Looking for a specific mechanism rather than a specific system? The capability index filters all 757 systems by the seven mechanisms judged against strict definitions, combining them with and — it answers "tombstone and scope enforced" in one click, which is the question this table cannot be sorted to answer. It is linked here as well as from the homepage, because this table is where that question gets asked.
One column needs a caveat before the table is read. Update/delete model describes what a system's own code does, and stops at the storage engine's boundary. On four of the five vector engines this corpus most depends on, the embedding survives a delete until a background pass triggered by a threshold rather than a clock — so a row reading "exact delete" is accurate about what the next query returns and silent about what is still on disk. The evidence is under the layer below delete.
| Repo | Memory unit | Storage backend | Retrieval strategy | Write strategy | Update/delete model | Scoping model | Agent integration | Background processing | Trust/provenance model | Notable strengths | Main risks |
|---|---|---|---|---|---|---|---|---|---|---|---|
7layermem |
A SQLite row for conversation turns and tool logs; an embedded
Chroma Document with a content-hash id for knowledge,
workflow, toolbox, entity and summary; a MERGEd Neo4j node
when the graph is configured |
Two SQLite tables — CONVERSATIONAL_MEMORY and
TOOL_LOG_MEMORY, in two separate database files — plus five
Chroma collections embedded with all-MiniLM-L6-v2, plus an
optional Neo4j entity graph, plus a second, unrelated Chroma collection
for the RAG corpus |
similarity_search(query, k) against each Chroma
collection and WHERE thread_id = ? against the two tables;
AgentMemory.recall fans out to five of the seven and ranks
them by a constant chosen per store, discarding whatever the search
ranked |
Synchronous. A regex on the text picks entity, workflow or knowledge
unless role or type is passed; Chroma writes
upsert on a SHA-256 content hash |
Delete by id on both tables, a whole thread on the conversational
one, delete_from_store(name, ids) on any of the five
collections, DETACH DELETE on graph entities, plus
delete_collection and reset_database. The one
UPDATE sets summary_id, and nothing outside a
test calls it |
thread_id filters both SQL read paths and is stamped
into entity Chroma metadata, where no read path consults it; no user,
project or tenant key anywhere |
AgentMemory.remember/recall, plus
LangChain BaseMemory, BaseStore[str, str] and
BaseChatMessageHistory adapters, plus a standalone agent
entry point |
None — no scheduler, no consolidation pass, no expiry | None. No status, confidence or provenance field on any store; the
one status column records whether a tool call
succeeded |
Seven memory types separated by store rather than by a type column, each annotated with the cognitive category it stands for, behind a two-method API that routes and fans out for the caller | Recall scores are constants per store, so cross-store ranking is a
fixed preference order; enabling Neo4j collapses every entity written
through the simple API onto one node named entity_0 |
a-mem |
MemoryNote with content, tags, context, links, and
evolution history |
An in-process dictionary plus an ephemeral Chroma client the
constructor resets; a separate PersistentChromaRetriever on
its own PersistentClient exists and the memory system never
uses it |
Vector similarity, with a linked-neighbour append that the final
[:k] truncation discards whenever the vector search already
returned k |
LLM decides links and neighbor metadata mutation before insert | Delete/re-add update; exact delete without incoming-link cleanup | None in core | Direct Python library | Periodic reindex called consolidation | No source provenance or trust state | Small, legible linked-note evolution concept | The evolution path indexes insertion order with a vector rank, so
the notes rewritten are the first ones ever added rather than the
neighbours the model was shown; the constructor calls
client.reset() on a shared in-process Chroma client; the
test named for evolution asserts only that fields are non-None, which
they are at construction; no durability |
a-memory |
An L4 core fact — key, value, importance, memory kind, visibility, source, metadata, optional expiry — over L3 episodes, an L2 session store, a persisted L1 reflex buffer and an L0 capture journal | Plain SQLite in one data directory: core_memory, a core_memory_history ledger, a core_memory_temporal interval table, episodes, an epistemic graph, wiki pages, staged proposals and an archive table | Tokenized LIKE search over L4 with visibility and superseded-pair filtering, L3 episode search, and a multi-source retriever over RAG, wiki, episodes, facts, graph and entities; session-start and context tools assemble facts by importance | remember(key, value, importance, source, ttl_minutes, visibility, memory_kind) through the MCP tool, plus a distiller and an hourly consolidation sweep that write without a visibility argument; created_at can carry the source message time | A save updates in place by key and appends a ledger row; delete appends a row with a null after-image. Forget moves rows to a shadow archive with dry run and undo; the forgetting loop archives and deletes outside the ledger | Layer (user or agent) and user id bound into a handle and applied on every CoreMemory and EpisodicMemory read; the MCP tools take both as arguments. The recall cache key omits the layer | An MCP server with a primitive and a flat tool surface, lifecycle hooks and an autohooks daemon, an HTTP surface described by openapi.yaml, and a PyPI package | A 15-minute loop for decay, archiving and edge pruning under a per-base maintenance lock, hourly compaction and consolidation per layer, and a nightly graph enrichment pass | A visibility flag preserved across automatic re-saves, a source provenance contract, a before-and-after ledger on the two CoreMemory mutators, a staged proposal queue the agent decides, and an interval chain no production path reads | The re-save rule is the precise one: an absent visibility argument keeps the stored flag rather than resetting it to the default, so the distiller and consolidation, which never pass one, cannot resurrect a hidden key, and the comment records the bug and date behind it ("F1 sanitation, 2026-09-12"). Search excludes private and hidden in SQL under a named invariant, and committed tests assert both exclusions against a store holding a matching visible or pinned fact. The ledger stores full before and after JSON with an attribution and is never rewritten. Scope is carried by the handle, and the project's own fix for a multi-source retriever that answered the agent layer with user rows added tests asserting both directions | The visibility predicate lives in three queries and not in get_all, and CoreEntry has no visibility field, so the one Python-side check (features/inject.py:222) always passes. Six context builders render key=value from get_all: two inject blocks, the recall protocol, smart context, memory_context and memory_context_inject, which also writes CONTEXT.md, so a private or hidden fact above the importance threshold reaches a prompt. The agent can clear the flag by passing visibility='visible', and a rollback of a deleted hidden key reinserts it visible. The ledger and the interval chain sit under bare exception handlers and drop silently, the ledger misses every write outside CoreMemory.save and delete, and the interval chain is on the write clock with no production reader. The recall cache key omits the layer, so a recall on one layer serves the other's results for 300 seconds |
acontext |
An agent skill — a directory of Markdown files with a SKILL.md the user defines the schema for | Postgres for skills, tasks, sessions and messages; a disk abstraction for the files themselves | None automatic — the agent calls list_skills, get_skill and get_skill_file and decides | A task reaching success or failed triggers distillation, then a skill agent routes and writes | The skill agent rewrites files; the dashboard can delete a whole skill; no rejected-value record | project_id on the skill read path, with disk, user and project foreign keys cascading | Python, TypeScript and CLI clients, plus Claude Code and OpenClaw packages and a sandbox | A message queue driving distillation and the skill agent, with session status through the pipeline | Task outcome is the only signal, and it gates the write rather than labelling the memory | The outcome gate the skills pattern asks for, tested; no embeddings, so memory is greppable and portable | Retrieval depends entirely on the agent choosing to look; a wrong skill file has no tombstone |
adk-python |
MemoryEntry — a types.Content plus
optional id, author, timestamp and custom metadata; the unit written is
usually a whole session's events |
Interface only. Ships an in-process dict, a Vertex AI Memory Bank client and a Vertex AI RAG client; sessions additionally have SQLite and database backends | search_memory(app_name, user_id, query) — Unicode-aware
keyword matching ranked by matched words and capped at ten in the
default implementation, hosted similarity search in Memory Bank, and RAG
retrieval ranked inside the caller's own files |
add_session_to_memory,
add_events_to_memory, add_memory; Memory Bank
generates memories from events server-side |
None. The contract has no delete, no update and no expiry, and no implementation adds one | app_name and user_id are required keyword
arguments on every write and on search, and travel to Memory Bank as a
scope dict |
LoadMemoryTool for the agent, Runner
wiring, and a plugin surface; the memory service is chosen by the app
author |
Memory Bank does generation and ingestion server-side; the local implementations do none | Author and timestamp on an entry; no provenance chain, trust state or confidence anywhere | Scope keys mandatory in the signature and carried into every implementation's read; session and memory cleanly separated; 80 memory tests, including isolation cases | Deletion exists on the session service and not on the memory service, so the durable half of a user's data has no removal path |
aeris |
A fixed-size struct — type, category, importance, certainty, emotional weight, involved entity, location, a forgotten flag — carrying no text at all, beside a belief struct with a status enum and pointers to the memories supporting and contradicting it | In-process stores keyed by entity id, serialized whole into JSON world snapshots at a tick interval by a generic resource loop no test exercises for them; no database, despite an ADR selecting SQLite | Swappable IMemoryRetrievalStrategy implementations,
scored by importance decayed against simulation time, over a candidate
list the retrieval system flattens out of every entity's memories into
one world-level working memory of seven chunks |
Nothing in the engine writes a memory or a belief.
AddMemory and AddBelief have no caller outside
the test suite; the per-tick phases decay, consolidate, retrieve and
project a store only a test can fill |
Forgotten flips when decayed importance falls below a
threshold and nothing is destroyed; the belief statuses
Weakening, Revised, Abandoned and
Contradicted are declared in the enum and assigned nowhere
in the repository |
Each store is one list per entity id, so the owner is the container rather than a field on the record — a partition, not a filter. Three reads pass an id; the retrieval system reads every entity's memories at once | None shipped. The engine builds a validated
SemanticState for a language model and the repository
contains no client that sends it |
Ordered per-tick systems — perception, attention, working memory, consolidation, long-term decay, reasoning, planning, decision, audit, enforcement — under a deterministic scheduler | BeliefStatus as a five-value enum beside
BeliefSource provenance, read as a filter by the extractor
and written by nothing — Active is the only value assigned
anywhere, and only in four test lines |
A validator that refuses to hand a model engine internals, asserted on the serialized payload by committed tests; determinism enforced in its own CI job; a test suite half again the size of the engine it covers | The durable tier has no producer, so every mechanism over it is specified rather than exercised; memory rows carry no content, so nothing can be corrected about what was remembered; the reasoning trace is cleared every tick |
agent-afk |
A fact — content, one of four CHECK-constrained categories, a source
surface, a confidence float, an access count, a supersedes pointer and a
nullable evidence citation |
SQLite with an FTS5 external-content index and porter tokenizer,
plus a HOT.md working file under a token cap |
facts_fts MATCH ranked by FTS rank, with optional
category and since filters, and superseded_by IS NULL
always appended |
Three agent tools — memory_search,
memory_update, procedure_write — writing
either hot memory or the durable fact archive |
supersedeFact sets superseded_by under a
WHERE superseded_by IS NULL guard, so a double supersede is
a no-op |
None on the read path by design — the fact archive is deliberately cross-session | A CLI agent with a hot working file and a durable archive behind three tools | None; truncation of the hot file happens on write | A confidence float, and a derived
[unverified] marker applied at render time when a codebase
fact has no citation |
An evidence gate that reaches the prompt text rather than being dropped before it, with a stale-citation warning on supersession and twelve committed cases | The verdict tags rather than withholds — an uncited codebase fact is
recalled with an [unverified] prefix and ranks like any
other, so a reader who skims past the tag gets the claim anyway |
agent-context-os |
A Markdown file in a named place — state/current.md,
state/decisions.md, state/blockers.md,
state/weekly-priorities.md, a dated file under
sessions/, a project folder, a skill — each carrying a
**Last Updated:** line the kernel parses |
The Git repository itself, with a gitignored
.context-os/ beside it holding proposals, receipts,
journals and locks; a separate local Git repository holds the host's
auto-memory directory for the curator |
A routing table the agent reads, a /start skill that
resumes today's session file or falls back to the most recent one, and a
read-only briefing over fixed lifecycle sources plus explicitly selected
Markdown files, each with freshness, a normalised-text hash and an
optional expected-revision check |
Slash commands and a CLI: a JSON payload is rendered into a proposal with per-file before and after hashes and a diff, then applied only with the exact proposal digest echoed back, as one transaction that publishes a receipt | State files are rewritten in place with the
Last Updated line advanced and the previous date pushed
onto a newest-first log; update, end and promotion append decision rows,
while setup replaces any populated state file listed for replacement.
The curator retires an auto-memory file to archive/ with a
row in ARCHIVE.md |
Directories — projects/, workspace/,
references/, writing/ — with path guards on
local-state access, a split-root mode that keeps a working repository
read-only, and claim leases so two agents do not take the same task; no
read is filtered by a scope key |
First-class Claude Code, Codex, OpenClaw, OpenCode, Cursor CLI, Devin CLI, Devin cloud and Hermes Agent, with Cursor IDE experimental; hooks in shell, PowerShell and Python, installable bundles with a lockfile, and a component manifest | None that runs on its own — the passes are checks a person or CI invokes: link and doc reachability, SSOT controls in disposable copies, bundle locks, component manifests, the continuity benchmark, and an on-demand curator that writes proposals for the host's auto-memory directory | A five-value freshness status — missing, unknown, future, stale,
fresh — derived from each state file's Last Updated line
and reported as a diagnostic; readiness admits fresh and stale
current.md. A briefing can be told the expected hash of a
source, and start exits non-zero when one is mismatched or
unavailable |
A benchmark whose baseline is information-equivalent, whose harder profile carries superseded material, and whose scorer requires the cited quote to occur in the cited file; committed model trials whose tables a test recomputes from the raw responses; and a receipt per applied change, published as the commit point and never overwritten | Freshness reads a self-reported Last Updated line; the
decisions table is append-only only in three of the kernel's four
content writers, and the pre-write hook's warning about a direct edit is
advisory; approval is an echoed digest the kernel says it does not
authenticate; and receipts are local, gitignored and editable |
agent-framework |
A MemoryTopicRecord — topic, slug, summary, a list of
memory bullets, updated_at, and the
session_ids that contributed to it — serialised as one
Markdown file per topic |
A MemoryStore ABC with a file-backed implementation:
per-owner, per-source directory trees holding topic files, an index,
state, and a transcript archive. Separate packages back Azure Cosmos DB
and the hosted Foundry service |
An index of one-line topic pointers injected per turn, with keyword extraction from the current messages selecting which topic files to expand | Model tools plus a consolidation pass tracked by
last_consolidated_at and
sessions_since_consolidation |
write_topic and delete_topic on the store;
consolidation rewrites a topic file into a tighter form. No record of a
deleted or rejected value |
Harness memory: the owner id is read from session state and
required — a missing one raises, .. and
absolute paths raise, and the resolved root is asserted to be inside the
base path — and selects a directory; no record names its owner. The
Redis provider stores application, agent and user ids on each document
and filters its search on them |
A ContextProvider contract of
before_run/after_run plus a
source_id, consumed by the Agent runtime; .NET and Python;
DevUI; a hosted Foundry provider |
Consolidation of a topic file via an LLM prompt, scheduled by sessions-since-last-run | None. A topic memory is a bullet list; there is no status, confidence or verification anywhere on it | Fail-closed owner directory resolution with a post-resolve
containment assertion; session_ids provenance on every
topic; 1,673 lines of tests on the harness memory alone |
The provider contract still declares neither deletion nor scope, so a third-party provider inherits AutoGen's gap; nothing records that a value was removed |
agent-memory-distillation |
Three record types per teacher trajectory: a workflow insight of two to four sentences keyed on the task's first message, subtask segments with a label, description and masked example calls, and per-call function records keyed on the tool name | A directory per build: workflow documents.json, subtask segments.jsonl and function records.jsonl, each beside a NumPy embedding matrix whose rows must line up with the records | Workflow top-1 by cosine over OpenAI text-embedding-3-small of the task's first message; subtask best match per turn instruction above 0.45; function records by exact tool name, ranked by similarity, only after a tool call returns an error | Offline batch only: a teacher model runs the benchmark, a builder LLM writes workflow and subtask records per trajectory, function records are copied from the successful calls. The student never writes | None in code. BFCL keeps the first workflow record per task id and appends function records without deduplication; the only delete is rmtree of the whole ToolSandbox memory directory behind a --clear flag | One directory per build date, passed as a path. BFCL stores a benchmark category on each record and filters on it, then retries unfiltered when the filter returns nothing | Overlay files for three benchmark harnesses: a modified BFCL base_handler.py, a ToolSandbox agent role, and six AppWorld configs naming an agent type that no file in the tree registers | None | None. Every retrieved record is injected as reference material; source is the constant teacher | Retrieval split by when the knowledge is needed, with function memory fetched only on a tool error; BFCL's stores refuse an embedding matrix whose row count differs from the records; placeholder masking of call arguments before storage | The committed main configuration builds memory from the same tasks the student is scored on, with no self-exclusion, so a task's top workflow match is its own record; BFCL includes failed teacher runs unless a score file is passed; one embedding fallback in the ToolSandbox builder overwrites the whole matrix; the AppWorld method and all baselines outside AppWorld are absent |
agent-memory-doctrine |
A fact in a temporal graph with validity and record time, plus a tier-3 projection that must declare what it was built from | A substrate port with an in-memory temporal graph reference; evidence artifacts as JSON on disk; Graphiti mapped through a driver | Lexical overlap in the reference substrate, filtered by isolation domain, project and task in the governing adapter | Every mutation is a proposal evaluated by PAMA into one of five authority outcomes before the substrate is touched | Correction is supersession; deletion plans a transitive purge and classifies everything derived into four residue buckets; a rejected-value registry now fingerprints a rejected value and fail-closed blocks its silent re-admission | Domain, project and task refs checked on the read path, returning named refusals the substrate itself cannot produce | None shipped as a product — a port, an adapter, conformance runners and a Mem0 comparator | None; the independent residue sweep runs on demand rather than on a schedule | Source trust and PAMA authority as separate axes; estimator confidence is barred from reaching an outcome | Undeclared residue is a hard gate, and the sweep re-derives it instead of trusting the purge's own traversal | A doctrine of thirty-five ADRs and tens of thousands of lines of prose over a reference implementation whose substrate is in-memory |
agent-memory-dotnet |
An entity, a subject-predicate-object fact, or a preference, each a Neo4j node with an embedding, a confidence, an owner, created and updated stamps, an optional validity window and an optional invalidation stamp; facts also carry canonical keys and a mention count | Neo4j, with vector indexes per node family and a composite merge-key index on facts | Vector similarity per family with an owner clause spliced in, graph expansion and GraphRAG context assembly, plus a point-in-time path carrying a transaction clock and a valid-time clock | Extraction from conversation into entities, facts and preferences, merged on canonical keys so a re-extracted triple collapses onto the existing node and increments its mention count | Soft invalidation rather than deletion — set by consolidation, by preference supersession, by an explicit invalidate, and by decay in its destructive mode; invalidated rows remain readable through history and as-of recall | An owner id on every node plus a shared bucket for rows with none, applied as a query clause; a strict multi-tenant mode turns a missing owner scope into a named exception | An MCP server with tools, resources and prompts, plus Semantic Kernel and Agent Framework adapters, a CLI, connectors and a NuGet meta-package | Consolidation that collapses duplicates onto a winner, a decay service with a non-destructive default, and enrichment and analytics passes over the graph | A confidence number per node that a re-assertion increases rather than replaces, and a two-value lifecycle status of live or invalidated; no vocabulary distinguishes why something was invalidated | Two clocks bound as separate parameters in one query; canonical merge keys computed in C# because the database's own lowercase function disagrees with the canonicaliser on a specific code point; and a salience counter that deliberately counts assertions rather than retrievals | Re-asserting an invalidated fact clears the invalidation by design, so a retraction does not survive the same claim arriving again; the audit trail records reads rather than writes; and live recall ignores valid time unless a flag is set, which the repository documents as a defect |
agent-memory-engine |
A MemoryNode in a per-project tree: title, summary, kind (constraint, architecture, module, decision, debug, procedure, outcome), depth and parent, importance, confidence, status, trust level, verification-evidence level, and optional source path, hash and symbol | SQLite through SQLAlchemy: .memory-engine/memory.db under the project root for the MCP server, ./memory_engine.db for the CLI and FastAPI app. A repository knowledge index with FTS5 sits in the same file, and an optional sqlite-vec vector.db beside it | Every node in the project is loaded, scored in Python by nine weighted signals with Jaccard word overlap counted twice, gated by kind and constraint scope, filtered by status, and packed into typed token buckets. Knowledge chunks come from FTS5 and an optional sqlite-vec arm fused by RRF | reflect_and_write turns the agent's outcome text into typed candidates after five gates, then promotes each in the same call: create, update, merge, supersede, discard or needs_review by Jaccard similarity and a keyword contradiction check. seed_project_context writes active nodes directly at confidence 1.0 | Supersede marks the old node and links it; update and merge rewrite the summary in place. Staleness is a CLI or HTTP verb, source drift flips status during retrieval, and retention archives and compacts. No delete path is reachable; no tombstone | project_id on every row with a predicate on every retrieval query; the MCP server also opens one database per project root. Constraint scope (global, repository, branch, module, path, symbol, task_intent) gates whether a constraint bypasses topical relevance. Branch columns on memory nodes are never written | A stdio MCP server with seven tools and twelve resources; bootstrap writes a policy block into the project's CLAUDE.md telling the agent when to retrieve and reflect. A Typer CLI and a FastAPI app open a different default database | None. Validity checks run inside retrieval, bounded to 50 nodes per call; retention, archival and compaction run only from the CLI, dry-run by default | A status column filtered at retrieval, plus a seven-level provenance trust ladder and a five-level verification ladder that gate global constraints and label authority. Human elevation of either ladder is implemented and has no caller | Source-backed memories are withheld when their file, symbol or commit drifts; an unverified agent claim cannot reach human_confirmed through any tool; every retrieval returns a per-signal trace including excluded nodes and their reasons; constraints carry an explicit scope instead of surfacing on every task | A node flagged needs_review keeps being served; the branch passed to reflect_and_write is dropped before the node is written; compaction writes a compacted status the domain model rejects; the CLI's lifecycle verbs open ./memory_engine.db, not the MCP server's store; seed_project_context lets the agent write active constraints directly |
agent-memory-guard |
None of its own — it wraps a caller's key/value memory writes and reads, carrying a source class, an optional memory class and a policy decision alongside each | An in-process store and a Redis store for the guard's own state and snapshots; the protected memory belongs to the host | Not a retrieval system. Reads pass through the guard for leakage and cross-task checks | guard.wrap / check / protect
around a write, taking a source_class of
external_tool, user_input,
agent_authored, system or
unknown, and an optional memory class |
Protected keys refuse reclassification; a classification change on an existing key emits a HIGH severity block | Cross-task contamination detection between task contexts; no tenancy model of its own | A Python package, a LangChain adapter, an MCP server, a GitHub Action, semgrep rules and a standalone regex scanner emitting SARIF | None; detection is synchronous on the wrapped call | Eleven detectors with severities and block or flag actions, a source-class taxonomy, memory classification with protected keys, integrity checks, snapshots, and SIEM-shaped security events | The self-reinforcement detector is the best statement in this corpus
of a failure this atlas keeps finding: "an agent reads its own prior
agent_authored memory, mildly elaborates on it, writes it back, then
reads the elaborated version on the next turn and elaborates again. Over
a few iterations a hallucination or attacker-suggestion is reinforced
into a durable 'fact' the agent now relies on." Its two rules are the
right ones — a cool-down on consecutive agent-authored writes to a key,
and a self-similarity rule under which a write resembling a recent
agent-authored value on the same key "is treated as reinforcement of the
previous write, not independent corroboration" — with the key insight in
the decay clause: only a separate external_tool or
user_input write weakens the loop, because corroboration
has to come from a different source class. The taxonomy around it is
explicit: external_tool and user_input are
"external inputs (untrusted by default)", agent_authored is
"the self-poisoning surface", system is infrastructure.
Eleven detectors cover injection, leakage, privilege escalation, tool
abuse, excessive autonomy, ML injection, memory persistence injection,
protected keys, cross-task contamination and anomaly |
The source class is declared by the integrating code, not derived,
and the default is UNKNOWN.
self_reinforcement.py states that it "[o]nly fires on
writes whose source_class is AGENT_AUTHORED" and returns early
otherwise, so a drop-in integration that never passes
source_class — or maps it from the legacy
source_type, where only MODEL_INFERENCE
becomes agent_authored — gets none of the self-poisoning
protection and no warning that it is off. The library cannot know the
provenance itself, so this is a necessary design rather than a defect;
it does mean the defence is a property of the integration's labelling
discipline. Separately, the standalone scanner/rules.py is
sixty-three lines of regex: its unprotected-write rule matches a
variable literally named memory or state
assigned on one line and requires guard.wrap|check|protect
on that same line, so a guard call one line above reads as a violation
and any other variable name reads as safe. The README leads with PyPI
download and repository clone counts under the OWASP name |
agent-memory-mcp |
A memory row — content, type (episodic, semantic, procedural, working), title, tags, context, importance, embedding, access counts and a sediment layer — with metadata carrying an engineering type (decision, runbook, incident, postmortem, dead end and others), lifecycle status, knowledge layer, service, owner, verification time, validity window and supersession links; plus subject-predicate-object triples and indexed document chunks | SQLite for memories, triples, steward inbox, audit, policy and run reports, and a separate SQLite vector store for document chunks; recall ranks over a cached snapshot of the memory rows | Hybrid scoring of embedding similarity with keyword matches, recency, source type and trust metadata, optional age decay per type, superseded entries excluded, surface-layer entries confined to their context when enabled; RAG over project docs with source classification; recall as of a timestamp; a knowledge timeline; a canonical layer recalled separately | Store tools per engineering type, Claude Code hooks that checkpoint before compaction and capture at session end, a session-close pipeline that classifies a summary and plans add, merge, outdate or promote actions with a risk level, and a steward that detects duplicates, conflicts, stale entries and drift | mark_outdated caps importance, archives, closes
valid_until and links a successor; merges and canonical
promotion keep history; delete removes rows; an archive sweep moves old
outdated entries |
An optional context filter, tags, service and engineering-type filters; surface-layer memories are confined to their originating context only when the sediment flag is on | About 50 MCP tools over stdio or HTTP/JSON-RPC, a CLI mirroring
them, Claude Code hooks, config snippets for Claude Desktop, Cursor and
Codex, a retrieval console at /console, Docker and Homebrew
service packaging |
A file watcher for document indexing, a scheduled steward run, a sediment cycle and an archive sweep | Lifecycle statuses (draft, active, outdated, superseded, canonical) that adjust a derived confidence, verification times, drift scans against the repository, a review inbox, and a steward audit table for applied maintenance actions | Session close as an explainable plan with a dry run; a steward whose risky actions queue for review; source-classified document retrieval; a changelog that records measured regressions, such as age decay cutting Hit@5 from 0.72 to 0.19 | recall_as_of and the knowledge timeline run on top of
recall, which hides superseded entries, so neither can return what was
valid before a supersession; validity windows are written only as the
moment of supersession; no mutation log beyond steward actions; context
scope is optional |
agent-memory-supabase |
One memories row — content, a nine-value
memory_type, project, tags, importance 1–10, extracted
entities as JSONB, a validity window, an expiry and a supersedes
pointer |
A single Postgres table on Supabase with pgvector HNSW, a generated
tsvector, pg_trgm and six further indexes |
Three lanes — vector, full-text and entity-grounded — fused by RRF with k=60, then blended by recency, importance and usage, with the blend switchable off for evals | Client-side embedding and entity extraction, then two dedup probes: cosine at 0.95 within the same type, and pg_trgm at 0.65 for same-template snapshots | superseded_by pointing at the replacement,
valid_until closing the window, active for
soft delete and expires_at as a hard TTL |
A nullable project column applied as a filter in every
function — and defaulting to NULL, which means all projects |
A 257-line JavaScript MemoryStore class over the
Supabase client; no framework binding, no MCP, no agent tools |
None. Everything happens in the query | An importance smallint that feeds ranking, and
correction as one of nine memory types. No status
field |
Real validity-versus-record time; an updated_at trigger
that will not fire on access-stat touches; a similarity floor on the
text lane with the RRF failure it prevents written into the comment |
The per-user RLS policies are commented out, so the only enforced posture is server-sees-everything; 898 lines and no tests at all |
agent-memory-techniques |
Different in each notebook by design — a turn, an extracted fact, an entity summary, a graph edge, an episode, a decaying strength-weighted record, a tiered MemoryRecord | In-process structures in most notebooks; SQLite for cross-session state, Chroma and FAISS for vectors, JSON files for the rest | Cosine similarity throughout, with a hybrid/recency/diversity/rerank comparison in one notebook and BFS over an adjacency list in two | Synchronous and explicit in every notebook; extraction and summarization are direct LLM calls with no queue | Exponential decay with a half-life, reinforcement on retrieval, archival below a prune threshold, and a four-tier fan-out delete for right-to-forget | user_id required on the production tier's read path and carried in a per-user index; absent from most teaching notebooks | None. Thirty Jupyter notebooks and a shared helpers module — this is a corpus to read and copy, not a library to install | A maintenance pass that demotes cold records between tiers; everything else is called explicitly | None represented as state. One notebook scores faithfulness and scans for contradictions after the fact | A correct half-life decay with archival rather than deletion, a deletion that fans out across every tier and writes a receipt, and an eval harness that measures contradictions and supersession | The contradiction rate's denominator counts pairs the batched scan never examined, so the metric falls as the corpus grows; nothing is tested, and the notebooks disagree with each other on scoping |
agent-memoryforge |
A Markdown file in a tiered workspace tree — short-term summary, working-memory task state, durable preference, semantic fact or graph relation — indexed as a row carrying tier, scope, kind and path, with the owner in the entry metadata | One directory per tenant and workspace, with a SQLite index (FTS5 plus a vector table) beside the files; pgvector as an alternate vector index in one shared table keyed on tenant and workspace; Redis optionally for audit | FTS5 over content plus optional vector similarity merged by reciprocal rank, narrowed by tier, scope, memory kind and path prefix, with private tiers filtered per hit against the entry's owner after the top_k cut | Synchronous file write plus a best-effort index upsert through an authenticated internal service; distillation is enqueued to a worker whose writes pass a grounding and hedge filter | Files are overwritten or appended and rows re-indexed; working-memory items move to done or cancelled and stay unless written with a TTL, which deletes the file on the first read after expiry. No delete route, and nothing records that a claim was wrong | A directory per tenant and workspace, a membership check at the gateway, and an owner predicate on every private-tier read; a private file is addressed by conversation or task id, with no check of the existing file's owner on write | An authenticated REST API and a Python SDK whose assembled context a LangChain or LangGraph loop can prepend, a reference agent runtime, and an operator portal; the in-tree MCP server exposes legacy skill tools, not memory | An async distillation worker that turns conversations into durable facts, preferences and graph relations, plus quota and usage accounting | None as a status. Distilled claims that hedge or are not grounded in the user's own messages are dropped before write, and nothing records whether a stored fact is true | Private tiers filtered per hit against the owner read off the entry, a fail-closed internal service key, and a distillation gate that drops hedged or ungrounded claims before they are written | _actor_role defaults to system, which is
privileged, so a caller that omits the field reads every user's private
memories; a workspace member who knows another user's task id overwrites
that user's working memory; audit durability is off by default and
distilled writes are unaudited |
agent-mesh |
A decision — a titled record with a tier, an externalized Markdown body addressed by SHA, and a status; messages and backlog items share the log but are coordination state, not claims | .agent-mesh/events.jsonl, an append-only SHA-256 hash
chain, with SQLite as an explicitly derived and rebuildable index across
roughly thirty tables |
Explicit CLI query only — a full-table substring scan for
decisions search, fnmatch over affected-code
globs for decisions at, and a Workbench tab |
Deterministic and local; no LLM anywhere. An agent or human appends
a decision_proposed event through the CLI or the
Workbench |
Supersession with cycle detection and a target-status gate, plus rejected and retired states — and no delete, no redaction and no TTL of any kind | One .agent-mesh/ per repository; the multi-repo
Workbench resolves an opaque repo ID to a store, but no scope key is
stored on a record or applied as a filter |
Two CLIs (agent-mesh, agent-q), a loopback
Workbench UI with a supervised background service, and a versioned
contract block installed into AGENTS.md and
CLAUDE.md |
None over memory. A user-level service (launchd, systemd, Task Scheduler) supervises the Workbench server; nothing re-reads or rewrites the store on a schedule | A six-value status column — proposed, accepted,
in_force, rejected, superseded, retired — with tier-driven promotion,
re-approval forced by editing an accepted record, and a reviewer quorum
that gates promotion: a decision_accepted event that misses
quorum is logged and the record stays proposed |
Editing an accepted decision emits decision_revisited,
clears accepted_utc and returns the record to proposed, so
a revision cannot silently inherit its predecessor's approval |
The grounding packet an agent receives is thread-scoped and reads no
decision at all, would_block and
evaluation_status are constants asserted by contract so the
enforcement mode never blocks, and two payload fields —
rejected_alternatives and consequences — are
still hardcoded empty at both write paths |
agent-working-memory |
An engram: concept, content, salience, confidence, tags, a stage, a memory class, optional task fields, an optional caller-supplied validity window, and the retraction pair retracted and retracted_at | SQLite by default, PGlite or Postgres by environment, behind one store interface; FTS5 or tsvector for the lexical arm and local ONNX embeddings for the vector arm | Activation-weighted recall over a BM25 arm and a vector arm, a default-on graph boost, a cross-encoder reranker and a confidence-shaped abstention; superseded rows are down-ranked by 0.15 and retracted rows excluded | A salience score sorts each write into active, staging, or kept-but-tagged low-salience; a same-concept match is reinforced instead of duplicated unless the caller names what the write supersedes | Supersession by id or by concept match; retraction flags the row and optionally writes a correction that inherits its strong edges; consolidation and the staging sweep hard-delete expired staged and orphaned archived engrams | agent_id from the server environment, applied in SQL on both recall arms by default; the model can pass a workspace name to memory_recall and widen recall to every agent registered under it, with no membership check | An MCP server with 19 tools, a Claude Code plugin with five hooks, a localhost HTTP API, a CLI, and an onboarding scan that writes a pack a person edits before import | A staging sweep on the staging TTL, consolidation on idle and on restore (decay, archive, fade, redundancy prune, forget), eviction over capacity, Hebbian strengthening after recall | A retracted boolean excluded on both recall arms and every injection path; retracted_by points at the correction engram; the diagnostic search and the session-start Last write ignore the flag | Retraction lowers the confidence of up to 20 graph neighbours by a penalty scaled 0.5 to 1.5 by the cohesion of the retracted engram's two-hop neighbourhood, derived from a cited cognitive-science result, and a correction inherits the retracted engram's strong edges. Near-discards are tagged rather than dropped, so discardRegret can count the ones later used | The default SQLite lexical arm cuts its FTS window across all agents and retracted rows before filtering, so other agents' and retracted rows consume a caller's candidates. Staged, archived and superseded rows enter the lexical arm, and include_staging has no reader. No append-only mutation record; three production paths hard-delete engrams. The retraction reason is required and never stored. memory_restore prints a retracted last write. The agent can lift its own scope: a workspace argument on memory_recall widens recall to every agent registered under that name, with no membership check |
agentdatabase |
A canonical JSON record: statement, kind, status, scope, valid_time, recorded_time with an in-record transition list, source with an evidence hash, sensitivity, conflict, supersession, negative_triggers, and a content hash under a named canonicalization | Sharded JSONL under data/memory/records/ with a
manifest, a generated boot view (AGENT_MEMORY.md and
agent-memory.json) of the six active high-importance
records, the pre-cutover legacy store under
data/memory/active/, per-run candidate files and a human
curation file. No database |
A CLI scan over the shards with optional filters on id, key, kind,
scope, tag and keyword, active-only by default, plus
--as-of and --recorded-as-of; a keyword query
is prefiltered by an in-process lexical n-gram index, and the boot
handshake carries a lexical routing index of public active records for
agents reading over the GitHub API |
memory mutate with an envelope: add, update, retire or
dispute, admitted or refused by the source type the envelope declares,
idempotent by transaction id, applied only on an
automation-c/memory-* branch, each status change appended
in-record |
Retirement is retrieval_exclusion_not_history_deletion:
status flips, validity closes, the record stays. No verb promotes a
candidate or resolves a dispute. Supersession and dispute fields exist
and no live record uses them |
scope {type, key} over global, project, task and
conversation, with allowed scopes per source type; the query filter is
optional and defaults to unset. All six active records are
global:owner and every conversation-scoped record is
candidate or retired |
A Python CLI, generated boot files, an agent context pack built from keyword-signal recommendations, a Codex skills registry, and a Memory Atlas web view retired on 30 September 2026 with its code kept | No daemon. CI workflows refresh a dynamic profile every third day and run the governance suite nightly; Automation C settles a mutation through one same-repository pull request with a required CI check and no direct write to the default branch | Status gates the CLI query, the boot view and the routing index;
confidence and importance are enumerated; abstention returns
UNKNOWN with a reason code and missing conditions;
admission is decided by a source type the envelope declares |
Abstention with a machine-readable reason and the conditions that would have permitted an answer; a disputed state that withdraws a claim without adjudicating it; transitions written into the record with a transaction id that doubles as the idempotency key; a record-time query that fails closed when history is missing; a gold-case schema with forbidden ids, hard negatives, required abstentions and a two-axis as-of | The admission gate refuses an envelope that labels itself
model_inference or raw_import, and the label
is written by the agent converting a user command. Every live record
entered through a one-time cutover the current policy would refuse, so
no transition, supersession, dispute or negative trigger exists in the
store, and a record-time query touching a retired import fails. The gold
benchmark's 1.0 scores a ranker defined inside its evaluator. The agent
context pack hands agents keyword-triggered statements outside the
canonical store |
agentic-context-engine |
A Skill — a section, keywords, an issue,
an optional insight, its source occurrences, an
active flag and four outcome counters |
An in-process Skillbook serialised to JSON, embeddings
excluded from the file and recomputed |
Embedding similarity over skill text, with inactive skills excluded from every listing | A model reads the run's outcome and reflection and calls add,
update, tag or remove; counters move by explicit tag_skill
deltas |
Soft removal sets active = false and appends the source
that justified it; purge is the hard delete |
None. One skillbook per agent process | A Python SDK, an MCP server, LiteLLM providers, and a benchmark harness with task loaders | A deduplication pass that pairs skills by cosine similarity and asks a model to merge, update or keep them | active withholds a skill from use;
helpful, harmful and neutral
counters record outcomes and are forbidden by prompt from being a
removal trigger on their own |
A KEEP decision — the pair, the reasoning and the similarity at the time — is durable and the detector consults it before re-proposing the merge | Everything above the storage layer is a model following a prompt, and the KEEP record is keyed on ids so a rewritten skill gets a new pair and a fresh argument |
agentic-graphrag-blueprint |
An entity node with a type and one description, a directed relation edge, a text chunk, and an LLM-written community report keyed by a fingerprint of its membership and internal edges | Chroma on local disk for every embedded unit; a
networkx.MultiDiGraph pickled to
data/graph.gpickle; a JSON file of source-file hashes and
report fingerprints |
Local — entity and chunk vector search filtered by record kind, seeded into a radius-1 subgraph traversal. Global — map-reduce over community reports | Ingestion re-extracts any file whose SHA-256 changed, adds unseen entities and every relation, upserts chunks and entities, then regenerates only the community reports whose fingerprint moved | One deletion in the system: community reports whose fingerprint no longer exists. Chunks orphaned by a shrinking document, entities from a deleted file, and duplicate edges all stay | None on the read path. The filter is kind — entity,
chunk or report — and source is stored on every chunk and
never filtered on |
A FastAPI service with upload, ingest, progress, query and stats; a React UI; Terraform for Azure Container Apps behind Entra ID | Ingestion runs on a daemon thread with a module-level progress snapshot; community reports are generated by a thread pool | None. No status, no confidence, no timestamp on any node, edge or chunk | Community fingerprinting that makes report regeneration selective, an incremental path whose test asserts zero LLM calls, and a consistency guard that forces a rebuild when the two stores disagree | Positional chunk ids orphan content when a document shrinks, entity
descriptions are frozen at first sight, cross-document linking sees the
alphabetically-first 150 names, and the graph is persisted with
pickle |
agentictrading |
A Memory node — memory_id,
query, keywords, summary,
agent_id, event_type, a single
timestamp and a lookup_count, linked to other
memories by SIMILAR_TO and RELATES_TO |
Neo4j, reached through a unified database manager, with full-text and property indexes and uniqueness constraints created at initialization | Substring CONTAINS matching over content, summary and
keywords, incrementing lookup_count on the way through,
plus a one-hop expansion along similarity and relation edges capped at
three neighbours |
MCP tools and an A2A server front the same store; an intelligent indexer and a real-time stream processor sit beside them | No supersession, no invalidation, no tombstone and no expiry on the
memory node; lookup_count is the only field the read path
mutates |
agent_id is stored on every node and is one optional
key in a filters dict; the primary search applies no scope
predicate at all |
An MCP server, an A2A server with a health checker, and agent pools for alpha, risk, execution and transaction-cost analysis | A real-time stream processor and an LLM research service alongside the store | None. A memory node carries no status, confidence, provenance or
validity field; lookup_count records use, which is a
property of ranking rather than of the claim |
The schema is created explicitly with uniqueness constraints and full-text indexes rather than emerging from writes, and the memory service is a separate addressable component two protocols can reach | The main retrieval query carries no agent_id predicate,
so one agent's memories are returned to another; Neo4j credentials are
literals in the source; and neither test directory can catch it — the
two files named for memory testing never import the package, and the
1,796-line suite inside it carries no assertions and passes on finding
words like success or stored in the reply |
agentmemory-markdown |
A section of plain Markdown — durable facts in
MEMORY.md, a dated work log, and a scratchpad — readable in
a text editor with no database behind it |
Markdown files under a local directory, with an optional qmd index for lexical search | Reading the files, optionally helped by a local qmd index; the probe set covers routing, advertised context caps, priority under saturation and cross-language lexical controls | The agent writes Markdown. There is no write gate, no extraction pipeline and no consolidation pass | A superseded fact is marked in prose — the eval fixture writes
Status: superseded and a sentence naming its replacement —
which is a convention the probe tests rather than a field any code
enforces |
None. Single user, one local directory, no scope key | An npm CLI with a Homebrew formula, skills, and committed git hooks; deliberately standalone, with no account, remote service or proprietary runtime | None for memory lifecycle; the repository's scheduled work is CI, npm publishing and a Homebrew formula update | None as a field. Supersession is a line of prose, and the project
carries temporal-correctness as an issue id with probes
attached rather than a mechanism that resolves it |
Every probe declares both a required and a forbidden marker, so neither returning nothing nor returning everything can pass; probes are derived from public complaints before fixes are proposed, and are data records carrying their cited source, a requirement and a fixture rather than functions someone must remember to call; the dataset is schema-validated and refuses to load without a licence field; a reproduced product issue exits zero so a finding is distinguishable from a broken harness; and the evidence the project cannot automate is named and then excluded from scoring | Supersession is prose with nothing able to filter on it, so the
probe checking the outcome is all that stands between a correction and
its ghost; the memory carries no status, no scope and no lifecycle,
which is proportionate at four source modules and is still the whole of
the trust story; and the screen found committed git hooks, inert until
core.hooksPath points at them, beside two npm build-time
execution points |
agentmemory-v4 |
An extracted memory with importance and lineage, indexed in an ANN structure | A fresh in-process SQLite store per benchmark case —
:memory:, so nothing survives the run — with an HNSW index
(M=16, ef_construction=200, ef_search=100) over an all-mpnet-base-v2
embedder and a cross-encoder reranker |
Dense retrieval with reranking under a per-question-type token budget | Extraction, classification, consolidation and calibration passes over ingested sessions | Consolidation and a GDPR module; no supersession or tombstone found | A fresh store per benchmark case; federation and namespacing modules exist | An MCP surface and a benchmark harness with resume and offset support | Consolidation, calibration, health checks, lineage tracking | Importance and calibration scores; nothing discrete on a memory | Comparability notes that restate three rivals' numbers into like-for-like form | The committed run log, result summary and runner default all name longmemeval_oracle.json |
agentmemory |
Raw/compressed observation, versioned memory, summary, lesson, graph/semantic/procedural records | iii StateModule backed by local SQLite plus persisted search projections | BM25 + optional vector + graph arms, weighted RRF, query expansion, rerank, source diversity | Hooks call mem::observe; explicit
mem::remember; optional compression and consolidation |
Delete/TTL; similarity-based version supersession; rebuildable indexes | Project and working-directory filters on mem::search
when passed; the MCP recall and smart-search tools take no project, and
smart-search drops the one its function accepts; agent isolation
opt-in |
Hooks, MCP, HTTP, CLI, iii functions | Optional compression, graph extraction, consolidation, decay, repair | Source observation IDs, versions, audit; no candidate/verified/rejected state | Cheap synchronous capture and compact-first hybrid search | Very broad surface; the agent's MCP recall reads every project,
because memory_recall and memory_smart_search
carry no project and smart-search filters its observation hits by agent
alone; shared agent scope by default; fuzzy supersession can hide
conflicts |
agentos-framerslab |
A memory trace with a scope key, a strength, emotional valence and a per-source trust policy of three use flags, scored by a retrieval-priority model rather than typed by epistemic status | A SQLite or Postgres Brain behind the Memory facade with FTS and an HNSW sidecar; the cognitive manager's in-process vector index writing through to it; a SQL or Neo4j knowledge graph; a vector provider the adopter binds | FTS fused with HNSW by reciprocal rank on the facade; vector search and spreading activation on the cognitive manager, optionally reshaped by the mechanisms engine | Facade remember and the agent's memory tools insert rows directly; the cognitive manager encodes synchronously and its consolidation pipeline soft-deletes the loser of a conflict | Soft delete keyed on trace id through tools, the facade and conflict resolution, which writes contradictedBy on both sides; forgetting and decay lower weights; nothing is keyed on a rejected value | A scope and scopeId on every trace and a brain_id on every row; the agency layer compiles an agency id into every vector query; facade recall and the search tool take scopeId as an optional filter and add no brain_id | A TypeScript framework — agent() with a memoryProvider hook, souledAgent() wiring the Memory facade, memory tools for the tool registry, AgentMemory over the cognitive manager, and an agency layer | The facade's consolidation loop prunes and merges and logs counts per run; the cognitive manager runs its consolidation pipeline and, when configured, the mechanisms engine | A per-trace policy of three use flags set from the source type at encode and filtered only when a caller passes usableFor; confidence decays continuously; no status moves after the write | Mechanisms from the cognitive literature with the papers cited in the source, and a soft delete fenced against stale vector documents across sibling stores, with committed race tests | The high-level agent path never runs the mechanisms and agent() drops cognitiveMechanisms without a warning when memory is on; facade recall omits brain_id in a mode the code calls multi-tenant; the agency query embeds with a placeholder hash |
agentrecall-x |
A CorrectionRecord — a one-sentence rule with a
severity, a nine-value failure class, a kind, and outcome counters —
beside journal entries and palace notes |
One JSON file per record under
~/.agent-recall/projects/<project>/corrections/, with
an optional Supabase mirror carrying pgvector and FTS |
Keyword and token overlap of a proposed action against active corrections, rules and insights; p0 always loaded, p1 on context match | Corrections are detected from the human's own words by the CLI; the
model can remember and register_rule but
cannot author or retract one |
Soft everything — active:false,
retracted_at with a reason, superseded_by,
merged_from; records stay on disk for audit |
The project name is the directory path, so every correction read is scoped by construction | An MCP server with thirteen tools plus a CLI, aimed at coding agents | On-write consolidation and supersession; no scheduler | kind of correction, insight, hunch or fact;
authoritative decides whether a record may override the
model; measured precision can withdraw that power |
A stale high-severity rule that keeps being ignored is demoted out of its own veto, and the counter that does it is measured rather than declared | The outcome loop depends on the agent judging whether it heeded a rule, and the committed benchmark that would check it is twelve cases |
agentrt |
An opaque byte record with a free-form JSON metadata string, a
32-char hex id and a created_at second stamp; separately, a
context-ledger entry typed as system prompt, tool definition, user
message, tool result, assistant message, compression block or cache
hit |
A fixed-size in-process array (default 1,024 records) with a djb2
hash index, mirrored to one line-delimited JSON file at
${AIRY_DATA_DIR}/agentrt/memory/mem.jsonl; the context
ledger and the semantic cache are in-process only |
Per-record TF-IDF term vectors with cosine similarity fused against substring-match density at a configurable 0.6/0.4 weight, scanning every record; an optional HTTP embedding backend replaces the TF-IDF half when it answers and silently degrades to TF-IDF when it does not | mem.write over JSON-RPC on a Unix socket, appending to
the array and the JSONL; mem.kb_ingest splits a document
into UTF-8-safe byte chunks tagged with
kb_id/doc_id/chunk |
mem.delete is a hard delete: the record is freed, the
array tail is swapped into the hole, and the whole JSONL is rewritten
through a temp file, fsync and rename. mem.evolve never
deletes — it writes a new record concatenating the hits |
None on memory records. The daemon serves one global store over one
socket with no user, agent or session key; kb_id is an
optional read filter the caller may simply omit |
A standalone daemon speaking JSON-RPC over a Unix socket
(<runtime-dir>/mem.sock, TCP 127.0.0.1:8085 on
Windows or behind --tcp), addressed by the gateway's
capability registry as the mem.* namespace |
None inside mem_d — no eviction thread, no decay pass,
no re-embedding. Compression and marking happen only when a caller
invokes them |
The context ledger's status filter and its append-only status-change records; a per-session token budget with a warn ratio; crash-safe persistence through temp-file plus rename | Persistence written carefully — every full rewrite goes through a
temp file, fsync and rename, and the path resolver documents the
recursive mkdir that a previous version got wrong and silently lost
memories to. A knowledge-base isolation test that asserts the negative
with its positive control beside it. A ledger whose status transitions
append a record carrying seq, a nanosecond stamp and a
ref_id back to the entry, making the transition sequence
replayable. The compressor protects the system prompt, tool definitions
and the current request by construction rather than by heuristic |
mem.recent reads recency off array position while
mem_remove_record_at swaps the tail into the deleted slot,
so one delete permanently scrambles the order — and
created_at, which every returned item carries, is never
used to sort. mem.evolve concatenates its search hits into
a new record without retiring the sources, so the merged record
out-scores them on the query that produced it and the store grows
against a hard ceiling that rejects writes rather than evicting. On
restart, load stops admitting records at max_records
without breaking the loop, keeping the oldest and silently dropping
every newer line. No scope key of any kind on a record. The semantic
cache reuses responses across sessions keyed only on canonical text and
model id |
agents-memory |
A bullet line inside a typed markdown file, addressed by store path, line number and an 8-character content hash | Plain markdown under the user's ~/.agents/memory/ and each registered repository's .agents/memory/, written atomically; a disposable SQLite FTS5 index under .index/ for ranked fill | Case-insensitive substring match capped at two hits per file, then BM25 fill from the FTS5 index over files not yet hit, up to a limit of 20 | add_memory(fact, kind, name, project, collection)
scrubs secrets, skips an exact repeat in the target file and appends a
bullet; write_memory_file overwrites any non-rule file;
session logs are ingested into staging and distilled by the model or by
keyword heuristics |
delete_memory removes one line by hash-anchored id,
re-finding the line if it moved, or a whole file by bare path;
revise-in-place kinds refuse a second append and are edited with
write_memory_file |
A user store and a per-repository store; the project argument
selects the scope per call, from the user store only to every registered
repository with * |
An MCP server of sixteen tools for Claude Code, Cursor, Antigravity, Zed and Gemini rule slots, a CLI, and an optional self-hosted sync server | None in process; ingest, distillation and sync are commands, and the sync MCP pulls about once a minute when a remote is configured | None. Kinds are locations, and proposed,
implemented and rejected are folders; the
frontmatter status and provenance values are
linted and read by no filter |
A published layout with one home per fact, a search id the delete accepts and resolves by content hash after lines shift, and hard rules a model can propose and only the person's CLI applies | Each search's project scope is a model argument, and
project=* reads every registered repository; the model
writes USER.md and agent .mdc rules freely, both of which can reach
always-on context beside the gated hard rules; a bare path given to
delete removes the whole file |
agentswarms |
A row with a four-value kind — fact, preference,
episodic, instruction — its content, and a trigger-derived keyword
array |
Supabase Postgres, three tables, row-level security per user; no vector column anywhere on the memory path | GIN && overlap between prompt tokens and stored
keywords, scored overlap × 2 + score + recency × 0.5,
capped at twelve |
gpt-4o-mini extracts up to four kinds per turn and
plain-INSERTs them; no dedup, no upsert, no similarity
check |
Hard delete only — memory_forget(id), a per-item bin in
the UI, and cap eviction by an RPC. No supersession, no tombstone |
user_id and agent_id on every query plus
RLS at the database; swarm runs pick agent, run or none |
Five tools — remember, recall, forget, and a conversation scratchpad set/get — inside a self-hosted agent and BI platform | An hourly retention pass that deletes old chat and the documents those turns generated; nothing sweeps long-term memory | None. kind is a category, not a status, and the
confidence-shaped column is a constant |
A deterministic keyword index derived in the database itself, and a retention purge that removes generated files before the rows that point at them | score, usage_count and
expires_at are read, surfaced or documented and written by
nothing; extraction never dedups, so a repeated fact becomes many
rows |
agno |
Six of them — a profile field, a free-text memory, a session summary, a titled learning, an entity carrying facts and events, and a decision with an outcome | One BaseDb behind eighteen backends (Postgres, SQLite,
Mongo, Redis, DynamoDB, Firestore, ClickHouse, SurrealDB, JSON, GCS);
learnings in one table keyed by learning type |
No embeddings anywhere on the memory path — last_n,
first_n, or an agentic mode that sends the
memory list to a model and takes back ids; entity recall matches names
on word boundaries |
ALWAYS extraction fired from a post-run hook, or
AGENTIC tools the model calls; a
background_executor if the app supplies one, otherwise
inline on the response path |
retire_fact stamps
superseded_at/superseded_by and keeps the row;
forget archives an entity; the curator prunes by age and
count; optimize_memories clears the table |
user_id required on every recall and returns
None when absent; entity namespaces of user —
keyed by a user_id digest since v3.0 — global, or a custom
group |
Agent and Team runtime, ~20 model providers, an AgentOS FastAPI
control plane with nine memory routes, MCP, and a
MemoryTools toolkit |
A post-run capture hook, a Curator that prunes and
deduplicates the user profile only, and an LLM supersession judge on the
entity write path |
A confidence float on decision-log entries and nothing
else; facts are live until something supersedes them |
Supersession that is judged, thresholded, reversible and tested; scope that fails closed on read; comments that document the corruptions that produced the code | optimize_memories defaults to apply=True
and replaces every memory with one model-written paragraph; PROPOSE-mode
approval exists only in a prompt string |
ai-agent-automation |
An AgentMemory document — agentId, content (a JSON
user/assistant envelope), a dense embedding, metadata carrying taskId,
workflowId and a type set to conversation, plus provider
and model fields that record the agent's chat configuration |
MongoDB via Mongoose, one collection, embeddings stored inline as a number array with no vector index | Load every conversation memory for the agent, cosine each in
JavaScript, sort, take the top k. The minScore
parameter is declared and never used |
storeMemory embeds first, then applies a 20-character
guard that the JSON envelope every caller passes always clears, then
inserts and runs a retention pass |
No update path. A retention pass deletes the oldest conversation rows over a 500 cap, and the management API exposes delete-one and clear-per-agent behind an ownership check | agentId is a required indexed field and a predicate on
every recall; the recall service and the management API both resolve
agent ownership against the authenticated user before reading or
deleting |
A workflow engine with typed handlers — LLM, agent call, HTTP, browser, email, file, MCP — where two handlers and the agent playground read and write memory around their model call | None for memory. Retention runs inline on every write | None. No status, no confidence, and the provenance fields name the agent's chat provider and chat model rather than what produced the vector | A changed recall signature fails closed on the old call shape, and ownership is re-checked against the database rather than trusted from the in-memory agent | minScore is a parameter with no consumer, and a
committed test asserts the unfloored result; the provenance fields
mislabel the embedder; the retention pass counts all types and deletes
only one; every retrieval logs a content preview to stdout |
ai-agent-book |
Per mode: a tagged note, an enhanced note, a JSON card under a category key, or an advanced JSON card with backstory, person, relationship and metadata | One JSON file per user under data/memories, written
through a temp file and atomic replace, beside a separate
conversation-history file |
The whole memory rendered into the prompt on every turn, plus a keyword search tool; the RAG variants index fixed windows of conversation rounds in an in-process BM25 or an external retrieval pipeline | A background processor runs a tool-using LLM agent over recent turns after every N rounds and applies add, update and delete operations | Update and delete by memory id; an offline consolidation merges identical notes and drops all but the newest note per first tag | A file per user id; conversation history in the prompt is limited to the current session | A CLI, an interactive chat loop and demo modes; teaching code rather than a library | The memory processor, on a conversation-count interval, optionally in a thread | None | Committed, hashed, credential-free evidence for 60 cases across four memory modes and three retrieval arms, with an external judge and a hallucination veto | One seed and one run per arm; the fixture table in the evaluation README tells the opposite story from the live results; supersession deletes the old value |
ai-brain-starter |
A Markdown note on disk. A journal entry additionally carries a
floor: frontmatter field naming the emotional state it was
written from, with wikilinks resolving to generated stub notes |
Plain files in a vault the person owns, beside a vendored and pinned taxonomy the repository deliberately does not copy | The assistant reads the notes; there is no index of the usual kind, and retrieval is shaped by the session-start context the hooks assemble | Admission control rather than grading: a write passes a set of deterministic hooks — no secret in a note, no raw git in the vault, no skip-prefix, no shared-worktree edit — or it does not land | None modelled. A note has a body and a floor; nothing supersedes, retires or records a correction | None. Single user, one vault; the boundaries enforced are about what may enter it rather than who may read it | Hooks, slash commands, skills, git hooks, bootstrap scripts for two shells, a health MCP service and a memory API service, with Spanish documentation beside the English | A session-end ritual that files what mattered, session locks, and coverage reporting over the note graph | None as a field. The bet is that memory compounds if bad material is stopped at the door, rather than graded after arrival | A smoke gate that asserts every hook runs at all, added after two were found absent for their whole lives while the installer reported them present; a static ban on unguarded platform-only imports paired with it, because a Linux runner cannot see a Windows import crash; a secret detector whose false-positive filter is a test file of its own; and a Stop hook that defines evidence by exclusion — tool outputs and executed commands — on the stated ground that a model cannot self-verify from its own prose | The harness holds no memory object, so nothing records a correction, a rejection or a scope; the fabrication detectors fail open by design, so a fabricated claim passes whenever the guard itself errors; sixty-seven files mention audit and none appends a ledger; and three auto-run surfaces are inherent to what a hook harness is |
ai-maestro |
A consolidated memory — an LLM-extracted sentence with a category drawn from a six-value vocabulary, a system number splitting knowledge from reasoning, a free-text context, the conversations and message ids it came from, a confidence float, a two-value tier, and four counters covering reinforcement, access and promotion | One CozoDB file per agent under the user's home directory, SQLite-backed, holding raw messages and their embeddings alongside the consolidated memories, their 384-dimension vectors and a typed link relation | HNSW vector search over the memory embeddings with a confidence floor and optional category and tier filters, then an optional graph expansion along typed links. Raw messages are searched separately by a hybrid of per-agent term scores and cosine | A nightly scheduled pass sends prepared conversations to Ollama or the Claude API, embeds each extracted memory, searches for a near neighbour in the same category, and either reinforces the neighbour or creates a row | Reinforcement bumps a counter and a timestamp on the matched row. Deletion is by primary key from the viewer, a hard delete. A prune drops raw messages older than a retention window; a separate one-off pass hard-deletes duplicate message rows and their dependents | One database file per agent id, with agent_id stored on
every memory row and bound as a predicate on each long-term read.
