinned facts, a rolling recursive summary, the newest sections verbatim — condensed by a headless model behind a six-check gate that requires the kept sections to round-trip byte-for-byte and leaves the original untouched on any failure.

Best idea: Back up first, then verify the rewrite against stated properties
Main risk: 124 test files, and none of them calls the gate

Read analysis

Lessons refused at write time297

Hats

Five memory layers separated by lifetime and owner, where a lesson the agent distilled from its own failure is refused before it is stored if it would widen what the agent may touch — by a rule file that names the function doing the refusing, and a registry that will not load a rule whose enforcement point does not exist.

Best idea: Refuse the memory at the door, not at the query
Main risk: The hash-chained audit log records no memory change

Read analysis

Redaction ordered ahead of persistence298

ByteChef

A workflow platform where agent memory is a socket on the canvas — a knowledge base behind a decorator that AND-s its scope key into every search, and nine interchangeable chat-memory backends. Masking is ordered one step upstream of the write, so what persists is the masked text.

Best idea: Redaction ordered upstream of the chat-memory write
Main risk: Tenant and environment both default to a live target

Read analysis

A stop hook that will not let the session end299

growmos

A dependency-free knowledge graph in JSONL beside your repo, where the edge id is a hash of the triple so a second document corroborates instead of duplicating — and the graph stays current because a Stop hook blocks the session while work is pending, not because the agent chose to.

Best idea: Maintenance enforced by control flow, not asked for in a prompt
Main risk: A merge deletes, and nothing records what was there

Read analysis

An index of what it knows it knows300

Hipocampus

The top of its compaction tree is not a summary but a topic index, injected every session so the agent can judge whether searching its own memory is worth doing — the failure it names is the one no query fixes, where you ask about payment flow and the rate-limit decision three weeks ago is never looked for.

Best idea: An index that answers "do I know about this?" before any search
Main risk: Leaves are permanent, so nothing can be corrected

Read analysis

A prior that updates from outcomes301

MemHarness

Every record keeps the situation it was distilled from, so a policy trained with GRPO can compare then with now and reject a memory that does not fit instead of pasting it — and a record's standing is the smoothed rate at which episodes that used it succeeded.

Best idea: Retrieval that can decline what it fetched
Main risk: Six thousand lines of memory with no test of its own

Read analysis

Invalidation with a reason, and no key on the value302

Potpie

A context graph over a codebase and its development lifecycle, where every mutation carries provenance and a withdrawal stamps valid_to rather than deleting — and the refusal is keyed on the row, not the value.

Best idea: An invalidation cannot be recorded without a reason, and deletes nothing
Main risk: Nothing is keyed on the value, so a re-derived claim is a new entity rather than a refused write

Read analysis

A gate that drops the sentence it cannot quote303

repowise

A codebase index whose decision records are refused unless a verbatim span of the source supports them, published with a sealed benchmark split and the rows it loses — and a scope boundary that lives in which database you opened rather than in the query.

Best idea: An ungrounded rationale is cleared, not flagged, and a candidate with nothing quotable is rejected
Main risk: The gate cannot check a producer that recorded no source span, and labels that case the same as a failed check

Read analysis

Five tiers of how-we-know, and the best one is discounted304

Gortex

A code knowledge graph where every edge records how it was resolved, from compiler-grade down to text-matched — and where the most trusted tier is deliberately attenuated for ranking, because abundant evidence and reliable evidence are not the same thing.

Best idea: One provenance ladder weighted twice: once for belief, once for authority
Main risk: The populated benchmarks grade the project on its own repository; the externally graded one is still a template

Read analysis

Compaction that rewrites pointers, never bodies305

TrueForge

An agent harness whose context log is append-only and written exactly once, with each turn holding an ordered list of pointers into it — so compaction and forking are both changes to which messages are in force, and no message is ever destroyed to make room.

Best idea: Message identity and message position in separate tables, so fork and compaction are one copy path
Main risk: Every superseded body is retained and addressable, and nothing ever reads one back

Read analysis

It publishes the number where it loses306

lossless-context-mcp

A content-addressed archive of every file version an agent was shown, hook-fed so a compaction cannot destroy the working set — and a benchmark whose headline result is that its own compression saves nothing on real sessions.

Best idea: Losslessness as a mandatory second metric, and the unflattering real-session number as the headline
Main risk: The measured feature is the one that does not pay; the features that justify it are scored by nothing

Read analysis

The block outlives the reason for it307

KAISEN

An evolutionary coding harness whose project memory is four plain files — and whose durable visited-set of code hashes grows without bound while the history explaining why anything was skipped is a 500-entry ring.

Best idea: Failure feedback hoisted above chronology, so a repeated mistake is read first
Main risk: A permanent refusal whose explanation ages out of a bounded history

Read analysis

A read failure and an empty store are the same value308

fx

A coding agent in Zig whose durable memory is a flat JSON array of strings — with a tool description that forbids writing anything the user did not ask to persist, and a loader that answers every read error with “no memories” just before the next save overwrites the file.

Best idea: The memory-write consent rule is stated in the tool description, where the writer reads it
Main risk: Four read failures share one answer, and the next save overwrites the file it could not read

Read analysis

Every store has a hook except the one holding beliefs309

OpenWolf

Per-project memory for coding agents where seven lifecycle hooks maintain the file map, the action log and the bug index — and the file holding preferences and corrections is replaced wholesale by a weekly model call whose output is routed by a substring check.

Best idea: A read hook that denies a duplicate file read, disarmed after compaction
Main risk: The weekly reflection replaces the belief store with model stdout, with no diff, floor or record

Read analysis

The rebuild is what reverts the corrections310

sift-kg

Documents become an entity graph a coding agent queries as structured memory — with a real human review between the model's merge proposals and the store, and a build that regenerates the graph from extractions the review never touched.

Best idea: Extractions are kept per document, so the graph is genuinely rebuildable
Main risk: Merge decisions are truncated on the next resolve, and the rebuild discards the rest

Read analysis

The session knows who is asking; the store does not311

Outworked

A macOS app that runs Claude agents as pixel-art employees, over a SQLite key-value memory whose remember, recall and forget tools are mounted into every agent — and take the scope from the model's own argument.

Best idea: A zero-LLM write path and a scope vocabulary stated in the tool description
Main risk: One agent can read or overwrite another's private scope by passing its name

Read analysis

A review flag whose only writer sets it true312

Corbell

A multi-repo architecture graph plus design decisions extracted from a team's ADRs, served to an agent over MCP — where the confirmation gate on which documents count is open by default and its answers do not survive the next scan.

Best idea: Every extracted decision names the file it came from
Main risk: A forgiving loader and an overwriting saver turn a corrupt store into an empty one

Read analysis

Local git writes the facts; the model labels its own claims313

Portable Handoff

One Markdown capsule between sessions, where local code supplies git state and file hashes, the model supplies labelled claims, and a verified label beside a conversational source is capped at parse time.

Best idea: Repository facts and file hashes come from local git, never from the model's draft
Main risk: The git facts reach finalize through a file the agent can edit, and nothing filters on trust

Read analysis

The client is readable, the store is not314

MemoraX Code

Memory middleware for four coding agents that redacts credentials before the payload leaves the machine and refuses a scope it cannot resolve — over a hosted store whose ranking, correction and deletion live behind two HTTP endpoints.

Best idea: Redaction before transmission, with an allowlist so placeholders survive
Main risk: No delete anywhere in the client, and none in the surface it speaks

Read analysis

The path is the schema315

agents-memory

A markdown store whose folder layout is its taxonomy, published as an ABI with a mutability rule per kind — and a search that returns a hash-anchored id the delete accepts back.

Best idea: One home per fact, no dump files, and recall returns an address you can delete
Main risk: The model picks each search's project scope, and a wildcard reads every repository

Read analysis

The verdict outranks the score316

Heimdall

A verification layer over someone else's store: every search hit is checked against its anchor path at read time and labelled STRONG, REBUILT, WEAK or STALE — and results sort by verdict first, with similarity only breaking ties.

Best idea: A verified hit cannot be buried by a better-scoring unverified one
Main risk: A failed path check deletes the node, and nothing about trust is ever persisted

Read analysis

The note-taker proposes; a person promotes317

Hestia

A self-hosted household brain whose memory is one markdown file per fact — where background extraction lands in a review inbox recall never reads, and a person promotes from a CLI or an e-ink board.

Best idea: Passive extraction may only propose, and the review step is the default path
Main risk: Nothing can mark a promoted fact wrong, and a discarded or deleted one looks novel again

Read analysis

Tests that the memory is plugged in318

NanoClaw

A per-agent container host whose durable memory is plain Markdown with no machinery at all, beside a conversation layer carrying a stated audience invariant and twenty committed cases about what must never reach which session.

Best idea: A test asserting the boot call is wired, written because the unit test stays green without it
Main risk: All the enforcement guards the transient layer; the durable one has the wider audience

Read analysis

Two tiers, one reviewed319

Muninn

A self-hosted multi-bot assistant whose extracted memories are written by a model with no review, no edit and no delete short of dropping the whole topic, beside a wiki tier where every drafted page waits in an approval queue behind a hash check — and a committed golden-set eval scoring the retrieval both depend on.

Best idea: The scope predicate sits inside both arms of the fused query, not around the join
Main risk: A model assigns the access-control label, once, and nothing can change it

Read analysis

A policy the store predates320

AgentDatabase

A canonical JSONL memory store with bitemporal projection, an in-record transition log, abstention that returns a reason code, and a 160-case gold benchmark — whose entire live content was written by an import its admission policy refuses.

Best idea: Abstention returns UNKNOWN with a reason code and the conditions that would have permitted an answer
Main risk: The gold set's 1.0 scores a ranker defined inside the evaluator, and admission trusts a source label the writing agent supplies

Read analysis

The whole transcript, every turn321

AuraOS

A local Flask harness that splices an identity folder and a caller-named transcript, whole, into every prompt — beside a distillation pass whose output reaches no prompt.

Best idea: A distillation prompt that asks to preserve contradictions and uncertainty rather than flatten them
Main risk: The caller names the memory it reads and writes, and the path is unsanitized

Read analysis

Memory the agent rates itself322

MeTTaClaw

An agent in MeTTa whose long-term memory is written only by its own tool call, where the model promotes and demotes its own memories by timestamp and recall returns a reinforcement slice beside a similarity slice rather than blending them.

Best idea: The utility signal is a tool call the model makes, not a counter the retriever increments
Main risk: The rater is the model whose recall the rating improves, and there is not one test

Read analysis

The fork that removed the ledger323

OmegaClaw

A neural-symbolic agent whose long-term memory is written only when the model calls remember — with a live test that sends a fact-shaped sentence and asserts no vector was written, and its explicit-remember twin as the control.

Best idea: A negative write test run against a real model, with its positive control on the same counter
Main risk: Nothing can be said about a memory after it is written — no delete, no status, not even a demote

Read analysis

No LLM in the write path324

GENOME

A memory layer that embeds locally and calls no model to store, so every mutation can be journalled and the store replayed exactly — and whose published feature audit reports one of its own features as harmful.

Best idea: A deterministic write path is what makes an audit log worth having
Main risk: That same journal keeps a deleted memory's text, and replay rebuilds it

Read analysis

A blocking consent gate325

Graphnosis

A local-first encrypted cortex whose MCP surface stops and waits for a human click before a client reads a sensitive tier — and whose corrections stay previews until someone approves them.

Best idea: A gate whose passphrase is never returned to the client asking
Main risk: Deletion is a confidence value that decay and reinforcement also write

Read analysis

Five states, one wired326

Arcon

A local-first companion whose write path classifies every candidate four ways without a model — and whose five-value status vocabulary has exactly one value both written and read.

Best idea: A deterministic four-way admission decision at the door
Main risk: A conflicting memory is withheld from every read and can never be confirmed

Read analysis

A threshold with no consumer327

AI Agent Automation

A local-first workflow platform whose per-agent vector memory is retrieved by a function declaring a similarity floor that its body never reads — while a caller passes one in and a committed test expects the unfloored result.

Best idea: A changed signature that fails closed on its old call shape
Main risk: Every top-k hit reaches the prompt however badly it scored

Read analysis

A control that proves the metric can move328

Silica

A transactional write path over a markdown vault whose contradictions stay visible until a person resolves them — and whose eval harness refuses to run a gate whose metric cannot fail.

Best idea: A negative control on the metric, not the system
Main risk: A contested claim is labelled rather than withheld

Read analysis

The substrate wins none of six329

RCK

A symbolic reasoning kernel whose stored denials block derivation rather than only retrieval — and whose own paper measures its central architectural bet against a plain index and withdraws two published claims.

Best idea: A refusal that also refuses the inference that would regenerate it
Main risk: The write-ahead log is truncated at every checkpoint

Read analysis

The durable half is not the memory package330

AutoResearchClaw

An autonomous research pipeline whose three memory categories are built inside the run directory — and whose one store that outlives a run is a skill file the code itself labels cross-run.

Best idea: The prompt overlay names which of its two halves is durable
Main risk: A cross-run store constructed at a per-run path

Read analysis

Default-deny on claim status331

Weave

A Rust knowledge-graph app whose MCP memory service stores evidence-backed claims with five statuses, recalls only the active ones by default, and audits the claims it rejects as well as the ones it keeps.

Best idea: The narrow status set is the default and the wide one takes an argument
Main risk: Nothing reads the rejected set before admitting a new claim

Read analysis

Authority caps the actor332

aimee

A C-hosted runtime whose Go memory owner holds model-authored facts as candidates until an operator approves them, refuses rejected values by key, and chains every memory mutation into an append-only store.

Best idea: A model-authored fact waits as a candidate, and the approve verb is off the agent's tool surface
Main risk: The runtime role that cannot delete a refusal can lift one, and no trigger records the lift

Read analysis

The gate is not a prompt333

Fireweed MCP

An MCP memory server that admits a claim only when deterministic functions find its cited evidence supports it, binds what survives to a byte range in the source, and abstains by name when a query has no grounding.

Best idea: A Merkle-bound source lets one subject be redacted without breaking anyone else's receipt
Main risk: The zero-dependency install hand-rolls an unauthenticated cipher

Read analysis

Derived namespace334

OpenCompany

A self-hosted agent-workflow canvas whose durable memory is an explicitly invoked tool over a namespace the backend derives from authenticated identity.

Best idea: The scope key is hashed from authenticated context and absent from the tool schema
Main risk: A forgotten fact leaves no record any write path consults

Read analysis

Unused scope key335

AgenticTrading

A multi-agent trading stack whose Neo4j memory service stamps an agent_id on every node and filters on it only when a caller asks.

Best idea: The graph schema is asserted up front, not grown from writes
Main risk: The search four agent pools share carries no scope predicate

Read analysis

The audit watches the read336

OpenExecutive

A virtual executive team whose episodic memory is extracted in the background, scoped to a conversation thread on the way into the prompt, and editable by a person.

Best idea: The scoping test asserts on the rendered prompt, not on the query
Main risk: Fourteen audit event types, all of them reads

Read analysis

Nine regexes and no way back337

Matrix OS

An agent operating system whose memory is a six-column SQLite table filled by pattern matching, with no scope, no status, and an export path only tests call.

Best idea: Capture costs no model call and reads only the user's turns
Main risk: Two patterns match ordinary speech and no field can mark the result doubtful

Read analysis

Snapshots that know what the harness wrote338

Tycho

A self-directed ARC-AGI-3 harness whose agent workspace is content-addressed and versioned, with the harness's own observations excluded from the snapshot and preserved across a restore.

Best idea: The snapshot boundary separates what the agent concluded from what the harness observed
Main risk: The world model is code with no way to mark a rule falsified

Read analysis

A briefing for the successor339

Retrodict

An ARC-AGI-3 agent whose entire durable memory is one model-authored markdown file, governed by a prompt that ranks the raw log above it.

Best idea: The prompt states why a raw log is not memory, then bounds what replaces it
Main risk: No harness code touches the one file the design depends on

Read analysis

Twenty-five hundred words of you340

Polyphony ARC

A per-game workspace of model-written code and notes, checked against the recorded frames, and a compaction that hands the successor a summary, a code-written pointer and its newest turns.

Best idea: The word bound is stated with its stakes, and a pointer written by code heads the handoff
Main risk: No tests; the handoff drops the main prompt, and nothing makes the successor read the files

Read analysis

Six thousand characters, oldest lines first341

OpenHands SDK

OpenHands V1's durable memory is two agent-maintained markdown indexes under a shared character budget, off by default — beside a much larger body of context-window machinery that is not memory.

Best idea: The truncation notice is charged to the budget, so the model can see its index is a fragment
Main risk: No schema, no writer in code, and no record of what truncation dropped

Read analysis

As of May, and a receipt for it342

MemBukkit

A fact store whose answers are dated — supersession instead of deletion, an as-of read filter, and a receipt naming every fact used — with the record-time axis its temporal claim would need still absent.

Best idea: Deleting a correction revives what it superseded
Main risk: One time axis, so it can say what was true and not what it believed

Read analysis

Immutability the database enforces343

Habitus AI

A zero-dependency SQLite memory whose canonical records are made immutable by triggers, whose edge weights are conserved by a checked invariant, and whose learning refuses to run on an unverified outcome.

Best idea: Immutability is a property of the file, not of the write method
Main risk: The shipped dense space is a hash, and the README does not say so

Read analysis

The index is the retriever344

OpenKB

A knowledge base compiled into a wiki of markdown pages with no embeddings anywhere, where retrieval is an agent walking an index and the write path is journaled like a database.

Best idea: Journaled, fsync'd, rollback-capable writes over a markdown tree
Main risk: The linter finds contradictions and no field on the page changes

Read analysis

The refusals are recorded too345

Veracium

A provenance-typed SQLite memory where third-party content is never assertable, confirmation commits its audit row or fails, and refused supersessions are recorded.

Best idea: If the audit row cannot commit, the state change does not happen
Main risk: The specification apparatus is larger than the mechanism

Read analysis

One turn to save, then the cut346

MerchantBench

A 366-day merchant simulation whose only agent memory is one overwritable Markdown document, warned once before each context truncation and never re-injected afterwards — while the human baseline that beat every model had the same document on screen at every activation.

Best idea: Every overwrite appends its full superseded text
Main risk: One advisory turn before an unconditional truncation

Read analysis

Many patterns, one memory floor347

All Agentic Architectures

A teaching catalog of 38 LangGraph architectures over a 497-line memory package — whose two persistent backends are exactly the two configurations its flagship dual-memory architecture retrieves nothing from.

Best idea: An unsupported query raises instead of returning nothing
Main risk: Two parameters the default backend silently discards

Read analysis

The second ingestion348

Agentic GraphRAG Blueprint

An Azure GraphRAG reference architecture whose community reports are keyed by a fingerprint of their own inputs, so stale ones are removable — and where nothing else in the store ever is.

Best idea: A derived artifact keyed by a hash of its inputs
Main risk: Positional chunk ids leak when a document shrinks

Read analysis

The ledger and the notes349

BrainAPI

An event-centric knowledge graph over six datastores, where an event accumulates legs and an attribute is replaced — and whose committed LoCoMo run recomputes exactly while its own notes say the number needs a cold re-run first.

Best idea: The correction rule falls out of making an event a node
Main risk: The ledger drops every caveat the run notes recorded

Read analysis

Findable before it is written350

MOTH Memory Template

A file-based memory format whose real contribution is asking, before a record is written, whether a later question would find it — and whether it would win — measured by tools that ship, over an architecture that mostly does not.

Best idea: Two write-time verdicts, because unreachable and unrankable differ
Main risk: The gate models the ranker instead of calling it, and the ranker moved

Read analysis

Two clocks, one checked351

AI Workflow Workspace

A token-efficient agent workflow whose three memory surfaces meet at one deterministic router — which hash-validates a code-index row before it will route on it, and answers a two-keyword cache hit with an instruction to stop investigating.

Best idea: The read returns a next step, not a result set
Main risk: Freshness covers the index and excludes the memories

Read analysis

Supersede, retract, forget352

Areev

A content-addressed grain store where world time and knowledge time are selectable at query time and every review decision is hash-chained with a mandatory reason — where a retraction is withheld at context assembly and returned everywhere else, and the agent’s own MCP tools can approve what the loop proposes.

Best idea: The temporal axis is a query parameter, not a convention
Main risk: The agent’s own tools clear the review queue

Read analysis

Learned judgement353

Citra Decision System

Turns officer corrections into scoped, provenanced clauses, governs them with a ten-value status the read query filters on — and publishes the run where three of its four seeded judgements measurably did nothing.

Best idea: The status is in the query, not on the score
Main risk: Parking a clause frees the evidence that re-forms it

Read analysis

Agent-native vault354

Hatchdoor

Markdown is the only record and the index is disposable, so a correction is a file edit — but a delete is a move into a folder nothing empties.