Nothing crosses between agents; nothing is shared between them
either |
A Next.js application with per-agent HTTP routes under
/api/agents/:id/memory, a React viewer, a per-agent
schedule file and a host-wide sweep endpoint that runs due tasks by
agent id |
A per-agent schedule seeded with an hourly index task and a 02:00 consolidation task, run by a sweep that walks the agents directory rather than the resident-object cache | A confidence float from the extracting model, a reinforcement count, and a two-value tier promoted on reinforcement and age. There is no status, no rejection record and no approval field | A single writer for the whole memory relation; a physical partition per agent that no query can cross; a maintenance sweep that walks the filesystem rather than a ten-slot cache, with committed tests that pin the accounting; and a deduplication module whose header records the measured sizes that motivated it | The context builder that assembles memories for a prompt has no
caller; the scheduled consolidation branch reports success
unconditionally, defeating the return-value accounting a committed test
pins for its sibling; two documented zero-valued switches are swallowed
by falsy defaults, so retentionDays: 0 prunes thirty days
and minConfidence: 0 applies a 0.5 floor; the deduplication
check on the write path bumps the access counters of the neighbours it
inspects; and the storage engine is pinned by a floating range |
ai-memory |
Markdown page in git with versions, plus observation, session, handoff, cross-project message and workstream records | Markdown in git as the human source of truth; SQLite as derived index and state, with an audit_log table | FTS5, entity, graph, optional vector and observation streams fused by RRF per project, with authority adjustment; a global flag searches every project; handoffs are claimed, not searched | Harness lifecycle hooks capture observations without a model call; the session end writes a rule-based page and an automatic handoff; opt-in LLM consolidation and auto-improvement, auto-approved by default; MCP page and handoff writes | Versioned supersession of pages; TTL, decay eviction and hard delete in a forget sweep; a handoff is claimed once, or expired by a newer baton from the same directory, a cancel or an operator bulk expiry | Workspace and project ids on every handoff read, plus an owner filter on deployments that tell operators apart; page queries take a model-supplied project, scopes list or global flag; per-project grants only for restricted projects | MCP with 24 tools plus lifecycle hooks for Claude Code, Codex, Cursor, Gemini CLI, opencode and other named harnesses; the handoff is injected at session start, first prompt or first tool call depending on the harness | Session consolidation jobs with generation supersession, an auto-improvement scheduler, profile harvesting, a forget sweep and wiki migrations | Actor capabilities, auth levels and opt-in per-project grants; admission webhooks can refuse writes and handoff claims; no candidate or verified state on a page | A handoff claim that is one atomic compare-and-set inside the receiving project, with the body released only to the claimant; owner and directory boundaries on delivery; tests for misdelivery | The automatic handoff is two user prompts and a tool list; to_agent is never written; no handoff expires by age and a manual one outranks every automatic one; memory_query global=true crosses every project |
ai-workflow |
A brain entry — id, date, type, dense keywords, problem, solution, and optionally root cause, failed approaches, files changed and a lesson — or a lessons-learned block compiled into a JSONL row keyed by a hash of its symptom | Markdown and JSONL files under ai-workspace/: a
two-file brain, a lessons file, an Obsidian vault, and two generated
caches |
BM25+ over the index rows, multiplied by an Ebbinghaus retention
factor, with a raw term count as the fallback when the maths module is
absent; brief.ps1 classifies the query by regex and
consults the caches and the brain in a fixed order |
brain-capture.ps1 appends an index row and a full
entry; complete-task.ps1 validates the handoff and captures
at task end; the agent appends to lessons-learned.md by a
prose protocol and a compiler turns it into a cache |
None. Every write is an append and nothing revises or removes an entry; correction means editing the Markdown by hand | None. One workspace, one brain, no key on any record that a query filters by | PowerShell scripts an agent shells out to, plus
AGENTS.md as the canonical rulebook and four workflow lane
prompts |
None. Compilation and indexing are commands a person or an agent runs | None on a memory. The compiled cache carries
status = 'resolved', hardcoded at the one write site and
read nowhere |
One router over three stores that emits a next step rather than a result set, index rows hash-validated before they are routed on, and a task-completion gate that refuses an incomplete handoff | The store is empty at this commit, the highest-consequence read is gated on keyword count alone, and the staleness machinery covers the code index while excluding the memories |
aidememo |
Locally, a typed fact (decision, convention, preference, lesson, error and others) linked to entities and relations, with an optional source namespace and actor, an observation time, a supersession stamp and a pinned flag. On the server, a canonical resource with a revision and either a key-sorted JSON body or a deletion tombstone | A local SQLite file by default or redb, with a cold sibling file for archived facts and an optional DuckDB analytics mirror. A separate server profile keeps canonical state in SQLite or PostgreSQL behind one storage-neutral command trait | BM25 first, with semantic HNSW search when lexical evidence is weak, graph traversal, entity resolution and recent facts composed into context packs; filters for namespace, event-time window, as-of record time and supersession. The server answers snapshot, change feed, resource and lexical or hybrid search per project | Explicit typed writes from the agent, the CLI, markdown ingest and an opt-in pending log, deduplicated on content hash per namespace after an optional privacy screen. Server mutations carry an idempotency key and fingerprint and commit with receipt, change entry and audit row | Local facts are superseded by stamp, edited in place, archived to a cold file or hard-deleted from the CLI; an identical re-add returns the existing row. On the server an upsert replaces the body and a deletion writes a durable tombstone that replicas receive | Server: tenant and project from the bearer token's membership on every read and write. Local HTTP MCP with bound tokens: source and actor injected and overrides refused. Local stdio MCP, CLI and bindings: a source namespace the caller may pass or override, and separate store files per registered project | One Rust binary: CLI, stdio MCP with 29 tools, an HTTP MCP server, a daemon, a Python agent SDK, native bindings for Python, Node, Elixir and C, Claude Code and Hermes plugins, and a separate server binary with REST and a ten-tool HTTP MCP | None by default. Consolidation and archiving run when invoked; the Hermes and Claude Code hooks inject context at session start and capture or preview candidate facts per turn; replicas pull the server's change feed by cursor | Supersession withheld by default reads, an observation time beside record time, an opt-in pending log for Hermes auto-capture, server-derived tenant and actor on every server audit row, idempotency fingerprints that refuse a reused id with a different body, and a conformance fixture every server backend runs | Two places where identity is taken from the credential rather than
the call. The server's AuthorizedCommand refuses an
envelope whose project differs from the authorized one, and
MutationCommand, the only thing
CommandStore::execute accepts, carries it as a field, so no
adapter can be handed a client-chosen scope.
aidememo mcp-serve with bound tokens does the same at the
local edge: it writes the token's source_id and
actor_id into every call and answers a different value with
an error naming the override. The local store keeps an observation time
apart from record time and withholds superseded facts from every default
agent read, and committed tests assert both the supersession filter and
namespace isolation across eight read paths with positive controls |
The default local deployment enforces neither identity rule: stdio
MCP, CLI and bindings take source_id and
actor_id from the call, an explicit argument overrides the
installed namespace, and an omitted one reads every namespace. The
Claude Code session-start hook runs CLI recent, which
passes no namespace and current_only: false, so superseded
facts from every namespace reach the prompt. A CLI write routed through
a running daemon drops --observed-at. An identical re-add
of a superseded fact returns the hidden row, which suppresses exact
repeats by accident and paraphrases not at all. The pending log records
no approver. On the server, an unwired public
delete_tenant_data erases audit rows with everything
else |
aigent-os |
A Markdown note in an Obsidian vault (daily, memory, concepts, projects, people, agents, research, feedback, reference), plus rows in a MEMORY_CANDIDATES.md staging table and a capsule file per refresh cycle | Plain files under the install folder: the vault, an embeddings.json index of 500-character chunk excerpts with 384-dimension vectors, JSONL runtime ledgers, and git history when the vault folder has a remote | search-vault.js: cosine over every indexed chunk with local all-MiniLM-L6-v2, deny-prefix and namespace filters, ended validity windows demoted below current notes, best chunk per file, top 5; run by the agent through Bash | The agent edits notes with Write and Edit; a UserPromptSubmit hook stages regex-matched user phrases as unscanned candidates, and an injection scan promotes clean rows to staged or marks hostile ones blocked | Edit or delete the file. A supersede skill strikes through and dates the old entry; a body line 'Valid from X to Y' demotes the note once Y passes. A deleted note's chunks stay in the index after a full rebuild | None per record. One operator per install; namespaces are top-level vault directories marked INDEX, SKIP or DENY, and a gitignored deny-prefix list removes confidential folders at index and query time | Claude Code hooks from a settings template: SessionStart reinjects a capsule pointer and heat-ranked links, UserPromptSubmit captures and journals, PreToolUse gates memory-file size, Stop writes the rolling capsule; skills for digest, supersede and search | No daemon. Re-indexing, heat scoring and the nightly close-parity pass run when invoked; the nightly pass counts staged candidates and commits and pushes the vault | Persisted text is rendered quoted, bounded and tagged with path and hash; candidate rows carry unscanned, staged, blocked, skipped or promoted, and no read path consults that status | A fail-closed capture queue where only a clean scan makes a row promotable; a write-time size budget on always-loaded files that always allows a shrinking edit; deny and namespace filters enforced at both index and query time; a preregistered harness with falsifier runs | Deleted notes keep answering search; blocked candidate rows are embedded and searchable; the validity line has no documented writer while the supersede skill writes a format search ignores; the agent applies its own digest |
aimaos |
A belief row in one of eight category files — content, confidence,
verifications, stability index, relations, and
previous_content once something has superseded it — with
raw conversation chunks a category of their own |
Per-category JSON files under each agent's own workspace directory, plus a pluggable vector store; SQLite holds cases, tasks, templates and jobs, not memory | Three duplicate channels on write and a pre-generative injector on read — exact id, phrasing-skeleton template match, and same-category vector similarity, with learned concept and relation expansions widening the vocabulary | Every thought ingests into a raw memory category with
no model call; a nightly review forms beliefs from that raw record and
merges them through the three channels |
merge_or_add_belief corroborates a paraphrase and
supersedes a contradiction, keeping the replaced wording in
previous_content; remove_belief deletes the
row and unindexes its relations and its template |
One store directory per agent, built from that agent's own workspace path, so crossing the boundary means opening a different file rather than omitting a predicate | A multi-agent office — office manager, legal researcher, document producer, devops, security officer — with a desktop UI, Telegram, an Android client and a document-heavy starter pack | A nightly belief review, a narrative journal writer whose entry is ingested back into memory, and a document digester | Confidence, verifications and a stability index, all floats. A contradiction restarts the evidence trail rather than adding to it | A phrasing-skeleton channel that catches the value-swap contradictions vector search places far apart, raw chunks exempted from decay by category rather than by flag, and per-agent isolation by construction | The superseded wording is kept on the row and consulted by nothing, so re-asserting an overwritten value supersedes back; the memory package has no test of its own |
aimee |
Two: a typed fact — a (source, relation, target) edge in
entity_edges with a confidence class, an authority rank, a
lifecycle and belief and validity intervals — and an episodic
memories row with a tier, a key, content, an epistemic
kind, a provenance category, validity bounds and a lifecycle state |
Postgres with pgvector, owned by one Go memory module in both placements, plus a SQLite audit chain a separately credentialed worker appends; 263 CREATE TABLE statements in the KB schema file | Lexical ILIKE and full-text reads, dense recall over versioned embeddings, graph fusion and assertion search, all behind one shared current-eligibility predicate; typed facts are assembled into a separate block gated on confidence and PII sensitivity | Stores are synchronous transactions with the audit intent in the
same transaction; a model-authored line that opens with an instruction
override is refused at admission; fact extraction is an asynchronous
memory_facts job; per-turn retraction runs at model
authority before context is assembled |
Every correction writes a successor and retires the old row as
superseded; a model edit to user-stated content becomes a pending
correction proposal; facts.retract and per-turn retraction
invalidate by triple, capped by the actor's rank, and write a
refusal |
A scope disjunction in the per-turn context read, the dense lane and
graph fusion, with row-level security on memories reading
transaction-local GUCs underneath; an MCP call without scope queries an
impossible tenant |
An MCP server, a CLI, a KB operator console, a two-placement split —
aimee-server for one human, aimee-kb for a
team corpus — with every memory decision in the Go module, and a
native-delivery route that releases personal recall rows with their
revisions to an inference host; the plugin that prepares attention state
from them is not in the tree |
The memory_facts extraction drain, re-embedding and
index maintenance, the decision revisit sweep, and hygiene previews that
queue proposals rather than mutate |
Authority ranks model 10, system 20, user 30, operator 40, derived from the verified caller and never from text; a model-authored fact is a candidate until an operator approves it or a higher rank re-asserts it; a confidence floor of 0.4 and a PII gate on the fact block | A refused value is a keyed row every Go writer consults, compared on the fact path through one database-generated identity that the trigger under it shares; an approve verb exists and the agent's tool surface does not carry it; memory mutations reach an append-only hash chain from a trigger in the same transaction | Both runtime roles can lift a refusal with an UPDATE and any
restored_by, and no trigger on the refusal table records it; the session
recall bundle's graph lane drops the application scope predicate and
relies on row-level security, which is ENABLE without FORCE on
memories; the native path from a corrected record to
changed attention state runs through an unpublished plugin; at over a
million lines the traced fraction is small |
aipass |
A JSON entry in a per-branch memory file, capped by type, plus symbolic fragments in ChromaDB | JSON files per branch as the hot tier, ChromaDB as the archive, with a subprocess isolation layer | Semantic search across branch archives, gated by a surfacing governance function | Entries appended to branch files under a character cap; rollover archives what exceeds the limit | An AUDN dedup pattern — add, update, delete or noop — decided per fragment by an LLM | branch is the scope key throughout, on files, limits, templates, search filters and lint | A drone CLI with per-module commands, hooks, a daemon and cross-branch template push | A rollover watcher daemon, a monitor/detector pair and template synchronisation | A relevance score plus governance state; nothing epistemic on an entry | Memory files have declared entry limits and a read-only linter that audits violations | The dedup verdict is an LLM call per fragment, with delete among the actions it may return |
akb |
A vault holding documents, structured tables and files, addressed in a URI graph that links them | Git-backed vaults over PostgreSQL, with per-user and per-token database roles carrying the ACL | Hybrid semantic and keyword search across docs, tables and files, plus the URI graph; agents may also execute their own SQL through one audited executor | Agents read and write directly over MCP with a Personal Access Token, or through an OAuth resource-server path with Keycloak as the authorization server | Vault archival with an allow_archived gate on access
checks; git carries document history |
A per-vault role of reader through owner, an optional per-token
VaultScope of name prefixes plus an explicit whitelist
intersected with the user ACL, and a PostgreSQL role per user and per
scoped token |
MCP over Streamable HTTP and stdio with a proxy, supporting the current protocol revision and four legacy ones behind one tool and authorization core; clients include Claude Code, Claude Desktop, Cursor, Windsurf, Cline and Continue | Role synchronisation keeping PostgreSQL roles in step with the ACL, indexing and search maintenance | The database-level ACL, a token scope that can only narrow, recorded authorizations, log redaction, and an audit compose file | Isolation enforced by PostgreSQL on the one surface that executes
caller-supplied SQL, where application-side filtering would be the wrong
layer; a token scope defined as an intersection and documented as
escalation-impossible; None versus empty scope
distinguished explicitly; the authorization record set at one place
because six returns could each forget it |
A concrete token scope gates mutating roles only — the docstring says "reads are unrestricted (a scoped agent still READS broadly, it just can't WRITE outside its scope)" — so a narrow token is a write-authority bound and not a read bound; system admins bypass the role switch entirely; the licence moved from PolyForm Noncommercial to BUSL-1.1, so neither the current nor the prior terms are open source |
all-agentic-architectures |
An Episode (content, role, ISO timestamp, metadata
dict), a (subject, predicate, object) triple, or a bare
LangChain Document |
FAISS in-process by default; Chroma or Qdrant behind an extra;
NetworkX MultiDiGraph by default, Neo4j behind
GRAPH_BACKEND. Nothing is written to disk by the library
itself |
similarity_search(query, k) on the vector side;
entity-anchored traversal on the graph side, through a hand-written
Cypher subset on the default backend |
Synchronous and unconditional. record,
add_fact, add — no dedup, no extraction gate,
no validation |
None. There is no way to remove one episode, one triple or one
document; reset() wipes the whole store and is the only
removal in the package |
collection_name, ignored entirely by the default FAISS
backend and set to a per-architecture constant by every caller in the
tree |
A Python library imported by 38 architecture classes and 35 notebooks; no server, no MCP, no CLI memory surface | None | None. No status, no confidence, no provenance, no source field on any stored unit | One small API over four backends; honest about several of its own limits in docstrings; a committed benchmark run with a memory task in it | Two parameters accepted and discarded by the default backends, no delete anywhere, and zero tests over the memory package |
alma-memory |
One of five typed rows — a heuristic, an outcome, a domain fact, an anti-pattern or a preference — each with its own columns and a 384-dimension embedding | Postgres with pgvector in the hosted schema and a local SQLite
mirror, with Chroma, Qdrant, Pinecone, Azure Cosmos and a file backend
behind the same interface; five tables plus indexes on
(project_id, agent) |
Per-table SQL with WHERE project_id = ? and a
confidence floor, plus vector similarity; a verification pass classifies
results before returning them |
Outcomes recorded per task; heuristics accumulate occurrence and success counts; a file miner extracts heuristics and anti-patterns from a repository | A ForgettingEngine prunes by age and by confidence,
writing an alma_forget_audit row before three of its eight
deletes; a DecayManager computes a per-memory strength from
access age, access count, reinforcement and importance, and the MCP
surface lists weak memories and reinforces them before they become
forgettable; no supersession pointer |
project_id and agent on every one of the
five tables, applied as a SQL predicate on the read path and indexed
together |
An MCP server of 31 tools, including a verified retrieve, a list-by-verification-status, reinforce and list-weak-memories, plus a CLI, a PyPI package and a JS package | The forgetting engine's pruning strategies, decay-based strength that is recomputed on demand rather than swept, and a file-mining ingestion pass | Four verification states — verified, uncertain, contradicted, unverifiable — derived by ground truth, cross-verification or confidence and written to a column on both backends, then returned to the caller as four labelled lists; no retrieval excludes any of them | An anti-pattern table storing the reason something was wrong and the better alternative beside it, a persisted epistemic status, and a LongMemEval recall curve that recomputes exactly from committed per-question records | The anti-pattern write guard sits on learn() alone, so
the heuristic extractor, the consolidation pass, the conversation miner
and two MCP write paths reach the store without passing it |
alphaonedev-ai-memory |
A titled row with content, tier, namespace, tags, priority, confidence, metadata, a memory_kind from a closed vocabulary and a lifecycle_state; unique on title and namespace | SQLite with FTS5, embeddings in a BLOB column and an in-process HNSW index; an optional Postgres backend with Apache AGE behind the sal feature | FTS5 rank plus priority, access, confidence, tier and recency terms; with an embedder, a cosine and FTS blend weighted by content length, optional cross-encoder rerank, token budget | Explicit memory_store from the agent; optional LLM synthesis choosing add, update, delete or no-op over near candidates; a 0.95-cosine near-duplicate refusal unless force is set | Upsert on title and namespace that never lowers confidence or tier; memory_update with expected_version; forget archives then deletes and writes an id-keyed forget tombstone; TTL expiry archives | namespace column with optional hierarchy expansion, plus metadata.scope private, team, unit, org or collective; an omitted namespace recalls across all | MCP stdio server, 7 tools in the default core profile and 101 in full; HTTP daemon; CLI; ai-memory boot as a SessionStart hook for Claude Code and others | Daemon loops fold recall_observations into access counts, TTL extension and mid-to-long promotion, and run GC; a separate curator auto-tags and flags contradictions; the stdio MCP server runs none of them | Quarantine of unattested federated writes, hidden from every read lane until attested; attest_level and a provenance tier on recall rows as decoration only | One fail-closed lifecycle allow-list shared by every read and egress lane, with a per-lane negative test; governance queues with consensus and an Ed25519 signed-quorum verifier; content-addressed ids and an id-keyed forget tombstone that stops federation resurrection | memory_pending_approve takes a caller-supplied approver id and accepts self-approval by default; the append-only revision spine and consolidation tombstones are resolved from config and never seeded; the stdio server never folds access, so recall-driven promotion needs the daemon; the claim validity columns have no writer |
altk-evolve |
An entity — content, a type such as guideline, trajectory or fact, and metadata carrying support counts, source task, trace id, owner, visibility and last access; in the Lite plugins, a Markdown file per entity | A namespace per table or collection in PostgreSQL with pgvector,
Milvus, or a filesystem backend with text matching; SQLite or Postgres
for namespaces and retention state; .evolve/entities/ files
for the Lite plugins |
Namespace search by vector similarity or text match, and dosage-aware guideline selection: always-on core guidelines above a support threshold plus the top-k from the most similar source tasks | An LLM generates guidelines from a trajectory, optionally clustering and consistency-resampling steps; conflict resolution by LLM decides ADD, UPDATE, DELETE or NONE against similar entities; hooks redact secrets and PII before persistence | Conflict resolution updates or deletes by id; retention policies flag or delete by age, disuse, provenance cascade or a deleted source, subject to legal-hold vetoes | One physical table or collection per namespace; entities marked public are discoverable across namespaces | An MCP server with a web UI and REST API, a Python client, Phoenix trace sync, and Lite plugins for Claude Code, Codex, Claw Code and IBM Bob driven by prompt and Stop hooks | Scheduled retention jobs with leases, and in the Lite plugins a Stop hook that runs the learn skill after every task | A support count on guidelines that selects core guidance and filters candidates; no status | A published AppWorld evaluation and paper; retrieval that doses guidance by support and task similarity; a retention engine that records why it spared an entity; hook seams that cannot be bypassed by a backend override | Conflict resolution deletes entities outright and no store keeps the history; the audit log exists only in the Lite plugins and does not record learned writes; the benchmark's run artifacts are not in the repository |
always-on-memory-agent |
A memory row — raw_text, an LLM summary, JSON entities and topics, an importance float, a connections list and a consolidated flag; plus a consolidations row holding source ids, a summary and one insight | One SQLite file, three tables (memories, consolidations, processed_files); no embeddings and no vector store by explicit design | None — no search of any kind; the query agent loads the most recent 50 memories plus the last 10 consolidations into context and the model synthesizes an answer with citations | An ingest agent turns any of 27 file types (via Gemini multimodal) or an HTTP post into a structured memory; a file watcher on ./inbox dedupes by path through processed_files | Delete a memory by id (hard DELETE) or clear everything; no update, no supersession, no rejected-value record; re-ingesting the same content from a new path is unguarded | None — a single SQLite file for a single user; no per-user, per-project or per-agent key | A Google ADK multi-agent app (ingest, consolidate, query specialists behind an orchestrator) on Gemini Flash-Lite, with a file watcher, an HTTP API and a Streamlit dashboard | An always-on consolidation loop on a 30-minute timer reads the ten newest unconsolidated memories, has the model find connections and a cross-cutting insight, writes a consolidation and marks consolidated whichever source ids the model passed back | importance is a 0–1 float and consolidated is a processing flag; there is no discrete epistemic status and nothing withholds a memory from being read | A clean, embedding-free design that bets the store fits in context and replaces retrieval with an LLM read, plus a genuine always-on consolidation daemon that compresses and connects rather than merely appending | The consolidation daemon pages newest-first, ten per half hour, with no offset and no catch-up, so a backlog past ten rows is never worked through while the daemon's own log prints the growing count; it scales only as far as fifty rows in a prompt — there is no retrieval, so recall is a recency window, not relevance; and correction is a hard delete with no rejected-value record, so a re-ingested claim returns |
anatid |
An immutable memory version — content, kind, confidence, embedding, writer — addressed by a logical id, with entity and relation edges and an episode beside it | One DuckDB file holding memories, edges, episodes, audit rows, a BM25 index and the bundled integration tables, queryable with SQL by anyone who opens it | Reference walks over the entity graph, BM25 text ranking and optional vector search, each narrowing a candidate set that is then filtered by the visibility predicate | Verbs — remember, relate, supersede, reinforce, forget, unrelate — each inserting a new version rather than editing the row it corrects | A correction closes the current version's transaction interval and
inserts the next in the same transaction; forget(hard=True)
is a right-to-erasure purge that also runs registered hooks over tables
anatid does not own |
tenant_id compiled into every read from one module,
with a test that fails the build when any other module writes the
predicate by hand |
A Python library, an MCP server, and bundled agent integrations whose tables are covered by the erasure hooks | Index generations and a journal, with derived accelerators constrained to narrowing rather than answering | Provenance through a writer on every version, an audit table with typed counterparts, and erasure that reaches transcripts and serialised state | The enforcement mechanism is the thing to take. Most systems in this
corpus hold their scope predicate by convention, and the atlas keeps
finding the read path that forgot it. anatid puts the predicate in one
module and then writes
test_no_module_writes_the_visibility_predicate_by_hand,
which parses every module's AST, pulls its string literals with
docstrings excluded and f-strings handled, and fails when a literal that
starts like SQL also matches tenant_id\s*=\s*(\?|\{) — one
parameterised test per module "so a failure names the file". The same
discipline shows in two smaller rules. An accelerator "only ever narrows
the candidate set", because "[a]n index built over current state cannot
answer what was visible at an earlier instant", so a stale index can
cost recall and can never leak a row past the guard. And the audit
schema is shaped by erasure: the counterpart memory id "goes in a
COLUMN, never into reason", because a hard forget "has to
be able to find and delete every audit row that names an erased memory,
and it cannot search free text for it". erasure.py then
chases the copies that live outside the memory graph entirely —
transcripts, serialised run states — and covers integration tables that
are "counters today" so that "a column added later cannot quietly reopen
the hole" |
There is no epistemic status: a memory is current or superseded, and the axis that decides is time rather than a judgement, so a claim nobody has verified and one a reviewer confirmed are indistinguishable at read time beyond a confidence number. Nothing is keyed on a rejected value — a hard forget removes every copy it can reach, and re-asserting the same content afterwards produces an ordinary new memory with nothing recording that the store was once asked to erase it. The erasure hooks are the honest version of a hard problem and they are still hooks: coverage of a table anatid has never heard of depends on whoever created it registering one, and the module says so. The usage counters are excluded from the bitemporal rule by design and are mutated in place, so an older version keeps the counts it had when it closed rather than the ones the memory has now. And DuckDB is a single-writer analytical file, which is what makes the SQL-queryable promise real and also what bounds the concurrency this can serve |
anda-brain |
A KIP Proposition with immutable Assertions taking a stance on it,
none of it defined here: the vocabulary is anda_kip, pinned
=0.13.0, and is described in the anda-db report |
Delegated to the Cognitive Nexus. Brain's own persisted state is a
Journal over an object store, every write an optimistic
compare-and-swap on UpdateVersion, holding orchestration
rather than facts |
A budgeted recall agent plans over channels and returns a
MemoryPacket of items, coverage and status; a budget too
small to work in returns budget_insufficient with empty
items and never calls the provider |
Deterministic KIP commands built in code rather than text a model
composed, through an envelope seam that keeps an operation-level failure
distinct from an envelope failure and treats OutcomeUnknown
as neither success nor licence to redo the write |
Retraction, supersession and expiry are AssertionStatus
values in the dependency. Brain's own contribution is a weekly disuse
pass that multiplies memory_strength and, by design, cannot
reach an Assertion's stance |
A Space is the unit of tenancy, and every space-scoped endpoint runs one shared prelude — shard check, CWT verification, space load, space-token verification — reached identically by the HTTP and MCP channels | An HTTP API and an MCP channel over the same prelude, plus a Cloudflare Worker carrying the Formation, Maintenance and Recall prompt assets and the KIP syntax reference | A settlement pass running maintenance on a cycle, which censuses counters so readers never pay heavy queries; the learning scheduler it would drive is unconfigured and the response says so | Stance, belief status and validity all belong to KIP 2.0 and are credited to anda-db. What is enforced here is the separation: disuse decay paces accessibility and has no path to an epistemic stance | One authorization prelude for two channels, written because a launch review found them diverged, with the admission rule given a name instead of left as a convention; recall tests named as invariants that pin what must not reach the model, including a model-invented citation; and a settlement response that returns a sentence naming its unconfigured preconditions rather than reporting zero evaluations as if measured | The memory hygiene this project states best — no decaying confidence
with time, no deleting one side of a contradiction, no destructive merge
of a suspected duplicate — is prompt text in a markdown asset, and only
the decay separation is enforced in Rust; default = []
leaves the audit event log, the learning runtime and the experiment
controls all off unless a deployment opts in; and two extensions are
documented as predating any reader while still costing a write |
anda-db |
Five element kinds — Concept, Proposition, Assertion, Evidence, Activity — where a Proposition is a claim, an Assertion is somebody claiming it with a stance, a confidence and a world-time window, and Evidence is what the Assertion cites | An embedded Rust document database over an object store, with B-Tree, BM25 and HNSW indexes, plus a per-Space version log and a separate governance plane of rows no query can reach | KQL patterns over the graph, defaulting to active elements, with
BM25 and vector search beneath and a BELIEF form that
projects rather than reads |
KML clauses through one transaction path that stamps the engine-owned envelope columns and advances the Space sequence | Lifecycle transitions — archive, quarantine, tombstone, merge,
supersede — all additive, plus PURGE as the one destructive
operation, guarded and digest-stubbed |
A MemorySpace bound into the session, emitted as a predicate on every read; explicitly not a topic namespace | A Rust workspace of fifteen crates, with Python and TypeScript bindings, a server crate and a WASM build of the protocol | Retention sweeps that tombstone expired elements before purging those already reviewed | A projection that computes belief from Assertions under a named policy and never stores it, a governance plane with default deny and bound approvals, and a version log under every change | The governance module's opening line is the sharpest statement of the memory-privilege problem in this corpus: "Cognitive content may describe authority. Only this plane can grant it." A Space can hold a Proposition saying Alice is an administrator, an Assertion supporting it at high confidence and Evidence for both, and Alice administers nothing — because grants are rows no KML clause can reach, "which is what keeps a prompt injection into ordinary memory formation from having a route into policy". The same file separates three questions most systems conflate: should I believe this, am I allowed to touch it, how strongly may it influence what I do. Projection is equally disciplined — belief is "a view, never stored state", because storing it "would create a second answer that could disagree with the Assertions it came from, and nothing would say which one was right" — and its three arithmetic rules are exactly the failures this atlas keeps finding: absence of support is not rejection, saying a thing three times is one voice repeated, and two Assertions citing the same Evidence are not independent because "[m]anufactured corroboration is exactly what an attacker builds". Purge keeps a digest stub because "a dangling reference does not say 'this was erased', it says nothing at all, which is worse for an auditor" | The cost is that almost nothing here is cheap to adopt. This is
169,548 lines of Rust across fifteen crates implementing a versioned
protocol specification, requiring Rust 1.95, with a breaking 1.x to 2.0
migration in this very release — a reader wanting a memory library will
find a governed graph database with a query language, a change-envelope
model and a policy engine, and no smaller entry point. Approval is
separation of duties rather than human review: an approval is signed by
a Principal, allow_self_approval defaults false so a
requester cannot approve their own operation, but nothing requires the
approving Principal to be a person, and there is no review console in
the tree — so on a host whose Principals are all agents,
RequireApproval is a second agent's signature. Historical
reads are declared scans that "enumerate the version log" because "[t]he
indexes on the current rows describe the present", charged against the
query budget and refusing rather than stalling on a large Space. And
projection is explicit that "Evidence quality is not automatically
evaluated" — the arithmetic protects against manufactured corroboration,
not against a plausible, well-cited falsehood |
animus |
An Observation — one line of text in one layer,
carrying weight, decay_rate,
tags, source, a memory_state of
new/current/deprecated and a superseded_by pointer; beside
it an ontology (entity, key) → value property and a whole
MemoryFile with its chunks |
One shared IDataStore connection, SQLite by default and
PostgreSQL behind -DANIMUS_WITH_POSTGRESQL=ON; every store
calls EnsureSchema() in its own constructor and branches on
Dialect() for FTS5 versus tsvector; with federation
configured, memory tables replicate between nodes through a trigger-fed
outbox |
Two arms that never meet — FTS5 bm25 or tsvector
ts_rank across five domains in MemorySearch,
mapped monotonically to q/(1+q) and merge-sorted; and a
brute-force in-process cosine scan over
memory_file_chunks.embedding in the prompt assembler, with
keyword counting as the degraded fallback |
Nothing writes memory except a tool call, an admin request or a boot
repair. The scheduler opens a consolidation:intake: session
and the LLM must call consolidation with
action: "create"; the pipeline never parses the model's
text and infers the count by comparing row totals before and after |
revise is copy-on-write with superseded_by
on the old row; retire sets Deprecated;
merge deprecates its sources; a boot pass retires the newer
of two identical live observations. Archive is a hard
DELETE FROM observations when the model says demote on the
bottom layer, and its audit row does not carry the text.
ontology:delete removes an entity with a logged motivation;
nothing removes or moves a single property |
agent_id on layers, observations, entities, properties
and diary entries; the layer is the enforced boundary on every
observation read path, the ontology arm of unified search has no agent
predicate, and the ontology's unique key omits the agent |
One animusd binary — Drogon HTTP API, a Vue 3 admin SPA
compiled into the executable, Lua channel adapters, a Lua 5.4 scripting
runtime, two agent-facing tools (memory,
consolidation) and an ActiveMemoryProvider at
priority 30 in the prompt |
Cron schedules registered per agent and per layer at startup —
hourly intake into day, a review pass per layer from every
two hours to yearly, and a session-report pass; millennium
is excluded from both; a federation pull loop when peers are
configured |
MemoryState { New, Current, Deprecated } on an
observation and on the ontology property linked to it, filtered out of
the assembled prompt, the review batch and unified search; an ontology
property in a selected entity is printed whatever its state |
A discrete epistemic state spent on withholding rather than
discounting, on four read paths; two append-only mutation logs, one of
which snapshots the row before and after; a perspective pass that
refuses to run on a layer with nothing live in it; write receipts taken
from INSERT ... RETURNING rather than store-global row
counts; and an admin surface that shows the reviewer the assembled
context block itself |
Default-layer seeding by fixed id leaves every agent after the first
with no layers; the tool dispatcher executes any registered handler by
name without checking what the session was offered, and the
consolidation tool applies no action whitelist outside its three session
prefixes; the Lua tool bridge never injects __agent_id, so
a script names its own; the intake phase discards the LLM response it
asks for; ReconcileOntologyFromObservations is always
handed an empty vector; the ontology namespace and its search arm are
global across agents; and agent deletion runs
DELETE FROM ontology_properties WHERE agent_id=? against a
column nothing writes |
anolisa-agent-memory |
A file beneath a namespace mount, indexed for search; atomic facts are additionally extracted from the component's own audit log by a consolidation pass | The filesystem, one mount per namespace with its own index of
files and files_vec, plus git auto-commit and
tar.gz snapshots for rollback |
BM25 and dense vectors fused by reciprocal rank fusion with time-decay ranking, over the per-mount index; auto-recall injects relevant context before the next prompt | File writes through a kernel-enforced sandbox, optionally auto-committed to git; consolidation is the second writer, extracting atomic facts from the audit log and dropping any candidate whose title or content trips the injection heuristics | No status, no supersession and no tombstone: versioning is git and rollback is a commit or a snapshot, at file or mount level | A namespace is a mount with its own root descriptor and its own index, so separation is physical rather than a key composed into a query; every model-supplied path is resolved by the kernel beneath that descriptor via openat2 with RESOLVE_BENEATH and RESOLVE_NO_SYMLINKS | An MCP server exposing 37 tools, an adapter layer, cgroup limits and a journald audit sink beside the JSONL one; Linux only, requiring a kernel new enough for openat2 | Auto-capture observing at conversation end, a consolidation pass extracting atomic facts from the audit log, an indexing worker, and snapshot and git versioning | None as a field. What protects the store is containment and an injection heuristic, not a state a memory can carry: a flagged search hit is annotated and still returned, and a flagged consolidation candidate is dropped without a durable record | The sandbox is enforced by the kernel rather than by a validator, and the module names the symlink-swap attack it exists to stop; coverage is split into two honest tiers with the weaker one labelled best-effort; escape tests assert the file is absent from the target directory rather than that a call errored; and the audit log records failure branches with their errors rather than only successes | Injection-flagged search hits are annotated and returned rather than withheld, so the decision passes to whatever adapter reads the flag; a rejected consolidation candidate leaves no durable record of the rejection; two of the three namespace kinds are declared and unused, so per-agent separation reads as available when only the user kind is live; and the audit log is per-mount and unsigned |
anything-llm |
A memories row — one sentence of content,
a userId, a workspaceId or null, a
scope of workspace or global, lastUsedAt,
createdAt, updatedAt — at most twenty per user
per workspace and five global per user; beside it, the older agent
plugin's memory, a document chunk titled agent-memory.txt
in the workspace's vector database |
The application's Prisma database (SQLite by default, Postgres optional) for the rows; whichever vector database the workspace uses — LanceDB by default — for the agent plugin's stored text | Every global fact plus every workspace fact when there are five or fewer; when more, the five ranked by the native ONNX reranker against the current message and the last three user turns, falling back to the five newest; appended to the system prompt under a fixed heading; no query, no threshold, no tool | A Bree job every three hours (the code's default; the sample
environment file says fifteen minutes) over each user-and-workspace pair
with at least five unprocessed chats and twenty minutes of idleness: an
observer agent proposes up to three candidates with a confidence and a
reason from the last twenty chats truncated to 1,500 characters each, a
reflector agent classifies scope, drops duplicates and low or medium
confidence, and may update an existing workspace row by id; applied in a
transaction under the limits; by hand from the sidebar or the API; and
by the agent's rag-memory tool into the vector store |
Update in place from the sidebar, the API or the reflector's
update action; hard delete; promote to global or demote to
a workspace under the limits; /reset marks a chat excluded
so it is never summarised; nothing supersedes, expires or is recorded
when removed |
User and workspace on every read, with global facts following the
user across workspaces; a system-wide memory_enabled switch
and a memory_auto_extraction switch, both admin-only in
multi-user mode |
Appended to the system prompt of the streaming chat, the
OpenAI-compatible API and the embed widget by chatPrompt; a
Memories sidebar in the workspace chat with tabs, cards, a modal to add,
edit, delete, promote and demote, and the two toggles; REST routes for
list, create, update, delete, promote and demote; the agent's
rag-memory tool with search and
store actions |
extract-memories under the background worker, added and
removed live when the switches change; nothing consolidates or prunes
the rows, and the caps are the only bound |
The observer's confidence is a filter the reflector applies and then
discards; a row carries no state, no provenance to a chat and no
confidence; the extraction never sees a chat twice, because
markMemoryProcessed runs in finally |
Hard caps that make the store readable in a sidebar; a two-agent extraction whose second stage sees the existing rows and can update rather than duplicate; scope on every read; a reranker over the workspace set so the injected five change with the conversation; extraction gated on idleness and volume | A chat is marked processed on failure and never retried;
lastUsedAt is written at every injection and read nowhere;
the embed widget passes a username string where chatPrompt
expects a user, so in single-user mode the instance's memories are
injected into anonymous widget chats; the older rag-memory
tool stores text as an untitled document nothing lists as memory; 57
unit tests mock Prisma and none exercises a retrieval that must exclude
a row |
aoci-code |
One FRAS line per managed file or database table: compact tags, then F (responsibility), R (relations), A (API) and S (non-obvious constraints), written by the host model | Plain-text Volumes in the repository root (aoci.txt Root, aoci.meta.txt Meta, aoci.code.txt, optional aoci.database.txt) plus .aoci/baseline.json holding each source file's SHA-256 at alignment; all committed to Git | Whole-index delivery through aoci_overview in chunks with a ten-ordinal recall challenge; aoci_get_entries by path, directory or object ref; aoci_search by case-folded substring and tag filter, capped at 30 | Agent-authored through aoci_update_entry in atomic batches under a cross-process lock and index-hash CAS; every Code entry must carry the SHA-256 of the source it describes, re-checked against disk at commit | Overwrite by path. Removal only of an entry whose file is gone, proven from governance facts, in the Volumes layout for every caller; the Legacy CLI lets a person remove a live entry | One repository per index; Volumes partition Code and Database entries physically. No scope key on an entry | stdio MCP server with nine tools; aoci init writes project MCP config and an AGENTS.md rules block for Codex, Claude Code, OpenCode and Cursor; optional Claude Code PreToolUse hook and Codex compaction hook | None. aoci_maintain computes Missing, Stale and Orphan targets on demand; drift is recomputed from file hashes on every call | Staleness only, derived per call from the source hash against the baseline; stale entries are still delivered, with a set-level dirty_or_stale flag in the Overview | Every entry is bound to the digest of the source it was written from and refused if the file moved; all-or-nothing batches with preimage recovery that never overwrites a third-party edit; a delivery challenge that checks the model holds the index; a pre-edit hook that shows the file's entry and warns when it is stale | An aligned entry means the file has not changed, not that the entry is right; stale entries are delivered unmarked by Volumes get_entries; aoci_report, the documented escape for a wrong live entry, refuses in the default layout; the ledger and governance receipts record counts and whole-volume digests, not which entry changed, and are git-ignored |
arc-code |
A log entry — the agent's own plan, the action it produced, and the
resulting state — plus whatever the agent chooses to write into
notes.md and its own programs |
Files in a disposable sandbox, mirrored every 60 seconds into Postgres over Neon's HTTPS SQL endpoint as runs, games, actions and gzipped artifacts | None supplied. The prompt forbids reading the log by eye and tells the agent to grep, sed and diff it programmatically | The broker writes the log, because the broker is the only process that can reach the game; the agent writes its notes with ordinary file tools | Neither for the log. The agent rewrites notes.md
freely, and the archive keeps only the latest version of each file |
One sandbox and one workspace per game; nothing is keyed or filtered by a scope | Stock Claude Code or Codex, headless, six pre-approved tools, no MCP server, no subagent, no custom tool | A 60-second mirror to Postgres and an audit pass that can re-grade every stored session later | No field on a memory. A session carries a machine verdict in
games.audit, and a stricter re-grade lands in
games.reaudit beside it rather than over it |
Log completeness enforced structurally — anything that reaches the game is written down by the thing that forwards it — and 191 sessions of measured failure analysis | The archive detects a changed file by its size, so a same-length edit to the agent's notes never reaches the record |
archeus |
An entity (name, type, one-sentence summary, repo, module, source file) extracted per module by a headless claude -p call, plus relations; a lesson (title, summary, kind, confidence, status) distilled from a session transcript; a heuristic session episode in a separate worklog | One JSON graph per project at .archeus/memory/graph.json, mirrored to the account's encoded project folder, written atomically; worklog.json beside it; hits.log and dirty.log sidecars; a twelve-version snapshot ring | Four rankers (presence-only BM25 over name and summary, path segments, dependency rank, lesson confidence) fused by reciprocal rank, then one or two hops over relations and module import edges, cut to a token budget that fits rather than truncates | Background or on demand: per-module extraction re-run when a file's mtime and size, then hash, change; one lesson call per finished transcript; heuristic episode capture at Stop; nothing written by the session agent | A fact a re-read module no longer emits is marked valid false with invalidated_at and kept up to 30 days, at most 40 such facts; entities beyond a 500-entity cap are evicted by rank plus hits; unpinned lessons decay after 30 scanned sessions unused; a person can evict a lesson | Physical: one graph per project directory, found by cwd; no scope predicate on any read. Lessons are mined from every account's sessions for the project, and cross-project conventions read every project's graph by design | A micro-digest in CLAUDE.md and every other harness instructions file, path-scoped .claude/rules files, an opt-in UserPromptSubmit hook, archeus recall over Bash, a Claude Code plugin with recall, status and review commands, a TUI and a local token-guarded GUI | A detached worker per project under an O_EXCL scan lock: capped extraction cycles, lesson mining, a token-free forget pass that expires invalidated facts and flags facts unconfirmed for 90 days | Lessons are pending until a person approves them or the extractor's confidence clears 0.8; code facts carry valid and a stale flag but no review state; a pending lesson recurring in three projects is promoted to the global CLAUDE.md | Provenance advances only for modules actually extracted, so a failed or capped cycle never marks stale work done; a contentless prompt retrieves nothing; reinforcement credits only what was injected and a preview never logs; snapshot before any shrinking save; every headless call is marked so archeus never learns from itself | Module-edge expansion injects invalidated facts; the extractor can approve its own lessons; unreviewed lessons reach every session on the machine through cross-project promotion; a GUI approval races the background worker on a whole-file write; the reinject-after-compact preset runs a hook that ignores that event |
archiver-rag |
A Markdown note in an Obsidian vault: frontmatter with type, date, tags and related, a title heading, a body, and a Related section of wikilinks the auto-linker owns; indexed as 500-word chunks, each embedded with a prefix naming title, folder, tags and up to eight link targets | The vault's Markdown files are the store of record; a Chroma PersistentClient collection under the XDG data directory holds chunk embeddings from all-MiniLM-L6-v2 with source, folder, type, tags, links, incoming link count, title and mtime as metadata; a centroid cache and a heartbeat JSON beside it | search_vault embeds the query, takes the top n chunks from Chroma (three by default, tripled when a tags filter will trim), optionally prefiltered on frontmatter type, drops chunks below a floor of 0.35 on a (1+cosine)/2 scale, and adds up to 0.20 for a wikilink to or from a context note and up to 0.10 for inbound links; get_connections walks wikilinks breadth-first to depth three | Explicit: the agent calls log_note, which writes type/slug.md and returns; a person writes in Obsidian; either is indexed by a separate watcher process that deletes the note's chunks by source path and adds new ones, then rewrites its Related section from a vector query with a relevance margin | An edit to the file replaces all of the note's chunks on the next watcher event. A second log_note with the same title writes slug-1.md beside the first. Deletion is a move to .trash/ by the CLI, by Obsidian, or by the agent through move_notes; the watcher or a prune then removes the chunks and sweeps Related links to the note | None. One vault per install, shared by every agent and every project the user works on; the only predicate on the read path is the optional frontmatter type, a taxonomy chosen by the writer | A stdio or streamable-HTTP MCP server with six tools (search_vault, vault_status, get_connections, move_notes, log_note, suggest_folder); instruction files for Claude Code, Codex, OpenCode and Copilot that make the vault the first memory to search and the authoritative one to write; a typer CLI and launchd or systemd services | A watchdog observer, run as a login service, that ingests and auto-links every saved note and optionally moves new notes into the folder whose description they best match, rewrites folder descriptions, and spins inbox clusters out into new folders; it does no catch-up on start, so changes made while it is down wait for a manual sync or prune | None. A note is believed from the moment it is written; there is no status, no confidence, no provenance beyond the filename, the folder and a frontmatter date, and a note written by an agent is indistinguishable from one written by the user | The store is plain Markdown a person can read, fix and delete in Obsidian, and every fix reaches retrieval on save; deletion is recoverable and sweeps dangling links; the long-lived server reconnects when another process changes the index; the watcher distinguishes an atomic save from a delete | The 0.35 score floor admits any chunk with cosine above -0.3, so search almost never returns nothing; a second note on the same title stacks instead of correcting; move_notes lets the agent trash notes with no confirmation; the HTTP transport has no authentication and DNS-rebinding protection is off by default; a vault under a dot-directory indexes nothing; search and ingest are untested against a real index |
arcon |
A row in personal_memories — one of six types, a
status, content, an importance 1–10, a confidence 0–1, a source type,
tags, an evidence count, and a nullable supersedes_id
self-reference |
One SQLite file via better-sqlite3 in WAL mode, with CHECK constraints on every enumerated column; entities, facts and conversations in tables beside it | Entity lookup first and, if it returns anything, exclusively;
otherwise a weighted sum over substring keyword matches, importance,
confidence, evidence count, recency band and a status bonus, sorted and
sliced against a minScore that defaults to zero |
An extractor produces candidates — rules or an LLM — and a deterministic review classifies each as CREATE, UPDATE, IGNORE or CONFLICT before anything is written | archiveMemory sets ARCHIVED; the supersede
path writes supersedesId on the successor and sets the
predecessor to SUPERSEDED; five of six statuses are
excluded from normal retrieval |
A scope column over five values, filtered before
scoring — normal retrieval is restricted to USER or
ARCON, so the human's beliefs and the companion's are
separable; PROJECT is queryable and never written,
CONVERSATION is unused |
A chat app, a desktop app and a server over local Ollama, with a voice package and a LoRA inference service | None on a schedule in the memory package; mood, emotion and interest engines update on interaction | A six-value status and a four-value source type, CHECK-constrained in the schema. Five statuses are excluded from normal retrieval and every one has a guarded writer that records its transition in a mutation log; no shipped surface calls those writers | The write path decides CREATE, UPDATE, IGNORE or CONFLICT deterministically before touching the store; a supersession writes a lineage pointer and retires the predecessor; and every negative retrieval test seeds a matching control so it cannot pass on an empty result | A PENDING_CONFIRMATION memory is withheld from
retrieval and no shipped surface can resolve it — the confirm, reject
and contradiction transitions exist on the repository and the pipeline,
and the server exposes no route for them and there is no CLI; and the
exclusion set is a denylist duplicated in two files |
arcrift |
A fact extracted from a captured conversation, plus graph triples and chunks | Local SQLite with FTS5 and vectors; a Neo4j adapter alongside | Hybrid FTS5 plus vector plus HyDE, with sentence-level trimming before injection | Browser extension capture from seven web AI products, plus MCP from four coding tools | Not a focus; the store accumulates captured conversations | Project is the tenant boundary, audited by a live leak test against a spawned server — and a global search path that deliberately crosses it | A browser extension, an MCP server, a dashboard, and a one-command setup | A weekly CI job checking platform DOM selectors and filing its own issues | Nothing on a memory; the graph carries structure rather than status | Committed audit reports, including a cross-tenant canary test against a live process | Capture depends on someone else's DOM, and the CI check covers three of seven platforms |
areev |
A typed grain — thirteen types under a versioned OMS spec, from Fact and Event to Skill, Recommendation and Trigger — content-addressed, carrying two validity intervals, provenance, a verification status and a supersession pointer | A content-addressed store over an embedded SQLite-compatible engine or Postgres, with attachments in a CAS and an append-only op log carrying a hybrid logical clock | CAL, one query language over hybrid recall — vector, BM25, graph traversal by relation and direction — with entity_at taking a world or knowledge time axis, and an optional decision-model reranker | Grains are added, superseded with a justification and an authorisation list, or forgotten; the learning loop proposes changes from recorded history citing evidence by hash, and an optional model leg proposes from a closed vocabulary that never auto-applies | Supersession keeps history and closes the record-time interval in the same write; forget erases from the hot store, clears the FTS text and the CAS bytes, and writes a replicating op-log record | Namespace on every grain and every store read predicate, with grant grains in the file checked by the facade on every gated read, and credentials host-side; the owner session is the implicit superuser | A CLI, an MCP server, JS and Python bindings, an HTTP server, a workflow runtime whose plans declare their memory reads, a sandbox and a conformance kit | None — the project runs no daemon; hooks, cron, CI or the host invoke the loop and the triggers | verification_status of unverified / verified / contested / retracted, kept apart from a confidence float and classified once; extraction stamps unverified or verified, and retracted is caller-authored; retracted is withheld from context assembly in every rendering mode and disclosed to an opt-in audit read and to the DSAR, while the store, CAL, the MCP tools, declared run reads and the bindings return it with no penalty; contested is a demotion, never a withholding | World and knowledge time as a query parameter, a review record with a mandatory reason and a hash chain, a deletion that clears the text and the attachment bytes and replicates, a conformance kit that runs the same negative cases against two storage engines and pins recall as a pure read, and a decision-model seam whose probabilities may reorder but never approve | The MCP tool surface approves and applies builtin findings as agent:mcp, and its areev_cal tool approves any recommendation as the owner session, recorded as a human; retract means a demotion in the trait and an erasure in the real substrate; the withholding lives in one crate that two CLI commands reach; the content hash a value-level tombstone would need is not consulted on re-add |
argo |
An ArchiMate 3.2 element, relationship or view — 96, 140 and 47 of them in the committed graph | design/KG/SystemArchitecture.json is canonical; Neo4j
is a projection rebuilt wholesale, plus a live vector index |
Neo4j native vector search — db.index.vector.queryNodes
filtered on a channel — behind gates that fail closed when the index is
not qualified |
Schema-validated JSON edited by the delivery loop, then
syncSystemArchitectureToNeo4j; the sync clears the graph
and re-creates every node |
MATCH (n {graphKey}) DETACH DELETE n then re-create —
no supersession, no history, no per-element lifecycle in the store |
graphKey partitions a graph; retrieval filters
WHERE node.channel = $channel on the read path |
MCP servers for architecture, validation and system metadata; Cursor, GitHub Copilot and OpenCode bundles | Embedding backfill, index qualification, readiness attestation, and a semantic operator journey CLI | Gate verdicts — qualified, blocked, aligned — attach to the index and the run, never to an element as a field | 27,152 lines of tests to 6,674 of implementation, architecture fitness functions, and retrieval that fails closed rather than degrading | The graph is a rebuildable projection with no correction semantics of its own; the project's own credential-boundary test fails at HEAD |
argos |
A memory_records row — category, content, tags, JSON
payload, embedding, status, source,
confidence, durability, scope,
user_scope, namespace,
client_scope, doc_class,
provenance_origin, grounding,
valid_from/valid_to/superseded_by,
tier, document provenance and embedder provenance — beside
a memory_candidates row for every proposal and a Kùzu
entity graph |
One DuckDB file per tenant (records, candidates, evidence, tombstones, rejection ledger, receipts, access audit, file catalog) and one Kùzu graph (Entity nodes, RelatesTo edges with memory ids and validity), held by a shared RPC service so CLI, gateway and desktop share one writer | ILIKE text search and cosine over local BGE-small vectors fused by
RRF, an optional BGE cross-encoder rerank, phrase lift, feedback and
recency, then alias expansion, graph boost and traversal, chain
annotation; as_of and include_closed widen the
current-only view; a why-not diagnostic explains a miss |
Every turn is mined by regex with an LLM fallback into proposals
that an automatic reviewer may raise only to
reviewed_approved; memory_save writes an
active row directly; structured JSON/CSV ingest and a document watcher
write with source provenance; a class A/B/C external write tier with
idempotency keys and compare-and-swap; both write paths refuse a
tombstoned value or a rejected claim slot |
memory_update chains a new version and closes the old
with valid_to/superseded_by;
memory_delete promotes the predecessor, quarantines a
middle version, or hard-deletes a single version and tombstones its
content; an erase request writes a receipt in the same transaction;
maintenance and consolidation quarantine, never delete;
memory_restore reverses a quarantine |
user_scope on every query, tenant cells as separate
stores, per-tenant ACL of client scopes and document classes with deny
over allow, loopback-only servers with a bearer token and server-derived
identity |
A Hermes plugin exposing sixteen memory_* tools, a
pre_llm_call ambient hook and three slash commands; an MCP
stdio server and a REST server over one facade (auth → ACL → validation
→ audit); a local admin console; JSONL and Markdown export and
import |
A per-turn extraction worker, a prefetch thread, a stale-review sweep, session-end consolidation and junk-entity purge, and three off-by-default passes — archival at 180 days, forgetting at 365, monthly rollups — plus a gated distillation pass that proposes and never writes | A seven-state candidate ladder whose top rung only a person or the
tool path may write, external-origin and grounding ceilings at the
storage boundary, a one-way rejection ledger, an instruction-injection
scan on every write, and a per-record grounding label that
caps what a memory may become |
Deletion and rejection that both write paths remember, an approval invariant enforced in storage rather than in a prompt, a claims audit that maps every README number to a committed artifact and records its own overstatements, and a contradiction test built from this atlas's rubric with a control against vacuous passes | The LongMemEval runs ingest with dedup off into a fresh store per question and, by the project's own audit, never produce a version chain, so the headline numbers measure retrieval plus an answerer and not the supersession machinery; the access log rotates and no event is written for a create or approval; 402 commits in five weeks under a BSL licence with a single maintainer |
artesian |
A MemoryRecord: content, tags, a string-to-string
metadata map, one of four tiers (L0Raw,
L1Atom, L2Scenario, L3Project), a
creation time, an optional confidence, a relation list, three access
counters, a lifecycle state, and six routing keys — scope,
agent_id, session_id, task_id,
user_id and project. Its id is a
SHA-256 over the content, the tier, the node id, and every routing key
that is set, so identity is the value together with where it
belongs |
One of four backends behind a MemoryBackend trait:
Markdown files under a memory directory, sqlite-vec, Qdrant, or
TencentDB; a pgvector store sits beside them. Above the store,
headgate keeps a bounded committed-context state that
serialises to a four-file bundle — manifest, schema, snapshot and a
qualify.jsonl decision log — plus a session anchor in
log.md and subagent lifecycle receipts in
receipts.jsonl |
A hybrid find: keyword hits and vector hits merged by
the trait's default implementation, with every populated routing key
applied as an equality filter first — as a predicate in the files
backend, as a must_eq in the vector backend's own filter —
and a state predicate that admits only Active unless
include_archived is set. A decay function over last access
and access count computes a retrieval strength used for ranking and
eviction, mmr diversifies, and neighbors and
by_entity walk relations as separate calls rather than as
an arm of find |
memory.store over MCP or
artesian memory store on the CLI. The write is synchronous
and local: no LLM call, no embedding service unless the configured
backend needs one. Identity is computed first, and an existing record
with the same id short-circuits the write and returns what is already
there. A per-session lane lock serialises concurrent writes to one
collection. The files backend appends a line to log.md
naming the stored id and node |
Three exits. artesian memory retract sets
Retracted, stamps retracted_at, adds a
superseded_by relation and stores a separate retraction
record naming the retracted node — the original stays readable through
get_node and through a query with
include_archived. artesian memory evict
archives by TTL, LRU, minimum strength or a keep cap, hard-deletes
already-archived records when asked, and appends every decision to
~/.artesian/eviction.jsonl. Neither is exposed over MCP: an
agent can write and read, and only a person at a terminal can retract or
evict |
Six keys on the record and the same six on the query.
MemoryScope is a four-value enum; agent_id,
session_id, task_id, user_id and
project are free strings. A populated query key excludes
every record that does not match it, and the project filter is a union
that admits the shared project beside the named one. The keys also enter
the record's identity hash, so the same sentence stored under two
projects is two records rather than one |
An MCP server exposing twenty-eight tools, nine of them memory:
memory.find, memory.store,
memory.answer, memory.context,
memory.anchor.get, memory.anchor.set,
memory.session.checkpoint,
memory.session.resume and agents.list; the
rest are orchestration and team coordination. A CLI with
init, memory store|find|retract|evict,
tokens, perf and doctor. Python
bindings, a Homebrew tap, a Dockerfile |
No daemon is required for memory. Decay is computed at read time
rather than swept; eviction, consolidation, backfill and the
dream pass are commands a person runs.
headgate compresses and evicts the committed context inline
when the token budget saturates, and the process agent can run an
autonomous loop with a declared budget envelope |
MemoryState is the epistemic field and it filters;
confidence is an optional float and it ranks. The qualify
gate carries a ReasonCode enum — qualified,
below-relevance-threshold, redundant, stale-version, budget-saturated,
drift, gate-rejected — on every admit and reject. Subagent spawns are
fail-closed behind a receipt when
ARTESIAN_RECEIPTS_FAIL_CLOSED is set, and consolidation and
the LLM judge are opt-in |
A scope key that both backends apply inside their own filter rather than after it, with a CI gate that proves the isolation against two present controls; identity that hashes the routing keys alongside the content, so a memory cannot leak across a project by being a duplicate; retraction that withholds without deleting and stays readable for drill-down; an eviction log that records the reason and the retrieval strength behind every archive and delete; destructive operations kept off the agent-facing tool surface | Eviction — and therefore the whole audit log — constructs a
FilesBackend unconditionally, so on the sqlite-vec backend
the README recommends, nothing decays, nothing is archived and the log
stays empty; the eviction log records the computed plan rather than the
applied outcome, and the apply step counts its own successes separately;
the qualify.jsonl and lifecycle.jsonl the
README calls an append-only audit log are written with
std::fs::write, which truncates, so they are snapshots of
an in-memory vector; the OCF spec files the receipt and bundle code say
they mirror exactly are not in this repository; retraction blocks a
re-store only because identity is a content hash, so a paraphrase
re-enters as Active; no validity time anywhere, so a memory
that was true last quarter and false now has no way to say so |
athena |
A Markdown file under .context/ — session log, canonical fact line, case study, protocol, user profile — written by the agent through a session routine | Plain Markdown as the source of truth; a local SQLite FTS5 index rebuilt from it; optional Supabase pgvector tables for sessions, case studies, protocols and chunks; a file-watching daemon keeps a files/tags/links SQLite catalogue that no search channel reads | Five channels fused by intent-weighted RRF with a cross-encoder rerank on when sentence-transformers is installed: canonical-line keyword match, pgvector, FTS5 BM25, filename find and framework-doc grep. Archive paths are skipped by the bulk vector sync and the filename and framework channels, and indexed by FTS5 | Session logs appended by the quicksave MCP tool and written at /end; a shutdown script copies tagged learnings into SYSTEM_LEARNINGS.md and USER_PROFILE.yaml by rewriting them | Curation by the user editing Markdown; an archive script moves session logs older than 30 days under .context/archive/; FTS5 forgets a removed file at its next rebuild, at most 24 hours later | None; one person's store. Supabase row-level security separates service_role from anon, not one owner from another | An MCP server of nineteen tools, a CLI, Markdown workflows and skills, and committed Claude Code hooks on prompt submit, tool use and stop | None scheduled by the package. The SDK shutdown spawns a vector sync whose module has no entry point; auditors and an archive script run when invoked | A three-label convention (code-enforced, agent-discretion, aspirational) on documents and a three-tag convention on claims in case studies, both prose; a Stop hook refuses a reply asserting engine results, or the phrase code-enforced, without a decision receipt | The README publishes what is enforced in code and what is prompt, row by row, beside a retrieval benchmark restated downward when a lenient matcher was found inflating it; the docs cite the sycophancy literature against the product's own mechanism | No memory carries a status, so the epistemic vocabulary never reaches a retrieved document; the flight recorder named as the action log has no caller; one retrieval channel indexes the archive the others exclude; the background vector sync at shutdown runs a module with no entry point and discards its output |
atomic-agent |
Memory, lesson, profile fact, and procedure, linked by typed edges | SQLite with versioned migrations; profile facts kept as a supersession chain on one time axis | FTS5 BM25 with one-hop link expansion, an opt-in embedding arm, a heuristic-gated query rewriter on by default, and vote-blended lesson and procedure ranking | Consolidator clusters; lessons and procedures from one LLM call per cluster | supersedes/superseded_by chains under a
partial unique index; deprecation retains the row; a 500-fact cap on
active unpinned profile facts deletes the lowest vote_score
first; a one-way Obsidian export reads the corpus without mutating
it |
A working_dir column filtered on the read path when the
caller asks — scope defaults to all, and on
the memory.notes.recall tool the model chooses it; profile
facts carry no scope key |
Agent runtime with a separate reflection slot | Consolidator, reflection, neighbour evolution, vote runner | A FIFO-capped vote_events log written in the same
transaction as an in-place, decayed vote_score, which by
default orders memory and profile eviction, deprecates lessons and hides
profile facts; surfaced-id allowlist |
Numbered invariants cited from code, a supersession chain enforced by a partial unique index rather than by convention, and deprecated lessons asserted out of recall | Large surface on by default with its evaluation results gitignored; model votes reach deletion; three timestamp columns that always carry the same value, so the history is versions rather than validity |
attune-ai |
Three units. A raw finding of at most 500 characters with type, session id and cwd, extracted at session end; a curated Markdown file per topic and kind, or per promoted node; a classified pattern record in the unified store | Raw stash in ~/.attune/session_stash/findings.jsonl, or the Redis Agent Memory Server when reachable; curated Markdown under ~/.attune/memory with a per-corpus .verdicts.jsonl; patterns as JSON files in ~/.attune/memdocs_storage | Raw stash by keyword overlap plus a 3-day recency half-life, or AMS semantic search; SessionStart injects the newest five by recency. Curated recall by keyword ranking through attune-rag; lessons by keyword ranking above a score floor on each prompt | A Stop hook asks a local Ollama model for up to five findings once per session, falls back to a keyword heuristic, runs a PII and secrets gate, and appends. Agents also write through session_memory_capture, personal_memory_capture and memory_store | Raw findings expire after 30 days, are deleted by id from /recall drop or review, and are forgotten at session start when every PR they cite has merged or closed. Curated files are overwritten in place or deleted by topic. No tombstone keyed on a value | cwd is stored on every raw finding and used only to sort same-project findings first, so other projects' findings fill the session-start block. AMS reads filter one install-wide namespace. Pattern retrieve checks workspace and owner; pattern search does not | Claude Code plugin hooks on SessionStart, Stop, PreToolUse, PostToolUse and UserPromptSubmit; an MCP server with memory_, personal_memory_ and session_memory_* tools; a /recall skill and an attune CLI | None scheduled. The Stop hook extracts once per session, prunes expired findings and scores the session's surfaced memories as acted_on, ignored or wrong for telemetry; a weekly SessionStart nudge names curated memories due for review | Every recalled body is wrapped as untrusted evidence with instruction-shaped text flagged. Curated memories carry a settled, check-before-acting or suspect label from age, type volatility and the latest human verdict; a wrong verdict labels and never withholds | Writes report False unless a readback proves persistence; one envelope renderer for every recall surface; a digest binds each verification to the text it verified; deletion by short id refuses ambiguous prefixes; PR-referencing notes expire when the PR closes | The session-start block is headed as this project's findings and includes other projects'; the review-gated stash-to-curated promotion has no caller outside tests; pattern search bypasses the access check retrieve applies; verdicts are keyed on filename stem, which collides across personal-memory topics |
aukora-kernel |
A hash-chained entry — payload (actor, chainKey, seq, operation, tier, contentHash) plus plaintext that a forget erases | Two paths: a local JSONL store with an independent JSONL receipts
log, and a Convex aukora_memory table behind a
delegation-manifest pipeline |
recall returns active entries for a chainKey in seq
order, banner-marked advisory; the Convex path requires a reader
proof-of-possession |
Authority-gated through the same gate as every tool — locked session pauses, an apparent secret denies — then chained, receipted, fsynced | forget erases the plaintext, tombstones the row, keeps
the hash link and appends a forget receipt; nothing blocks re-asserting
the same content |
chainKey filters every read; the Convex path binds
owner, subject and resource scope and severs a revoked subject |
A CLI, an IDE agent (Auma), and the Convex kernel pipeline of grant, intent, decision token and receipt | None on the memory path | Receipts, hash chain and per-entry actor; recall is advisory and can never authorize an effect | Receipt-coupled fail-closed writes; RTBF that erases plaintext without breaking the chain; limits documented inline | Forget records a rejection it never consults, so the same content can be written again; tiers are declared and never applied |
aura |
Depends on the tier — a JSON record under a family, an episodic row,
a vector, or a BeliefMutationRecord keyed
namespace:key |
SQLite, a vector store, per-family JSON files, and a receipt store with a SHA-256 hash chain beside it | Hybrid dense plus lexical scoring, gated by an epistemic firewall that clusters near-duplicates before counting corroboration | Two paths — a fail-closed gateway that rolls back when its receipt cannot be emitted, and a facade whose governance block degrades open for non-user-facing writes | Retention is RAM-scaled keep-counts per tier; a contradicting claim cannot overwrite a trusted belief, and the rejected value is stored but never consulted | user_id normalised and carried on chat-turn and episode
records; no tenancy boundary and no default scope on recall |
A self-hosted daemon with a desktop app, tools, skills, sensors and an autonomy engine — memory is internal, not an exposed service | Consolidation, synthesis, defragmentation, scar healing and pruning, all inside the running process | active | trusted | contested on a belief record, gating
autonomous writes that touch a contested key, with a resolution API and
a six-hour freshness window — none of it persisted |
A tamper-evident receipt chain that detects modification, insertion and deletion, with sixteen tests that passed when run at the first pin; and a claims ledger that names what the project cannot prove | The belief ledger is a process-lifetime dictionary, so every trust
state resets on restart, and the contested flag that is
persisted on memory records is read by nothing |
auraos |
A turn appended to a plain-text transcript as
[ISO-8601] ROLE followed by the text; plus the
core/ folder read whole as permanent identity |
histories/USER_ID.txt on the server, one file per
caller-supplied id; an unused second server keeps
users/UID/memory.json, and a browser client writes a
user-held HISTORY.txt |
None. The entire history file is read and spliced into every prompt — no search, no ranking, no budget, no cutoff | Two appends per turn, synchronous, after the model responds. Nothing extracts, deduplicates or consolidates | Nothing in the code. Correction means editing the text file by hand | user_id arrives in the request body, defaults to
default, is never validated, and is interpolated straight
into a file path |
A Flask server in front of a local Ollama model, with a static frontend; separately a Tkinter shell, a stub reply function, and a PyQt6 launcher whose server.py is committed only as bytecode | None. A knowledge distiller exists as a standalone script with hard-coded Windows paths, and its output reaches no prompt | None on a record. The identity file instructs the model not to fabricate and to say when it is uncertain | A distillation prompt that argues against the corpus's usual consolidation, asking to preserve contradictions, uncertainty and emotional context rather than flatten them | The caller names the memory it reads and writes, the path is unsanitized, the server binds every interface and allows every CORS origin by default, and the prompt grows without bound |
aurora |
A chunk of code or documentation with an ACT-R activation record and typed relationships | SQLite in WAL mode with chunks, activations, relationships, a file index and a document hierarchy | A three-signal hybrid — BM25 0.3, ACT-R activation 0.3, embedding similarity 0.4 — inside a nine-phase pipeline that verifies the plan before executing it | Indexing of a codebase into chunks with a base-level activation seeded per chunk | Activation decay and reindexing; no supersession, no rejected-value record | None on the read path — the store is one codebase | A CLI, an LSP package, an MCP surface and a spawner for sub-agents | Query metrics, a decomposition cache and a schema-version migration path | Groundedness and activation scores; nothing epistemic on a chunk | Verification is a pipeline phase with an adversarial option, run before the expensive work | The documented retrieval-quality gate passes parameters the verify function does not accept |
auto-company |
One file, now with two governed regions.
memories/consensus.md holds the cycle log, decisions,
active projects, company state and next action as agent-owned prose,
plus ## Human Overrides and
## Priority Issues, which are the only sections with a rule
attached to them |
A single markdown file under memories/, which
.gitignore excludes along with everything in that directory
except the template; plus a .bak baseline per cycle, a
timestamped snapshot of every consensus a cycle successfully produced
under memories/snapshots/, and an exclusive-create copy
under memories/resets/ before any reset |
None as a mechanism. The loop pre-loads the file into the prompt and tells the model to read it from disk if that did not happen; there is no query, no index and no selection | The prompt requires the model to rewrite the consensus before the cycle ends. Two validators then read it: the loop greps for three headings, and the guard parses the two governance headings, requires each exactly once in canonical form, and byte-compares the Human Overrides section against the pre-cycle baseline | The file is still replaced wholesale each cycle, but a successful cycle now leaves a timestamped snapshot, so the series of past documents survives; there is still no supersession and no diff, and a cycle that fails leaves no snapshot of what it wrote | None. One file per installation | A launchd or systemd user daemon runs the loop behind an advisory
lock; fourteen agent personas and thirty-six skills are markdown files
under .claude/, with an English translation set under
i18n/; the engine sits behind a named adapter contract; a
small Python server and a browser dashboard render a preview of the
consensus, the cycle log and the usage ledger |
The loop itself — preflight, baseline, read, decide, execute, rewrite, verify, snapshot, sleep — with a circuit breaker on consecutive errors, a usage-ledger budget pause, an advisory lock on the pid file so two loops cannot own one checkout, and a pending marker that forces governance recovery after a kill | None on a claim. No status, confidence or provenance on anything the consensus records; the one discrete state in the file is a priority item's checkbox, which gates the whole cycle rather than any single read | A human-owned region of the memory the agent cannot keep a change to — byte-compared around every cycle, restored and paused on violation — plus a blocking priority item checked before the model is invoked, snapshots of every successful consensus, and a governance suite that drives the real loop under SIGTERM and SIGKILL | Only one of the two human sections is byte-compared, so a cycle may
rewrite Priority Issues — including checking off a blocker — and pass
verification; the agent-owned body is still validated by heading
presence alone; and the README showed an MIT badge over no licence file
until the 2026-09-19 pin, which added a root MIT
LICENSE |
autobot-ai |
Several: a knowledge-base fact (content plus a metadata JSON with provenance, owner, visibility and collection), a scored chat trajectory, a verbatim turn chunk, a memory-graph entity with observations and relations, a working-memory key, and a SQLite memory entry | Postgres knowledge_facts as system of record with Redis hash and ChromaDB projections; ChromaDB collections for trajectories and verbatim chunks; RedisJSON entities for the graph; Redis for working memory; SQLite for the general manager | An always-loaded Essential Context block of up to 800 tokens ranked by quality_score plus bounded usage and recency boosts; hybrid vector and BM25 RAG over facts with reranking; top three similar high-reward trajectories; graph lookups and traversal on the MCP and admin API | Background after each chat turn: verbatim chunks via Celery and a judged trajectory capture; a per-turn fact-extraction task that calls a method no class defines; explicit fact writes from uploads, connectors, the research endpoint, agent diaries and an agent tool | update_fact overwrites content and merges metadata; delete_fact removes the row and its projections; a per-user privacy API lists, forgets and amends across six stores that do not include the fact store; graph entities are invalidated with valid_to rather than deleted | Per-store: required user_id predicate on the SQLite store and verbatim search, user and tenant predicate on trajectories, owner and visibility filters on the explicit KB search APIs; none on the Essential Context block or the chat RAG path; graph API admin-only and global | Built into the platform's chat workflow; a read-only MCP server with kb and memory tools; REST routes for memory privacy, the graph, verification and research | Celery tasks per turn for verbatim writes and fact extraction; nightly trajectory consolidation at 04:00 UTC and fact pruning at 04:20 UTC, the latter inert until an epoch is configured | Research claims are quarantined by a collection value and promoted only by a corroboration gate; verification_status carries unverified, verified, disputed and rejected, and no read filters on it; a model-scored reward gates which trajectories are recalled | A durable Postgres row ahead of rebuildable projections; an owner predicate that cannot be omitted on the SQLite store; a user and tenant predicate with a backstop on trajectories; fuzzy entity-name writes refused; a sentinel type for the one deliberately unscoped caller; injection sanitising and credential redaction at the fact write chokepoint | The Essential Context block injects up to 200 arbitrary facts per turn with no owner or quarantine filter; chat RAG has no owner predicate; the per-turn fact extraction fails on every call; forget-everywhere omits the fact store and matches trajectories on agent_id, which no writer sets to a user |
autogen |
MemoryContent — content, a MIME type and optional
metadata. There is no identifier field |
Interface only. Ships an in-process list plus ChromaDB, Redis, Mem0 and a text-canvas adapter | query(query) returning MemoryQueryResult;
the default returns everything in chronological order |
add(MemoryContent), called by the application or by a
task-centric memory sample; no extraction in the core |
clear() wipes the store. There is no targeted delete in
the protocol or in any shipped adapter |
Absent from the protocol. Only the Mem0 adapter carries
user_id, and it defaults to a fresh UUID |
update_context lets memory inject itself into the model
context; components are declaratively configured |
None in the core; the task-centric memory samples add their own learning loops | MIME type and free-form metadata; no provenance, confidence or state | update_context as a first-class injection point; a
small protocol that is genuinely easy to implement |
No identity on a memory, so targeted deletion is not expressible; scope is an adapter's option, not the contract's |
autoharness |
A skill folder: SKILL.md with name, description and category frontmatter and a body capped at 25 non-blank lines, optional scripts, templates, assets and references subfiles, a .sidecar.json of counters and a .ledger.jsonl | Plain files under .claude/skills in the project (the main worktree root inside a linked worktree) and ~/.claude/skills; counters, intent queues, run accounts and snapshots under .claude/autoharness | No search. SessionStart injects an index of every live self-authored skill in both layers, grouped by category, one 60-character description per line; the host's own description-based recall runs unchanged underneath | Background: after 50 main-session tool calls a detached claude -p child running a haiku reflector stages intents through the stage_skill MCP tool, and a deterministic promoter lints and lands them atomically when the child exits; the main session and /learn stage into a queue drained at each Stop | Update, patch and remove_file intents require created_by agent in the sidecar; delete and lifecycle eviction move the folder to .archive, revived only by moving it back. Create checks neither ownership nor an existing SKILL.md | Physical: a project layer and a global layer as separate directories, with no scope key on a skill and no read predicate; the same name in both layers makes every later modification of it fail as ambiguous | Claude Code plugin: SessionStart, Stop, PreToolUse and SessionEnd hooks all route to one dispatcher; a hand-rolled stdio JSON-RPC stage_skill server; reflector and curator subagents; a /learn skill | Reflection per 50 tool calls, with a SessionEnd flush of the remainder; a curator folds the whole self-authored library every 250 Stops after tarring both skill trees; lifecycle archival recomputed at every SessionStart | None as state. A promoter lints safety regexes, structure, a trigger cue in the description, body length and required reason and evidence; no person approves a skill, and the index tells the model it MUST consider loading any match | The model only proposes and a single deterministic writer lands, validating in memory before any write; atomic temp-and-rename persistence; evidence slices redacted and content-addressed by the promoter so the model never names them; opportunity-relative load rate with probation and a view pardon; archive instead of delete | Create overwrites and adopts a same-named hand-written skill; the MCP tool drops absorbed_into, so every fold is recorded as a plain retirement; lifecycle archival writes no ledger entry and re-archiving a name deletes the earlier archived folder; no human gate on a skill injected as MUST consider |
automem |
A Memory node in FalkorDB: content up to 2,000 characters, tags, importance, type from a seven-value set with a classification confidence, timestamp, t_valid, t_invalid, updated_at, last_accessed, metadata JSON; a Qdrant point with a payload copy; typed relationship edges | FalkorDB for nodes and edges and Qdrant for vectors behind a Flask HTTP API, run with Docker Compose or deployed on Railway | GET /recall: Qdrant vector search, a graph keyword search and a metadata search, blended with fixed weights, optional relation and entity expansion, then a current-state pass that drops archived, expired, not-yet-valid and superseded memories and injects the head of each supersession chain; id fetch and tag listing skip that pass | POST /memory or a batch of up to 500; the service mints a UUID, auto-summarizes content over 500 characters, classifies the type, writes the node, queues an embedding and an enrichment job. Clients write explicitly; the mcp-automem client adds a supersede mode that stores the replacement, closes the old memory's validity and links old to new | PATCH /memory/id rewrites fields in place with no re-enrichment; DELETE removes one node and its point, or every memory carrying any of the given tags with no dry run; no tombstone | None on the row. Tags are a filter the caller may pass; one graph, one collection and one bearer token for every client | HTTP API; the mcp-automem stdio MCP client and installer for coding-agent hosts; a bundled SSE and streamable-HTTP MCP bridge with the same six tool names and no supersede mode | Embedding and enrichment queues, daily decay, weekly creative association, monthly clustering into MetaPattern nodes that recall excludes; controlled forgetting and identity synthesis off by default | None as a status. The current-state pass acts on validity, supersession edges and a decay archive flag; confidence is the type classifier's and only ranks; supersede metadata written by the client is never read | Default recall suppresses expired and superseded memories and substitutes the chain head, bounded and cycle-safe; server-minted ids; content size governance with the original kept; decay and forgetting shipped disabled; MetaPattern artifacts excluded at one chokepoint | The embedding worker drops t_valid and t_invalid from the Qdrant payload, so the vector arm returns memories whose window has closed; tag listing and id fetch skip the state pass; bulk delete by tag; update keeps entity tags of replaced text; consolidation hardcodes the Qdrant collection name; the Qdrant recovery script rebuilds nodes without validity or edges |
autoresearchclaw |
A MemoryEntry — id, category, content, metadata,
embedding, confidence, created_at,
last_accessed, access_count — or, on the path
that outlives a run, a generated arc-* skill directory
holding a SKILL.md |
JSONL per category, rewritten whole on save, under a store directory
the pipeline places inside the current run; skills under
~/.metaclaw/skills and
~/.researchclaw/skills |
Cosine over embeddings with a time-decay weight and confidence factored in, per category | add with an embedding and a starting confidence;
update_confidence applies a clamped delta;
prune trims a category to a cap |
No status, no supersession, no delete by value. prune
drops the lowest-ranked entries once a category exceeds its cap |
By category — ideation, experiment, writing — which separates kinds of memory rather than principals; and by run directory, which is where the separation actually bites | A CLI, an MCP server, an OpenClaw integration, a dashboard and a large human-in-the-loop subsystem that governs the pipeline's artifacts rather than its memory | Lesson extraction after a run, a MetaClaw bridge that promotes high-severity lessons to skills, and a prompt overlay assembled per stage | A confidence float updated by a clamped delta, plus
access_count and last_accessed. No status, no
provenance beyond a free-form metadata dict |
The prompt overlay is built in two labelled sections and the code names which of them is cross-run, so the boundary between per-run state and durable memory is written down where it is decided | No memory class is constructible outside the test suite — the single
production call passes store_dir= to a constructor that
takes (store, retriever), raises TypeError
into a debug-level except, and leaves an empty
experiment_memory/ directory behind;
IdeationMemory and WritingMemory have no
production caller at all; and the self-evolution store whose docstring
promises to inject lessons into future runs is built at
run_dir/evolution by both of its callers |
basemode |
An RDF subject in an ops: ontology of about twenty
declared classes — Decision, Task,
Goal, Handoff, Person,
Project, Entity, Reminder and the
rest — carrying ops:createdAt, an unvalidated
ops:status, and typed edges, beside AST-derived entities
for the workspace's own code (functions, callers, imports, dependents)
mapped by a tree-sitter pass |
Oxigraph over one N-Quads file per tier —
<ws>/.base/graph.nq for a workspace and
~/.base-gbl/.base/graph.nq for global — with writes routed
into per-workspace named graphs inside it, an append-only
changes.jsonl beside each graph, and a sync ledger for
cross-machine replication |
SPARQL against the tier's store, composed per hook moment rather
than ranked: session start returns the working set, the active notes and
the handoffs, the prompt hook returns matching domain rules and prior
decisions, the pre-tool hook returns the rules and shape of the file
about to be read, and the post-tool hook returns the call chain for the
lines just returned. A
FILTER NOT EXISTS { ?x ops:supersededBy ?y } is spliced
into recall, both rules blocks and the prompt neighbourhood; the
session-start memory block and learn --list select
status active instead, which the supersession writer leaves
in place |
Synchronous CLI and hook writes under a file lock, loaded and mutated inside the lock, serialised to a temp file and renamed atomically; the changes line and a doorbell notification to any running app both fire after the rename lands, never before | Correction is a supersession edge and nothing is re-pointed:
new ops:supersedes old with the inverse and a
superseded status in one INSERT, A→B→C left as three
records and two edges, resolve_head walking forward to the
live end, and would_cycle refusing a loop at write time.
The INSERT adds the status without deleting active, and the
sync of domains.toml deletes every triple on a synced rule,
the edge included. Removal is a separate verb whose guard and DELETE ask
the same wildcard question |
Two tiers as two files, selected by
find_workspace_base(cwd), and per-workspace named graphs
inside a tier that writes are routed to and no hook query filters on.
One read-path predicate exists: the session-start working set keeps
projects whose ops:path resolves to the current registered
workspace or to none. Notes, rules, decisions, tasks and handoffs are
read across every named graph in the tier |
A single Rust binary wired into all four Claude Code hooks — session start, prompt submit, pre-tool, post-tool — installed by a shell or PowerShell one-liner, plus a CLI of graph verbs, a Svelte dashboard, a doorbell socket for a running Electron app, and a plugin and extension surface. Hook output is trimmed to a byte budget before it is printed. Codex and Antigravity are named as coming | None on a timer. Session start runs three passes: graph compaction
when a tier has grown past a threshold, backup-first and cooldown-gated;
an archive of reminders ten days past due; and a deferral pass over cold
handoffs, forks, tasks and milestones, gated on
[defer] enabled, false by default. The supersession audit
runs inside base doctor rather than at write time |
Provenance is the changes log and the supersession chain.
ops:status is a lifecycle label — six declared values, 44
in the author's measured store — that the working set and the memory
block filter on; no value separates a candidate from a verified
record |
The source comments are incident records: a dated quad count proving a declared predicate had never been written, a status-value census that explains why the label is not trusted, a numbered bug where a wildcard guard and a scoped DELETE disagreed, and tests that name the release they were red at and carry a control that must stay green | The session-start memory block serves a superseded note beside its
correction, because it filters on a status the supersession writer adds
to rather than replaces. Within a tier nothing scopes notes, rules or
decisions to a workspace. Correction is keyed on the record, and a sync
of domains.toml erases the edge on a synced rule |
basic-memory |
Canonical Markdown note; indexed entity, observation, relation | Filesystem source + SQLite/PostgreSQL projection | FTS5/tsvector, optional semantic chunks, hybrid score fusion, graph context | MCP/API writes accepted Markdown; file watcher reconciles human edits | Distinct create/replace/edit/move/delete with stable ID and reindex | Project, workspace, tenant, local/cloud route | MCP tools, typed clients, API, CLI | Watcher, startup reconciliation, indexing workflows | Human-visible source/checksums; no candidate/verified state | Inspectable portable memory with rebuildable indexes | Bidirectional sync complexity; agent can write unsupported claims |
beads |
One string under a caller-named or derived key, stored as a kv.memory. row in the config table. No author, timestamp, type, source or status | The config table of the workspace's Dolt database, beside settings and generic kv rows; embedded, a local SQL server, or a proxied server | None by relevance. bd prime injects every memory in alphabetical key order, optionally capped by count or bytes; bd memories filters by case-folded substring over key and value; bd recall reads one key | Explicit: bd remember, POST /v0/beads/memories, or bd import. The key is the caller's, verbatim, or the first eight words of the content capped at 60 bytes; an existing key is overwritten and reported as Updated | Overwrite in place; bd forget and DELETE /v0/beads/memories/{key} delete the one row. Each write is one Dolt commit. No tombstone | Physical: one Dolt database per workspace, or the shared beads_global database. No key on the row; every clone of a workspace's remote shares its memories | SessionStart hook installers for Claude Code, Codex, Gemini and Cursor run bd prime, which re-fires after compaction; an HTTP API behind a shared bearer token; export and import as JSONL | None. Memories travel with Dolt push and pull, and a merge conflict on memory rows alone is resolved to the remote's value | None. Every memory is injected as a heading and its text | Read-then-write in one transaction, so Updated and Forgot report the row that was really there; a guard against storing a command name or a bare key as content; a read failure is announced in the injected block, not silent; opt-in injection caps with an elision banner; kv set refuses the memory prefix | Remote-wins conflict resolution overwrites a local edit on pull, announced only on stderr; caps drop memories alphabetically rather than by use or age; import bypasses the key validation and can store a row recall and forget refuse; memories replicate to every clone and remote |
beever-atlas |
An atomic fact — the memory text, a quality score, a tier, a cluster id, the channel, platform, guild, author and message timestamp it came from, topic, entity and action tags, an importance, graph entity ids, source media and link lists, a validity pair, supersession pointers in both directions, and a contradiction flag | Weaviate for facts and their vectors, MongoDB for documents and wiki pages, and a graph store with Neo4j and NebulaGraph adapters | Four methods over one collection — a paginated list, a keyword search, a semantic search and two hybrids — each scoped to a channel and tier, with the retired-fact exclusion applied after the fetch on three of them | Connectors ingest chat from Slack, Discord, Teams and Mattermost; an extraction worker emits atomic facts; a maintainer routes each fact deterministically to the wiki pages it affects and rewrites only those sections | A supersede operation stamps the old fact with an invalidation time and a pointer to its successor rather than deleting it, and marks a conflicting pair as a potential contradiction. Wiki pages are versioned with archived snapshots | Channel and tier, built into every store query as filters rather than applied to the results; a fact also carries its platform and guild | An MCP server, a chat bot, a web front end, and a Google ADK agent layer with memory tools | A debounced wiki maintainer that collapses a burst of extraction events into one rewrite per page, a batch processor, and a consolidation service | A quality score and an importance on the fact, a supersession stamp that withholds it from most reads, and a contradiction flag that is written and never read on any retrieval path | A scope filter compiled into every query with no unscoped branch; an exclusion whose placement is explained by a store limitation and pinned by a regression test that asserts what must not reach the query; a maintainer that routes deterministically and calls the model once per affected page, preserving unaffected sections byte-identical; and a durability gap named with its worst-case bound rather than left to be discovered | The keyword search carries no supersession filter and is what all
four hybrid call sites fall back to inside
except Exception, so a retired fact returns exactly when
retrieval is already degraded; potential_contradiction is
written by the supersede path and read by nothing; the exclusion runs
after the fetch, so retired facts consume top-k slots; and
invalid_at is tested for presence rather than against the
clock, so a future-dated invalidation retires a fact immediately |
beevibe |
A memory fact — an agent id, a three-value scope, a five-value fact type, the text, a 1536-dimension embedding, and the session ids it came from. Separately, core-memory blocks that sit in the agent's system prompt | One Postgres database with pgvector, an HNSW index on the fact embedding, and a composite index on agent and scope | Cosine similarity over the HNSW index with a recall floor and a
per-briefing cap, bound to one agent and asked for all three scopes; the
same pipeline serves the session-start briefing and the mid-session
search_context tool |
An MCP save_memory tool embeds the content, looks for a
neighbour above 0.88 cosine in the same agent, scope and fact type, and
either LLM-merges into that row or inserts a new one |
A merge rewrites the existing row's content, re-embeds it and unions the session ids. Promotion updates the scope in place. There is no deletion path in the memory service and nothing is keyed on replaced content | Agent ownership, enforced as a predicate on every read. Scope is a second column recording the saving agent's tier — ic, team or org — which narrows the write-side dedup and is always requested in full on the read | A pnpm monorepo of six packages — api, core, daemon, sandbox, scheduler, web — with an MCP server exposing memory tools to agents and a React dashboard for people | A post-session promoter that asks an LLM whether each fact written during the session should climb a tier, a scheduler that dispatches tasks, and bounded agent-to-agent negotiation that escalates to a person when the round cap is hit | None on the fact. confidence existed in the first
schema and was dropped by a later migration as unread;
fact_type is a write-time genre — belief, pattern, gotcha,
preference, decision — not a status, and nothing withholds a fact from a
read |
A read path with no unscoped branch; a dedup that refuses to merge across tiers and says why; a migration that removes four fields with the explicit finding that no caller populates or reads them; and a negotiation model with a round cap that hands a stuck disagreement to a human rather than looping | The promotion audit table has a migration, a Postgres adapter, an API view counting its rows and a dashboard page, and its only writer sits behind an optional dependency the single composition root does not pass, so the count is structurally zero; promotion widens a label rather than an audience, since every read binds the owning agent; and seven package manifests declare floating ranges with no lockfile beside them |
bifrost |
A conversation frame — the user query and the agent's final answer concatenated, titled with the session id and a timestamp | One Memvid .mv2 file per tenant and session, named
agent_{tenant}_session_{session}.mv2 under a base
directory |
Delegated to Memvid's own search, exposed as a single agent tool taking a query string | One commit per completed turn from the swarm overseer, with failures logged and swallowed | None found — the wrapper appends, and exposes no delete, supersede or retire path | The tenant and session are the filename, so separation is a file boundary rather than a predicate | A tool named memvid_agent_memory_search, registered on
the agent builder alongside the other tools |
None in the memory path | None in the memory path; the runtime's guardrails and RL audit trail sit elsewhere in the tree | The wrapper is small enough to read in one sitting and does the
honest thing at both ends: the search tool and the commit are
constructed from the same
(tenant_id, session_id.unwrap_or("anon")) pair, so what an
agent can read is exactly what this runtime wrote for it — there is no
asymmetry between the write key and the read key, which is the bug this
shape usually has. A commit failure is logged at error level rather than
propagated, so a memory write cannot fail a user's turn. And the wider
runtime is candid about its own staging:
INTEGRATION_STATUS.md, PHASE_A_SUMMARY.md and
COMPLETION_SUMMARY.md sit at the top level, which tells a
reader which parts are finished before they go looking |
The tool's description tells the model it is searching "your
absolute long-term memory for past conversations, facts, or context you
have stored", and the store it reaches is one file per session. Past
conversations therefore means earlier turns of the current conversation
— unless the session id is absent, in which case both the write and the
read fall back to the literal "anon" and a tenant's whole
session-less history pools into a single shared file, which is the only
configuration in which the description is accurate. Nothing in the
148-line layer supersedes, retires or de-duplicates: each turn appends
the query and the answer concatenated, so a fact restated ten times is
ten frames, and there is no delete path at all. Scope is the filename
rather than a predicate, which is the physical-partition shape this
atlas does not count as enforcement. The tree also carries
.backup copies of two source files committed beside their
originals in src/ |
binder |
A record: a uid, an optional unique key, a type from the workspace schema, and a JSON fieldset validated against field definitions. Types and fields are themselves config entities in the same graph | One SQLite file per workspace with records, configs and a hash-chained transactions table; a transactions.jsonl journal mirrored on every commit; an undo.jsonl redo stack; Markdown files rendered from records by navigation rules | Structured filters compiled to SQL over JSON fields, plus a $text substring LIKE across every text field; results in insertion order with cursor pagination, no ranking. Relation fields can be expanded into nested includes | Explicit: the MCP transact tool, CLI create/update/delete, POST /api/transactions, tx import, or a saved Markdown file the LSP diffs back into changesets. Each write is one transaction with full prior values; a create carrying an existing key updates it | Updates patch fields; $delete hard-deletes the row and the transaction keeps every prior value. undo, transaction rollback and squash revert by applying inverses and then delete the transactions from the table and the journal | Physical: one workspace per directory, one database per workspace. No scope key on a record and no predicate on any read | A stdio MCP server with three tools (schema, search, transact); a CLI and four agent skills; an LSP for VS Code, IntelliJ and Neovim; a loopback HTTP API with a record browser. Nothing is injected into an agent's context automatically | None. Commit subscribers re-render Markdown, reconcile the journal against the database, clear the redo stack and run configured shell hooks, all synchronously after each commit | None. Schema validation at write time is the only gate, and an agent's record is live on commit. Provenance is the workspace author for every surface, with channel cli only on CLI commands | Every transaction carries full before and after values under a SHA-256 hash chain that journal verify recomputes; writes serialise behind a version check inside an immediate SQLite transaction; edits in Markdown become typed transactions; a redo stack | undo, rollback and squash delete history from both the table and the journal while the docs call it append-only; MCP and LSP writes are indistinguishable in the log; deleted values stay in the log; substring retrieval with no ranking; create silently upserts on a colliding key |
bitterbot-desktop |
A chunk with an embedding, an importance score, two lifecycle columns, hormonal and somatic scalars, a sensitivity tag and a provenance chain; above it a canonical fact addressed by key; beside it entities and relationships in a knowledge graph | One SQLite database with sqlite-vec vectors and FTS5, carrying
chunks, canonical_facts,
canonical_conflicts, entities,
relationships, memory_audit_log, and dream,
curiosity and skill tables; a full reindex rebuilds the index tables and
copies every other table across |
Hybrid vector and lexical fused by reciprocal rank, with graph expansion, recency and mood-congruent boosts and a retrieval trace; the search SQL filters on model and source only, so lifecycle reaches it through index membership; canonical facts bypass retrieval and are injected by key | Session extraction into chunks written with a pending embedding until a backfill pass, a canonical ledger with a closed op set of ADD, STRENGTHEN, SUPERSEDE and REJECT, and a curiosity loop that closes the previous answer's validity window; the similarity conflict resolver has no caller | Consolidation marks chunks expired and forgotten and merges losers
under a parent; a purge sweep hard-deletes forgotten and expired rows
and their vector and FTS rows once updated_at is older than
the retention; the owner can edit a chunk's text or hard-delete it from
all three tables at once |
None in the memory store — one owner per database. A guest turn filters search hits to rows whose stored and recomputed sensitivity are both normal, which is a sensitivity label rather than a scope key | A local gateway on one port serving a Control UI with a Memory page for listing, editing, forgetting, retiring facts and export; memory_search, memory_get and memory_pin tools for the agent; channels including WhatsApp, browser automation via Playwright, a P2P skills marketplace and a wallet | A dream engine with modes, an oscillator, an adaptive interval and a self-evaluator that grades dreaming by whether its results get used; plus consolidation and purge every maintenance tick, embedding backfill, health sweeps, a curiosity loop with web research, and epistemic directives | Canonical status active, retired or superseded gating injection; two chunk lifecycle columns read through one predicate on skill, listing and backfill paths; an append-only audit table written per caller; provenance chains; lineage, structural and entity-admission gates on the graph; a sensitivity filter on guest turns | The canonical ledger answers a real failure of similarity-gated stores — short high-importance facts share no embedding mass with a cold first message — by addressing them by key and injecting them unconditionally, with a closed op set and deterministic score-based demotion. The project acted on a published finding within weeks with a shared liveness predicate, a repair migration, a test seeded so the old filter would fail, and a source-scanning test for cross-vocabulary comparisons. Owner forget deletes from the table and both indexes in one transaction and says in its own comment why a soft mark would not do | The hybrid search SQL reads neither lifecycle column, so a chunk
consolidation forgets stays retrievable until the purge deletes its
index rows. The relationship validity interval is stamped with the
insert time and closed at supersession time by every writer, so the
graph records when it believed a fact and not when the fact held; the
as-of reads that use it have no caller outside tests. The vocabulary
test matches only col <op> 'literal', and
conflict-resolver.ts compares lifecycle with
forgotten inside a COALESCE it does not see. A full reindex
restores a demoted chunk's lifecycle without its
lifecycle_state. An owner-retired fact is reactivated by
the next same-value pin, including the agent's |
brain-db |
Four record types — Memory, Entity, Statement and Relation. A statement carries a subject that may be an entity, the source memory itself or a pending resolution audit, a predicate, an object, a confidence, an evidence reference, the extractor that produced it, four timestamps, a supersession chain and a tombstone reason | An embedded key-value store for metadata with rkyv-archived rows, a write-ahead log with sequence numbers and fsync, an arena for content, and an HNSW index for vectors | Semantic, lexical and entity-graph arms fused by reciprocal rank, then a six-step filter chain in a binding order, then rerank; EXPLAIN reports per-step survivor counts | A binary wire protocol with CBOR payloads and one opcode per cognitive operation, planned into an execution plan with a cost estimate and an idempotency check before the write-ahead log append | Correction supersedes and stamps the record-invalidation timestamp; forget has a soft mode that tombstones and a hard mode that zeroes the vector and the text; the reclamation worker takes only rows whose tombstone reason says the caller asked for removal | A namespace resolved from the credential and a space passed per request, both folded into the storage id and both forming the leading bytes of every secondary index key | No client ships — any language speaks the documented binary wire protocol; a server binary, an admin port, a plugin surface and a 148-file normative specification | Consolidation, decay, reclamation and resolution workers, plus checkpointing and recovery from the write-ahead log | A confidence float that ranks and a record-time invalidation that filters, kept as separate fields and separate filter steps; a statement is believed exactly when its record-invalidation timestamp is unset | A scope that lives in the key rather than in a predicate; a four-timestamp model whose header works a late-arriving correction through both axes; and a filter chain whose step order is declared binding and whose as-of versus tombstone interaction is decided explicitly rather than emerging | The anonymous space is the type's default, so a forgotten space lands in a shared bucket instead of raising; memory, entity and relation rows carry no record-axis timestamps so an as-of query passes them through unfiltered; and this is a v0.1.0 pre-release whose specification is ahead of the tree in places |
brain-mcp |
One line of an agent's own transcript file, held byte-exact in an append-only per-session floor file and indexed as a message row with role, agent, session, event time, capture time, a human_authored flag and a subagent flag | Plain files under ~/.brain: lake files per lane and session, a session-folder mirror, an append-only JSONL manifest of chunk hashes, and a DuckDB file that caches raw lines, a messages table and a BM25 index, all re-derivable from the lake | DuckDB full-text BM25 over the messages table with optional agent, role and date filters; harness-injected user text and subagent transcripts excluded by default; every hit returns file, line span and a sha256 computed from the floor at read time, and zero hits return an abstention naming the coverage | Claude Code Stop, SessionEnd and PreCompact hooks spool line deltas and final snapshots; a 60-second scheduled record tick drains the spool, poll-scans Codex, Pi and Claude Code session folders, appends complete lines to the lake, and refreshes the index. No model is called | Nothing is deleted. A rewritten origin opens a new generation and keeps the old, capped at five a day. redact replaces lake lines with a marker and logs the old span hash, and leaves the indexed text in DuckDB. restore writes a session back to the agent's directory, refusing to overwrite different bytes | One corpus per machine and user. Agent, role and date are optional caller filters; no project or working-directory key reaches the messages table; brain_get reads any file under lake/ | Seven MCP tools over stdio: search, get, recent, sessions, health, capture status, backup. A CLI for record, install, health, backup, redact, restore, scan-secrets, migrate-v1 and doctor. A Claude Code plugin with the hooks and the server; nothing is injected into a prompt | A LaunchAgent on macOS runs brain-mcp record every 60 seconds; Linux is left to a user-written systemd timer. Each tick that adds messages rebuilds the whole FTS index | Provenance is byte-level: a citation re-hashes from the floor and brain_get verifies it against an expected sha; the manifest lets the receipt re-verify deleted origins; health reports unknown as unmeasured. Nothing judges whether recorded text is true | Capture without a model at two entry points sharing one identity; an append-only floor with generation files instead of overwrite; citations checkable with sed and shasum; an abstention contract with coverage; a receipt and an all-or-nothing restore for sessions the agent deleted | Redaction rewrites the lake but not the DuckDB text, so search keeps returning a redacted secret; a redacted session that grows again fails the lake integrity check; scan-secrets misses session-folder files; brain_backup copies the corpus to any path the model names |
brain-md |
A markdown page with CLI-generated frontmatter, a
compiled_truth section holding what is currently believed,
and a timeline of append-only entries typed
decision | evidence | reversal | note |
Plain markdown in brain/ inside the repository — six
fixed root pages plus pages/ — with an
index.md regenerated rather than hand-kept, and a
brainRoot redirect for a sidecar brain |
Section extraction by marker, a regenerated index.md
carrying each page's first compiled-truth sentence,
list-pages metadata rows and wiki-links; no embeddings, no
search, and no status filter — archived and draft pages list beside
active ones |
Every mutation goes through brain subcommands —
create-page, update-truth, append-timeline, archive-page, set-tags,
update-root, reindex — so frontmatter is never hand-shaped; only
create-page validates the page id |
update-truth rewrites the compiled truth and appends
its timeline entry in one atomic write, keeping no copy of the replaced
text; archive-page sets status: archived and
appends a kind: reversal entry only when given a summary;
nothing is deleted |
One brain per repository — a physical partition:
resolveBrainDir picks the directory from
.mindmux/preferences.json or ./brain, no
record carries a scope key and no read applies a predicate;
read-page and the write subcommands other than
create-page take an unvalidated id, so ../
leaves the pages directory |
Four skills, a zero-dependency Node CLI published to npm, a
wire command that writes a marked instruction block into
CLAUDE.md and AGENTS.md, and opt-in SessionStart hooks for Claude Code
and Codex |
None over the store. Every page write reindexes synchronously;
lint-links runs on demand or from an optional pre-commit
hook that blocks a commit on a broken link; a SessionStart hook shells
out to list-pages and injects the listing at the start of
an agent session |
None as a status. active / draft / archived is
lifecycle that no code filters on, and no subcommand moves a page out of
draft; a reversal is a timeline entry kind
rather than a state on the page |
A compiled-truth rewrite that cannot skip its timeline entry, a linter that deliberately excludes the append-only layer from link validation, a stated boundary on its own guarantee, and a hook whose tests assert page bodies cannot reach the injected snapshot | The correct-by-construction guarantee holds only while nobody
hand-edits a file, and the project says so. A line break in a timeline
summary can plant a marker that makes the next update-truth
discard earlier entries (traced, not run). Page ids are validated only
on creation. The Claude Code hook injects the whole listing with no byte
budget; only the Codex branch is bounded |
brainapi |
A (Node, Predicate, Node) triple, with events as
first-class nodes so an actor's involvement is an edge to the event
rather than a fact about the actor |
Neo4j or a NetworkX-over-Postgres graph, Mongo for documents and the change log, Milvus or Postgres/pgvector or Qdrant for vectors, Redis for cache, RabbitMQ for the ingest queue — one database per brain in each | Dense vectors plus BM25 (or ILIKE) fused by a configurable mode, then graph channels — PPR, entity siblings, catalog walks — with a validity filter applied to every predicate | A queued Celery ingest runs an agent swarm — architect proposes edges, janitor vetoes, KG agent writes — and a same-type outgoing edge from the same subject is invalidated when a newer one lands | deprecated = true plus an invalid_at
property, set together; remove_nodes and
remove_relationships exist for hard deletion; nothing is
keyed on the value that was wrong |
The brain, resolved in middleware and used as the Mongo and Neo4j database name, with a per-brain PAT | A FastAPI service, an MCP server with an stdio-HTTP bridge, a Celery worker, a React console, a TUI installer, and five benchmark suites | Celery ingestion, graph consolidation, the janitor and observation agents, and trigger evaluation | None on a stored memory. The janitor's
OK / ERROR / REJECT is a per-batch verdict during
extraction that reaches a run-scoped cost ledger and never a field |
A validity filter applied across every graph read path, a janitor gate that fails closed on a provider failure, and per-question benchmark artifacts whose headline recomputes exactly | The published leaderboard entry is the run its own notes say needs a
cold re-run first; invalid_at is only ever tested for
truthiness; and two node names reach Cypher unescaped |
breadcrumbs |
A JSONL line — a settled fact keyed to a repo path — plus an append-only episode row and a tab-separated index row | Plain files in git: JSONL ledgers, a JSON fact store, a TSV fact index, a markdown handoff; no database | Path-key match against the files a session touched, most specific then most recent, hard-capped; the fact index answers by exact key or alias first | A session appends by hand or through a prompt hook; no model extracts anything | Append-only supersession through obsoleted_by; the engine logs a prior value before overwriting and refuses a value it has tombstoned | A three-level public / internal /
regulated scope on a fact, filtered at context assembly
with an unscoped fact defaulting to internal;
ScopedContextService derives the audience from a
host-authenticated principal so the caller never supplies one, and the
whole episodic tier is dropped whenever an audience filter is active
because episodes carry no scope |
Claude Code hooks and slash commands, plus three push hooks for the fact index and a stdlib library for a loop you write yourself | Nothing in this tree runs on its own; the sweeps are report-only and the weekly gardener trigger ships as a template | asserted vs verified as a rendered label that no read filters on; verified refuses a missing oracle, a missing verifier, agent authority and self-verification, and a rejected value refuses to be re-asserted | Committed cases asserting a superseded entry must not win the injection lane, gated in CI | The fleet architecture the docs describe is not in the tree, and one essay of five says so |
brigade |
A markdown note in an Obsidian vault the operator owns; Brigade keeps only a derived index and proposal staging under its own state directory, owner-readable only | The operator's vault for the notes themselves, with an allowlisted set of roots Brigade may index, plus per-operation receipts under a Brigade state directory | Index and search over the allowlisted roots, returning cited notes; a separate scenario-driven harness grades projections against named invariants | Additive proposals only: a proposal is staged, then delivered into one allowlisted inbox through a symlink-free directory handle, as a planned kernel mutation whose receipt is checked for a committed terminal state | None from the agent's side — it cannot overwrite an existing note and has no delete. What a note becomes is the operator's business in their own editor | Allowlisted roots and filesystem containment rather than a stored scope key: paths are opened relative to a directory handle without following symlink components, and an inbox that escapes the vault is refused | A CLI with a large command surface, receipts for runs and routes, attestation records, and a skills subsystem with its own proposal inbox | A projection kernel that prepares, commits and restores multi-file operations, plus memory care planning and closeout passes and a memory doctor | None. A note carries no status, no confidence and no validity window; what protects the store is that the agent cannot modify it, not that a memory can be marked doubtful | The agent has a propose verb and no accept verb anywhere in the tree, which is the strongest form of a review gate; the containment refuses to run where its primitives are unavailable rather than falling back to a plain open; the same must-not-exist precondition is enforced both by the file handle and as a plan precondition; the kernel states the guarantee it provides and the stronger one it does not; and the retrieval eval returns a named violation sentence with its hash check written in both directions | Nothing verifies who accepts a proposal — resolution happens in the operator's editor, so the separation is of surfaces rather than identities; receipts are per-operation artifacts with optional HMAC signing rather than an append-only ledger, and one path unlinks an install receipt; and a note has no status, so a proposal accepted in error is indistinguishable afterwards from one accepted deliberately |
browsentic |
A site note: Markdown with front matter naming a category, a domains list and, for generated maps, provenance and generatedAt; beside it a recorded workflow of named steps, a saved page tool, and one user profile | Markdown files under ~/browsentic/skills/ (activated maps as a folder with SKILL.md, map.json, screenshots, evidence and per-page notes) and ~/.browsentic/skills/; recordings, saved-tool code and an uploaded-skill index in the extension's storage.local; the profile in ~/.browsentic/profile.json at 0600 | No search. Site notes whose domains match the active tab's host are appended to the system prompt, hand-written before generated, inside a 64 KB cap; up to eight ready recordings are listed in every prompt and read by tool; an @name prefix pins one note | A mapping run, read-only and locked to one host, hands in a structured report through browsentic_saveSiteMap; the daemon scrubs and renders it into a staged folder. People write notes, recordings, saved tools and the profile through the panel | Activate moves the staged folder into place; Discard and Delete remove the folder recursively. Re-mapping moves the old map into staging, where the next mapping run's sweep deletes it once a day old. Unreviewed maps are swept after 24 hours. Recordings are capped at 20, oldest dropped | Per site: a domains list on each note, matched as host equals or ends with .domain, optionally narrowed to one exact host at activation. Saved tools match host and first path segment. One machine, one profile; no user or tenant key | A Manifest V3 extension side panel drives a local Node daemon that spawns the user's agent CLI (Claude Code, Codex, Antigravity, Vibe, Grok, Cursor, Qwen, OpenCode) with only Browsentic's MCP tools; an optional MCP server shares the browser with other clients but carries no notes or profile | No consolidation. A sweep of abandoned staging runs at the start of each mapping run; recordings are turned into steps by a one-shot agent call when capture stops | Staged versus active is a directory, not a field. Active generated maps carry provenance: generated, which orders them after hand-written notes and labels them machine-generated; instruction-shaped text in a report raises a warning on the review card and is not removed | Generated memory is unreadable until a person reads the exact Markdown and activates it; the producing run is read-only, one-host and holds no activate verb; every runner but Antigravity closes the agent CLI's own file and shell tools | The prompt calls generated notes the user's own words, not page content; the promised researched-background section has no field to arrive in; recordings skip review; deleting an uploaded skill with the Bridge offline leaves the file the loader reads |
buzz |
An engram — a kind:30174 Nostr event whose NIP-44
ciphertext decodes to {slug, value}, or
{slug: core, profile} for the identity surface |
A Nostr relay the operator runs; engrams are parameterized-replaceable events keyed by (pubkey, kind, d_tag), so the relay holds only the head | No search. core is fetched and injected; everything
else is reached by following [[slug]] references or asking
for a slug by name |
Synchronous — build body, encrypt, sign, publish.
mem set replaces; mem patch applies a unified
diff under a sha256 compare-and-swap |
Last-writer-wins head selection with monotonic
created_at and event-id tiebreak; mem rm
publishes a value:null tombstone, barred on
core |
The d-tag is HMAC(conversation_key, slug), so
addressing is per agent-owner pair; the relay filters by (pubkey, kind,
d_tag) and can correlate neither |
buzz mem CLI, ACP prompt injection of the core section,
a read-only desktop viewer, and an MCP dev server |
None for memory — no extraction, no consolidation, no embedding, no scheduled pass | Signatures and encryption, and nothing epistemic — no confidence, no candidate state, no provenance on a value | The relay cannot read content or correlate slugs; compare-and-swap on a memory value; a careful distinction between confirmed-absent and unknown | Replaceable events discard prior versions, so there is no history and a tombstone records only that something is gone, not what was rejected |
bwmem |
A per-user fact — key, value, category, type, confidence, both validity bounds, both transaction bounds, a status, a lineage link and an override priority — beside messages, sessions, held intentions and emotional capture | PostgreSQL with pgvector for facts and embeddings, Redis for session state, and Neo4j optionally for the knowledge graph | Full-text and semantic search over active facts, with relevance scoring, collision handling and a context builder that assembles the prompt block | Messages are recorded and facts extracted in the background, with contradiction detection and a quality scorer running over what was written | A correction supersedes: the old row keeps its lineage, takes a
status and a superseded_at, and a corrections row records
both values; nothing is deleted |
user_id stored on every fact and required by every read
signature, with intent_id as an optional narrower scope for
a conversation thread |
A TypeScript SDK to drop into a chatbot, with a Docker compose stack for the three services it needs | Multi-stage consolidation, fact extraction, sentiment analysis, response-quality scoring and dedup passes | A CHECK-constrained status vocabulary, confidence and override priority on a fact, contradiction detection over active values, and a corrections log with reasons | The migration that introduced the second time axis is the document
to read, because it states the problem before the solution: the table
already had validity bounds, and "[w]hat was missing is the second time
axis — WHEN WE CHANGED OUR BELIEF — distinct from when something was
true. Without this you can't honestly answer 'what did we believe about
X on date Y' — you can only answer 'what was true on date Y.'" It then
defines each of the four columns in a line, writes out the composed
predicate, and ships
getFactsAsOf(userId, asOfValidTime, asOfTxnTime) with both
instants defaulting to now — so the ordinary read and the historical
read are the same code path with different arguments, and the historical
one cannot rot separately. The status vocabulary is enforced by a
CHECK rather than by application code, and the partial
index is built on WHERE fact_status = 'active', which makes
the active set the read set at the planner level as well as in the
predicate |
The corrections log carries old_value and
new_value in the clear, which is what makes the lineage
answerable and also means an erasure request has to reach the
corrections table as well as the fact — the opposite trade from the one
argued a report earlier, and there is no purge path here that reaches
both. Nothing is keyed on a rejected value, so a corrected fact can be
re-extracted from a later message and written again as active. There is
no human surface: this is an SDK, corrections come from extraction and
contradiction detection rather than from a person, and the
reason on a correction row is a fixed string chosen by the
code ("Value correction", "Temporary override") rather than an
explanation anybody wrote. The committed tests are unit-level — SQL
shape, context formatting, consolidation gating — with no store-level
case asserting that a superseded or another user's fact fails to come
back, which is the assertion this design would most benefit from
pinning. And the runtime is three services: Postgres with pgvector,
Redis, and Neo4j when the graph is on |
bytechef |
Two units. A knowledge_base_document_chunk — a row
carrying vectorStoreId and a FileEntry
pointer, with the text in file storage and the embedding in pgvector, so
one chunk exists in three stores at once. And a Spring AI
Message in a conversation, addressed by a
conversationId the workflow author types |
Postgres for rows plus a kb_-prefixed pgvector table
for embeddings, chunk text in pluggable file storage, and chat memory in
whichever of nine backends the workflow wires up — JDBC, Redis, MongoDB,
Cassandra, Neo4j, S3, in-memory, a vector store, or the built-in
application database |
Vector similarity only, topK 10 by default, through
KnowledgeBaseVectorStoreWrapper, which AND-s
knowledge_base_id and any tag filter onto the request. Chat
memory is MessageWindowChatMemory — the last N messages of
one conversation, no search. There is no lexical arm and no fusion |
Upload a document and a message-broker worker runs read → split → embed asynchronously, flipping the document through UPLOADED, PROCESSING, READY and ERROR. Chat messages are written by the Spring AI advisor chain during the call | Real and thorough at the chunk and document level: deleting a
document removes its vectors, its chunk content files, its chunk rows,
its source file and its row, in that order, inside one
@Transactional facade. Editing a chunk re-embeds it
asynchronously. A conversation is deleted whole by
deleteConversation. Nothing is keyed on a value and there
is no tombstone |
knowledge_base_id is a stored key AND-ed into every
vector search. Around it sit two ThreadLocals —
TenantContext, selecting a Postgres schema and defaulting
to public, and EnvironmentContext, selecting
model credentials and defaulting to PRODUCTION. Chat memory
has no scope key at all: findConversationIds() returns
every conversation in the store |
Memory is a cluster element inside a visual AI-agent node — the author drops in a chat-memory component, a knowledge base, a document retriever and guardrails, and wires them. Also a REST API, a GraphQL API and an embeddable SDK | A message-broker worker owns the whole ingest path and the re-embed after a chunk edit. No pass re-reads or rewrites the store on a schedule | None over memory content. KnowledgeBaseDocument.status
is a pipeline stage — UPLOADED, PROCESSING, READY, ERROR — recorded on
the document, and no read path consults it, so a chunk whose re-embed
failed answers queries with its pre-edit embedding while the document
reads ERROR in the UI |
SanitizeTextAdvisor.getOrder() returns
DEFAULT_CHAT_MEMORY_PRECEDENCE_ORDER - 1, so PII and secret
masking runs one step ahead of the chat-memory advisor and what is
persisted is the masked text — asserted by a test whose message says so;
the runtime refuses to start an agent with two guardrails of the same
kind, because two advisors at one order make the ordering undefined |
Both ambient scopes fail open to a real target rather than closed —
an unbound thread reads the public schema and the
PRODUCTION environment, and the S3 chat memory will
create a <prefix>-public bucket for it; the
conversation id is an address rather than a permission, and the workflow
editor offers a dropdown of every conversation in the store labelled
with its opening line |
byterover |
Flat memory with source/pinned metadata; structured knowledge
ContextData |
Local Markdown under .byterover/, optional cloud
sync |
MiniSearch BM25 over a cached context-tree index, with chunking, a relevance floor, a score-gap cut and parent-score propagation; metadata filter and pagination on the flat memory list | LLM dedup returning CREATE/MERGE/SKIP; DECISIONS always
creates |
Structural-loss guard repairs destructive curation; no tombstones | Storage directory; the search scope is a topic path
that falls back to the whole tree when it matches nothing |
brv CLI, MCP, Hermes provider |
LLM dedup at bounded concurrency | A human review queue over curation that a structural-loss detector
can force open, plus a mutation log; source and
maturity are recorded but neither is a trust judgement |
Deterministic structural-loss detection and repair on LLM rewrites, wired to a human review queue the agent cannot talk its way out of | Elastic License 2.0, not open source; merge path itself is unguarded |
cambium |
A Markdown page in an adopter's vault, carrying frontmatter with four independent status axes; Cambium ships no pages | None of its own — the corpus is the adopter's vault; Cambium adds a state layer of ledgers, receipts and a watermark, all as templates | No retrieval engine. Read Sets bound which sources a route may load, and Runtime Cards are compiled shortcuts that lose to normative text on conflict | An LLM proposes a Coverage Delta; apply_delta.py merges
it deterministically, dry-run by default, aborting if the merged file no
longer parses |
Supersession must retain the relationship and the reason — historical judgments must not be silently deleted; no delete path and no value-keyed rejection | Batches scope work and apply_delta rejects a page whose
batch does not match the delta; no scope key on any read path, because
there is no read path |
Check scripts, schema templates, kernel modules and runtime routes, plus an MCP stdio server whose tool list is compiled from the CLI contract and which imports nothing from the distribution it serves | A maintenance run that produces candidate lists; candidates never change a status axis by themselves | Four independent status axes that must not be merged and an evidence-maturity ladder from signal to validated, all validated against a controlled vocabulary; the one axis any tool reads is the coverage disposition, and it decides what enters the authoring queue rather than what may be believed | Checks that distinguish nothing-checkable from passed, a governed write path an LLM cannot hand-edit, and a filled example profile that binds every interface slot | The repository selects no profile of its own, so vocabulary and freshness cannot be demonstrated on it, and it ships no corpus, so maintaining one over time is unexercised end to end |
camel |
A MemoryRecord — a chat message plus its backend role,
a UUID, a timestamp, an extra_info dict and an
agent_id. Nothing is derived from the transcript |
Key-value backends for chat history (in-memory, JSON file, Redis, Mem0 cloud) and a vector backend for recall (Qdrant by default); an optional Memanto-backed memory that archives turns to a remote agent store | Chat history returns the stored list, optionally windowed; the
vector block embeds the last user message and takes the top
k by similarity with no filter |
write_records on every turn — no extraction, no
summarisation, no consolidation. The transcript is the memory |
pop_records(count) and
remove_records_by_indices(indices) on chat history; both
raise NotImplementedError on the vector store, where
clear() is the only removal |
agent_id is stored on every record and applied on no
core read path; the Memanto memory routes by it in the URL, and the Mem0
adapter filters on user_id equal to it. Isolation comes
from giving each agent its own storage object |
AgentMemory ABC consumed by ChatAgent; a
MemoryToolkit for save/load; role-playing and workforce
runtimes on top |
None | None. A record is a message that was sent; there is no status, confidence, source or provenance beyond the backend role | A small, legible three-part contract — block, memory, context creator — that a custom store can satisfy in an afternoon | A stored-and-unused scope key, a vector store that cannot delete one record, and a retrieval query that is whatever the last user message happened to say |
cashew |
A thought node — content, a type, a domain, a storage timestamp and
an optional referent_time event clock, an access count and
last-accessed stamp, a source file, tags, a mood state, a
decayed flag and a permanent flag — linked by
derivation edges |
One SQLite database: thought_nodes,
derivation_edges, embeddings,
metrics and a lazily-created decay_audit, with
an optional vector extension table |
Similarity search over embeddings plus graph traversal along derivation edges, every path excluding decayed nodes on both endpoints, with a gentle recency weight in [0.5, 1.0] computed from the event clock | Extractors pull nodes from conversations and files; a sleep protocol consolidates, cross-links and garbage-collects in a work-capped vectorised pipeline | Decay rather than deletion — the row and its content stay, the flag is set, and an audit row records the transition; a frequently-read node is promoted to permanent and exempted from decay for good | A domain field on each node and a single per-user database; no scope predicate is applied on the read path | A CLI, a daemon, extractors for agent transcripts, a dashboard, and skills and integration directories for wiring an agent to the graph | The sleep protocol — consolidation, cross-linking, permanence promotion, decay and audit garbage collection — in a batched, Numpy-backed pipeline with configurable work caps | No epistemic state. Access count is the signal that matters: it drives promotion to permanent and it gates decay, and a node that was read even once is out of the decay set entirely | A decay gate that requires a node to be old, never read, and orphaned in the live subgraph before it can be forgotten, with cascading held to a stricter threshold and a single live parent enough to save a child; an audit helper that snapshots the node on the caller's connection so the record and the state change commit together; and an event clock the operational passes are forbidden by docstring from reading | Decay is keyed on the row and never consulted on the write path, so
re-extracting a decayed sentence produces a fresh node with no trace of
the first; the decay audit is itself garbage-collected, so the record of
a forgetting has a retention of its own; permanent is
irreversible by design, so a node promoted by a burst of reads can never
be demoted; and there is no scope predicate — the boundary is one
database per user, which makes the domain field a label rather than a
partition |
cass-memory-system |
A playbook bullet — a rule or an anti-pattern with a category, a scope, a state, a maturity, helpful and harmful counts, and a decay half-life | JSON playbooks on disk, global and per repository, merged on read,
beside a .cass/blocked.log of forgotten rules |
No ranking engine; the active bullets are rendered into markdown by category, with anti-patterns in their own PITFALLS section | Sessions are reflected on by an LLM into candidate bullets, curated through a decision log, and promoted by outcome feedback | Forgetting writes the rule text to a blocklist, and any later bullet within 0.85 token overlap of it is deprecated on merge | A scope field of global, workspace, language, framework or task with an optional scope key — stored and counted in statistics, not applied as a filter on the read path | A CLI and a skill file for coding agents; the playbook is exported as markdown for injection | Reflection, curation, gap analysis and outcome scoring run as commands rather than as a daemon | Two discrete vocabularies — state and maturity — beside helpful and harmful counts and a confidence decay half-life | A blocklist keyed on the rule text with a similarity threshold, so a forgotten rule cannot return by being reworded; anti-patterns rendered as their own section | The usage-analytics half of the tracking module is unwired — five typed event writers, an append-only log and a passing test suite with no caller in the source |
caura |
A memory row with content, one of fourteen memory_type
values, one of eight statuses, one of three visibility tiers, a
tenant_id, fleet_id and agent_id,
a content hash, a ts_valid_start/ts_valid_end
window, a nullable confidence, an is_inferred
flag, a JSONB scope of structured validity qualifiers, a
supersedes_id, recall counters, a soft-delete stamp and an
optional RDF triple projection of subject entity, predicate and
object |
PostgreSQL with pgvector at 1,024 dimensions (BAAI/bge-m3) and a
tsvector column for full text, under Alembic migrations
past number forty. Four services — core-api,
core-storage-api, core-worker,
core-operations — plus a plugin and TypeScript and Python
clients. Docker Compose for development, with an optional local
reranker |
A hybrid SQL search: vector similarity and full-text score combined
in an ingredients CTE, with tenant, fleet and visibility as
hard predicates and status restricted to the three live values. Soft
multipliers handle what hard filters would over-prune — a lapsed
ts_valid_end applies a currency factor rather than
excluding the row, and a date range boosts rather than filters. An
optional rerank pass and a valid_at parameter for
historical questions |
caura_write over MCP or the HTTP API takes plain text;
an enrichment step classifies the memory type and may downgrade the
status to cancelled or conflicted. Three types
— outcome, rule, insight — are
server-reserved: agents may not supply them at the write boundary, the
enrichment prompt omits them from the offered vocabulary, and
_validate_enrichment demotes any that slips through to the
default type. A live-content-hash unique index keyed on tenant, fleet,
agent and hash enforces the dedup contract the write path
advertises |
A soft deleted_at plus five non-live statuses.
Contradiction handling is a unified model: confidence
guards the invariant that weak evidence must not delete strong,
is_inferred stops a materialised memory silently overriding
a stated fact, and the JSONB scope means two memories
conflict only when their validity qualifiers overlap. A crystallizer
deduplicates and archives losers. Rejecting a distilled skill writes its
cluster fingerprint to a poison table with a cooloff, which the next
distillation run consults |
Three keys and a tier. tenant_id is mandatory,
fleet_id optional, agent_id recorded on every
row, and visibility is scope_agent,
scope_team or scope_org.
_fleet_scope_clause is the single builder every
fleet-scoped read calls, with a strict mode that excludes fleetless rows
and an org-visibility disjunct that survives strict mode because it is a
tier a writer chose rather than an accident of a missing fleet |
Sixteen MCP tools including caura_write,
caura_recall, caura_evolve,
caura_insights, caura_keystones,
caura_doc, caura_manage,
caura_tune and caura_stats; an HTTP API; a
plugin; TypeScript and Python clients on npm and PyPI. The old
memclaw_* tool names, environment variables and URLs keep
working after the rename |
A worker for enrichment and embedding; a crystallizer that deduplicates and consolidates; an evolve service that turns outcomes into rules; an insights service; a Forge cron that clusters memories into candidate skills and files them to the inbox; an async audit flush that batches chained appends | Eight statuses of which three are live; a nullable
confidence in the claim rather than in the retrieval;
is_inferred distinguishing a materialised memory from a
stated one; three server-reserved memory types agents cannot mint; a
per-tenant tamper-evident audit chain; a human inbox in front of every
distilled skill; and a poison table that remembers a rejected
fingerprint for a cooloff window |
Every one of the seven mechanisms this atlas grades for is present, wired to a reachable path, and tested; a rejection record keyed on the value and consulted before the next proposal, which almost nothing here has; an audit chain whose serialisation point is a separate one-row-per-tenant table so the log never takes the lock; one shared visibility clause written after a leak moved from one copy of a predicate to the next; a write boundary that refuses to let an agent mint the three types the server derives | The poison record expires — a rejected fingerprint is skipped for a
cooloff of thirty days by default and is proposable again after it, so
the tombstone is a moratorium rather than a permanent refusal; the inbox
and the poison table both sit behind an
org_settings.skills_factory.enabled flag and return 403
when it is off; the accuracy numbers in BENCHMARKS.md are
not reproducible from this tree, which the file says itself; the surface
is large enough that a self-hosting team is adopting four services, a
worker and a migration chain past forty rather than a library |
chitta-field |
A payload in a realm, with a state carrying version, strength, decay rate, confidence, access counts, a pin, a tier, a retrieval history, a status and an epistemic status | An append-only op log, one segment file per writer process, with in-RAM indexes and full snapshots; segments a certified snapshot covers are deleted | A cortical sparse index assigning each memory 64 active features from a dictionary of 16,384 learned atoms, beside semantic HNSW, BM25, HDC, temporal, triplet, symbol-graph, PPR and association-spreading lanes | One Op appended to the writer's segment per mutation, hash-chained and CRC'd; state is rebuilt by replay or loaded from a snapshot | Delete is an op and a deleted flag, compacted out of the next full snapshot; supersession, contradiction and archiving are statuses that veto the scored lanes while the payload stays | A realm string on every payload, an optional filter on the semantic, BM25, HDC and temporal lanes; None reads every realm and tag selection is global. ClearProject removes code-file and symbol entries, not memories | A Rust library with a C FFI, the backing store for the cc-soul daemon in a separate repository | A maintenance thread that drains touches, checkpoints a full snapshot on a WAL budget and prunes covered segments; decay; an embedding backfill that dedups by cosine; a reconcile pass | Statuses that veto on the scored lanes, an epistemic status that only weights, a claim-level contradiction detector served over FFI, a hash chain whose breaks are logged, and a lineage fence | A status that excludes returns None rather than a small
multiplier, so the scored lanes skip the candidate as control flow — a
zero weight is a number a later stage can multiply back up, and an
Option is not. How a memory was obtained is kept orthogonal
to whether it is believed: EpistemicStatus produces a
multiplier and can never veto. The contradiction detector is
"claim-centric, not text-centric": "[t]wo memories contradict when they
make incompatible claims under overlapping scope (same
subject+predicate), not merely when they are semantically similar". The
V3 segment header carries a vector-space id, and replay skips and
archives segments written under a different embedding model, dimension
or text format instead of returning wrong neighbours. A committed test
asserts the three excluding statuses stay out of semantic recall beside
an active memory that must come back |
The op log is a recovery log, not a history: every full snapshot, including the one the maintenance thread takes on a WAL budget, deletes the segments it covers, and nothing reads past ops except replay. A broken hash chain is logged as a warning and replay continues. The status veto holds on the scored lanes and not on temporal, HDC or artifact recall. The claim detector and its resolution run only when the FFI caller asks, and resolution returns ops for that caller to apply; the in-tree reconcile pass uses a six-word prefix heuristic. Valid time on triplets is the write clock. Realm is an optional filter. The status and epistemic multipliers are deserialised from scoring.json with no range check |
chump |
Two units. A fact row in chump_memory: content, timestamp, source, a confidence float, a verified integer, a sensitivity label, an optional expiry and a memory type. A lesson: a directive in chump_improvement_targets with a priority and an optional tool-domain scope, attached to a reflection that carries an outcome class | One SQLite file shared by the fact table with an FTS5 mirror kept by insert, delete and update triggers, an entity-triple graph, the reflection and lesson tables, episodes and causal lessons; embeddings in a positional JSON array beside it; a markdown wiki under a separate brain path | Facts: FTS5 with an expiry filter, cosine over embeddings and an entity-graph rank fused by three-way reciprocal rank fusion, multiplied by confidence and freshness, then MMR to a 4,000-character budget. Lessons: frequency over recency, filtered by priority, seed tag, outcome-class quality and tool domain, injected first in the system prompt | The agent's memory tool stores a fact with a model-chosen confidence, type and expiry; an opt-in LLM summariser writes a semantic_fact with verified = 1 and expires the episodic rows it consumed. Lessons come from heuristic reflections after autonomy tasks, CI-failure capture and the orchestrator's per-dispatch writer | Expiry, exact-content dedupe and confidence decay floored at 0.05 for unverified facts, all in an operator-run curate mode that nothing in the tree schedules. No forget verb on any surface; lessons are deleted only by an A/B-seed cleanup command, and graph triples and embeddings survive the deletion of their fact | No scope key on facts; isolation is one database file per repository root. Lessons carry a tool-domain scope with a universal NULL, and an empty domain returns every lesson. Episode search takes an optional repo argument the caller may omit | The built-in agent's memory, memory_brain and graph tools; an MCP server with memory_search, memory_recall, episode_save and episode_search for bring-your-own agents; a briefing command that hands lessons to dispatched agents; a duty-officer peer that reads and writes episodes from shell | Curation runs only when an operator invokes chump --curate; reflections are written at task and dispatch completion; the duty-officer loop appends an episode per judgment tick | A verified integer whose only writers are the two LLM summariser paths, a sensitivity label that is always 'internal' and never read, an outcome-class quality gate on lessons, a hash-chained tool-call ledger capped at 200 rows, per-faculty bypass flags, and a research-integrity directive binding on contributors | Every cognitive faculty has an environment flag read in one place and wired at its single injection point, so each can be measured by its absence; CHUMP_BYPASS_SPAWN_LESSONS short-circuits load_spawn_lessons before any database work. The project ran that A/B, then asked a second question of the same faculties, whether the agent textually references the injected state, and found reference rates of 0 and 1 percent. Its directive prohibits the exit-code scorer, requires an A/A run per series and states the tolerance before a result may be cited, and EVAL-102 records in public why EVAL-101's null may not be cited. The lesson read path is pinned by tests that assert off-domain and failure-derived lessons stay out of the assembled block beside lessons that must appear | The memory A/B is weaker than its label. The first EVAL-056 run scored exit code and output length while most trials failed on API connectivity, which the write-up says itself; the LLM-judge re-score at n=50 per cell had overlapping intervals and an A/A run of +0.200 against the plus-or-minus 0.03 the directive requires before citing. RESEARCH-022 applied a 5 percent threshold its preregistration states as 10. Embeddings are a positional array aligned with the live rows, and expiry, dedupe and summarisation remove rows without touching it, so semantic scores attach to the wrong facts after the first removal. The MCP search tools omit the expiry predicate. Thirty-nine of the 78 eval write-ups are private stubs |
cindy |
A Markdown shard named type_slug.md with YAML title, description, type and updatedAt; types user, feedback, project and reference are curated, and digest holds Pi compaction summaries | One directory per scope key under the signed-in owner's data root: the shards, a derived MEMORY.md index, meta.json and an fts.db holding an FTS5 table rebuilt from the files on every open. Teammate scopes live in the teammate's Home under memories/ | MEMORY.md, listing every curated shard's title and description, is snapshotted into the prompt at session start. memory_search runs an FTS5 phrase MATCH ranked by bm25 plus a LIKE scan for CJK substrings; memory_read fetches a shard by filename | The model calls memory_write, memory_consolidate or memory_delete through the cindy_memory MCP server, or Pi's bot_memory facade in a teammate session; a nightly routine proposes teammate memory changes and admits a new one only on a verbatim user quote; Pi compaction writes digests; a person edits teammate memories in settings | update overwrites the shard and bumps updatedAt; append concatenates; consolidate writes a target and unlinks the sources; delete unlinks the file and rebuilds the index. Settings and nightly edits are compare-and-swap on updatedAt. Nightly changes keep before and after for undo, for the last 30 runs | Physical: one directory and one fts.db per key, the key being the working directory with linked git worktrees folded to the main checkout, ssh:host:path for remote sessions, or bot:id for a teammate, all under a per-account root. The key comes from the host session context and never from a tool argument. session_search in the same server reads account-wide history for ordinary sessions | Built into the Cindy desktop host and its headless runner: an in-process MCP server with list_tools and call_tool over seven memory tools plus session_search, injected rules and index for Claude Code and Codex, a bot_memory tool for Pi teammates, and the harnesses' native auto-memory switched off while it is on | A built-in nightly learning routine per teammate, default on at 03:30 local time, one auxiliary-model call over the owner conversations since its watermark; no background pass touches workdir memory | None on a shard. Nightly creates need a quote found verbatim in a user message; nightly updates and deletes need only a reason. Skill drafts wait in a candidate list until they recur or a person promotes them | A scope key derived by the host on every path, failing closed when the account is unknown; a derived index the model never edits; verbatim-quote admission for background memory writes; per-item undo that refuses to overwrite a later edit; an end-to-end test through the real MCP server | Deletion is a hard unlink with no record outside the nightly path; the injected index has no hard cap; session_search crosses workdirs from an ordinary session; model writes through MCP carry no evidence; a per-reply review and a working-memory ledger stay in the tree with no caller |
citra |
A clause — one rule in 40 words or fewer, carrying a derived facet scope, the corrections that taught it, the officers who supported and dissented, firing counters and a ten-value status | One MongoDB collection, smartapp_clauses, keyed by
tenant, app, modality and task type, with a multikey index on the facet
array |
Subset containment on facets —
scope_facets ⊆ case_facets — then an n-gram specificity
backoff as the primary sort, with support, precision and recency as
tie-breaks within a tier |
A consolidation job clusters roughly three officer corrections and authors the text in a single LLM call; later matching corrections touch provenance and counters only | Status transitions with a snapshot into an append-only
history; retire, quarantine, challenge and supersede all
withhold without deleting, and the evidence stays |
tenant_id and app_slug on every query,
plus the facet subset predicate that decides which cases a clause may
reach |
A decision app, a REST decision API, an embeddable recommendation UI, and an MCP service | A consolidation job that forms and reconciles clauses, and a precision monitor that parks a clause measured wrong more often than the floor allows | Ten statuses of which three fire; corroboration is a headcount of distinct officers, never a per-officer weight, and the project states that weighting officers by seniority would encode hierarchy into an audit trail | A status the read path filters on rather than scores, a store that refuses an unprovenanced clause, and a published null result naming which of its own features measurably did nothing | Retirement makes a clause invisible to the matcher that would have
recognised the same lesson, so a quarantined judgement re-forms from the
same corrections under a new id; record_dissent is the one
status writer in the store that leaves no history entry, and the audited
path is a convention of clause_store.py rather than a
property of the collection; and the project is nine days old |
claude-code-memory-setup |
One Markdown note per exported chat, with YAML frontmatter carrying a title, keyword tags, an origin, a created date from the export's mtime, an import time and fixed source, status and type values; session logs written by the model on /save and by a SessionEnd hook | An Obsidian vault on disk, notes filed under chats/code or chats/web; no database, no index of its own | None in this repository. Obsidian's own search and graph view, or the agent reading vault files, do the finding | A daily cron job the guide installs exports every Claude Code session with claude-extract and imports it with --move, tagging from a 63-entry keyword map; web chats are exported by hand; the model writes a session log when told /save; a SessionEnd hook writes a mechanical log on every non-trivial session close | Editing or deleting a note in the vault. Each nightly run re-imports every exported Claude Code session onto the same path, overwriting edits and re-linking from scratch | An origin folder — code or web — inferred per file, and a per-project logs folder the hook picks by working-directory basename. No user, project or agent key is applied on a read path | One Claude Code SessionEnd hook, a cron job outside the agent, and /save and /resume defined as instructions in the vault CLAUDE.md; the agent otherwise sees the vault because it is on disk | A daily cron job at 22:00 runs export and import; a SessionEnd hook runs on session close | Nothing is verified. The importer's only safety behaviours are --dry-run, which the wrapper never passes, and skipping code fences when inserting links | Wikilinks inserted at import time, longest-name-first and once per note, so a new note joins the existing graph without anyone maintaining it | Silent rewriting of note bodies with a four-character name floor as the only false-positive guard, a nightly re-import that overwrites edits to imported chats, and token-savings figures the repository cannot support |
claude-engram-mlapeter |
A world memory: content up to 600 characters from extraction or 400 from the store tool, scope global or project, register self, person or craft, four salience floats, tags, access count, created_at and an active-day stamp, updated_from, protected, and archive lineage fields. Beside it, model-written identity documents and first-person episode files | JSON files under ~/.claude-engram: global/memories.json and projects/hash/memories.json, a deep_archive.json, embeddings.json and associations.json beside each; identity and episode markdown; a per-project text buffer; the whole directory committed to a local git repository at each consolidation | SessionStart injects identity documents, a code-assembled Right now lane and a briefing an Opus call wrote at the previous SessionEnd. The recall tool ranks exact substring, else token overlap blended with optional Voyage vectors, times compressed strength and a capped recency boost, then follows association edges and same-session siblings one hop | Stop appends transcript spans to a per-project buffer; a detached runner sends each 16 KB chunk to Sonnet with the recent and strongest memories, dedups by cosine 0.85 or token overlap, and stores. The store tool writes directly; pasted claude.ai dumps are folded in at consolidation; the session model writes episodes and identity deltas with its own Write tool | reinforce with new_content overwrites text; an extracted memory naming updates multiplies the older one's salience by 0.7; consolidation merges, gists and prunes into the deep archive with merged_into and gist_of lineage; forget deletes the active row only. No tombstone | Physical: one global file and one file per project, keyed by a hash of the working directory; every read loads global plus the current project. The scope field is a two-value label, and a consolidation merge the model marks global becomes visible in every project | Four Claude Code hooks registered by install.sh in ~/.claude/settings.json, a user-scope stdio MCP server with nine tools, an opt-in dashboard on port 3333, and a manual paste bridge from claude.ai | Detached extraction at 32 KB or 4 hours of buffer, PreCompact, SessionEnd and wake; one consolidation per active day with five new memories or pending deltas: prune below strength 0.03, gist craft after 7 active days, Sonnet merge and generalize, association edges, Opus identity rewrite, git snapshot before and after | None as a state. Supersession and merging reduce rank or move rows to an archive the recall tool does not read; the prompt asks the extractor to set updates only when a fact changed | The buffer is claimed atomically and restored on any extraction failure, per chunk; merges refuse to cross registers and never lower salience; protected and highly emotional memories are exempt from gisting and pruning; a failing pipeline announces itself in the next session's context; decay runs on days used, not calendar days | forget leaves the verbatim pre-gist copy and merge sources in the deep archive, where deep_recall can reactivate them; the dashboard binds with no hostname and no authentication and serves every memory and an inbox write route; the agent holds every correcting verb; no CI |
claude-mem-lite |
An observation — type (decision, bugfix, feature, refactor, discovery, change), title, subtitle, facts, narrative, concepts, lesson learned, files read and modified, importance 1-3, project, branch, applicability scope — with citation, injection and access counters and supersession and compression links; plus session summaries, prompts, handoffs and an activity events table | One SQLite database in WAL mode under
~/.claude-mem-lite/, with FTS5 tables kept by triggers,
idempotent migrations, periodic snapshots and pre-delete
VACUUM INTO copies |
FTS5 BM25 with column weights, synonym and CJK expansion, stop-word filtering, an AND-to-OR rescue, pseudo-relevance feedback and concept co-occurrence; per-type recency decay, importance, citation factor, active-file overlap and a cross-project penalty; optional multi-query rewrite with RRF and a Haiku rerank | Seven Claude Code hooks: tool calls are filtered in code, batched
into episodes, saved immediately with degraded metadata, then enriched
by a background Haiku, OpenRouter or claude -p call; manual
saves through MCP, CLI and slash commands; two-tier dedup by Jaccard
over five minutes and MinHash over seven days |
mem_update edits in place; a save can name observations
it supersedes; auto-dedup and fuzzy dedup supersede the lower-importance
twin; weekly compression folds old low-value rows into summaries;
deletes are hard, with a snapshot first |
Project derived from the working directory; searches boost the current project and include other projects at a 0.4 multiplier unless a project is passed | A Claude Code plugin with hooks, an MCP server with 18 tools (9
listed), slash commands, a CLI, and a managed block written into the
project's CLAUDE.md on every session start |
Detached workers for episode enrichment and session summaries under a two-slot semaphore; a 24-hour auto-maintain pass for decay, dedup, compression marking, purge, backups and vocabulary optimization; citation feedback after each session | Retraction by explicit supersession with a reason, tombstones kept out of every injection and export path, a verify-before-use hint on old file-bound lessons, secret scrubbing before storage, and citation-driven ranking | A retrieval benchmark wired into CI with a regression gate; a single live-row predicate with a test that pins every site carrying half of it; supersession that reports each requested id it did not apply; a README that retracts its own wrong claims | The automatic save path's dedup reads superseded rows while the manual path excludes them, so a retracted lesson silently blocks a close re-capture for seven days; cross-project recall by default; the CLAUDE.md block is re-applied to a committed file on every session start; no mutation history beyond snapshots; a large, fast-moving codebase whose correctness rests on its own audit rounds |
claude-mem |
Hook event, pending message, observation, session summary, prompt | Canonical SQLite, optional Chroma projection and cloud sync | FTS/filter search or Chroma semantic search; file-only metadata/semantic intersection; recent timeline context | Lifecycle hooks queue work; observer generates structured XML; SQLite commit before acknowledgement | Exact row deletion with synchronized tombstones; project-wide server forget paths | Local: project, worktree lineage and platform source filters. Server: the API key's team and project on every observation read and delete | Coding-agent hooks, HTTP, MCP, UI, multiple adapters | Durable queue, provider retries, vector/cloud projection, repair | Session/tool metadata and deterministic file evidence; generated claims have no trust state | Reliable non-blocking capture and bounded cross-session context | Ordinary search is not fused hybrid; generated observations activate automatically; dual schema transition |
claude-self-reflect |
An immutable ~900-character chunk of a Claude Code transcript with a
deterministic UUIDv5 id, a project name, a timestamp, a sequence index,
a sidechain flag and a highest-authority speaker; beside it a
reflections row for agent-written insights, session stories
and episode JSON |
One SQLite file at ~/.claude-self-reflect/, with FTS5
over chunk content, 384-dimension embeddings in a BLOB column, and an
HNSW graph persisted as index files beside it; no server, no container,
no external database |
Vector kNN over HNSW with a project-id filter, an FTS5 arm appended
only when the best semantic score is below 0.5, then a deterministic
provenance rerank by author, scaffold, mechanic and poison signals, time
decay whose half-life moves with session outcomes and shipped-release
distance, and a two-hop csr_why walk over the session↔︎file
co-edit graph |
Six Claude Code hooks import the live transcript on Stop and
SessionEnd; a shared sanitizer drops CSR's own tool blocks and
hook-injected reminders before chunking; store_reflection
and csr_resolve are the only agent-driven writes, and an
optional daemon adds heuristic and LLM narrative layers |
Nothing is ever deleted on a user-reachable path. A conversation is
re-imported whole, layered narratives supersede one another by
delete-then-insert, and csr_resolve and the dream cycle
only append verdicts that demote a hit within its page or label it |
chunks.project_name is applied as a filter on both
chunk arms; the default is the caller's project resolved from
MCP_CLIENT_CWD, falling back to every project when that
variable is absent; reflections, anti-pattern injection,
search_by_recency and get_recent_work are not
scoped |
An MCP stdio server with fifteen annotated tools, six Claude Code
hooks written into settings.json by
csr-engine hook install --apply, a statusline, a SwiftBar
plugin and a Claude Code plugin manifest |
An optional daemon: a file watcher, a plans importer every 30
minutes, a history spine every 10 minutes, heuristic and
claude -p narrative layers, a ratification extractor, an
hourly release-ancestry refresh and a dream cycle every six hours |
A three-value append-only verdict per chunk and a three-value append-only verdict per code witness, both consumed as rank and label only; provenance by speaker with user-authored content boosted and a tool result asserting authority demoted | Staleness decided by BLAKE3 stamps and git commit ancestry with explicit abstention instead of an LLM or a wall clock, a sanitizer that keeps the system's own retrieval output out of its own corpus with counters for both kinds of scrub, and a failed pre-registered hypothesis kept as a shadow signal fetched after ranking is fixed | A chunk the dream cycle has proven stale is still returned, and on
the UserPromptSubmit injection path it arrives with no label at all; the
project scope falls open to every project when one environment variable
is missing; and the supersedes link the reranker pays 0.20
for is hardcoded None at every production call site |
claude-total-memory |
A row in an append-only fact_assertions log, plus knowledge rows enriched by queue workers | SQLite with an append-only assertion log, a temporal knowledge graph and vector/BM25 indexes | Six-stage hybrid — BM25, semantic, fuzzy, graph, cross-encoder, MMR — then a negative-evidence pass | Assertions appended; a conflicting assertion closes the prior one with superseded_by | valid_to is set with an invalidation_reason; nothing is edited or removed in place | one SearchScope object rendered both as SQL predicates
and as an allows() check re-applied to anything retrieval
expansion pulled in, with a benchmark counting out-of-scope hits as a
leak rate; unconditional on the temporal graph's supersession lookups,
and a narrowing filter rather than a confinement elsewhere — writes
default to the general project, reads take whatever project
the caller names and span all of them when it names none |
MCP server, CLI, hooks, nine IDE installers, Docker, launchd and systemd units | Enrichment, triple-extraction and representation queues plus a consolidation daemon | NLI entail/neutral/contradict with two calibration profiles; confidence is a float on the assertion | A deliberate second retrieval for contradicting evidence, aimed at producing IDK | The cross-system delta still subtracts a recall_any
from another project's differently-defined headline, though both
variants and the caveat are printed beside it; and closing an assertion
is not refusing a value, so the same wrong text can be re-asserted by
the next ingest |
claudest |
A session branch in SQLite, plus curated entries in CLAUDE.md, MEMORY.md and topic files | SQLite with FTS5 and BM25, no external dependencies; markdown for the curated layer | Precomputed context summaries injected at session start; full-text search on demand | Sessions imported automatically; learnings extracted only through an approval gate | Consolidation retires and merges entries, deleting with trash rather than rm | One database per user; branches are the unit, no scope key on the read path | A Claude Code plugin marketplace of eight plugins; this is claude-memory | Batched summary backfill that marks permanent failures instead of retrying them | summary_version as a three-valued marker — needs work, current, permanently failed | A consolidation protocol that requires removals and verifies each one landed | 505 test functions across the repository and not one drives the consolidation protocol — the one mechanism that edits the user's memory files on every session |
claudinio-brain |
A fact — entity, predicate, object (text, number or another entity), with valid time, transaction time, retraction, confidence, scope, source and a JSON locator; an object pointing at an entity makes the fact an edge | One SQLite file, one binary, no server: facts, entities, aliases, predicates, an FTS5 index and a vec0 table partitioned on scope | Four channels — words, names, a graph walk and kinship — with a semantic channel over a static potion-base-8M embedding; every mode carries the same temporal predicate | brain remember --subject --predicate --value --at --until --source,
a batch file, an MCP remember tool, and harness hooks that
record what a session did from the transcript |
A new value closes the old one rather than overwriting it; a correction at the same instant retracts instead, and the write returns which of the four happened | scope is a column and a vec0 partition key, but the
query carries it as an optional argument that defaults to none, so
nothing separates namespaces unless the caller asks |
A CLI, an MCP server, a loopback studio UI, and installable hooks for Claude Code, Codex, Cursor, Gemini, Cline, OpenCode and others | Session hooks that capture what a session did;
brain lint scans for structurally unreachable facts and
brain repair acts on it as a separate decision |
Retraction as never-true, separated from expiry; declared aliases resolve writes and learned ones deliberately do not; a linter that reports what retrieval cannot reach | Two things. First, the single read arm: for_when builds
one temporal predicate for every mode and Now is literally
AsOf(now), so "the two cannot drift apart because there is
only one arm" — the structural answer to a store whose current-value
path works while its as-of path quietly does not. Second,
brain lint, which reports "[w]hat the brain can see wrong
with itself": findings are structural defects where "the fact is stored,
it is true, and retrieval still cannot use it", the case that motivated
it is named ("a brain where 59 out of 69 is_a facts had a
string where an entity belonged. Every voucher knew its class and no
voucher was reachable from it"), and finding it had required "opening a
3D scene and noticing loose dots". A memory system that can detect its
own unreachable contents and does not report them "is failing at its
job, so this module exists to make that a command instead of an
observation." The alias split is a third: declared aliases resolve where
a write lands and learned ones never do, because "they are guesses made
from watching questions, and a guess must never decide where a fact is
stored" — enforced "by this WHERE clause and by nothing
else, so it is load-bearing", which is the comment a future reader
needs |
Scope is the gap. It is stored on the fact and used as a vec0
partition key, but the read path takes it as
Option<String> defaulting to None, so a
caller that forgets it searches everything; the exclusion form is a
post-filter on the semantic channel, since a partition key "indexes
equality and cannot express an exclusion", which the project documents
and tests but which means that channel trims after ranking. There is no
mutation audit beyond the fact table itself, and the retraction reason
is appended into source by string concatenation —
source = COALESCE(source, '') || ' [retracted: ' || ?2 || ']'
— so the field naming who asserted a claim also carries why it was
withdrawn, and neither can be parsed back out reliably. And nothing is
keyed on a rejected value: live_facts excludes retracted
rows precisely so that they "must not influence where a new fact lands",
so re-asserting a retracted value produces a fresh created
fact with no sign that the brain once rejected it |
clawmem |
A Markdown document in a collection, chunked for search, plus derived observations and subject-predicate-object triples | One local SQLite file per vault: FTS5 for lexical, sqlite-vec for dense, ordinary tables for the graph | Two regimes — raw BM25 or raw cosine by default, composite metadata blend only when the query reads as recency-seeking | Files indexed by a watcher; hooks extract observations through a local GGUF model; both land as ordinary documents | invalidated_at removes a row from both retrieval legs; superseded_by links the replacement; nothing blocks re-assertion | None across users — one vault file each; an optional collection filter on user content, and the internal _clawmem collection excluded by default on every retrieval route unless the caller opts in | Claude Code hooks, an MCP server, an OpenClaw plugin and a Hermes MemoryProvider, all against the same vault | A consolidation worker, an optional quiet-window heavy lane, an embed daemon and a filesystem watcher | A confidence float that erodes on contradiction, and a contradiction judge that must be configured before anything can be deactivated | Ran an eval against its own ranking stack, lost, and shipped the negative result as the default | Invalidation is silent at query time, and the mechanism that fires it is an LLM verdict on a 0.25 confidence decrement |
clio |
A typed LTM entry — discovery, problem-solution, code pattern, workflow or failure — with confidence, tier and corroboration sources | ltm.json in a per-project directory under
~/.clio/projects/, named by a UUID in the project's
gitignored .clio/project_uuid, beside a session key-value
directory and YaRN conversation archives; pure Perl, no database |
Per request, keyword overlap with the current input, active task and unresolved state plus confidence; at most five entries scoring 5 or more, a 0.5 confidence floor, no tier term; substring search through the memory tool | Agent-invoked memory_operations calls; no LLM
extraction and no automatic capture |
Confidence decay, tier-differentiated age-out, Jaccard dedup and
per-type hard caps in consolidate; a flat, tier-blind
prune; update_ltm rewrites text in place; no
record of what was removed |
One store per project directory, named by a UUID file at the project root — a filesystem boundary, not a stored key | A terminal-native Perl agent with slash commands, sub-agents and an MCP client; memory reaches the model through a per-request block in the user message and one tool | maybe_consolidate runs in-process at session start and
session load, gated at 24 hours and 20 entries |
unverified until two distinct
agent:session sources corroborate — an
[UNVERIFIED] badge, a 0.3x weight in the cap-eviction
score, a 30-day age-out and doubled decay; the injection score has no
tier term, and the memory tool takes both source names as arguments |
A tier that reaches the rendered memory block, the eviction order and the decay schedule; a manual promotion only a slash command reaches; committed relevance tests asserting unrelated memories stay out | Two tool calls naming two sources promote an entry, and update_ltm rewrites a trusted entry's text without touching its tier; the docs credit the injection ranker with a tier penalty it does not apply; the library defaults to unknown:unknown |
cloud-alter-ego |
A Markdown line in a per-context monthly journal, written by a hook for every question and answer or by the agent through note.py; beside it a context README, raw and rendered session transcripts, and repo-wide preferences, techniques and skills files | A private Git repository of Markdown and JSONL: clients/slug/ and projects/slug/, each with README.md, a monthly journal file and a sessions folder; preferences.md at the root | No retrieval code. SessionStart injects preferences.md verbatim and names the active context; the agent is told to read that context's README and newest journal file with its own tools | Automatic: UserPromptSubmit and Stop append a truncated question and answer to the active context's journal and push in the background; SessionEnd copies the transcript, commits everything and pushes. The agent adds one summary line per turn with note.py | Append-only journals; the agent or a person edits any file by hand. No delete verb and no forget path; every line stays in Git history and on every clone | Physical: one folder per client or project, chosen by a gitignored .current-context file that every write rereads. One repository holds every client, and nothing on the read side is restricted to the active folder | Claude Code hooks registered in every config directory on the machine and re-registered at each session start; a global CLAUDE.md pointer block; Codex through notify chaining and an AGENTS.md block | A detached git commit, pull --rebase and push after every journal line, serialised by a lock file; a pull at every session start | None in code. preferences.md tells the agent that its own earlier conclusion, also from the journal, is not a confirmed fact | Capture that does not depend on the model; preferences injected verbatim with a length warning; journals merged with git's union driver so parallel devices do not conflict; installers back up every settings file they touch | One .current-context per clone, reread at every write, so parallel sessions for two clients write into each other's journals; raw transcripts with tool output are pushed with git add -A and no filter; recall is a prompt; no tests |
codemem |
A memory item with a kind, a project, a scope id, a visibility, a session and timestamps — decisions, dead ends and repository-specific traps | Local SQLite with FTS5 and sqlite-vec, plus optional
peer-to-peer replication of selected scopes |
BM25 lexical and vector semantic search merged and re-ranked, injected automatically into every prompt, with memories already in context not repeated | An observer processes sessions through the configured model provider; the README notes this "can incur costs or consume plan usage" | Not the subject of this reading; the epistemic work is in attribution rather than supersession | A replication-scope gate every read path enables, with caller filters intersecting it and the disabling flag typed out of the semantic-search context | Plugins for OpenCode 1 and 2, Claude Code and Codex hooks, an MCP server, and a viewer server | Observer processing, peer-to-peer sync, a coordinator for teams, and a retrieval ledger | A retrieval ledger of attempts and exposures, an outcome-evidence store, and an attribution layer that separates observational from causal claims | Two gates, both enforced in the type system rather than by
convention. The read boundary: every memory read path passes
enforceScopeVisibility: true, caller scope filters
intersect rather than widen, and the context a semantic caller builds
has the flag removed from its type —
Omit<OwnershipFilterContext, "enforceScopeVisibility">
— so the path most likely to forget it cannot express forgetting. Beside
it, one catalog defines every tool-exposed filter key, pinned to the MCP
schemas by "an exact parity test", because otherwise "a filter added
here [could] be silently omitted from either surface, so exclusion
filters can never fail open and return broader results than the client
requested" — naming the failure direction, which is what makes the
tripwire worth having. The attribution layer is the other reason to read
this: retrieval attempts and exposures are ledgered, outcomes carry
evidence, and an assessment is labelled helpful, irrelevant, stale,
harmful or unknown on one of seven bases — with a claim type of
observational or causal, and a gate refusing the second unless the basis
is a randomized contrast whose witnesses are retention-pinned and carry
both experiment.cells_complete and
experiment.uncertainty_reported. "[C]ausal claims require a
linked preregistered randomized contrast with complete retained cells
and uncertainty" is a sentence almost nothing in this corpus is in a
position to enforce |
That attribution layer is not wired to anything yet, and the file
says so: "[t]hese pre-writer validation gates define initial v1
semantics. Once production writers are enabled, semantic rule changes
require a contract version bump."