Best idea: The atomic exchange is the commit point
Main risk: A declared debounce ceiling nothing reads

Read analysis

Agent-runtime memory355

Animus

Seven time-named layers over a new/current/deprecated state the prompt assembler and search both filter on — beside an ontology with no tenant boundary in its key.

Best idea: A state spent on filtering, not on ranking
Main risk: Default layers that serve one agent

Read analysis

Four types, one label356

RAGFlow Memory

A per-tenant message index where the memory predicate is overwritten inside every backend adapter — beside a four-type taxonomy that is whatever JSON key the model returned.

Best idea: Scope resolved before the query, forced under it
Main risk: A type system no query ever reads

Read analysis

Its memory, but not its corrections357

openvurp

A wallet of user-created agents where each keeps its own SQLite FTS5 memory, lessons and replayed corrections under a per-agent directory — but a correction typed to an agent reaches no learning log, the nightly fade runs on the platform's store alone, and the mirror replays an agent's corrections against the platform's lessons.

Best idea: A correction becomes a test case replayed at night
Main risk: The memory is scoped; the learning is not

Read analysis

Who confirmed it, and until when358

Open Knowledge Format

A Google Cloud specification for agent-written knowledge as markdown bundles — who generated a concept, who verified it, when it goes stale, and a sanctioned computation a consumer can attest — whose every trust state is advisory: the one consumer in the tree draws badges, and a regeneration keeps a human's signature on text the human never saw.

Best idea: Verified is not the same field as generated
Main risk: States that nothing reads

Read analysis

Dead ends that stay dead359

OmniMem

A self-hosted MCP memory server on Valkey whose episodic memories carry effort, outcome and a graveyard of abandoned approaches, checked by keyword before any recall is embedded and suppressed as a topic when a costly approach dies — while a contradiction, once recorded on both rows, is cleared by nothing.

Best idea: The graveyard speaks first
Main risk: Links that nothing clears

Read analysis

A scene graph that fuses before it persists360

Chronotope

A numpy-only Python library that turns object detections into a single-file SQLite scene graph through a deterministic fusion arbiter — merge, create or reject each observation, with every mutator fusing the staged rows before it commits — where a rejected observation stays as a row nothing reads and a forgotten node leaves no record.

Best idea: No observation persists without a node
Main risk: Refused evidence nothing can find

Read analysis

A scene graph the robot edits after every grasp361

DovSG

The RA-L 2025 mobile-manipulation code whose 3D scene graph is repaired locally after each pick and place — remembered voxels the new depth contradicts are deleted, objects that lose half their voxels are dropped, their subtrees cut and the rest rebuilt — and whose planner and navigator never read the graph they maintain.

Best idea: Delete by depth disagreement, locally
Main risk: A graph nothing consults

Read analysis

Fifty sentences behind the static prompt362

OpenMake LLM

A self-hosted AI workspace whose cross-conversation memory is a per-user table of up to fifty sentences injected after the static system prompt — typed into a settings tab or extracted behind two switches that default to off — gated by a stored toggle the client can only tighten, tombstoned on delete, audited on the tab's path and not the extractors', and invisible to a data export that still queries the columns of the table dropped in May 2026.

Best idea: A delete the extractors remember, behind a toggle the client cannot loosen
Main risk: An export that has never returned a memory

Read analysis

Wire-dark temporal facts in an abandoned harness363

ELAI

An abandoned, privacy-filtered Rust agent harness whose memory crate is a SQLite fact table with validity and ingestion times with per-type trust decay, evidence enforced at insert, judged contradiction closure and a compile-time role firewall on injection — where the only conversational writer sits behind a flag that expired before publication, the automatic extractor stores nothing, and the trust tiers the tests defend filter no live query.

Best idea: A role allowlist that fails to compile when a role is added without a decision
Main risk: A crate wired to almost nothing, in an archive nobody maintains

Read analysis

A ladder every proposal must climb364

Argos

A Hermes memory plugin and standalone MCP/REST server — DuckDB records, a Kùzu entity graph, local embeddings — where every extracted fact is a proposal whose top rung automatic review cannot write, deletion and rejection leave ledgers both write paths consult, versions chain with as-of reads, and the benchmark numbers recompute from committed files that the project's own audit says never formed a chain.

Best idea: Tombstone and rejection ledger consulted on both write paths
Main risk: Headline benchmarks ran with the supersession machinery idle

Read analysis

Markdown memories under a code index365

Reporecall

A Claude Code hook daemon and MCP server that indexes frontmatter markdown — the agent's own memory directory read-only beside a writable one — into SQLite FTS5 and injects it under per-class budgets, where archival and supersession live in the index row and not the file, a promoted fact is a copy compaction supersedes, and the project's source repository no longer resolves.

Best idea: Rank the agent's own memory files into the prompt at zero token cost
Main risk: Lifecycle state the next file edit resets

Read analysis

Wires are the context366

ThoughtDAG

An editable context graph — desktop app, harness plugin, read-only CLI — where what the model sees is exactly what wires into the node, one compiler feeds the preview and the request, each request is hashed at dispatch, stale answers are marked and replayed, a profile and topic dossiers are written behind a constitution in code, and recall brings dossiers and other agents' past sessions into an ask.

Best idea: One compiler for the preview and the request, hashed at dispatch
Main risk: Recall crosses every project, and an archive does not reach the dossiers written before it

Read analysis

Real at rest, fake on the wire367

OpenMasq

The cross-conversation memory of a redacting desktop chat client — one card per entity and a profile, extracted by the same model from the pseudonymised transcript it already saw and un-redacted locally through the conversation's vault, admitted only when the entity appears verbatim in the real text, merged by attribute replacement with a restorable history, selected client-side on real values and re-redacted on every injection, searchable by the model through a lexical tier topped up by an on-device embedder, and reviewed in an inbox that empties by confirming.

Best idea: Extract from the wire the model already saw, and let the vault filter hallucinations
Main risk: Nothing a card knows about itself keeps it out of a prompt

Read analysis

A second brain with a daily cap368

no_human

The learning store inside a ticket-to-pull-request coding agent — rules, skills, facts and anti-patterns in one SQLite table, proposed only from labelled failure signals, screened for duplicates, personal data, provenance and vendor terms, activated ten a day with a kill switch, injected through one chokepoint that scopes by remote hash, matches tags on word boundaries and ranks by importance, recency and use, with an injection-to-outcome ledger and an append-only event trail; nothing is ever deleted, and a reviewer never reads a rule distilled from its own verdicts.

Best idea: One install site, proven by parsing, with a guard that can fail
Main risk: Auto-activation on by default with a daily cap as the only ceiling

Read analysis

The open half of a closed memory369

Engram Format

The published storage crate behind a closed memory product — a SQLCipher vault with a documented schema, an FTS5 index and a vector table, a capture pipeline that skips noise, strengthens a verbatim duplicate and refuses a near-verbatim paraphrase, a quarantine of imagined-and-ungrounded rows that some read paths honour and the defaults do not, an Ebbinghaus decay and a retrieval-count promotion, and a sync envelope with tombstones and last-write-wins; the daemon, the relay and every user surface are elsewhere.

Best idea: Typed write outcomes and a curated bypass past the dedupe gate
Main risk: A quarantine the default read path ignores

Read analysis

Muninn keeps the facts370

Khoj

The long-term memory of a self-hostable personal AI — one Postgres row per first-person fact with a pgvector embedding, extracted after every non-automated turn by a prompt that may create facts and delete them by id, recalled as the ten most recent facts of the week plus the ten nearest by cosine, scoped per user and per custom agent, injected as a dated list the model is told to ignore when irrelevant; the extractor only ever sees the facts recall found, so a fact it did not retrieve it cannot retire.

Best idea: Scope on both recall arms, tested with the excluded facts present
Main risk: The extractor sees only what recall retrieved, so stale facts persist

Read analysis

Five global, twenty per workspace371

AnythingLLM

The personalisation memory of a self-hosted RAG chat application — one-sentence facts scoped to a workspace or global and capped at twenty and five, extracted every few hours by an observer and a reflector over an idle user's last twenty chats, appended to every system prompt with the five workspace facts a reranker puts closest to the message; a chat is marked processed whether extraction succeeded or failed, and the public embed widget gets the owner's facts in single-user mode.

Best idea: An observer that proposes and a reflector that sees the rows
Main risk: Chats consumed on failure; the embed widget gets the owner's facts

Read analysis

Notes an assistant may edit, one tool at a time372

Joplin

The AI service inside a nine-year-old note application — a chat scoped to the open note that edits it through anchored tools, reaches the rest of the notebook through eleven global tools each switched off by default, a background indexer that rides the app's change feed into a sqlite-vec index and rebuilds itself when the model changes, a token budget that refuses rather than truncates, and an MCP server that hands the same gated tools to outside agents; the notes are the memory, and the assistant keeps none of its own.

Best idea: Every capability beyond the open note is a switch, and the refusal names it
Main risk: The assistant remembers nothing and attributes nothing

Read analysis

One predicate before every page373

Memos

A self-hosted note service whose memos carry a creator, a visibility and a space that the storage driver renders as one WHERE clause before LIMIT on every list and count, so a row the caller may not read is neither returned nor counted; a two-user test asserts the viewer's list by id; and an MCP server that is an allowlist over the REST API forwards the caller's bearer token unchanged. A memo is a note: no state, no provenance beyond its creator, a hard delete, and a default audience of everyone logged in.

Best idea: The audience is a SQL predicate appended before the page
Main risk: A memo is a note, and PROTECTED is everyone logged in

Read analysis

The hash is the write precondition374

SilverBullet

A Markdown wiki whose file API returns a SHA-256 ETag on every read and demands it back on every write, fails closed on any precondition it cannot evaluate, merges three ways under a per-path lock when two writers collide and otherwise writes both sides into the page between markers for a person, and commits each quiet period to git under the account, client or external process that made the change. Every capability mark is withheld on definitions; the write contract is what the report is for.

Best idea: Name content by its hash and make the hash the write precondition
Main risk: Write access is code execution in every reader's browser

Read analysis

A snapshot before the first write375

SiYuan

A local-first block notebook whose kernel runs an agent over thirty-three tools that each declare whether an action writes locally, sends data out or costs money; any of the three waits for the person unless always-allowed, the first local write of a chat takes a data-repository snapshot recorded in the session, sessions are JSON files saved under an expected revision with orphaned-turn recovery, and compaction injects its summary as untrusted historical memory. Semantic search is a remote embedding and a full scan; nothing is a memory with a state.

Best idea: Confirmation by declared effect, then a snapshot
Main risk: Always-allow is one click

Read analysis

One registry for the chat and the MCP376

Trilium Notes

A hierarchical note application whose twenty-one assistant tools are defined once with a mutates flag and executed by the in-app chat, the public MCP route behind an ETAPI token, the person's own Claude Code with every built-in tool disabled, and a Copilot agent on a loopback endpoint; a revision marked llm precedes every content edit and the column persists, but the mark covers three tools and no test asserts it. No embedding, no index, and the assistant remembers nothing but the chat note.

Best idea: One tool registry with a mutates flag serves four consumers
Main risk: The assistant's mark covers three tools and no test

Read analysis

A checkpoint before compaction377

VISTA

A harness that plays ARC-AGI-3 games through Claude Code or Codex, archives every environment frame so the model can re-inspect original evidence through bounded read-only tools, keeps a per-game GUIDE.md and WORKING.md with a provenance stamp on every write, blocks the runtime's compaction with a hook until the model has saved a non-empty continuation checkpoint, and rebuilds a fresh context from the files and the exact last event; every recovery path fails closed under test, and the memory is one game deep.

Best idea: Compaction waits for the model's own checkpoint
Main risk: The checkpoint gate is syntactic

Read analysis

Discovery proposes, authority decides378

Velantrim Crystal

A local-first evidence and memory kernel where a fact enters as Observed, is refused on sight when it contains a claim pattern a curator has recorded as rejected, passes a truth gate that never lets model output become a world fact, grounds an answer only when VERIFIED, canonical and unrestricted, waits for a curator otherwise, and leaves every compliance event in a hash-chained audit log with a checkpoint against a deleted tail; erasure is physical and cascades over derived facts, with a content-free receipt that does not feed the rejection memory.

Best idea: Model output can never become a world fact, as an invariant
Main risk: Erasure does not tell the rejection memory

Read analysis

Three tools over a knowledge graph379

Forgetful

A self-hosted MCP memory server for coding agents — one Zettelkasten-shaped row per memory with nine provenance columns, embedded in-process by FastEmbed, stored in SQLite or Postgres, auto-linked on create to its three nearest neighbours with no distance floor, retrieved by a dense top-20 that a local cross-encoder cuts to k and a one-hop walk widens, re-sorted by importance under an 8,000-token cap, isolated per user by a WHERE clause on both backends, obsoleted but never deleted, and audited by an event bus that is off by default; the sparse leg, the rank fusion and the 0.7 threshold the README and the agent's own skill describe are not in the tree.

Best idea: Three meta-tools over 152 operations, with discovery text built from the feature flags
Main risk: The retrieval the agent is told about is not the retrieval that runs

Read analysis

Notes as a graph, answers as citations380

Kwipu

A local Graph RAG over a folder of Markdown notes — LlamaIndex's property graph on Ollama — where every wikilink and frontmatter key becomes a relation in code before a model extracts its own, four retrievers answer under a prompt that must cite files, an edited note is re-indexed in place, and a wikilink's triple has no document behind it, so a removed link stays a relation until a deletion forces the full rebuild.

Best idea: Triples from the note's own structure before triples from a model
Main risk: A triple outlives its link, and the MCP server never watches the folder

Read analysis

A harness that keeps its rulings381

craft

A Claude Code plugin whose memory is files under .craft/: learnings recorded with a quote, a date and a count at pending, listed and approved by a person in a reflect drain before they are copied into .claude/ for Claude Code to load; locked decisions and tokens behind a confirm step and a sole merge writer; notes indexed into every session; a write gate on the file tools beside a hook that approves every shell command; and a story field pointing at decision records nothing writes.

Best idea: Pending means never injected; a person approves before promotion
Main risk: Every Bash command outside a short blocklist is auto-approved

Read analysis

One vector that forgets on a schedule382

holomem

A 423-line holographic memory — every fact a weighted triple in one fixed-size complex vector rebuilt from a plain fact list — where an unconfirmed fact halves every 45 days, a contradicted one is damped rather than deleted, a second trace answers what was true in a given month, and a z-score margin says when to stay silent; a committed capacity sweep the README recomputes from exactly, and nothing that persists.

Best idea: A confidence gate in units of the trace's own noise
Main risk: No store, no scope, no record; the fact list is yours to keep

Read analysis

Recall is an action the mind must choose383

HUMANs

A persistent local agent around one SQLite file whose canonical records are immutable by trigger and corrected only by a superseding record, whose speech model sees the current utterance and nothing stored, whose recall is a selected one-use LOOK returned through a receipt, and whose language memory admits only what was heard — with a committed test that seen and noticed text stays out. The shipped command line can add a fact and cannot retire one.

Best idea: The model is shown the current utterance and nothing stored
Main risk: Supersession has no writer on the command line

Read analysis

Learnings the model writes and the person never sees loaded384

Pro Workflow

A Claude Code plugin whose self-correcting memory is a SQLite table of rules with an FTS5 index, written by a Stop hook that parses [LEARN] blocks out of the assistant's reply and filtered by project on every read — and whose session-start hook prints the loaded learnings to stderr, which the harness shows the person and never the model.

Best idea: A project filter in the query
Main risk: The loading step reaches the person, not the model

Read analysis

A team's learnings, voted on by the agents that used them385

teamai-cli

Tencent's CLI for distributing a team's skills, rules and knowledge to ten coding agents from a git repository — learnings as Markdown pushed through a merge request, filed at a shared root or under a project namespace the index admits only for that project's members, votes that count only what the transcript shows was recalled, a confidence that prunes and promotes, and a review queue with a risk on each machine-written section. A learning deleted upstream is reconciled out of every member’s cache; nothing records that the team rejected it.

Best idea: An upvote only for a document the transcript shows was recalled
Main risk: Forgetting is the absence of a file, not a record of a decision

Read analysis

The directory is the memory unit386

EvoX Genesis

An Elixir system for long-horizon autonomous software evolution whose memory is a tree of per-directory CONTEXT.md files — written by agents, versioned in git, and read by each agent as the chain from the repository root down to its own node, with the skills it may call named in those same files' frontmatter. Agents are finite-lived and the tree is not; a rejected proposal is a deleted branch that leaves no record of what it proposed.

Best idea: Scope is the directory, so it cannot drift from what it scopes
Main risk: The function that assembles the memory has no test

Read analysis

A decision chain no edit can rewrite387

MemContinuum

A decision store for Claude Code projects where every ruling is an append-only link in a per-topic chain, a git hook runs the linter's frozen-body check on every commit and refuses an edit to a link already recorded, the authority on each ruling decides whether a drift violation fails the run or only informs, and a pre-edit hook hands the whole chain — including what was declined — to the model before it touches a governed file.

Best idea: Append-only enforced by a diff against a git ref
Main risk: The declined ruling is delivered and consulted by nothing

Read analysis

A memory that must be voted in388

SAGE

A Go memory node on a vendored CometBFT chain where a submitted memory is stored as proposed and becomes readable only after a vote commits it, recall reads committed rows alone, a deprecated memory's exact bytes are refused on resubmission, and confidence decays on a curve evaluated at read time with the floor applied across every candidate before the top-K trim. On the default single-node install, the vote that decides admission is one key applying three string heuristics.

Best idea: A memory is unreadable until something votes it in
Main risk: Single-node consensus is three string heuristics

Read analysis

A draft is written but not injected389

PLUR

A local-first shared memory where the agent authors plain-text engrams into a YAML file that is the source of truth, a commitment of draft withholds one from injection while leaving it retrievable, validity time sits beside record time and both are filtered on read, and every mutation appends to a monthly history that never syncs. A retired engram is deliberately invisible to the dedup that would have stopped it coming back.

Best idea: Retrievable but never injected, enforced in the injector
Main risk: Nothing in the repository can approve a draft

Read analysis

Facts with a validity window390

OpenZync Core

A FastAPI memory backend where one LLM call turns a message into fact triples carrying a validity window, and every fact search and listing filters on that window at an instant the caller can name, down to the graph walk. A retracted triple is refused if it is said again, and the project wipe retracts every fact the same way.

Best idea: A validity window tested at an instant the caller names
Main risk: The memory wipe turns every fact into a tombstone

Read analysis

Five tiers, one SQLite file, no vectors391

Sibyl Memory

A local memory engine of five tier-specific tables in one SQLite file, retrieved through FTS5 with a folded-trigram fallback and no embeddings anywhere, where a zero result names which of five causes produced it rather than looking like an empty store. Every query carries a tenant key its own authors flag in a lock comment as a post-filter on an unindexed column.

Best idea: A zero result that names its cause
Main risk: Tenant isolation is a post-filter, as the authors say

Read analysis

The half of the baton the agent may not write392

Auto Company

Fourteen agent personas driven by a shell loop whose entire cross-session memory is one markdown file. One section of it belongs to a person: it is copied before the model starts, compared byte for byte afterwards, and a cycle that changed it is rolled back and every later cycle refused. An unchecked priority item stops the loop before a model call is spent.

Best idea: A region of the memory the agent cannot keep a change to
Main risk: Only one of the two human sections is compared

Read analysis

Heal the two sidecars, and every consumer is rename-aware393

ripwire

A C++ code-context engine whose memory is two committed sidecars — and whose repair for a key that a file move destroys is to rekey those two files forward before anything reads them, rather than teach nine call sites to try an alias.

Best idea: Repair the key where it is stored, not where it is read
Main risk: The notes half cannot say a row went stale

Read analysis

Deciding what to write without an LLM394

SAGE Novelty Gate

A mem0 fork that routes each candidate fact by vector arithmetic instead of a per-write model call.

Best idea: Published numbers recompute from committed artifacts
Main risk: A discarded candidate leaves no record at all

Read analysis

The store owns the index, not the text395

OpenContext

Memory is Markdown files; SQLite indexes them and the agent is handed a path to read.

Best idea: Index the files, never hold a second copy
Main risk: No scope key anywhere on the read path

Read analysis

The gate is the context; the memory is underneath396

Artesian

A Rust context governor over a durable store — a memory’s id hashes its content together with its project, user and session keys, both backends push that key into their own filter, and a CI gate proves one project’s private memory stays out of another’s query.

Best idea: Identity is the value and its address, hashed together
Main risk: Eviction and its audit log run on one backend only

Read analysis

The schema rejects a thin memory at the door397

Context Keeper

Typed project memory whose server refuses a decision without forty characters of problem and sixty of rationale — then serves it through a ranked path that flags its own weak answers and an exact path that never guesses.

Best idea: A character floor the store enforces at capture
Main risk: The conflict check skips everything you deprecated

Read analysis

Compile once, then serve the same bytes398

Statewave

Append-only episodes compile into typed memories with a validity window separate from their record time; assembly reads the compiled set inside a token budget and writes a receipt naming every entry it chose.

Best idea: A tenant invariant enforced by parsing your own source
Main risk: Tombstoned means expired, so a lapsed claim recompiles

Read analysis

A rejected skill is remembered by its fingerprint399

Caura

Fleet memory where a rejection is written down by value and consulted before the distiller proposes again, every mutation appends to a per-tenant hash chain, and a person approves a candidate skill before any agent sees it.

Best idea: A poison table the next distillation run must consult
Main risk: Two governance marks sit behind one feature flag

Read analysis

Trust is a triple the runtime derives, never a field a caller sets400

ShisaD

A security-first agent daemon whose memory looks up every entry’s trust band in a validated matrix of origin, channel and confirmation — raising on an unknown combination — and admits only elevated entries to the identity surface.

Best idea: An unenumerated provenance raises instead of defaulting
Main risk: It refuses poisoned writes without remembering the refusal

Read analysis

Quarantine tags the contradiction and recall returns it anyway401

MCP Memory Service

A belief table with a candidate-to-active-to-superseded ladder filtered in SQL, beside a memory row whose quarantine flag no retrieval path reads — so the contradiction it detects is labelled and still returned.

Best idea: Promotion needs a confidence floor and a provenance floor
Main risk: The quarantine flag filters nothing

Read analysis

Compress before you store, consolidate while you sleep402

LightMem

An ICLR 2026 reference implementation whose three-stage ladder compresses and segments before anything is stored and consolidates offline — keeping the pre-compression text on the row, and recording nothing when consolidation rewrites or deletes.

Best idea: Filter with a small model before you embed anything
Main risk: Consolidation hard-deletes and overwrites, unrecorded

Read analysis

The memory was already on disk; nobody had indexed it403

deja-vu

Every memory tool starts empty and records forward; this one indexes the session transcripts your agents already wrote — stripping secrets as it builds, and telling you in prose when a session says an approach was backed out rather than calling that a state.

Best idea: Index the history already on disk instead of starting empty
Main risk: No project boundary, deliberately — one index answers everything

Read analysis

A year of one person’s system, published as a blueprint404

Context Infrastructure

Daily observations an agent appends under three retention marks, promoted weekly into rule files against a threshold the prompt states — and then deleted from the log that justified them.

Best idea: The promotion bar is stated where the promotion happens
Main risk: Consolidation rewrites away its own evidence

Read analysis

A ledger of who did what, and the payloads live elsewhere405

CommonGround Kernel

An append-only ledger where every row names the actor and the cause that produced the event, and the project key is part of every primary key rather than a filter to remember — with the payloads in a submodule this repository does not contain.

Best idea: Two nullable columns make the audit answer “why”
Main risk: The content store is a submodule that is not here

Read analysis

Harness scaffolding is stored and kept out of the index406

pond

Every agent session ingested losslessly into Lance storage you own — with each message part marked conversational or injected, and only the conversational half contributing to what can be found.

Best idea: Store the scaffolding; never index it as speech
Main risk: A lossless archive with no redaction at ingest

Read analysis

Recall hands back the replacement, not the superseded memory407

LWC

A source-grounded wiki over a temporal memory: every lexical hit is walked forward through the supersedes chain, so a query matching an old decision answers with the one that replaced it — and eviction spares anything still marked unresolved.

Best idea: Resolve supersession on the read path, and label the result
Main risk: The provenance ladder and the validity interval reach no query

Read analysis

The third answer to a transcript already on disk408

continuity v2

An index over the JSONL sessions the harness already writes, whose best tool returns the conversation around a match rather than the match — and whose second-best asks, read-only, whether the index has fallen behind its source.

Best idea: Return the thread around the hit, not the hit
Main risk: No tests, no redaction, and a checkpoint with no owner

Read analysis

A claim about code, accountable to the code409

Memspec

Memories are markdown files under version control, each anchored to the git blob SHAs of the files it depends on — so when the code moves, the claim is flagged for a person instead of quietly rotting.

Best idea: Detect staleness against the repository, not the calendar
Main risk: Every honesty mechanism here waits on an operator

Read analysis

The reranker was off for three months, and the docs say so410

Somnigraph

A heavily tuned personal memory server for Claude Code — feedback-shaped hybrid retrieval, biological decay, sleep consolidation — whose most valuable artifact is a documentation set that records its own silent regression in full.

Best idea: Every constant carries the study that set it
Main risk: Extensive benchmarks, and no test suite at all

Read analysis

An LLM-free memory core rebuilt from its own event log411

Slowave

A local memory layer whose core makes no LLM call and whose derived memory is replayed from an event log — where a person’s dashboard delete removes every row naming a schema but not the events a rebuild re-forms it from, and the same rebuild skips what the agent explicitly remembered.

Best idea: Show the collateral before the confirmation
Main risk: A logic-version rebuild re-forms deleted schemas and drops remembered ones

Read analysis

Every read carries the project key except the one that forks412

UltraContext

A git-shaped store for the sessions five coding agents already write — every change a new version head naming its operation and the nodes it touched — that can write a session back out in another agent’s own format.

Best idea: Writers, not just parsers — continuity as a file
Main risk: The fork path resolves its source without the project key

Read analysis

A port that kept the approval queue and lost the frozen prompt413

Khabeer

Hermes Agent’s bounded-file memory ported into a Termux-based Android app — two capped Markdown files, substring edits, a threat scan and a staged write-approval list a person works from the Memory page.

Best idea: Pending writes as a page that survives restart, each with its origin
Main risk: The prompt is re-read from disk every tool step, so it is never frozen

Read analysis

A correction that repetition can undo414

Memora Engine

A Postgres memory service whose conflict pass supersedes a contradicted memory and keeps the reason, with a committed evaluation that asserts no superseded or archived memory reaches a populated top five.

Best idea: A leak test that fails if the status filter is removed
Main risk: Deduplication skips superseded values, so they return as new

Read analysis

A scoped notebook for handing work between agents415

ContextMeld

A desktop app that indexes Claude Code and Codex history and keeps memories a person writes, scoped global, per project or per agent, filtered by that scope when a handoff package is built.

Best idea: A closed scope set, filtered where memory reaches an agent
Main risk: The filter lives in the view, not the query

Read analysis

A global memory the model writes and every session reads416

AgentOS (Tanglies)

A FastAPI agent platform whose long-term memory is one SQLite table the model writes with a tool and the runtime recalls into every system prompt by default, keyword-matched with Chinese bigrams.

Best idea: CJK bigrams where FTS5 will not tokenise Chinese
Main risk: No scope, automatic recall, and a web fetch tool always on

Read analysis

Change candidates only the person can confirm417

Memory Garden

A retrospection agent over an Obsidian vault that proposes changes in a person’s stated views as candidates, lets only the person confirm or deny them, and skips a denied pair on later scans.

Best idea: The model proposes; only the person confirms
Main risk: A denial keyed on the file revision returns after any edit

Read analysis

Markdown notes, a local model, and a bounded index per project418

Kept

A Rust memory for coding agents made of Markdown files, searched by a CPU embedding model, with a prompt hook on every request and one generated MEMORY.md per project that excludes archived notes.

Best idea: A 17 KB session index per project, compacted oldest first
Main risk: The per-prompt hook ranks notes from every project

Read analysis

A tested session boundary over an exact-match store419

Hivemind

A Go daemon serving memory over MCP whose session scope is a real, tested read filter that opens for an empty session id, whose only embedder is a hash that finds a memory only by its exact text, and whose exact-filter lookup backs a GitHub Actions log cache.

Best idea: An isolation test that pins identical vectors across sessions
Main risk: A placeholder embedder turns search into exact match

Read analysis

Per-agent Markdown memory behind a frozen prompt section420

Nuum

A local-first desktop for persistent agents whose memory is Markdown per agent, written by a tool and a post-turn extractor, and injected into a system-prompt section frozen per epoch to keep the prefix cache warm.

Best idea: Only user-requested writes break the frozen memory section
Main risk: Background removals stay in the prompt until the next epoch

Read analysis

A claim has to quote its source421

Scope Recall

A local memory core for Hermes, Codex and Claude Code where a claim is stored only if the span it quotes is in the source, and believed only when that source's origin lends authority the agent's own tools cannot stamp.

Best idea: Authority read from the cited source's origin, not from the caller
Main risk: Nothing measures recall quality; the gate for it was removed unpassed

Read analysis

Measured fusion recall over a soft-delete lifecycle422

Uteke

A single-binary Rust memory engine with local embeddings, weighted fusion of vector and keyword recall, and a tested namespace filter, whose corrections are soft deletes that time travel cannot see and a thirty-day prune erases.

Best idea: Weighted fusion tuned in the open, with recomputable raw results
Main risk: Retired values leave no trace and can be written back

Read analysis

A tested project boundary under a one-hour default423

dsh-ai-memory

A Rust and SQLite memory crate wrapped as a DeepSeek Harness plugin that packs project-scoped recall into a token-budgeted system-prompt section before every model call.

Best idea: Project bound at session open, never a tool argument
Main risk: The default preset deletes working notes instead of promoting them

Read analysis

A durable queue and MCP tools over Graphiti on FalkorDB424

Janus-Graph

An MCP memory service that queues agent episodes in SQLite and feeds them to Graphiti on an embedded FalkorDB, filtering recall to facts whose validity interval is still open.

Best idea: A durable queue and dead-letter path in front of graph extraction
Main risk: A repair fallback turns one malformed edge into no facts

Read analysis

Staleness proved by a commit receipt, never deleted425

Claude Self-Reflect

A single Rust binary that indexes Claude Code's own transcripts into SQLite with FTS5 and an in-process HNSW index, and flags a hit stale only when a content-hash witness at a git commit proves it.

Best idea: Staleness from BLAKE3 stamps and git ancestry, with named abstentions
Main risk: A chunk proven stale still returns, unlabelled on the injection path

Read analysis

Two clocks read as carefully as they are written426

Utopia

A Rust binary over one Postgres that extracts ontology-typed entities and bitemporal facts from documents and from sentences an agent records over MCP, and keeps every remembered fact off the graph until a person confirms it.

Best idea: Automatic merges gated on what undo cannot recall
Main risk: The confirmation queue and its rejected-triple key skip bulk ingest

Read analysis

A shared team memory that mines traces into skills427

Hivemind (Activeloop)

A hook layer for seven coding agents that writes every turn into a Deeplake workspace, lets the agent grep that store as a filesystem, and mines recent sessions into SKILL.md files that install themselves on every teammate's machine.

Best idea: Correct a skill from the user's next message, judged against sycophancy
Main risk: The improved skill reaches every teammate with no review and no measurement

Read analysis

A memory contract bolted to a graph database428

RushDB

A schema-free graph and vector database on Neo4j whose agent memory is a 600-line client package — episodes and facts with deterministic ids and a five-field scope filter applied before similarity — while the server below it knows nothing about memory.

Best idea: A filter in the query picks exact scoring over the ANN index
Main risk: The outbox, the timeout and the fact deactivation are someone else's code

Read analysis

An exact-quote gate in front of the graph429

Signet AI

A local daemon under ten coding harnesses that captures transcripts as immutable episodic evidence and lets a background dreaming pass derive a semantic graph from them only by citing a verbatim quote it re-resolves against the store.

Best idea: Consolidation writes rejected unless the quote resolves
Main risk: The published benchmark number has no committed artifact

Read analysis

A headline number held to a test that parses the README430

GrayMatter

A single static Go binary — bbolt facts, an inverted index and an embedded vector store behind a CLI, a seven-tool MCP server and a daemon — whose supersession is latched against stale snapshots and whose published token table fails CI when it stops matching a live run.

Best idea: Published numbers parsed out of the README and failed against a live run
Main risk: A forgotten value can be written straight back as new

Read analysis

A revision layer whose status nothing reads431

Membrane

A Go memory substrate storing six typed record classes in one Postgres and pgvector schema, retrieved as a byte-bounded entity graph behind a scope and sensitivity gate, and revised through supersede, fork, merge, contest and retract.

Best idea: A retrieval budget sized in SQL and re-enforced above the store
Main risk: Retraction is a salience of zero that prune then deletes with the audit log

Read analysis

A review layer that outlives the graph it corrects432

MARM Memory

A local-first MCP memory server for coding agents over one SQLite file, with an exact lexical lane that is never semantically reranked and a concept graph whose removals leave name-keyed suppressions a full rebuild cannot undo.

Best idea: Human verdicts in the tables a rebuild does not drop
Main risk: Every memory is HTML-escaped on write, with no inverse

Read analysis

A shared org memory where the ACL is the query433

Lobu

An event-sourced Postgres memory for a whole organisation's agents, whose every read compiles its scope from one value — tenant, connection owner, then the source system's own ACL mirrored as SQL and failing closed while the sync is stale — and whose corrections are appended rows that a view hides and nothing ever deletes.

Best idea: One predicate compiler, with the upstream ACL joined at read time
Main risk: Correction only masks the record; the value can be written back

Read analysis

Memory that ships as a template434

Create Context Graph

A Neo4j Labs CLI that generates a whole agent application around a three-tier context graph, with thirteen connectors that import real SaaS and local-session history — and, on its default hosted backend, relationships encoded into a text field that nothing in the tree reads back.

Best idea: A watermark that advances only after the batch lands
Main risk: Encoded edges no reader parses, and nothing can be deleted

Read analysis

Skills as curated procedural memory435

SkillCorpus

A pipeline that crawls public SKILL.md files into a SQLite library and judges each one with an LLM whose verdict is cached under the hash of the body it judged, so a re-crawl cannot re-admit what was excluded — and a per-turn engine that fuses a local BM25 pool with a remote catalog and lets a gate put at most two skills into the agent's context.

Best idea: Curation verdicts keyed on the content hash, re-derived every build
Main risk: Third-party instructions injected verbatim behind one build-time opinion

Read analysis

Graph-native context and provenance436

Semantica

A graph-native context platform whose graph keeps validity time beside record time and separates retraction from erasure from retroactive correction — sitting beside an agent-memory store whose filter predicate knows three keys and answers True to every other, so the scoped delete its docstring shows empties the store.

Best idea: Retract, purge, receipt, revise — four words for four removals
Main risk: A filter that ignores unknown keys, behind delete and recall

Read analysis

Symbolic memory, no embeddings437

KITE by Memoket

A conversational memory with no vector stack at all: sessions become dated facts under a topic taxonomy in one readable XML file, a question compiles into an inspectable select-filter-sort plan over posting lists, and contradiction is left to read time — a date-ordered pack and a reader told the most recent row wins — because nothing here can edit, supersede or delete a fact once written.

Best idea: A benchmark contract a sceptic could run, seals and all
Main risk: No delete, no correction, and the sealed rows are unpublished

Read analysis

LLM-supervised local memory438

Mnemon

A single Go binary that implements MAGMA's four-graph memory over one SQLite file and calls no model of its own — importance, links and forget decisions arrive as arguments the host agent chose — with a decay formula whose automatic deleter reads a column only an agent-invoked command refreshes.

Best idea: Deviations from the paper it implements, in a table
Main risk: Auto-prune orders by a score nothing on that path recomputes

Read analysis

Policy as the memory layer439

flow

A Go task manager for Claude Code whose durable memory is five markdown files the binary never parses — an unusually well-written policy carried entirely by prompt text, with a stats command that mines session transcripts to count how often the model actually read what it wrote.

Best idea: Counting reads of the memory from the harness's own transcripts
Main risk: Every guarantee is a sentence; its own artifacts disagree on the read path

Read analysis

Honest about its own recall440

Prism

Session memory for coding agents whose distinctive work is nine contract tests on the seam between what retrieval did and what the agent is told about it — written after a health check hardcoded a zero and reported HEALTHY through an outage where every semantic query returned nothing.

Best idea: Tests that pin what the system says about its own retrieval
Main risk: The memories keep no mutation record; only live state does

Read analysis

A graph that audits its own wiring441

basemode

A Rust binary that maps a workspace into an RDF graph and injects slices at four Claude Code hook moments — whose supersession module opens by recording, with a date and a quad count, that the predicate it implements had been declared for months and never once written.

Best idea: Comments that audit the code's own wiring, dated and counted
Main risk: Session start serves a corrected note beside its correction

Read analysis

Approval a bearer token cannot grant442

Engraphis

Every write is stamped pending unless it came from a local agent, and the only way to approved is a browser session with a CSRF token and a written reason — so an agent cannot bless its own memory.

Best idea: Make the approver a different kind of caller
Main risk: No memory of what was refused

Read analysis

A rejection you cannot tell from silence443

OwnMem

Memory as markdown in the repository, where refusing a candidate requires a reason and keeps the summary — and the schema forbids the system from ever promoting a change to its own governance.

Best idea: Keep the refusal, keyed on what was observed
Main risk: Scope raises a score and hides nothing

Read analysis

Ten mechanisms from the psychology, on one of two stacks444

AgentOS

Retrieval-induced forgetting, reconsolidation and feeling-of-knowing, each citing the paper it implements — on a cognitive manager the high-level agent path never constructs, beside a facade whose recall drops the tenant key.

Best idea: Cite the paper in the file that implements it
Main risk: Mechanisms on the stack the agent does not use

Read analysis

A secret gate that will not quote the secret445

Memex

A Zettelkasten of markdown cards whose write and search commands pass a credential detector — tested for what it must allow as well as refuse, never echoing the token it rejected, and skipped by the importers.

Best idea: Screen the query, not just the write
Main risk: The gate is in the command, not the store

Read analysis

AS OF, in a query language of its own446

MenteDB

A Rust memory engine with a WAL, HNSW and BM25 under a query language where record time and validity are both fields — so a superseded fact is visible when you ask about a moment it was true.

Best idea: Judge a memory against the instant asked for
Main risk: Scope is optional, and the server’s recall ignores the token

Read analysis

A blocklist that survives paraphrase447

CASS

Forgetting a rule writes its text to a blocklist, and any later bullet within 0.85 token overlap is blocked on merge — beside five typed audit writers with no caller outside their own tests.

Best idea: Match the blocklist fuzzily, not by hash
Main risk: A green test suite over an unwired audit log

Read analysis

The prompt was measured and replaced with a door448

Compartment

An encrypted offline vault whose audit chain anchors its own length against truncation — and whose memory-shape rule moved from the MCP handshake into a refusal after the handshake version measured a 1,938-character median.

Best idea: Anchor the chain's length outside the chain
Main risk: Supersession keyed on an id, not content

Read analysis

The ladder protects the wrong end449

Mnemo Cortex

Seals the testimony and lets the filing change — then ranks "this is false" at the bottom of the confidence ladder, where any ordinary write outranks it.

Best idea: Seal only the half that must not change
Main risk: The rejection state is the easiest to overwrite

Read analysis

The transaction clock set to the valid clock450

Lemmalog

Memory as a deductive database — proof trees, semiring provenance, scoped retraction — whose shipped tuple carries an asserted_at position every write sets equal to valid_from, a backdated one included, and the default rules discard.

Best idea: A hypothetical that proves it left no trace
Main risk: The second clock is allocated, not running

Read analysis

The default account filter is a closed one451

Linggen Memory

A LanceDB memory whose account scope defaults to the owner's rows as a WHERE clause and whose merges archive their losers — while the exact-content dedup on the write path consults neither the account nor the archive.

Best idea: Default the enum to the restrictive variant
Main risk: A dedup lookup that skips the read gates

Read analysis

Invalidation keyed on a hash of the file's mtime452

XERJ

A Rust search engine whose agent-memory API is one reserved index per namespace, with bitemporal graph edges over those memories — and an edge id that changes when the source file is saved, so the invalidation stops applying.

Best idea: Two clocks filled from two different sources
Main risk: A rejected claim returns under a new identity

Read analysis

A silence verdict that scored zero453

Rekal

Coding sessions captured at every commit and carried to teammates by git itself — with a committed benchmark showing the recall gate injected on all 1,888 questions and abstained on none of the 446 that had no answer.

Best idea: Rank on the drill edge, not the ranker's own output
Main risk: The abstention branch is measured dead

Read analysis

Every seam for approval except the approver454

OpenLore

Shared Markdown served to agents over SSH as a scope-filtered virtual filesystem — with a complete human-approval protocol whose only callers live in three test files.