recordAttributionAssessment has no caller outside its own
module, so the contract and its 5,052 lines of tests exist ahead of the
writers that would populate it — honest, and it means a reader should
not take the taxonomy as describing what the product currently records.
The impact label is likewise diagnostic: a harmful
assessment is counted in a diagnostics view and filters nothing, so
nothing withholds a memory that was judged harmful. Retrieval itself has
no epistemic state — no status, no provenance class, no supersession
found on the read path. And the surface is large for what it does:
375,155 lines of TypeScript across a dozen packages, with a coordinator,
enrollment reconciliation, peer-to-peer replication and a viewer server
around a local memory store, and eight unpinned dependency surfaces at
this pin |
codewiki-plus |
Two kinds. A note is a markdown file with frontmatter carrying an OKF status, a confidence level, a verified list, an optional task_id, an optional reason and verification block, and a type. A task memory is an entry inside a per-user markdown file, headed by a timestamp and a collision-checked 4-char base36 id | Files under a repowiki root behind a KnowledgeStore facade, written by temp-file replace under sidecar locks and staged into git on every write; an SQLite analysis cache holds the search index | BM25 over notes, wiki pages and raw sources with an authority multiplier folding note type, OKF status, confidence level and source, plus wikilink hops and progressive reading modes; deprecated notes and, by default, shadow notes are dropped and drafts are labelled; task memories have their own per-task BM25 search that skips superseded entries | Notes enter as draft through ingest_note or distillation and reach stable through confirm_note, or are ingested as stable with a required free-text reason; task memories are written directly by add_task_memory, which rejects a near-duplicate of a recent live entry | confirm_note, reject_note, batch_set_status and adjudicate_conflict rewrite a note's status in its frontmatter. Supersession inserts a dated marker line naming the successor into a task-memory entry. Compaction moves originals to a per-user archive file and rewrites the live file. delete_task removes the task directory, archives included | An optional task_id filter on the default note query and a repo filter for centralized layouts, both caller-supplied; task memories are addressed by task_id and split into per-user files, with other users' files loaded as a summary plus two recent entries | 53 MCP tools over an IDE-driven flow, a CLI, SessionStart and SessionEnd hooks, and a web view; the model is the IDE's own, and the installed server updates itself from PyPI in a detached child unless disabled | No daemon. A SessionEnd hook captures the transcript in a detached subprocess; distillation, consolidation, compaction, lint and telemetry aggregation are tools the agent calls, with compaction handed to an async subagent when the hot layer crosses its threshold | An OKF status of draft, stable or deprecated, where deprecated is dropped and draft is labelled; a confidence level of strong, weak or shadow that weights ranking and drops shadow by default; and a trust tier of unverified, machine-confirmed or human-reviewed derived from a self-declared verified.by prefix, attached to results and read by nothing | Three answers to an uncertain claim on one read path: dropped, labelled, or weighted. A supersession marker written into the entry itself, naming the date and the successor. A telemetry chain that reaches past retrieval to whether the work succeeded, and feeds the last five failures into the prompt that writes the next note. A dedup recall exempted from authority weighting so a confidence migration cannot blind it | Every retirement is keyed on a record: distillation dedup, the conflict search and the task-memory write check all skip retired material, so re-extracting a rejected claim produces a fresh draft. Every lifecycle verb, including confirm and adjudicate, is on the agent's own tool surface, and ingest_note writes stable directly given any reason. Other users' warm-layer entries are loaded without the superseded filter. The telemetry stream is rewritten on every hit. The outcome verdict is self-reported. The installed server pip-installs minor releases from PyPI on its own |
codex-dev-mcp-suite |
A Markdown note with YAML frontmatter — id, title, kind, tags, aliases, created, dir — beside a JSONL journal entry, a file-snapshot manifest record, and an auto-derived note built from git log and chat-transcript lines | Plain files under one home directory:
notes/<id>.md plus index.json per
project slug, log.jsonl and handoff.json per
journal, content-hashed blobs plus manifest.json per
checkpoint. No database |
A keyword index with a wikilink graph boost, optionally reranked by cosine over embeddings — remote when an endpoint is configured, otherwise a 384-bucket hash of words and character trigrams | Synchronous on the tool call. The note file, the index entry and the wikilink graph are written before the tool returns; a remote embedding call blocks that return | memory_delete unlinks the file and drops the index
entry. No status, no supersession pointer, no deletion marker, and
nothing consults what was removed |
A project slug derived from a directory path — but the directory is
a model-supplied dir argument on every tool, and
memory_global_recall crosses all projects by design |
Four stdio MCP servers declaring 42 tools, of which 39 have a
handler — memory_import_session,
pack_dense_brief and journal_standup are
advertised in tools/list and reach the
default: branch that throws. Plus an init
wizard that writes server entries into six clients' configuration
files |
None resident. memory_auto_index is an agent-invoked
pass that reads git log, file mtimes and chat transcripts and writes
notes from what it matches |
No status field on a note and no provenance distinction. A transcript line matched by keyword becomes a durable note carrying the same weight as one the agent wrote deliberately | Readable and repairable — every artifact is a Markdown or JSON file a person can open; the wikilink graph is resolved on save; dedup suggests and refuses to delete; 285 assertion calls across 113 cases in 13 committed test files | Three tools the 3.5.0 release is named after are declared to clients
and implemented nowhere; checkpoint_restore with
clean: true deletes every file the snapshot skipped —
binaries, anything over 2 MB, anything past a 4,000-file cap — and
reports them as newer; pack_audit interpolates filenames
into a shell command; the journal's compressor silently reports an
entire log as empty when one line fails to parse |
cognee-rs |
A knowledge graph built from ingested documents — document, chunk, entity, entity type, text summary and typed edges — with vector payloads for each, grouped into datasets owned by a user | A relational database for datasets, data items, pipeline runs and search history; a graph database for the entity graph; a vector database for embeddings, with LanceDB and pgvector among the built-in backends; and file storage for the ingested originals | A four-verb API — remember, recall, improve, forget — over an orchestrator that auto-routes a query to one of several retrievers: chunk, entity, hybrid, temporal and graph-completion, with an optional truth-subspace reranking weight that is default-off and neutral when unset | Ingestion builds the graph through a cognify pipeline whose runs are registered, so a failed run can be rolled back by sweeping the artifacts that run produced rather than by dataset | Cascading deletion in dependency order — relational, then graph, then vector, then file storage — with a dry-run preview. The two modes are named soft and hard and differ only in whether an orphan-node sweep follows; both remove the row | Dataset ownership. Explicit dataset ids and the ids that dataset names resolve to are authorized against the requester's readable set inside the orchestrator, with a tenant filter applied to the owner path; the full grant resolution lives in a closed crate and the open build falls back to ownership | A CLI, an HTTP server with an OpenAPI surface, and bindings for Python, TypeScript, Java, iOS and C, with a cross-SDK end-to-end harness | Pipeline runs with a registry and status, an orphan sweep on hard delete, and a run sweeper that rolls back a failed cognify | No epistemic status on a node. The truth-subspace crate scores
rather than states — truth_score returns 0.5 and
truth_factor returns 1.0 when inputs are missing, so the
reranking knobs are neutral by construction and default-off |
An authorization check placed where the retrieval happens rather than at the edge, with one listing query instead of a per-id loop and the reasoning written down; a test that proves the store was never queried rather than only that the response was refused; doc comments that state in which direction the open build diverges from the Python original; and 3,809 test functions across 30 crates | The delete mode named soft removes the row — the only difference from hard is an orphan sweep, and soft is the HTTP default; a tracked follow-up records that soft delete leaves orphans the Python prunes; a search with no dataset filter carries no owner scope; the provenance ledger that earns the Python implementation its audit mark has no counterpart here; and the Python-parity search route posts the caller's query text and system prompt to an external analytics endpoint in a default build |
cognee |
Source data, chunk, typed DataPoint, graph edge,
summary, session entry |
SQLite/PostgreSQL plus pluggable graph/vector stores | Chunk, lexical, vector, graph, triplet, summary, temporal, hybrid, and routed modes | add + cognify; unified
remember; session-hot writes with background
improvement |
Exact data/dataset/all forget; memory-only reprocessing; provenance rollback; opt-in supersession tags on functional relationships that retrieval does not read | Stored user-to-dataset read permissions resolved before search, with a database per dataset; on by default on supported backends, off only by explicit configuration | Python, REST, CLI, MCP, typed memory entries | Composable pipelines, session bridge, memify, rollback/recovery | Source records, content hashes, pipeline/task/user provenance, an opt-in hash-chained provenance ledger; no factual trust state | Ontology-aware multimodal graph pipeline with serious rollback | Large configuration surface; cross-store consistency; extracted graph can harden errors |
cognicore |
A memory_entry with a state, a category, a scope pair,
provenance columns and eight outcome counters |
Swappable backends behind one contract — SQLite, Chroma, TF-IDF, graph, multihop and hybrid; a separate research store for episodes, strategies and reflections | Backend-specific search with a scoped wrapper filtering on the read path, plus multihop and reranking paths | Extraction and categorisation into a candidate state;
supersedes set when a newer entry replaces an older
one |
supersedes points at the entry being replaced and is
queryable metadata in the Chroma backend; state moves to
archived; no rejected-value record |
scope and scope_id on every entry, applied
by ScopedMemory on the read path as a Python filter when
the backend cannot express it |
MCP launch path, a Claude Code plugin directory, an HTTP and UI server, and an OpenEnv manifest | A sleep module, lifecycle and decay passes, a utility
scorer and a task queue table |
state defaults to candidate and moves
through verified, active and
archived; a separate correct flag and
positive/negative outcome counters |
A state that begins at candidate rather than at true,
and a utility ledger that distinguishes a retrieved memory from a used
one and from an ignored one |
The category read over-fetches five times the limit and scopes in Python, so a caller whose scope is sparse in a category under-returns silently; supersession is record-keyed with no rejected-value record; the committed benchmark's headline gain comes from one of six environments |
cognis |
None of its own. The unit is whatever the mounted provider returns — a recall payload of instructions, core memories, search results and stats — with the host holding the policy that produced it | No memory store. Postgres holds users, agents, conversations and workflows; memory is delegated to a provider, with Mnemory and a null backend shipped | recall on the provider, parameterised by search mode,
instruction mode, TTL and a managed flag, with auto-recall a policy
switch rather than a call site |
remember for turns and add_memory for
explicit facts, both carrying agent and user identity; auto-remember is
a policy flag; and a trusted-evidence route that sends a strict pydantic
body bound to a SHA-256 hash of the exact persisted session event |
delete_memory and a separate
delete_memory_tool on the contract, so the agent-facing
delete is a distinct method from the host's own |
agent_id and user_email on every contract
method, with the caller's identity taken from a verified JWT subject
rather than a request header |
Controller and executors split over a bus — tools, browsers, shells, LSPs and MCP servers run wherever the work belongs; memory and guardrails are companion services | Workflows run agent work off the chat path; memory bootstrap, auto-recall and auto-remember are per-turn policy rather than background passes | None on a stored memory. What the host models is the fate of a write: a seven-value evidence outcome, a typed rejection contract asserting no semantic effects, and an explicit unknown-outcome state that disables automatic retry | A frozen per-turn memory policy carrying a SHA-256 fingerprint over backend, flags and instruction text; a memory write bound by hash to the exact persisted event that occasioned it; a transport failure classed as unknown rather than failed, with retry refused; deletion in the contract twice | Provenance crosses the boundary and belief does not — the provider is told who and which event, never how much to trust it — and neither the fingerprint nor the evidence hash records what a write changed in the store |
cognitive-spatial-memory |
A point in a fixed 8D manifold — an id, a permanent position projected from its embedding, a mass derived from confidence and affect, and a temperature that cools on a Lorentzian curve; beliefs and memories share the same space | JSON belief files beside a pluggable backend (JSONL, SQLite or ChromaDB), with the manifold`s positions and gravity anchors saved and reloaded as engine state | A KD-tree neighbourhood around a moving attention centre, ranked by
temperature * mass / distance² rather than cosine
similarity — the vector form divides by dist³ because the
displacement is unnormalised, which is the same law |
store() embeds, projects to 8D and registers a point;
pulse() moves the attention centre and re-heats what it
passes. Nothing extracts, dedups or compares against what is already
there |
None. There is no delete, forget, remove, purge or compact anywhere in the package, and no supersession — a stored point is permanent, and correction is not expressible | None. No user, tenant, agent or project key exists in the tree | A Python library with a
store/query/get_context surface
offered as a drop-in replacement for cosine RAG, plus a co-occurrence
hook and a preconscious context assembler |
A pulse step that decays temperature and recomputes gravity anchors, driven by the caller rather than scheduled | None. Confidence feeds mass, so belief strength is a ranking weight; there is no status and no state that withholds a point from retrieval | A retrieval law stated as an equation and implemented as stated, where recency is a force rather than a filter, so nothing is excluded by a cutoff; and an honest docstring naming the parent system the engine came from | The persisted state carries no record of which embedding model produced its permanent positions, so changing the provider silently mixes two manifolds that nothing can re-embed or remove; there is no deletion of any kind — no delete, forget, supersede or compact — behind a drop-in RAG replacement claim; there are no tests and no evaluation of that claim; and the committed audits link file:///home/nemo paths that resolve for nobody |
cogz |
An entity — observation, rule, knowledge, or a derived code symbol — stored as a markdown file with YAML frontmatter and mirrored into a SQLite row | Markdown files under .cogz/ as the record, optionally committed for a team, with one local SQLite database per repository as a projection carrying FTS5 and a vector extension | Hybrid full-text and vector search with graph expansion and git co-change terms, status-filtered before the KNN cut, assembled into a token-budgeted context pack | An agent calls create_entity, or a person edits the markdown; MCP writes run title and embedding dedup, a rejected-match pass and NLI contradiction checking after the file is synced | Status moves through a five-value lattice checked on every update of an existing row; reject is a CLI command and an MCP tool; pruned tombstones blank content and are hard-deleted past a retention count | The repository directory. There is no tenant, project or user key on an entity; separation is one database per checkout | A Rust binary with nineteen CLI subcommands, an MCP server over stdio offering fifteen tools, and hooks configured for Claude Code, Cursor, Codex, Gemini CLI and Copilot | Session-end consolidation promotes supported observations to rules and merges duplicates; every index recomputes knowledge drift against referenced code; a 30-day telemetry sweep deletes old events at session end | A validated status lattice on the update path, a rejected-match warning to the writer, drift annotations against code hashes, delivery hit and miss instrumentation, and a secret scanner at the write and sync boundaries | The status vocabulary is a state machine that the update path
honours: transition_status fixes the legal moves with a
typed IllegalTransition, and every sync of an existing row,
hand-edited file included, goes through
update_entity_preserving_status, which refuses an illegal
move before the row changes. A file claiming pruned while
carrying text is refused as a minted tombstone. Rejection has a producer
on both surfaces and a consumer at write time:
check_rejected_match compares a new entity's title and
embedding against up to 100 rejected rows of its type and returns the
prior verdict and its rejected_reason. Every retrieval
surface filters the status, the KNN filter runs before the cut so stale
rows do not take slots, and respects_status_filter pins the
behaviour with a positive control. Knowledge carries
verified_against hashes of the code it describes, and
orphaned anchors demote it to stale automatically |
The lattice is checked against the projection, not the record.
cogz reset deletes the database and cogz index
inserts every file as a creation, so a status hand-edited from rejected
back to active is refused at sync and accepted after a rebuild. The
rejected-match pass runs after the new entity is written and synced as
active, reaches only the writing agent, and is never stored; once doctor
prunes a rejected observation its title is blanked and the match cannot
fire. The event table is telemetry rather than an audit:
sweep_old_telemetry deletes every event older than 30 days
at each session end, pruning strips old_content from
payloads, and the cascade nulls entity_id. The agent holds
reject_entity and verify_knowledge, the second
clearing the stale review queue, and no event records which actor did
either |
commonground |
Two things, kept apart. A ledger event — sequence, project, event
type, subject kind and id, actor kind and id, an optional cause kind and
id, a timestamp, a note, JSONB annotations, and a pointer to a payload —
and a semantic record, keyed (project_id, record_id) with a
record_role, a turn id and sequence, and a Cardbox
reference. The content itself is in neither: both point at a
cardbox_project_id/cardbox_id pair |
PostgreSQL, with the schema created in
infra/postgres.py — agents, credentials, turns, spawn
envelopes, semantic records, the kernel ledger and its scope index.
Payloads live in CG-Cardbox, which is a git submodule of this repository
and is not checked in with it, so the store this kernel indexes is not
in this tree |
No search arm at all — no embedding, no vector column, no full-text
index, no ilike. Reading is by identity and by sequence:
fetch a subject, or page a project feed after a ledger sequence, or read
a scope's events through cg_ledger_scope_index. That is the
right shape for a ledger and it means the kernel offers nothing that
resembles recall by meaning |
Agents act through an HTTP API versioned v3r1,
authenticated per agent with credentials whose status is
active or revoked. A turn produces semantic
records and ledger events; a ClaimToken and a
ConflictError in the contracts give optimistic concurrency,
and unique constraints enforce one provision-launch record per turn.
Ledger writes are inserts, never updates |
Nothing in the tree updates or deletes a ledger row. Semantic
records are keyed to a turn and a sequence and carry a
record_role, so a correction is a later record rather than
an edit. Agent credentials are revoked by status rather than removed.
What is missing is any statement about the payloads: deletion, retention
and correction of the content live in Cardbox, which is not here |
project_id from a request header, applied as a
predicate on every repository read and built into the composite primary
keys and foreign keys, so a row cannot reference a parent in another
project. Beside it a cg_ledger_scope_index on
(project_id, scope_kind, scope_id, ledger_seq) gives a
second scope dimension over the ledger |
An HTTP API at /v3r1, a CLI with project, agent, feed
and provisioning subcommands, an SDK, an agent client and a projection
client, plus adapters and an Integrations directory. Agents are
registered into a project with a provenance record and issued
credentials |
None in this repository. Projections are read models a client pulls rather than a worker that maintains them, and there is no consolidation, decay or summarisation pass — which is consistent with a kernel that stores facts and leaves interpretation to its participants | Structural rather than epistemic. The ledger records an actor and a
cause for every event, credentials carry an
active/revoked status, registration carries a
provenance kind and reference, and a test asserts creator authority does
not leak into the kernel snapshot or public metadata. No memory record
carries a confidence, a verification state or a validity interval |
An append-only ledger whose rows name the actor and the cause, not just the subject — an audit that answers why as well as what; a project key that is a composite primary key rather than a filter someone must remember, so a cross-project reference is impossible at the schema level; a deliberate refusal to offer search, leaving recall by meaning to participants; a test asserting that the authority which created a project does not appear in the kernel's own snapshot | The payload store is a submodule this repository does not contain,
so what the ledger references — and every question about retention,
correction and deletion of content — is outside the tree that was read;
there is no retrieval by meaning, so a participant needing recall must
build it; no memory record carries a trust state or a validity interval;
twenty commits from February to May 2026 and nothing since, against a
v3r1-preview label, so this is an early cut of an ambitious
design rather than a settled one |
compartment |
An encrypted record in a namespace, with a kind, tags, a discovery date and an optional expiry, beside a relation table of subject-predicate-object triples with validity bounds | One sealed .vault file — SQLite and ciphertext inside
an encrypted payload, journaled and fsynced per write, with a
hash-chained audit log inside the seal and ACLs in a plaintext config
beside it |
Keyword search over FTS and vectors rebuilt into RAM on unlock, with
the semantic channel aged by the share of the searched namespaces
written since; save-date and discovery-date windows; a deterministic
relation filter with an as_of instant |
Every write is journaled and fsynced; a store gate refuses a memory whose shape would embed badly, rather than asking the model not to send one | Supersession by record id — the row, ciphertext and vectors stay so history and export keep it, while the FTS row goes so the keyword channel can never surface it again | Per-caller ACLs over namespace patterns, resolved to a readable set
before every search, with packs/* read-only for
everyone |
An MCP server, a Claude Code plugin, a Gemini extension, a Hermes memory provider, a menu-bar and systray app, and a CLI | An embedding daemon; the vector index is rebuilt in RAM on unlock rather than persisted | None as a status. A record carries a kind, tags and a writer-set quarantined flag that labels a result and never withholds it | An audit chain that anchors its own length so a tail truncation is reported as removal; a store gate whose justification is a measurement of the prompt it replaced | Supersession is keyed on the record id and the duplicate guard sees live records only, so a superseded claim can be stored again; supersession carries no time, so past belief cannot be reconstructed |
context-engineering |
Four shapes, one per CoALA tier: a scratchpad triple with original, minimized and enriched text; an episodic event with session id, kind, summary, importance and provenance; a schematic record, which consolidated facts also borrow; and a knowledge-graph triplet | SQLite files for scratchpad, episodic events and the graph; a JSON file as the semantic source of truth, mirrored into a local Chroma collection or Azure AI Search | Scratchpad injected whole, newest first, to a 1,500-token budget; episodic recall scores recency, importance and bag-of-words relevance for analytics and diagnostic intents; semantic search over Chroma or JSON keywords; one-hop graph neighbours of IDs named in the query | Explicit MCP tools for scratchpad, episodic, graph and schematic writes; every pipeline turn appends a user_turn event; an MCP-sampling consolidation tool extracts at most five facts and appends them as draft schematics | Schematics update and delete in place, delete behind a confirm flag; scratchpad clears by subject or wholesale; episodic events and graph triplets have no reachable delete. No tombstone | None enforced. Scratchpad rows carry no session key; episodic session_id is an optional filter the pipeline's recall does not pass; schematics and facts share one collection | FastMCP server over stdio and streamable HTTP with 29 tools, 13 resources and 5 prompts; a nine-node LangGraph pipeline behind the search tool and a REST API; read-only dashboards | None scheduled. Consolidation runs only when a caller invokes warn_consolidate_memory | Consolidated facts are written as draft with trust_level agent_extracted in their specifications, and no read path filters on either | Each tier is small enough to read in one sitting; episodic recall returns a per-event score breakdown; minimized, original and enriched text are all persisted; the consolidation cycle logs itself as an episodic event; comments label every simplification as deliberate | Injection prefers an LLM-expanded version of each scratchpad note over what was written; without an OpenAI or Azure key minimization falls back to keeping the first 75% of words; consolidation re-reads the same scratchpad each cycle and appends duplicates; two processes over one JSON file lose each other's writes |
context-infrastructure |
A dated block in contexts/memory/OBSERVATIONS.md
holding lines marked 🔴 High, 🟡 Medium or 🟢 Low, under a
Date: YYYY-MM-DD header. Above it, a promoted rule: an
axiom file with id, category,
created and updated frontmatter, or a skill,
or a section of one of the four rule files. Below it,
contexts/daily_records, survey_sessions and
thought_review |
Markdown files in a git checkout, plus an embedding index the search
tool builds beside them — embeddings.npy,
chunks.pkl and a manifest.json under a lock
file. No database and no service; rules/,
contexts/, periodic_jobs/,
adhoc_jobs/ and tools/ are the whole
store |
Two paths and a routing table. AGENTS.md is the root
index an agent reads at session start, pointing at
rules/WORKSPACE.md for directory routing.
tools/semantic_search builds a forward index of chunks and
embeddings and queries it. OBSERVATIONS.md opens with an
instruction not to load itself whole — "不要全文加载这个文件" —
and to retrieve on demand instead |
An L1 observer runs on a schedule: an 84-line Python trigger hands a
prompt to an OpenCode agent, which scans the workspace for the day's
changes, filters them, and appends a dated block to
OBSERVATIONS.md under the three priority marks. The prompt
carries the idempotency rule — read the file first, and if a block for
that date exists, change nothing — and instructs the agent to append
with >> or tee -a rather than rewriting
a large file |
An L2 reflector runs weekly on the same trigger pattern: read the 🔴
and high 🟡 entries, promote the generalisable ones into
rules/ by responsibility boundary, then "rewrite
OBSERVATIONS.md, deleting promoted and expired 🟢 records." The
promotion threshold is stated in the prompt as prose — cross-project
generality, repeated verification, a clear applicable scenario — and the
garbage collection is a rewrite, so the observation that produced a rule
does not survive its own promotion |
None. One workspace, one owner, one observation file.
rules/WORKSPACE.md is a routing index over directories
rather than a boundary, and nothing in the tree partitions memory by
project, user or agent |
Designed for a coding agent opened on the directory — Claude Code,
OpenCode or Cursor — with AGENTS.md as the session-start
routing table. Scheduled work runs through cron against an OpenCode
client; docs/SKILL_ECOSYSTEM.md lists separately
installable skill repositories so this one stays light |
The heartbeat is the system: a daily observer, a weekly reflector, and further scheduled jobs for a newsletter, a crontab monitor and an AI-news survey. Consolidation is not a background pass over a database — it is an agent rewriting Markdown on a timer | Three priority marks assigned by the observing agent at write time, defined by retention rather than by truth: 🔴 is kept permanently and is a promotion candidate, 🟡 is expected to matter for weeks, 🟢 is "定期垃圾回收" — garbage-collected periodically. Nothing filters recall on them, and nothing records that a claim was wrong | A promotion ladder with a stated threshold rather than an implicit one; an idempotency rule written into the prompt that performs the write; an instruction in the memory file itself telling a reader not to load it whole; a real embedding index with a lock and a manifest rather than a re-embed on every query; a published system whose author reports running it for a year, offered as a blueprint rather than as a product | Consolidation deletes its own evidence — the reflector rewrites the
observation log without the entries it promoted, and a promoted axiom
carries no pointer back to what produced it; the priority marks are
retention classes an LLM assigns, so nothing distinguishes a claim that
was wrong from one that stopped mattering; every trigger script ships
with /path/to/your/workspace and
<your-model-id> placeholders, so nothing in the tree
runs as committed; there is no licence file at all, which leaves the
whole repository all-rights-reserved by default |
context-keeper |
A typed entry in one of three stores — a decision
(summary, problem, why_chosen,
alternatives, tags, scope), a pipeline (name,
purpose, ordered steps) or a constraint
(rule, reason, hardness) — each
with an id, a status, an origin, a
scope, tags, related_to links, and
verification and creation timestamps. Entries are human-editable JSON
under .context/ in the project directory |
Plain JSON files per type under .context/, with zero
runtime dependencies. export_snapshot writes the whole
store to a committable .context-keeper/memory.json.gz so a
team shares memory through git; import_snapshot reads it
back non-destructively and auto-runs when the store is empty. An
optional remote store is reachable through mirror, which
pulls newest-wins or backfills local to remote.
DECISIONS.md is a derived read-only projection |
Two paths, deliberately different. get_context ranks by
tag and text overlap with a scope boost, recency, status and origin
weighting, pulls related_to links, and fills a 4,000-token
budget, reporting budget_truncated when it cannot.
query_entries applies exact predicates — status, origin,
hardness, tags any/all, scope, superseded_by,
supersedes, date bounds, free text — with no ranking at
all. An opt-in local embedder adds a calibrated cosine arm blended into
the relevance signal |
record_entry over MCP, dispatched by kind,
with per-kind fields validated server-side before anything is stored: a
decision needs summary ≥ 5, problem ≥ 40 and
why_chosen ≥ 60 characters, a pipeline name ≥
3 and purpose ≥ 40 plus at least one step, a constraint
rule ≥ 5 and reason ≥ 40. A short entry is
rejected, not warned about, and update_entry re-checks the
same floors. At capture the server looks for high-overlap live entries
and labels each pair likely_contradiction or
likely_restatement for the caller to resolve |
update_entry edits in place under the same length
floors. Recording an entry that names a predecessor flips the
predecessor's status to superseded, which demotes it out of
default recall while leaving it queryable. deprecate_entry
requires a reason and can fold a duplicate into a survivor with
merge_into. prune_stale reports entries not
verified within a threshold rather than deleting them, and
code_drift counts commits touching an entry's scope since
it was last verified and flags a scope whose file has been deleted as
orphaned_scope |
One scope string per entry, and one implementation of
what it means. scope_rules.py decides coverage for every
surface: a scope whose last component contains a dot is a file scope
matching a path tail exactly; anything else is a directory scope
matching whole consecutive components with at least one component after
them; global, all, * and empty
are domain scopes that cover no path at all. query_entries
filters on exact equality; the ranking path uses coverage as a boost;
the pre-edit hook uses it to decide which constraints to inject |
An MCP server with fourteen tools, installed as a Claude Code plugin
or an .mcpb bundle. Seven hooks: session_start
and subagent_start seed context, scope_guard
runs on PreToolUse before every Edit and Write to inject the constraints
covering the target file, constraint_reinject re-surfaces
rules mid-session, pre_compact calls
verify_quality and post_compact produces a
compaction report, and commit_capture_reminder prompts for
capture. With rules_export on, constraints are written into
the harness's own .claude/rules/ surface |
No daemon. Hooks fire on session start, subagent start,
pre-tool-use, and around compaction. prune_stale,
verify_quality, code_drift and
mirror are tools a person or an agent invokes. Nothing
rewrites the store on a schedule |
status gates the project summary and the constraints
file, and the write path, though get_context excludes only
deprecated entries; origin records whether a user, an agent
or an import wrote it and an unknown value is coerced to
agent; hardness grades a constraint.
get_context annotates a response with
no_confident_match and top_relevance when the
top entry's tag-and-text overlap falls below a 0.20 floor — chosen as
the highest value with zero false abstentions on the eval set — while
still returning the results. Capture-time conflict labelling separates a
restatement from a contradiction |
A schema that refuses a thin memory instead of storing it; two read paths with honestly different contracts, one ranked and one exact; one shared implementation of scope semantics with the four-way disagreement that motivated it written into the module docstring; an abstention signal calibrated against a committed eval rather than guessed; zero runtime dependencies, which is load-bearing because the scope hook runs before every edit; paired absence-and-presence assertions in the retrieval tests | The capture-time conflict check skips every entry whose status is
deprecated or superseded, so a rule that was
retired can be recorded again with no warning that it was ever rejected;
no append-only record of mutations exists anywhere, so an entry edited
in place leaves no trace of what it said before; no validity time, so a
constraint true only for a past release cannot say so; the abstention
floor annotates but never withholds, so a confabulated answer is still
returned and a caller that ignores the flag is unprotected; the mirror
resolves conflicts newest-wins with no merge surface |
context-mem |
An observation from a tool call, plus knowledge rows and a derived markdown vault page | SQLite as the authoritative store, with a continuously synced markdown vault | Hybrid BM25 plus vector, with an optional LLM judge blended into the ranking | Every tool call auto-ingested, noise-filtered, importance-classified and summarized | Progressive compression by age — verbatim, light, medium, distilled; pinned never compresses | One .context-mem store per project directory; no scope key on the knowledge read path | 45+ MCP tools, hooks, and init configs for nine editors, plus Obsidian and VS Code plugins | A dreamer, a pressure predictor, synthesis, topic detection and vault sync | importance and pinned drive compression; superseded_by exists and is not filtered on read | Fourteen content-aware summarizers and age-tiered compression that never deletes | The headline badge reports a different metric from the one the benchmark is known for |
context-mode |
A typed session event — file_read, error_tool, git_branch, decision, task, plan_enter/approved/rejected — plus an FTS-indexed chunk of tool output | Per-project SQLite, path derived from a canonical hash of the project directory; two FTS5 virtual tables; Markdown instruction files and a per-project memory directory read from disk | SQLite FTS5 with a weighted bm25 over a word index and a trigram index; a unified pass merges current-session chunks, prior-session events and auto-memory files | Hooks fire on every tool call and write typed events; the MCP server indexes tool output it sandboxes. No model decides what is worth keeping | No update path. ctx_purge deletes every on-disk artifact for one project directory, sidecars included; nothing smaller can be forgotten | Project directory and session id, both applied on the read path — and in per-project mode the cross-project parameter is absent from the MCP tool schema entirely | Seventeen harness adapters wiring SessionStart, PreToolUse, PostToolUse, PreCompact, UserPromptSubmit and Stop, plus an MCP server with ctx_search | None. Everything runs inside a hook or an MCP call | Events are extracted from hook payloads, never from model judgement; a deny policy and a project-boundary check gate what the sandbox will execute or read | A committed regression test that another session's events must not surface, and a tool schema that omits the cross-project parameter rather than validating it | Nothing can be corrected or individually forgotten, the knowledge block is assembled from whatever the hooks caught, and the licence forbids offering it as a service |
contextdb |
Whatever the user declares: rows, graph edges and vectors under one MVCC transaction in a single file. The schema, and therefore the memory model, belongs to the system built on top | An embedded single-file database in a single process, with relational storage, bounded graph traversal and vector similarity unified under MVCC snapshot isolation | PostgreSQL-compatible SQL, pgvector's <=> for
vector distance, and SQL/PGQ-style GRAPH_TABLE ... MATCH
for bounded traversal — described as the subset that matters rather than
the full standard — all against one snapshot |
Transactional writes validated against whatever the table declares: a state machine, a DAG constraint, a cascade. Remote changesets arrive through the same validation | MVCC delete markers keyed on a row id and the deleting transaction — the storage meaning of tombstone, not an epistemic one. What deletion means for a memory is the caller's decision | None of its own: each agent, device or service runs its own instance and they reconcile through a server, so separation is per-instance rather than a key inside one store | A Rust library and CLI, with bidirectional sync between instances over WebSocket through a central server; Python and TypeScript bindings are named as roadmap rather than shipped | Sync reconciliation applying changesets under a per-table conflict policy and returning applied, skipped and conflicting rows | None held. What it offers is enforcement: a table may declare a state machine and the engine validates every update against it, including updates arriving from another instance | A declared lifecycle enforced in the engine holds for every writer rather than for the writers that remembered, and the two relational backends answer the transition question through one shared method; conflict resolution is chosen per table, which is the right granularity when facts and statuses want different merge rules; and a merge that would break an invariant is skipped with the conflict returned and the rest of the batch applied | It holds no memories of its own, so the six epistemic marks are all the caller's to earn and none of those decisions are made here; the tombstones are MVCC row markers and read as something stronger to anyone grepping for the word; MVCC supplies transaction ordering with no world-validity axis, so an as-of question must be built from user columns; and the language bindings a memory system would likely want are roadmap rather than shipped |
contextmeld |
A memory a person writes: title, Markdown body, scope, project path, agent list and tags, with a revision number and a soft-delete timestamp | One local SQLite database holding the indexed sessions, events, projects and memories, with two FTS5 tables — one over transcript events, one over memories | FTS5 search across sessions and memories for a person, and a scope filter that decides which memories a handoff package offers | A person, through an editor, with optimistic concurrency on a revision number; archive import skips exact duplicates; no agent and no model writes a memory | Revision-checked edits; trash sets deleted_at and
restore clears it; nothing deletes a memory permanently |
global, project or agent,
applied as a filter when a handoff is assembled — in the webview, and
bypassed by an explicit staging |
A desktop app that reads agents' own history files and writes a Markdown or JSON package a person carries to the other agent; it never starts an agent | A file watcher that re-indexes agent history as it changes; nothing touches memories | Every memory is authored by a person; nothing is inferred, so there is nothing to verify | A scope model with a CHECK constraint and a filter at the one read path that reaches an agent, tested against a populated list; transcripts read and never executed | The scope predicate lives in the UI rather than the query, so any second consumer of the memory API inherits no boundary; a trashed memory is kept forever and cannot be purged |
contextstream-mcp |
Typed nodes held by a hosted service — decisions with a rationale and rejected alternatives, events, docs, diagrams, tasks, todos, transcripts and lessons — reached through six MCP tools; the client defines the wire contract and the rendering, not the storage | A closed backend reached over HTTPS. What this repository stores locally is identity and configuration: a random versioned marker in Git's common directory, a checkout-local config, folder mappings, and a thirty-second in-process result cache | Tool actions that post a query with a resolved workspace and project scope and render a typed envelope; a per-process warm cache answers an identical call inside thirty seconds and says so in the text | Tool calls and managed editor and git hooks. A capture from a hook validates the checkout binding, replaces the filesystem path with an opaque checkout id, canonicalises the remote, and re-checks the scope immediately before sending | A decision is superseded rather than edited, through a typed action that also carries dispute, verify, invalidate and choose-successor; the lookup that finds the target deliberately queries every status so an already-superseded decision can still be addressed. Local unbinding and server-side purge are separate documented operations | Workspace and project resolved from the session, a folder mapping, a task-auth override or an explicit argument, with a stated precedence and a cross-workspace project silently ignored rather than honoured; beneath that, a checkout binding that five equalities must satisfy before an automatic writer may act | Six registered MCP tools over stdio or an HTTP gateway, plus managed editor rules and git hooks that capture commits, pushes, checkouts and merges | Managed git hooks that background their own invocation, run git with optional locks disabled and a sub-second timeout, and fail open on any error | A decision status vocabulary of active, superseded, disputed and
verified with a documented server default of active, validated against a
constant in this repository; the renderer prints unknown
rather than inferring a status the payload does not carry |
A named threat — another folder appearing at a path a project once occupied — answered with a marker whose creation is deliberately separate from its reading; a minimisation boundary enforced twice on purpose, the second time as a whitelist with a test that a home-directory path is dropped entirely; a cache key that fails closed for an unidentified caller; and 2,820 committed test functions, many named for the fault they prevent | Everything the memory actually holds is in a proprietary backend this repository does not contain, so status filtering, retention and cross-tenant separation cannot be verified here; project scope accepts a name that is matched after lowercasing and stripping spaces, underscores and hyphens, so two projects whose names differ only that way collide; scope recovery after a stale-project error retries at a different scope, reported back in the result but still a write the agent did not ask for; and ten dependency manifests changed within the seven-day cooldown |
continuity-v2 |
A turn: session_id, turn_idx,
ts, role and a text synthesized
from the JSONL message content — assistant prose,
[tool:<name>] <description> for a tool call,
and [result] … truncated at five hundred characters for a
tool result, all concatenated into one field. Above it a session:
id, project, ai_title,
cwd, started_at, ended_at,
turn_count, file_path,
file_mtime, indexed_at and a
source of code or chat |
One SQLite file at data/continuity.db in WAL mode:
sessions, turns, a contentless
turns_fts FTS5 mirror kept current by insert and delete
triggers, a turn_vecs sqlite-vec table of 384-dimension
MiniLM vectors, and an edges table of TEMPORAL
and SIMILAR_TO pairs. Nothing is stored that the JSONL
transcripts do not already hold |
Three arms over the same rows. search_sessions is FTS5
with a highlighted snippet, ordered by rank.
find_similar is a sqlite-vec KNN over-fetching three times
the limit and re-ranking by
0.7 × cosine + 0.2 × linear recency over 365 days + 0.1 × session turn count capped at fifty,
printing all three components on every result.
thread_recall seeds from FTS5 and walks
TEMPORAL edges outward in both directions to a hop and turn
cap, returning the surrounding conversation grouped by session with the
seeds marked |
Nobody writes memories. index.py walks
~/.claude/projects/**/*.jsonl and
chat_index.py reads an Anthropic data export; both skip a
session whose recorded mtime matches the file. The MCP server carries a
reindex tool holding its own inline copy of the same walk.
embed.py, wire_edges.py and
wire_similar.py are separate passes a person runs |
The transcripts are the source of truth and the index is rebuilt
from them: a changed session is deleted from sessions and
turns and re-read whole, and wire_edges and
wire_similar clear their own edge type before rewiring.
There is no correction verb, no supersession and no forgetting — and no
cleanup of turn_vecs, whose rows are keyed on the
turns autoincrement id that a re-index discards |
project and source are stored on every
session and offered as optional arguments to
search_sessions and recent_sessions — the
project one as a LIKE '%…%' substring the caller supplies.
Nothing is applied by default, and find_similar and
thread_recall accept neither, so the semantic and graph
arms answer across every project on the machine |
A stdio MCP server exposing eight tools, four CLI scripts, and four
Claude Code hooks: a PreCompact checkpoint writer, a SessionStart
injector, a Stop-hook checkpointer, and an SSE proxy the user points
ANTHROPIC_BASE_URL at so it can watch token usage and ring
bells at seventy, eighty-five and ninety-five per cent |
None inside the store. The three build passes and both drift checks are commands a person runs; the only always-on component is the optional local proxy. No consolidation, no decay, no summarisation | None. A search of the tree for status,
confidence, verified, superseded,
rejected or tombstone returns one hit, and it
is resp.status in the HTTP proxy. Recency is a ranking
term, not a state. The nearest thing to a provenance distinction is the
embedding filter, which skips any turn whose synthesized text starts
with [tool: or [result] — a string-prefix test
on generated text, applied to the semantic arm only, while FTS5 indexes
tool calls and truncated tool results like anything else |
Two read-only consistency checks between a derived index and its
source, which is two more than most: drift_check.py mirrors
the indexer's skip logic exactly to report which sessions are new or
stale without writing anything, and fts_integrity_check
runs FTS5's own check with fts_rebuild beside it.
find_similar prints the three components of its hybrid
score on every row, so the ordering is inspectable. The SessionStart
hook injects nothing after /clear, honouring a deliberate
erasure |
No tests at all — no assert, no test function, no
suite. No redaction of any kind, so every credential pasted into a
session is in the FTS index and, above thirty characters, in the vector
table. The compaction checkpoint is one file at a fixed path with no
session key, and the injector checks its age and never its
Session: line, so a second session compacting within three
hours is handed the first one's state. edges is created
twice with different schemas and
CREATE TABLE IF NOT EXISTS, so its shape depends on which
script ran first. turn_vecs has no delete path while
re-indexing changes the ids it points at. And the Stop hook hardcodes
one Windows absolute path under a specific username, in a file the
README says resolves on any platform |
continuous-claude |
A 'learning' — a typed note (WORKING_SOLUTION, FAILED_APPROACH, USER_PREFERENCE, ARCHITECTURAL_DECISION, ERROR_FIX, CODEBASE_PATTERN, OPEN_THREAD) stored as an archival_memory row: content plus a 1024-d embedding, with type, tags, confidence and context in a metadata JSONB blob | PostgreSQL + pgvector (archival_memory) for learnings; a separate SQLite artifact index (handoffs, plans, continuity, FTS5) and a SQLite sessions/file_claims coordination DB; the default 'sqlite' learnings backend is selected but its write module is absent | Hybrid reciprocal-rank fusion over pgvector cosine and Postgres full-text, cross-session and cross-project, injected per prompt as a MEMORY MATCH; no confidence, type or scope filter on the read path | A background daemon polls for stale sessions and spawns a headless model that mines the session's thinking blocks, classifies them into the seven types, embeds and stores them; nothing blocks the agent | None wired — no supersede, no correction, no forget; the only mutation is an uncalled hard DELETE, and re-extraction is bounded per session rather than per rejected value | Learnings carry only a session_id and no project key, and recall applies no scope filter, so recall is global across every project; dedup, inconsistently, is scoped to the same session | A Claude Code .claude/ config — 30 hooks, 32 agents, 109 skills — installed by a wizard that needs Docker and PostgreSQL; recall is a UserPromptSubmit hook, capture a detached daemon | The memory daemon (double-fork, 60s poll) extracts learnings on a
stale heartbeat via a headless
claude -p --model sonnet --dangerously-skip-permissions
subprocess; when the session id does not match a transcript filename it
mines the most recently modified transcript from any project, and a
failed extraction is marked done and never retried |
A confidence label (high/medium/low) is stored in metadata but read on no path; there is no discrete status, and nothing withholds a learning from recall | Extraction targets the thinking blocks — the reasoning, not the actions — via a background model, and recall is hybrid RRF injected automatically; the handoff half survives compaction as git-tracked YAML | The design overshoots the code: the default learnings backend cannot write, the daemon falls back to the most recent transcript from any project and stamps it with the stale session's id, embeddings from different models share one unstamped 1024-d column, dedup is per-session while recall is global and unscoped, confidence and human-confirm are inert, and the artifact-index hook shells out to a path two segments off |
corbell |
Service, data store, queue and method nodes with typed edges; a
Decision extracted from a design document; an embedded code
chunk |
SQLite for the graph and for float32 embedding blobs; JSON for learned doc patterns and candidates | Graph traversal by service id, cosine similarity over chunk
embeddings with an optional service_id filter the caller
supplies and no default, and a context assembler for spec
generation |
graph:build re-derives the graph from the repositories;
docs:learn extracts patterns and decisions from confirmed
documents |
Whole-file rewrite of the pattern and candidate JSON; no delete, supersede or tombstone for a decision | A workspace directory and a service_id subject filter;
no principal scope on any read |
MCP server with graph_query,
get_architecture_context, code_search,
list_services; CLI; exports to Linear, Jira and Notion |
None — every stage is an explicit command | None — a confirmed boolean on a candidate document,
defaulted to true for every candidate |
Every decision keeps source_file, and the graph is
re-derivable from the repositories it describes |
The review gate's only producer confirms everything, and a re-scan overwrites the candidate file that held the answers |
core-memory |
Bead (typed record) plus Claim (subject/slot/value) with claim updates | Session JSONL as live authority, rebuildable index projection; Qdrant, Kuzu, Neo4j, SQLite backends | Typed pipeline over archive/graph/projection; lexical, semantic, entity, causal; myelinated edges; a junction/roadmap layer that plans over recurring memory locations and may never author meaning | Turn capture into beads; claim extraction; connector ingest with per-source grounding | Supersession chains, retracted, tombstone_bead, reject;
every governance action requires a reason |
scope on every bead; session/project surfaces with a
documented truth hierarchy |
Python API, HTTP server, MCP, PydanticAI tools, OpenClaw bridge, CrewAI, Spring AI | Dreamer proposes candidates for human decision; association passes; promotion; compaction | grounding gates confidence_class C/B/A;
authority; approval workflow with rejecter and reason |
Grounding caps the trust ladder, so a speculative memory cannot be promoted by use — asserted end to end, including across an index rebuild | Very large surface; supersession is record-keyed, so re-derivation is not blocked |
core-redplanet |
A statement — an atomic fact extracted from an episode and classified into one of twelve aspects | Neo4j for world facts as triples, a Postgres voice_aspects table for voice facts, and six pgvector namespaces; the only graph and vector providers the factory builds | An LLM router classifying the query into six types, each with a dedicated handler, merged and optionally reranked; a BM25 pipeline behind the v1 search route and the non-V3 fallback | Episodes chunked and diffed, two extractors split world from voice facts, entities deduped by normalization plus vector similarity, statements resolved by one model call | A model-judged contradiction stamps invalidAt from the resolution clock and an invalidatedBy episode pointer; the stamp has no guard, so a second one overwrites the first | userId as an unconditional predicate on every graph query; workspaceId required by the search services and optional at the provider, which drops its predicate when absent; no agent scope | An MCP server, thirty-eight connectors, a Tauri desktop app, a web app and a CLI | Sync jobs per connector, statement and aspect resolution, session compaction, persona generation on a queue | Aspect classification and provenance; no epistemic status field on a statement | Splitting storage by whether a fact decomposes into a triple, rather than forcing everything into one | Contradiction rests on one model call that sees candidates without their state; the LoCoMo number is a year older than this pin and lives in another repository |
cortana |
A memory with a kind, content type, retention tier, scope, project, source, dedupe key, confidence, importance, lifecycle status, an ACL, a provenance document, an observed time, a valid-from and valid-until pair and a supersession link | Local SQLite in WAL mode with a full-text index over memories, a separate candidate staging table, and consolidation job and control tables; documents and chunks with embeddings sit beside them | BM25 over the memory FTS index with a fallback OR query, gated in SQL on active status, the validity window against the wall clock, project, kind, content type, retention tier, scope, the owner bit and the ACL, then re-scored with importance, confidence and recency | Three doors: an explicit remember on MCP, HTTP and CLI that writes canonical memory directly; observations staged as expiring candidates; and consolidation, which promotes a candidate under a versioned policy or an approval boolean | A correction writes a new row carrying supersedes_id
and marks the target superseded with its content kept; forget marks a
row retracted, blanks its content and provenance and removes it from the
FTS index |
A scope column with an owner-only owner-global value, a
project, and a per-row ACL normalised to the project label when empty,
matched in SQL against labels taken from the authenticated
credential |
A Tauri desktop app, an MCP stdio server, a loopback or explicitly secured HTTP API, and a local-owner CLI | No standing memory worker. Consolidation runs per call from MCP, HTTP or the CLI and records a job row under a control table with a pause switch, and an owner's HTTP call spawns one recovery pass over queued jobs; candidate expiry runs on every candidate operation; device sync exchanges bundles through a compacted journal | A lifecycle status filtered on every recall, an ACL validated in SQL, credentials that fix a principal's labels, candidate rate limits and expiries, an automatic-retention gate that policy JSON cannot set, and a posture that starts query-only | The recall statement is the artifact to read. It gates on the active status, on the validity window, on project, kind, content type, retention tier and scope, and on the principal's admin bit before owner-global rows are reachable. Before it matches the access list it checks the list's shape with json_valid, json_type='array' and no element whose type is not text, so a corrupted or wrongly typed ACL matches nothing instead of reaching the empty-means-unrestricted branch. The writer closes that branch from the other side by substituting the project label for an empty list. The product posture matches: a new installation starts query-only, and source authorisation, ingestion, model use, shared-agent access and memory writes are separate decisions. Committed tests assert that another principal, a forgotten row and a superseded row stay out of recall, each beside a case that returns something | The validity window opens at the write clock: the only product
writer binds valid_from, observed_at and
created_at to one now, and
valid_until is a working-memory expiry, a 365-day retention
ceiling or the supersession time, so nothing records when a fact became
true. Review is advisory: the MCP consolidate tool takes an
explicit_approval boolean from the agent, and the agent's
own remember tool writes canonical memory without the
queue. A rejected candidate blocks only a re-offer by the same principal
under the same dedupe key. confidence and
importance rank rather than withhold, and
provenance_json gates nothing. The surface is broad for a
personal store, with one auto-run surface and three unpinned dependency
surfaces at this pin |
cortex-engine |
A node — observation, belief, question or hypothesis — in a namespaced graph | SQLite, Firestore or JSON behind one CortexStore interface, with atomic transactions | Neighborhood aggregation, spreading activation, multi-anchor voting, FSRS scheduling | observe and believe; a contradiction is adjudicated before it is recorded as a signal | A belief log holding old and new definitions with a reason, written transactionally | One store per namespace; namespace names validated alphanumeric, not a read predicate | An MCP server with 60 tools, a REST surface with a destructive-tool blocklist | Two-phase dream consolidation, wander, evolve, goal-directed prediction error | A confidence float penalised in proportion to adjudicator confidence | Contradiction adjudicated into five outcomes, with supersession routed away from penalty | Many neuroscience-named mechanisms and still no evaluation of retrieval quality; the one gate that is measured is the structural acceptance check on generated thoughts |
cortex-hub |
Two stores. A mem9 memory is one LLM-extracted fact string in a Qdrant point with user_id, agent_id, hash, metadata and timestamps. A knowledge document is a titled text in SQLite, chunked into Qdrant, with hall_type, origin, valid_from, invalidated_at, usage counters and lineage | Qdrant collections cortex_memories and knowledge (plus knowledge_clusters) behind a Node API; SQLite holds knowledge metadata, chunks, lineage, usage and capture logs, and session handoffs. Docker Compose with Ollama for embeddings | mem9: dense vector and a BM25 sparse arm fused by reciprocal rank, blended with recency, plus the project's last three session summaries. Knowledge: vector search over-fetched and re-scored as vector 0.55, keyword overlap 0.35, usage quality 0.05, recency 0.05 | Memory store runs two LLM calls: mem0's fact-extraction prompt, then an ADD, UPDATE, DELETE or NONE decision against neighbours above 0.7 cosine; exact duplicates are caught by hash. Knowledge is stored verbatim by agent, dashboard, session-end recipe capture, an LLM fix pass and a docs builder | mem9: LLM-chosen UPDATE overwrites by id, DELETE removes the point; the MCP delete tool and HTTP route take any id. Knowledge: hard delete, an archive status, an invalidate route that stamps invalidated_at, and fix lineage that archives the parent. No tombstone | mem9 user_id payload key composed from agent-supplied project and branch, filtered on every read. Knowledge project_id filtered only when passed. API keys carry a project_id nothing reads | MCP server with memory, knowledge and session tools; Claude Code, Gemini and Codex hooks that block edits until knowledge and memory search have run; session start builds a brief from knowledge search; session end stores the summary as memory and as a recipe candidate | Fire-and-forget recipe capture after session end and task completion, rate-limited to five an hour; a knowledge health check that rewrites low-scoring documents through an LLM, run only when POST /api/knowledge/health-check is called; a docs-to-knowledge builder on every index job | None as a state. Knowledge status is active or archived and search does not read it; a derived deprecated flag from fallback rate hides a document from the session brief only | Hash dedup scoped to the memory's own user_id; a BM25 arm with a stated reason (Vietnamese text and identifiers under an English-only embedder); hooks that make recall a precondition for editing, with evidence-carrying markers and a named escape file; a validity axis a caller can query as of a date | Feedback from any quality gate credits or blames the ten documents touched in the last hour, in every project; archived and invalidated documents stay in search; three of four knowledge writers omit cluster_id, which hierarchical search requires above 500 chunks; the mutation history store is never instantiated; memory routes accept unauthenticated callers on port 4000 |
cortex-hypermnesia |
A memory row with a supersession link, beside a wiki layer of concepts, synthesised drafts, published pages, claim events and citations | A local SQLite file by default, or PostgreSQL with pgvector; the project's memory is "a file you own and can delete" | Lexical, vector and graph retrieval with no model in the loop, joined against a current-memories view and inspectable after the fact | Fifty-four MCP tools over one stdio server, the same set on every supported host | A correction sets superseded_by_id on the old row; wiki
pages carry their own superseded_by and a deprecated
status |
A team-scope backfill exists in the schema module; no scope predicate was traced on the recall path | One stdio MCP server across Claude Code, the Claude Desktop bundle, Claude Cowork and other local stdio hosts, with per-host differences "stated there, not discovered after install" | A homeostatic state table with a fold log, draft synthesis, curation and compilation into pages | Supersession as a view rather than a delete, retrieval inspectability, no model in the retrieval loop, and a CI gate over the documentation's own numbers | The documentation gate is the thing to take away.