Best idea: A nested docset overrides its ancestor grant
Main risk: The approver is a plugin that isn't here

Read analysis

The absent actor role is the privileged one455

Agent-MemoryForge

A multi-tenant memory plane whose private tiers are filtered per hit against the owner stored on the record — and whose actor role defaults to system, which is on the privileged list.

Best idea: Markdown is authoritative, the index is rebuildable
Main risk: Omitting a field grants privileged reads

Read analysis

Memory built to drift456

SelMem

A memory organ that degrades what it stores on purpose — gists blur, forgotten scenes keep colouring what comes next — so that two instances on one corpus stop sharing a past.

Best idea: One text that may drift, one set at encode to drift away from
Main risk: A spent memory is deleted together with its only history

Read analysis

A guess waits to be confirmed457

WeKnora

An inferred memory is written pending and no prompt can reach it until a person confirms — and rejecting one records a fingerprint the extractor checks before it writes.

Best idea: A status that holds a guess out of every prompt until confirmed
Main risk: The validity interval is written at five sites and read by none

Read analysis

The key decides the scope458

Halofy

An organization memory kernel where identity comes only from the API key, every read is an enumerated list of ancestor namespaces, and every outcome is hash-chained into the audit log in the same transaction — while the write-time dispute quarantine its documents describe is never created.

Best idea: Server-owned identity and an IN-list ACL on every read
Main risk: A documented dispute quarantine with no producer

Read analysis

Draft, share, anchor459

OriginTrail DKG V10

Agent memory as RDF in three layers — a private per-agent draft, a gossip-shared graph, and chain-anchored Knowledge Assets whose trust only the protocol writes — recalled by a keyword scan that ranks by layer and never asks for trust.

Best idea: An explicit private-to-shared-to-anchored progression
Main risk: Default recall ignores the trust levels

Read analysis

A textbook that commits its receipts460

AI Agents in Depth

A book's memory chapter that builds user memory four ways and commits hashed run evidence for each on one sixty-case suite — where enhanced notes edge out the structured cards the chapter builds toward.

Best idea: An experiment ledger with hashed, credential-free receipts
Main risk: Single runs, and a fixture table that contradicts them

Read analysis

Consolidation with receipts461

dsh-mneme

A DeepSeek Harness memory plugin whose background consolidation writes a replayable receipt for every run and every merge it commits — with conflict freezing and scope isolation built, tested, and off by default.

Best idea: Content-addressed receipts for automated rewrites
Main risk: Every protection defaults to off

Read analysis

A corrections log beside the code462

widemem.ai

A Mem0-shaped Python library that can exempt a medication from decay, returns a confidence level so an agent can abstain, and keeps an append-only write history guarded by a source-walking test — while a search with no user id reads across users.

Best idea: Claims gated by tests, corrections logged in public
Main risk: Unscoped search reads every user

Read analysis

A graph the agent thinks in463

kaeru

A Rust graph engine where an agent records hypotheses, verdicts, reviews and reasoning trails, never overwrites a node, and can read any node as it stood at a past second — along record time only, and with verdicts recall does not consult.

Best idea: Validity-keyed nodes plus an audit node per mutation
Main risk: Refuted claims recall like supported ones

Read analysis

Guidelines learned from trajectories464

ALTK-Evolve

IBM's on-the-job learning for agents: guidelines extracted from finished trajectories, merged by LLM conflict resolution, and injected as a small support-weighted dose per task — with corrections that delete rather than supersede.

Best idea: Core lessons plus a dose from similar tasks
Main risk: Conflict resolution deletes without a record

Read analysis

A governance layer over empty tables465

Open Brain

A Postgres memory service for coding agents with a full assertion model — statuses, validity windows, reviewed proposals, reversible executions, tombstones — that nothing in the service ever writes; what runs is a pgvector memory table and an event log.

Best idea: Review, apply and reverse for every automated change
Main risk: No producer for assertions, projects or tasks

Read analysis

Written only on verbatim evidence466

distill-kura

A dependency-free Python memory, one Markdown store per agent mode, where a model recalls by reading the whole index and every write must carry quotes found verbatim in the transcript — numbers from tools, decisions from the human.

Best idea: Evidence classes decide what a memory may claim
Main risk: A retired memory is still recalled

Read analysis

Governed corrections, ungoverned defaults467

Waggle

Project memory for coding agents: verbatim turns, deterministically extracted nodes with evidence spans and validity windows, and a browser workflow where a person approves the exact text of a correction — while the default hybrid query ignores validity.

Best idea: Apply only the approved text, or mark it stale
Main risk: Superseded nodes reach agents through hybrid hits

Read analysis

A vector database that gardens its memories468

KektorDB

A Go vector database with HNSW, BM25, a time-stamped property graph and an LLM gardener that consolidates and reflects — where superseded and consolidated memories are hidden by one recall tool and returned by the others.

Best idea: Evolve memories on a crash-safe engine
Main risk: Historical flags read by one tool of four

Read analysis

Retrieval measured against itself469

claude-mem-lite

A Claude Code memory plugin on one SQLite file: batched hook capture enriched by Haiku, heavily tuned FTS5 recall gated by a CI benchmark, and retractions kept as tombstones every read path excludes — though the automatic save still dedups against them.

Best idea: One live predicate, pinned by a test
Main risk: Auto-capture dedup reads tombstones

Read analysis

One brain, stored in two places470

EGC

A local runtime that installs shared memory, a command guard and a session bus into twenty-nine coding tools — with encrypted per-branch project state beside plaintext decisions and lessons that every project’s queries return.

Best idea: Encrypted project state per git branch
Main risk: Decisions and lessons ignore the project

Read analysis

An event log that remembers what failed471

projectmem

A local-first memory for coding agents that appends every issue, attempt, fix and decision to one JSONL log, warns before a commit repeats a failure, and promotes lessons to a machine-wide store that ignores their later corrections.

Best idea: Warnings at commit time from recorded failures
Main risk: Global gotchas never learn of a supersession

Read analysis

Every summary keeps its source472

StrataGate

A DeepSeek Harness memory that seals conversation verbatim before any model call, derives decaying layers, time-aware event cards and a current-state graph from it, and reinforces only evidence an answer actually used.

Best idea: Reinforcement only from use receipts
Main risk: Superseded events injected without their status

Read analysis

A steward for engineering memory473

agent-memory-mcp

A Go MCP server for engineering agents with typed decisions, runbooks and incidents, a document index, session close as a reviewable plan and a steward that queues conflicts — whose as-of recall cannot see superseded entries.

Best idea: Session close as a plan a person can review
Main risk: Temporal recall built on a filter that hides history

Read analysis

Links that explain an answer474

VelesDB

A Rust vector, graph and columnar database whose memory server stores facts with no model call, returns the evidence trail behind a recall and compiles context under a budget — while forgotten facts leave their extracted attributes on the entity.

Best idea: No model on the write path; why() shows the trail
Main risk: Entity attributes outlive the fact that stated them

Read analysis

Three tiers composed per turn475

dsh-mnemon

A DeepSeek Harness plugin that pins one view per turn from bounded runtime memory, documents and provider-backed memory spaces, and archives overflow only after verifying every entry landed — while branch-scoped memory leaks across branches after archival.

Best idea: Host-verified archival between tiers
Main risk: Branch scope fails open

Read analysis

Owner scoping with two exits476

yantrikdb-hermes-plugin

A Hermes Agent memory provider over an in-process YantrikDB engine that scopes every recall to the agent and optionally the person — while the shared-brain mirror and id-only forget both cross the person boundary it guards elsewhere.

Best idea: Namespace from the host session, not the model
Main risk: Shared brain and forget cross owners

Read analysis

Two clocks, one fenced lane477

inite-brain

A per-tenant SurrealDB memory service whose facts carry real-world validity and knowledge time on separate columns, with a parity test binding the profile and the search lane to the same instant — while the per-user fence on the timeline and the contradiction list is off by default.

Best idea: Two clocks, pinned by a parity test
Main risk: User fence stops at the search lane

Read analysis

Rejections that stick478

goodmemory

A memory layer for installed coding agents that identifies a writeback candidate by a hash of its own content, so a sentence a person rejected is refused forever — while recall and export enforce workspace scope by two different rules.

Best idea: A tombstone keyed on content, not a row
Main risk: Two scope fences, two rules

Read analysis

Every read fenced, one write unchecked479

memorix

A local-first shared memory for coding agents that checks visibility at every seam returning a record and promotes memories only through CLI review — while the transfer tool’s import inserts arbitrary records verbatim.

Best idea: The visibility check at every read seam
Main risk: Import trusts its payload

Read analysis

Both clocks in the WHERE480

dense-mem

A self-hosted Go memory service whose recall gates real-world validity and knowledge time together and replays a claim’s transition history to answer what was believed then — while a verifier model, not a person, decides what becomes fact.

Best idea: Point-in-time status replayed from a ledger
Main risk: The governor is a model

Read analysis

A death certificate the importer reads481

loreai

An LLM proxy that distils sessions into versioned knowledge, deletes by appending a death certificate both import lanes consult, and detects contradictions without resolving them — while the approval that decides team sharing is excluded from sync.

Best idea: A deletion later writes must read
Main risk: The sharing decision is not synced

Read analysis

Validity on the edges, none on the claims482

mazemaker

A C++ and Python associative memory with a sleep-cycle consolidation engine whose supersession fires only when two similar memories carry different numbers, and which demotes the older one by half a point rather than filtering it.

Best idea: Sampling the slices recency never reaches
Main risk: Correction needs a digit, and never filters

Read analysis

A boundary the caller cannot drop483

memtomem

A markdown-first memory whose scope rule is a SQL fragment that is never empty on any retrieval path — while a maintenance tool on the agent’s own surface previews every project’s chunks.

Best idea: A scope fragment that cannot be dropped
Main risk: Maintenance tools read every project

Read analysis

Proposals a person applies484

tracedecay

A Rust code-intelligence daemon whose fact store proposes every deletion as a review-required candidate and applies none of them alone — and then hard-deletes by policy, keeping no record that a fact was ever rejected.

Best idea: Deletions that carry their own review flag
Main risk: A hard delete leaves no record

Read analysis

A purge that later writes collide with485

titen

A Bun and SQLite memory with no model or embedding provider on any path, whose purge record makes a later claim citing that evidence fail on a primary key rather than be refused in application code.

Best idea: A tombstone enforced by a constraint
Main risk: The guard covers the first cited source

Read analysis

A share that grants its prefix486

llm-memory-api

A Postgres memory and multi-agent deliberation service whose namespace permissions gate every retrieval path — and whose note-share check matches a shared slug as a prefix, so one shared note opens every note whose slug extends it.

Best idea: Deliberation with a derived outcome
Main risk: A note share read as a prefix

Read analysis

A verified history any writer can shorten487

demarkus

Versioned markdown over QUIC where every version is hash-chained and the history response reports whether the chain verified — with capability tokens held only as hashes, reads filtered row by row, an archive state every current read honours, and a retention key any writer can set to delete the oldest versions unseen by the check.

Best idea: Integrity reported on the read
Main risk: Pruning passes the chain check

Read analysis

Narrow by default, widened on purpose488

people-context

A local-first store of memory about the people in your life, where a four-level sensitivity bounds what an ordinary read discloses and imports stage for review, committing only by the ids a person names.

Best idea: The narrow set is the default
Main risk: Personal data no mechanism can consent for

Read analysis

Two halves, one detached HEAD489

state-memory-mcp

A deterministic SQLite graph for workflow state that logs both sides of every mutation — and on a detached HEAD reads nothing while writing under main, with neither half reporting it.

Best idea: Before and after in one event row
Main risk: Read and write disagree, silently

Read analysis

One rule, keyed on the operation490

the-librarian

A markdown-and-git vault curated by a resident agent, where every apply-propose-skip verdict comes from one function keyed on what the operation does rather than on what the model said about its own risk.

Best idea: Never ask the model to grade its own edit
Main risk: Confidence alone still decides a merge

Read analysis

The database holds the ACL491

akb

A git-backed knowledge vault where agents run their own SQL and PostgreSQL enforces vault isolation through a transaction-scoped role — with a token scope that intersects the user ACL and can only subtract.

Best idea: Enforcement in the database, not the app
Main risk: A scoped token bounds writes, not reads

Read analysis

A write boundary in a comment492

jaz

A personal always-on agent host whose memory injects two horizon files every turn — one documented as dream-maintained and read-only for agents, though neither write path distinguishes it from the other.

Best idea: Inject the considered view, don’t retrieve it
Main risk: Nothing enforces the read-only horizon

Read analysis

Recency read off a moving position493

agentrt

A C11 agent-runtime substrate whose memory daemon keeps records in a fixed-size array and reports newest-first by array position — which its swap-with-tail delete permanently scrambles.

Best idea: A context ledger with replayable transitions
Main risk: One delete destroys the recency order

Read analysis

An evidence model, and two ways past it494

inno-agent

A personal learning agent that derives mastery from typed, weighted evidence and gates teaching on a misconception status — beside two tools that write the same fields with none of that discipline.

Best idea: Weight evidence by what the learner did
Main risk: Evidence ids nothing ever resolves

Read analysis

Approval as a state, not an event495

oh-my-hermes

An operating layer over Hermes Agent where nothing reaches a prompt without an admission state — staged, decided per item, and re-checked at the write and again at replay.

Best idea: Re-check admission at the point of use
Main risk: The evidence expires before the state

Read analysis

Lifecycle the search query skips496

bitterbot-desktop

A local-first agent with a key-addressed facts ledger, and two chunk lifecycle columns that one predicate reads everywhere except the hybrid search query.

Best idea: Inject the key facts by key, not by similarity
Main risk: A forgotten chunk stays searchable until the purge

Read analysis

The limits are in the doc comment497

yantrikdb-engine

The embeddable Rust engine behind YantrikDB’s server and Hermes plugin: decay, consolidation and an as-of recall whose header lists the three things it cannot reconstruct.

Best idea: Reading history must not count as use
Main risk: Scope is an Option, not a guarantee

Read analysis

Coverage as a compile error498

nodedb

A multi-model database pitched as agent memory, whose row-level policies are injected into physical plans by a walker exhaustive over every engine’s own op enum.

Best idea: An un-run check reads as “never ran”
Main risk: The memory vocabulary has no code behind it

Read analysis

Unknown renders as most certain499

openconcho

A desktop and web client for self-hosted Honcho that browses, creates and permanently deletes the conclusions a memory server has drawn about you.

Best idea: A delete button on an inferred belief
Main risk: A missing level renders as explicit

Read analysis

The merge must keep every line500

ox

A CLI whose team memory lives in server-distilled git repositories, written so it cannot conflict, with an opt-in LLM merge that must keep every line of both sides.

Best idea: A rule documented with its evidence
Main risk: Distillation runs on the server

Read analysis

A test that parses its own source501

maximem-synap-sdk

Client SDKs for a hosted memory service, where Python proves every method taking a customer id checks it by walking its own AST — and TypeScript ships the guard without the proof.

Best idea: Assert coverage, then assert it isn’t vacuous
Main risk: The other SDK misses two call sites

Read analysis

The count nobody reads502

syke

A local memory agent that brackets every unsupervised LLM rewrite of its graph with a fingerprint, a snapshot and a gate — which counts the memories deleted and raises nothing.

Best idea: A creation time that may not change
Main risk: Deletion is outside the gate

Read analysis

Index the shape, not the secret503

sivtr

A Rust memory space over the terminal output and agent transcripts already on your disk, which records that a session holds credential-shaped strings without storing them.

Best idea: One scan, two outputs, two paths
Main risk: The eval corpus isn’t committed

Read analysis

Two status axes, not one504

eliot-memory-os

A pre-alpha Rust control plane whose claim cards separate how well founded a belief is from whether it is live, and which let only an operator promote a candidate.

Best idea: Epistemic status apart from lifecycle
Main risk: Every invariant lives in Rust alone

Read analysis

Its own numbers, tested505

neuralmind

Persistent memory and context compression for coding agents, whose recorded decisions go stale when a commit changes their files, and whose test suite refuses any website ratio without a reproduction command.

Best idea: A commit marks the decisions it touches stale
Main risk: A failed audit append leaves no trace

Read analysis

The retired value, refused on return506

inspeximus

An agent memory that keeps a ledger of the values each key has retired and retires a matching write on arrival — with the guard’s own defeat condition in the comment above it.

Best idea: A tombstone keyed on the value
Main risk: An echo that hides the value gets through

Read analysis

The journal is the memory507

pi-memory

A Pi extension that indexes Pi's own session journals with contentless FTS5 and byte pointers, and rereads and redacts every answer from the journal.

Best idea: A disposable index over the transcript
Main risk: The agent can widen the project scope

Read analysis

Withdraw by event, delete nothing508

mandalore

A Git-backed memory where every change is a new validated revision with its author and reason, withdrawal is an appended event that hides without deleting, and recall tells the model that absence is not proof.

Best idea: Put the disclaimer in the payload
Main risk: Withdrawn records stay readable in history

Read analysis

The wire never writes your verdict509

kannaka-memory

A hyperdimensional swarm memory whose prose promises wave interference, and whose single write chokepoint refuses to let a remote peer set or clear the hallucination flag.

Best idea: Overwrite the flag, don’t validate it
Main risk: A bespoke non-OSI licence

Read analysis

It ablated its own lesson memory510

chump

A fleet coordinator with an off-switch for each cognitive faculty that ran the lesson-memory A/B and published the null — on runs whose A/A control missed its own stated tolerance.

Best idea: Build the off-switch, publish the null
Main risk: The null rests on runs its rules would not cite

Read analysis

The decay policy in one table511

longterm-memory-mcp

A fully local MCP memory server whose forgetting is a six-row half-life table with floors and protected tags, and whose every read rewrites the whole database file.

Best idea: A decay policy a user can read
Main risk: Two sessions on one file overwrite each other

Read analysis

Corroboration must cross a source class512

agent-memory-guard

A defensive middleware that wraps a host’s memory writes with eleven detectors, including one that refuses to let an agent corroborate itself — if the caller labels the write.

Best idea: A restatement is not a second source
Main risk: Unlabelled writes skip the check

Read analysis

Hidden survives a silent re-save513

a-memory

A four-tier local store where a re-save with no visibility argument keeps the stored flag, so automatic writes cannot un-hide a quarantined key.

Best idea: A missing argument keeps the stored flag
Main risk: Context builders skip the visibility filter

Read analysis

An update the input cannot request514

memex

A Markdown memory for coding agents with a CI gate that fails when memory went unused, and a write path where every call makes a new page because no input carries a slug.

Best idea: Memory activity as an exit code
Main risk: The model's write tool cannot update a page

Read analysis

A guard that expects to be evaded515

yacmemo

A Markdown memory server that strips the dates and –2 suffixes off a title before checking it for duplicates, counts every override, and lets only a person dismiss a collision warning.

Best idea: Normalise away the evasion first
Main risk: Git is the only complete record

Read analysis

A gate that declines to decide516

levh

A decaying local memory whose admission gate holds the candidates it will not judge, while the agent's own tool can store them anyway with a force flag.

Best idea: Two refusals, two different paths
Main risk: The agent can force past the hold

Read analysis

A claim about authority is not authority517

anda-db

A Rust knowledge-graph memory where grants are rows the query language cannot reach, belief is computed rather than stored, and erasing a source blocks its digest from ever being re-published.

Best idea: Content cannot grant authority
Main risk: No smaller entry point exists

Read analysis

A filter reading fields nothing writes518

temporalstore

A serious Rust storage engine with a ranked context pack above it, whose validity field has no writer and whose headline token saving divides by a corpus the baseline never read.

Best idea: Lexical and cosine on one scale
Main risk: Deprecated fields still filtered on

Read analysis

Hidden and absent answer alike519

mushroomdb

An embedded graph where a relationship is a rule that derives and retracts its own edges with the evidence attached, and a role token’s mask can only ever be narrowed.

Best idea: Every permission failure denies
Main risk: MCP takes the role as an argument

Read analysis

One rule, one place, every path520

flair

An identity and memory substrate whose read-scoping lives in a single helper, written that way after the same rule, copied per path, leaked one agent’s memories to every other.

Best idea: The scattered rule was the leak
Main risk: Only “private” separates agents

Read analysis

Proving absence by building the other corpus521

theurian

A decision record agents read and propose to, whose absence proof compares a withholding corpus with one that never held the row, so a withheld row cannot be inferred from a count, a score or a page boundary.

Best idea: Absence proved, not asserted
Main risk: Nothing checks the merge happened

Read analysis

Ignored means quieter, not louder522

yantrik-os

A desktop OS whose shell is an agent, with an LLM-free cognition loop whose speaking threshold rises when its suggestions go unheeded.