scripts/check_doc_claims.py compares "every advertised
count against the one place that owns it" and runs "at the point where
the drift is introduced (every push and pull request), not at release
time" — so a README number that stops matching the repository fails the
build rather than ageing quietly. Its exemption mechanism is better
still: a line that states a number meaning something other than the
advertised total declares
[not-a-count-claim: <label>], and "[t]he declared set
is a registry: it is printed on every successful run and pinned by a
test naming each member, so an exemption is added deliberately or not at
all". An escape hatch that is enumerated, printed and test-pinned is the
difference between a gate and a suggestion. The product framing is
equally concrete: "[n]o LLM in the retrieval loop, and nothing leaves
localhost unless you configure an integration that does", one stdio
server with the same fifty-four tools across hosts and per-host
differences "stated there, not discovered after install", and a headline
that promises accountability rather than intelligence — "[k]eep
decisions, fixes and project context between sessions, and inspect what
was retrieved" |
The wiki's draft queue looks like a human-review gate and is not
one: wiki_curate evaluates pending drafts through
evaluate_draft, described as pure logic, and the compile
step publishes "every draft currently in status='approved'" — so a
model-synthesised draft, carrying the synth_prompt and
synth_model that produced it, is promoted by an automated
evaluation rather than by a person, and reviewed_at records
when that happened rather than who. Scope is the other gap: a team-scope
backfill exists in the schema module and no scope predicate was traced
on either recall path, so what separates one project's memories from
another's was not established here. confidence on a draft
is a continuous default of 0.5, so an unset value is indistinguishable
from a considered middle. And the surface is large — 274,911 lines,
fifty-four tools, a wiki subsystem, a homeostatic fold log, Swift
alongside Python — with four auto-run surfaces and four build-time
execution points at this pin, which is what a multi-host MCP bundle with
installers looks like |
cortex |
An episodic row (session, summary, topics, entities, importance, sensitivity) or a semantic row (content, summary, category, tags, importance, sensitivity) | libSQL/SQLite with FTS, embeddings stored as blobs, and an optional mirrored vector backend | Vector plus lexical over episodic and semantic, tier-filtered, with
an optional AND em.session_id = ? predicate and a graph
traversal beside it |
Regex heuristics assign category and tags with no model call; a classifier assigns a sensitivity level; the vector store is mirrored best-effort | Consolidation and a delete path into both the row store and the vector records | None enforced. Two of the five retrieval arms accept a
sessionId and apply it only if the model supplies it in its
own tool arguments; the semantic, semantic-vector and graph arms take no
session parameter at all |
A Deno agent runtime with a memory_search tool, a supervisor decision path and a human approval gate | Consolidation, a preference learner, and a weekly benchmark workflow in CI | A four-level sensitivity classification — public, normal, sensitive, secret — computed at write and recomputed at read | A read gate that can refuse: hits are re-classified after retrieval, a secret-classified result needs a supervisor decision and then a human yes at a terminal prompt, and denial returns an error rather than a redaction | A complete MemoryPrivacyPolicy with allowed tiers, PII
redaction and retention lives in a process-local Map and is consulted by
nothing |
cortexdb |
A text row in the messages table under a caller-chosen memory_id, with importance, TTL and free metadata, plus optional entities and relations that also land in the knowledge graph. Knowledge documents and graph facts are separate units | One SQLite file, by default ~/.cortexdb/cortexdb.db shared by every project on the machine, or PostgreSQL with pgvector. Memories in messages, the graph in graph_nodes and graph_edges with history tables, and a trigger-written change_log | memory_search fuses a bucket-filtered FTS5 or LIKE lexical arm, a bucket-filtered cosine arm with a 0.28 floor when an embedder is set, and entity-graph or PPR lanes that drop other buckets after the query. Importance and age are bounded tie-breakers. knowledge_memory_recall adds documents and graph facts | Explicit memory_save or knowledge_memory_remember, upsert by memory_id. A SessionEnd hook distils the transcript with an LLM into up to eight global-scope memories in a detached process. Markdown export, hand edit and sync back; Claude Code memory import | Upsert or memory_update in place; supersedes stamps superseded_by on the named rows, which every search lane then drops; TTL hides expired rows at read; delete removes the row and retracts its graph node into history. No tombstone | A bucket id built from scope, user and namespace, stored as session_id and matched in SQL on two of four search lanes. On the local MCP server scope, user and namespace are caller arguments; on the gRPC server a scoped key confines user, scope and namespace per request | Claude Code and Codex plugin: MCP server, UserPromptSubmit auto-recall hook, SessionStart directive, SessionEnd capture hook, slash commands. OpenClaw and Hermes providers; gRPC and HTTP servers; Go, Rust, Python and Node clients | SessionEnd capture runs detached with an LLM; an hourly janitor prunes the change log; inference maintenance reads the change log. No pass rewrites or re-reads the memory table | None on memory rows beyond superseded_by. Graph rows may carry a knowledge-contract grade (verified, self_consistent, asserted, held, refused) that verify_claims and entity resolution read and recall ignores | Supersession that keeps the old row and leaves every search lane; a similarity floor so semantic search can answer nothing; an embed failure stores the memory without a vector; deletion retracts the graph node too; a change log written by triggers inside the write; scoped gRPC keys that refuse the opaque CallTool path and answer NOT_FOUND for another user's id | The auto-recall hook reads only the global default bucket, so memories saved as the remember command instructs are never injected; memory_get, memory_list_all and the graph tools read across every bucket; the graph lane filters by bucket after the query; a scoped key cannot use CallTool, which the recall hook and the Hermes provider depend on; one file holds every project's memory |
cortexes |
A Markdown page with frontmatter in Notes/category or Projects/repo, distilled from Raw session transcripts or saved directly; indexed as a body vector, an LLM-written bilingual summary vector, and a BM25 record | The vault is a git repo of Markdown files and is the source of truth; a derived Chroma collection at ~/.cortex/vectorstore and a pickled BM25 index at ~/.cortex/bm25, both rebuildable | cortex-vec search: weighted RRF (k=60, 0.4 BM25, 0.6 vector) over jieba-tokenized BM25 and OpenAI embeddings; optional wikilink graph stream, synonym boost, LLM rerank and per-repo cap, all off by default. BM25-only without an OpenAI key | SessionEnd writes every session over 4 KB to Raw/ automatically, filtered and redacted; notes are written by the model through the evolve, distill and broadcast skills, with a user confirmation the skill prose asks for | Broadcast edits existing pages change by change with a y/n per change; contradictions are flagged inline or the old claim is rewritten. No skill deletes a page or runs cortex-vec delete or rebuild. Superseded prefix Raws are git rm'd | One vault per machine. Projects/ pages carry a repo key filtered by --repo; Notes/ are cross-repo by design. Repo identity is the origin URL basename | Claude Code plugin: SessionStart menu hook, SessionEnd recorder, six slash commands, six skills, and the cortex-vec CLI from PyPI | SessionEnd filter and reclaim run detached under nohup; a claude -p classifier compresses up to five oversized blocks per session. No background pass over notes | None on notes. Raw files carry position-anchored outcome markers (new, pending-merge, skip-routine, no-insight) that drive the distill and broadcast queues, not retrieval | One filter language held across three retrieval arms by a lockstep test and a field table that refuses unknown keys; a mechanical coverage gate before a Raw may be declared insight-free; atomic Raw writes with redaction and a logged failure path; prefix reclaim that refuses a cross-repo pair | Without an OpenAI key, cortex-vec upsert exits before updating BM25, so saved notes never become searchable; a full rebuild without a key drops the vector collection and builds nothing; a hand-deleted page stays retrievable; human confirmation is prose the model can skip |
cortexgraph |
A memory with a decaying strength, a use count, entities and a review schedule, plus typed relations | An append-only JSONL log or SQLite, with promoted memories written as Markdown into a vault | Activation spreading over relations, filtered to active status, weighted by current strength | Append to the log; strength starts at 1.0 and decays from last_used unless reinforced | Decay to a pruning threshold; promotion moves a memory to a Markdown file and sets promoted_to | None — no user, project, agent or session key anywhere in the
source. The security/ package guards filesystem paths,
which is containment rather than scoping |
An MCP server, a CLI, a web surface and an Obsidian-style Markdown vault | Ebbinghaus pruning, hippocampal consolidation, relationship discovery and review scheduling | None epistemic — status is active, promoted or archived, and strength is a decay curve | Forgetting is the default and reinforcement is the exception, which is the inverse of most stores here | The licence is AGPL-3.0 in LICENSE and MIT in CITATION.cff, and the two are not reconcilable |
cosmonapse |
An entry, shape left to the backend; Hit and
RecallResult on the way out, ImprintReceipt on
the way in |
An Engram ABC with three shipped backends — a dict,
stdlib sqlite3, and asyncpg Postgres |
recall() with a deadline, preceded by
can_serve(query) — a hosting Dendrite skips responding when
a backend says it cannot answer |
imprint(op, entry, merge_key=..., trace_id=...)
returning a receipt, with each write journaling its inverse against the
trace |
compensate(trace_id) replays journaled inverses LIFO;
commit(trace_id) discards the journal. No delete on the
contract itself |
None in the contract. namespace appears only as advice
about hosting more than one Engram |
An event-driven A2A protocol — agents as functions on a bus — with Python and TypeScript SDKs, a CLI, and in-memory, TCP, NATS and Kafka transports | None on the memory path | None. No status, confidence or provenance on an entry | A contract that models refusal, overload, deadlines and rollback — the only memory interface here with a failure vocabulary | The saga journal is an in-process dict, so a worker that dies mid-workflow leaves provisional writes permanent and unmarked |
counterparts |
A memory row: title, body in the model's own words, kind (self, person, entity, skill, place, fact), three salience dimensions, band, use and return counts, fade, feelings and trait rows, confidential flag, source and origin session | One SQLite file per owner (counterparts.sqlite, WAL, synchronous FULL) holding bodies, versions, edges, contradictions and logs; a rebuildable cache SQLite for tokens and static embeddings; JSONL capture buffers per project directory; daily snapshots | Ambient per turn on UserPromptSubmit: rarity-weighted token cues, a lagged static-embedding channel, date cues and spreading activation over co-activation edges, gated into loud and footnote tiers inside 2,048 bytes and 1,200 ms. A recall tool expands a handle or answers a question | The model writes memories itself: the Stop hook asks for them and the session_end, chapter and note tools deposit them through a content-idempotency ledger and a five-gate battery with credential redaction. A crash fallback and a next-session write-up cover sessions that ended unasked | updates plus how settles a pair as changed (one strength cut), corrected (archived) or open; beliefs take pressure; merges supersede with versions kept 90 lived days; the owner's interactive remove blanks the row, chases every copy it knows and deny-lists the id | One store per owner shared by every project. Directories can be switched off or paused; origin_scope is recorded and read by no retrieval; confidential memories reach only the owner's sessions; handoffs are excluded from recall | Claude Code hooks (five events) and a stdio MCP server with nine tools; a CLI; a local dashboard; a headless claude -p night run for dreaming and reflection | A detached worker per session boundary and a nightly cycle: decay on a lived-day clock, archival prune below strength 0.02 after 90 lived days of dwell, core promotion, embedding backfill; an opt-in dream that merges, links, flags and settles, each change undoable | A corrected settle archives the losing memory out of recall; unsettled, changed and open pairs are labels in front of or after the text; protected and core memories refuse change and correction; no candidate state | Every tool claim is rendered from a registry whose mechanism pointers a test checks; the removal path is owner-only by import-graph test and interactive confirmation; settles are typed, attributed, explained and undoable; confidentiality is a column gate tested with positive controls | Any session can archive an unprotected memory by id through note settle, and only the owner can undo it; removal leaves the deposit's content hash in the events table and the per-project proposal ledger; no scope predicate; no CI; the prune module's header says a strong cue can still reach an archived memory, and recall excludes it |
cowagent |
Markdown files, chunked into an indexed chunks
table |
SQLite with embeddings and self-healing FTS5 | Vector plus keyword over chunks; MEMORY.md injected in
full |
Summarize into dated daily files, then distil | Recency-wins conflict update; whole-file overwrite | user_id and scope, defaulting to
shared |
Agent memory tools | Deep Dream after the daily summary, 23:55 cron | Line-addressable chunks with hashes; dream diary | Dated intermediate layer and written distillation rules | Shared-by-default scope; chained lossy summarization |
craft |
A file under .craft/: a learning in
.learnings.yaml — pattern, category, evidence entries with
a source kind, a quote, a story and a date, an occurrence count and a
status — a locked pattern in design/locked.md, a token in
design/tokens.yaml with a provenance comment, a durable
note in notebook/notes/ with a facet and a date in its
name, a tweak record with a taste: field, an observation
with a surfaced flag, a failure classified as knowledge gap
or noise, a riff memory, and a story whose decisions: list
names records under a directory nothing creates |
Plain files under <project>/.craft/ — YAML,
Markdown with frontmatter, a shell-sourced .global-state,
per-story JSONL under .events/ — plus what the reflect
drain writes into .claude/; /tmp markers for
the stop guard; nothing outside the project except /tmp,
and the project decides whether .craft/ is tracked by
git |
No search: the session hook injects a one-line-per-note index and a status line, the prompt hook injects the active cycle, story and chunk, and everything else is a file an agent or command is told to read by path — locked patterns and tokens by the implementer and the style analyser, decision records by the planner, learnings by the reflect drain | Commands and agents write the files as instructed by their prompts —
a learning after each chunk, a lock on approval, a tweak record on an
adhoc change, a note on an accepted offer; scripts own the structured
writes — append-event.sh for events,
observations-append.sh for observations,
merge-tokens.py for tokens,
handle-tool-failure.py for failures; a source write outside
.craft/ and .claude/ is denied by a PreToolUse
hook unless a story, an adhoc flow, a workflow session or
dev_mode opened the gate |
A learning moves from pending to written
and stays in the file; a skipped one stays pending and is offered again;
a failure pattern is deleted after the drain whether approved or not; a
todo moves to done/; a token key is replaced under a merge
that snapshots and self-verifies; nothing records a rejected learning,
and nothing removes what the drain wrote into .claude/ |
One .craft/ per project root, resolved by walking up
from the working directory with a monorepo pin file when several exist;
the hooks read only that project's state; no scope key inside a
store |
A Claude Code plugin installed from its own marketplace — seven hook
events, 33 slash commands, 27 agents, 11 skills, a
chrome-devtools MCP server started as
npx chrome-devtools-mcp@latest — with the drain's output
landing in the project's .claude/ for Claude Code itself to
load |
Nothing runs outside a Claude Code session; the hooks fire on session start, every prompt, every write, every Bash call, every tool failure, before compaction and on stop; a PostToolUse hook updates progress asynchronously | A learning's status, pending or written;
an evidence list with a source kind — statement, correction, request,
explanation, repeated pattern, CLI error — a quote and a date; a
failure's class, knowledge gap or iteration noise; a note's facet and
as of date; an observation's surfaced flag; a
token's provenance comment |
Nothing a session learns reaches a prompt until a person has seen it listed and approved it; the write gate makes the memory directory the one place an unapproved write can land; the token merge refuses whole-file writes and reports conflicts per key before asking; the notes index is a MEMORY.md-style always-loaded surface with the body read on demand; eighty-five test scripts in bash with no dependency | A PreToolUse hook auto-approves every Bash command outside a short
blocklist; the MCP server is an unpinned @latest; the
decision records the planner reads have no writer; a skipped learning is
re-offered forever and a declined failure pattern vanishes; what the
drain wrote into CLAUDE.md is never revised by craft; the whole memory
is prompt-instructed writes by the agent into files the agent can also
edit directly, gated only by path; 288 commits in four months by one
author |
create-context-graph |
Three tiers written through neo4j-agent-memory: a conversation
message; a long-term entity that is a name, a POLE+O type and one
description string carrying every other property as
markdown; and a decision trace of thought/action/observation steps.
Documents sit beside them, written twice on the hosted backend — once as
an entity, once as a message |
Whichever backend was chosen at scaffold time: the hosted Neo4j
Agent Memory Service over REST by default, or a self-hosted Neo4j over
bolt with --self-hosted. The generated project also keeps
data/fixtures.json,
.context-graph/watermarks.json and
.context-graph/deadletter.jsonl on disk |
Cypher, almost entirely — per-domain agent tools, a free-form
run_cypher, and app helpers doing
toLower(...) CONTAINS toLower($query) substring matching.
get_context also asks the library for entities, preferences
and traces, and all eight framework templates keep only
messages |
Synchronous on the chat path: store_message blocks on
the library's extraction twice a turn. Connectors ingest real SaaS and
local-session history at scaffold time and again through
make import, with per-connector watermarks and a JSONL
deadletter |
Nothing on the default backend — the CLI and make reset
report that no delete endpoint exists rather than pretending. On bolt
the designed eraser is MATCH (n) DETACH DELETE n, and the
free-form Cypher route and agent tool accept any write, a targeted
delete included. No per-memory delete, TTL, supersession or expiry is
designed anywhere in the tree |
A domain property MERGEd into the node key by the
generated seeder on bolt and filtered as
n.domain IS NULL OR n.domain = $domain in nine REST read
paths. The CLI's library ingest and the generated importer write no
node-level domain, no bundled agent tool's Cypher names it although
every tool reads the same graph through the same function, and on the
hosted backend no domain property is written at all, so the boundary
there is the API key's workspace |
Eight agent frameworks from one template set behind a shared FastAPI
layer and Next.js UI, an optional Claude Desktop MCP config pointing at
neo4j_agent_memory.mcp.server, and thirteen connectors |
None in the generated app. Every write runs in the request that
caused it or in a make target |
Confidence floats on extracted decisions and preferences, a
REJECTED edge to the alternative a user corrected away, and
secret redaction before import. No read path filters on any of them |
A watermark-plus-deadletter import whose watermark only advances on a clean run, a parity contract test pinning two deliberately duplicated write paths to one call sequence, redaction wired into every content path of the Claude Code connector, and a reset that refuses rather than reports zero | On the default backend every relationship is encoded into a text
field nothing in the tree reads back, entity properties collapse into
prose, and nothing can be deleted; on bolt the agent's Cypher tool is
described to the model as read-only and accepts writes; the generated
document browser returns any OBJECT-typed entity as a document; and the
domain-scoping test's assertion is len(...) >= 0 |
crewai |
A MemoryRecord — content, a hierarchical
scope path, categories, metadata, an
importance float, created_at,
last_accessed, a source, and a
private flag |
LanceDB by default, Qdrant Edge as an alternative, behind a
backend.py contract; a separate SQLite store for kickoff
task outputs |
A recall Flow — sub-queries embedded in parallel, searched across
candidate scopes concurrently, oversampled 2×, then composite-scored on
semantic, recency and importance with match_reasons
attached |
An encoding Flow — batch embed, intra-batch cosine dedup, parallel find-similar, parallel LLM analysis producing a consolidation plan, then bulk execute | forget() deletes by scope, category, age, metadata
filter or explicit ids; update() rewrites in place; the
consolidation plan lets the model delete existing records on write |
A path prefix — /company/engineering/alice — applied as
scope_prefix on every search, plus a private
flag filtered against the requesting source |
Memory, MemoryScope and
MemorySlice as views; agent tools; an event bus; a
read-only Textual TUI in the CLI |
None scheduled; consolidation happens inline on the write path | An importance float from 0.0 to 1.0 that feeds ranking.
No status, no verification, no provenance beyond
source |
Scope as a hierarchical path with subscope views and a committed test that a rooted view cannot recall a sibling's records; recall that reports what it looked for and did not find | An LLM on the write path is authorised to delete existing records, with no tombstone, no audit and no human in the loop |
crystalline |
An engram: one markdown file with OKF frontmatter (type, title, permalink, tags, a free-text status, recorded_at, optional valid_from and valid_to, a generated stamp naming the actor and model, a verified trail), observation bullets and typed relations, inside a domain with a MANIFEST | Markdown files per domain as the source of truth, or database rows for a virtual domain; a derived index in Turso (SQLite-compatible) or a shared PostgreSQL with pgvector, holding engrams, chunks with embeddings, observations, relations, links, tags and per-actor draft rows mirrored to a journal | Hybrid search blending a LIKE-prefiltered weighted term score with a cosine top-100 over chunk embeddings, 0.4 and 0.6, with a salience lift and a fade for retired statuses; a PageRank-ranked relation and link neighbourhood for build_context; a per-prompt hook naming up to three engrams | Explicit: an agent calls write_engram, edit_engram, split_engram or move_engram over MCP, always naming a domain, or a person edits in the Fluid web UI. The file and its index rows are written synchronously and embedding runs in a background worker. A Stop hook nudges the agent once per session to propose captures | Edits in place; supersession by setting a retirement status, closing valid_to and linking superseded_by, which fades rather than hides; delete removes the file and rows. In a review-mode domain each of these lands in the author's draft, and a draft deletion is a per-path tombstone row | Domains in one shared index, filtered by name on every read; private domains with owners and members per account; a per-author actor column screening drafts; the machine owner over stdio and the CLI is unrestricted | A single binary: an MCP server over stdio or HTTP with 30 tools, a REST API, the Fluid web UI with live co-editing, a CLI mirroring the tools, and installers wiring SessionStart, UserPromptSubmit and Stop hooks plus skills into Claude Code, Codex, Copilot, Cursor, Kiro, Gemini CLI and Qwen Code | An embed worker after each write, a file watcher and sync, an optional local NLI pass scoring observation pairs for contradictions after each embedding pass, GitHub pull and share for team domains; evolve is a read-only sweep returning a ranked maintenance queue | A retirement status filtered from the recall hook and the write advisory and faded in search; review-mode drafts withheld from every reader but their author until a merged proposal lands; a verified trail whose actor the caller may name | Every write must name a domain; a review mode that turns agent writes into per-author drafts only a forge merge publishes, with the agent holding no merge verb; one actor screen shared by every read leg; tests that pair each must-not with a must-have on a populated index | Retired knowledge is returned by search at 0.6 weight and current_only has no caller; HTTP MCP serves without a token by default; an agent can record a verification naming a person; sharing: direct removes the review step without a person; no durable mutation log outside git |
csm |
Typed memory row across eleven types, plus experience packets, AgentBook events, and work-ledger file changes | PostgreSQL with pgvector HNSW across 46 tables; a deliberately narrower SQLite core | RRF over vector, Postgres FTS, and entity boost, weighted 0.35/0.25/0.35 with a 0.05 recency term and a 168-hour half-life | Fully deterministic — no LLM on the write path; synchronous on the embedding call | Exact-content supersede, flag-based archive, a capped per-project TTL delete, and a lesson promoter that marks its source candidate applied; search, list, cascade and evidence injection exclude superseded and archived rows, the per-turn lesson-trigger cache does not | project_id bound at tool registration and applied on the search
path, failing closed to 1=0 when absent; the per-turn
lesson-trigger cache reads every project's lessons from the same table
and injects them |
OpenCode plugin over eleven hooks, four of them experimental; plus a stdio Codex MCP bridge | In-process timers — distiller flush, belief consolidation, self-model replay, doc flush; no queue or worker | Provenance fields on every row and a known-versus-inferred claim classifier; no status on a memory, and the belief store's only admitting state is one no code path writes | Per-item injection provenance recording what was trimmed and why; a work ledger that re-reads the file to decide whether an edit survived | Four read paths filter beliefs on a promoted status no writer produces; memory_candidates is selected, updated and swept by five statements and inserted into by none; and the lesson-trigger cache injects up to 50 lessons every turn with neither the project nor the lifecycle predicate the rest of the read paths carry |
ctx-open |
Typed cognitive records: goal, epic, task, hypothesis, decision, evidence, conclusion, plus operational runbooks and cognitive triggers. Each carries a state enum and a Traceability record with a caller-supplied author and created and updated times | A .ctx directory of indented JSON files beside the project: one working-context file holding every goal, task, hypothesis, decision, evidence item and conclusion; one file per commit, runbook, trigger, packet and run | No search. A context packet takes up to three goals by priority and six tasks, then follows id links to hypotheses ordered by confidence, decisions, evidence and conclusions, each capped; runbooks are scored by task, goal and trigger substring match. A goal or task id that matches nothing falls back to the top goals | Explicit CLI or MCP verbs, synchronous, under a process and file lock. Hypotheses are born Proposed; decisions and conclusions take any state the caller passes; evidence is always stamped Validated. A heuristic bootstrap reads documents and writes a goal, task, hypotheses and evidence without a model call | Update in place by id, with state changes, merge and supersede verbs. No delete verb for any record. Commits snapshot the whole working context with a diff against the previous commit. Branch merge takes the incoming copy of every entity | Physical: one .ctx directory per project. The MCP server is pinned to one repository unless started with an allowed root. Commits carry a branch name that the log filters on; the working context holds one branch at a time | CLI, a stdio MCP server that is read-only unless started with --mode write, an ACP-style JSON-RPC agent that is read-only, a local web viewer, and prompt files that teach the agent the loop | None. Commits are cut by the agent or a person; runs call OpenAI or Anthropic only when invoked | State enums are rendered into the packet as labels and used by planning, audit and next-work filters; the packet itself filters no hypothesis, decision, evidence or conclusion by state. Runbooks are filtered to Active | A typed reasoning model with explicit hypothesis, decision and conclusion states; commits that store a full snapshot and an entity diff; a consistency audit that names missing evidence and open hypotheses on closed tasks; atomic temp-file writes under a process and file lock; read-only MCP by default | Superseded hypotheses reach the packet under their old state label; merge overwrites divergent entities with the incoming copy after reporting them, and its equality test is reference-based on lists; bootstrap_map reads any file path, bypassing the repository guard, in read-only mode; documented states silently become defaults |
ctx |
Markdown entry staged, then digested into a themed region of a root document | Files in the project tree; a dream ledger and journal alongside | Progressive disclosure — roots, themes, regions read by any tool that can read files | Staged entries; dream proposes, a schema gate
validates, apply writes within a guarded scope |
Proposal dispositions including promote; region folding; no value-level tombstone — a rejection is durable and consulted, but keyed on the id the model emitted rather than on the content | None on the read path — progressive disclosure is any tool reading
files. What exists is a write-scope guard by path: dreams/
and ideas/, with specs/ only on promote |
CLI, MCP, VS Code extension, skills; any tool that can read files | dream scan, propose, validate, apply, with a ledger and
resume |
Provenance required on proposals; invalid proposals rejected rather than admitted; and a four-value human decision — accepted, rejected, amended, skipped — recorded per proposal in the ledger | A per-proposal human gate whose every disposition lands in an append-only ledger, a write-scope guard on consolidation, and a corruption regression corpus from the literature | Correction is region folding; nothing records that a digested claim was wrong |
cua |
A skill — one directory holding SKILL.md with frontmatter, a section per step, and a generated agent prompt, beside the source video, the raw input events, per-step frames and trajectory.json | Files under one home directory, at a fixed path per machine. No database, no index, no manifest | None. Three MCP tools list, read and delete; the model names the skill it wants. No scoring, ranking, embedding or similarity exists on this path | Out of band and blocking. A person records a screen session, ffmpeg cuts one frame per input event, and a vision model captions each frame into observation, think, action and expectation | Delete removes the directory outright. There is no update — recording again under an existing name gets a numeric suffix rather than replacing the old skill | None. One global directory per machine, with no key on a skill and no predicate on any read | An MCP server whose permissions default to every permission when none are given, plus a Python CLI and a separate TypeScript CLI over the same directory | None. Captioning runs inside the record command and blocks it; one model call per recorded input event | None stored. Frontmatter is a name and a description, and a captioning failure writes empty sections while the command still reports success | Each step carries an expectation, which is a postcondition a later agent can check; the video and raw events stay beside the distilled text so a skill can be re-derived; the cross-scope read is a separate tool rather than a wider argument | The delete tool passes an unvalidated model-supplied name to a recursive delete and the server grants every permission by default; a captioning failure is silent and produces a skill indistinguishable from a good one at rest; a demonstration recorded against a hostile screen becomes durable instruction text |
cyrene-agent |
Three layers in one memory.json: an L0 profile of five string fields, an L1 recent state of three fields, and L2 episodes (content, trigger text, optional source quote, status, weight, evidence ids). Separately, opt-in social atoms per conversation: long_term, short_term or open_loop, each with a verbatim evidence quote | JSON files in the Electron userData directory: memory.json (whole-file rewrite), rag-data/memory-store.json for vectors (atomic, debounced), chat-social-atoms.json, entity-graph.json and an append-only memory-trace.log | L2: the user_memory tool runs hybrid vector plus BM25 with an optional cross-encoder rerank over an allowlist of recallable episodes. Voice calls and proactive messages inject up to four L2 by DMAE activation from keyword and recall hits. L0 and L1 are injected whole every turn. Social atoms: BM25 with a 30-day half-life, top five | Background: every sixth turn an LLM judge reads the last eight turns and emits candidates filtered for overclaim; L0 requires explicit and user_explicit. Also a write_memory tool, a reflection pass every 20 turns that rewrites L0 and L1, and compression of similar L2 into summaries | L0 and L1 overwrite in place. L2 changes status (active, aging, archived, superseded, merged) and is never deleted outside a compression rollback; Obsidian edits overwrite L2 content. No tombstone | None on the L0/L1/L2 store: one global profile and episode set shared by the desktop app and every channel, QQ groups included. Social atoms carry conversationId and are filtered on it | Electron desktop app with Live2D; tools user_memory, read_memory, write_memory and recall_history in the agent harness; a memory panel for L0 and L1 edits; a two-way Obsidian vault sync for L2 content | A serial LLM queue: judge every 6 turns, one conflict resolution every 5 turns with a 60-second floor, reflection and compression every 20, weight decay every 50; vector reconciliation at startup | Social atoms: active versus superseded or resolved, filtered on every read. L2: status filtered on vector recall, not on DMAE injection; a conflict marker is shown as a warning suffix. No human review state | Verbatim evidence-quote check and role gating on social atoms, applied all-or-nothing per batch; L2 recall reads status from the canonical store rather than a copy in the index; a compression transaction with explicit rollback; startup reconciliation between store and vector index with backups; conservative judge prompt with a post-filter on absolute terms | The write_memory tool and the reflection pass both write L0 past the judge's explicit-user gate; superseded and merged L2 reach call and proactive prompts; decay archives episodes recalled one to ten times and never touches unrecalled ones; channel senders write the desktop user's profile; the judge's turn buffer mixes conversations; memory.json is rewritten non-atomically every turn |
daem0n-mcp |
A memory row with content, rationale, tags and an outcome, versioned on every change | SQLite per project under .daem0nmcp, with FTS5, BM25, Qdrant vectors and a graph layer | Hybrid routing with a query classifier, recall planner, decay and a failed-decision boost | Gated by covenant middleware — mutating tools require a signed preflight token | Every change appends a memory_versions row; invalidation sets valid_to and a link | One database per project directory; project_path is not a read-path predicate | MCP server with FastMCP middleware, Claude and OpenCode hooks, a CLI, an LSP spec | Idle dreaming — re-evaluates failed decisions, discovers edges, refreshes communities | outcome and worked on each version; facts carry is_verified, which nothing reads | A real bitemporal query with both dimensions, and each entry point stating which it uses | The covenant HMAC key has a committed default, and the bypass log has no writer |
daimon |
Trust-classed checkpoint item: open question, decision, belief, uncertainty | Per-project JSON checkpoints plus a disposable SQLite FTS5 index | Automatic session-start injection; FTS5/BM25 for
recall, ranked by importance x decay, with contradiction
and supersession as tiers applied before the weighting on both read
paths — demotion keys and never filters; a forgotten value and a
human-confirmed quarantine are judged out before a row is indexed and
again on every hit |
Detached LLM extraction at session end, then deterministic quote and outcome gates | A value-keyed tombstone on the item id, every sibling id and a key ref of its own, appended before the rewrite and consulted at every checkpoint write, so a re-extracted forgotten value is dropped before it reaches disk and an unreadable ledger refuses the write; also consulted by the supersede-candidate emitter and the index build; forget runs every registry step, reports each surface it could not reach, rebuilds the index, purges the chunk cache and redacts every ledger, keeping a quarantine's verdict; only a human unforget lifts it | Per-project bucket on every unaddressed read, each latest-read naming a route and an admit rule; cross-project reads by explicit slug, all_projects, a host-declared allowlist, or a ruling layer — an ancestor directory outside every git working tree whose own bucket claims it by name, read-only and never written from below. The slug and all_projects are arguments the model passes to the shipped MCP recall and brief tools, refused only when the host sets the tenant-scoped flag, which also returns no layers | Host hooks (Claude Code plugin, Windsurf, Codex), opt-in delivery of cross-project asks into a running session at its next turn boundary, rulings ratified once at a directory above a set of repositories and rendered into each one at brief time, a CLI split into subcommand family modules behind one render seam, a read-only stdio MCP whose recall rows name a stale item in plain words, an in-process host API that renders the machine briefing with a state and plans or launches a serialize repair, and a local read-only viewer with search-as-recall | A pre-action hook runs a human-armed ruling check before a matching shell action, fail-open under a five-second budget, and logs every firing; a check armed at a ruling layer re-arms in every repository below it on a machine that never synced the layer directly; detached serialize child, retry ledger with self-heal and a serial heal of every healable session under one machine-wide lock, index rebuild | verbatim vs inferred as a stored field, verified by code against the transcript, with corroboration as a separate axis that can never become a trust class; a candidate/active/overturned ledger carrying both polarities, whose authority is read off the observed write channel and whose polarity is derived from the founding event name rather than any writable field; a candidate/confirmed/rejected relation ledger in shadow mode with no mechanical channel at all; a human quarantine ledger whose active state one read view withholds from every read surface, closing outright when the ledger cannot be read, proposed by an agent and confirmed or released only through a human channel, and published to teammates as a hash-only row; and a contradiction slot on the recall index that only receipt, file, branch and PR probes may write, each cure bound to its own claim and recorded rather than erased | Authority derived from the observed write channel rather than a caller-set flag, with the strongest channels unreachable from the CLI; a surface registry where every file shape declares its delete strategy and a guard refuses an undeclared one; a residue auditor whose third exit code separates cannot-prove from clean; a placebo arm that has refuted the project's own features; one value-keyed human verdict that withholds where every machine signal only ranks, through one read view and a census asserting no surface leaks it | One live checkpoint per project; the chunk cache is purged wholesale
because it is keyed by chunk text and cannot be searched by value; the
negative-knowledge guard is agent-invoked and advisory, and nothing
reaps its ledger by age; world evidence reaches the contradiction slot
only from a daimon brief run with worldcheck on, so the MCP
and Hermes briefing paths record none and a dependency-version
contradiction moves no rank; the team sidecar's write access is the
trust boundary for a published quarantine, so a member who can write it
can forge a row that over-suppresses or one that lifts a teammate's
claim; one ratification at a ruling layer arms a shell-blocking check in
every repository beneath it, and only ruling propose
carries the guard against a directory resolving to a layer the caller
did not name; the MCP recall and brief tools read any project the model
names unless the host sets the tenant flag; forget redacts whole-value
event fields in place, leaving the tombstone rows, which name no channel
or author, as the record of the redaction, and drops every row of a
matched refutation, amendment, request or relation record |
deepcode |
A markdown file in a flat per-workspace namespace, plus an
event-sourced item inside a persisted conversation
thread |
Three stores that never meet — markdown notes under
<workspace>/.deepcode/memory/, JSON and JSONL session
transcripts, and a SQLite database at
~/.deepcode/state/deepcode.sqlite3 holding projects,
threads and an append-only event log |
No search. MEMORY.md is injected verbatim into the
system prompt at session start under an 8,000-character cap, and every
other note is reachable only by the agent choosing to call
memory read |
The agent calls a five-action memory tool —
list, read, write,
append, delete — with no extraction pass and
no dedupe; the conversation layer instead appends sequence-numbered
domain events |
write overwrites, append concatenates,
delete is Path.unlink() with no history and no
tombstone; session deletion is a separate crash-recoverable journal that
quarantines to .trash and never touches the notes |
The thread listing filters on a stored project_id in
Python after an unscoped fetch; the SQL predicate exists in a repository
method nothing calls. The notes namespace is a per-workspace directory,
and the tool refuses any name that is not a bare filename |
One tool inside a harness with a TUI, a Tauri desktop app, a
headless exec path and an app server, all assembled through one
build_agent_session |
autodream — a scheduled single-turn agent pass told to
merge duplicates and delete stale notes, run from
cli.schedule_cli on an interval the user sets |
Typed provenance on conversational input — client surface and input source, so automation is distinguishable from a person — and nothing at all on a note | An event-sourced conversation store with replay and sequence heads, typed input provenance, a crash-recoverable deletion journal, and a consolidation module whose docstring states its own missing oracle | The consolidation pass may delete any note on LLM judgement, with a note count as the only mechanical signal, over a store that has no history, no protected notes and no record that a deletion happened |
deepseek-harness |
A SessionEvent in one session's append-only log,
carrying a sequence number and a surface classification of
current, shadowed or
log-only |
One append-only JSONL log per session behind a
SessionPersistence seam, migrated forward through versioned
session formats on open — plus a separate FTS5 index and session-scoped
spill files at 0600 |
Exact reads, filters and lineage traces on
ctx.sessionQuery by default; SQLite FTS5 over
persisted_docs and a temp.live_docs, unioned
live-preferred, exists but every shipped bundle sets
openAt: never so search calls fail closed |
Synchronous in-memory append, then a batched durable write — the
first pending event opens a fixed window that later events join without
resetting it, and session/flush is the ordering checkpoint
the loop waits on before claiming the next turn |
Nothing is overwritten. Compaction issues
{ op: 'replace', start, end }, which shadows the surface
entries in that range and inserts the new event in their place; the
shadowed events stay in the log and stay searchable as
shadowed |
A cwd column on the session row is applied as a
workspace filter on the model-facing read path, with per-session
authorization above it and a registry layered by an opaque
ScopeKey so a preset's plugins are invisible outside
it |
tool-session-query registers
session_search, session_event_search,
session_trace, session_event_trace and
session_event_read — all read-only, and no shipped bundle
mounts the package, so the default model has no history tools at
all |
None over memory. Persistence batches on a bounded timer and the FTS index is maintained on write; nothing re-reads or rewrites the corpus on a schedule | No epistemic state. surface says whether the model
currently sees an event, not whether it is true, and nothing carries
confidence, verification or provenance beyond who emitted it |
Cross-session search whose authorization is tested against a probing caller — a hidden parent session and a nonexistent one are asserted indistinguishable, without the provider being called | The searchable-history story is opt-in twice over and off in every shipped bundle; a developer preview with a very large dependency surface, and no delete a user can reach |
deer-flow |
A structured fact in the DeerMem shape — version,
lastUpdated, user, history,
facts[] — which every backend must map into |
Backend's choice. The default writes JSON; Mem0 and OpenViking adapters point at those systems instead | get_context is one of two required methods; how it
retrieves is entirely the backend's business |
add is the other required method, with an
add_nowait that defaults to delegating to it |
create_fact, update_fact and
delete_fact are contracted tier-3 hooks that default to
raising, wired to buttons in a settings page |
A resolved user_id travels from the request through the
manager into every backend call, with a trusted internal owner header
honoured only after auth |
A harness with four selectable backends — its own, Mem0, OpenViking and a no-op template — swapped by one line of config | A summarization hook and pre-compress and turn-start hooks, all optional and defaulted to no-ops | None at the contract level. Nothing in the interface carries a status, a confidence or a provenance field | A three-tier contract that replaced hasattr probing
with defaulted hooks, and a portability rule permitting exactly one
import from the host |
Every backend must return the default backend's response shape, and the README states the failure — pydantic drops unknown fields silently and the frontend crashes on the empty date |
deja-vu |
A Session — an id, the harness that wrote it, a
project, a path, a title, start and update times, and its
Message list of role, text and time — read from a
transcript the agent had already written. The index adds derived fields
the parsers never set: GaveUp, Words,
Touched, AgentTitle, and for a synced session
OrigID, From, Lifecycle,
LifecycleNote and LifecycleAt |
Its own append-only index over the transcript files already on disk,
under internal/index, with a digest, an embedded arm and
per-source parsers for each supported harness. Nothing is copied into a
database the user has to run; the corpus is the history, and the index
is a derived artefact that can be rebuilt |
Lexical search over the index with CJK and NFC folding, a scoring pass with a freshness decay, and narrowing options for harness, project, session id and time. A session whose own text reports backing an approach out takes a ranking penalty rather than an exclusion. Notes promoted from a session are lifted above their source in the result order | There is no write path in the ordinary sense — the agent's own
transcript is the write, and deja indexes it. Secrets are
stripped during indexing by internal/redact before anything
is stored, so what a later recall hands the model has already been
through the redactor. A person can promote a session to a note, which is
the one authored artefact |
Re-indexing rebuilds from the transcripts, so the store is derived
rather than authoritative. A promoted note carries a
Lifecycle — accepted, rejected,
superseded, stale or pending —
set by a person and synced between machines; it changes how a hit is
ranked and how it is described to a reader, and it does not remove the
session from results |
None enforced, and by design: the product's argument is that one
memory should span every agent and project on the machine.
Project, Harness and session id are stored and
are applied as filters when a caller asks for them, with an unknown
session id answering nothing rather than falling back to the whole
store. With no flag, the search is the whole store |
Hooks into each supported agent — recall arrives at session start,
on every prompt, before a file is edited and after a command fails —
plus an MCP server, a CLI, and a plugin manifest.
deja install --auto wires the harnesses it finds |
Indexing and re-indexing; a digest cache per project for the session-start hook; a novelty tracker that records which ids were already served so the same memory is not injected twice; peer sync between machines | Deliberately thin, and argued for. The index derives
GaveUp from a session's own words and the search applies a
score penalty and prints "mentions backing an approach out — one
path here was abandoned", with a comment explaining the restraint:
"Nobody sets the rejected state by hand… When the transcript itself
says something was backed out, say so — as evidence from the session,
not as a state someone recorded." A promoted note's
Lifecycle is the one recorded state, and it modifies rank
and wording rather than admission |
A corpus that starts full rather than empty, because the transcripts were already written; redaction on the indexing path so what reaches a model has been stripped before it is stored; a vacuity guard written as its own named test with the reasoning in a comment; a fail-closed narrowing where an unknown session id returns nothing rather than everything; code comments that cite the issue each decision came from | No scope boundary at all — crossing projects is the point, so a session containing something private to one project can answer a question asked in another; the epistemic layer is deliberately minimal, so a wrong conclusion in an old transcript is retrievable forever with only a freshness decay and a give-up penalty against it; the index is derived from files the tool does not own, so a harness changing its transcript format is a parser problem rather than a migration; the benchmark numbers in the README have their harnesses committed and no result file |
demarkus |
A markdown document at a path with publisher metadata (tags, importance, type, typed rel- relations), each surviving version linked to its predecessor by a previous-hash, and a separate archive state | A versioned, hash-chained file store behind the Mark Protocol over QUIC; the knowledge server keeps the same version bytes in an object bucket with a commit log, checkpoints and per-world document quotas | Path and version fetch, version history with a chain verdict, directory listing, and LOOKUP over a catalog ranked by matched terms, then importance, then modification time, with a body-section mode; graph traversal over links and backlinks runs in the client tools | PUBLISH, APPEND and ARCHIVE over the protocol under a token or an in-process grant carrying publish; a per-world publish policy and a secrets and personal-data content check run as write preconditions; every content write appends a version | Correction by publishing a new version. ARCHIVE withholds a document from current reads and an empty-body PUBLISH restores it. A retention metadata key on any write deletes all but the newest N versions; the graph export publishes with a default of 20 and federation checkpoints with 5 | Capability tokens with path globs and operations; a path no read token covers is public. The memory broker maps each verified identity to one world and refuses any other; the knowledge profile exposes every readable world. The local plugin mints a publish and archive token over the whole store and no read token | Plugins for Claude Code, Cowork, Cursor, OpenCode and pi; an MCP server and an OAuth memory broker for hosted clients; a CLI, a TUI and a WATCH change stream | Knowledge-server compaction of the commit log into checkpoints, catalog rebuild at startup, broker world provisioning, and federation export of graph checkpoints | The hash chain and its verdict on VERSIONS, token hashes with expiry, a publish policy with warn, ask and block, a content check that always blocks secrets, the archive state, and user and agent identity keys the writing surface stamps and a caller cannot set | Integrity reported on the history read rather than assumed; a token store that holds only hashes; read authorization applied per row before LOOKUP truncates and per entry before LIST pages, so a protected document neither appears nor displaces a readable one; an archive state that the catalog, listings, fetch and the session primer all honour; a tenant gate that refuses an unclassified tool before provisioning a world | Retention is publisher metadata: any writer, the agent's own mark_publish included, can delete all but the newest versions, and VerifyChain starts at the oldest surviving version, so a pruned history reports chain-valid true, which the conformance suite asserts; the deletion is recorded only as a server log line. In the file store a head whose body is edited with its frontmatter kept also passes, and FETCH never runs the check. Reads are public on any path no read token covers, which by default is every path on a local soul. There is no validity window and no record of a rejected value |
dense-mem |
Evidence — exact, durable, append-only content with a content hash,
an authority tier of authoritative, primary,
secondary, inferred or unknown,
and a source revision token — supporting Relationships between Entity
and typed Value nodes, each Relationship carrying a tier, a status, a
polarity, a validity window, a knowledge-time window and a support
count |
PostgreSQL with pgvector as the only durable authority for knowledge, lifecycle, provenance, search, authorization and audit; Redis for coordination only | Recall fused across the actor's authorized memory spaces, gated on active status, eligible support, the space generation, and — when an instant is supplied — both time axes plus the replayed status history | remember over MCP: the provider's output is a proposal,
closed-schema validation and deterministic server policy decide durable
state, and the runtime API deliberately exposes no semantic claiming or
status mutation |
A lifecycle action changes effective state without deleting provenance or trace lineage; evidence is retracted with a reason and an idempotency key, and the result reports affected, pending and retained relationship counts; corrections that collide with inactive history are refused | Team, identity, membership and a permanent owner alias resolved from authentication and never chooseable by a client; memory spaces with a generation, an allowed-space list on the actor, and team visibility kept distinct from owner mutation authority | MCP at /mcp as the external automation contract, a user
portal and a separate control portal on another port for
administration |
Dreaming, automatic conflict review, community summarisation and support recomputation as server workers | Authority tiers on evidence, the tier ladder on relationships, support eligibility, a verifier model, quarantine and dispute states, security events on ingest, and an audit log with field redaction | Both time axes in the same query plus a status replay that answers what was believed then; database CHECK constraints carrying the invariants rather than application code alone; partial indexes that make an unpromoted row absent rather than filtered; a correction path that refuses to revive an identity it already rejected | The promotion that decides what is recallable is made by a
configured verifier model and background workers, with no person-facing
review surface — the human surfaces are team and credential
administration; the service refuses to start without embedding and
verifier model configuration, so the whole memory depends on an external
provider; the audit_log table's own consumers are
administrative, and the memory-side record is the transition ledger |
deus |
An atom — a chunk of conversation with a type, a confidence, a corroboration count, a domain and category, a source chunk, and an expiry with its reason — plus entities and relationships carrying first-seen, last-seen and evidence counts | SQLite with a vec0 virtual table for embeddings and an
FTS5 index for the lexical arm, degrading to ANN-only when the SQLite
build lacks FTS5 |
Hybrid BM25 and vector search over atoms with the expiry predicate bound, plus an entity-relationship graph walk and spreading activation across domains | Conversations are broken into atoms with confidence scoring and domain tagging; entities and relationships are extracted alongside; contradictions between an older and a newer atom are detected and queued rather than applied | An atom is expired with a reason rather than deleted, and reads compare the expiry against today's date. A contradiction never auto-invalidates: it becomes a pending conflict a person resolves or dismisses, with the resolution and its timestamp stored | Per-conversation container isolation at the runtime level; the memory database itself carries a domain and category on an atom rather than an enforced scope predicate | Messaging connectors, a TUI, containerised per-conversation agents, and a credential proxy that keeps API keys out of the container | An evolution loop that scores its own responses, generates self-critiques and rewrites the system prompt, plus periodic compression into weekly and monthly digests | A confidence and a corroboration count on an atom, an expiry with a stated reason that the read path honours against the clock, and a pending-conflict queue that only a person clears | An expiry compared to the clock rather than tested for presence; a contradiction policy that queues for review and says so at the insert site; a write-once resolution timestamp; and a migration that declines to backfill a value it never observed rather than fabricating one | The architecture document describes the semantic graph as having
bi-temporal validity over a schema carrying one temporal axis — the
session date an as_of read travels, plus observation stamps
and a retirement date — with no column recording when the store came to
believe anything; the README's 95% LongMemEval figure is a 50-example
run whose own table reports Recall@1 at 94%, and the headline drops the
sample size; and the comparison table's ~37K-line self-measurement is
five months stale against a tree whose src alone is 64,400
lines |
dexto |
A Memory — id, content capped at 10,000 characters,
timestamps, up to ten tags, and metadata carrying source and pinned |
A five-method MemoryStore interface with a
database-backed and an in-memory implementation |
None. list() filters by tag, source and pinned, sorts
by updatedAt and paginates |
Direct CRUD through a validated manager; no extraction, no model, no dedup | Real update(id) and delete(id), both
raising a typed error when the id is unknown |
None, and the manager's docstring names multi-scope keys as future work rather than implying they exist | A system-prompt contributor with a pinnedOnly switch,
agent tools, and a web UI panel with a delete dialog |
None | source distinguishes user from system and nothing ranks
on it; pinned is a selection flag, not a status |
Addressable memories with typed errors on every failure, and a docstring that says plainly where the design stops | With no retrieval, the whole store enters the prompt unless a person pins a subset — so relevance is entirely manual |
diffmem |
A markdown entity file holding the current view, with history in the commit graph | A git repository of markdown; no vector store, no embeddings, no BM25 | An LLM issuing whitelisted shell commands — grep, git log, git diff, git blame — beside a fixed baseline of the user entity and recent timeline | A writer agent edits the current-state files; a consolidator merges and redistributes | Editing the current view; the prior state stays reachable through git history | One worktree per user under one root; pluggable personal and corporate ontologies | A server, a Docker deployment, and a pluggable executor with a Hatchet backend | Consolidation with dedupe, linking, reabsorption and redistribution, under a lock | A per-type status enum in frontmatter; only open-item status is read, to drop finished items from followups.md. Commit messages record which session or consolidation pass changed a file | Retrieval as repository exploration, with git's subcommands separately allowlisted | The validated string runs with shell=True and a single & or a
newline starts a command nothing validated; the plan's git_cmd needs
only a git prefix; an HTTP route hands the router to any
caller, unauthenticated by default; no model-named path is held to the
worktree |
distill-kura |
One Markdown file per fact with frontmatter — name, description,
type, reserved and free tags, three curation sentences with an HMAC
mark, an evidence manifest hash — and one line in
MEMORY.md, written as a recognition trigger |
A directory per store holding memory files and
MEMORY.md; _still/ beside them holds drafts,
seeds, a write-ahead log, the resident map and JSONL gauges;
_evidence/ holds content-addressed manifests; a registry
maps agent modes to stores |
Tier zero first — five deterministic n-gram heads over index lines and bodies with an honesty gate — then the whole index in one prompt to a thinker model that names slugs, word overlap if the thinker is down, then a breadth-first walk over [[links]] with per-memory and total budgets | A distiller reads session journals, classes each segment as USER, TOOL, ACT or SELF, asks a model for candidates with quotes, keeps only quotes found verbatim, drops echoes of the store, checks novelty, composes and stages a signed draft; a scribe model or a person pours it. Direct writes are allowed, refused or frozen per store | EXTENDS appends to an existing memory; retire rewrites
the old memory's index trigger to superseded: … now [[new]]
and appends a note, only on a [USER] quote naming both; nothing deletes
a memory |
One directory per mode, chosen by the host before the session; the HTTP server has no authentication and any caller can name any store it holds | A DeepSeek Harness plugin in Node, an MCP bridge, an HTTP service, a CLI and the Python library; a standing resident map injected into the system prompt | kura tend, one watcher per store that drains drafts,
distils, re-weaves the map and warms model prefix caches when the
journal has been quiet |
Evidence classes on every quote, numbers only from TOOL output, human attribution only from USER quotes, signed curation that glance shows only when verified, and a retirement face on the index line; none filters recall | A deterministic write gate that fails closed on paraphrase; provenance manifests a retirement or a pour must verify against; recall by recognition that says out loud when it found nothing; a test suite written as escape attempts | A retired memory is still recalled, and the note that says so can be trimmed from what recall returns; store separation is routing, not confidentiality; the evidence gate trusts the journal it reads |
dovsg |
An instance object — a class_name_N id, the class of
its most confident detection, a set of 1 cm voxel indexes,
detection-weighted CLIP and text features, a confidence and a detection
count — and a scene-graph node holding its parent and one of three
relations: on, belong,
inside |
Pickles per step under
memory/<config>/step_<n>/: the voxelised view
dataset, the instance list, the scene graph, LightGlue features,
per-frame detections and a class palette; each step a full snapshot,
reloaded by step number |
CLIP text-to-instance cosine: localize_AonB takes the
top-3 instances for the target label and the top-5 for the reference and
returns the centroid of the closest pair; the scene graph is pickled and
drawn and never traversed by a query |
Per frame, RAM tags → GroundingDINO boxes → SAM2 masks → CLIP features; ConceptGraphs-style association scored 0.5 spatial + 0.4 visual + 0.1 text and merged above 0.75 with detection-weighted feature averages; objects seen fewer than three times dropped; the graph built from footprints, heights and hulls with a rule per relation | After each pick or place: relocalise, project the remembered voxels into the new views, delete those the new depth says are gone, drop any object that lost over half its voxels, re-detect on the new frames and merge into the survivors, cut the vanished nodes and their children from the graph, add the rest back; nothing records what was removed | None. One memory directory per scene tag and, below it, one per task description | A Controller driving an xArm6 on an Agilex base over
ZMQ; a GPT-4o-mini planner that receives the instruction and five worked
examples and never the graph; ACE and LightGlue relocalisation; A* over
an occupancy map |
None; every update is a synchronous step inside the task loop and blocks the robot | None. An object is present or deleted; the detector confidence chooses its class name and nothing else | Localised repair driven by depth disagreement rather than reconstruction: the deleted subtree is recomputed and the rest of the graph kept; every step is pickled, so a run resumes from any step | The graph the paper is about is consumed by nothing but the visualiser; an object that moved but kept over half its voxels keeps its stale parent; a re-detected object gets a new identity; no tests, no licence file, six uninitialised submodules and two committed shared objects |
dreamgraph |
A dream edge or node (from, to, relation, confidence, plausibility, evidence, contradiction, TTL, status) in a speculative graph; a validated edge once promoted; fact-graph entities (features, workflows, data-model entities) and tension signals beside them | Per-instance JSON files under ~/.dreamgraph/UUID/data: dream_graph.json, candidate_edges.json, validated_edges.json, tension_log.json, the fact-graph seed files and more, rewritten whole and atomically under an in-process file lock | graph_rag_retrieve resolves seed entities by exact id, exact name and TF-IDF over the fact graph, expands by BFS over validated edges only, ranks by confidence, recency and term overlap, and serialises to a token budget; get_cognitive_preamble takes the top five validated edges and top three tensions; query_dreams filters the dream graph by status on request | Dream strategies (deterministic and LLM) and the agent's solidify_cognitive_insight append candidates; a normaliser scores them against the fact graph with an optional LLM pass and promotes validated edges; lucid_action accept and enrich_seed_data write validated edges and fact entities directly | Speculative edges decay by TTL and confidence each cycle, rejected ones twice as fast; validated edges are deleted or retargeted in place by mutate_validated_edge; clear_dreams resets any store; source-less fact entities can be quarantined to a report file. No tombstone | Physical: one data directory per instance UUID, one instance per project. Entities carry source_repo inside an instance, and no retrieval path filters on it | An MCP server of about ninety tools over stdio or HTTP, a dg CLI, a VS Code extension whose context builder calls the tools, a browser Architect, and an Explorer SPA with a curated-mutation HTTP funnel | An in-process scheduler, enabled by default, runs user-created dream, normalise, nightmare and metacognition schedules on interval, cycle count or idle time; scan_project also triggers a decay pass | Dream-edge status (candidate, latent, validated, rejected) gates promotion into the only edge store retrieval reads. The agent's own tools can bypass the gate and can resolve a tension as human | Imagination and retrieval live in separate stores with a scored gate between them; rejected edges cannot be reinforced by deterministic strategies; a failed multi-file promotion is rolled back; source-less facts can be quarantined with a cascade to edges and tensions; the Explorer audit records failures and dry runs | A rejected edge decays out in about four cycles and its key then boosts the next re-derivation; lucid accept promotes rejected edges past the normaliser; resolve_tension takes resolved_by human from the caller; an Explorer reject flips the oldest candidate row while the normaliser reads the newest; stores documented as append-only are spliced and cleared by agent-reachable tools |
dsh-ai-memory |
A row of text in one of three tiers — working, episodic, profile — with a project id, optional JSON metadata, a pinned flag, an access count, and a hash-embedding blob | One SQLite file in WAL mode holding projects with their policy as
JSON, memories, and an embeddings table;
~/.local/share/ai-memory/dsh.db by default under the
plugin |
The project's 2,048 newest rows (pinned first), a TTL filter, a keyword-plus-recency prune to 256, then a weighted sum of recency, token overlap and cosine over a 64-dimension token-hash embedding; no score floor | memory_remember from the model, one insert per call
with the tier given or guessed from English phrases; synchronous and
visible to the next recall |
memory_forget hard-deletes by id; an explicit
consolidate deletes rows past their tier TTL and promotes by age and
access count; an explicit compact folds older working rows into one
episodic note and deletes them |
A project_id on every row, applied in SQL on every read
and bound at session open, never a tool argument; the plugin's default
project is dsh for every chat in a profile |
A DeepSeek Harness Cordis plugin, in process through a napi addon or
through the ai-memory CLI once per call, registering six
tools and a system-prompt section; the Rust library and JSON CLI for
other harnesses |
None; consolidate and compact run only when a tool call or the caller invokes them | None; the tier is durability, pinned is retention and
pack priority, and the rendered pack cites id, tier and score but no
source |
Project isolation enforced in SQL and asserted over populated results, a pack that provably fits its token budget with pins first, and no model call, network client or background job anywhere on the memory path | The default chat preset hides a working note from
recall after an hour and deletes it on consolidate, because its TTL and
the promotion delay are both an hour and expiry is checked first; every
prompt's prefetch increments the access count that decides promotion to
the untimed profile tier |
dsh-auto-memory |
One Markdown file per memory with YAML frontmatter: kebab-case name, optional title, a one-line description, one of four types (user, feedback, project, reference), optional pinned, disabled and importance 1-10, and created, updated, lastRead and reads counters | A directory tree under $DSH_HOME/memory: one _user directory and one directory per session cwd encoded by DeepSeek Harness's projectKey, each holding the memory files and a derived MEMORY.md rebuilt under a cross-process file lock | No query search. Every step injects the user and project MEMORY.md indexes, ordered pinned first then importance times a day-granular recency decay, cut to a 4,096-byte budget; the model then fetches bodies by exact name, with one level of wikilink summaries | Six model tools, a browser panel behind the harness connection, and an opt-in background pass at root-agent disposal that asks the session's model for at most five memories. Every path goes through one store.write that redacts secrets and escapes the wrapper tag | Writing an existing name overwrites the file in place, keeping creation time and read counts. Consolidation matches candidates to existing memories by name coverage or description similarity and overwrites the match. Delete unlinks the file; bulk prune and delete-all ask the user through the harness approval hook | Physical directories: a project directory derived from the session header's cwd and a shared user directory injected into every workspace. No scope key is stored in a record; the layer is the directory the file sits in | A Cordis plugin for DeepSeek Harness: six memory tools, one dynamic system-prompt section at order 4000, a tools/pre-execute hook for the destructive verbs, session-event capture for consolidation, and a web panel page with four HTTP routes | Off by default. With autoSummarize on, user and assistant text is buffered per session and a single model call at root-agent disposal proposes memories. With staleAfterDays above 0, each session's first agent refreshes both indexes so stale zero-read memories drop out | None on content. Memories enter the prompt inside a memory_context wrapper labelled as data, with secrets redacted and the closing tag escaped at write time; a disabled flag mutes a memory from the index without asserting anything about its truth | A store a person can read, grep and fix; injection that costs nothing when empty and is bounded and cache-stable when not; one write path every producer shares; orphaned-lock recovery; and committed exclusion tests with positive controls | Consolidation overwrites whatever its matcher picks with no prior version kept, including a user-layer memory from a project session; a hand edit reaches the injected index only at the next rebuild; a deleted fact can be re-extracted; single delete and overwrite are ungated |
dsh-continual-harness |
A versioned entry of kind prompt, memory, skill or subagent: id, content, version, updatedAt, optional title, blastRadius, projects tags, protection and lifecycle metadata | harness_state.json under the harness root for the global layer and one per session directory, written by tmp-and-rename; refinements.jsonl journals beside each; skill entries also materialize as SKILL.md bundles in the dsh skills directory | No search tool. A pre-step block is injected as a user message: by default a stable index of the top 15 entry ids ranked by project ownership then IDF-weighted term overlap with the session's opening request and cwd, no content; query mode shows six entries per kind at 180 characters | An LLM planner proposes create, update and delete edits from a tail-biased trajectory; triggered by the harness_refine tool (global by default), the /refine command, or an automatic gate every 25 turns or on compaction that writes session-local only | Validated edits with a required reason and blastRadius, a baseline fingerprint check, a growth cap and protected-entry rules; delete removes the entry; any committed refinement rolls back once by id from its before snapshots; archive hides an entry | Physical: a global store and one store per session id, local shadowing global on merge. Project tags rank the index and never filter. A session-radius entry is skipped only when it comes from the global layer. Skills of either scope materialize into one shared directory | A Cordis plugin for DeepSeek Harness: agent/pre-step projection, session/event driver, harness_refine, harness_wrapup and harness_benchmark tools, an optional /refine slash command, and an invariant companion | Automatic gate on turn interval or compaction end with a 20-minute cooldown: one model review call, then a planner call if approved, fire-and-forget; each verdict appended to reviews.jsonl | None as a state. active or archived lifecycle, pinned and protection flags; the review gate and the planner are the agent's own model; global approval is an optional prompt to the user on one tool path | Compare-and-swap on an entry fingerprint between planning and commit; blastRadius legality checked against the destination layer; full before and after snapshots make every commit reversible; a session-stable injection block that keeps the provider prefix cache warm; a paired A/B benchmark whose verdict is computed in code | The default injection carries ids only while no tool reads an entry; the approval gate covers one verb while harness_wrapup promote and rollback reach the global store without it; planner JSON passes provenance, protection and lifecycle fields through unchecked; session-local skills land in the shared skills directory |
dsh-layered-memory |
An L1 atomic memory row (content, type, priority, scene_name, version, family), distilled by LLM from captured L0 turns; above it Markdown scene files (L2) and one persona file per family (L3) | One SQLite file with FTS5 (jieba plus CJK-bigram tokens) and an optional sqlite-vec table; append-only JSONL per day for L0 and L1; scenes and personas as Markdown under the data directory | Hybrid by default: FTS5 BM25 and, when an embedder is configured, vec0 cosine, fused by RRF k=60, weighted by a 30-day half-life decay floored at 0.5; five hits per step from the last eight messages as query; family predicate when the session mode is chat or work | Automatic. Every non-off turn is sanitized into L0 at turn end; a per-session slice is extracted by LLM once it reaches a threshold that starts at one message and doubles to six, then an LLM dedup pass chooses store, update, merge or skip against up to five same-family candidates by vector or ten by FTS | Update and merge append a new record at version plus one and delete the targets from SQLite only; the JSONL keeps both. No user or agent delete for L1, none at all for L0. Rebuild archives the derived layers and re-distils everything from L0 | A chat or work family column with an SQL predicate on the FTS read and a post-filter on the vector read, applied only in single-family session modes; conversation_search and memory_read_scene read across families. session_id on L1 rows is always default | A Cordis plugin for DeepSeek Harness: a session/event capture hook, an agent/pre-step injection of relevant-memories as a plugin-sourced user message, persona and scene navigation in the system prompt, three read-only tools, a web settings panel and a TUI status line | A serial task queue: L1 extraction per session slice, L2 scene consolidation per family after five new records, L3 persona after twenty; an idle flush after 300 seconds; a 60-second persona cache refresh; re-embedding on an embedder change | None. Recalled lines are framed as reference only, not as the current task; there is no status, confidence or verification, and priority is stored and never read by retrieval | Injection kept out of capture by source kind and by tag stripping; off and write-only modes gate every read path; failure-bounded distillation with a fallback route chain and backoff; a committed benchmark with raw per-probe files for one run | No way for a person to delete a memory, and L0 is never deleted, so rebuild restores what dedup removed; the rebuild repair the error log recommends reads L0 from SQLite, not from the JSONL it names; L2 sees only the triggering turn's records; the headline benchmark has no committed raw run |
dsh-mneme |
A memories row — type, title, content, tags, importance
1-5, an epistemic_status of observation, inferred or
subjective, forgotten and archived flags, a capped content history and
an embedding — plus entities with time-boxed attributes |
One SQLite database with vector, audit, receipt and conflict tables, mirrored to Markdown files per type that edit back into the store | Keyword LIKE, BM25 and vector search fused and reranked with a query-adaptive vector threshold, an optional local embedder for offline use, and semantic-first injection into the system prompt | Nine model tools, automatic session summarization, optional entity extraction, and a quality filter; consolidation runs on a schedule or when the harness is idle | Update archives prior content into history; forget and archive set flags; delete removes the row; consolidation merges, supersedes, archives or marks conflicts under a snapshot compare-and-set | Optional agent and workspace labels from the session header; by default a soft re-weighting, and under strictScope a hard wall only for explicitly declared scopes | A DeepSeek Harness plugin with model tools, prompt injection, slash commands, a web panel and a standalone HTTP API | autoDream consolidation, an idle-triggered sleep cycle that tiers memories by heat, summarization, re-embedding and mirror reconciliation | An epistemic_status inferred by regex or declared, used
to weight ranking and to prefer winners in consolidation when enabled;
never a filter |
Replayable, content-addressed receipts for automated consolidation; human edits that win over machine state and are kept in history; conflict freezing with a review queue | The protective features are opt-in — conflict freezing, scope labelling, strict scope and trust weighting all default off; auto-labelled rows stay visible across scopes even under strict mode; ordinary tool writes are not audited |
dsh-mnemon |
A runtime entry — content, target (user or memory), importance, optional git branches, timestamps — projected into USER.md and MEMORY.md; a workspace document with narrative sections; and a memory in a provider-backed memory space, whose shape is the provider's | Runtime JSON plus two Markdown projections under a global or workspace data directory, byte-limited (MEMORY 10 KiB by default) under a file lock with compare-and-swap revisions; documents in the workspace; memory spaces in Mnemon's local database through its CLI, or in one of eight external providers | A pinned view per root turn composed by a strategy from the three sources; the runtime tier projected whole (branch-filtered when the branch is known); documents by search then read; memory spaces by one agent query plus one refinement across pinned active spaces, with evidence quality selection | mnemon_runtime_memory add, replace and remove with byte
limits; explicit remember into a space; document create and
manage; over-limit runtime writes archive older entries into existing
spaces through a routing worker whose plan the host verifies before
committing |
Runtime replace and remove by exact text; archival and semantic compaction of MEMORY.md with lineage; forget in a space (soft delete in Mnemon Native, per provider otherwise); space merge and delete | Explicit global, workspace, centralized-workspace or custom storage scopes; optional branch tags on runtime memory entries; memory spaces selected per view | A DeepSeek Harness plugin with a Sidebar workbench, Headless support, conversation tools, Mnemon Packs for import, a plugin SDK for sources, strategies and providers, and nine provider packages | Deterministic activity scoring and an optional background review at idle; asynchronous child-agent memory work with inherited pinned views | Host-verified archival with exact source coverage and revision checks, evidence quality selection on recall, and the provider's own model of change | One pinned, revisioned view per turn shared with child agents; archival that refuses to change runtime memory until every entry is durably written elsewhere; a provider contract with conformance tests; branch-aware projection of working memory | Branch scope becomes a tag on archival that nothing reads, so an archived branch-only decision is recalled on every branch; the projection falls back to every branch when the branch cannot be read; memory semantics depend on the chosen provider |
dynamics-memory |
One LLM-distilled sentence with an embedding, a pool (candidate, memory, archive), a decaying value V, hit counters, source unit ids, a scene name and an origin tag | An in-process dict pickled to .opencode/memory/state.pkl under the project, loaded through a whitelisting Unpickler; raw turns in an append-style SQLite log with FTS5 trigram, entity mentions and unit embeddings | Cosine over every stored memory plus a pool prior and a freshness term, a quality gate, in-band suppression of near-duplicates, top 5; unresolved rivals of a selected memory are appended as conflict lines. The log is searched separately by FTS5 and vector with RRF | Every turn goes to the log, then one LLM call distils candidates that enter the candidate pool; verbatim repeats add evidence, near-duplicates add a tension pair. An in-process investigator and the main agent can also propose memories citing log unit ids | No delete. An LLM verdict supersedes (update), merges (synonym), aggregates (contradiction) or keeps both (collision); losers move to the archive pool, which retrieval still scores. Idle candidates archive after 50 turns | Physical: one state directory per project under .opencode/memory. Memories carry a scene name that no memory read filters on | An opencode plugin spawns the sidecar, injects a relevant-memories block into the system prompt each turn, posts each finished turn, and registers nine memory and log tools for the main agent | A signal queue drives an LLM judge for aged conflicts and a recognizer for which injected memories the answer used; an investigator thread reads the log under per-signal budgets and a daily cap | None enforced. Pools and a disabled confidence gate rank rather than withhold; a contradiction aggregate carries a pending_review flag that nothing clears or reads at retrieval | Captured turns are never lost to a failed extraction; a miss detector turns user corrections and the agent's own log searches into repair signals; proposals must cite existing, non-future log units; stored text is scrubbed of the injection delimiter; state loads through an allowlisted Unpickler | Superseded values stay retrievable through the archive prior; conflict lines are unbounded in the injected block; the agent holds the verdict tool; raw turns, unredacted, reach the log, the log tools and a remote embedding API; queued signals are not persisted |
ean-agentos |
Depends on the table — the distinctive one is an
errors_solutions row: an error, its stack trace, a fix, and
whether the fix worked |
One SQLite database with roughly fourteen base tables and fifteen migrations, plus an embeddings table | LIKE matching over error message, type, stack trace and
tags, ordered by solution_worked then recency |
Deterministic capture from agent hooks, a git post-commit hook, and explicit CLI calls; no LLM on the capture path for errors | None for errors. attempts increments and
solution_worked is set; nothing is retired |
project_path and session_id on nearly
every table, and applied on one of the five paths that read the errors
table — the dashboard, and only when the caller asks |
Hooks installed into Claude Code, Gemini CLI, Codex and Kimi settings, plus an MCP server and a local HTTP API | A memory daemon, an auto-summarizer, and a transcript reconciler | solution_worked and a quality_score on
reusable patterns; neither withholds anything from retrieval |
A deterministic capture path — git commits and tool calls become memories without a model deciding what mattered | A fix that did not work is ranked below one that did and still returned, so the guard against repeating it is the model reading a boolean |
ecc |
A Markdown file with validated frontmatter — id, title, kind, scope, trust, status, sourceHarness, targetHarnesses, tags, links, timestamps, body | One ${id}.md per memory under a per-scope vault root,
with a trusted-boundary assertion on every read |
Index and lexical search over the vault, filtered to
status === 'active', with scope selecting the root |
Create-only through the ecc memory CLI or the
memory_save MCP tool; every write sets
trust: unreviewed and status: active |
Neither. Writes are create-only, and no code path sets
rejected or superseded |
project | team | user vault roots chosen per call, user
refused unless the MCP server grants it; on the MCP path every read is
filtered to records targeting the server's harness |
A CLI, an MCP server, and harness skills for Claude Code, Codex, OpenCode and Cursor, plus session hooks | Session hooks that persist memory at lifecycle boundaries | trust is an enum of exactly one value,
unreviewed, and the design says so — verified knowledge is
promoted out of the vault, not within it |
Says in the schema that its memory is never authoritative; harness routing on every record | The read path filters a status the write path cannot produce, so rejection is reachable only by hand-editing frontmatter |
echo-agent |
A MemoryEntry with a tier, a type, a key, an importance
and a source recording which write path created it |
SQLite with a numbered migration list — memories, episodes, graph nodes and edges, vectors, plus evolution tables | Vector plus lexical over local embeddings with a local reranker, filtered by a visibility function before ranking | A memory tool with a constrained enum, a background LLM reviewer, and sleep-time consolidation that promotes from episodic | superseded_by set by an adjudicating contradiction
pass; a forgetting curve archives then forgets; no rejected-value
record |
memory_scope applied through a visibility function on
the read path, under a scope_policy the shipped config
defaults to session, which is fail-closed for an unowned
user memory |
Python package and CLI with a web UI, skills directory and an evolution subsystem | Contradiction check and resolve, a decay pass, sleep-time consolidation, and a background reviewer | No candidate/verified/rejected state; a source
provenance word ranks write authority instead, and the writing path
assigns it |
A write guard that ranks provenance so a model-inferred claim cannot overwrite a user-stated one; contradiction that adjudicates and supersedes rather than flagging | Supersession is record-keyed, so re-assertion is unguarded, and the reviewer that approves a memory is an LLM rather than a person |
edda |
An event in an append-only ledger under .edda/,
carrying a family, a level, a payload, digests, its own hash and its
parent's; decisions, tasks, verdicts and review artifacts are event
kinds |
SQLite for the event log and its projections, with a content-addressed blob store beside it for anything large | Full-text search over the ledger, plus projections the events are folded into | Every mutation is an appended event, validated against the current tail before it lands | State changes are new events; blob deletion appends a tombstone record naming the hash, the reason, the last known class and whether it was pinned | One .edda/ workspace per repository; authority is a
registered actor with a live session, an RBAC grant and an HMAC-sealed
local capability |
A CLI and MCP surface for Claude Code, Cursor, Codex and OpenClaw, plus a bridge crate and a conductor that coordinates parallel agents | A conductor driving phases and waiting at gates, garbage collection with quota enforcement, and a postmortem crate | A chain enforced at append time, capability material held outside the ledger, verdicts bound to a subject, a commit and a freshness window, and a second-provider review that records what it measured | Three decisions are worth the visit. The chain is enforced where it
is cheapest to enforce — on append, by reading the tail and refusing an
event whose parent does not match — rather than only verified by a later
pass, and validate_event_hash re-derives the event
canonically so a tampered taxonomy is caught alongside a tampered
payload; four tests inject the corruption through raw SQL and assert
which break is reported. The authority module states its threat model in
the header, treats "issue text, manifests, events, environment values,
and portable/imported bytes" as untrusted, keeps "[t]he root key,
capability record, and bearer … outside ledger events and continuity
bundles" so writing memory cannot mint authority, enforces owner-only
permissions before any secret byte is read or written, fails closed on
Windows "until a reviewed safe owner-only storage abstraction is
available", and names what it does not cover: "[a] malicious process
already running as that same owner remains outside S6a's boundary". And
a verdict binds three ways — to the subject, to the full commit SHA, and
to the moment: "a verdict only satisfies a gate if it postdates the
gate's gate_entered_at. Approving a subject BEFORE its gate
opens (a pre-recorded verdict) therefore does not work", which closes
the pre-approval an agent would otherwise bank in advance |
The approver is a label. edda verdict approve|reject
records an actor string supplied by the caller, with no
authentication on that path and no requirement that the sealed
capability be held — so the gate genuinely blocks the conductor until
something outside it responds, and what responded is self-asserted. That
is why this report claims no human-review mark: the binding and
freshness rules are the best half of such a gate and the identity half
is absent. The blob tombstones are likewise a record rather than a rule:
they are keyed on the content hash and carry the deletion reason, but
their only reader is edda blob tombstones, an inspection
command — nothing consults them when the same bytes are written again.