Best idea: Ignored raises the bar
Main risk: Forgetting goes around the engine

Read analysis

A merge that only previews523

huiran-cerebro

A single-file personal memory hub whose dedup would retire the later duplicate and keep the first, behind the one command, which is hardcoded to preview.

Best idea: Mark the duplicate, keep the first
Main risk: The merge only ever previews

Read analysis

It strips its own context block524

light-mem

A hook-driven memory for four coding agents that redacts before storing, removes its own injected block so it cannot re-ingest itself, and tells a missing prompt from a redacted one.

Best idea: Do not re-ingest your own output
Main risk: Two stores, one audit log

Read analysis

A promise the filename cannot keep525

bifrost

An agent runtime whose 148-line memory layer keys one Memvid file per session, under a tool that tells the model it is searching its absolute long-term memory.

Best idea: Read key and write key agree
Main risk: Session is in the filename

Read analysis

Provenance you cannot leave blank526

mnemora

A cognitive layer for underneath an agent framework, where a memory’s origin is the tag of a union rather than a flag, and a contested memory is still recalled.

Best idea: Provenance as a type, not a field
Main risk: The tenant string is the caller’s

Read analysis

A veto is an Option, not a zero527

chitta-field

An SDR-backed associative memory whose excluding statuses return None rather than a low weight, and whose contradiction detector compares claims instead of text.

Best idea: Exclusion the compiler can check
Main risk: The log is pruned at each snapshot

Read analysis

It tells you what it held back528

mnemonic

A markdown-and-git memory server whose recall reports how many weak matches it suppressed and whether it widened — and where omitting the scope is the stricter path.

Best idea: Disclose the suppressed count
Main risk: Superseded notes keep their rank

Read analysis

Guards that say what they are not529

nougenshards

A local memory that harvests other AI tools’ traces into encrypted SQLite, redacts before embedding, and labels its sandbox and denylist as speed bumps rather than boundaries.

Best idea: A guard that disclaims itself
Main risk: One store, everything, no isolation

Read analysis

No approval banked in advance530

edda

A tamper-evident ledger for coding agents that refuses to write a chain break, keeps capability material out of its events, and ignores any verdict recorded before the gate opened.

Best idea: Subject, commit, and a time window
Main risk: The approver is a label

Read analysis

Declare how you knew, not how sure531

osiris

An event-sourced entity graph where a fact’s confidence is a projection of how it was obtained, merged objects drop out of every search route, and a daily job prunes the append-only tables.

Best idea: Corroboration nobody can claim
Main risk: Never-delete, pruned daily

Read analysis

Every earlier check goes stale532

holo-invariant

A hash-chained append-only claim log where a correction is a record beside the original and each re-check is bound to the version it checked.

Best idea: Bind a check to its version
Main risk: Its benchmark scores typed answers

Read analysis

A flag the caller cannot write533

codemem

A coding memory whose semantic search has the scope-enforcement flag removed by type, and whose attribution layer refuses a causal claim without a preregistered randomized contrast.

Best idea: Subtract the flag from the type
Main risk: The epistemics are not yet wired

Read analysis

The exit shipped before the entrance534

tessellum

A typed-note knowledge system whose re-derivation gate blinds the claim, pins the model so it cannot certify itself, and quarantines rather than retracts when it cannot tell.

Best idea: Demotion before promotion
Main risk: Not a store an agent writes to

Read analysis

A fact gets a table, not a threshold535

neoth

A local-first AI daemon whose operator-asserted facts live in a decay-immune table ordered ahead of episodic memory and reach recall only when verified, and whose forgotten topics stay out of profile extraction.

Best idea: An importance score is not a fact
Main risk: A review gate nothing calls

Read analysis

The disclosure was the leak536

hungry-hippa

A local memory runtime that reports what it excluded and why — and whose own test suite records that, to an unauthorised caller, that report answered whether a memory exists.

Best idea: Identity decides, never a label
Main risk: The log is code, not a trigger

Read analysis

A malformed ACL grants nothing537

cortana

A local-first second brain whose search validates each row’s access list in SQL before matching it, and which starts query-only until each capability is separately authorised.

Best idea: Check the ACL’s shape, then match
Main risk: The proposer can approve itself

Read analysis

The build checks the README’s numbers538

cortex-hypermnesia

A local memory server with no model in the retrieval loop, supersession published as a view, and a CI gate whose exemption list is itself pinned by a test.

Best idea: Gate your own advertised counts
Main risk: Curation is automated, not human

Read analysis

Two time axes, one clock539

engram-cognitive

A single-file Python memory with episodes, superseded facts and an entity graph, whose published numbers are recomputed by a CI gate and whose gates are pinned to the release workflow by a test.

Best idea: Test that the gates run where bytes ship
Main risk: One clock writes both time columns

Read analysis

Now is AsOf(now), not a branch540

claudinio-brain

A bitemporal knowledge graph in one SQLite file where valid time comes from the caller, a retraction means never-true rather than no-longer-true, and a linter reports facts retrieval cannot reach.

Best idea: One read arm for now and then
Main risk: Scope is an argument you can forget

Read analysis

Its negative set was inside its own corpus541

re-call

Agent memory on your own PostgreSQL where every hit carries a verdict and only ok becomes evidence, strict mode refuses instead of answering, and a claim a person rejected stays rejected.

Best idea: Measure whether you ingest your own eval set
Main risk: Injection hooks skip the verdict

Read analysis

The trust field that promotes542

okf-agent-memory

An Open Knowledge Format implementation keeping memory as repository markdown, where status and staleness are validated but never read, and governance multiplies the rank instead.

Best idea: A log the MCP path cannot switch off
Main risk: Deprecated ranks like stable

Read analysis

The database is a replay543

loreweave

A temporal knowledge engine over a markdown vault where fact lines are the durable record, queried by both valid time and transaction time, and the index can be wiped and rebuilt.

Best idea: Make the index disposable
Main risk: No scope key anywhere

Read analysis

It publishes the bypass that works544

temvera

An ICDE 2027 artifact whose reference substrate is a bitemporal event ledger with crypto-shredded payloads, beside a signed-evidence action gate and a harness that rechecks every printed figure offline.

Best idea: Commit the attack that succeeds
Main risk: Nothing reads the deletion receipts back

Read analysis

An empty scope shows the global layer545

mindreader

A Rust MCP memory over Neo4j where the agent curates what it keeps, visibility is checked on both endpoints of every relationship, and correction edges are barred from search.

Best idea: Omitting the scope narrows, not widens
Main risk: The epistemic tiers only rank

Read analysis

An audit chain that forgets on purpose546

verimem

An AGPL memory where writes pass an admission gate, recall SQL drops three stored statuses, and the hash-chained mutation log records the deletion without recording what was deleted.

Best idea: Keep content out of the immutable chain
Main risk: Scope is assembled by the caller

Read analysis

The predicate test parses your source547

anatid

A DuckDB memory whose tenant and bitemporal predicates live in one module, whose indexes may only narrow, and whose erasure chases copies outside the memory graph.

Best idea: Fail the build on a hand-written predicate
Main risk: Time is the only axis of doubt

Read analysis

The index follows HEAD548

memhtml

A git tree of semantic HTML, one fact per file, with a rebuildable index, four arms sharing one scope filter, and a nightly curation branch that search serves before anyone merges it.

Best idea: One scope filter for every arm
Main risk: Unmerged curation is searchable

Read analysis

Both axes, one read path549

bwmem

A per-user memory SDK on Postgres whose facts carry both time axes, whose database-constrained status keeps three of four values out of every read, and whose corrections table names both values.

Best idea: The as-of read is the ordinary read
Main risk: Nothing purges the corrections log

Read analysis

The model cannot sign the approval550

huqan

A local gate between what an agent proposes and the state it would change, where a memory write waits in a durable queue until someone holding a secret the model never sees approves it.

Best idea: Approval is a credential, not a name
Main risk: Quarantine holds nothing

Read analysis

Keep what the merge destroyed551

ontomem

A consolidating memory that merges extractions into one record per key, with a ledger of pre-merge inputs so removing a document re-merges the survivors instead of deleting everything it touched.

Best idea: Exact rollback from kept inputs
Main risk: A record cannot say it is doubtful

Read analysis

Two walls, and a summary around them552

yantrik-mind

A Rust companion over a pinned belief engine whose own contribution is a purpose gate: scope then sensitivity on every facade read, default-deny policies, and a receipt for each, the operator's included.

Best idea: A grant opens purpose, never scope
Main risk: Compaction reads around the wall

Read analysis

A floor under the thresholds553

mnesio

A Rust memory that compiles agent outcomes into versioned policies, where a bitemporal graph decides what was live at an instant and no configuration can relax the commit baseline.

Best idea: Relax every threshold, still refuse
Main risk: Nobody reads what the gate passes

Read analysis

Measure the refusal both ways554

ulpia

A deterministic keyword router over hand-keyed markdown with no model in the retrieval path, whose abstention is scored as a decline rate and a false-decline rate on a labelled set.

Best idea: A differentiating claim must be measured
Main risk: The stage ladder reaches no read

Read analysis

The sweep may only demote555

gaius

An offline ops memory that injects mined facts unattended, where a person’s reject withholds a fact and the audit pass may only demote one into a ranking penalty.

Best idea: State the pass's ceiling first
Main risk: A rejection stands only once

Read analysis

Bound on the server, an argument locally556

aidememo

A Rust working memory whose local facts are superseded rather than deleted, beside a server that binds every write and read to the credential's project.

Best idea: Make the authorized scope its own type
Main risk: The default local MCP takes its namespace from the call

Read analysis

The lattice guards every update, not a rebuild557

cogz

A local-first Rust memory whose status lattice guards every update, hand-edited files included, and whose rejected claims warn a matching write without refusing it.

Best idea: A status lattice enforced on hand-edited files
Main risk: A rebuild inserts every status unchecked

Read analysis

A blank scope is not a scope filter, and a test says so558

Leteo

A local-first Rust memory whose comments carry the measurement and the bug behind each decision — and whose one visibility rule hides a superseded memory from every read while the save path writes into it.

Best idea: Put the measurement, and the bug, in the comment
Main risk: A hidden memory is revised by the next keyed save

Read analysis

An agent's lesson is not retrievable until a person approves it559

MemoryWhale

A local-first Rust debugging memory where an agent-written lesson lands unapproved by default — and where the loader refuses outright to run against the one schema shape in which that filter could be silently skipped.

Best idea: Decide approval from the author, at write time
Main risk: A rejected lesson is deleted, not remembered

Read analysis

The blast radius of one hallucinated decision is five records560

Rememora

A cross-agent Rust memory whose LLM consolidation is capped by what a wrong answer would cost, refuses clusters it distrusts before calling the model, and journals each applied decision beside the SQL that reverses it.

Best idea: Set the blast radius below the batch size
Main risk: One bit of epistemic state, set by a model

Read analysis

The tool argument picks a view, never an authority561

FAVA Trails

A Jujutsu-backed institutional record where a thought carries a six-value lifecycle status, the default read returns only approved current records, and the identity a read is scoped to comes from the server process rather than from anything the calling agent can say.

Best idea: Authority in the process, view in the argument
Main risk: The default reviewer is a model

Read analysis

A typo must not quietly retarget a session's memories562

LeanKG

A Go code knowledge graph whose markdown memory layer bounds its always-loaded files by refusing an overflowing write, and whose port made an unknown scope an error because the Rust original silently fell back to the project bank.

Best idea: An unrecognised scope is an error, not a fallback
Main risk: No epistemic state of any kind

Read analysis

A verified-only filter with nothing that verifies563

Hypha

An agent framework whose memory record carries an eight-value status the read gate enforces and a scope hash it compares before anything else — beside a humanVerified flag that four call sites read and no code anywhere sets.

Best idea: Compare a hash of the scope before anything else
Main risk: A verifiedOnly filter with no producer

Read analysis

The consolidation runs nightly and nothing reads it back564

AI Maestro

A multi-agent desktop orchestrator that gives each agent a CozoDB file and a nightly LLM pass distilling its conversations into categorised memories — and a context builder to put them in a prompt that no code in the repository calls.

Best idea: One database file per agent, created by the constructor
Main risk: The read-back path has no caller

Read analysis

A path is not an identity565

ContextStream MCP Server

The Rust client for a closed memory service, whose most careful work is deciding which project a folder may write to — a random marker in Git's common directory, with creating it kept deliberately apart from reading it.

Best idea: Minting the identity marker is a different code path from checking it
Main risk: The memory itself is not in this repository

Read analysis

The second clock is the engine's, and you cannot set it566

mnestic

A maintained fork of CozoDB adding an engine-assigned transaction-time axis beside the existing valid-time one, so a relation can answer what the database believed at time T about the world at time V.

Best idea: The belief axis has its own refusal
Main risk: Two doc comments describe a future that already arrived

Read analysis

The authorization check is one layer below the one that documents it567

Cognee-RS

A Rust reimplementation of cognee that authorizes dataset ids inside the search orchestrator rather than at the HTTP edge, and proves with a recording retriever that a foreign id never reaches the store.

Best idea: Authorize where the retrieval happens, not at the edge
Main risk: The delete mode named soft removes the row

Read analysis

It measures whether its own human oversight is real568

Kipi System

A markdown memory whose decision log records what the operator did with each assistant suggestion — and whose deterministic harness computes how often the answer was simply "approved".

Best idea: Measure whether the human review is real
Main risk: An interpreter on the allow list is the allow list

Read analysis

It deletes the fields nobody reads, and ships a table nobody writes569

Beevibe

A shared workspace for people and agents whose memory facts climb a three-tier scope ladder after every session — with an audit table for those decisions that has a migration, an adapter, a dashboard counter and no wired writer.

Best idea: Delete the column nobody reads
Main risk: An audit table with four of its five parts built

Read analysis

The off arm is the control on the metric570

Knowl

A local knowledge store for coding agents that retires a replaced fact instead of letting it compete with its successor — with the ablation that proves it committed to the repository, including the arm whose job is to keep looking bad.

Best idea: Keep the losing arm, and say what its losing proves
Main risk: The published figure is the best slice

Read analysis

The guard against a second copy is spelled one way571

kiwi-mem

A personal memory gateway whose hardest engineering is in forgetting — permanent tombstones consulted before a write, two generation counters for in-flight deletes, and a test forbidding a re-typed scope predicate beside one it cannot see.

Best idea: A tombstone with no expiry and one revocation path
Main risk: The anti-drift guard matches one spelling

Read analysis

The fallback is the copy without the filter572

Beever Atlas

A self-maintaining wiki built from team chat, whose retired facts are dropped by default from the semantic and hybrid reads — and returned by the keyword search that four call sites fall back to when those reads throw.

Best idea: Route deterministically, then call the model once
Main risk: The fallback is the copy without the filter

Read analysis

It sabotages its own DELETE to prove the second layer holds573

Pensyve

A memory runtime whose namespace boundary is a predicate in the SQL and row-level security behind it — with a test that deletes the predicate from a production statement, and a startup that says when the database role makes the backstop inert.

Best idea: Sabotage the statement to test the backstop
Main risk: The activity feed is written at the tool boundary and discarded

Read analysis

The date is set once and the traversal obeys it574

KGLite

An embedded Cypher-queryable graph engine offered as a substrate for agents, whose temporal context shifts a whole traversal to a past date — one validity axis, and no record of when the graph learned anything.

Best idea: Make the reference date a context, not an argument
Main risk: One temporal axis

Read analysis

Encrypted at rest, and two plaintext copies nothing deletes575

Meridian

A screen-activity memory that turns a day at the keyboard into a timeline, with an ignore list applied before the write — beside a migration backup and an MCP export that each leave the same data in the clear.

Best idea: Filter before the write, not on the read
Main risk: Two plaintext copies that nothing deletes

Read analysis

An unresolved space name must not widen to every space576

Memory Vault

A self-hosted Postgres memory whose forget marks rather than deletes, whose empty space filter compiles to a false predicate instead of no predicate, and whose threat model ships a pentest script against its own claims.

Best idea: An unresolved filter is not an absent filter
Main risk: With no space named, a search spans every space

Read analysis

It deleted the gate when the endpoint it measured went away577

Open Graph Memory

A Postgres graph memory whose runtime gate boots a fresh stack and checks tenant isolation through the public routes — and whose evaluation README removed two benchmark gates rather than let them report numbers the new API cannot produce.

Best idea: Delete the gate when its endpoint goes
Main risk: The excluded-relations list is read by nothing

Read analysis

A problem it chooses not to have578

funes

Hugging Face's append-only memory over coding-agent transcripts, which declines supersession on the argument that a write-time correction loses information silently — and guards publication with a fail-closed secrets gate.

Best idea: You may decline correction, but argue for it
Main risk: Recency weighting ranks, it does not withhold

Read analysis

A contradiction goes to the person, never to the invalidator579

Deus

A personal assistant whose memory expires atoms against the clock rather than on a flag, queues every detected contradiction for human review instead of resolving it, and refuses to backfill a review timestamp it never observed.

Best idea: Queue the contradiction, and say so where you insert it
Main risk: The summaries are more confident than the documents behind them

Read analysis

Three tiers and no floor580

Open WebUI

A self-hosted chat front-end whose per-user memory is scoped on every read and partitioned by vector collection, injected in three tiers per turn — and whose relevance filter, argued for in a comment right above it, never runs because its default is the value the gate excludes.

Best idea: Partition the vector store by user instead of filtering it
Main risk: A relevance floor disabled by its own default, then a sort that drops the ranking

Read analysis

A cascade bounded by tier581

memini

A Go memory service whose recall cascade reaches ancestors and links but only for durable tiers, while five addressing tools take any namespace the model names, and whose benchmark table cites a results directory the repository never committed.

Best idea: Narrow the tier axis at the moment you widen the namespace one
Main risk: A namespace argument on memory_list reads any namespace at every tier

Read analysis

Excluded, labelled, weighted582

CodeWiki-Plus

A documentation generator that grew a memory layer, where one query path drops a deprecated note outright, returns a draft one under an [unconfirmed] prefix, and weights everything else — and a three-event telemetry chain feeds recent failures back into the prompt that writes the next note.

Best idea: Three responses to an uncertain claim, on three values of one field
Main risk: A rejected note is skipped by the dedup that would stop it returning

Read analysis

Two clocks, one formula583

MIRA

One conversation thread that never ends, whose quiet segments collapse into first-person memories ranked by a thirteen-step SQL formula counting the user's active days rather than the calendar — with row-level security on eleven tables and a boot probe that plants a canary and refuses to start if another user can read it.

Best idea: Decay in activity days, deadlines in calendar days, both explained
Main risk: No committed test exercises any memory behaviour

Read analysis

An index that checks itself584

Flowix

A Rust Markdown notebook whose memos an agent can search, read, write and delete over MCP — with hourly versioning, a cross-process write lock, and a bigram index that re-verifies every candidate against the raw body because it knows two overlapping tokens do not prove a substring.

Best idea: Re-check a probabilistic index against the source before returning a hit
Main risk: No mark: no status, no audit, and deletion takes the history with it

Read analysis

A baseline that already knows585

Context OS

A Git-backed context convention with a Python kernel that applies every state change as one transaction and publishes a create-only receipt for it — and a continuity benchmark whose baseline deliberately contains all the answers, whose harder profile carries superseded material, and whose scorer has its own negative controls.

Best idea: An information-equivalent baseline, and a quote that must occur in the cited file
Main risk: Freshness reads a self-reported date, setup can replace the decisions table, and approval is an echoed digest

Read analysis

Gaps, not scores586

GraQle

A typed organisational knowledge graph whose entries carry a validated tenant key, an ordered clearance and five TRACE gap scores, decay between verifications, and are redacted rather than hidden for a reader below their level — with every governed tool call captured into a Merkle-committed trace anchored to a public transparency log.

Best idea: A validator whose step order stops an acceptance check seeing an un-normalised value
Main risk: Redaction keeps the confidence and quality scores of what it hides

Read analysis

Forget only the unread and unreachable587

Cashew

A personal SQLite thought graph that decays a node only when nobody ever read it and nothing live still points at it — writing every live-to-decayed transition through one audit helper that snapshots the row before the caller commits, and keeping the user-facing event clock off limits to the decay pass.

Best idea: Assert the stale row is still in the index before asserting search filters it
Main risk: Decay is keyed on the row, so the same sentence can simply come back

Read analysis

The user said no, in the write path588

Orbital

A desktop project agent whose memory is four budgeted markdown files plus an append-only asks log — an oversize file demotes its coldest entries to an archive and leaves an addressable pointer behind, a commitment the user dropped is refused when the agent writes it again, and an automated editor may close an ask only by quoting the user verbatim.

Best idea: Overwrite the agent's claim to be the user, so the close stays undoable
Main risk: The re-add check matches exact text; the fuzzy matcher built for it has no caller

Read analysis

Every ingredient but the filter589

Papez

An MCP causal memory graph whose nodes climb a consolidation ladder and are deleted only when five criteria hold together — with per-user and per-org partitioning inside the store's own read helpers, and a missing identity that raises rather than quietly returning everyone's data.

Best idea: Pair each exclusion test with an inclusion using the identical embedding
Main risk: Supersession ranks and labels; the correction and what it corrects both return

Read analysis

Re-check the claim before it steers590

Stella

A Rust coding agent that re-probes its committed policy claims before they steer — dropping a refuted one, demoting a lapsed one out of the byte-stable cached prefix — keeps an append-only ledger under SQLite triggers, and keeps a declined proposal declined.

Best idea: Append-only enforced by database triggers, not by a rule in a module header
Main risk: The domain scope recall receives is the whole taxonomy, so it partitions nothing

Read analysis

Two clocks in one query591

AgentMemory for .NET

A .NET agent-memory library over Neo4j whose point-in-time recall binds a transaction clock and a valid-time clock as separate parameters in the same query, and whose facts merge on a canonical triple key computed in C# because the database's own lowercase function disagrees with it on a specific code point.

Best idea: Make the lookup ask the same question the write path answers
Main risk: Re-asserting an invalidated fact clears the invalidation, by design

Read analysis

The tenant is not a parameter592

MUSE Brain

A Postgres-backed memory service for paired companion agents whose tenant is fixed in the storage client's constructor and validated against DNS-label rules, and where a cross-tenant read has to clear both a deployment allowlist and a per-project sharing flag — each defaulting closed.

Best idea: Bind the scope key to the client so no call site can omit it
Main risk: An audit table built for memory mutations, with one operation writing to it

Read analysis

The scope is in the key593

Brain

A Rust memory database whose statements carry four independent timestamps across two axes, whose every secondary index is prefixed with the namespace and space so a range scan cannot physically reach another tenant, and whose default read drops superseded and tombstoned rows while an as-of query deliberately overrides that.

Best idea: Put the tenant in the index key so the wrong rows are never reached
Main risk: The anonymous space is the default, so a forgotten one lands in a shared bucket

Read analysis

Deleting is relocating594

NeuroStack

A local index over a Markdown vault whose four delete paths all move a memory into an archive table with no full-text index and no embedding, so invisibility to retrieval is structural rather than a predicate anyone has to remember — and whose expiry runs at read time by relocating the row rather than by a clause.

Best idea: Assert the absence against the full-text index, not the result list
Main risk: The archive is keyed on the row; the same sentence saved again is stored again

Read analysis

Is this still true?595

invalidate

A layer that re-judges every stored fact against each new event and moves it between seven statuses of which recall returns two — logging an event that reads as a question or an instruction without ever writing it, and re-judging a kill with the memory alone in context before it lands.

Best idea: An event that commands the system is logged and never written
Main risk: A fact is born current, so a re-add escapes the event that killed it

Read analysis

The index caches the field the filter reads596

Headroom

A local context-compression proxy whose cross-agent memory supersedes rather than edits, and which removes the superseded row from both search indexes because each index holds a cached copy of the metadata that would otherwise still call it current.

Best idea: Drop the superseded row from the index, not just from the filter
Main risk: The bug that comment describes has no regression test

Read analysis

An allow-list, not a deny-list597

The Agent Guild

A Go MCP server whose lore entries carry one of nine statuses, where the search path admits four of them by name so anything else is excluded until someone adds it to the list — and the listing path beside it denies two instead, so the two reads hide different sets.

Best idea: Name the statuses you admit, so a new one is excluded by default
Main risk: Two read paths, two defaults, hiding different sets of statuses

Read analysis

The log is the state598

RecallWeave

A dependency-free Rust memory engine whose hash-chained append-only log is the source of truth and whose current state is replayed from it — with a content fingerprint that is exactly the right dedupe key, and a liveness predicate on the consult that stops it from becoming a tombstone.

Best idea: Replay the state from the log, so the two cannot disagree
Main risk: The dedupe consult filters to live rows, so a forgotten fact can return

Read analysis

It recognises itself599

Throughline

A Postgres workspace that ingests transcripts from nine AI tools into one schema so it can surface contradictions no single tool can see — and that recognises its own generated transcripts before the next sweep takes them back in as the user's work.

Best idea: Test the false-positive side of an exclusion filter as hard as the true
Main risk: Excellent audit triggers, pointed at the config tables and not the memory

Read analysis

It cannot stamp its own trust600

SwarmAI

An agent OS whose knowledge proposals carry a trust stamp that fails closed to not-applicable and never to passed, and whose approval endpoint reuses the same actionable-status constant the listing does — so a proposal hidden from the list cannot be approved by id.

Best idea: One constant shared by the list and the by-id action
Main risk: The automatic path discards what it distrusts instead of escalating it

Read analysis

The listing is an allow-list, the dispatch is not601

Kleos

A Rust cognitive-infrastructure server whose optional review gate withholds a pending memory from every listed read path, behind an MCP dispatcher that will resolve the approve route by name whether or not it was advertised.

Best idea: Resolve the gate decision once, before the write, in a pure function
Main risk: A model can call the approve route it was never offered

Read analysis

The code discloses what the deployment cannot do602

Anda Brain

A Rust cognitive layer over the KIP 2.0 graph, whose recall path is budgeted and pinned by must-not tests, and whose settlement response reports in words that no skill evaluation was performed rather than returning zeros as if measured.

Best idea: Return a reason, not a zero
Main risk: The best-stated memory hygiene here lives only in the prompt

Read analysis

It published the benchmark that was lying603

MemoryIndustry

A Rust MCP memory server over PostgreSQL whose quarantine tier is an allow-list predicate pinned by tests that pair each must-not with its control, and whose README retracts its own headline retrieval number and the two conclusions drawn from it.

Best idea: An allow-list trust predicate, and a control beside every must-not
Main risk: With no project bound, every read spans every project

Read analysis

Never silently pick a side604

remem

A local-first Rust memory server for coding agents whose truth projection returns no claim at all when two surviving claims refute each other, and whose review queue is reachable from a terminal command the agent's own tool surface does not carry.

Best idea: Return the contradiction, not a ranked winner
Main risk: The per-write log is rewritten in place

Read analysis

It tells the agent how old a fact is, and declines to act on it605

enquire-mcp

An Obsidian MCP server that turns an existing vault into cited agent-readable recall, surfacing each note's age as a signal the model may reason over rather than a filter the retriever applies.

Best idea: Surface the age, leave the ranking alone
Main risk: Writes are possible and no lifecycle follows them

Read analysis

The boundary is the file, not a predicate606

Sugar

A local-first memory layer for coding agents that keeps project memories and cross-project guidelines in two separate SQLite files, so a query cannot span projects because there is no shared table for one to span.

Best idea: Refuse rather than fall back when a scope will not resolve
Main risk: A correction overwrites the value it corrects

Read analysis

An empty scope returns nothing, and the test says so607

Lerim

A Python context compiler that turns finished agent traces into cited records with a world-validity window, where an as-of query deliberately returns rows that were archived afterwards and an empty project list fails closed rather than open.

Best idea: An empty scope is a different question from no scope
Main risk: The reasoning is prose no query can act on

Read analysis

The exclusion is tested by reading the query, not by running it608

Synapse

A hippocampus-shaped wrapper over graphiti-core adding a salience-modulated forgetting curve and point-in-time search, whose temporal filter is proved by asserting its own Cypher string contains the clause.

Best idea: Name the database behaviour a workaround exists for
Main risk: A model-supplied string is interpolated into Cypher

Read analysis

One filter helper, and nothing that tests it609

Memento

A self-hosted collector that aggregates AI coding conversations from every device and scopes each read through one shared device filter whose empty case means see nothing, with no committed case asserting one user cannot see another's.

Best idea: Decide the admin bypass in one function, not at every call site
Main risk: The isolation is documented in words and in no test

Read analysis

The agent may propose into the inbox and nothing more610

Brigade

A coding-agent work tracker whose memory writer can only deliver additive proposals into an allowlisted Obsidian inbox, through symlink-free directory handles that refuse to run at all on a platform lacking the containment primitives.

Best idea: A propose verb, and no accept verb anywhere in the tree
Main risk: Nothing verifies who accepts, and a note carries no status

Read analysis

The escape test checks the filesystem, not the error611

ANOLISA Agent Memory

A Rust filesystem memory served over MCP whose sandbox is enforced by the kernel through openat2 RESOLVE_BENEATH, and whose escape tests assert the file did not appear outside the mount rather than that a call returned an error.

Best idea: Let the kernel refuse the path, and name the attack in the module
Main risk: A flagged search hit is labelled, not withheld

Read analysis

Deleting the row was futile, so it tombstones the source612

memo

A local-first memory for coding agents that answers what the store held and what was true in the world as two separate as-of queries, and stops a re-ingest resurrecting a deleted note by excluding its source rather than by deleting the user's file.

Best idea: Tombstone what the importer reads, not the row it creates
Main risk: Contradictions are resolved only between sessions

Read analysis

A conflict policy cannot overrule a state machine613

contextdb

An embedded Rust database for agent memory that enforces declared state transitions in the engine rather than in application code, and skips a synced row whose merge would break one instead of letting the conflict policy win.

Best idea: The merge yields to the invariant, and a test says so
Main risk: It holds no memories, so the epistemic decisions are all yours

Read analysis

A failing probe is a finding, not a broken harness614

AgentMemory

A markdown memory for coding agents whose evaluation suite turns public complaints into falsifiable probes with both required and forbidden markers, and exits zero when one reproduces the problem it was written for.

Best idea: Every probe declares what must appear and what must not
Main risk: Supersession is a line of prose nothing can filter on

Read analysis

The token is neutralised in prose and preserved in a code fence615

Gomaa

A hierarchical markdown-vault memory over Postgres or SQLite whose injection defence is tested in both directions, and whose wing-and-room scope is an argument the calling model may simply omit.

Best idea: The control that gives the must-not its meaning
Main risk: An omitted scope searches every wing

Read analysis

Two guards were dead on arrival for their entire lives616

AI Brain Starter

A verification harness around a note-taking agent whose hooks block bad writes before they land, and whose smoke gate exists because two of those hooks crashed at import and the install kept reporting them as present.

Best idea: Assert the guard runs at all, not just that it works
Main risk: Admission control around notes that carry no state

Read analysis

One history table outlives its subject and the other does not617

Task Orchestrator

An MCP work-item server that verifies an agent's actor claim against a did:web JWKS before admitting a note, records the verdict on the row, and never consults it again on any read.

Best idea: A stale cache and a failed fetch are different answers
Main risk: Five verification states, and no query mentions them

Read analysis

Narratives are never edited: corrections stack on top as amendments618

Tideline

One agent's SQLite memory whose narratives are immutable under an append-only amendment layer, with overwrites archived thirty deep and injection at session start.

Best idea: Correct a memory by stacking an amendment on it, never by editing it
Main risk: A time-filtered search leaks old narratives through an unparenthesised OR

Read analysis

The citation file says the query wiring is your job619

zer0dex

A markdown memory index paired with semantic retrieval delegated to mem0 and Chroma, whose own citation abstract states that wiring the query into model calls remains an agent-host step.

Best idea: Disclose the missing half in the citation metadata
Main risk: The store is a copy and nothing detects drift

Read analysis

eBPF watches what the agent does and nothing watches what it keeps620

xiaoO

An agent runtime whose sandbox records every process, file and network access through an eBPF-backed audit, and whose memory rows carry no status, no scope and no audit trail of their own.

Best idea: Opt-in semantic recall under per-kind context budgets
Main risk: One timestamp, and no audit reaches the memory crate

Read analysis

Three headline tools are in the menu and not in the code621

Dev MCP Suite

Four file-backed MCP servers whose current release is named after three tools that are advertised to every client and throw when called, and whose snapshot skips binaries and large files that its restore then deletes as newer.

Best idea: Cross-scope recall is a second tool, not a wider argument
Main risk: Three advertised tools have no implementation

Read analysis

Rehearse the question at write time, keep it off the evidence path622

T-Mem

A conversational-memory pipeline that indexes every scene and item by generated triggers — anticipated future queries at two granularities — and never lets a trigger be returned as evidence.

Best idea: Index by the question, and refuse to return it
Main risk: Indexes are pickles, and nothing can be corrected

Read analysis

Memory files the agent may write without asking623

ZCode

A coding-agent harness whose memory is per-project Markdown files: recalled as an index pasted into the system prompt, written by a confined background sub-agent, and deleted through a shell grammar that parses the command rather than matching it.

Best idea: A delete grammar, and a denylist that normalises first
Main risk: No test runner exists, and a git hook calls one

Read analysis

A recorded demonstration, captioned into a skill624

Cua

A computer-use agent platform whose durable memory is a human screen recording that a vision model turns into a per-step Markdown procedure, read back only when a later agent asks for it by name.

Best idea: Every step carries a postcondition, over the raw recording
Main risk: A failed caption writes an empty step and still reports success

Read analysis

Continual learning as the only memory625

mini-AGI

A byte-level model that learns by taking a gradient step on everything it reads, including your half of the conversation, where the store is a directory of weight files and nothing written into it can ever be named again.

Best idea: Eviction reads staleness and refuses the gate, because the gate is anti-predictive
Main risk: Nothing learned can be corrected or deleted, and the file reader has no secret filter

Read analysis

A memory-store protocol inside an agent SDK626

Strands Agents

AWS's Python and TypeScript agent SDK, whose memory is a store protocol with a background extractor, a per-turn injector, a scope key enforced on the read path — and no delete anywhere in it.

Best idea: Optional store methods detected by inspecting the type, not by a capability flag
Main risk: No delete in the contract, and an explicit filter replaces the scope predicate

Read analysis

Facts retired when their evidence changes627

elizaOS

An agent framework whose fact store links every extracted claim to the messages it came from, retires it when those messages change, and pushes a seven-value scope ladder into the same SQL query that paginates.

Best idea: Every fact stores its sources' revisions, and an edited source retires the claim
Main risk: Retirement is record-keyed and the dedupe skips retired rows, so the claim returns

Read analysis

Typed key-value memory inside a multi-agent orchestrator628

Gas Town

A multi-agent coding orchestrator that replaces each agent's memory file with typed rows in beads' Dolt config table, printed whole into every session start, with corrections first.

Best idea: One store every agent in a rig reads, ordered so corrections come first
Main risk: The write fails against every bd release since v1.1.0, which reserves its key prefix

Read analysis

A key-value memory plane inside a Dolt issue tracker629

beads

A Dolt-backed issue tracker for coding agents whose memory is a flat key-value plane, injected whole at every session start and replicated between clones with the remote winning conflicts.

Best idea: Probe and write in one transaction, so Updated and Forgot are true
Main risk: A pull resolves a same-key edit to the remote and tells only stderr

Read analysis

Self-hosted MCP memory service on Postgres and pgvector630

Memorizer

A self-hosted .NET MCP server where agents store and rewrite titled Markdown memories in Postgres, found by RRF hybrid search and versioned on every edit with one-call revert.

Best idea: Every edit snapshots the prior state in its own transaction
Main risk: A delete cascades history away; two of six event types have producers

Read analysis

The engine over MCP, scope left to the model631

yantrikdb-mcp

An MCP server that runs the YantrikDB engine in process behind twenty-one tools and refuses what the engine cannot honour, while recall defaults to every namespace and the skill gate guards only one of two write doors.

Best idea: Refuse what the engine cannot honour, naming the fix
Main risk: Default recall spans every namespace; the skill gate has a second door

Read analysis

Local hybrid memory for coding agents over MCP632

PMB

A local SQLite and LanceDB memory for coding agents, injected by hooks on every prompt, with keyed facts superseded in place and archive-only forgetting.

Best idea: A durable outbox makes the sub-millisecond async write crash-safe
Main risk: Restating a keyed fact's current value archives the only current row

Read analysis

An off-heap cognitive memory engine with a bitemporal fact log633

Spector

A JVM memory engine whose consolidator flags the older of two contradictory memories and hides it from recall, beside a fact log whose valid-time filter mismatches its writers.

Best idea: Forget says the bytes remain; purge reports what it could not reach
Main risk: Valid time written in seconds, compared in milliseconds; retracted facts still returned

Read analysis

Code-first fork of MemPalace on LanceDB634

mempalace-code

A code-first fork of MemPalace that mines repositories into LanceDB with declaration-level chunks, hash-gated re-mining and a SQLite graph of type relationships.

Best idea: A stale sweep that deletes only rows it can prove are regenerable
Main risk: Delete by id interpolates the id into SQL, so one crafted id deletes everything

Read analysis

Single-mind MCP memory with a subconscious daemon635

Resonant Mind

One AI's observations in Postgres and pgvector, superseded on write and metabolised by a 30-minute daemon that archives, consolidates, dreams and proposes.

Best idea: Supersede similar same-entity observations at write time
Main risk: Superseded rows still surface through the wake ritual and dream pools

Read analysis

Mistake landmines inside a structural code graph636

engram (NickCirv)

A local code-graph context layer for coding agents whose memory is regex-mined mistake and decision nodes in one SQLite file, injected as landmines before an edit.

Best idea: Turn each git revert into then-believed, found-false and truth-now fields
Main risk: Reindexing a file deletes its mistakes; every hook rewrites the whole store

Read analysis

A personal profile mined from session logs, with verbatim receipts637

Emulo

A stdlib Python tool that mines the messages a developer typed to coding agents into receipt-backed rules, validated for support and installed as a profile agents load whole.

Best idea: Accept a quote only inside the message of its claimed date
Main risk: The served profile is model-written; the validator checks inclusion, not exclusion

Read analysis

A promotion gate at the tool, a second door on the write path638

sqlite-memory-mcp

A local SQLite MCP knowledge graph for coding agents that logs every core mutation append-only, while its claim-to-fact gate defaults to human_confirmed and a regex path promotes without one.

Best idea: Retire facts with a reason and an effective time, logged both sides
Main risk: Promotion defaults to human_confirmed on the agent's tool; regex hits promote unasked

Read analysis

Current-state recall over a graph and a vector store639

AutoMem

A FalkorDB and Qdrant memory service whose default recall swaps expired and superseded memories for the current version.

Best idea: Default recall substitutes the supersession chain head for stale memories
Main risk: Vector payloads omit the validity window, so expired memories still surface

Read analysis

A Git-shared project wiki grounded in a code graph640

MEX

A CLI that keeps a team's architecture and decisions as typed Markdown entities in the repository, grounded to code symbols and flagged when that code drifts.

Best idea: Ground each claim to a code symbol by fingerprint and body hash
Main risk: Agents edit files directly, bypassing the ledger, filter and review

Read analysis

Local MCP memory that supersedes on similarity641

m3 Memory

A local-first SQLite MCP memory shared by several coding agents, where a similar new write closes and soft-deletes an older memory, logged in a mutation history.

Best idea: Supersession closes validity under one compare-and-set
Main risk: Cosine 0.92 soft-deletes distinct facts; as_of cannot see them

Read analysis

A JSON hook store and a shared brain beside a vector engine642

RuVector

A Rust vector-engine monorepo whose agent memory is a per-project JSON store written by Claude Code hooks and guarded by an embedding-provenance stamp, plus a hosted shared brain with votes.

Best idea: Refuse any write from an embedder the store was not stamped with
Main risk: Tool-call telemetry and explicit memories share one FIFO with no forget

Read analysis

Project-scoped chat recall in an open-core desktop AI app643

Off Grid AI Desktop

An on-device AI desktop app whose open core filters chat recall and documents by project, then folds an unscoped, LLM-filtered memory pool that private code feeds into every project.

Best idea: Semantic hits are dropped unless their SQLite row still exists
Main risk: Unscoped captured memories join every project's knowledge base by default

Read analysis

A four-tier CoALA teaching app over SQLite, JSON and Chroma644

WARNERCO Schematica

A course's flagship MCP server that implements CoALA's four memory tiers as small stores behind a LangGraph pipeline, with an ADD-only consolidation pass run on the client's model.

Best idea: Every recalled episode returns its recency, importance and relevance scores
Main risk: Injected notes are an LLM's expansion, or truncated to 75% without OpenAI

Read analysis

A local C daemon with a confidence-gated recall over agent notes645

Graft

A local C daemon that stores agent-written notes in SQLite, returns a note's body only when a title-level vector hit is confirmed by lexical overlap, and lets the agent correct notes through an audited, reversible maintenance loop.

Best idea: Return the title alone when vector and lexical signals disagree
Main risk: A note marked stale stays in every search, unlabelled, and sync carries no correction

Read analysis

Governed Markdown memory with an admission gate646

MIND-Mem

A local Markdown memory for coding agents in which each ingest door decides a block's status, only an approved proposal makes one active, and recall withholds the rest on every leg.