Nothing in the ledger is epistemic: there is no status, confidence or
provenance class on a memory, and a decision and the later one that
reverses it are two events with no relation between them beyond order.
At 213,521 lines of Rust across a dozen crates — an 80,675-line CLI
among them — the ledger a reader came for is a tenth of the tree |
egc |
Three shapes in the memory server: a per-branch Markdown state document (context, active decisions, things not to repeat, preferences, next steps); SQLite rows for decisions (context label, text, timestamp, project path) and lessons (content, context, confidence, tags, author, archive flag, project path); and TTL working-memory entries keyed by project. Hooks add plaintext prior-session summaries outside the server | State documents encrypted with AES-256-GCM under
~/.egc/state with HMAC sidecars, mirrored in plaintext
(context, five decisions, five next steps) into the project's existing
instruction files and held out of commits by a git clean filter; one
plaintext SQLite database at ~/.egc/memory/state.db for
decisions, lessons, working memory, patterns and the session bus; a
separate CLI state store at ~/.egc/egc/state.db |
get_state reads the current branch's document, then
main, then a flat per-project file, and appends a scrubbed
global document; FTS5 BM25 over decisions and over lessons with
substring fallbacks; working memory by project and key; hooks inject
state sections on detected intents and a prior-session summary at
session start |
update_state merges into the branch document under a
cross-process lock and mirrors it into instruction files;
store_decision, lesson_save and
working_memory_set insert rows through a write queue; hooks
append a model-mined digest of the transcript and verbatim remember
prompts to the state document; team sync merges teammates'
documents |
State documents are merged and rewritten, and a rule-based consolidation layers old entries by age; lessons are reinforced, decayed weekly after a 30-day grace and archived below 0.2 confidence; decisions are append-only; working memory expires within at most seven days | State documents are keyed by the last two path segments of the project and a hashed branch name; working memory by a project path the model may supply; decisions and lessons record the project path and are read without it; the session-start summary falls back to the most recent session of any project | Two MCP servers (memory and Guardian) registered by
egc install into the twenty-nine coding tools the README
lists, hooks per tool, a memory protocol written into each tool's
instruction files, a session mesh, team sync over git, and a local cost
dashboard |
A lesson decay sweep at most daily and a working-memory sweep on reads; transcript mining at session end and before compaction when a provider key is set; rule-based observation compression and pattern detection when invoked; a session bus with heartbeats and file claims | A prompt- and command-injection scanner on the memory server's free-text writes and on lesson reads, a generated-data notice and a second scrub on mirrored text, encryption and HMAC tamper warnings on state documents, confidence decay on lessons | Branch-aware project state with a per-commit file for a detached HEAD, encrypted at rest with integrity sidecars; one injection scanner shared with the command guard, applied on lesson writes and again on lesson reads; careful lock, link and quarantine handling on the encrypted files | Decisions and lessons from every project are returned by search and recall; a state document's identity is the last two path segments of the project, so two checkouts named alike share one document; the transcript miner and team sync write into the state document without the injection scanner; the session-start load hook reads the encrypted file as UTF-8 text |
elai |
A memory_facts row — one of eight fact types, a key, a
JSON value, an extractor confidence, a decaying trust score, a validity
interval, an ingest time, non-empty evidence pointers, a trust tier
T0–T3 and a provenance; beside it a free-text memory_notes
row with tags and links, and one core_blocks row per
user |
Three SQLite files under the project's memory directory — facts,
notes, core block — plus the session state board (ssb.db)
that journals every mutation |
For facts, a filter chain and no search: current rows for the user, seat and project, above a per-type trust floor, with non-empty evidence, code-cited rows re-resolved against the symbol index, newest-observed first, eight at most; for notes, personalised PageRank over tag and link edges seeded by the task id | /remember <text> or elai remember
when ELAI_USER_MEMORY_ENABLE=1: a regex blocklist and
credential skip-list, an optional invisible-Unicode scan, then ADD or
supersede on (user, scope, type, key);
elai memory insert with the same guards and no flag; the
every-fourth-turn reflection writes a note and appends to the core block
and extracts fact candidates it never stores |
Supersede closes the old row at the new row's start and links it;
elai memory delete, the dashboard's forget and a
tombstone-marked candidate soft-close without replacement; the semantic
pass closes an older contradicted row at 0.85 judge confidence; nothing
is ever deleted, and a closed key can be re-added by the next write |
user_id in SQL, seat_id and
project_id as hard filters in Rust, and a closed
compile-time allowlist of roles — Executor and Worker only — that may
receive any of it |
A Rust workspace of twenty-four crates: a REPL and CLI, an
orchestrator with a typed journal, a Svelte and Tauri dashboard with a
facts drawer, forget and pin buttons and a contradictions list; facts
reach the system prompt under # User decisions (remembered)
for the executor role only |
None spawned: the tokio decay scheduler has no caller, and decay, staleness quarantine, tier-conflict audit and the NLI contradiction pass all run inline every fourth user turn of the REPL | Per-type exponential decay of trust_score with
half-lives from 69 days to 19 years and a per-type retrieval floor; a
T0–T3 provenance tier whose safety-critical ceiling no live query sets;
supersession by higher tier and by judged contradiction; a persisted
trusted/recallable/untrusted label behind a second flag that registers
taint and filters nothing |
A role firewall that fails to compile when a role is added without a decision, provenance enforced as a non-empty evidence list at insert, fail-closed citation validation for code-grounded facts, and a staleness instrument with a negative-control arm whose results are committed | Abandoned and unsupported, with a filtered history and sanitised bytes; the capture flag expired on 1 September 2026; the automatic extractor, the LLM extractor, the promotion gate, the adjudication UI, the write quarantine, the raw-evidence tier, the MemGPT tools, the tier ceiling and the background scheduler are each declared and reach no live path; a forgotten key can be re-asserted by the next write |
elastic-atlas |
A document in one of three indices: an episodic customer message, a semantic fact with fact_type, confidence, source episodes and optional validity dates, or a procedural playbook with steps and outcome counts | Elasticsearch — atlas_memory_episodic, atlas_memory_semantic, atlas_memory_procedural, a shared atlas_catalog, and atlas_memory_state holding the consolidation watermark | RRF over BM25 and a semantic query on auto-embedded text, each leg filtered by user_id and by the absence of superseded_by and scaled by time decay and a use-count boost, then a Jina cross-encoder rerank to top-k | The customer's message is stored as an episode each turn and the agent writes facts through a tool; after the reply an inline consolidation pass extracts facts, drops assistant-only claims in code, and dedups against nearest neighbours | Supersession stamps the old fact superseded_by and superseded_at, plus retracted on an in-turn denial, and hides it from recall; forget_memory hard-deletes one document with an owner check and a best-effort event. No tombstone | user_id on every memory document, filtered on recall, core memory and consolidation, with optional per-user DLS keys; a REST recall without user_id and the supersede write carry no owner predicate | FastAPI chat over SSE, REST memory routes, and an unauthenticated MCP JSON-RPC endpoint per user_id exposing recall, write and forget | None scheduled; consolidation runs inline after every chat turn from a per-user watermark, one extraction call plus one batched dedup judgement | Superseded and retracted states withheld from default recall; confidence and pending_outcome surfaced to the model; a code filter drops extracted facts carrying tokens only the assistant said | A supersession filter with a value-level must-not case and a positive control, validity dates separate from record time, and a grounding filter enforced in code rather than in the prompt | Nothing on the write path consults a retracted value, the supersede write has no owner check, REST recall without user_id reads every user, and the harnesses need a live cluster and were not run |
elephantasm-core |
Four tables per anima: events (raw messages and tool calls), memories (an LLM summary with importance, confidence, a lifecycle state and a pgvector embedding), knowledge (typed statements: fact, concept, method, principle, experience) and one hand-written identity row | PostgreSQL with pgvector and row-level security: events, memories, a memories_events provenance junction, knowledge with knowledge_audit_log, identities with identity_audit_log, dream and meditation session and action tables, and persisted memory packs | A pack compiler assembles identity, recent memories by recency, up to 20 unsynthesised raw events, knowledge by pgvector cosine, and long-term memories scored in Python over a few of the newest embedded rows; separate routes offer ILIKE and pgvector search | Agents post events. An accumulation score of hours, events and tokens triggers an LLM to synthesise a pending batch into one memory with provenance links; each new memory then triggers typed knowledge extraction. Direct CRUD routes also write memories and knowledge | Soft delete and restore on every table. The Dreamer merges, splits, rewrites or soft-deletes memories every 12 hours and journals each change; the Meditator does the same for knowledge. Deleting a memory leaves the knowledge extracted from it | One anima per agent; anima_id is a predicate on every read; Postgres RLS admits animas in the caller's organisations; a host allowlist limits the public SDK domain to ingest and read routes | REST API with JWT or sk_live API keys; Python and TypeScript SDKs published separately call ingest and inject; inject returns a markdown pack for the system prompt | APScheduler: hourly synthesis sweep plus a check after each event; the Dreamer every 12 hours per anima (decay, state transitions, clustering, LLM merge, split and review); the Meditator after a count of knowledge syntheses; a daily billing job | Floats only: importance and confidence per memory, confidence per knowledge item. The ACTIVE, DECAYING, ARCHIVED state is an attention lifecycle, and packs read ACTIVE by default | Every curation mutation carries before and after snapshots and the model's reasoning; provenance from memory to source events and from knowledge to source memory; per-anima predicates on every assembler read under organisation RLS; a curation pass split into a free algorithmic phase and an LLM phase | The published tree imports billing and organisation modules it does not contain; any memory created by the Dreamer or the API moves the synthesis cursor and strands pending events; DECAYING to ARCHIVED cannot fire; the no-query pack is served from cache; deleted memories keep their knowledge |
eliot-memory-os |
A claim card with an epistemic status, a lifecycle status, a payload, a write id and a memory revision; beneath it evidence atoms, tool observations, source snapshots and verification runs | SurrealDB for canonical state — claim_card,
evidence_atom, tool_observation,
source_snapshot, verification_run,
write_receipt, memory_transition,
canonical_record, trace_span — with a redb
control write-ahead log holding pending writes, failed writes, dead
letters and project heads |
An activation graph and cognitive projections over canonical state; reports are explicitly projections, "prose not truth" | Every write carries a receipt reference, a memory revision and a project sequence, staged through the control WAL with a write status and typed reject reasons | Status transitions rather than deletion: Superseded,
Stale and Rejected are epistemic values,
Suppressed and Archived lifecycle ones, and a
memory_transition table records movement |
Project id and task id on every canonical record, with scope heads and project sequences | An MCP stdio surface with operator, cognition, task and verification handlers, plus Windows IPC, an app, a kernel and a watchdog | A governor crate of 41,468 lines, a supervision crate, adapter circuit states, and restart windows with runtime checkpoints | The epistemic and lifecycle axes, operator disposition of candidates, write receipts re-checked at promotion, a secret report, and an architecture-boundary auditor run against the Cargo manifests | The epistemic vocabulary is the best-shaped in this corpus: nine
values covering how a claim came to be believed, on an axis explicitly
separate from a four-value lifecycle covering whether it is live — so
Superseded and Suppressed are different facts
rather than one overloaded field. A candidate cannot promote itself: the
operator path refuses anything that is not an undispositioned candidate,
records the disposition with the source write id and memory revision,
and a later verification re-reads the claim and fails unless the status,
the write id, the candidate_only flag, the
operator-admission flag and four cognitive-run identifiers all agree —
an approval checked against its own receipt. The architecture boundaries
are machine-checked: audit-architecture-boundaries.py reads
the Cargo manifests and a declared policy and reports HARD_VIOLATION,
TRACKED_DEBT or AUDIT_SIGNAL, where a debt entry is rejected as
malformed unless it carries a positive issue number, a reason and a
removal condition — an exception mechanism that cannot be used as a
silent suppression |
Pre-alpha, and the README says so first: "Not ready for use." At
1.17 million lines of Rust across nineteen crate groups, with 6,142 test
functions, the proportion of this that has been exercised against a
running system is not determinable from the tree. The SurrealDB tables
are all SCHEMALESS, so none of the vocabularies above are
constrained at the storage layer — every invariant lives in Rust. The
durable-audit surface is named in the architecture and the tables exist
(write_receipt, memory_transition,
canonical_record), but whether they are append-only across
every write path was not verified here, which is why no audit mark is
claimed either way. The documentation carries a "mandatory
verified-reading protocol" addressed to reading agents; it was treated
as data and not followed |
elizaos |
Two kinds side by side — a Memory row (content, entityId, roomId, worldId, embedding, scope metadata) in a named table, and a LongTermMemory record typed episodic, semantic or procedural with confidence, source and access counters | Postgres or PGlite through Drizzle in plugin-sql, with an in-memory adapter that reimplements the same access ladder; embeddings in a sibling table | Vector search over embeddings plus keyword scoring, with a per-kind time weight — durable facts never decay, current facts decay as exp(-ageDays/14) from validAt | Model-driven extraction into a two-store fact model, durable and current, with a deterministic id per claim-and-evidence and a write-time structural dedupe that merges stronger metadata into the kept row | Real delete by id through the runtime, an agent action and an HTTP route; plus evidence-linked retirement that flips a fact inactive when a source message is edited or removed | A seven-value scope ladder on metadata.scope, compiled into the same SQL query that orders and paginates, with an unresolved role failing closed | A TypeScript monorepo — runtime, agent, CLI, desktop app, cloud, and 108 first-party plugins — with an HTTP memory API and a browse/feed UI | Evaluators run after a turn: fact extraction, reflection, and a reconciliation pass that retires derived facts whose source revisions changed | A discrete extraction status that filters every read, a three-valued verification status of which one value has no reader, and a separate confidence float used only for ranking | Every extracted fact carries the ids and revisions of the messages it came from, and an edited source retires the claim rather than leaving it; the scope predicate cannot be bypassed by pagination; provenance that cannot be derived withholds the item from recall rather than defaulting to global | Retirement is keyed on the record, and the write-time dedupe skips inactive rows, so the next message re-asserts a retired claim as a new row; memory_access_logs is declared twice with different columns and written by nothing; the human approval queue's closed action vocabulary contains no memory operation |
embodied-lgr |
A graph node holding a free-text object label from Florence-2, its MiniLM embedding, the robot's pose (x, y, yaw) when the label was seen, and a list of sighting timestamps; beside it a ReMEmbR row holding a scene caption, its embedding, the robot position, yaw and time | A NetworkX graph in the memory of the graphmemory_manager process, never written to disk; a Milvus collection named test_collection that the vector builder drops each time it starts | Three ROS services over the graph, each a linear scan returning the top 60: cosine between the query and each label, 2D distance to a coordinate, and nearest sighting timestamp. The vector store is reached through a Flask server that runs the ReMEmbR LangGraph agent over Milvus text, position and time search | Every 7 seconds a frame goes to Florence-2 for dense region labels; each label within 5 metres of the robot and above 0.75 cosine to an existing node updates that node, surplus labels create nodes. Scene captions are embedded and inserted into Milvus on arrival | A matched node's x and y move halfway to the robot's current position, its yaw is replaced and a timestamp appended. Nothing deletes a node; the Milvus collection is dropped whole when the builder restarts | None. One graph per graphmemory_manager process and one Milvus collection name shared by the builder and the server | A ROSA agent on GPT-4o with four memory tools, three graph queries and one call to the ReMEmbR server; the system prompt makes the graph primary and the vector store a fallback; a separate NaVQA evaluator node builds its own LangChain ReAct agent with the tool set chosen by a memory_mode parameter | None beyond the perception timers; the memory is written as frames arrive | None. Every label the vision model emits becomes or refreshes a node, and the evaluation prompt tells the model to take any positive vector-store answer as final | A graph with three typed query services that return structured coordinates and times instead of prose; semantic deduplication by label embedding inside a spatial radius, so cup and mug seen from one place converge on one node; an evaluator that switches the memory backends per run | The graph has no edges and is lost when its process exits; the vector builder drops the vector store at start; the paper describes edges, k-closest updates and preserved yaw that the code does not implement; node positions are where the robot stood; no memory test; the ReMEmbR agent evaluates model output with Python eval |
emem |
An observation: text, x y z coordinates, a caller-supplied timestamp, a perception layer name, a source type, a confidence float, an episode id and a tier. Beside it, gists summarising groups of observations and entities an LLM extracts from them | One SQLite file in WAL mode with observations, episodes, gists, entities, edges, an FTS5 table and the HNSW id map; one hnswlib index file written only on save or close; an in-memory R-tree rebuilt from SQLite at startup | Ten read-only tools. Semantic search fuses an HNSW top-k over observations, gists and entities with an FTS5 BM25 top-k by reciprocal rank, then filters by layer, time, episode and radius; radius, time-window, entity, episode, concept-to-centroid and latest-body-state queries run in SQL over the R-tree candidates | The host application calls add or add_body_state; observations buffer in process and flush on five items or two seconds, embedding inline. Every ten flushes or sixty seconds an LLM extracts entities, merged by name cosine 0.85, 5 m radius and a context-cosine gate | No delete or edit API. end_episode writes LLM gists and moves observations to long_term; maintenance archives long_term observations whose timestamp is over an hour old, blanking the text and removing them from HNSW, FTS and the R-tree. An entity merge overwrites its coordinates | None. One SQLite file per memory instance; layer and episode are optional filters the model chooses per call | A Python library; OpenAI-format tool schemas with a dispatcher, and callables for EmbodiedAgents' register_tool. The agent reads only; writes come from the perception pipeline | None in the library. Time-window consolidation and archival run when the host calls consolidate_time_window and maintenance; entity extraction runs inside whichever add call triggers a flush | A confidence float per observation and per entity, carried and never filtered on; merged entities keep the maximum. No status | Three indexes behind one filter set, so what, where and when compose in one call; an FTS5 query escaper; per-observation entity attribution with a context gate against merging two generic chairs; a benchmark harness with eight cognitive paradigms and schedule-driven virtual time | Archival reads observation age, not time in the tier, and DBSCAN noise never leaves short_term; the entity gate fails open once its source is archived; area summaries return the oldest gists; the HNSW file is lost back to the last save on a crash; the paper's two baselines are tool subsets of eMEM itself |
empirica |
A typed epistemic artifact — finding, unknown, mistake, decision, assumption or dead-end — scoped to a project and goal | SQLite across a dozen schema modules, with an optional Qdrant backend for semantic event retrieval | Bootstrap loading with N-step recursion, time decay and impact weighting rather than a similarity query | Artifacts are recorded during work; a Sentinel gate blocks edits until understanding is demonstrated | Resolution with a closed four-value reason vocabulary, plus a named superseded_by pointer | project_id as a foreign key on every artifact table and a predicate in the repository queries | An MCP server, a CLI, a terminal statusline and an optional cross-agent mesh | Deprecation scoring, calibration loops, epistemic rollup and a persistent inbox listener | Two orthogonal vocabularies — how a claim was arrived at, and why it stopped being current | The resolution vocabulary was designed from a measurement of the project's own store, and the argument is committed | The source-tagging that would catch a gamed confidence vector is v0 with the routing rule deferred |
empryo |
A record with a four-value category, summary, details, topics, file references and a unique content hash | SQLite with FTS over two tokenizers, a 384-dimension embedding
column, and a memory_edges similarity graph |
RRF over five directional signals — unicode FTS, trigram FTS, file affinity, git co-change affinity, semantic rank — plus a magnitude bonus | Agent tool calls and an upsert keyed on
content_hash UNIQUE; the hash both dedups and,
deliberately, wakes a hidden record |
superseded_by with hidden, both filtered
on the read path; soft delete is restorable and re-saving the same text
restores it |
Separate writeScope and readScope over
global and project, defaulting writes to
project as the safer side |
A terminal agent with memory tools, inline hints on tool results, and a browser with a bulk cleanup queue | None scheduled; similarity edges and hint state are computed on the write and read paths | source records user or agent and nothing reads it as
trust; pinned, hidden and superseded are lifecycle, not epistemic
status |
A deterministic hash-bag embedder with its cosine ranges measured and the ranking calibrated against them; co-change and blast radius as recall signals | Soft delete is not rejection — the dedup path wakes a hidden memory when the same text is saved again, and a test asserts it |
emulo |
A rule with an operational implication, kind inferred or explicit, citing evidence items that each hold short verbatim dated quotes from the user's own typed messages; rules are grouped into work, design, write and video profile files | Files under ~/.emulo or EMULO_HOME: content-addressed segments, cached worker reports, immutable hash-manifested profile versions and a current.json pointer. The one-file path writes emulo-out/ instead | None by relevance. A skill runs plugin profile-path and the agent reads the core file plus one domain file whole; the MCP tool returns the same text; --install copies the profile into AGENTS.md, GEMINI.md, a Cursor rule or a skill | Batch, on explicit request: the extractor keeps typed messages, redacts and segments them; an agent runs one worker per segment and one reducer; Python validates quotes, rule support and the pack before an atomic pointer swap | No per-rule correction. The active profile is hash-checked, so a hand edit is refused; the guide says to mine again, and unchanged inputs reactivate the cached reduction. A session log that rolls off disk drops its segment at the next update. Delete is rm -rf ~/.emulo | One person, one store. Domains are separate files chosen by the loading skill; no scope key on a rule and no predicate on a read | Claude Code and Codex plugins with five skills, a skills.sh bootstrap, a one-tool stdio MCP server, and install adapters for Claude, Codex, Cursor, AGENTS.md, Gemini and OpenCode | None. Mining and updates run when the user asks; an Autopilot package with a review queue, generations and encrypted sync ships with no producer of candidates | Admission only: verbatim-quote check, two sessions and two source-quarter strata for an inferred rule, refusal of any rule citing contradicted evidence, a generic-phrase list. Installed rules carry no status and are injected as instructions | Receipts checked verbatim against the dated message; the extractor keeps only human-typed turns and drops injected context and its own chunks; content-addressed segments and reports make an unchanged update cost zero model calls; immutable versions with a fail-safe pointer swap | validate-pack checks that validated rules are present in the LLM-written profile, not that nothing else is; a wrong rule has no correction path; history that rolls off disk leaves the profile at the next update; the Autopilot review queue has no producer and its retirement kind renders as another rule |
engram-alpha |
A typed node joined by typed edges, carrying a fields
map of graph-declared custom values beside its tags — but the type set
is per-graph config, not a Rust enum: engine logic keys on the roles a
type or verb carries (supersession,
contradiction, worklist,
tombstone), so a renamed or replaced ontology keeps every
behaviour |
TepinDB — one self-describing graph.tepin file holding
documents, keyword index and vectors, the birth format of every new
graph since v0.6.2 — with the SQLite driver kept behind the same trait
as a migration source; nodes and edges plus a suspects table, an
append-only audit journal and a meta row that records the store's own
encryption state |
Vectors with a reranker that votes rather than decides, a keyword weight of 0.15 over a blind BM25 index that ranks identically sealed or plain, calibrated delivery — a score floor and a knee cut whose whole tradeoff curve is committed, with the abstention line fitted per graph from unanswerable probes built out of the graph's own vocabulary — a rank demotion at the cut for a second hit from a session already delivered, and one-hop neighbours attached to every hit | A write returns the look-alike pairs it just queued, so the assistant judges them in the same turn — detection is local, judgment is the assistant's | replaces and conflicts-with edges,
valid_until for archival, an atomic
merge_nodes that rehomes edges and archives victims behind
a supersession, a suspects table resolved as conflict, replaces or
dismiss, a human pin that disables decay, and a hard delete that mints a
Tombstone note carrying what was removed, its text and why
— a later write near it lands with a tombstoned warning and
is never refused |
None inside a graph. Separation is one store per project, and a single machine-wide core process holds them all — so which project a session reads is a five-rung binding decision, not a predicate | An MCP server that is always a bridge to the machine core, a
JetBrains plugin and a VS Code extension published to three
marketplaces, plus a standalone pane with a live browser demo;
brief called with a project rebinds a session
whose client will not say where it is, and setup writes
session-start brief hooks for Claude Code, Codex, Devin CLI and Bob |
Trust is computed at read time, so no pass has to have run for a
read to be correct; a session-boundary validate_graph
archives, retires, re-fits the two auto-tune dials and rescans, and
drift scans surface for review while deliberately never demoting |
Three distinct durable anchors — confirmed_at,
approved_at, demoted_at — plus a
trust_override pin, and a suspects status of suspected,
confirmed or dismissed |
Retrieval stamps last_seen for observability only,
because exposure would otherwise let a broad recurring query certify its
own outputs |
No scope key of any kind, and a session whose workspace cannot be determined binds the home graph rather than failing; approval is an MCP call whose only guard is its own description; the retrieval half of LongMemEval is graded at session level, and the one number the external run does not price is how often an answerable question gets warned |
engram-cognitive |
An episode with a caller-settable timestamp, actors, tags, salience and a decaying importance score; a fact as a subject-predicate-object triple with validity and supersession columns; entities and weighted graph edges beside them | One SQLite file with the .engram extension — sqlite-vec
for vectors, FTS5 for keywords, optional SQLCipher with a
rekey() method; no server and no API key to write |
Hybrid BM25 and cosine at a 0.5/0.5 default blend, pure cosine, or
spreading activation over Hebbian edges; as_of restricts
episodes to a point in time and timeline() reads facts
valid at one |
Writes land locally and immediately; extraction is a separate
reflect() pass the caller schedules, and a CI gate holds
the promise that no provider SDK is imported at module level |
A newer extraction closes the older same-subject-predicate fact's
validity and links the successor; forget,
forget_fact and forget_entity are permanent
deletes, the last of them crossing every agent in the file |
agent_id is a vec0 partition key filtering every episodic read,
widened only by cross_agent=True; facts and entities are
shared across agents by an explicit decision |
A Python library, an engram CLI, an async wrapper, and
an MCP server exposing remember, recall, why, forget and stats with
reflect() deliberately withheld |
A reflection pass that extracts facts and resolves contradictions, an Ebbinghaus decay with Hebbian reinforcement, and a compression pass that summarises low-importance episodes and hard-deletes the originals | Provenance through why(), a hash-chained event file
when configured, a socket-blocking CI check that a full
observe-and-recall cycle opens zero sockets, and a gate that recomputes
every published number from committed records |
The gates are the thing to take. Three scripts under
scripts/ hold three invariants, each written as an argument
rather than a rule: no-network-at-write.sh parses the
package with Python's AST — "because indentation is the entire
distinction and a regexp would be fooled by an import inside a try block
at module scope" — to prove no provider SDK is imported at module level;
local-first.sh holds the install side, an allow-list of
exactly three permitted default dependencies ("a new dependency should
have to be argued for, not merely fail to match a list of things
somebody thought of in 2026") and a full observe-and-recall cycle run
with socket creation made to raise, "so a call that would have connected
fails loudly instead of passing quietly on a machine that happens to
have no route"; and readme-numbers.sh recomputes the recall
table and corpus size from benchmarks/results/*.jsonl
rather than quoting them, because "[a] number in a README is a claim
with no owner". Each says it is "the ONE copy of this check". Then comes
the layer almost nobody builds:
tests/test_gates_are_wired.py asserts the gates run in
release.yml, because a tag push does not trigger
ci.yml at all, so until August 2026 the workflow that
shipped the wheel to PyPI ran none of them. That test refuses to parse
the YAML, on the ground that PyYAML is not a declared dependency and "a
test that quietly depends on somebody else's transitive install is the
same class of defect as a gate that runs in one job" |
The bitemporal columns are the gap to read first: facts
carries valid_from/valid_to beside
recorded_at/superseded_at, and both shipped
writers set valid_from and recorded_at to the
same now, while close_fact writes one
now into both valid_to and
superseded_at. Two axes, one clock, and no public API
accepts a valid time, so get_facts_as_of reads a version
chain rather than a belief history — the store cannot answer what it
held as of last Tuesday. The bitemporal test suite passes because its
helper constructs rows directly, setting
recorded_at=valid_from, which no shipped path produces.
Erasure is the other one: forget_entity deletes episodes
where the entity is named in the caller-supplied actors
list, so an episode whose text names the person while its actors list
omits them survives, and the next reflect() reads the whole
episode window and can re-extract the deleted fact. Nothing is keyed on
a value and no tombstone concept appears anywhere in the tree, so a
re-derived belief returns silently. Smaller: import_json
writes episodes, facts and entities with no event at all, so an auditor
reconciling against memory_written finds memories nobody
recorded creating; and confidence is a continuous score with no discrete
status beside it, so an extraction the model was unsure of is
indistinguishable at read time from one it was certain of |
engram-format |
An engrams row — a UUID id, a layer of episodic,
semantic or imagined, one of sixteen sources, a privacy level, content
and a JSON context, a strength that retrieval raises and decay lowers, a
valence, a retrieval counter, the imagined and
grounded flags, created_at,
occurred_at, last_retrieved,
modified_at and synced_at, a project,
comma-separated tags, a normalised content hash, a scope word and a
content type; beside it typed links, a 384-dimension embedding, evidence
pairs and annotations |
One SQLCipher-encrypted SQLite file per vault directory, keyed from
the machine id or from an Argon2id passphrase with a per-vault salt,
with an engrams_fts FTS5 table synchronised in application
code and an engram_embeddings table of raw little-endian
f64 blobs; schema version 7 tracked by PRAGMA user_version
with idempotent column ensures |
FTS5 over content, tokens ANDed first and ORed when that returns
nothing, ranked by FTS rank, falling back to LIKE ordered
by strength; a brute-force cosine scan over every stored embedding; a
surface_relevant score of word overlap, strength, seven-day
recency and positive valence over the fifty strongest rows;
search_related by explicit links then by cosine above 0.35;
a get bumps the retrieval counter and
last_retrieved |
A library call: write runs the capture pipeline — a
noise filter on episodic captures, a normalised SHA-256 dedupe that
strengthens the existing row by 0.1 instead of inserting, a paraphrase
gate at cosine 0.95 when an embedding is supplied, tag normalisation
with a denylist, project and tag auto-fill — then an upsert, the FTS
row, the embedding, the carried links, semantic links above a threshold
and a temporal link to the previous row of the same session;
write_curated skips the gates |
Upsert by id; delete and purge_by_criteria
are hard deletes that also clear the FTS row and refuse an unparseable
date; apply_daily_hygiene strengthens rows retrieved in the
last day and decays the rest by an Ebbinghaus curve whose stability
grows with retrievals; apply_weekly_consolidation promotes
episodic rows with five or more retrievals to semantic and deletes
imagined rows below strength 0.05; sync deletions are tombstone blobs
with a higher vector clock |
A project column, a privacy_level and a
temporal scope word are stored; the crate's read paths
filter on none of them, Query.project and
Query.scope are declared on the trait and dropped by the
adapter, and purge_by_criteria is the only consumer of
project |
A Rust library, axiom-engram 0.1.5 on crates.io,
exposing EngramStore, a MemoryBackend trait
with an adapter, a QemCache write-through layer of 32-bit
XOR codes, an Embedder trait with a Candle-backed
all-MiniLM-L6-v2 behind the onnx-embed feature, and the
sync envelope types; the daemon, REST and MCP servers, CLI, browser
vault and relay that call it are closed source |
Nothing runs on its own: hygiene and consolidation are methods the
closed daemon schedules; the FORMAT names a nightly consolidation and
the lib.rs header a nightly distillation into semantic
abstractions, neither of which is in the crate beyond the counter-based
promotion |
A quarantine state for imagined, ungrounded rows honoured by the
related, duplicate and link paths and optional on the rest; a
grounded flag, memory_evidence pairs and
annotations tables with no writer in the crate; strength as
a continuous score; sync integrity by HMAC and last-write-wins on a
per-memory clock; every derivation constant published |
A format specification that a vault owner can check line by line against the code; a capture pipeline whose every gate is named and unit-tested with its outcome type; a stated threat model for the machine-key vault; idempotent migrations that cannot claim a version they did not reach; a decay report that surfaces near-duplicates and stale working state for a person instead of acting | Half the read surface ignores the quarantine, including every path
the MemoryBackend trait exposes; hard deletes with no local
record; purge_by_criteria builds SQL from criteria names;
surface_relevant scores by word overlap over the fifty
strongest rows only; the specification's header lags the code by a
schema version and the README by a crate version; three commits and one
author, with the product's behaviour unverifiable from here |
engram-mcp |
A typed memory row (fact, decision, preference, pattern, debug, entity, handoff, adr, todo) with tags, importance, branch, pinned and global flags, external artifact pointers and merge provenance; handoffs, ADRs and todos add sidecar tables | One SQLite file for every project, default under the user data directory, with an FTS5 index kept by triggers and 256-dimension embeddings from a local quantized ONNX model | memory_query fuses cosine over project plus global embeddings with FTS5 BM25 by RRF k=60; memory_context scores cluster centroids first, over a 500-row recency-capped candidate set; handoff_resume ranks per-section embeddings along a branch chain | Explicit MCP or CLI store; same-type memories at cosine 0.90 or above auto-merge on store, new over old; Claude Code hooks capture a session-end summary by default, and #remember prompts and subagent results when enabled, under a daily cap | Content replaced wholesale with the old version snapshotted; supersedes edges redirect retrieval to the successor; a dead flag drops a memory; deletes, merges, prunes and wipes snapshot to a 30-day trash with memory_restore | project_id key on the row, from the git remote or path, filtered on the search, list, handoff, todo, ADR, trash and export reads and overridable per call by a model-supplied project argument; memory_graph reads by id and traverses edges with no project predicate; a branch column filtered by branch mode; a global flag that crosses projects | MCP stdio server with up to 29 tools behind three advertised profiles, two MCP prompts and memory resources; engram-cli with JSON output; a SessionStart shell hook; lifecycle hooks installed into Claude Code settings | An hourly pass recomputes decay, prunes never-accessed floor-relevance memories older than 30 days and sweeps the trash; a 6-hourly pass re-clusters and merges same-type pairs at 0.90 inside each cluster; both sleep one interval before the first run | Stored dead flag and supersedes edges filtered by query, context and list; ADR status and todo status are workflow states; no provenance of author or source beyond hook tags | Supersession returns the successor at the superseded memory's rank with a matched_via note; every destructive path snapshots to a trash with edges and embedding; decay counts days of curated activity, not calendar days; tool results return what they replaced or destroyed | The 6-hourly and CLI dedup passes ignore supersedes edges and dead flags, so a correction can be merged away; recall_context and handoff_resume skip the status filter; the memory_context candidate cap favours the latest-accessed rows; memory_graph returns other projects' memories through cross-project links; deletes do not sync between machines |
engram-nickcirv |
A graph node of kind mistake, decision or pattern beside the code nodes: a label, a source_file, a confidence enum and score, last_verified, and four optional fields for then-believed, found-false-at, truth-now and applies-to | One SQLite file per project at .engram/graph.db, held in memory by sql.js and written back whole on every close | Mistakes by exact source_file for the Edit, Write and Read hooks, the newest few by last_verified for the SessionStart and PreCompact briefs, and substring match on label or id plus BFS over edges for query_graph, with a 2.5x score boost for mistakes | Regex mining of git reverts, fix commits, CLAUDE.md, AGENTS.md, .cursorrules and .engram/sessions on init; engram learn and POST /learn run the same regexes over a caller's text and promote any mistake to 0.85 | INSERT OR REPLACE by an id derived from the label. No delete verb. A full init deletes every node and re-mines; a single-file reindex deletes every node whose source_file is that file, mistakes included | Physical: one graph.db per project root. No key on the row and no predicate beyond the file path | Claude Code hooks installed by init on eight events, a read-only stdio MCP server with six tools, an authenticated localhost HTTP API, and generators that write mistakes and decisions into CLAUDE.md and AGENTS.md | None for memory. An opt-in file watcher and PostToolUse reindex hook refresh code nodes per file | A confidence score, 0.9 for reverts, 0.85 for learned text and 0.6 for mined fix commits, used as a 0.8 floor on the proactive warnings. The EXTRACTED, INFERRED and AMBIGUOUS enum only changes rendering | Reverts become structured then-believed and truth-now records with commit provenance; a frozen-fixture test holds the session regexes to zero false positives on prose; proactive warnings carry a confidence floor so inferred mistakes browse but do not nag; the MCP surface cannot write | Every store open writes the whole file on close, so concurrent hook processes are last-writer-wins, a hazard the repository's own test acknowledges; a reindex of a file deletes its mistakes; learned mistakes are lost on the next full init; valid_until has readers and no writer; the guard's documented default is off and its code default is on |
engram-provable |
A typed memory row with a binding, a provenance, a confidence and an event date | PostgreSQL with pgvector, an HNSW index, and a per-tenant hash-chained mutation log | Hybrid recall with graph expansion, every query filtered by tenant and by binding | Through the Provenance Firewall, which can hold an untrusted write out of active memory | Soft delete, archive, redaction, and per-subject crypto-shredding | tenant_id is a WHERE clause on every read; anchor and session bind memories to subjects | An HTTP API, an MCP server, an admin console, Docker and a distroless image | Decay, consolidation, contradiction detection, metacognition | binding quarantine holds a memory out of recall and belief logic until an admin acts | A database-enforced append-only audit chain with a verify function that names the break | The 91.4% LongMemEval headline has no harness or result committed anywhere in the tree |
engram |
Observation and prompt records | Local SQLite WAL, FTS5 | FTS5, topic-key lookup, context assembly | MCP mem_save, conflict candidate flow, dedupe/update
rules |
Topic-key updates, duplicate counts, soft delete/sync mutation | Project, scope, session, topic key | MCP tools for coding agents | Sync queue, local conflict workflows | Source/session/project metadata, explicit judgment path | Simple durable local design, inspectable code | Lexical retrieval limits; conflict UX depends on agent behavior |
engraphis |
A memory row typed working, episodic, semantic or procedural, carrying a scope, a confidence, world-time validity bounds, the system time each bound was learned, and a provenance blob holding its review state | One SQLite database — memories, an entity/edge graph with per-edge supports, a portable vector table, a hash-chained audit ledger and a job queue | Scope and time filter, then vector, FTS5/BM25 and Personalized PageRank arms fused by RRF, reranked, packed to a token budget, and the packing drops anything pending, quarantined or conflicted | Every write is stamped pending unless it came from a
local agent source that did not arrive over http, mcp or remote ingress;
a poisoning detector can quarantine independently |
Validity is closed rather than rewritten — valid_to
with valid_to_recorded_at beside it; erasure emits a sync
tombstone keyed on the id, not on the value |
workspace_id and repo_id compiled into the
recall query, with a four-level scope of session, repo,
workspace or user on the row |
An MCP server whose recall tools take valid_at and
known_at separately, a v2 HTTP API, a dashboard, and a
Claude Code plugin manifest |
A job queue for embedding, consolidation and graph indexing;
consolidation writes its output back as pending |
A discrete review state — pending, approved, quarantined — that
gates the packed prompt, with a numeric confidence beside
it used only as a scoring multiplier |
Approval requires a browser session, a CSRF token and a written reason, so an agent cannot approve its own memory; the security eval's absence checks each carry a presence precondition | The open-core boundary puts hosted sync, analytics and team services outside the tree; the scope predicates admit NULL workspace and repo rows; consolidation output lands pending and nothing but a person clears it |
enquire-mcp |
A file in the user's Obsidian vault — markdown or PDF. Its path is
its identity, its mtime is its age, and its frontmatter is
whatever the user wrote |
The vault itself, untouched; derived state is a SQLite FTS5 table plus an embedding database and its HNSW derivatives, treated as one coordinated persistence family that can be erased and rebuilt | FTS5 lexical and embedding arms fused by reciprocal rank fusion, with PDF hits keeping page citations; results carry a path, an excerpt, a score and an age in days | Read-only by default; writes are opt-in, with cancellation split between rollback operations that restore committed effects and atomic operations allowed to finish | No memory lifecycle — the user edits their own notes. Erasure applies to derived artifacts through one receipt leaf that believes an unlink only after re-statting the entry absent | None in the retrieval sense: one vault, one user, no stored scope key. What is enforced is filesystem confinement — a path is resolved, then classified against reserved and hidden segments at every depth, then refused | An MCP server reaching Claude, Cursor, ChatGPT, Codex and other clients, with a hybrid search tool, structured Canvas, Dataview and Bases tools, and a stale-notes surface | A vault watcher behind an activation guard, periodic cache pruning, and embedding sync and replacement staged against full-family erasure | None. A note's age is surfaced as age_days and a
stale flag for the model to reason over; nothing is
withheld on it, and the recency re-ranking built on the same signal is
opt-in and off by default |
The path policy is applied to the resolved physical location, so a visible symlink cannot launder a hidden directory into the public surface, and the privacy suite opens with a guard asserting its own fixtures can be built; one erasure receipt leaf replaced the same rule half-applied across six erasers after the project's own re-sweep found the gap; and age is surfaced as a signal rather than folded into ranking | There is no memory lifecycle at all: writes exist but nothing
distinguishes a note an agent wrote from one the user wrote, nothing
records a correction, and staleness is computed from mtime,
so a note a linter reformats is newly young. The repository also ships
llms.txt, llms-ctx.txt and an AGENTS.md addressed to reading agents,
which is worth knowing when an agent summarises this project from its
own documentation |
everos |
Markdown on disk as the source, deriving episodes, atomic facts, agent cases and agent skills as typed rows | Markdown files as canonical, with SQLite and LanceDB indexes rebuilt from them | Keyword and dense search over LanceDB with a shared filter compile path for /search and /get, plus a case-to-skill bridge | A watcher-scanner-worker cascade over the Markdown root, with one handler per derived type | A deprecated_by column marks superseded episodes and
atomic facts and is excluded on read; document deletion exists at the
service layer |
Four keys — owner_id, owner_type, app_id, project_id — pinned into the base filter of every read | A Python library, a service with /search and /get, and a
cascade sync CLI |
The cascade: a filesystem watcher, a scanner, a worker, a reconciler and a backfill | Confidence on some derived rows and a deprecation pointer; no epistemic state and no provenance chain | Four scope keys enforced on one shared compile path, tested end to end; Markdown canonical with rebuildable indexes | Supersession is excluded from reads but recorded on the row, not the value, so re-derivation is unguarded |
evox-genesis |
A directory. Each one carries a CONTEXT.md holding its
intent, API surface, constraints, design decisions, known issues, notes
to future agents, dependencies, test strategy and a routing table naming
its children; beside it a git note under refs/notes/evogit
per commit records the agent episode that produced it, and a task row
records the run |
The git repository itself — CONTEXT.md files as tracked
content, refs/notes/evogit for per-commit agent metadata,
refs/genesis/archive/T<n>-A<n>-start|final refs
pinning each archived episode's endpoints against gc; a SQLite database
(tasks, projects) for task rows, their review
status and their archive metadata; skills as markdown files under
.agents/skills/ in the target repository |
Structural, not ranked. build_context/2 assembles the
CONTEXT.md of every ancestor directory from the repository
root to the agent's node, in order; search_history runs a
regex over commit messages and the evogit notes ref; the
agent reads files with ordinary tools. No index, no embedding, no
scoring —
rg -n -i 'embedding|vector|cosine' apps/evo_git/lib --glob '*.ex'
finds nothing |
An agent writes CONTEXT.md with the ordinary file tools
and commits it; the architect agent is told the file is the only place
architectural intent can live. complete_task then attaches
a git note to the final commit with the objective, the result, the agent
type, the depth, the parent and the context node path, and — only when
the run was started with --archive — writes the two archive
refs and an episode record that reaches the task row |
A CONTEXT.md is rewritten in place and the change is a
commit; disable_skill and
remove_skill_from_all_contexts edit the frontmatter lists.
There is no deletion record for memory: reject_branch
deletes the branch and nothing else, and the task keeps a
review_status of :rejected keyed on the task
rather than on what was proposed |
The directory position is the scope key. An agent sees the root-to-node chain and no sibling subtree; a skill is callable only where an ancestor names it; each agent gets its own git worktree, and the prompt tells it that siblings are readable but never writable | A CLI (genesis, evolve,
reflect, run), a Phoenix LiveView dashboard
with projects, tasks, a review page and a chat entry to a repo-less
self-reflective agent, a Tauri desktop shell, a headless daemon release
for SSH remote development, and model access through ReqLLM |
None on the memory. Agents run as scheduled episodes; a lease and
heartbeat recover stuck tasks and a startup reconciliation moves
:finalizing to :failed; no pass rewrites a
CONTEXT.md |
None on a memory. A CONTEXT.md has no status, no
confidence and no provenance field; the discrete states in the system —
a task's :open, :merged,
:rejected, :continued, :ignored,
:no_changes — belong to the run, not to what was
written |
A scope key that costs nothing to maintain because it is the file's location; knowledge that lives in the same commit as the code it describes, so a diff moves both together; a routing table that lets a parent delegate without reading a child; skills enabled hierarchically from the same file; 4,655 committed test cases | build_context/2 — the function that assembles the
memory — has no test, and its one caller degrades to a bare path string
on any error, so an agent can run with no context tree and no signal; a
rejected branch is deleted and nothing keyed on its content survives;
the archive is off by default; each ancestor is truncated to a byte cap
with only a log line; there is no validity time and no status on a
memory |
exomem |
A typed Markdown page in the vault's Knowledge Base folder: a Source, an Evidence artifact, a compiled note (insight, pattern, failure, research-note, experiment, production-log), an entity, a Record or a Planning item, with optional semantic blocks (claim, finding, decision, hypothesis) inside it | The user's Markdown/Obsidian vault is the source of truth; per-machine SQLite sidecars hold FTS5 and trigram indexes, embedding blobs, the wikilink graph, claims and review state, all rebuildable except the review-state file | find and ask_memory fuse BM25 over FTS5, bge embeddings and one-hop wikilink neighbours by weighted RRF, with an optional cross-encoder rerank; activate_context compiles a bounded working-set packet or abstains; superseded pages are halved in score, not dropped | Explicit and agent-authored through typed MCP, CLI or REST tools: remember, capture_source, preserve_evidence, edit_memory, replace_memory, record_memory, episode_memory. No model extracts anything; hooks only remind the agent to search or save | replace_memory marks the old page status superseded with a superseded_by pointer and writes the successor; edit refuses a superseded page; delete moves a file to _trash with a sidecar; Sources and Evidence refuse delete and replace. No tombstone | Governance policy in _Governance: scopes select pages by frontmatter projects, tags, types, classes or path, rules cap disclosure per audience, and a release plane drops withheld hits on find, ask_memory and activate_context. Local stdio and the shared REST key are the owner and see everything; hosted tenants get one vault per cell | FastMCP server over stdio or HTTP with 32 tools, the same registry exposed as CLI and REST; a Claude Code plugin with skills and Stop, UserPromptSubmit, PreCompact and SessionStart hooks; Codex hooks; a browser Review Studio; hosted cells behind OAuth | A file watcher keeps indexes fresh; a media worker child runs OCR, ASR and CLIP; an opt-in idle dreamer proposes upkeep and, with sensing on, runs an NLI model in a child process; none of them writes the vault | No candidate or verified state. Page status is a lifecycle word; unit verdicts (confirmed, refuted, qualified) are authored and never filtered; NLI stance labels are opt-in audit signals. Review decisions dismiss lint signals, not memories | Writes, index updates and the log entry commit in one atomic batch; the release plane runs after the shared result cache and fails closed on an unbound principal; supersession keeps both pages and refuses edits to history; a working-set packet has hard character caps and states abstention; negative controls in the activation benchmark are asserted to be load-bearing | Superseded conclusions stay retrievable at half score and the inject hook drops their lifecycle label; the agent holds every review verb the Studio uses; the log is an editable vault file with no before values or actor; Sources cannot be deleted through the product; the server refuses to run on macOS; the surface is very large for one maintainer |
facets-flow |
Two kinds. A tasks row in SQLite — slug, project,
status, priority, work dir, the harness session id and its resume
timestamps, waiting-on, due date, assignee — and a dated bullet in one
of five fixed markdown files, written in the format
- YYYY-MM-DD — short quote or paraphrase by the model,
never by the binary. Task briefs, progress notes, project updates and
each owner's charter and journal are further markdown files beside
them |
One SQLite file at ~/.flow/flow.db for task, project,
playbook, owner, tag and message-bus state, and a directory tree beside
it — kb/ with five seeded files, tasks/ and
projects/, one subdirectory per slug, holding briefs and
dated update notes |
There is no retrieval engine. flow show task,
flow show project and flow show playbook print
the row, the brief path, the update paths and the five knowledge-base
paths; the session hook tells the model to Read the brief and
updates eagerly and the knowledge-base files lazily, only when the turn
needs them. What reaches a context window is whichever files the model
chose to open |
Two paths, both the model's. During a session the skill's scoop rule
says to append a durable fact to the matching bucket on hearing it,
without asking. At flow done, the binary runs a headless
close-out sweep through the task's harness —
claude -p --dangerously-skip-permissions or
codex exec --dangerously-bypass-approvals-and-sandbox —
waits for it to exit, and discards its output; the sweep re-reads the
whole transcript and appends what passes three bars. The binary composes
the prompt and writes nothing to the knowledge base itself |
By convention, not by mechanism. Guardrail four says entries are
never edited — 'append-only log; a changed fact is a new dated entry' —
and nothing enforces it because nothing but a model and a text editor
ever touches the file. Task and project state has an
archived_at column and the skill states that archiving
never deletes briefs or updates from disk |
Physical and by convention. Tasks and projects have their own
directories and a work_dir; the knowledge base is one
global directory per flow root, listed to every session regardless of
task or project |
A CLI plus a harness abstraction with two implementations, Claude
Code and Codex. It installs its own skill (SKILL.md plus
fourteen reference files, embedded in the binary), a SessionStart hook
that emits the bootstrap contract, and spawns sessions into iTerm,
Ghostty, Kitty, Warp or Zellij tabs |
Owners — recurring agents with a wake schedule, a tick process and a
last-tick status — plus the close-out sweep run by
flow done, and a message bus with a backoff escalation
schedule for pending human messages. Only the sweep is directed at the
knowledge base, and it writes there by asking a model to |
Provenance is the date on the bullet and the file it landed in. There is no status, confidence or source field on a knowledge-base entry, and the binary cannot tell an entry it prompted for from a line the user typed into the file by hand. The close-out sweep that writes entries runs with every tool approval bypassed | flow stats mines Claude Code session transcripts for
Read calls whose path contains /.flow/kb/ and
reports them as knowledge-base lookups — an instrument for the one thing
a prompt-directed memory cannot guarantee, which is whether the
instruction was followed. The match is a literal on the default root, so
a relocated FLOW_ROOT or a Codex task reports none |
The shipped artifacts disagree about when the knowledge base is
read: the session hook and the skill say lazily and only on demand,
while the README, a comment in show.go and the close-out
sweep's own prompt say the files are loaded into every session — the
last is the premise the sweep's strict bar rests on |
farm |
An object row across parallel tensors and lists — a 3D Gaussian mean and packed covariance, a detection-count-weighted appearance feature, a sparse voxel set, an external object_id, a VLM caption with category, supercategory and attributes, three retrieval embeddings, per-object caption and embedding histories, retained viewpoint image ids, an active flag and a lock flag | One scene_state.pt written by torch.save through a temp file and rename; optional scene_graph.json and versioned HDF5 snapshot directories; nothing else | Reciprocal-rank fusion over caption-text, raw-utterance, SigLIP2 and Qwen3-VL embedding channels on active captioned rows, then an LLM-parsed query graph whose spatial predicates are scored in closed form over the Gaussians, with an optional VLM rerank of the top candidates | Per RGB-D batch: YOLOE masks lifted to Gaussians, neighbours among active rows by feature similarity and Hellinger distance, union-find correspondence, moment fusion, new rows for unmatched detections; captions and embeddings arrive later from an asynchronous VLM worker | Fusion updates rows in place; merges, keyword pruning, unclear-caption drops and a Viser delete all set active to False and keep the row; a person can edit a caption, lock or add an object in the Viser UI; nothing removes a row, and nothing stops the same object returning as a new row | None on a row. One file per scene; a query that names a room narrows candidates to that region's objects | A ROS 2 mapping node, an offline driver that runs the same node over recorded datasets, a Python retrieval API and CLI, and a Viser browser UI with a query panel and edit controls; no LLM agent writes to it | An asynchronous caption and embedding worker, keyword pruning every 100 steps, periodic region clustering, and saves every 40 m of travel, on timed checkpoints, on each UI edit and on request | None as a state. A VLM keep or drop verdict per caption that only the viewer reads; an active flag that collapses merged, pruned, dropped and deleted into one value | A compact per-object representation with a constant-cost closed-form update, relations recovered at query time instead of stored, a retriever that fails closed on the default path, and a reload that freezes the prior map against being merged or recaptioned | A deleted or pruned object comes back as a new row the next time it is seen; a lock freezes a moved object at its old place; UI edits share no lock with the mapping batch; the store is a pickle loaded with weights_only=False; no test touches persistence, deletion or locking |
fava-trails |
A thought \u2014 a markdown file whose YAML frontmatter carries a ULID, a parent, a supersession pair in both directions with scopes, an agent id, a bounded confidence float, a source type, a six-value validation status, an intent reference, a creation time, typed relationships, and a metadata block of project, branch, tags and free extra | Markdown files with YAML frontmatter in a Jujutsu repository, under
trails/<scope>/thoughts/<namespace>/<ulid>.md,
with the namespace routed from the thought's source type into decisions,
observations or preferences, and drafts held separately until
promotion |
Lexical substring AND: the query is lowercased and split on whitespace, and a record is kept only when every token is a substring of its content, id, source type, agent id, project, branch and tags joined. No ranking, stemming, phrase search or vectors. The visibility predicate is applied before the scope filter and the query match | save_thought refuses obvious secrets and writes a draft
stamped with the process's agent id. propose_truth runs a
trust gate whose verdict sets approved, rejected or error, or leaves the
thought proposed when there is no gate result, then commits through a
transaction that journals the prior text and refuses if the record
changed since review |
No edit after a terminal state: approved, rejected and tombstoned records are content-frozen, as is any record with a supersession backlink, so a correction is a new record. Approving a replacement stamps the predecessor in the same transaction, and refuses when the predecessor is ambiguous or already has an approved replacement | A scope path plus an agent identity taken from the server process's
environment. The default governed view returns approved records only; an
authoring view returns the configured agent's own drafts; an
operator-only history view selects lifecycle statuses and may include
superseded records. A supplied agent_id argument filters
and never grants |
An MCP server with its tools classified as read-only, destructive and open-world; a hook pipeline over seven lifecycle events; an HTTP runtime, a reader UI and a CLI; three optional paper-derived protocol packages installed by command | None on the memory itself. Sync is an explicit fetch-and-rebase that restores the pre-sync state on conflict, and an interrupted write is recovered from its journal on the next entry rather than by a sweep | A six-value lifecycle status of which one is visible by default, a bounded confidence float the read path never consults, and an approval block naming the reviewer, the verdict, the reasoning and whether the approval was a model's advisory verdict or a person's | A read scope whose identity comes from the process rather than the request, stated in one line of the module that implements it; a mode that raises rather than narrowing when the caller lacks authority; supersession that retires a record only on an approved successor, so a draft correction cannot blank the current answer; content frozen at every terminal status; an approval compared against the exact text the reviewer saw; and a retrieval baseline document that states the matcher's predicate and says outright that it is not a product claim | The default reviewer is an LLM one-shot and nothing requires a human
pass, so a trail can be entirely model-approved \u2014 correctly
labelled and still the default; a shared MCP endpoint is one identity
boundary, which the project states twice and does not enforce at
deployment; confidence is stored and never read; the
version-control history is the only mutation record, which is provenance
rather than an audit log by this atlas's definition; and the published
PyPI release is a version behind the governed-read model described
here |
feltstate |
A 5W1H record — who/what/why/when/where plus intensity, confidence, recalls and a reinforce count — optionally sealed with a birth fingerprint carrying its source pointers and the affect present at the moment it was written | Line-delimited JSON, no database: canon.jsonl for
confirmed facts, canon.pending.jsonl for the grey zone, an
archived sidecar, plus a hash-linked ledger and a snapshot set |
Three legs — substring search, scored
recall, and reach, which collides query words
with the keys written at birth, walks judged edges, and lets event time
decide, with no semantic index and no invalidation flag behind it. All
filtered to active entries and to a region, ranked by a
salience recomputed on every read |
Explicit tools only — the agent calls add,
ask, correct, retract; nothing is
injected into a prompt by the store itself, and a distilled summary is
gated against its sources by a zero-LLM consistency check before it
commits |
Four distinct exits: decay past a floor (invisible, still on disk),
correct (old version superseded), retract
(marked, kept for audit), and a real death — gc computes a
plan, reaper writes a fsynced legal_death
tombstone before removing the rows from the live stores and from every
snapshot |
None. region partitions facts from skills and
actor is an optional filter; there is no user, tenant or
session key anywhere in the store |
A Python library the agent calls; affect is appraised by a component the reply model cannot author, and state is returned as context rather than as behavioural instruction | An off-path dreaming pass that recombines affect-tagged material without logic and leaves only a mood residue, plus a sleep pass and a caller-scheduled crystallisation ladder that fuses day crystals up through week, month and year; the lifecycle itself runs on explicit tools with no hidden rewrite daemon | A grey zone promoted by explicit confirmation,
_retracted and _superseded_by as separate
fields, and a confidence float kept distinct from all of
them |
A tamper-evident ledger whose fail-safe direction is right — deleting a tombstone makes the next patrol alarm rather than go quiet; deletion that reaches snapshots under a crash-safe transaction; a validity window with a real as-of read; and negative tests that include the rare corrected-value case | A retracted or superseded entry is ignored when matching, so re-asserting the same value yields a fresh active fact — the store records that a value was withdrawn and never consults that record on the next write; and there is no scope key of any kind |
fernme |
A namespaced tag edge per site and user (weight 0 to 9, confidence, source state, stated or inferred provenance, salience, fast lane, reinforcement history), beside a raw event Cabinet, pinned key=value settings and opt-in typed entities | SQLite at ~/.fernme/fernme.db by default, or PostgresStore with the same interface; managed documents and photos as files in a vault beside the database | Spreading activation from the user's edges and the call's context over a per-site association graph, scored with population-prior idf and read-time decay, compiled to the top 8 tags; Cabinet search by SQL LIKE over event payloads | Synchronous and model-free: sanitize tags, map, canonicalize, Hebbian bump of user and co-occurrence edges, append event, append audit, one transaction. propose_tags queues a pending candidate instead | edit_memory pins an override edge; forget_me deletes the user's rows; consent withdrawal purges; opt-in curation supersedes a displaced value; a rejected suggestion keeps its row under a content-hash id | site and user columns on every row with SQL predicates; an optional FERNME_SITE and FERNME_USER lock on the MCP tools, and token-bound profiles for remote agents. The card's cold start reads a site-wide population prior | MCP server (20 core tools, 11 more for documents and photos) packaged as Claude Code and Codex plugins; a REST API and React graph UI; a Python library | None scheduled. decay and forget_everywhere are library calls with no caller in the package; the population prior refreshes on a REST call or an erasure | Edge source states with superseded kept off the card under curation; pending, accepted and rejected suggestions; an inferred value never silently displaces a stated one | Zero model calls to write; a bounded card; content-hash suggestion ids that keep a rejection rejected; a k-anonymous, Laplace-noised prior with sensitive namespaces excluded; a content-free audit chain that survives erasure; README benchmark rows recompute from committed per-seed results | The local MCP surface registers the accept verb beside propose_tags; remember and recall_card default ts and now to 0, which switches off decay and latest-value-wins; observe raises a hand-edited override; the tag sanitizer drops any tag containing prompt or override |
fidelis |
An original passage stored verbatim, with a payload carrying the scope key, a system-clock recorded_at, a content hash and, when declared, valid_from, valid_to, event_at, source and the ids it supersedes | Local Chroma under ~/.cogito, a rebuildable SQLite sidecar indexing content hashes and supersession edges, and a JSONL queue with a dead-letter directory for writes that could not reach the embedder | Vector search by default over MCP; BM25 plus nomic dense with RRF fusion on the hybrid path; a deterministic planner on the orient path that can decline to search; every lane with a temporal view annotates status, puts current records first and pulls a superseding record into view when the pool holds it | Verbatim store behind a deterministic write gate that refuses harness exhaust, probe residue and secret-shaped text; exact duplicates of a current record are reported rather than stored; a failed write is queued and re-gated on replay | Correction by a new record declaring which ids it supersedes, checked to exist for the same user; the superseded record stays and is demoted, never removed. No delete exists on the fact store; a session purge is written and no entry point reaches it | One user_id per server process, read from config, stamped on every write and applied on every reachable read, including both id-addressed fetches; session rows are stamped with a constant and read by an unreachable function that ignores the key | MCP for Claude Code, Codex, Cursor, Copilot CLI, Gemini CLI and OpenClaw with six tools, a Claude plugin, an opt-in Pi prompt-time recall extension, a CLI, a launchd or systemd service, Docker | A watcher over a notes directory, a replay job over the write queue, and a sidecar reconcile at boot | A read-time status of current, superseded, expired or not_yet_valid, used to order results and never to exclude them; an operator-authored pointers file that annotates retracted claims; a calibrated hedge string in the QA scaffold | Corrections that keep their history: the superseded record is returned marked, the replacement is pulled into view from the same relevance pool, and an as-of query sees the store before a later correction existed. Benchmark reporting that states which metric it measured, declines the flattering comparison, and tells a reader the redesigned default path does not inherit the historical headline | No status ever withholds a record, so a superseded or expired passage reaches the reader whenever the caller ignores the mark; the Pi prompt-time assembler reads /recall_b, which carries no temporal status, and says so in the header it injects; the agent holding fidelis_correct can supersede any record of its namespace, with force=true past an existing correction; the specification seventeen files cite is not in the tree; the end-to-end QA figure is read and graded by the same model |
fireweed-mcp |
A claim node — normalized claim text, resolved entity refs, a domain set, a five-value memory state, a reinforcement layer, a transaction and event timestamp pair, and a provenance record carrying the evidence span | A single JSON snapshot at
~/.fireweed/mcp/substrate.json rewritten after every
mutation, a SQLite append-only event ledger beside it with node content
encrypted per subject, source documents as text files, and signing keys
in a separate directory outside the store |
Deterministic graph traversal over entity and relation indexes with lexical predicate matching, an optional pinned sentence-transformer for paraphrases, and an admission gate in front that abstains when the question's subject or predicate is ungrounded | The agent supplies both the claim and the verbatim evidence; four pure functions check subject, relation order, numerals and predicate before anything is stored. No model runs in this server | Revision supersedes rather than overwrites, stamping
valid_to and superseded_by;
forget computes an exact transitive closure, destroys the
subject's content key, redacts the source documents through a Merkle
binding that leaves bystanders' receipts verifying, runs a probe battery
and issues a signed certificate that states its own scope |
None. No tenant, user, workspace or project key anywhere on the read
path; source_id names a document for receipt binding, not
an audience |
A stdlib-only MCP server over JSON-RPC on stdio, seven tools, no SDK and no dependencies; an open substrate format with a published spec and a stdlib-only reference reader | None in the server. The engine carries a consolidator and a two-clock scheduler, neither of which the MCP process starts | A five-state memory_state beside a separate confidence
float, a four-verdict write firewall whose refusals are typed and
returned to the caller, and a signer that carries an
adversary_checkable flag so the certificate reports what
its own signature is worth |
The write gate is deterministic code on the far side of an RPC boundary; receipts bind claims to byte ranges a stdlib-only reader can re-verify with no engine import; a Merkle binding lets a redaction remove one subject's text while every other party's inclusion proof still verifies; and the tests carry real negative controls on the receipt instrument and on the erasure record | The default zero-dependency install hand-rolls an unauthenticated
HMAC-keystream cipher in the same release whose signing module refuses
to hand-roll Ed25519 on principle; there is no scope key anywhere, so
this is a single-tenant store; and quarantined and
frozen are declared states with no writer |
flair |
A memory row with content, an owning agent, a durability class, a visibility, an archived flag, an optional supersedes link and validity window, an embedding and usage counts — beside an agent identity and a soul of personality, values and procedures | Harper over its RocksDB binding, installed and supervised by the CLI, with a BM25 index beside the HNSW vector index | Hybrid semantic and lexical, excluding archived, expired and superseded rows by default, with the displayed percentage documented as similarity and not as a probability of being the right answer | memory_store over MCP, flair memory add,
the client package or the feed; credential-shaped text is redacted on
write, and a server-side conservative-duplicate gate computes a signal
and never suppresses the write |
In-place update by default, or a supersedes-linked successor that closes the predecessor's validity; archive and restore as a flag; owner delete; operator-only physical purge recording a deletion row for durable memories | One read-scope resolver on every memory read path, binding the authenticated agent as the owner key; open within the instance for everything not marked private | A stdio MCP adapter written into each detected client, a built-in OAuth MCP endpoint off by default, an HTTP API, and thirteen packages including runtime bridges | Federation sync, presence, nightly distillation into candidates and their promotion, reflection, maintenance archiving of expired rows, and an out-of-store watcher for lost durable rows | Ed25519 per-agent keys for external identity, a server-attested provenance status surfaced on recall and barred from every decision, and a recorded justification required before an auto-promoted memory is shared | The comments record what went wrong and what the code guarantees.