Best idea: The ingest door decides the status a write may carry
Main risk: An editor or agent file tool writes active blocks past the gate

Read analysis

An LLM wiki plugin inside a multi-agent control plane647

Paperclip

A control plane for companies of coding agents whose memory is an experimental wiki plugin: a managed agent writes markdown pages, Postgres indexes their titles, and issue history is distilled with source-hash provenance.

Best idea: Every generated page is bound to the source hash it came from
Main risk: Scope keys are tool arguments and plugin SQL is not bound to the caller

Read analysis

Selection as the memory of what survives648

RRSI

A harness optimizer whose memory is the program its gate admits — a commit on a branch the next run starts from — while the ledger that justifies it lasts one run.

Best idea: Added tokens must be paid for by measured gain
Main risk: The program outlives its evidence; a new run inherits edits with an empty ledger

Read analysis

Embedded spatio-temporal memory for robots649

eMEM

An embedded Python memory for robots whose observations carry a position, a time and a perception layer, searched by meaning, radius and time at once and aged from gists into archival.

Best idea: One filter set across meaning, radius, time and perception layer
Main risk: Archival reads observation age, and DBSCAN noise is never archived

Read analysis

Teacher-distilled procedural memory for small agents650

Agent Memory Distillation

A teacher agent's benchmark trajectories become workflow, subtask and function memory files a small student reads frozen, with function records fetched only when a tool call fails.

Best idea: Fetch a tool's calling convention only when the call fails
Main risk: The committed evaluation lets each task retrieve memory built from itself

Read analysis

A robot's object memory, locked whole on reload651

FARM

A real-time RGB-D object memory for robots — one Gaussian per object with VLM captions and embeddings, queried by relational predicates computed at query time — saved as one pickle, locked whole on reload, and corrected through a UI whose deletes the next sighting undoes.

Best idea: Relations computed at query time, not stored
Main risk: A deleted object returns on the next sighting

Read analysis

An object graph that lives inside one ROS node652

EmbodiedLGR

The code for the EmbodiedLGR paper: a ROS 2 robot whose object labels are merged by place and embedding into an in-process graph with no edges and three query services, beside a ReMEmbR caption store in Milvus that the builder drops each time it starts.

Best idea: Deduplicate labels by place, then by embedding
Main risk: A memory that does not survive its own processes

Read analysis

Heat-equation memory overlay, archived653

Living Mind Cortex

An archived Python agent runtime — hormone bus, circadian clock, LLM dreams — that stores memories in Postgres and mirrors them into a RAM-only heat-equation substrate whose cold nodes return as high-importance identity rows.

Best idea: A cheap in-process salience field beside the store
Main risk: Unread memories, heartbeats included, become permanent identity rows

Read analysis

File-per-fact memory inside a coding-agent workspace template654

open-bridge

A markdown-and-YAML workspace for coding agents whose memory is one file per fact behind a session-loaded index, with tooling that measures the harness and gates that are prose.

Best idea: Lint the auto-loaded index against the harness's real cut-off
Main risk: Every memory gate is a rule the writing agent itself executes

Read analysis

Signed notes beside an Earth-observation fact plane655

emem (Vortx AI)

A Rust MCP server where agents write ed25519-signed, content-addressed notes and read signed geospatial facts with bi-temporal bounds, every attestation and note edit in a Merkle log.

Best idea: Strangers add attributed derivations; only admitted keys occupy addresses
Main risk: Search stamps every note with the server key, so author filters never match

Read analysis

Transcript-fed case memory with a background librarian656

ShellBrain

A repo-scoped Postgres memory for coding agents where a background Codex or Claude librarian files evidence-cited cases and concept claims from synced transcripts, recalled through a model-written brief.

Best idea: Refuse any memory whose evidence ids are not this repo's transcript events
Main risk: Codex inner agents run with full access; the allowlist is an environment variable

Read analysis

Local SQLite memory with a trust-gated briefing657

MeMesh

A local SQLite memory for Claude Code and Codex that captures by rule, recalls by FTS5, and injects only trusted, project-tagged memories at session start.

Best idea: One predicate decides everything injected unasked, shared by every hook
Main risk: Any plain remember on an imported memory silently promotes it to trusted

Read analysis

Append-only judgment records under a local owner agent658

MAMA

A local work agent and Claude Code memory on one SQLite engine, where every memory change is an appended judgment with a scope binding and an event row.

Best idea: One append path writes the row, scopes, event and receipt
Main risk: Recall re-attaches superseded summaries to their successors as prior context

Read analysis

A Git-style commit graph for agent memory659

Mnemosyne (Nabzx)

A Rust store that commits every agent write as a content-addressed snapshot, with branch, three-way merge, blame and bisect, and never deletes history.

Best idea: Every write is a commit in an insert-only store
Main risk: Forget drops a node from HEAD; recall_at still returns it

Read analysis

Self-maintaining skill library660

autoharness

A Claude Code plugin in which every model only stages skill intents and a deterministic promoter lints and lands them, archiving skills nobody loads.

Best idea: The model only stages intents; a deterministic promoter lints and lands them.
Main risk: Create skips the ownership check, overwriting and adopting a same-named hand-written skill.

Read analysis

An MCP concept graph a coding agent writes for itself661

MegaMemory

A per-project SQLite concept graph that a coding agent writes after each task and searches by in-process embeddings, with soft delete, a tool-call timeline and a merge for diverged branches.

Best idea: Soft delete with a required reason, filtered on every agent read
Main risk: A removed concept's name cannot be reused; conflict copies are searched as settled

Read analysis

Self-hosted multi-tenant MCP memory on Postgres and Qdrant662

Kagura Memory Cloud

A self-hosted FastAPI MCP server whose three-layer memories are isolated by workspace, context and user keys, corrected by supersede edges that shadow rather than delete, and linked by Hebbian edges grown on recall.

Best idea: Suggest supersession; a dismissal reopens only when similarity moves
Main risk: Unset SLEEP_ENABLED runs a job hard-deleting unsurfaced memories after 30 days

Read analysis

Local SQLite replica of a closed hosted memory service663

Prismer Cloud

The SDK half of a closed agent platform, whose daemon keeps a capability-gated, visibility-filtered SQLite replica of the workspace wiki and leaves correction to the server.

Best idea: Identity from a daemon-signed cap, one visibility matrix for search and recall
Main risk: The hook route takes identity from the request body, and the digest skips visibility

Read analysis

Memory declared in YAML, compiled onto one Postgres table664

Memseek

A self-hosted context engine that compiles a YAML catalog into immutable Postgres records, cited LLM derivations, reviewed promotion and token-budgeted context, behind an MCP allowlist.

Best idea: A derived claim may cite only what its run was shown
Main risk: One workspace key promotes and erases; superseded L1 memories stay in recall

Read analysis

Governed memory over a Markdown vault the user owns665

Exomem

An MCP server over an owned Obsidian vault that indexes agent-authored typed notes for hybrid search, keeps superseded pages beside their successors, and releases each hit per caller audience.

Best idea: A per-principal release gate run after the shared result cache
Main risk: Superseded conclusions are only demoted, and the agent holds every review verb

Read analysis

Episodic task memory with rule-based pattern extraction666

Rust Self-Learning Memory

A Rust workspace that records coding-agent episodes, scores and reflects on them by rule, and extracts reusable tool-sequence patterns served over MCP and a CLI.

Best idea: A write path with no model call anywhere on it
Main risk: The MCP server's quality gate scores fields before they exist; its default cannot pass

Read analysis

Embedded keyword memory667

MemHop

One Go file per agent family: turns become LLM keyword tracks, consolidated in the background, with originals swept after seven days.

Best idea: Agent id in every record frame
Main risk: Only model-derived keyword tracks outlive the seven-day window

Read analysis

A git-backed Markdown vault distilled from Claude Code sessions668

Cortexes

A Claude Code plugin that records every session into a git-backed Obsidian vault, distills notes with user confirmation, and searches them by BM25-plus-vector fusion.

Best idea: One filter language across every retrieval arm, held by a test
Main risk: Without an OpenAI key, saving a note never reaches the BM25 index

Read analysis

A Markdown vault as coding-agent memory, routed by code path669

Wordcell

A Markdown knowledge base and local MCP server whose notes are the only authority, found by exact search, optional local vectors, or the code path an agent is editing.

Best idea: Every derived vector hit reconciled against a fresh Markdown scan
Main risk: No delete verb; a re-import re-creates a deleted imported note

Read analysis

Candidate-gated fact memory for OpenClaw and Hermes670

Octop Memory

A Python memory runtime that extracts candidates from agent transcripts, promotes them to evidence-citing atoms through five rule checks, and queues conflicts for a person.

Best idea: Model output never reaches the candidate status column
Main risk: The web dashboard's approve marks a candidate promoted and writes no atom

Read analysis

One LanceDB memory shared by several coding agents671

RecallNest

A LanceDB memory layer that several coding agents share over MCP and HTTP, storing transcripts as evidence and structured writes as durable memory.

Best idea: Transcript evidence kept out of the stable profile until promoted by copy
Main risk: Write-path key matching ignores scope; search widens to all scopes when empty

Read analysis

Typed fact graph per project, kept by a background Haiku keeper672

Memoose

A local Claude Code memory plugin storing typed facts with evidence pointers in one SQLite file per project, superseding single-valued relations by validity date and logging every write.

Best idea: Supersede single-valued facts by validity date, not arrival order
Main risk: Restating an old fact clears its superseded flag and revives it

Read analysis

A neuroscience-named algorithm library over a SQL memory coordinator673

ZenBrain

A TypeScript memory coordinator that routes text into four SQL tables by heuristic, beside a neuroscience-named algorithm library whose decay and replay it never applies to stored rows.

Best idea: A lexical fallback that scores exactly 0 when nothing matched
Main risk: No shipped surface deletes a memory; the model can pin blocks into every recall

Read analysis

A Git-backed Markdown brain behind a two-door MCP server674

Cortex (Obelyth)

A self-hosted MCP server over a private GitHub repository of Markdown notes that checks every answer's quote against the file and queues guest proposals for review.

Best idea: A deterministic quote check stamps every answer, retractions included
Main risk: Trusted doors write without review; retraction is recognised only by house-style words

Read analysis

A self-hosted memory and knowledge hub for teams of coding agents675

Cortex Hub

A self-hosted MCP hub whose coding agents must search a mem0-style memory and a dated knowledge base before any edit.

Best idea: Hooks refuse edits until knowledge and memory recall have run
Main risk: Quality feedback from any project rescores documents anyone searched that hour

Read analysis

Entity-timeline memory service over Qdrant, Neo4j and Kafka676

MindMemOS

A self-hostable memory service that extracts facts or entity property timelines from dialogue into Qdrant and Neo4j, corrected by feedback and an LLM consolidation pass.

Best idea: The tenant comes from the credential and is re-checked at the store
Main risk: Dreaming clusters and archives memories across users in one project

Read analysis

A privacy-scoped personal brain on one Oracle database677

second-brain (LindaHaviv)

A single-user second brain on Oracle 26ai whose memory rows carry a write-time sensitivity tag every SQL read filters, while a nightly LLM pass rewrites every fact.

Best idea: Expire raw memory only after a consolidation ran within a week
Main risk: Each consolidation deletes all facts and keeps whatever the model returned

Read analysis

Governed memo log678

aios (rexleimo)

An append-only memo log inside a coding-agent control plane, with provenance, valid-time supersession and a candidate queue that nothing can promote.

Best idea: Claim status decided inside the append, never from the payload.
Main risk: Agent write tools land verified as local-user; candidate promotion always denies.

Read analysis

A value-dynamics memory sidecar for opencode679

Dynamics-memory

A Python sidecar for opencode that distils each turn into candidate memories, promotes them by decayed use, and repairs misses with a budgeted investigator that reads the raw log.

Best idea: A correction or the agent's own log search files a repair job
Main risk: Superseded values are archived into a pool that retrieval still scores

Read analysis

A four-layer distillation plugin for DeepSeek Harness680

dsh-layered-memory

A DeepSeek Harness plugin that captures every turn, distils atomic memories, scenes and personas with an LLM, and injects relevant memories before each user step.

Best idea: Injected recall carries a source that capture refuses
Main risk: No delete anywhere, and rebuild restores what dedup removed

Read analysis

Layered companion memory inside a Live2D desktop agent681

Cyrene Agent

A Live2D desktop companion whose profile and episode memory is extracted by an LLM judge and reconciled by an LLM resolver, beside an opt-in per-conversation atom store that checks every evidence quote verbatim.

Best idea: Verbatim evidence quotes checked in code, batches applied all-or-nothing
Main risk: Two profile writers skip the explicit-user gate; superseded episodes reach call prompts

Read analysis

Turn-level memory for a multi-model maintainer team682

Neo Agent Brain (Memory Core)

The Agent OS behind Neo.mjs's AI maintainers, whose Memory Core keeps every turn verbatim in a write-ahead log, then Chroma and a SQLite graph, read team-wide by default and per tenant under the private policy.

Best idea: Every write reports recency and semantic visibility as separate fields
Main risk: Purge deletes Chroma rows; the graph node's summary stays in recency reads

Read analysis

Git-scoped LanceDB memory served over MCP683

Octobrain

A Rust MCP and CLI memory server that scopes notes by git remote in one LanceDB table and ranks them by hybrid search, decay and a trust-tier multiplier.

Best idea: One predicate builder carries the scope clause into every search
Main risk: Rewrites stamp the session's scope, moving global memories into the project

Read analysis

Event-sourced SQLite memory for coding agents684

Kimetsu

A Rust sidecar that stores coding-agent lessons as events in one SQLite file per project and injects them through a model-free hybrid broker on every prompt.

Best idea: A rebuild that would lose a memory rolls back instead
Main risk: The agent holds accept and invalidate; its own confidence skips review

Read analysis

Current-state retrieval over captured coding-agent sessions685

Lint-AI

A Rust memory layer whose hooks capture each coding-agent turn into a project-local index and hide superseded evidence before ranking, inferred from regex-extracted claim chains.

Best idea: Superseded documents leave candidates before ranking; history queries restore them
Main risk: Captured session records are never suppressed, only marked conflicted, and hooks drop the mark

Read analysis

Six memory stores inside a self-hosted AI platform686

AutoBot

A self-hosted AI platform whose memory spans a Postgres-backed fact store, scored chat trajectories, verbatim turns and an entity graph, with required owner scopes and a research quarantine in the stores and none on the always-loaded Essential Context block that every chat prompt carries.

Best idea: An owner scope the store cannot be called without
Main risk: Every prompt carries 200 unscoped, unfiltered facts

Read analysis

Documents beside a code graph687

nano-brain

Agent notes and summarised coding sessions in workspace-keyed Postgres, found by parallel BM25 and pgvector legs fused with recency — and a fallback query that drops the time window the caller asked for.

Best idea: Workspace key on every chunk, isolation tested with positive controls
Main risk: The default search's OR fallback drops the caller's time window and tags

Read analysis

Architecture graph daemon688

DreamGraph

A per-project MCP daemon whose speculative edges reach retrieval only through a scored promotion gate.

Best idea: Retrieval never reads the speculative graph
Main risk: Rejections expire in cycles; agent tools bypass the gate

Read analysis

Governed lifecycle inside a personal agent689

Flowly

A self-hosted personal agent that wraps MEMORY.md notes and a temporal knowledge graph in a SQLite governance store with enforced statuses, an audit trail and a human review queue.

Best idea: LLM proposes consolidation ops; a validator applies them, never deleting.
Main risk: Live writes reach the prompt before governance, so reject withholds nothing.

Read analysis

Reviewable Markdown memory over MCP for coding agents690

Global Agent Memory

A local MCP memory for Claude Code and Codex that keeps notes as Markdown, returns only approved ones by default, and gates protected notes behind owner grants.

Best idea: Replay-safe request ids and compare-and-set edits on every mutation
Main risk: The agent holds memory_approve, and supersede activates its replacement in one call

Read analysis

Self-hosted claim memory for coding agents691

Recollect

A Rust and PostgreSQL server that stores coding-agent claims as reviewed, time-qualified revisions with cited evidence and keeps rejected values out of recall through value-keyed rules.

Best idea: Rejected values become keyed rules that also withhold repeating source text
Main risk: Default autonomous policy accepts model extractions from captured sessions without a person

Read analysis

Model-curated Markdown memory in git, with a shared-view hub692

RightMemory

A git-backed Markdown memory for coding agents in which agents submit evidence, a batched model updater edits Memory in an isolated worktree, and the runtime lands only validated commits.

Best idea: Model writes in a worktree; code decides whether the commit lands
Main risk: Question views reach the provider's whole root, scoped only by a prompt

Read analysis

Self-rewriting personal knowledge graph693

TideMind

A local SQLite knowledge graph shared by every connected agent, where digests land verbatim and background LLM passes link, tag, merge and rewrite them.

Best idea: A person's tag rejection is refused on every later annotation
Main risk: Recall-time LLM rewrites and newer-wins merges change memory text without review

Read analysis

Hook-driven project memory inside a Claude Code session plugin694

windvane

A Claude Code plugin whose hooks capture failed tools and stated decisions into per-project JSON and inject file-matched memories before each edit.

Best idea: Inject only on a path-aware file match, otherwise stay silent.
Main risk: The failed-tool hook never reads the archive, so an acknowledged mistake is captured again.

Read analysis

Version control for an agent's reasoning695

CTX Cognitive Version Control

A .NET CLI and MCP server that versions an agent's goals, hypotheses, evidence and decisions as JSON commits, with branches, merge and a consistency audit.

Best idea: Hypothesis, decision and conclusion as separately stated, linked records
Main risk: Refuted and superseded hypotheses still reach the packet, ranked by confidence

Read analysis

Outcome-scored tiered memory for coding agents696

Roampal Core

A local ChromaDB memory server for Claude Code and OpenCode whose model rates each injected memory, promoting or deleting it across tiers.

Best idea: Per-request profile routing that refuses an unknown profile instead of defaulting.
Main risk: Deletes by nearest neighbour; the model that used a memory also rates it.

Read analysis

A derived card index over OpenCode's own session history697

OpenCode Session Recall

An OpenCode plugin that distills every past session into a card and a slim FTS5 index, so the agent searches its own history before fetching any of it.

Best idea: Rank derived cards first; refuse the unscoped output sweep outright
Main risk: Deletions reach the index only through the lease holder's own events

Read analysis

A governed, source-bound code index as agent memory698

AOCI-CODE

A Go MCP server that keeps a model-written, Git-versioned index of a codebase, one line per file, each bound to the source file's SHA-256.

Best idea: Bind each entry to its source file's digest; refuse a moved file
Main risk: Aligned means unchanged, not correct; stale entries are still delivered unmarked

Read analysis

Thread-keyed context entries behind an MCP server699

MCP Context Server

A FastMCP server that stores prompts and agent reports as thread-keyed entries in SQLite or PostgreSQL, summarised and embedded before each write commits.

Best idea: Generation runs before the transaction, and a failed leg stores nothing
Main risk: Owner and private visibility are stamped on every row and read by no query

Read analysis

Local SQLite memory with a scoped startup brief700

Tree Ring Memory

A Rust CLI over SQLite FTS5 whose hooks inject a project-scoped startup brief and ask the agent for up to three memories at each stop.

Best idea: A startup brief scoped by the harness, not the model` (10 words)
Main risk: Explicit recall returns expired rows; the forget reason is discarded` (10 words)

Read analysis

Branch-scoped coding memory with supersession redirects701

Engram MCP (edg-l)

A local Rust MCP server for coding agents that stores typed memories and branch-chained handoffs in SQLite, redirecting superseded hits to their successors.

Best idea: A superseded hit returns its successor at the same rank
Main risk: Background dedup merges superseded pairs, silently undoing the correction

Read analysis

Self-refining harness state for DeepSeek Harness702

dsh-continual-harness

A DeepSeek Harness plugin where an LLM planner rewrites the agent's own prompt notes, memories, skills and subagent specs, each edit journaled with snapshots and reversible by id.

Best idea: Every edit declares its reach, checked against the layer written
Main risk: Default injection lists ids only, and no tool reads an entry

Read analysis

Human-memory physics for a Claude Code companion703

Counterparts

Claude Code hooks and an MCP server keep one SQLite memory the model writes itself, decays on a lived-day clock and settles on an undoable trail.

Best idea: Contradictions settle as changed, corrected or open, each one undoable.
Main risk: Any session can archive an unprotected memory by naming its id.

Read analysis

Brain-modelled memory for Claude Code, in JSON files704

Claude Engram (mlapeter)

Claude Code hooks buffer transcripts into JSON memories that a detached model extracts and a nightly sleep decays, archives, gists and merges.