The read-scope module exists because the rule used to be scattered:
SemanticSearch had "its OWN inline grant-resolution + a
visibility === \"office\" global OR-clause that leaked ANY
authenticated agent's read of ANY other agent's memories" — so there is
one helper, composed from a record-type registry, with a test that trips
on drift. The migration invariant is argued rather than asserted:
not_equal 'private' is chosen over
equals 'shared' because the latter would "silently
retroactively privatize every legacy row". The dedup gate is labelled
NEVER SUPPRESSES A WRITE after an earlier gate silently dropped the
second of two distinct findings. The feed and by-id fixes each ship a
test that compares the path against the ordinary by-id read rather than
restating the rule. And the README says the match percentage "is not a
probability that the memory answers your question correctly" |
Within one instance every verified agent reads every other agent's
non-private memory, deliberately, and grants gate no read;
private is the only owner-only exception and the federation
push filter the only hard boundary. Only the Fabric branch of
flair init provisions the least-privilege
flair-agent Harper user, so on a local install a verified
non-admin agent runs as the Harper super user and the resource-level
checks are the whole boundary; the memory feed was readable unfiltered
that way until 30 September 2026. The owning agent can promote its own
continuity candidate naming itself as reviewer. The Ed25519 key proves
the caller and signs nothing a memory says, and attribution
on a usage row is "nothing more than a label". Deletion history covers
durable memories only and the purge path removes its own rows, and
in-place update is the default edit |
flatbread |
A typed Markdown record with YAML frontmatter in one of eight kinds: Effort, Issue, Finding, Decision, Constraint, Risk, Citation, Blob. Every record but an Effort belongs to one Effort, and typed edges such as derives_from, supersedes and invalidates link records inside it | One Markdown file per record under eight directories of a graph root, default .flatbread-proof, tracked in Git with the code; a gitignored write journal holding before and after images and a generation counter; a gitignored cache of rendered read digests | Five CLI reads through the Flatbread GraphQL engine: list Efforts by status, records of one Effort filtered by kind, state, status and created_at, one-hop relations, proposed Decisions deriving from open blocker Issues, and get by id with optional walk to the supersession head. No text or vector search; oldest first, 25 records per page | Explicit: the agent passes one of 17 typed JSON mutations to flatbread proof write. Zod validates it, a planner checks kinds, Effort boundaries and lifecycle rules, and a journal commits every touched file under a writer lock. A skill gate asks the agent to write only 4/4 durable reasons; the CLI does not enforce it | Lifecycle mutations move Decisions, Issues, Risks and Efforts through fixed transitions; Supersede and Invalidate add edges with materialized reverse links; Retract flags a record, strips its id from other records' relations and drops it from browse reads while keeping the file. No delete verb; bodies are hand-editable outside the journal | The Effort id on every record, enforced by the writer on every edge and applied by the records, relations and blocking-decisions reads; get by id, Effort discovery and the GraphQL endpoint span Efforts. One graph root per repository, shared through Git branches | A packaged Agent Skill installed by flatbread proof install-skill, plus two companion skills; the agent shells out to the flatbread CLI, which prints one JSON envelope per command and a Markdown digest path. No MCP server and no hooks; an optional 3D explorer and GraphQL endpoint from flatbread start | None. Journal recovery runs on the next write or live-server start; the live server reindexes after each committed generation; digest pruning runs only when the agent calls proof cache prune | Decision state proposed, accepted, rejected or superseded, with acceptance rejecting proposed siblings on the same question Issue and a reopen_history kept on revival; the state is displayed and counted, and no read filters on it. Findings carry no state; invalidation is an edge. The retracted flag is the one property a read excludes on | A typed record model that keeps reasons, evidence and alternatives as linked files reviewed in pull requests; Effort boundaries enforced at write and failed closed at read; a crash-safe multi-file journal with read-your-writes tokens; bounded, paged digests that report when they are incomplete | The agent accepts and rejects its own Decisions; an invalidated Decision reads as accepted; Retract strips the retracted id from dependents' derives_from, so provenance silently shortens; oldest-first paging puts the newest records of a large Effort on the last page; get, the GraphQL endpoint and the explorer return retracted records |
flowix |
A memo — a Markdown file with frontmatter whose identity is
flowix_key, an eight-character [0-9a-z] id
back-compatible with an older six-character form, plus a title, tags,
created_at and updated_at |
Markdown files in notebook directories, with a SQLite notebook
registry at ~/.flowix/index.db and a per-notebook
.flowix/ holding versions and derived state |
An in-memory inverted index, never written to disk, over a bigram tokenizer that handles ASCII words and CJK; scored by title, tag and body-frequency hits and verified against the raw body before a hit is returned | Twelve MCP actions — notebooks, list, tags, show, search, create, edit, write, delete, and three artifact operations — alongside the desktop app and CLI, every file write taking a cross-process lock | Editing a memo auto-versions it at most hourly, keeping twenty versions with a content hash each; deleting it removes the file and its version history together, which a committed test asserts | Notebooks are directories in a SQLite registry, and a search takes an optional notebook filter — with none supplied, the search spans every registered notebook | An MCP server registered into DeepSeek Harness by a bundle that
proxies to a local flowix-cli over stdio, plus a desktop
app, a web build and a plugin runtime |
Index rebuilds on notebook switch, version pruning against a twenty-version cap, and an orphan-version sweep that retains unknown version directories for thirty days | None. A memo has no status, confidence or review state; the only lifecycle is the version history, and it is deleted with the memo | A search that knows its own failure mode — the bigram index can match two overlapping tokens without the substring being present, so every candidate is re-checked against the raw body before it is returned; version cleanup written so that a missing index row cannot destroy recoverable history; and a module docstring that states the index's staleness limit rather than leaving it to be discovered | The atlas awards no mark here and the reason is the shape of the
product rather than a defect: there is no status a memo can hold,
nothing records what happened to one, and deletion is complete. The
in-memory index tracks only the app's own write commands, so editing a
.md in an external editor leaves search stale until a
notebook switch rebuilds it; and the one test written as a negative
control asserts an empty result over a one-memo fixture, so it would
pass against a search that returned nothing |
flowly |
A governance item (kind, text, status, confidence, privacy level, normalized key, source session) wrapping a free-form MEMORY.md note, a knowledge-graph triple, an Obsidian note or inline text | Three SQLite files in the profile data directory (governance store, temporal knowledge graph, FTS and embedding index) plus workspace MEMORY.md and dated daily notes | MEMORY.md and a 20-entity graph summary injected into every system prompt; memory_recall returns active items by confidence; memory_search runs BM25 plus brute-force cosine over memory markdown; knowledge_graph query with as_of | Agent tools memory_append and knowledge_graph, mirrored into governance by a post_tool_call hook; a background dreamer extracting from session transcripts; ChatGPT and Gemini dump import; Obsidian ingest; self-review subagent; pre-compaction flush | Status transitions only, never a delete: supersede on a same subject-predicate fact, LLM-proposed merge, supersede and stale ops, user reject, correct and undo. Superseding a fact closes its KG triple; rejecting one does not | Physical: one data directory per profile. No scope key on an item and no predicate on a read; privacy_level secret is always excluded from recall and the generated block, sensitive only on request | In-process tools in the Flowly agent loop across the TUI and messaging channels; flowly memory CLI; TUI review panel; desktop feature RPC; MCP server mode exposes the agent, not the governance verbs | Dreamer on idle (30 minutes), daily (03:30) and every 10 user turns; LLM consolidation every 50 turns or 30 minutes when dirty; self-review subagent; MEMORY.md regenerated once at turn end | Six-state status machine with an enforced transition table; calibrated confidence for dreamer candidates, fixed 0.85 and 0.90 for live writes; injection scan fails closed to review; feedback nudges confidence and demotes below 0.55 | The LLM only proposes consolidation ops and a validator applies them; enforced transition table with an audit row per move; imported and vault memories cannot self-activate; secret items never reach the prompt; dreamer watermark held on extraction failure; undo that reopens a closed triple | Live writes land in MEMORY.md and the graph before governance, so review and reject do not withhold them; reject never closes the KG triple; subagent writes carry an empty session id and bypass the automation gate; a rejected value is re-extracted as a fresh candidate; correct and confidence changes are unaudited |
fluctlightdb |
An engram: one Episode (content, context, optional outcome, optional agent_id and tenant_id, optional provenance kind with a verified flag and confidence) plus its neuron sets and salience | A brain directory of serialized segments in numbered generations, default format v4, or a single .flct file; a SQLite FTS5 sidecar for the hybrid candidate index; the HTTP server keeps one brain per tenant | activate_scoped: FTS5 and vector candidates, spreading activation over a synapse graph, then score boosts for verified provenance, cortex tokens, CA3 completion, neuromodulators and prefrontal goals; a balance-cue override and an exact-query lane inject verified engrams at the top afterwards | Explicit: experience, wm_push then turn_end, observe_tool, ingest-chunk, or the MCP remember tools. Provenance and the verified flag are supplied by the caller; an embryonic-stage gate and a separation gate can refuse a write | reconsolidate overwrites content in place and multiplies the salience of engrams matching the new text by 0.45; forget_engram and delete_by_subject remove rows; retention prunes low-salience and aged unverified engrams; automatic compaction merges near-duplicates and discards the absorbed episode. No tombstone | Physical: one brain directory per agent or project, one brain per tenant behind the server. Inside a brain, an optional agent_id is filtered after ranking and truncation on activate_scoped only; the agent-facing recall passes none | Python SDK over a PyO3 native module, an MCP server with remember, recall, resolve, consolidate and observe_tool plus project and handoff tools, a Cursor sessionStart hook template, an HTTP API with keyed roles, LangChain and LlamaIndex adapters | Idle auto-consolidation on tick: working-memory flush, sleep replay, retention prune; compaction every few sleeps and under synapse pressure on the write path | Five provenance kinds and a verified boolean, both caller-set, used as ranking weight, retention exemption and an exact-query injection lane. Unverified numeric-looking recalls get a trust_note string. No state withholds a memory | A large, legible test suite with fault injection, crash recovery and chaos runs; committed benchmark JSON that recomputes; an honest correction of its own LoCoMo headline; a two-lane separation between verified and chat provenance that is explicit in the data model | The agent_id filter runs after truncation and before two lanes that inject engrams from the whole brain; the v4 checkpoint never writes the agent and governance segments its loader reads, so the audit log and retention clocks do not survive a reopen; verified is whatever the writer says; compaction merges across agents and provenance |
forgetful |
A row in memories — title (≤200 chars), content
(≤2,000), context (≤500), up to ten keywords and ten tags, importance
1–10 defaulting to 7, nine nullable provenance columns
(source_repo, source_files,
source_url, confidence,
encoding_agent, encoding_version,
agent_id, agent_version,
agent_model), is_obsolete,
obsolete_reason, superseded_by,
obsoleted_at, access_count,
last_accessed_at; its 384-dimension embedding sits in a
vector column on Postgres and in a vec0
virtual table on SQLite; beside it entities, projects, documents, code
artifacts, files, skills, plans and tasks, of which only memories and
skills are embedded |
SQLite through SQLAlchemy async with the sqlite-vec extension loaded
per connection and vec_memories/vec_skills
virtual tables outside Alembic, at a platformdirs data path by default;
or Postgres 16 with pgvector, an HNSW cosine index on
memories.embedding and GIN indexes on the tag and keyword
arrays; Alembic migrations run at startup on both |
Dense only — embed the query alone with FastEmbed
BAAI/bge-small-en-v1.5, take the twenty nearest
non-obsolete rows for the user (importance floor and project
EXISTS applied in SQL), then when reranking is on and more
than k came back score "query: q, context: c" against each
row's rendered text with the Xenova/ms-marco-MiniLM-L-12-v2
cross-encoder and keep k; walk one hop through memory_links
ordered by importance; re-sort by importance and cut at 8,000 tiktoken
tokens and twenty rows; no lexical arm and no fusion exist despite the
docstring |
Agent-authored through create_memory, synchronous in
the request: provenance defaults from the environment, one embedding of
title+content+context+keywords+tags, insert, then
find_similar_memories returns the
MEMORY_NUM_AUTO_LINK (3) nearest non-obsolete rows with no
distance floor and create_links_batch links them; no
extraction, no dedupe, no LLM anywhere in the server;
update_memory is PATCH, re-embeds when a search field
changed and never revisits links |
mark_memory_obsolete sets is_obsolete, a
required reason, an optional superseded_by and
obsoleted_at; the row stays, get_memory by id
still returns it, every search and walk excludes it, and nothing in the
tree clears the flag; the REST DELETE /api/v1/memories/{id}
is the same soft delete; no code path hard-deletes a memory row, only a
user cascade; documents, entities, skills and artifacts are
hard-deleted |
Per user by user_id on every query — the single default
user when no auth provider is configured, otherwise the token's
sub provisioned on first sight; per project by association,
as a filter the caller opts into; a Postgres session sets
app.current_user_id for row-level security that no policy
in the tree reads |
Three MCP tools — discover_forgetful_tools,
how_to_use_forgetful_tool,
execute_forgetful_tool — over a registry of 152 named
tools, with docstrings built at registration from the feature flags; the
same registry behind a REST API under /api/v1, an SSE
activity stream and a forgetful CLI with local and remote
modes; ten SKILL.md files and per-client command packs tell the agent
when to query before creating and to confirm with the user before an
update or obsolete |
None in the server — the event bus dispatches audit and access-count
handlers as fire-and-forget tasks inside the request;
--re-embed is a manual full rebuild with a file-copy or
pg_dump backup and restore on failure, and
rebuild_embeddings is a user-scoped targeted rebuild that
re-adds auto-links |
Provenance columns the caller fills, with environment defaults an
operator can force with ENFORCE_ENV_OVERWRITE; a
confidence float nothing reads on the read path; a boolean
obsolete flag and no candidate state; every activity row has actor
user, the system and
llm-maintenance actors having no producer; tool-level OAuth
scopes intersected with an instance ceiling |
A meta-tool surface that keeps 152 tools out of the context window; a write path that costs one local embedding and never blocks on a model; obsolete rows kept out of the auto-link candidate set as well as out of search; a 1,454-function suite of which the SQLite end-to-end half runs the real embedder and reranker in-process with no service to start; an environment-enforced provenance stamp for shared instances; a soft delete whose reason is mandatory | The retrieval the README, both docstrings and the recall skill
describe — sparse leg, reciprocal-rank fusion, a 0.7 auto-link
threshold, query and context embedded together — is not the retrieval in
the tree; auto-link attaches the three nearest rows however far away, so
a small store becomes a clique and links are never re-evaluated on
update; the cross-encoder's order is discarded by an importance re-sort
before the budget cut; the audit log is off by default and
fire-and-forget when on; the SQLite get_recent_memories
loads every row for the user and paginates in Python; the
row-level-security session variable is set and never read |
funes |
An immutable, timestamped chunk of a transcript turn, carrying its session id and turn uuid as provenance and the agent it came from; never overwritten and never updated | A Lance dataset on disk holding the raw passages and their
embeddings, optionally synced to a Hugging Face Hub repository the user
owns, where recall reads immutable files over hf:// into a
commit-pinned local cache |
Local embeddings and a local cross-encoder reranker over the chunks, with recency weighting, spanning every indexed agent and naming which one each hit came from | Deterministic indexing — parse, chunk, embed — with no model in the ingest path, so the same transcript always indexes the same way and every hit traces to a real line of a real transcript | Nothing is overwritten. A changed fact leaves the old passage in
place and adds a newer one, and obsolescence is resolved at read time by
recency and by the reader. funes scrub exists for one
purpose — removing a secret — and rewrites the affected block by
deleting its chunk ids and appending the redacted text at the same
coordinates |
A memory is a dataset you own, gated by your Hub token; there is no in-store scope predicate because there is one memory per owner | A CLI, hooks that index in the background, and integrations that let Claude Code, Codex, pi and Hermes recall from one memory | Hooks that index sessions as they end and push in the background,
with funes status scanning pending rows the same way a push
would |
None, deliberately. Every passage stays and the reader judges; the design document argues that a write-time supersession decision loses information silently when it is wrong | A design document that argues for what it declines rather than listing what it has; deterministic ingest with no model between the transcript and the index; a publication gate that is fail-closed, reconstructs blocks before scanning so a secret split across chunks cannot evade it, and holds back every chunk of an offending block; and a statement that the reader is a separate trust boundary | Index-time redaction is best-effort and silently absent without the scanner beyond a printed warning, so a local memory can hold credentials; obsolescence is entirely the reader's problem, which is a position rather than an oversight but leaves a wrong passage indefinitely recallable; and every dependency manifest changed on the day of this reading |
fx |
A string. ~/.fx/memories.json is a JSON array of them,
and a memory has no id, no timestamp, no source and no structure beyond
its own text |
One file in the user's home directory, written atomically with a truncate-and-rewrite fallback; the session layer beside it is a separate event log under its own directory | None. list returns the entire store as a bulleted list
— no query argument, no ranking, no limit |
save loads the file, compares the new fact
byte-for-byte against every existing one, appends if no match, and
rewrites the whole array |
clear deletes the file. There is no per-fact removal
and no edit, so correcting one wrong memory means discarding all of them
and re-saving the rest |
None. One file under $HOME shared by every workspace,
despite fx being a per-project coding agent |
A registered builtin tool alongside filesystem, shell, terminal,
skills and web tools, with no permission gate and clear
declared irreversible to the harness |
None over memory. The session log has its own compaction that replaces prior frames with a snapshot | No epistemic state. A memory is a string that is present or absent | A write policy stated where the model will read it — the tool description rules out task notes, secrets, project facts and anything the user did not ask to persist | At the first reading every read failure returned an empty list and
the next save wrote a one-element array over the file;
fixed to fail closed on 21 August 2026, and the tool was removed on 31
August |
gaius |
A fact with a topic domain, a key, text, first and last seen times, a confirmation count, the agents, sessions, principals and model families that produced it, a provenance label, a score, an outcome, a six-value review state, a fact type and a tombstone column | One SQLite file with an optional sqlite-vec table and an entity-triple graph beside the facts, fully offline — "[n]o API keys, no cloud" | BM25 and TF-IDF computed in Python, blended with optional sqlite-vec cosine, over facts neither tombstoned nor rejected; pending, deferred and agent-reviewed facts rank at 0.6x. The domain filter is optional and the session hook passes none | Mined from Claude Code, Grok, Codex, Ollama and PentAGI sessions straight into the corpus with no person in the path; Gemini harvests stage until promoted at the CLI; an MCP tool writes a fact directly | Duplicates sharing a fact key merge into the oldest row with counts summed and provenance unioned, the losers tombstoned; an opt-in TTL tombstones stale live facts; the audit pass only demotes; no path deletes a fact row | None enforced. The domain is a topic label that deduplication ignores; inject and search take it as an optional argument and the session hook passes none | A CLI, an MCP server of seven tools including one that writes a fact, and a Claude Code plugin whose hooks inject at session start and, when enabled, per prompt | Retire, harvest and ingest passes that extract and promote, a decay pass that rescores and can tombstone stale live facts, and a corpus audit that demotes when enforcement is switched on | A six-value review state, an outcome a person's reject sets to rejected, a heuristic confidence and contradiction flag at write time, provenance arrays unioned across agents and sessions, and an environment and tty check on the verbs that write a human verdict | Two bounded mechanisms. The enforcement pass states its limits before its purpose: "DEMOTE-ONLY — never tombstones, never DELETEs", touching "ONLY review_state" so the field recording why a fact was believed survives, and reversible because "an operator flips review_state back to 'auto' to undo". Withholding and demotion are separate: a person's reject removes a fact from every retrieval read and keeps the row, while pending, deferred and agent-reviewed facts stay retrievable at 0.6x. The merge of duplicates keeps the oldest row, sums confirmation counts and unions agents, sessions, principals and model families, so the evidence that several runs agreed survives the merge. The verbs that write a human verdict refuse four agent environment variables and a non-tty, and a test pins both refusals | Rejection is keyed on a row. Session-mined facts take a key from the
session stem and the text, so the same claim mined from a later session
is a new row and injects at full weight; the MCP tool hashes the text
another way again. The withholding predicate reads outcome,
which the Claude shim fills with raw tool output, and the audit pass
treats any non-null outcome as verified, so those facts are never
demoted. The domain is a topic label rather than a scope. The audit's
contradiction tier groups live rows by fact key, which the partial
unique index makes impossible, and its test builds a table without that
index. The README's hard gates that exit 2 on force-push ship as an
example script in the docs; none of the plugin's hooks blocks a tool
call |
gambletan-cortex |
A MemObject: a tier (working, episodic, semantic, procedural, archived), content as text, fact triple, preference, relationship, pattern or event, an optional 384-dim embedding, ingestion and event time, salience with decay, a privacy level, an optional namespace, tags and a content hash | One SQLite file, SQLCipher when keyed, with memories, links, people, channel identities, beliefs, patterns and an FTS5 table; an in-process HNSW index rebuilt from stored embeddings; sync oplogs as JSONL in a cloud folder; the Muse inbox and audit log as files beside the database | Candidates from HNSW cosine, recent rows when no embedding exists, entity expansion over stored fact triples, a temporal-intent list and FTS5 BM25, capped at 10,000 or 250 ms; namespace and archived tier filtered per candidate; a weighted sum of seven signals, reweighted by a regex-detected query type | Explicit memory_ingest or batch ingest. Each write is embedded with all-MiniLM-L6-v2 and run through regex extraction that may add facts and preferences as separate semantic rows, superseding a fact with the same subject and predicate. Synchronous and model-free by default; exact duplicates by content hash are dropped across namespaces | memory_delete is a hard delete that also removes Muse export copies; archive moves a row to a tier retrieval skips; a superseded fact keeps its row at 0.3 times its salience behind a supersedes link nothing reads. Derived facts carry no link to their source and survive its deletion | An optional caller-supplied namespace per row, filtered on memory_search and partly on memory_context; beliefs, patterns and people are global; privacy levels gate sync, not reads; Cortex Cloud gives each tenant its own encrypted database directory | A stdio MCP server with 30 built-in tools plus six muse_ tools and an optional deny-by-default capability file; an unauthenticated REST server with a dashboard; Python and WASM bindings; an OpenClaw plugin that injects memory_context before each turn and ingests each user message after it | Consolidation (decay, promotion of repeated episodes, archival below 0.05 salience) every 100 ingests in-process or on the memory_consolidate tool; compression on demand replaces a day's episodes per channel with one summary; optional sync pull every 30 seconds plus a file watcher | Floats only: salience, fact confidence and Bayesian belief probability. A 0.3 floor drops low-confidence facts from injected context; no status withholds a memory from search | A disclosure gateway for a third-party agent that reads only an explicit export, caps and audits every response, and quarantines that agent's writes for approval; end-to-end tests asserting what must not leak; encrypted sync with per-memory opt-in | Namespace is a filter on one read path, not a key on facts, beliefs, dedup or compression; extracted facts all have subject User and supersede each other across users; recall never refreshes access, so ordinary episodes are archived about 20 days after ingest; the REST server has no auth and allows any CORS origin |
gastown |
One string under a key of the form memory.TYPE.SLUG, TYPE one of feedback, user, project, reference, general. No author, timestamp, source or status on the row | A row in the config table of beads' Dolt database, key prefixed kv. by bd. One Dolt SQL server per town, one database per rig plus hq for the town | None by relevance. gt prime lists every memory row in the database the working directory resolves to and prints them all, grouped by type with feedback first; gt memories filters by substring | Explicit: an agent or a person runs gt remember, which shells out to bd kv set. The key is a caller slug or the first five words of the text, and an existing key is overwritten. Against bd v1.1.0 or later the call is rejected, because those releases reserve the memory. key prefix | Overwrite in place under the same key; gt forget runs bd kv clear, a hard delete. No tombstone, no revision kept in the store; the JSONL backup's git history retains deleted text | Physical: the Dolt database a process's working directory resolves to through .beads/redirect, so the town and each rig hold separate memory sets. No scope key on the row and no predicate on the read | SessionStart hook runs gt prime --hook for Claude Code, Gemini, Codex, OpenCode and others; the town-root CLAUDE.md and the mayor role template tell agents to use gt remember instead of Claude Code's auto-memory | None for memory. A JSONL backup exports the config table every 15 minutes and pushes it to git; a compactor flattens Dolt history once it passes 2,000 commits | None. The feedback type is printed under a header asserting user origin, and any agent that can run gt remember chooses the type | Small and legible; type order puts corrections first in the injected block; one env policy strips inherited database selectors on the read path; the sandbox allowlist, derived from a per-command annotation, keeps memory writes off the sandboxed polecat path by default | gt remember and gt forget fail against every bd release from v1.1.0, which gt installs as latest; an auto-key collision on the first five words overwrites a different memory; the compaction fast path re-injects nothing; the working directory, not the caller, chooses the destination while the mayor prompt promises town-wide sharing; a read failure is silent; injection is unbounded |
gbrain |
Two units over one page graph — a facts row of hot
memory (one claim with a kind of event, preference, commitment, belief,
fact or idea, an entity, a confidence that decays by kind, a visibility
of private or world, a validity window, a session and a provenance
string) and a takes row of graded knowledge (a claim typed
fact, take, bet or hunch with a holder, a weight and, for bets, a
resolution); a proposal sits between them |
Postgres or PGLite with pgvector behind two engine implementations; markdown pages on disk whose facts and takes fences are canonical, so a forget or a supersede is a fence rewrite the database reconstructs on rebuild; row-level security on Postgres | Hybrid search over pages with lexical, vector and typed graph
traversal into cited synthesis with a gap statement; recall
over active facts by entity, session or time with kind half-lives
applied to confidence; a _meta.brain_hot_memory injection
of the top ten facts into MCP tool responses, cached thirty seconds per
session; semantic search over embedded takes |
remember with a required provenance, or an opt-in
ambient writeback whose Stop-hook backstop runs a zero-LLM salience gate
before a Haiku extractor; every write passes an entity-scoped duplicate
search, a cosine 0.95 fast path, an LLM classifier of duplicate,
supersede or independent and a 0.92 fallback; the cycle's propose_takes
extracts claims from pages into a queue a person drains, and consolidate
promotes clusters of three or more facts older than a day into
takes |
A fact is superseded — the old row gets expired_at and
superseded_by, both stay — or forgotten by striking its
fence row and setting valid_until; a take is superseded
with a strikethrough and superseded_by; a bet's resolution
is immutable; a source soft-deletes with a 72-hour tombstone, an impact
preview and a typed confirmation; a rejected proposal stays rejected and
blocks the same claim from the same page content |
Every read carries the caller's allowedSources;
visibility private hides a fact from remote and MCP
readers; mounted brains are read under a four-rule contract whose rule 4
refuses subagents; Postgres enforces the source at the row |
MCP with three surfaces — seven frozen verbs (remember,
recall, entity, synthesize,
forget, context_pack, delta), a
starter set of about twenty operations, or everything — for Claude Code,
Codex and OpenClaw harnesses; a CLI; cron; an HTTP server; installable
harness instruction blocks whose consent is never automated |
Sixty-plus cycle phases with budget metering — extract, propose takes, grade takes into a verdict cache, calibration profiles with a completion fraction, consolidate, drift, anomaly, synthesis — plus a facts queue that extracts off the write path | A four-value commitment vocabulary on takes and a per-holder Brier profile with bias tags from resolved bets; a pending, accepted, rejected or superseded status on proposals; confidence with kind half-lives on facts; a judge cache the operator must opt into applying, at 0.95; every take resolution records who or what resolved it | Validity read at query time on facts with history preserved; a human gate between extraction and the knowledge table, with a concurrency-safe accept; BrainBench in the tree with sealed gold, a holdout and executable floors; a destructive guard that previews and tombstones; write outcomes typed as inserted, duplicate or superseded | Two validity models — read on facts, stored and never read on takes,
where until_date has no reader and the scorecard's window
compares since_date at both ends; a rejected proposal is
keyed to the page's content hash, so an edited page can re-propose the
same claim; drift_decisions is a table nothing writes; a
903,931-line tree with two engine implementations to keep in parity; the
evaluation numbers that matter are prose in the README and docs rather
than committed run artifacts |
generative-agents |
ConceptNode typed event, thought, or chat with
poignancy |
Per-persona JSON plus in-memory embedding dict | Normalized recency + relevance + importance over a full scan,
hand-tuned gw = [0.5, 3, 2] — and the recency term is
computed over a list sorted oldest-first, so it scores the least
recently accessed node highest |
Perception, conversation, and reflection all write ungated | None; observations are never deleted or overwritten | One persona directory | Simulation only; tightly coupled to Persona |
Reflection fired by accumulated poignancy | Reflections cite supporting nodes, but citations are never used | Consolidation triggered by significance rather than a timer | Derived thoughts share one pool with observations; the decay is positional rather than temporal, and its direction is inverted — the oldest node normalizes to 1.0 and the newest to 0.0 |
genericagent |
Text and Markdown across four layers | global_mem_insight.txt, global_mem.txt,
memory/, L4_raw_sessions/ |
Agent reads a ≤30-line index and opens files by pointer | Only successful tool-call results may be written (by policy) | Layer migration and patching; "better not to modify at all" | One global tree | Internal to the framework | 12-hour L4 archive cron | Verification is a stated precondition, but no record is kept | "No Execution, No Memory" plus an ROI test for permanent context | Every axiom is prose with no enforcement or audit |
genome |
A MemoryRecord — content, a float32 embedding,
user_id/agent_id,
created_at/accessed_at/access_count,
parents and an operator tag, plus a metadata
bag. Entities and entity facts are memory records too, tagged by
operator, so they inherit scope, cascade delete and search |
SQLite by default, Postgres behind the same interface; embeddings stored as blobs and compared by exact cosine over the scope's rows, with no ANN index to build or maintain | Exact cosine over the tenant's rows, an optional BM25 hybrid arm and
an optional local cross-encoder rerank; separately
facts_valid_at(entity, T) resolves the fact log as of a
point in time |
Embed locally and store — no model call, no network. Fact extraction, conflict resolution and automatic fact detection are each opt-in and each add an LLM call | delete by id, reset by scope, an MCP
forget that refuses below a min_score cosine
floor and names the best candidate instead, and an opt-in conflict
resolver returning ADD, UPDATE, DELETE or NONE. No tombstone: a deleted
value can be added again, and the journal retains its text |
user_id and agent_id columns applied as
predicates on every read arm — and both optional, so an unscoped call
sees every tenant |
A Python API, a CLI, a FastAPI server that also exposes the trust
firewall over HTTP, a fully local MCP server exposing
remember/recall/forget/reset_memories,
LangChain and LlamaIndex adapters, and a TypeScript SDK with the same
reach |
None required. Auto-consolidation is opt-in and its constructor
carries a measured warning against enabling it; automatic fact detection
runs inline on add when an LLM is configured |
Discrete provenance tiers — system, user, agent, tool, web — that
quarantine below a threshold rather than reweight, plus a per-fact
confidence float used for a detection cutoff |
The write path is deterministic, so the journal can replay the store exactly and the record is auditable in a way an LLM-extraction store cannot be; and the project publishes a feature audit that reports one of its own features as harmful | The journal that makes the store reproducible also makes deletion
reversible — a purged memory's text stays in the log and
replay_journal(until_seq=N) rebuilds it; scope is optional
on every call; and the automatic fact path swallows its own failures at
DEBUG |
gh-aw |
A file the agent wrote in a previous run — JSON, JSONL, Markdown, CSV — with no schema the system imposes or reads | Three file-backed surfaces — a GitHub Actions cache holding a git repo, an orphan git branch, and a managed issue comment materialised as Markdown — plus an experimental FUSE-mounted GitHub Drive that reuses the cache-memory git layout | None. The whole store is mounted as a directory and the agent reads it with its own file tools; a generated prompt section names the path | The agent edits files in place during the run; a post-agent step commits and pushes or upserts, gated by size, count, glob and extension limits and an optional author-supplied validation script | Overwrite in place. Cache memory expires at 7 days and by LRU; repo memory is unbounded and versioned in git; nothing is ever marked wrong | Integrity level (merged/approved/unapproved/none), a constant per compiled workflow, carried as a git branch and as the cache key prefix, plus branch-scoped cache keys and per-id directories; a partition chosen by name, with no level on a file and no predicate on a read | A YAML frontmatter key in a Markdown workflow file that a Go compiler expands into GitHub Actions steps; no MCP tool and no API | Nothing between runs. A scheduled maintenance workflow prunes stale cache entries by key prefix | Memory from a previous run is treated as attacker-controlled: hooks deleted, symlinks deleted, execute bits stripped, disallowed extensions removed, all before the agent can read it | Memory partitioned by the guard policy that produced it, with a read-down merge for stores two levels share, and a read path that assumes its own store is hostile | No retrieval, no correction, no notion of a fact; the whole store is mounted as a directory, the trust label describes the writer rather than the belief, and comment memory is read from every comment on the thread with no author or provenance check |
gini-agent |
memory_units with network, status, confidence,
bi-temporal occurrence |
SQLite (memory_banks, entities,
entity_mentions, memory_links) |
Four channels — semantic, BM25, graph spreading activation, temporal — fused by RRF then reranked | retain.ts; proposed status as a candidate
tier |
A five-value status column of which only archived is
ever written, by an observation-pruning statement;
proposed, rejected and conflicted
are declared and have no producer |
agent_id enforced across every channel and the HTTP
API |
CLI, HTTP, web UI | reflect.ts consolidation,
reinforce.ts |
Per-unit embedding_model, source task and session
ids |
Bi-temporal columns, an agent boundary asserted in both directions by a test that makes the two units identical apart from the key, and decisions kept as ADRs | Three of the five declared statuses have no writer anywhere in the tree, so the conflict and rejection model is a schema rather than a mechanism; no value tombstone |
gitlord |
A turn — system, user, assistant, tool call, tool result or summary — committed as JSON under turns/ on a branch, addressed by commit sha | A bare git repository with a ref per session under refs/agents/, a JSON index file rebuilt from it, and an optional Chroma collection rebuilt from it | Three library read paths: ContextAssembler walks one branch into a message list, TurnQuery filters the JSON index across every session, and VectorIndex queries Chroma; no module in the package calls the first or the third | append_turn and its typed variants commit through a compare-and-swap ref update that rebuilds the commit onto the moved tip on a race; each commit then rebuilds the whole JSON index | No update or delete verb for a turn. rewind adds a ref at an earlier commit; subagent drain and trim delete refs, leaving the commits unreachable until git gc prunes them | A branch per session for context assembly; the JSON index and the vector index hold every session, and session.query() applies no session filter | A Python library, a Typer CLI whose run command commits a user turn and calls no model, an MCP client that supervises external tool servers, and a LiteLLM router with a tool-schema translator | None. Summary turns are a documented library call the package never makes, and the assembler drops the summary together with the turns it covers | None. A turn is what happened; there is no claim, status or confidence anywhere | A durable log that is inspectable and forkable by construction, with both indexes regenerated from it rather than maintained beside it | It stores what was said rather than what is believed; the default subagent cleanup makes subagent history unreachable to git while a trailer still names its sha |
gitmem |
A learning typed scar, win, pattern or anti_pattern, with counter-arguments, applies_when, an action protocol and self-check criteria; decisions, threads and sessions are separate stores | Postgres with pgvector on Supabase from setup.sql, cached locally as one embedding index; or JSON files under a .gitmem directory on the free tier | Cosine similarity times decay_multiplier over one cross-project in-process index of the 500 most recently updated active learnings, with an RPC fallback while the index is cold; BM25 over learnings.json on the free tier; severity and type post-filters | create_learning, refused for a scar without a severity and two counter_arguments; session_close writes scar usage, decisions and threads | archive_learning sets is_active false and returns the reason without storing it; decay_multiplier is rewritten from usage; nothing deletes a learning and nothing is keyed on a rejected value | Project predicate on threads in Postgres, session history and the session_start decision panel; none on any scar read, by design, and none on the free-tier threads.json or the free-tier search over decisions | MCP server with Claude Code hooks on SessionStart, UserPromptSubmit, PreToolUse, PostToolUse and Stop, plus rule templates for Cursor, Copilot and Windsurf | Behavioural decay refreshed at session_start from 90 days of scar usage; an on-disk index cache with per-row delta sync; implicit thread suggestions from session-embedding similarity | severity, is_active, decay_multiplier from dismiss rate, and a repeat_mistake flag that analytics reads and nothing in the package writes | Refute-or-obey confirmation with per-decision evidence rules, refused after a failed recall, behind a PreToolUse gate that hard-blocks consequential commands; dismissals and refutations feed back into ranking | The PreToolUse gate counts confirmations rather than matching them, so after one accepted confirm_scars a later recall's scars do not block; the scar index is cross-project and capped at 500 rows; the dismissal counter cannot exceed one; the free tier evicts the oldest fifth of a collection past 10 MB |
global-agent-memory |
One Markdown note with YAML frontmatter: an immutable mem_ id, title, one of nine types, scope, project, status, visibility, confidence, importance, tags, links, source kind and ref, supersession links | An Obsidian-compatible Vault of Markdown files is canonical, in lifecycle folders; a disposable SQLite database holds FTS5 chunks, sqlite-vec vectors, jobs, projects, access requests and the idempotency cache; audit.jsonl and tombstones.jsonl sit beside it | Keyword FTS5 over 550-token chunks with an AND query relaxed to OR on an empty result, optional Ollama vectors, reciprocal rank fusion, small project, importance, recency and status adjustments; memory_context packs results round-robin by type under a token budget | memory_remember writes a candidate after a secret-pattern check and a duplicate check against candidate and active notes in the same scope and project; nothing is extracted by a model; request_id makes every mutation replay-safe | memory_update edits body, sections or metadata in place under optimistic concurrency; approve, reject, supersede and archive move the file between lifecycle folders; hard delete removes the file and appends id and file hash to tombstones.jsonl, which nothing reads | Scope global, organization, project, session or archive plus a project name on every note; search and context admit only shared scopes and the resolved project unless cross_project is set; the candidates resource and memory_get take no project and return any project's notes | Seventeen MCP tools, ten resources and six prompts behind a frozen contract, served in process or through an optional localhost daemon; installers register Claude Code and Codex and copy five skills; an authenticated dashboard and Obsidian for people | Optional daemon runs a Vault watcher and a one-second embedding retry loop; without it, every request reconciles changed files at most once a second | Status candidate, active, superseded, rejected or archived, filtered to active by default; visibility standard, protected or sealed, with protected reads behind owner-approved grants and sealed bodies never indexed; stored text is labelled untrusted in the packed context | Markdown canonical and every index rebuildable from it; replay-safe mutations with payload-hash conflict detection; optimistic concurrency on edits; fail-closed protected and sealed visibility with owner grants that can only narrow a request; an append-only mutation log; a populated negative retrieval test | The agent holds memory_approve and memory_supersede, and supersede activates a new candidate in one call, so candidate-first review is a convention; the candidates resource lists every project; memory_dashboard_open returns the owner's one-time login URL to the agent; the audit log names no actor; rejected values can be proposed again |
gmeow-ontology |
One claim: a reified RDF 1.2 statement whose rdf:value is the text, annotated with dct:created and optional confidence, accordingTo and sourceLocation, identified by a BLAKE3 assertion id | One GTS ai-package file per GMEOW_MEMORY_PATH, default ~/.gmeow/memory.gts, zstd-rsyncable frames primed with the bundle's gmeow-memory-hot-v1 dictionary; the browser build holds the same records in process memory | recall over the whole file: drop suppressed claims and, with a floor, claims below or without a confidence; an empty query returns newest first, otherwise lowercase whitespace-token overlap ranked by score then recency; default limit 10 | Explicit MCP tool store_claim, gated by a Transaction-Logic verdict whose precondition the handler asserts after input validation; synchronous, no model call, no extraction or deduplication | revise_belief appends a suppression frame keyed on the claim's reifier, optionally naming a successor; nothing is deleted. The same text stored again is a new live claim. No tombstone | Physical: the file the environment variable names. accordingTo is stored on each claim and no read filters on it | Stdio MCP server, gmeow mcp, with store_claim, recall, revise_belief and store_segment among its tools; no hook, no automatic injection; the agent decides when to store and recall | None. A compact_store function that repacks the file under a library lock exists and has no caller | A suppressed bit derived from stored suppression frames, filtered on every default recall; confidence is a float used only as an optional floor | Append-only by construction with a per-write tool-call record in the same file; suppression rather than deletion with an explicit audit view; a five-shape negative recall test with a control; the browser store is tested by the native suite and mirrors the native ranking | No cross-process lock on the claim file while the upstream engine documents a single-writer requirement; revise resolves ids only in the last segment, so a medium change can strand older claims; writes are three unsynchronised appends; every call re-reads the whole file; the store is an engine module named examples |
gmr |
A binding — an external memory reference (provider, external_id) attached to one or more anchors, each anchor an observable fact with a versioned probe and content-hashed transition rules | One SQLite database whose append-only half is enforced by sixteen
BEFORE UPDATE/BEFORE DELETE triggers raising
append_only — journal, bindings, binding_anchors, links,
both revocation tables, and a content-addressed sealed
table that raises sealed_immutable. Four tables are mutable
and each says so in the schema with its reason: sighting
and usage counters, a per-session ledger of
verb calls and envelope bytes, and a polling queue. Memory
content itself stays in an external provider (git files) |
Not search — surfacing. Observe an anchor, and if its content-addressed fact crosses a declared transition, return the memories bound to it; cobound derives sibling memories from the binding graph | Bind a memory reference to anchors at a recorded journal sequence; open, transition, still, revise and close entries accrete on the anchor's append-only journal | An anchor is revised (reprobe/retransition/reterminal/restate) or closed, each with a rationale hash; a memory whose content moved since binding is flagged rewritten and can be reaffirmed. Detaching is a revocation row rather than a delete, and it names the binding rows it observed — so a later re-add of the same anchor is a tag the revocation never saw, and survives. Link revocation works the same way, each row killing exactly one observed edge | A memory reference is namespaced by provider and external_id; there is no per-user or per-tenant scope filter — GMR is a single-project grounding layer | A Rust runtime and CLI over eight crates, with a
console/ holding the CLI plus Node and Python bindings,
batteries/ for transport, provider, survey and atlas
adapters, and packs/coding shipping probes and an
extractor; memory providers are pluggable behind a
ContentProvider trait |
Observation runs the probe on a cadence and appends a sighting; a
Still is written when nothing moved, a Transition when the fact crosses
a rule, an Attempt when the probe fails. A queue table with
a lease and an epoch high-water mark carries polling deployments, and a
caller can demand freshness inline instead: grounded_within
with Instructions::fresher_than errors rather than serving
a reading older than the caller asked for |
A memory's currency is its anchor's discrete state at the sequence it was bound; anchors carry status, terminal statuses, closed and superseded; probes are Closed (reproducible) or Open (declared) | Grounds a memory in the observable fact it depends on and surfaces
it when that fact drifts, with a probe-failure taxonomy that never lets
an unreachable probe masquerade as a change; append-only enforced by
database trigger rather than by convention; a health verb
that reports which anchors have never answered and which answered
without ever moving a memory, so a badly chosen anchor is measurable
rather than merely suspected |
It grounds and surfaces but does not decide correctness or store the memory; the value depends on someone writing good anchors, and an Open probe is trusted rather than verified. There is no per-user or per-tenant scope filter anywhere in the runtime or store. And the surface has grown fast — 50,501 lines of Rust across eight crates plus four sibling trees — against a design whose whole argument is that a small number of semantics are held exactly |
gobii |
A row in a table the agent invented. There is no framework-defined
memory record — the schema is whatever the model wrote
CREATE TABLE for |
One zstd-compressed SQLite file per agent in Django's
default_storage, restored per run through a validating
subprocess; Postgres holds the platform's own 183 models |
SQL. The agent is shown a generated schema prompt capped at 30,000 bytes and 25 tables, then writes queries against it | SQL, through a batch tool with autocorrect, query-quality checks and recovery; the file is validated and re-uploaded after the cycle | UPDATE and DELETE FROM, written by the
model. No framework-level correction, no record of what was removed |
Two boundaries of different kinds — one SQLite file per agent UUID
with ATTACH/DETACH denied by an authorizer,
which is a guarded partition; and an agent foreign key on
the summary tables, filtered on every read, which is the predicate the
mark tracks |
A Django platform — persistent agents with email, SMS, Discord and web endpoints, MCP servers, schedules, a browser-use agent, skills and a kanban plan | Celery. Comms and step snapshot chains summarise history incrementally, each linked to its predecessor with an inclusive cut-off | None. A row is true because the model inserted it; there is no status, confidence or provenance column unless the model invented one | An explicit persistence contract — eight built-in tables declared ephemeral and dropped before save, with each one's mortality stated in the prompt the model reads; a real SQL authorizer sandbox | The schema is model-authored, so nobody can write a query to correct or erase a subject without first discovering what tables exist |
gomaa |
An Obsidian Markdown note with wikilinks and tags, carrying a
wing, a room and a salience score, mirrored
from a human-readable vault into a store |
PostgreSQL with pgvector and an HNSW index, or a zero-config SQLite WAL database, beside the vault the notes actually live in | Keyword and vector arms fused by reciprocal rank fusion, optionally spanning a shared store alongside the private one for cross-agent fleet sharing | A write passes an admission gate against poisoning, contradictions and low-quality data, lands in the vault as Markdown and in the store as a row, and appends a timeline entry | No deletion path is wired: delete_note is declared in
the base class and both backends and called by nothing. Forgetting is
salience decay plus archival of notes below a threshold untouched for
ninety days; pinned notes are exempt |
A stored wing and room composed into
queries by a _scope_clause helper each store implements
separately — and the helper returns no predicate for an absent scope,
while the MCP handler reads the scope from the calling model's own
arguments |
An MCP server, a CLI, a dashboard, adapters for several agent frameworks, and asynchronous Google Drive sync with its own path-safety tests | Consolidation applying salience decay at the store and archival in the engine, link reconciliation over the wikilink graph, and cloud sync | None as a state. Admission control refuses a write and returns a reason to the caller without storing it, so a rejected memory is not a memory marked untrustworthy; salience is a float used for ranking and archival | The injection defence is asserted in both directions in one file — control tokens neutralised in prose and the identical token required to survive inside a code fence — and path traversal is tested through the scope field and the title separately; a database error is required to leave the existing note untouched; the timeline is insert-only and logs failures beside successes; and a parameter that exists only for signature symmetry says so in its docstring | The scope that the README offers as the answer to research notes and
credentials colliding is a model-supplied argument that compiles to no
predicate when omitted, so an unscoped query spans every wing; the same
eleven-line scope helper is implemented twice, once per store; a
rejected write leaves no record despite the project's own complaint that
humans cannot audit what an agent learned; the timeline has no actor
column although fleet sharing is offered; and delete_note
is implemented twice and wired nowhere |
goodai-ltm |
A chunk of text addressed by a text_key returned at
insert, with optional metadata and a timestamp |
In-process chunk queue over a simple vector database, serialised
whole through state_as_text / set_state |
Embedding retrieval with a pluggable reranker — embedding, cross-encoder or a probabilistic matching model — plus optional LLM query rewriting | add_text with optional LLM rewriting; chunking is
queue-based with section separators bounding chunk expansion |
replace_text and delete_text by key, both
abstract on the base interface — the complete lifecycle, keyed |
None. No user, session, project or tenant concept anywhere | A Python library plus example LTM agents; no MCP, no server, no framework binding | None | Metadata and timestamps; no provenance, confidence or state | Targeted update and delete on the interface itself; a redundancy filter on the read path with a committed positive/negative control pair; a trainable reranker; a companion benchmark suite | Dormant since February 2024; whole-state serialisation; no scope key of any kind |
goodmemory |
Typed records — preference, reference, note, fact, feedback, episode
— each carrying a scope, a confidence, an
evidenceCount, a MemorySource naming the
extraction method and instant, a lifecycle, an optional
supersededBy, and optional
validFrom/validUntil and
expiresAt; plus claim projections with their own validity
intervals and an append-only history |
A document store behind one port: durable SQLite under Bun by
default, Postgres or an injected adapter when configured, with a
scopeKey index over the JSON column |
A pipeline rather than a query — routing, BM25 and vector fusion, query decomposition, iterative recall, reranking, budgeted selection and context assembly, with an evidence ledger recording what was used | remember with configurable extractors, profiles and
rules; installed-host writeback in off, observe, review or selective
mode; importMemory; feedback |
Supersession sets lifecycle and
supersededBy and leaves the earlier record readable through
claim history; forget and deleteAllMemory; TTL
demotion writes a demotionReason; a forgotten writeback
candidate stays refused by content hash |
A five-part scope of user, tenant, workspace, agent and session; recall requires exact equality on tenant and workspace, while the admin and export path filters on whichever scope fields the caller supplied | A package with goodmemory,
goodmemory/ai-sdk, goodmemory/host and
goodmemory/http entry points, a CLI with setup
and status, managed hooks for Codex and Claude Code, a
read-only MCP server with opt-in writeback, and a local Inspector web
app |
Extraction and projection into the recall index, TTL demotion, evolution and promotion passes, and the installed-host writeback runtime | Per-record confidence and evidence count, the lifecycle state
machine, the review queue, the writeback audit ledger with a
false_write review outcome, and secret redaction on
anything stored from a transcript |
A tombstone that is keyed on content rather than on a row id; a review mode that holds candidates outside memory until a person acts; a benchmark-claims gate that refuses a README number without a committed declaration naming commit, version, judge, dataset and licence | The recall scope guard and the export scope filter implement
different rules, so a bare user-only scope returns almost nothing from
recall and every workspace's memory from
exportMemory; the lifecycle filter lives at many pipeline
seams rather than in the store, which returns retired rows unfiltered;
the tombstone covers installed-host writeback only, and the audit ledger
with it |
gortex |
A node or an edge in a persistent code knowledge graph — functions,
classes, call chains, HTTP routes and cross-service contracts — with
every edge carrying an Origin tier recording how it was
resolved |
An on-disk graph over SQLite (the pure-Go
modernc.org/sqlite driver), shipped as a single static
binary with no dependency chain |
A trigram index and an FTS arm, a vector arm with a rerank stage, and graph traversal for structural questions; path confidence is derived from the provenance tier of the edges walked | Batch indexing through tree-sitter AST analysis over 257 grammars, lifted by in-process resolvers and optional LSP providers; a watcher drives incremental reindexing and prunes files deleted since the last pass | Re-indexing replaces; DeleteFileMtimes and
DeleteFileMetasByFiles prune paths that vanished. No
tombstone — nothing records that a resolved edge was wrong, only that
the file it came from is gone |
A repoPrefix string threaded through the store API,
plus filesystem confinement to the one root owning each file, re-checked
at every content sink. Multi-repository by default; the empty prefix
means every repository in one family of calls and exactly the unprefixed
repository in another |
An MCP server with 175 configurable tools, a CLI, and a web UI; installation configures every one of 19 supported coding agents detected on the machine | A watcher and a daemon; incremental reindex on change, with published p50/p95/p99 latencies through the production dispatch path | Provenance as a six-tier ladder from compiler-grade through text-matched to speculative, the last dropped from edge-returning queries by default, mapped to confidence by one shared function — and mapped a second way, deliberately differently, for graph centrality, where the speculative tier has no case and falls to the ast_inferred weight | A provenance model that survives being read:
EffectiveOrigin backfills unstamped edges rather than
letting them sort below the weakest tier, and the same backfill is what
the agent is shown, so a gating decision matches the displayed
evidence |
The populated benchmarks are self-curated — ten queries whose ground
truth is hand-written against Gortex's own repository, timed on one
operator's machine — and the externally graded surface, SWE-bench, ships
as a template whose result table is still TBD |
graft |
A node: title, Markdown body, keywords, an optional author and expiry, a state of active, stale, superseded or retired, provenance links to file, URL, conversation or manual sources, and a BGE-M3 embedding of the title only | One SQLite file per profile in WAL mode: nodes, an FTS5 table over title and body, a sqlite-vec vec0 table used as blob storage, keywords, edges, sources and node_sources, and five maintenance tables including an append-only maintenance_log | query embeds the text, scans every active and stale vector, and gates the best of ten candidates to STRONG, WEAK or MISS on title-only signals; retrieve fuses the vector arm with BM25 over title and body by reciprocal rank; explore runs a beam search over edges | Explicit: an agent or person runs graft insert through the CLI, MCP or HTTP, optionally with sources. The title is embedded synchronously and edges are built by brute-force scans. Identical content returns the existing id, attaches the new sources and restores a retired note | graft maintain resolve marks a note stale, retired, superseded or active again, in one transaction with an audit row; apply-safe purges retired notes after 30 days. graft delete is a hard delete. Expired nodes are deleted on the next read | Physical: one database and one daemon per profile. The MCP server takes the profile as a caller argument and OAuth scopes are per operation. A source's project id filters only the sources commands; a keyword scope applies only to the viewer's graph dump | A Claude Code and Codex plugin carrying skills and two hooks, one injecting a STRONG note on each prompt; skills for OpenCode via graft setup; a Python MCP server over stdio or HTTP with an OAuth gateway; graft status and maintain status tell the agent what housekeeping is due | None in the daemon. The skills have the agent run maintain apply-safe and a bounded scan-and-resolve batch when graft status reports them due; an optional autosync worker syncs a profile against a shared SQLite file on an interval | The gate label per query, and a STALE state that every search returns and no read output names. Contradiction candidates read a CONTRADICTS edge kind that only a test fixture writes | A retrieval gate that returns a title without a body when unsure; reversible correction with an append-only audit row in the same transaction; file provenance with fingerprints that flags notes whose source changed; a benchmark whose held-out headline recomputes from its committed rows | STALE is searchable and unlabelled, and every maintenance scan skips it; sync resurrects deletions and carries no state change; the MCP server's instructions tell the model to correct by delete and re-insert; the agent adjudicates its own maintenance queue; 40% false STRONG on held-out negatives |
graphify |
A Q&A doc — question, answer, cited source nodes, and an outcome
of useful | dead_end | corrected |
Markdown with YAML frontmatter under
graphify-out/memory/, plus a derived
.graphify_learning.json sidecar beside
graph.json |
A deterministic LESSONS.md read at session start, and a
per-node learning= annotation that reorders preferred nodes
ahead of the rest in query output |
One graphify save-result per answered question; files
are append-only and never edited |
No delete and no edit. A correction is a new doc whose negative decayed score demotes the nodes the wrong answer cited | One graphify-out/ per project directory — a filesystem
boundary, not a stored key |
A slash-command skill installed into fourteen agent harnesses, a CLI, and git post-commit/post-checkout hooks | A git hook rebuilds the graph and refreshes LESSONS.md;
--if-stale makes a redundant reflect a no-op |
A derived preferred / tentative /
contested band, persisted on the sidecar behind a
corroboration threshold of two and appended to the node line the model
reads — the code calls that annotation display-only, and no read path
withholds a node on it |
A committed test that the system's own lessons artifact cannot be re-ingested as evidence, and another that the header must say verify rather than reuse | Known dead ends are rendered for an agent to read and consulted by no code path; every memory doc is stamped with the same hardcoded contributor |
graphiti |
Episode, entity, temporal relationship edge, community/saga | Neo4j, FalkorDB, Kuzu, Neptune | BM25 + cosine + BFS across edges/nodes/episodes/communities; RRF/MMR/cross-encoder | Episode ingestion, entity/edge extraction, resolution, temporal invalidation | Close valid_at intervals, expire edges, remove
episodes |
group_id on every node and edge; search filters by
group_ids only when the caller passes them, and FalkorDB
maps a group to its own database |
Python library, MCP, server | Ingestion maintenance; saga summaries | Source episode UUIDs and bi-temporal history; no verified state | Preserves changing facts without erasing history | Entity merge/invalidation mistakes reshape the graph |
graphnosis |
A node in one of several named graphs, carrying text, a
confidence float, an optional validUntil, a
source kind and classification metadata; the node model itself belongs
to the pinned sync SDK |
Local-first encrypted files under a state directory, with an
append-only per-device op-log beside the graphs; the store and its codec
are @nehloo-interactive/graphnosis-secure-sync, pinned from
GitHub at v0.4.1 and not present in this repository |
A federated recall across graphs returning results grouped
byGraph, with embeddings through a serialized queue, TF-IDF
pairing, an association index, edge prediction and query enrichment
layered on top |
Ingest through connectors and documents; autonomous writes are gated on actor — only the orchestrator may write cortex memory without an explicit ask, and specialist personas may propose | deleteNode(id, reason) is soft: confidence drops to 0.1
and validUntil is set to now, and the node stays for audit.