Best idea: Capture is dumb and durable; failed extraction chunks return to the buffer.
Main risk: Forget skips the archive, so a verbatim pre-gist copy can be reactivated.

Read analysis

Agent-kept notes files that survive session resets in a multi-agent desktop705

Orgtree

A desktop workspace for persistent coding-agent teams whose memory is each agent's own Markdown notes and breadcrumb log, mirrored into every provider's prompt and spliced into a reset session's first turn.

Best idea: Mirror the agent's notes into the prompt where its CLI ignores them
Main risk: The recovery log is append-only only by instruction, and nothing attributes its lines

Read analysis

Temporal SQLite library706

Smriti

Raw turns plus supersession-chained bi-temporal facts in one SQLite file, with an optional enterprise layer for knowledge time and receipts.

Best idea: Validity chain re-sorted by event time on every write
Main risk: Scope and quarantine never filter the context the model reads

Read analysis

Sealed engineering intent, kept in Git refs707

Mainline

A Go CLI that has coding agents seal their goal, decisions and rejected alternatives as events in per-actor Git refs, and ranks that history deterministically before each edit.

Best idea: The event log is the store, appended by compare-and-swap on a ref
Main risk: Superseded and reverted are read everywhere and written by no command

Read analysis

Local context hub; the resolver has no caller708

Minta

A local FastAPI memory hub whose search re-reads every Chroma hit from SQL under an owner and status filter, while the resolver that would mark memories stale is never called.

Best idea: Vector index advisory, SQL owner-and-status join authoritative
Main risk: Resolver uncalled, scan scheduled paused, and the agent can confirm its inbox

Read analysis

Coding-agent local709

Agent Memory Engine

A local MCP memory tree for coding agents that withholds memories whose source file drifted.

Best idea: Hash the source file; withhold the memory when it drifts
Main risk: needs_review is served, and no verb ever resolves it

Read analysis

A governed SQLite memory server with a federation trust lane710

AlphaOne ai-memory

A Rust MCP, HTTP and CLI memory server whose read lanes all share one fail-closed lifecycle allow-list, quarantining unattested federated writes until their signatures verify.

Best idea: One visibility allow-list shared and tested on every read lane
Main risk: The approve tool takes its approver as a parameter and allows self-approval

Read analysis

Append-only decision memory keyed on code entities711

Selvedge

A local MCP server and CLI that logs why each code entity changed and which approaches were rejected, in a hash-chained SQLite log a PreToolUse gate enforces.

Best idea: Rejections are records; supersede re-opens them by link
Main risk: Any later write on a rejected path silently makes it active again

Read analysis

Ontology engine712

GMEOW

An ontology engine whose MCP server appends agent claims to one GTS file and retires them by suppression.

Best idea: Suppression with an explicit audit view
Main risk: No writer lock on a single-writer claim file

Read analysis

One SQLite file, hybrid recall, an as-of fact graph713

local-memory-mcp

A single-file SQLite MCP server storing learnings, decisions and an entity graph whose observations retire by closing a validity interval, searched by BM25 and local-embedding cosine fused with RRF.

Best idea: Supersede closes an interval; asOf still returns the retired fact
Main risk: An archived learning restated later is stored again as new

Read analysis

A per-project code graph and reviewed lessons for Claude Code714

archeus

A Claude Code launcher that keeps a model-extracted code graph and session-distilled lessons per project, injected through a CLAUDE.md digest, path-scoped rules and a prompt hook.

Best idea: Advance provenance only for modules actually extracted
Main risk: The extractor auto-approves lessons; unreviewed ones reach the global CLAUDE.md

Read analysis

Self-hosted company brain with a learnings store715

Marvis

A self-hosted MCP company brain whose memory is a workspace-scoped table of incident learnings, with a supersede design behind a default-off flag that nothing reachable completes.

Best idea: Exclude retracted memories on every read, never down-weight them
Main risk: No reachable path ever sets invalid_at; approval yields guidance, not apply

Read analysis

Stash, recall and curated memory for Claude Code716

Attune AI

A Claude Code plugin whose Stop hook stashes locally extracted findings and whose SessionStart hook injects the newest as untrusted evidence, beside a curated tier a person labels.

Best idea: Report a write only after reading it back
Main risk: Session-start block mixes other projects' findings under a this-project header

Read analysis

A shared transcript index with a distilled project memory beside it717

Session Recall

A local MCP server that indexes Claude Code, Codex and Cursor transcripts into SQLite, with a nightly agent distilling bugs and decisions into git.

Best idea: Refuse to mix embedding spaces; report the degradation to the agent
Main risk: Distilled entries are believed on write; deletes keep no reason

Read analysis

Local MCP memory with a duel rule over facts718

MGI-Mind

A local Rust MCP server over Qdrant where memories pass a relevance gate into a recoverable quarantine and contradicting facts are settled by a duel rule that, by default, favours the newest value.

Best idea: Generate the status filter from the visibility rule itself
Main risk: Young facts always flip; a re-added loser silently returns

Read analysis

Hybrid SQLite memory with two surfaces719

Mnemo

A SQLite MCP memory server with FTS5 and sqlite-vec fused by RRF, rows superseded rather than overwritten, and a subject-scoped CLI core beside it.

Best idea: Supersede only a live row, in one guarded statement
Main risk: Deleted memories stay readable through history and export tools

Read analysis

Scoped memory rows beside a bitemporal knowledge graph720

CortexDB

A pure-Go single-file library and Claude Code plugin that stores bucketed memory rows beside a bitemporal knowledge graph, logs every write by trigger, and recalls on every prompt.

Best idea: Superseded memories stay stored and leave every search lane
Main risk: Auto-recall reads only the global bucket; /remember saves to user scope

Read analysis

Scoped in the query, not the key721

Synapse Layer

The open Python SDK of a hosted memory service, whose SQLite store filters every recall by agent and lets a second agent's identical write take the row.

Best idea: Scope predicate inside the SQL on every branch
Main risk: Content-hash key lets another agent take a row over

Read analysis

Hebbian preference graph, zero-model writes722

FERNme

A per-site, per-user Hebbian tag graph recalled by spreading activation into an eight-tag card, written without model calls and gated by consent.

Best idea: Hash the suggestion payload so a rejection occupies its id
Main risk: The local MCP agent can accept its own proposals; timestamps default to zero

Read analysis

Embedded Rust engine723

FluctlightDB

An embedded Rust memory engine whose episodes carry provenance kinds that rank recall but never filter it.

Best idea: Provenance kind and verified flag on every record
Main risk: Agent filter runs after truncation; later lanes read the whole brain

Read analysis

Governed Markdown vault for coding agents724

osk-system

A local Markdown vault where coding-agent hooks capture transcripts and the agent distills cited nodes over MCP, each citation bound to both bodies' hashes, with search open across every scope.

Best idea: Bind each citation to both bodies' hashes
Main risk: Writes are confined to one scope; search reads every scope

Read analysis

Shared memory control plane725

Pluribus

A Go and Postgres service where coding agents share one memory pool, quarantined rows leave recall, and agents vote on curation.

Best idea: Status filtered in SQL and again after lanes merge
Main risk: Activity lane returns the advisory text behind quarantined memories

Read analysis

File-tree MCP memory726

IHMT

A stdlib-only MCP memory that files text in a tree of summaries and dates regex-extracted facts, without letting the dates rank.

Best idea: Ask for a clue instead of picking between tied matches
Main risk: Old and new values tie; a pruned branch reads as empty

Read analysis

A rejected value is held, not re-minted727

Particles

A single-operator claim ledger where extracted and agent-asserted beliefs carry provenance and status, contradictions wait quarantined for review, and a retracted value cannot quietly return.

Best idea: A tombstone that is the retired row itself
Main risk: Project scope the calling agent can switch off

Read analysis

Learned preference memory as the controlled variable728

Harness Evolution as Learning

Paper code that learns a simulated user's preferences from checker complaints with six update recipes and injects the whole memory into each AppWorld episode.

Best idea: Rule provenance kept where the learner cannot see it
Main risk: Deduplication keeps the older bullet when a newer one negates it

Read analysis

An Obsidian vault as shared agent memory729

Archiver RAG

An MCP server over the user's Obsidian vault — agents log Markdown notes, a watcher service embeds each saved note into Chroma and rewrites its ## Related links by a relevance margin, and correction is a person editing or trashing the file — where a restated note stacks beside the first, the agent's move tool reaches the trash unconfirmed, and the score floor sits at a cosine of −0.3.

Best idea: The index is a cache of files the user already reads and fixes
Main risk: A search floor that admits almost every chunk, so nothing is ever a miss

Read analysis

A browser agent whose site notes wait for a person730

Browsentic

A browser side panel that drives the user's own agent CLI, remembers how each site is laid out as per-domain Markdown notes, and stages every generated map where the loader cannot read it until a person activates it.

Best idea: A generated map sits in a directory the loader skips until a person activates it
Main risk: The prompt calls page-derived notes the user's own words, and recordings skip review

Read analysis

Hook-written journals synced through Git731

Cloud Alter Ego

Claude Code and Codex hooks that append every question and answer to a per-client journal, save raw transcripts and push both to a private Git repository, with the person's working rules injected at every session start.

Best idea: Capture every turn in hooks, whether or not the model remembers to
Main risk: One machine-wide scope file sends parallel sessions into each other's client journals

Read analysis

Markdown truth, distilled at every turn732

Tigerless agent-memory

Typed Markdown memories shared by Claude Code, Codex and Muse Code: hooks archive each turn and a host-model run with tools disabled proposes JSON writes the core validates, with as-of recall over validity intervals.

Best idea: The model returns operations; the core validates and performs them
Main risk: The sleep reasoner ends memories unattended, judged by an access log in the deletable index

Read analysis

The ledger was ported; the ratchet was not733

ripwire-rs

A Rust port of ripwire that reads the original's committed ack ledger, written by the C++ binary, through a suppression test with three added clauses and a file-level key. It writes no ack and surfaces no note.

Best idea: Read the predecessor's ledger format unchanged
Main risk: One ack covers a whole file, within twelve points or at any size

Read analysis

Skills promoted on two passing checks734

MuscleMemory

Hooks record every tool call of Claude Code, Codex and Cursor; a session whose tests pass after the last edit becomes a versioned skill, injected as a short pointer only after a person approves it and two other sessions re-run its test and pass.

Best idea: A person's OK and two independent checks, never the source session
Main risk: Outcomes are client-reported, and the CLI that mints admin keys trusts its caller

Read analysis

Self-hosted companion over a searchable conversation archive735

Resonant

A Claude companion keeping every message in SQLite with a local MiniLM embedding, recalled by meaning through a Bash CLI, digested every 30 minutes and carried into the next day.

Best idea: In-process vectors, evicted after every delete commits
Main risk: Edits keep the old vector; the Mind hooks call names the server lacks

Read analysis

A vault the agent compiles, a writer that locks736

obsidian-wiki

Forty skills have a coding agent compile documents, chat history and sessions into an Obsidian vault; a dependency-free package locks and reconciles the log, index, snapshot and profile, and injects a recap at session start.

Best idea: Generated files reconciled under one lock, and authored validity with a successor pointer on search
Main risk: Lifecycle filters nothing, and the MCP mount skips the API key

Read analysis

Every recall cited or abstained737

brain-mcp

A local recorder that copies Claude Code, Codex and Pi transcripts byte-exact before the agent deletes them, and returns every search hit with a line citation that re-hashes from the floor.

Best idea: Citations checkable with sed and shasum
Main risk: Redaction never reaches the search index

Read analysis

A gateway that hands a remote agent one export738

Cortex (gambletan)

A local Rust engine over SQLite with on-device embeddings and regex fact extraction; Meta Muse reads only an explicit export through a capped, audited gateway, and what it asks to remember waits for approval.

Best idea: One reserved export namespace, re-checked per row, for a third-party agent
Main risk: Namespace filters search only; facts, dedup and compression cross it

Read analysis

One row gate behind every recall arm739

Remembra

A self-hostable memory API over SQLite and Qdrant that grounds extracted facts in their source text and supersedes rather than deletes; Relay builds coding-agent handoffs from git and briefs the next agent of any vendor.

Best idea: Every recall candidate re-checked against its SQLite row
Main risk: The default background dedup raises on every memory, logged at debug

Read analysis

Notes keyed and tombstoned by title740

pi-jarvis

A Pi extension giving the main agent and a side session one local SQLite store of curated notes and captured turns, recalled by keyword into each request.

Best idea: A forgotten or renamed title refuses the model's next save
Main risk: The same fact under a new title is admitted; the model overwrites a person's note

Read analysis

Claude Code's memory files, on DeepSeek Harness741

dsh-auto-memory

A DeepSeek Harness plugin that keeps one Markdown file per memory and injects a rebuilt MEMORY.md index on every step, with six model tools and an opt-in session-end consolidation pass.

Best idea: A derived index rebuilt under the write's lock, with day-rounded decay that keeps the prompt prefix stable
Main risk: Consolidation overwrites whatever its name matcher picks, in either layer, and keeps no prior version

Read analysis

A vault the agent edits, a capture queue that scans first742

aigent-OS

A Claude Code harness whose memory is an Obsidian vault the agent edits and git pushes, searched by a local MiniLM script, with regex-captured user phrases held as unscanned until an injection scan clears them.

Best idea: Capture rows born unscanned, and a write-time budget that always lets a shrinking edit through
Main risk: Deleted notes and blocked candidates both stay searchable

Read analysis

Shared agent memory believed by corroboration743

HiveMind (projectmentor)

Agents on several machines write facts into a signed, hash-chained journal merged over Tailscale; confidence is recomputed from the independent identities behind each exact text, and the owner's forget follows the text.

Best idea: Belief that repetition cannot raise, weighted by device and principal
Main risk: Hermes writes the model's reasoning as observation; forgotten text is kept on every device

Read analysis

Markdown engrams with a reviewed-draft overlay744

Crystalline

A Rust daemon serving OKF markdown engrams to coding agents over MCP, with hybrid search, private domains and a review mode where every write waits as its author's draft until a GitHub merge.

Best idea: Agent writes become per-author drafts that only a forge merge publishes
Main risk: Superseded engrams keep answering search at 0.6 weight

Read analysis

One Qdrant store, a domain gate per machine745

Hermes Fleet Memory

An MCP server giving several Hermes machines one Qdrant collection, with each node's domain read from its environment, slot cards overwritten by UUID5 id and episodic cards expiring after 90 days.

Best idea: A domain the agent can narrow by argument but never widen
Main risk: One Qdrant key on every machine reads every domain

Read analysis

Every change invertible, and undo erases it746

Binder

A local-first typed record graph in SQLite, rendered to Markdown an editor syncs back, that agents read and write through three MCP tools; every change is a hash-chained transaction holding its prior values.

Best idea: Prior values in every changeset, chain checked inside the write lock
Main risk: Undo deletes transactions from the log; agent and editor writes look the same

Read analysis

A named graph per user, a claim per belief747

Ontofelia

A self-hosted agent gateway whose parser LLM writes the facts in every user message as RDF triples into a per-user graph or a shared worldview, each with a provenance claim, and supersedes a functional value while keeping the old claim.

Best idea: The graph IRI as scope key, with model-written SPARQL parsed against an allowlist
Main risk: The README's forget result runs an eval-only delete; the shipped one leaves nothing keyed on the value

Read analysis

Decision records committed beside the code748

Flatbread Proof

Typed Markdown records of a coding agent's efforts, findings, decisions and risks, kept in the repository and written through one validated, journaled CLI command.

Best idea: Every lifecycle transition is a typed mutation with its preconditions checked in one planner
Main risk: Reads return rejected, superseded and invalidated Decisions beside accepted ones, and the agent accepts its own

Read analysis

A curator whose every rewrite is journalled749

Elephantasm

A FastAPI and Postgres service that synthesises agent events into scored memories and typed knowledge, assembles a four-layer prompt pack, and curates memories twice a day with an LLM.

Best idea: Every Dreamer merge, split and delete stores both snapshots and the model's reasoning
Main risk: Any non-synthesis memory moves the cursor and strands pending events; the published tree does not import

Read analysis

Evidence re-checked on every read, delivered either way750

ken

A local code index and MCP server for coding agents that keeps agent-written findings with hashed file dependencies, injects them through hooks, and runs a separate logged premise store for rule inference.

Best idea: Declared file and tree dependencies are re-hashed on each read, failing closed to unknown
Main risk: A stale finding is injected with a label and nothing withheld; anchors fire only when the agent asks

Read analysis

Every grant in the chain, checked per record751

Hyperconsciousness

An encrypted, signed, per-device append-only log that agents read and write over MCP and HTTP through expiring grants on kind, tags, sensitivity and write time.

Best idea: Every link of a delegation chain checked against every record on the node holding the key
Main risk: The agent skill's discovery command reads the store with no grant or retraction filter; plain notes cannot be corrected

Read analysis

Ambient capture with an explicit fact table752

Screenpipe

A local desktop recorder whose screen text, transcripts and an agent-writable SQLite fact table are served to agents over REST and MCP.

Best idea: Profile memory threat-scanned on write and again on render, frozen per session and fenced as data
Main risk: Memories are unscoped, outlive the captures they came from, and their deletions never reach the enterprise archive

Read analysis

The library writes, the app draws the boundary753

Hy-Memory

Tencent Hunyuan's Python memory SDK, where one configured model extracts and reconciles every write into a layered store, with MemHub, a desktop app that scopes recall through broker-built grant envelopes.

Best idea: A scope envelope built from the grant, so a model's scope argument is a request and never a grant
Main risk: The SDK applies the writer model's target ids unchecked, and deleting a correction restores the old value

Read analysis

Facts on the user's word, kept for good754

Apache Maka

An Apache Incubator agent workspace whose Runtime Host extracts facts only from quoted user messages and recalls them by workspace beside full transcripts, with a user-written MEMORY.md and an agent-maintained index.

Best idea: Admission that accepts a fact only when every citation is a substring of a user message
Main risk: No production path corrects or deletes a fact, and Recall's transcripts cross workspaces

Read analysis

Adopted harnesses carried to the next task755

Harness²

Google Research paper code that refines an agent harness per task and stores each adopted harness tree, with a reflector's lesson, in a per-domain library later tasks' editors read.

Best idea: Entries hold the executable harness, and grader output is refused at write and at read
Main risk: A lesson is admitted on non-empty fields and nothing later can correct it

Read analysis

The host names the store756

Cindy

A desktop agent host that swaps Claude Code, Codex and Pi native memory for host-scoped Markdown shards with a rebuilt MEMORY.md index, FTS5 search and a quote-gated nightly tidy for teammates.

Best idea: A scope key the host derives from the session, never from a tool argument
Main risk: Deletion is an unlink with no record, and raw-history search crosses projects

Read analysis

Capped tiers per space, the space chosen by the model757

Mind

A local Bun MCP server that keeps coding-agent memories in one SQLite file, in named spaces with capped hot and warm tiers, multi-channel lexical search and checkpoints that complete into session summaries.

Best idea: Fixed tier caps with least-recently-used demotion, so nothing is evicted to deletion
Main risk: A wildcard space on the agent's own surface, and supersession as a tag no read honours

Read analysis

One hard question:what should an agent remember?

Retrieval is only half the memory problem.

Evidence before belief

Scope before ranking

Correction before scale

Steal the architecture,not the product.

Rejected-value tombstone

Evidence before belief

Hybrid retrieval fusion

Scope as a first-class key

Start where your problem is.

Profile, stages, acceptance tests

Which ones actually do X

The full comparison

Choose a system to inspect.

Mem0

LangMem

Honcho

Engram

MemPalace

Swafra

llm-wiki-memory

RainBox

Letta

Supermemory

Verel

Hindsight

Graphiti

Mastra Observational Memory

MemOS

Basic Memory

agentmemory

TencentDB Agent Memory

Cognee

Claude-Mem

A-MEM

Holographic

Hermes Agent

OpenViking

Redis Agent Memory Server

ByteRover

OpenClaw

HippoRAG

Voyager

Generative Agents

Magic Context

Pi

MetaClaw

nanobot

CowAgent

GenericAgent

open-cowork

Gini Agent

Moltis

Mercury Agent

LlamaIndex

Atomic Agent

MateClaw

Waku Agent

Memora

LoongFlow

Core Memory

Memanto

Memory Engine

ai-memory

ctx

OptMem

Memvid

MemoryOS

memU

OpenWorker

Qwen Code

OpenCode

NOOA Memory

Neo4j Agent Memory

Elastic Atlas

NemoClaw

Daimon

MIRIX

Memobase

One hard question:
what should an agent remember?

Steal the architecture,
not the product.