supersede preserves lineage and is preferred for a
correction; forgetSource retracts a whole source and is
idempotent |
Separate named graphs, an RBAC module, a session access policy and a classification schema whose label drives an internal tier; recall is federated across graphs rather than filtered by a stored principal key inside one | An MCP server over stdio, HTTP and a socket, a relay, a Tauri desktop app, a VS Code extension, and a docs site — one cortex behind many clients | Daily temporal decay, reinforcement on recall, contradiction scanning and health scheduling, duplicate scanning, skill retraining, and an idle-maintenance lane | A single confidence float carrying three different
meanings — how believed, how recently used, and whether deleted — plus a
separate sensitivity tier that governs disclosure rather than
belief |
A consent gate that blocks on a human and cannot leak its own passphrase to the client asking, a correction path that is a preview by default, and a contradiction verdict that separates a genuine conflict from a supersession and from a negation artifact | Deletion is encoded as confidence = 0.1, the same field
decay lowers and reinforcement raises, so the store cannot durably
distinguish removed from doubted; and the graph store
itself is a pinned GitHub dependency this repository does not
contain |
graqle |
A ProvenanceEntry — a value with a source agent, the
round it was stored and last verified, a current and initial confidence,
a tenant partition key, a clearance level, five TRACE gap scores, a
contradiction count and a HIGH/MED/LOW reasoning impact; alongside typed
nodes and edges in the knowledge graph itself |
A typed knowledge graph with pluggable backends, an ontology layer with domain registries and a constraint graph, and a separate governed-trace store with a tamper-evidence layer | Activation strategies select nodes, aggregation strategies combine them — weighted synthesis, majority vote, rank fusion or confidence-weighted — and the reasoning store renders prior findings ordered by decayed confidence above a floor, each passed through clearance redaction | Ingestion from codebases, documents, policies and decisions into a typed graph, with a write gate, SHACL constraints and governance decisions recorded per tool call | Confidence decays each round since verification and again per contradiction, widening the transparency and auditability gaps as it falls; entries below the floor stop being rendered rather than being removed | A validated tenant partition key on every entry, opt-in behind an environment variable, and a four-level clearance applied as redaction where memory enters a prompt | An MCP server plus adapters for coding agents, a CLI, a chat surface with its own permission manager, Docker and Lambda images, and a PyPI distribution with editions and entitlements | Calibration, failure prediction, config-drift detection, pattern abstraction, a near-miss store and a tamper-evidence worker that batches, commits and anchors trace records | Five TRACE gap dimensions composing to a score, a confidence that decays by a caller-supplied lambda per unverified round and by a penalty per contradiction, and a reasoning impact of HIGH, MED or LOW; every numerical parameter is supplied by the caller rather than hardcoded in the module | A partition-key validator whose step order is fixed so no acceptance check sees an un-normalised value, rejecting double-encoding and unicode homographs before allow-listing three shapes; an audit schema frozen against extra fields and extended by a sidecar rather than mutated, with an explicit no-silent-drop commit lifecycle; and redaction that preserves the fault code so a reader below the clearance still learns that something failed | Tenant scoping is off unless an environment variable is set, and the validator's own docstring notes that passing it does not assert the tenant exists; a redacted entry still discloses its existence, its source agent, its confidence and its TRACE score, so the metadata of a restricted memory is public to anyone who can read the summary; and a patent notice asserts European applications over the methods, permitting use under the project's licence while requiring a separate patent licence to reimplement them elsewhere |
graymatter |
A Fact: one ULID-keyed string of agent-supplied text
with created and accessed timestamps, an access count, a decaying weight
in [0,1], an optional embedding, a supersession marker, a write-time
confidence word, a kind that marks vocabulary aliases, and a pin flag
with its timestamp |
One bbolt file gray.db per data directory — a facts
sub-bucket per agent, an inverted term index with a recency spine, a
session-checkpoint bucket and an audit bucket — beside a persistent
chromem-go vector store in vectors/ |
Reciprocal-rank fusion of three signals at weights vector 1.0,
keyword 1.0, recency 0.5; superseded facts and alias facts are removed
before anything is scored; an inverted index answers candidates by
default with a full-scan fallback; optional MinRelevance
cut relative to the top score |
Put blocks on an embedding round trip, one bbolt
transaction covering the fact, its term postings and a pending-vector
marker, then a chromem upsert; no LLM on the hot path, and no duplicate
detection at all |
revise and forget set
SupersededBy, which excludes a fact from recall immediately
and unconditionally while it stays listed, exported and decaying;
UpdateFact refuses to un-retire a tombstoned fact; a
consolidation cycle hard-deletes anything unpinned below weight
0.01 |
A bbolt sub-bucket per agent_id plus a reserved
__shared__ namespace that RecallAll fuses in —
a physical partition, not a query predicate, and the project's own
threat model states that any client which can authenticate may read and
write any agent_id |
One Go binary: a library, a CLI of roughly thirty commands, a stdio
and HTTP MCP server with seven tools, a socket daemon holding the single
bbolt writer, a REST server, a TUI, four Claude Code hooks and a
context-sync projection into CLAUDE.md |
No scheduled sweep: consolidation is launched asynchronously after a write once an agent holds twenty facts, bounded to two concurrent runs and silently dropped when full; a 30-second loop drains pending vectors and a watchdog exits the daemon after two idle minutes | A Confidence word of verified,
inferred or unverified validated at write and
surfaced by the TUI, exports and explain — read by no ranking, filtering
or consolidation path, and settable only from the Go library; injected
memory is wrapped as untrusted data on the run harness path
only |
Benchmark claims that cannot drift from the code: the README's own token and retrieval tables are parsed and compared against a live measurement in CI, the reduction column at zero tolerance, with a companion test forbidding any quality metric nothing computes; a monotonic supersession latch; and a threat model that names its own gaps | A retired value can be written straight back — nothing is keyed on the value and there is no write-time dedup; the audit trail has no reader; the untrusted-memory framing is missing from the hook path the README leads with; and consolidation ships half the store's fact texts to an LLM per cycle with no cap |
grok-build |
A markdown chunk with a blake3 content hash, a source of global, workspace or session, and created_at, updated_at, access_count and last_accessed | Markdown files under ~/.grok/memory/ as the source of truth, with a derived per-workspace index.sqlite carrying FTS5 and an optional sqlite-vec table | BM25 and vector KNN merged by weight, then temporal decay on session chunks only, source weights, an access-count boost, MMR diversity and a content-free filter | A flush turn appends a model summary to the session log before compaction, when idle, on /flush and at session end; the dream pass consolidates on gates of hours elapsed and session count, under a lock, and overwrites the workspace MEMORY.md | The dream overwrites MEMORY.md with a response truncated at 16,000 characters and then deletes the session logs it actually read; there is no version, diff or backup of the file it replaced | A per-workspace directory named slug-blake3(cwd)[..8] with its own index; memory_get canonicalizes both sides and fails closed outside the memory root; FTS filters on a stored source column | memory_search and memory_get, both is_read_only; legacy writes come from harness-run flush and dream turns, never from a model tool; opt-in v2 lets the model edit topic and inbox files through a path-checked access policy | The dream pass, gated and locked, plus a file watcher that reindexes on external edits and purges chunks for deleted files | No state on a record. Retrieved session memory is annotated with its own age and an instruction to verify, computed at render time and suppressed for curated sources | Every injected memory carries its age and a verify hint, and the injection is written to preserve the provider's prompt-prefix cache | Consolidation is destructive at both ends, and grok memory clear --global leaves the deleted text in every other workspace's index until a manual reindex |
growmos |
A typed entity and a directed edge. The edge is the memory:
id = r_ + sha(source_id | normalized predicate | target_id),
carrying the list of source documents it was seen in, a
confidence that is the length of that list, and an optional
when validity range |
.growmos/ beside the repo —
entities.jsonl, relations.jsonl,
aliases.jsonl, mentions.jsonl,
sources.jsonl, profiles/*.json,
journal.md, eval/gold/*.json. Plain files,
hand-editable, no database, and no runtime dependency at all |
Seeds by alias containment then token overlap against the question,
a k-hop induced subgraph around them, serialized as triples sorted by
corroboration with each edge's id and source labels attached — the
answer schema then requires cited_edges and a
not_in_graph list |
Three one-line verbs — remember, link,
journal — plus an extraction pipeline that hands judgment
to whatever agent you already run as a task packet (prompt + JSON shape
+ the exact apply command). No API key required; a headless
provider mode exists for cron |
merge folds one entity into another, rewriting its
edges, repointing every alias and deleting the source node and its
profile file; rename changes a display name;
compact prunes dangling edges and aliases. Nothing records
that a fact was wrong, or that a merge happened |
One .growmos/ per repository and no scope key on any
record. The graph is shared by every agent and person working in that
directory, which is the stated design |
An MCP server, a CLI, and installed hooks: SessionStart
prints the brief and the pending work, Stop returns
{"decision": "block"} while packets are outstanding.
growmos integrate writes the config for Claude Code, Codex,
Grok, Cursor and Gemini |
None on a schedule. Work is queued by content hash — a changed
document flips its source row back to pending — and drained
by the agent when a hook or a human asks for the next packet |
confidence is the number of distinct source documents
an edge was seen in, not a model score. provisional marks
an entity whose name resolution has not been confirmed, and no read path
filters on it |
The edge id is derived from the triple, so the same fact re-asserted from a second document corroborates rather than duplicates; agent instruction files are excluded from ingestion by default because they are protocol, not knowledge; a failed fact-check answers with the adjacent true edges instead of a bare miss | The maintenance loop is enforced by blocking the agent's stop and by
a session-start line telling it the work does not need
permission; a merge deletes the folded entity with no durable
record of the merge; when is written and read by nothing;
and the review verdict lands in a memo rather than on the node it
judged |
guild |
A lore entry — a topic slug, a kind from idea, research, decision, observation or principle, a title, a mandatory two-to-three sentence summary, tags, an optional file pointer and source, a status, a time-to-live, a review flag, the quest that prompted it, and access counters — linked to other entries by informs, supersedes or contradicts | Embedded SQLite, one database for lore and one for quests, with FTS5 over both and a stopword tokenizer | BM25 keyword search fused with vector similarity by reciprocal rank when embedding coverage clears a threshold, and a deterministic keyword-only path when it does not | MCP tools an agent calls to inscribe an entry or post a quest, with a consolidation pass that reclassifies and de-duplicates | Status changes in place; the consolidation pass supersedes the older of an exact-duplicate pair and links it to the newer; a snapshot archive backs the whole store up and restores it | A project id on every entry; the listing path always scopes by it and the search path makes cross-project the recommended mode for research queries | A single compiled Go binary containing an MCP server, usable from any MCP client as a shared substrate for parallel agents | A consolidation pass, a hints engine that scores its own rules by follow-through and disables the ones that stop landing, and a quest board that cascades unblocking when a dependency clears | Nine statuses with the search admitting four by name; a review flag the writing agent sets on itself; near-duplicate detection that flags rather than refuses | A status filter written as an allow-list so a new status is excluded by default; a hints engine that records whether each fired rule was followed, ignored or still pending, so a rule has an obey count and not only an ignore count; and a near-duplicate threshold whose value is argued from two named reproducer pairs | Two read paths default to hiding different sets of statuses; the review flag is a parameter on the tool the agent itself calls; and the quest board's event log has no counterpart for lore, whose updates overwrite with no prior version kept |
habitus-ai |
A canonical record — type, source, timestamp, text, embedding,
provenance, metadata, and an optional supersedes_id —
beside a concept graph of nodes, edges and vaults built over them |
One SQLite file, no external services and no runtime dependencies: records, record links, concepts, edges, edge evidence, vault membership, traces, outcomes, experience state and projections, and overlap clusters | Two lanes — a locked top-3 dense rail straight from the records table, and a graph lane that traverses Y-paths by a travel-time cipher, expands the visited nodes' vaults and reranks the candidates by dense plus BM25 | Records are inserted and never changed; a correction is a new record
whose supersedes_id points at the old one. Edge strengths
move only through reinforce_edges, which returns
immediately unless the outcome is verified |
Impossible on a record: records_are_immutable_update
and records_are_immutable_delete both
RAISE(ABORT, 'canonical records are immutable'). Edges
carry an archived flag rather than being removed |
None on the read path. source_id is stamped on every
record and defaults to "human", and no query filters on
it |
A Python library with a CLI, a demo, an agent wrapper, a tool registry binding tools to output trunks, and optional adapters for Chroma, Pinecone and pgvector | None. Gestation and hatching are explicit calls, and reinforcement runs inline when an outcome is recorded | No epistemic status. RecordType names a kind — fact,
observation, inbound message, outbound message, receipt — and a
projection carries a confidence float |
Immutability enforced by the database rather than by convention and tested in both directions; a conservation invariant that is machine-checked from the CLI, the app and two tests; and a learning path that discards an unverified outcome and refuses a verified external one with no receipt | The default embedder is a signed hashing trick over tokens and
trigrams, so the dense lane is lexical unless a real model is supplied;
the audit tables have no reader; source_id never reaches a
query; and the README names an ActionReceipt type the tree
does not contain |
halofy |
A memory_objects row — content, type, scope,
confidence, provenance, a data classification, event and assertion
times, a validity interval with a supersedes link, and an
inline embedding |
One Postgres database with pgvector — embedded PGlite when no URL is set — holding memory, policy, tombstones and the audit log; L3 concepts as markdown with encrypted private bodies; warm-store mirrors and retriever sidecars as rebuildable caches | A policy-selected read-only driver over an ACL-scoped view — baseline 0.5 cosine plus 0.5 BM25, graph, or a Mem0 sidecar that may only reorder — plus a token-budgeted working-set allocator and an L2-then-L3 fault path on absolute hybrid scores | Extract, verify, resolve entities, classify, exact-dedupe and insert in one transaction with its audit row; verbatim when no model is available; semantic conflicts judged out of band by a model | Supersedence closes the prior row's validity and links it, never deleting; mem_forget hard-deletes inside the caller's subtree, writes a tombstone per erased id and signs an ed25519 deletion certificate | Namespace, actor and role resolved from the API key; reads see the
key's namespace and its /-split ancestors through an
enumerated IN list, never siblings or descendants |
Fifteen mem_* syscalls over MCP, HTTP and a CLI, a
console control room, filesystem, Postgres, Obsidian and CSV connectors,
and a six-check conformance kit for retriever drivers |
An out-of-band conflict autopilot after writes, consolidation runs that draft knowledge proposals, durable jobs and a warm-mirror outbox | A provenance trust lattice decides automatic conflict outcomes; a
disputed quarantine status and a dispute review service
exist with no producer in the tree |
Server-owned identity with an enumerated ancestor predicate on every read; a hash-chained audit row in the same transaction as each change; retrieval confined to a read-only cartridge with a conformance kit | The documented write-path dispute quarantine is unwired and its similarity band constant is read nowhere; conflict detection needs an Azure OpenAI deployment; no point-in-time read over the validity intervals |
harness-evolution |
Per arm: an ACE bullet (6-hex id, one sentence), a TEPA precedent (id, attribute key, sentence, active flag), a TRACE check (API, argument, predicate, value, sentence), a Reflexion paragraph, one free-text memory file, or an oracle statement picked from a candidate bank; the Q2 pool holds induced sentences tagged with the rule that produced them | Python objects inside one experiment process, snapshotted to a memory Markdown file at each checkpoint and to updater_final.json at the end; only the Q2 assertion pool is written to JSON and read back by a later run | None. The whole current memory is formatted into the agent's system prompt at the start of every episode; Q2 builds a fixed block by consensus rank and round-robin across rules before evaluation | After each rejected training episode the updater sees the simulated user's complaint; ACE asks the model for add or modify deltas, TEPA for keyed precedents, TRACE for compiled checks, Reflexion for a reflection, the rewrite arm for a new memory file; accepted episodes write nothing | ACE modify rewrites a bullet by id, trigram dedup at cosine 0.85 keeps the older bullet, and the oldest are evicted above 12; TEPA revokes the active precedent under a key and re-activates an exact repeat; TRACE and Reflexion evict FIFO; the rewrite arm truncates at 1,200 characters | One persona per process; no scope key on any memory unit | A driver loop over AppWorld tasks: inject memory, run a function-call or code agent, score with the persona's checkers, turn violations into feedback, call updater.observe, freeze and evaluate at checkpoints | None | TEPA's active flag withholds revoked precedents from injection; every other arm injects everything it holds as settled. The feedback is a programmatic checker, not a person | One observe and render interface across six update recipes, so the learned memory is the experimental variable; rule-to-complaint provenance kept driver-side and never shown to the learner; content-hash ids with modify-by-id; keyed revocation that keeps the revoked entry; frozen task splits committed | Nothing persists past one process, so the memory cannot be inspected or corrected between runs; ACE deduplication keeps the older bullet when a newer one negates it; ACE's helpful and harmful counters are declared and never written; no tests and no results committed, so no reported figure recomputes from the tree |
harness2 |
A library entry: the full component tree of one task's adopted harness (system prompt, guardrails, LongTermMEMORY.md, tool guidance, skills, subagents, scripts, plugins) plus an EXPERIENCE.md holding the selector's reason, per-edit rows and one cue, lesson, evidence and confidence | Plain directories under runs/library, one per benchmark, k, executor and seed, then one per recursion mode and per benchmark domain; INDEX.md is regenerated from disk after every write. The task summaries under runs/adapt are the store of record the library is rebuilt from on resume | None by query. The whole domain directory is copied into every editor session's context tree, and the editing model browses INDEX.md and opens entries with its own file tools. The selector, the reflector and the executor never receive it | After a task's blind selection, a reflector session reads the adopted and rejected candidates and writes edit rows and at most one lesson. The entry is stored only if cue, lesson and evidence are all non-empty; NO_ENTRY keeps the adopted harness out as well. Synchronous, before the next task in the domain starts | Before each task the scheduler deletes every entry not from an earlier task in the stream; a re-run of a task overwrites its own entry. Nothing lets a later task revise, demote or remove an earlier lesson, and a hand-deleted entry returns on the next resume | Physical: a separate directory per run identity, per mode and per domain, so retrieval is by construction rather than by a key or predicate. The domain comes from the benchmark's task id or manifest, never from a model | Internal to the method: the improvement stages of Propose–Probe–Compose read it through the context tree; no API, tool or CLI flag exposes the library on its own | None. Every write happens inline in the task loop; there is no consolidation, deduplication or decay pass | None as state. The lesson's confidence is free text no reader parses; the evidence field is a citation the reflector writes about its own edit rows, checked only for being non-empty. Grader verdict strings and answer-key paths are refused at write and at every copy into context | Entries carry executable components rather than prose; a strict prefix rule makes the library each task saw reproducible; content-addressed session caching invalidates when the library changes; grader output is kept out of memory by a tripwire at both ends | Admission is a non-empty-field check on a model's self-citation; no lesson can be corrected by later evidence; re-running an upstream task leaves downstream tasks built on its old entry; the library grows without bound into every editor context; the paper's library ablation and transfer arms have no CLI path |
hatchdoor |
A Markdown note on disk, identified by
{vault_id, slug}; everything else — chunks, embeddings,
links, backlinks, tags, headings, FTS rows — is derived and
disposable |
The vault directory is the only record; one shared SQLite file holds
a per-Vault disposable snapshot with FTS5 and two
sqlite-vec vector tables, wiped and rebuilt on a schema or
embedder-identity change |
Pure semantic KNN or FTS5 BM25, chosen per call by mode
and never fused — ADR-05 shipped that after measuring hybrid and a
cross-encoder and rejecting both; a #tag prefix answers
from structural rows without vectors |
14 MCP write tools and a Vault-scoped HTTP surface over one
vault/write layer, each write gated on
expected_content_hash and committed with
renameat2 RENAME_EXCHANGE under a per-Vault mutation
lock |
Update is a conditional atomic rewrite; delete is a move into
.hatchdoor-trash/ that also strips every wikilink to the
note from every other note; archive is a move under a prefix. ADR-11:
nothing is unlinked from disk by Hatchdoor |
vault_id — resolved before the query, filtered again on
the snapshot's participating flag, and carried into both
retrieval arms' SQL; layers are a surface selector inside a Vault, not a
boundary |
One binary serving a web UI, a Vault-scoped HTTP API and an MCP server on the same core; MCP off by default with its own bearer token, Origin allowlist and a separate write gate | A per-Vault file watcher requesting whole-Vault Index turns, a work coordinator serialising Index and Git turns per Vault, and a Git scheduler on a default 24-hour poll | None. A note has a path, an mtime, a content hash and optional
frontmatter; there is no candidate/verified/rejected field on a note or
a chunk, and the MCP instructions string tells the client
to treat Markdown note content as untrusted data, not
instructions |
A write path that makes RENAME_EXCHANGE the commit
point so the hash check has no TOCTOU gap, a compensating mutation
journal, an accepted ADR that refuses hybrid retrieval on measured
evidence, and 36 committed eval runs whose every headline number
recomputes exactly from its own per-query table |
Delete never removes anything and rewrites other notes' text;
WATCH_MAX_DEBOUNCE is declared and read by nothing, so a
continuously-changing vault defers reindexing indefinitely; the quality
gate ADR-15 mandates cannot be run from the repository because
eval/queries.jsonl holds two queries; and the private
125-query set the runs used is printed in full in the committed results
file |
headroom |
A memory with content, a user and optional session, agent and turn ids, a validity window, an importance score, supersedes and superseded-by pointers, a promotion chain, an access count, entity references and an embedding | SQLite with vector, full-text and graph adapters for the local backend, or a delegated backend; compression caches and telemetry live in their own stores | Vector similarity with full-text and graph adapters beside it, filtered by scope level and by validity, with superseded rows excluded unless a caller asks for them | Extraction from traffic and explicit tool calls; correction is a supersession that stores a replacement and closes the predecessor rather than editing in place | Supersede, and a detach that reverses one supersession edge with an atomic lineage repair; delete removes the row and its index entries | A user id bound to the memory system at construction and supplied to every operation, with ownership re-verified before an update or a delete | A compression proxy, an MCP server, agent wrappers for a dozen coding tools, Python and TypeScript SDKs, and sync adapters that share one store across Claude Code and Codex | A learn pass that mines failed sessions into corrections written to a gitignored personal file by default, traffic learning, and cache maturation policies derived from measured re-read behaviour | A validity window whose closure marks supersession and is excluded from search by default; importance is a separate score; no vocabulary distinguishes why a memory was closed | Removing a superseded row from the search indexes rather than trusting the status filter, because the indexes cache the field the filter reads; a user id that is a property of the system object rather than a parameter; and a tuning constant derived from a measured distribution over real sessions rather than chosen | The supersession exclusion has no regression test even though its own comment records that the bug shipped once; the scope key is optional one layer below the enforcing one; and the module named audit measures compression policy rather than recording memory changes |
heimdall |
A Graft node — either a seeded knowledge-base note anchored to a filesystem path, or a file/symbol node projected from a row in Heimdall's own journal | Graft, whose C source is vendored and whose binary is compiled from
it at install time, plus Heimdall's own authoritative SQLite journal at
~/.heimdall/journal.db and a fact_history
archive beside it |
graft retrieve for candidates plus a graph walk, then a
per-hit verdict computed by checking the anchor path and its content,
with the verdict as the primary sort key and the score only breaking
ties |
A level-triggered reconciler: a hook appends a path hint, a single writer reads that file from disk and makes the graph match it. The hint is never believed and never replayed | A vanished file retracts exactly the nodes its path owns and leaves
an absent row behind; retracted facts are archived with
invalidated_at and an optional superseded_by,
capped at fifty rows per source path and purged outright when the same
fact returns |
A --scope substring match against the result's path at
query time; no stored scope key |
An npm CLI, adapters that write hook config for pi, Claude Code, Codex, Cursor and Windsurf, three agent extensions, and a launchd job | A single-writer daemon draining the queue, an audit that compares
the journal against the filesystem, a read-only
heimdall verify that reports drift without repairing it,
and a detached indexer the install hook spawns |
Four computed verdicts — STRONG, REBUILT, WEAK, STALE, plus REMOVED and NOPATH — assigned per hit at read time and never persisted | A queued path is a hint that something changed, never a description of what — so a missed, duplicated or wrong hint cannot corrupt the graph | Installing the package wires detected agent harnesses and spawns a detached indexer, swallowing every error so npm cannot see a failure; and the journal is declared authoritative over a projection that nothing ever reads back |
helix-agi |
A belief row in one of seven category files — content, mass, confidence, verifications, stability index, relations, memory_refs, an 8-D position and the somatic state at encoding — beside memories that exist only as journal lines | Per-category JSON files for beliefs, one append-only JSONL journal for memories and belief snapshots, a separately saved 384-D index; no database | Two surfaces — 8-D gravity in the manifold for ambient preconscious injection, and a lossless 384-D cosine index (numpy, FAISS IVFFlat past 5k vectors) for explicit recall | Capture into the journal at pulse time with no model in the path; a local-model detector tags pulses, and a nightly Curator extracts, consolidates and integrates beliefs | update_belief and adjust_confidence;
remove_belief rewrites the category file and clears both
runtime indexes; archive_belief sets mass to 0.01 and tags
it, and its snapshot reaches the journal through the same sync path as
any belief write; the journal records no removal, and memories have no
delete path at all |
None. No user, project, agent or tenant key exists anywhere in the memory layer | A continuous four-state pulse loop, Discord/Slack/Telegram/WhatsApp/webhook channels, a tool registry with generated tools, a read-only dashboard, and an MCP plugin for testing agents | A nightly Curator — extraction, consolidation, UMAP/HDBSCAN compounding — plus per-pulse hooks and a nightly attrition recompute; the journal's own documented compaction is defined and never called | Floats only — confidence from a stated attrition equation, mass, verifications, stability index. A detected contradiction is a -0.10 confidence nudge | Confidence recomputed nightly from a written equation with named terms, a self-reinforcing mass loop found and deliberately cut, and a zero-cost capture path with a cheap local gate in front of the expensive nightly pass | The journal it calls the single source of truth never hears about a deletion, and a removed belief's content is still resolvable from it into the injected surface |
helm |
A (kind, key) fact carrying confidence, evidence_count,
access_count and an expiry, plus a free-text episode |
One local SQLite file via node:sqlite, vectors as JSON
text in side tables; a separate Markdown vault the agent edits by
prompt |
BM25 fused with MiniLM cosine by RRF, scaled by confidence and a key-match boost, over the 500 most recently updated active facts | One CLI verb per fact, a regex on the hot path, and a 15-minute think tick plus a weekly LLM pass for the rest | A same-key rewrite expires the old row and inserts a new one;
forget and the prune sweep hard-delete |
None on the fact table — one owner, enforced at the gateway;
channel is stored on episodes but never filtered on |
Discord, iMessage and a terminal client into one Claude Code session; two registry tools; a generated index imported into the prompt | A launchd/systemd think tick, a weekly deep review, consolidation with decay and prune, and index regeneration | A confidence float with a 0.7 cap on a first observation that rises only on repeats of the same value, independent or not | The evidence gate, decay slowed by access, and episode-noise gates anchored by tests that name the pollution that forced them | Confidence never reaches the model, three readers ignore the expiry predicate, and the 500-row recall window is ordered by recency |
hermes-agent |
Delimited text entry in MEMORY.md /
USER.md; session message; skill |
Markdown files plus SQLite state.db with FTS5 |
Curated memory always in prompt; session history via FTS5; no cross-layer fusion | Explicit memory tool through a staged write-approval
gate |
Substring-addressed replace/remove; a write that would exceed the char cap is refused with the current entries returned and an instruction to consolidate in-turn, capped at three refusals before the turn is released | Profile-level only; no project or room boundary within a profile | Own tools plus one mounted MemoryProvider; MCP
serve |
None for curated memory; providers may run their own | Threat-scanned at write and re-scanned at every load, with a matching entry replaced by a named placeholder in the frozen prompt while the original stays in live state; no provenance, status or confidence on entries | Frozen prompt snapshot preserves cache; a poisoned entry on disk is fenced out of the prompt at load time and the exclusion is asserted in committed tests; foreign-write detection with backup | Model writes are instantly authoritative with no candidate state and no tombstone; removal is model-driven and leaves no record; the fail-closed checkpoint contract has no in-tree provider that opts into it |
hermes-fleet-memory |
A card in one Qdrant collection: text, a domain of work, personal or shared, a client_id, a slot_name, a memory_type of slot or episodic, a constant status of active, pinned, revision, regex-extracted entities and relation triples, author node and profile, created_at, updated_at and expires_at, and a 384-dimension bge-small embedding | One Qdrant collection, hermes_fleet_memory, with INT8 scalar quantisation and keyword payload indexes, either self-hosted behind a WebSocket tunnel or on Qdrant Cloud; expired episodic cards are appended to a local JSONL archive before deletion | fleet_memory_search embeds the query and runs a Qdrant vector query filtered on status, domain and an optional client_id; fleet_graph_search scrolls every authorised card up to a 5,000-point cap and matches the entity against the entity list, a text substring and relation endpoints | Explicit, through the fleet_memory_store tool. A slot write overwrites a UUID5 id from domain, client_id and slot_name and is pinned; an episodic write either replaces its nearest neighbour above 0.95 cosine in the same domain or gets a fresh UUID4. Synchronous embedding and upsert; a credential pattern refuses a shared write | Slot cards overwrite in place, rejecting a write only when the caller supplies a timestamp older than the stored updated_at. Episodic near-duplicates overwrite their match. No delete or forget tool; a cron-run cleaner archives and deletes unpinned cards past a 90-day expires_at | A domain key on every card, filtered on both agent reads from the node's FLEET_HARD_DOMAIN: work and personal nodes see their own domain plus shared, an all node sees everything. client_id is an optional caller filter. One Qdrant key for the whole fleet | A FastMCP stdio server registered in Hermes, Claude Code, Cursor or Claude Desktop, with a skill file telling the agent to search before shelling out; Hermes is configured with memory.provider none so nothing is injected; the same server carries desktop-bridge and task-plane tools | server/cleaner.py, meant for weekly cron on the hub: scrolls active, unpinned cards past expires_at in batches of 500, appends each to a JSONL archive, then deletes them, for at most 200 batches | None as state: status is written as active by the only writer and filtered on by every read. Provenance is author_node and author_profile from the environment, and a monotonic revision counter | A domain boundary the agent cannot widen by argument, decided before any network call; deterministic slot ids for facts that should have one value; a credential scan that refuses shared writes; zero ambient injection by design | The boundary binds the agent, not the node, since one Qdrant key reads every domain; episodic dedup overwrites another client's card and clears its pin; no correction history or delete tool; the cleaner cannot reach a Qdrant Cloud URL; tests never exercise a filter |
hestia |
One markdown file per fact — frontmatter of type,
confidence, source, last_seen,
links, pinned, plus free text |
A directory of markdown under HESTIA_MEMORY_DIR with an
auto-generated INDEX.md; proposals in an
inbox/ subdirectory; records are gitignored as runtime
data |
BM25 over every live record with a 34-word stop list, length
normalization and corpus rarity; pinned breaks ties only,
and the result is capped at twenty |
A two-op memory tool the model calls, plus a background
note-taker that proposes into an inbox rather than writing |
Files a person can edit or delete; promote and discard on the inbox; discard unlinks the proposal and keeps no record; no supersession and no delete op on the tool | One household store; no scope key | An OpenAI-compatible local endpoint with eleven tools, reached by phone, terminal, kitchen mic and Home Assistant, plus an operator MCP server over stdio that is read-only unless switched | A note-taker extracting durable facts after each answer into a review inbox, deduplicated against live memory and the queue | A confidence float shown in INDEX.md and
the review list and read by no ranking; a pinned flag that
only breaks ties; an inbox status: proposed that nothing
reads, since the exclusion is the directory |
The review inbox is the only path for passive extraction, both review surfaces are a person's, the write whitelist errors loudly, and recalled memory reaches the prompt in a JSON envelope labelled data-only | Recall is lexical with no semantic arm; a promoted fact has no way
to be marked wrong; a discarded or deleted fact can be proposed again;
HESTIA_INBOX_DIR pointed at the memory directory would make
proposals live; the nightly backup copies a fixed path and ignores
HESTIA_MEMORY_DIR |
hexis |
A memory node in a Postgres graph, plus a user-model claim keyed on a canonical claim_key | Postgres with a hand-built graph schema — one table per edge type — and eighty-plus SQL function files | Graph neighbourhood recompute, emotional-state weighting, a tip-of-the-tongue path and a reflect pipeline | Claims accumulate evidence refs and a count; nothing reaches the approved review status without a decision | Two orthogonal CHECK-constrained axes — status and review_status — with a supersession pointer in both directions | Single-subject by construction; contacts and channels partition input rather than the store | Chat channels, connectors for external accounts, a UI, plugins, skills and characters | A maintenance worker running subconscious observation, reconsolidation sweeps and scheduling | status is active, superseded or rejected; review_status is pending_review, approved, rejected or superseded | A belief transformation triggers re-evaluation of what that belief had caused to be rejected | The reconsolidation verdict is an LLM call batched eight memories at a time; the committed benchmark measures the behaviour it produces on 25 synthetic cases rather than the verdict itself |
hillock |
A subject-predicate-object triple with a source-document label, plus a decaying co-activation weight between two entities | One SQLite file in WAL mode with four tables: entities, relations (with source_doc, confidence and created_at columns), hebbian_weights, and an hdc_reservoirs blob store for multi-hop path vectors; the 10,000-dimensional codebook is in-process only | String entity linking, a one-hop SQL fetch, then a late-interaction score (the mean over query tokens of each token's best cosine against the fact's predicate, subject and object hypervectors) against a fixed 0.55, plus a 0.35 predicate-alignment floor | Document ingestion only: a local pipeline (coreference, predicate routing, GLiREL at a 0.30 threshold) writes triples labelled with the file's basename; no admission gate; nothing is written from conversation | Append-only with no supersession; INSERT OR REPLACE on the triple restamps its source label; a CLI quiz after ingestion deletes a pronoun triple and inserts the user's replacement; reset drops all four tables | None: one database per process, no scope key in the schema, and the HTTP server serves every caller from one store and one in-process context state | A console REPL, an importable IntegratedHillock class, and an OpenAI-compatible FastAPI server bound to 0.0.0.0:8000 with no authentication; any OpenAI-compatible chat endpoint renders | None; Hebbian decay runs inline on every answered turn | No status. A confidence column nothing reads, a single-valued source label shown to the renderer, and a record timestamp nothing reads | No stored fact reaches the model unless it clears the gate; in strict mode an unmatched question returns a fixed string and the model is never called | The gate averages over query tokens, so a four-token question scores about 0.52 against its own exact triple and blocks at 0.55; the default mode sends every blocked question to the model with a refusal prompt |
hindsight |
Source chunk, world/experience fact, observation, reflection | PostgreSQL/pgvector or Oracle | Semantic + BM25 + graph + temporal, RRF/interleave, cross-encoder rerank | Screen, chunk, extract, embed, link, consolidate | Replace/append source; observation create/update/history; exact bank/document operations | Memory bank, tags, schemas/tenants | REST, MCP, generated SDKs, framework integrations | Queued consolidation and maintenance with retries | Source IDs, proof counts, audit/LLM traces; no explicit truth state | Complete service pipeline; task-specific fusion; temporal recall | LLM facts/observations can harden errors; operational complexity |
hipocampus |
A typed entry under a heading in a daily log —
## Topic Name [type], where type is project,
feedback, user or reference, and
the type sets compaction priority and whether the entry may expire. A
feedback entry has a fixed shape: rule, why,
how-to-apply |
Markdown files in the project — memory/YYYY-MM-DD.md
leaves, memory/weekly/, memory/monthly/,
memory/ROOT.md, plus knowledge/,
plans/ and the hot files SCRATCHPAD.md,
WORKING.md, TASK-QUEUE.md. No database, and
the only state file is a compaction counter |
Three ways in, and the first is a decision rather than a search:
ROOT.md's Topics Index is in context every session so the
agent can judge whether memory holds the subject at all. Then
qmd (BM25, optional vector and rerank) over the files, or
traversal down the compaction tree |
The PreCompact and TaskCompleted hooks run
hipocampus compact, which turns the transcript into a raw
daily log through a secret scanner, then either copies or concatenates
below threshold or marks the node needs-summarization for
the agent's own skill above it |
Nothing is deleted. Raw daily logs are "permanent leaf nodes" and weekly, monthly and root nodes are "index supplements — originals are never deleted". The only content-keyed removal is at promotion: entries marked temporary, test run or delete later — in English or Korean — are stripped on the way up | The project directory. Memory lives beside the code it is about, there is no scope key on any entry, and a second project is a second tree | Installed as a Claude Code plugin, or
npx hipocampus init for OpenCode, OpenClaw and Codex. Three
hooks — SessionStart injects the protocol and creates the tree,
PreCompact and TaskCompleted run the compactor — plus five skills the
agent reads |
None. Compaction is triggered by the platform's own pre-compaction event or by a completed task, and the deterministic half runs in-process in a few hundred lines of Node | None over content. status: tentative|fixed on a
compaction node is temporal — tentative means the period is still open
and the node is regenerated from its sources; a ? in the
Topics Index means a reference entry is due for verification |
The root node answers do I know about this? rather than what do I know, which is the question that decides whether a search happens; a tentative node is regenerated from its sources rather than patched, so a summary never drifts by increments; and the one thing the project chose to test is the secret scanner, which is the right thing to have chosen | The only test transcribes the secret scanner instead of importing
it, and compact.mjs exports nothing, so a change to the six
patterns leaves the suite green; nothing can be corrected — a wrong
statement in a daily log is permanent by design, and the only thing that
changes is what the summaries above it say; the benchmark that carries
the project's central claim lives in another repository, so no result is
committed here; and no commit since 25 April 2026 |
hippo-memory |
A memory row carrying strength, half-life, layer, emotional valence, schema fit, outcome score and a confidence level | SQLite with FTS5 and a 25-plus-step migration ladder; separate tables for conflicts, goals, policies, decisions, processes and audit | Hybrid BM25 plus vector with RRF, MMR rerank, a temporal-direction boost, and a physics pass over mass, charge and temperature | capture extracts items from transcript text; CLI, HTTP
and MCP writes; auto-learn from a repository |
Record-keyed supersession honoured on read, a hard
forget, and a digest-keyed rejected-value tombstone
(rejected_values) whose guard refuses re-asserting a
rejected value at the single write choke point — exact normalized value,
not semantic |
tenant_id as a read-path predicate on the API; the CLI
is single-tenant-per-process by design and sleep is
host-wide behind a loopback and admin gate |
31 HTTP routes, an MCP server, and a large CLI | A six-phase sleep: consolidation, dedup, quality audit
that hard-deletes, auto-share, ambient state, graph extraction
drain |
A stored epistemic tier — verified, observed, inferred or stale — beside a derived age-out boolean that exempts pinned and verified rows and fires at 30 days of disuse | A scope boundary enforced in the query and deliberately suspended for consolidation, fenced at the transport layer instead; a retention prune that records its own execution | Staleness is computed from retrieval recency rather than from evidence; the quality audit deletes host-wide; the rejected-value tombstone is keyed on the exact normalized value, so a paraphrase of a rejected value still evades it |
hipporag |
Chunk plus derived entity and passage graph nodes | igraph graph with pluggable vector store (Qdrant/Chroma/Milvus) | Fact scores → LLM rerank → IDF-penalized graph seeding → Personalized PageRank diffusion | index(): chunk, OpenIE triples, fact/passage/synonymy
edges |
Chunk-scoped delete; shared entities survive by reference count | None — corpus is global | Python library only; no MCP, tools, or service | Cacheable OpenIE; incremental synonymy edges | Chunk identity only; no actor, time, or trust state | Diffusion replaces hop planning; synonymy as edges rather than merges | A hard error instead of a fallback when no query phrase seeds the graph; undirected diffusion discards predicate direction |
hive-mind |
A fact: a free-text assertion with tags, an asserted importance capped at 0.3, a source string naming app, context class, instance and session, and an optional channel of sense, act or introspect; beside it decisions with rationale, ideas, entities and typed links | Daily JSONL journal files, append-only, per-device hash chains, Ed25519-signed; a SQLite store.db with an FTS5 index, rebuilt from the journal and never authoritative | FTS5 over fact content and tags, LIKE over decisions and ideas; facts ranked by effective confidence decayed at query time, or by recency, importance or utility; facts below a minimum confidence, 0.0 by default, are dropped | Explicit: hv remember, decide, propose, retract, entity, through the CLI, an MCP server, a Hermes plugin that mirrors the host's memory writes, or a signed module API. Synchronous, no model; identical text corroborates an existing row instead of adding one | No edit and no delete. A peer retract or a contradicts or resolves link adds negative evidence; an owner-signed forget pins the content to -1.0 and an owner-signed unforget lifts it; a decision is superseded or revoked by a link that commands only from the owner or the target's author | None on a record. A hive, one HIVE_HOME and its journal, is the boundary, shared by every agent on every admitted device; tags are an optional caller filter and the session digest picks facts by full-text match on the repository name | hv CLI for any agent; Claude Code skill and hooks for a session-start digest and save and audit nudges; a FastMCP stdio server; a Hermes memory provider; a loopback HTTP module API with signed requests | A sync daemon exchanges Merkle chunk hashes with peers over Tailscale every 300 seconds by default; a doctor timer self-heals the node; no consolidation, extraction or rewriting pass | Confidence derived from distinct signed identities, discounted on one device, capped at 0.70 for one principal and zero-weighted for introspect-channel claims; admission by an owner key held outside the agent's command; a contested flag that is shown, not filtered | A belief that repetition cannot raise; a signed, hash-chained journal as the only source of truth; an agent command that cannot produce an owner signature, checked by import-graph tests; a value-level forget that a restatement cannot undo | Hermes mirrors the model's own reasoning with no channel, so it counts as observation; forgotten text is permanent, synced and searchable with one flag; every command reads the whole journal; no scope inside a hive; a cross-device correction waits for an owner who cannot clear it |
hivemind-activeloop |
One row per hook event — the prompt, tool call with full input and
output, or assistant turn, as JSONB with a 768-dimension vector; beside
it an LLM-written session summary, a mined SKILL.md, a team
rule, a goal, and a per-source-file doc page |
No store of its own: seven tables in a Deeplake workspace reached by
a POST to the workspace's tables/query endpoint with SQL in the body,
plus local files — the skills themselves under
.claude/skills/, including skills mined from local
transcripts before sign-in, a pull manifest, a JSONL event cache, an
optimizer meta log and a code-graph snapshot |
Grep over ~/.deeplake/memory/ intercepted and compiled
to one UNION ALL of an ILIKE arm scoring a constant 1.0 and a cosine
arm, so any literal hit outranks every semantic hit, and lexical-only
while embeddings are off, which is the default; a docs search with a
project predicate; no per-prompt recall on any host, and at session
start the model gets team rules while the resume brief goes to the user
only |
Every hook event embeds locally and INSERTs on the turn path, after secret masking on every host except pi; a detached worker shells out to the host agent's own CLI for the summary; a second worker mines the last ten sessions in scope and asks Haiku for KEEP, SKIP or MERGE | hivemind sessions prune hard-deletes your own session
rows and their summaries; rm under the memory mount is a
DELETE FROM; skills, rules and docs append a new version
row; goals are updated in place and the version column is
vestigial |
Org and workspace are the real boundary and live in the request URL
and an X-Activeloop-Org-Id header; a .hivemind
file routes a directory tree to another workspace or opts it out of
capture; a project key filters code-docs search and the resume brief,
and nothing filters memory search |
Hooks for Claude Code, OpenClaw, Codex, Cursor, Hermes and pi, plus a shared MCP server with four tools for Claude Cowork; memory is presented to the agent as a filesystem, so it uses Bash and Grep rather than a tool API | Detached workers on Stop and SessionEnd: summary, skill mining, code-graph rebuild, doc refresh, skill auto-pull at SessionStart, an event-driven skill optimizer armed by each org-skill invocation, and a one-shot install-time mining and backfill of past local sessions | Provenance only — author, contributors, source sessions, source agent and plugin version per skill; no epistemic state, and nothing on any read path filters on trust | A correction loop that closes on a real signal: a skill invocation arms a window, an LLM judge asked the anti-sycophancy question reads the user's reaction, and a failed verdict produces a bounded edit against a protected region and a new version teammates pull automatically | That loop publishes org-wide with no review by design, its own
applied/reverted outcome states have no
producer so it never learns whether an edit helped, auto-pull installs
every author's skills with the user filter hardcoded empty, and the pi
extension's own capture writer inserts turns with no secret masking |
hivemind |
An entry: content, a scope of session or
user, a session id, a source and source type, an optional
external id, tags, timestamps, and a vector in sqlite-vec |
One SQLite file with a vec0 virtual table for vectors,
a tag table, and a partial unique index on source, external id and
scope; raw CI logs cached as files beside it |
With query text: L2 nearest neighbours over five times the requested count, a fixed distance cutoff of 1.0, then scope, session, source and tag filters. Without it: exact tag, source and external-id filters, newest first. Own-session results first, then user scope | A memory_write MCP tool taking an optional scope,
source type and external id; with an external id the write is an insert
that keeps the first row and ignores later ones |
No update or delete tool. The daemon's hourly CI-log retention sweep deletes entries tagged with the path of a log file it expires; nothing else deletes | Session scope enforced on read by a caller-supplied session id, and
dropped when that id is empty; a user scope every query reads and any
caller may write by passing scope: user |
A local daemon speaking MCP over HTTP, a hivemind CLI
that autostarts it and caches GitHub Actions logs, and a Claude Code
PreToolUse hook that rewrites gh run view --log into the
CLI; installed by Homebrew or Scoop |
An hourly retention sweep over the CI-log cache, by age and total size, deleting the matching memory entries | None; source and source_type record where
an entry came from |
A small MVP with a real scope predicate on both read arms, a test that proves another session's entry stays out, and a design document that names the write-scope tradeoff it made | The only embedder is a non-semantic hash, so text search matches only byte-identical content and a caller-supplied vector is unreachable by text; an empty session id reads every session; a cached CI run is never refreshed while its log file lives |
holo-invariant |
An entry in a hash-chained JSONL log: an original claim holding any JSON value, a correction naming the index and hash it replaces with a reason, or a revalidation receipt with outcome, method, evidence and the digest of the version it checked | One append-only JSONL file per chain, each line hash-linked to the previous one and optionally zlib-compressed; an opt-in SQLite slot mirror; zero runtime dependencies | Case-insensitive substring search over decoded entries in chain order, plus an effective view and a claim index folded from the whole log on every read; no ranking and no scope filter | Library calls append, correct and revalidate with no gate; the service facade and the holo append CLI refuse unless handed a single-use authorization bound to the content hash, built from caller-supplied reviewer and reference strings | A correction appends a record and the original stays in raw history; correcting a claim makes every earlier revalidation of it stale. Nothing deletes; prune_suggestions only lists entries older than a threshold | None over stored content; a thread id reaches the provenance packet and no read path | A Python library and the holo CLI (append, replay with search, index, resume, demo, benchmark continuity); the MCP server exposes one read-only IDX packet check and no memory verb | None; every read and every append re-verifies the chain from the genesis hash | A tamper-evident interior, required correction reasons, revalidation receipts bound to the exact version they checked, and payloads that record truth_claimed false; the head is unanchored and the claim status filters nothing | A check is bound to what it checked. A revalidation stores the digest of the effective version it examined and the index of the correction that version came from, and the claim index reports a claim's status from the latest receipt that still matches — so correcting a claim turns every earlier HELD into STALE without anyone editing those receipts, and the test asserts exactly that sequence. Corrections are appended rather than applied: each names the target's index and hash and must carry a reason, the effective view folds the latest one over the original, and raw history keeps every value the claim has held. Both appends re-validate their target inside the append lock, so a correction whose target changed between read and write is refused. The write facade binds an authorization to the SHA-256 of the exact content and refuses one whose id or hash already appears in the chain, which makes each approval single-use and target-specific. The benchmark scorer is built carefully: the fixture is hashed and "fixes the target before results are observed", the condition schema is closed "so undeclared fields cannot alter the scoring contract", and the pass condition demands full recall of current claims alongside zero resurrections, so the negative half cannot pass on an empty answer | The published benchmark measures no store. The "CI-verified reference result" is the scorer applied to a twenty-three-line condition file whose recovered, current, uncertain and lineage fields are typed by hand, and the latest-value baseline it is compared against is a dict literal in the test that copies the fixture's own answer key; no code turns a HoloChain into a condition, so the five-for-five row and the two-metric tie describe declared answers. The claim status is computed on every read and consulted by nothing: the continuity checkpoint copies it, and no read withholds a FAILED or STALE claim. The authorization that gates the write facade is built from strings the caller supplies — the CLI takes --reviewer and --approval-reference and builds it itself — and the module says it is "deliberately not proof of the issuer's identity"; the library methods take no authorization at all. Verification walks forward from the genesis hash, so deleting the last entries leaves a chain that verifies. Every append re-reads and re-hashes the whole file under a lock. And the store is 863 lines inside a repository of verifiers, receipts and research experiments that runs to well over a hundred thousand, which is the cost of entry for a reader who came for the store |
holographic |
Flat fact row plus HRR phase vector and linked entities | Local SQLite (WAL) with FTS5 and per-category bundled banks | FTS5 + Jaccard + HRR cosine, multiplied by trust; algebraic
probe/related/reason |
fact_store tool, mirrored host writes, optional
end-of-session regex extraction |
Exact update/remove; feedback shifts trust; no supersession | Category only; no user/project/session scope | Hermes MemoryProvider plugin; fact_store
and fact_feedback tools |
None; bank rebuild is synchronous on every write | None — no source, actor, or session on a fact | Deterministic hash-derived vectors; contradict as a
query action |
Three downvotes silently drop a fact below the retrieval floor; one score for truth and reachability |
holomem |
A Fact — subject, relation, object, a weight, a created
time and a last-seen time — in a Python list that is the ground truth,
and its term w · bind(S, R, O) in one complex vector of
dimension d, plus the same term bound to the month it was
learned in a second vector |
None. The fact list lives in the object; the traces are rebuilt from it on every query after a write; symbols are derived from a hash of the folded name so no codebook exists; persisting the list is the caller's job | Unbind the trace by bind(S, R) and snap the residue to
the nearest object in the candidate pool by complex cosine, returning
the winner, its score and the margin over the runner-up; the inverse
query unbinds by bind(R, O) over the subject pool with no
second index; a dated query unbinds the epochal trace by the month
symbol as well |
learn scans the list for the folded key, reinforces an
existing fact by 0.25 up to 1.5 and stamps it seen, else appends at
weight 1.0; contradict(s, r, o) multiplies every other
object of that relation by 0.35; forget_faded drops facts
whose decayed weight is under 0.18; each invalidates the traces |
No edit and no delete by name: a contradiction damps, a fade drops,
and a fact below the floor still sits in the list until
forget_faded runs; nothing records what was dropped or
damped, and relearning a damped fact reinforces it |
One object per person or project by convention; no key, no filter, no identity | A single module on NumPy, installable with
pip install git+… since 6 September 2026; no CLI, no
server, no MCP; the same author's membench harness scores
it as a memory arm |
Nothing runs; time enters through an injected clock at query and at
forget_faded |
A weight decayed from last confirmation with a 45-day half-life; a margin and a noise floor per answer, with a z-score gate the README recommends at four; no state, no provenance beyond the timestamps | A confidence gate measured in units of the trace's own noise, so silence arrives before the wrong answer does; contradiction as exact linear subtraction that leaves the old belief answerable as history; symbols derived, never assigned, so the vector rebuilds identically anywhere from the fact list; a capacity sweep committed and recomputed exactly by the README, with the project's own three retracted figures named | No persistence and no scope; capacity collapses past about a quarter of the dimension, and the cleanup pool must hold every candidate; insert is quadratic and every write rebuilds the trace; contradiction is damping so a dominant old belief can outlast a new one under decay; nine commits in five days by one author |
honcho |
Message, document/observation, representation | Postgres/SQLAlchemy with pgvector, or a Turbopuffer, LanceDB or
Qdrant adapter behind one VectorStore interface |
Working representation blends semantic, recent, most-derived; message search by ILIKE or embedding with context windows; a workspace-level dialectic that prefetches stats, active peers and peer cards, then recalls through pair-scoped observation search | Message ingestion plus queued derivation | Sessions and workspaces hard-cascade in the background; a conclusion
is soft-deleted and hard-deleted by the reconciler; peers and single
messages cannot be deleted; representation reconciliation, and a
scope-removal cascade that soft-deletes the session's explicit documents
and then walks source_ids to a fixpoint so every deduction
resting on removed evidence leaves with it |
Workspace, peer, session, collection — plus a scope, a named grouping of sessions that bounds visibility inside a peer, carried as an option on chat, representation, context and search | Hosted API/service model, Python and TypeScript SDKs, an MCP server with HTTP and stdio hosts, a shared harness-plugin core, a committed mock provider and sandbox | Deriver queues and workers, plus two membership-reconciliation jobs — backfill by copy when a session joins a scope, cascade removal when it leaves — that call no LLM at all | Source IDs, derived observations, peer/session provenance | Strong event-to-representation pipeline, and a deletion path that follows derivation rather than stopping at the row it was pointed at | Operational complexity; LLM-derived observations still need trust policy; a scope only sees messages ingested after the session joins it unless a backfill runs, and the backfill's correctness rests on an invariant the code names but does not assert |
huiran-cerebro |
A memory fragment — type, subject, content, entities, tags, status, source reference, embedding state, importance and namespace — beside content items, knowledge-base chunks and a typed entity graph | One SQLite file with FTS5 trigram tokenisation for Chinese, an embeddings table, and no service dependency | FTS5 trigram plus bge-small-zh-v1.5 embeddings fused by
reciprocal rank, over fragments, rolling summaries and knowledge-base
chunks |
CLI subcommands, a web console, or MCP tools; session check-ins skip a same-day near-duplicate at write time; content items carry a source type, a source tag and an authorization reference | A Jaccard dedup function that marks the later of two near-identical
fragments merged and keeps its text; its one caller,
lifecycle --dedupe, passes dry_run=True, so no
shipped entry point writes the mark. Content items carry a version and a
parent id |
A namespace column on fragments only, which no write
path sets, so every fragment is default; the unified
search's namespaced branch queries tables that lack the column |
An MCP server with a written guide for Doubao, a Flask web console, and Windows batch launchers | Rolling summaries from event fragments, a daily brief, and lifecycle passes run by hand; the dedup pass runs as a preview only | A fragment status that listing, rolling-summary input and vector indexing filter on and keyword search, the start-of-day block and already-computed vectors do not; no shipped entry point sets it. A retrieval-audit table records what was asked; content items carry an authorization reference nothing reads | The dedup function makes the right decisions and states them. It
marks rather than deletes — the docstring says 不删原文, do not delete
the text — and keeps the earlier fragment on the stated ground that the
first writer is the information source, which is the right call when the
later copy is a restatement rather than a correction. A
dry_run flag returns the candidate pairs with their scores
and changes nothing, so a threshold can be tuned before it is applied.
Around that, the engineering is proportionate to its scale: one module
holding the schema and the operations, FTS5 with trigram tokenisation
because Chinese has no spaces to split on, a read-only conflict scan
exposed over MCP, a version constant a script syncs the README badge to,
a doctor command, and a pre-publication scan for private
terms that can read the whole git history |
The merge is unreachable as shipped. dedupe_fragments
writes by default, and its one caller, the
lifecycle --dedupe command, hardcodes
dry_run=True while telling the user that re-running with
the same flag will mark the duplicates; the README documents a
--dry-run flag the parser does not declare. Were the mark
written, it would withhold little: search_memory, behind
the MCP recall and search tools and the web
console's question box, collects FTS and LIKE hits with no status
predicate, the start-of-day block reads fragments three times without
one, and a vector computed before a merge stays in the index until a
reset. There are no tests. The pairwise dedup scan grows with the square
of the store. namespace exists only on fragments and
nothing sets it. The README carries a section addressed to LLM readers
alongside an llms.txt |
humans |
An immutable canonical record — type, source, timestamp, text,
embedding, provenance, metadata, an optional supersedes_id
— plus, for every event, language-free projections into the vaults of
the graph nodes it touched: activation, preference, confidence, pulse,
with the experience id shared across a turn's inbound message, reply and
receipt |
One SQLite database per mind — sixteen tables: records with two immutability triggers, record links, concepts, directional edges, edge evidence, vault membership, traces, outcomes, experience cycles and returns, experience state, node dynamics, recurrent pulses, projections, overlap clusters — bound to one embedding space and dimension on creation; a cortex checkpoint directory beside it | Two paths. The library's recall runs a direct dense
top-3 rail that graph candidates cannot evict, graph-selected vaults
with dense and BM25 retrieval inside them, a working memory that retains
prior injections, and a character-budgeted renderer that prefixes each
record by its type; the shipped mind runs none of that automatically —
/recall must be selected as a LOOK ability and then scores
active language records by token overlap, cosine and phrase match,
returning eight, rendered deterministically and never placed in the
model's prompt |
Every heard message, spoken reply, ability return and notification
becomes a record on its lane; /remember adds a fact record
after an exact case-folded duplicate check; only a HEAR event may create
word-derived membrane evidence, a SEE or NOTICE payload gets an opaque
embedding under its lane's namespace; writes are synchronous on the
event-loop thread |
No update and no delete: the triggers abort both, and there is no
forget verb; a correction is a new record with
supersedes_id, which the active-record queries honour, and
the library's remember accepts it — the command line's
/remember never passes it, so on the shipped surface a
wrong fact is corrected by nothing and can only be outranked |
One database is one lineage, owned by whoever created it; records
carry a source_id that no read path filters on; the lane a
record arrived by is the one filter — language recall sees heard records
only |
A CLI (habitus-mind) with /remember,
/recall, /open, /run,
/state and --once … --json; a Python library
(BaseAgenticMemoryRAG) with remember and
recall; a local Ollama model as the speech motor behind a
small ChatModel protocol; an offline playground with a tiny
cortex and a fake motor; no MCP, no HTTP |
Nothing outside a pulse: a recurrent SELF pulse, desire pressures and the cortex update per event, six lanes queue concurrently on one event loop, an ability's return closes its experience cycle; no consolidation, no decay, no rewrite of the store | Immutability and supersession as the only states; a
verified flag on receipts, tool results and observations
that the renderer turns into I directly verified against I
observed, and a THOUGHT record rendered without treating it as
verified, none of it filtered; a verified external outcome cannot
be recorded without a receipt id; experience preference as a
confidence-weighted mean |
Immutability enforced in the database rather than the code; the speech model receives the current utterance only, and a test proves the prior event's text is absent from the next call; a committed negative case with its control in the same test for the language boundary; receipts with hashes on every ability; a whitepaper that tables what is not demonstrated | Supersession has no writer on the command line, so the shipped mind
cannot correct a fact; /recall on the shipped surface is a
full scan of active records with a hand-tuned score; one database is one
user with no scope key; nothing forgets; no benchmark artifact is
committed and the whitepaper's evidence manifest hashes files Git
ignores; three commits in one day by one author |
hungry-hippa |
An episode, a belief, a procedure, a relationship or an evidence row
— evidence carrying a kind from user_explicit through
tool_result to agent_inference and
derived_pattern |
Local SQLite under reversible migrations, each carrying
up and down; raw evidence rows are
immutable |
Entity lookup with keyword and vector search in parallel, bounded graph traversal, an actor/status partition, then ranking by salience × recency × relevance × confidence | Writes pass a quota table, and every mutation writes a
mutation_log row — enforced in code rather than by triggers
"so the log carries rich context" |
Status transitions to archived, compressed or purged; supersession is preferred over deletion and the context compiler prefers active over superseded | A per-row owner check on every retrieved item, decided by identity rather than by the actor label a caller passes | An MCP server so several clients share one local store, plus importers for other tools' histories | Consolidation, forgetting sweeps and quota enforcement | A status partition with an opt-in quarantine, an identity-decided read policy, a mutation log, and a score explanation that deliberately carries no memory content | The test suite is the artifact to read:
test_existence_oracle.py,
test_confused_deputy.py,
test_injection_framing.py,
test_trust_boundary.py, test_trust_token.py,
test_quarantine_cli.py, test_supersession.py,
test_provenance.py, test_file_permissions.py,
test_resource_limits.py — attack classes named as files in
a fifteen-thousand-line project. The existence-oracle file carries a
finding the project made against itself, and it is the most useful thing
in this repository: recall returned
excluded=[{"item": "belief:B-0002", "reason": "other-actor"}]
for a topic matching a protected memory and [] for one
matching nothing, and "[t]hat difference answers 'does the operator hold
a memory about X', and the row id leaks sequential identifiers". The
disclosure that helps an authorised caller understand what was withheld
is, unchanged, an oracle for an unauthorised one. The read policy that
followed is stated as a rule rather than a heuristic — "[t]he operator
and the runtime's own background work read everything; an untrusted
caller reads only its own rows. Identity decides, never a label" — and
the score explanation is built so that it "never contains memory
content, so it cannot leak quarantined or otherwise unauthorized text",
closing the same side channel one layer up |
The mutation log is enforced in code rather than by triggers, which
the schema docstring states and justifies — richer context — and which
means a new write path can omit it without the database noticing;
thirty-two call sites cover the paths that exist today. Evidence kinds
distinguish user_explicit from agent_inference
and derived_pattern, but nothing found withholds on that
distinction, so provenance ranks and labels rather than gating.
importance and confidence are continuous
defaults of 0.5 on every episode, so an unset value is indistinguishable
from a deliberate middle. The tests are run_all()-style
modules returning result lists rather than pytest functions, so an
ordinary pytest run exercises less than the file names
suggest and the harness is the entry point. And the store's own framing
— one local database several MCP clients share — is what makes the
identity check load-bearing rather than decorative: the whole design
rests on callers being distinguishable |
huqan |
Two units. A graph fact: a subject node and an edge with weight, confidence and provenance, parsed from text by a rule-based extractor. A memory record: content, status, provenance and metadata, used for error-prevention rules and searched by memory_query | SQLite through better-sqlite3 with a JSON-file fallback; graph nodes, edges, an append-only audit_log, candidate claims, a mutation journal and hash-chained mutation receipts, a separate memories table with an event log, and a tool_approvals queue. No cloud and no API key | Graph lookup for ask and reason in one workspace; BM25 by default for memory_query, with substring and recency modes, followed by a recall gate that withholds inactive, unprovenanced or other-workspace records and marks stale ones | A mutating MCP call is classified review and queued as a pending approval; once approved, learn runs the memory admission gate and writes only on allow, logging REVIEW or REJECT otherwise | Graph edges are reinforced by weight and pruned below a threshold; decayed isolated nodes are deleted with an audit event. Memory records are superseded, tombstoned or archived in place and kept | A workspace key in every graph and memory-record primary key and on every read; on the stdio MCP server the workspace is a model-supplied argument and no caller workspace is bound | Seven binaries — CLI, stdio MCP server, a pre-execution hook for six coding agents, a Windows approval-authority service and three experiment labs — plus an HTTP server and a library export | None by default. An opt-in auto-think timer runs dream, whose candidate edges go through admission; optimize decays and prunes when invoked | A review queue whose approve verb is hidden from the model and needs an HMAC capability from the server's environment, an interactive-terminal check on the CLI approve, an admission gate with four outcomes, a read-time recall gate, and an optional identity-resolving oversight runtime an embedder injects | The model and the approver are separated by a secret rather than by a label. Every mutating MCP tool classifies as review, the approve verb is filtered out of tools/list, and calling it needs a capability HMAC-signed with HUQAN_MCP_OPERATOR_TOKEN from the server's own environment and bound to the approval id and argument hash. A committed contract test asserts both halves: approve absent from discovery, and a wrong secret leaving the row pending. The CLI approve refuses unless stdin is a terminal and the id is typed back. Writes that admission refuses leave an append-only audit event carrying the text and a receipt id | What HUQAN calls quarantine is a refusal: a quarantined write is not held anywhere a person can release it, only described in an audit event. On the stdio MCP server the workspace is whatever the model names, and the cross-workspace gate runs only for an embedding host. The identity-resolving oversight runtime with separation of duties ships as a library export no binary constructs, so a default approval records no resolved identity. HUQAN_HUMAN_APPROVAL_DISABLED auto-approves every review. Edge pruning deletes without an audit event. The surface is very large for a gate, with seven binaries and an HTTP server |
hy-memory |
Chat: a MemoryNode in one of eight layers (basic info, raw turn, fact, summary, schema, intention and two reserved), with owner, tags, a lifecycle status, a supersession chain and a caller-supplied event time. Working and Coding: a session fact plus reusable experiences, and for Coding a per-function diff chain | Chroma by default, or Qdrant or FAISS, for chat nodes; Kuzu or Neo4j for the schema and intention graph in ultra mode; SQLite for history, the operations cache, coding facts, experiences and diff threads. MemHub adds its own SQLite ledger of evidence, governed memories, versions and grants | Vector search over layers filtered by user, agent or session key, status active and latest, with optional BM25 fusion, tag and entity boosts, a local cross-encoder, graph expansion in ultra and evolution-chain expansion of hits. Coding adds lexical and workspace-scoped search and attaches diff chains. MemHub re-filters HY's ranked ids through its ledger | Synchronous in add(): the raw turn is stored, one model call extracts facts, intentions and basic info, a second compares them with the user's candidate memories and returns ADD, UPDATE, SUPERSEDE or DELETE ops, which the writer applies; the raw turn is then shadowed. Summaries and graph projection run as background tasks | UPDATE rewrites a fact in place; SUPERSEDE marks the old fact superseded and links it; the reconciler's DELETE shadows it. client.update re-embeds by id; client.delete hard-deletes vector and graph rows and restores a deleted chain head's predecessor to active. MemHub deletes softly and queues the HY delete | SDK: an isolation key of user, agent and session, with search requiring user_ids and filtering on them; reconcile candidates are user-wide across agents by design; get, update and delete by id are unscoped, and the OpenClaw tools take a model-supplied userId. Coding: workspace and branch filters. MemHub: grant envelopes with all-apps, workspace and source scopes on every external read | Python SDK, a stdlib HTTP server on 127.0.0.1 with no authentication and CORS open to any origin, an OpenClaw plugin with six tools and auto-recall and auto-capture hooks; MemHub ships an MCP server, a recall broker, Claude Code and other host hooks, a desktop app and a CLI | Episode summaries and graph projection scheduled after writes; System 2 schema induction, cross-domain sweeps and forget-marker retirement only when evolve() or sweep() is called in ultra mode; MemHub's processing runner imports transcripts from granted sources and calls HY ingest | No epistemic state. SHADOW and SUPERSEDED are lifecycle states that the read filters honour; NEGATED and CONFLICTED have no writer, schema_status is never set, and source_type and confidence rank. MemHub writes every memory confirmed on arrival and converts legacy candidate rows to confirmed | A grant envelope that a model cannot widen, built by the broker and re-checked by Core; a correction ledger that refuses a model write resting on evidence a person overruled; a zero-LLM diff chain recording each version of edited code; exact-list negative tests on real stores | One model setting drives write and read-side model calls; model-chosen target ids are applied without checking they were among the candidates; deleting a correction resurrects the value it replaced; the SDK server has no authentication and open CORS; the OpenClaw tools let the model name any user, so no shipped agent surface holds a scope on the SDK; no harness for the published model numbers |
hyperconsciousness |
A sealed, signed record whose JSON payload is a note with kind, tags, a sensitivity level and text; managed captures add a producer context and a version with an upsert or retract operation | Per-device append-only log segments of fixed-header binary records sealed with XChaCha20-Poly1305 and signed with Ed25519, rolled at 1 MiB, plus content-addressed encrypted blobs and rebuildable encrypted caches for search, files and permissions | Literal substring search newest first with a bound cursor, or an opt-in BM25 relevance mode over word prefixes computed over authorized candidates; an encrypted trigram fold narrows candidates; no vectors and no model | Explicit: hc write, MCP remember and remember_many, or HTTP capture, each one synchronous fsynced append; a batch of up to 250 is checked item by item against the grant before any lands; versioned captures are retry-safe | No delete and no correction for ordinary notes. A managed capture is superseded by a higher version or retracted by its own principal; old versions stay in the log and are hidden on grant reads and hc read | Signed, expiring, attenuable grants over kind, tags, sensitivity and a write-time window, checked per record on every MCP read; workspace paths become tags; spaces and company roles are separately keyed compartments | A stdio MCP server bound to one grant, the same tools over HTTP with OAuth and DPoP, a company gateway with signed requests, a CLI, and agent skills including ingestion recipes for chats, Slack, GitHub and documents | None over memory. An optional service replicates signed logs to peers or a keyless S3-compatible remote; caches advance from verified log tails on the next read | Fixed labels only: search output is marked untrusted evidence and capture claims unverified; no status field and no review; conflicting content under one capture version hides that version | Enforcement at the key-holding node with every grant in the chain checked per record; a hash-chained signed log that is the store; corrections hidden on every grant path and its point reads; recall evals that grade leaks and reject always-empty answers | hc find, which the agent skill lists before the MCP tools, reads the whole local store without grant, sensitivity or retraction filtering; ordinary notes cannot be corrected or deleted; sensitivity is whatever the writer typed; a remember with kind revoke revokes the writer's own grant |
hypha |
A managed record \u2014 typed content with a canonical text and summary, a structured scope and its hash, a five-value visibility, a source and provenance block, four unit-interval scores (confidence, importance, strength, salience) plus a decay score and access counters, an eight-value status, a separate seven-value index status, typed entity and relation references, a content hash, expiry and deletion timestamps, and the flags immutable, sensitive and humanVerified | A managed record store with pluggable structured stores \u2014 vectors, idempotency, extraction state, external mappings and lifecycle tasks \u2014 over local adapters or MongoDB, with client adapters for several third-party memory services beside the native in-process provider | Hard filtering, then score fusion, then a stable tie-break, then a replayable explanation addressable by snapshot id. Ranking combines exponential recency against a configurable half-life with importance, confidence, an authority score derived from the source type, a verified feature and reinforcement from strength | The native path hashes the content and the scope, stamps the record
active with a pending index state, and on a rewrite links
the previous version through a supersedes relation rather
than editing it. An outbox and a leasing worker carry the record into
the vector index, with a dead-letter manager for exhausted lifecycle
tasks |
A correction writes a new version related to its predecessor by version id; statuses carry a record through superseded, invalidated, deletion_pending and deleted, and the read gate drops the last two unconditionally. Nothing is keyed on the content of a removed record, so the same material can return under a fresh id | A structured scope hashed to a scopeHash stored on
every record, compared for equality as the first test of the retrieval
gate, with the same boundary enforced at the provider adapters.
Visibility is a second five-value axis \u2014 private, session,
workspace, tenant, shared \u2014 filtered beside it |
An MCP package, a production harness, a skills and tools surface and a domain-pack model, across seventeen workspace packages | An indexing outbox with a leasing worker, a lifecycle task queue with retention tasks, provider reconciliation, bounded recovery and a dead-letter manager | An eight-value lifecycle status deciding admission, four separate
unit-interval scores deciding order, a conflict-free retrieval filter
that excludes any record carrying a contradicts relation,
and a humanVerified flag that four call sites read and
nothing writes |
A scope hash compared before every other test in the read gate, with no path that skips it; a status that withholds rather than ranks, kept apart from the four scores that rank; an index state that never has to borrow a value from the trust state; a retrieval explanation replayable by snapshot id with a committed equality assertion; and an exclusion test measured against a result proven populated in the same case | humanVerified has a retrieval filter, a second filter
in the managed store, a ranking feature and a conflict check reading it,
and no writer anywhere in the repository \u2014 so
verifiedOnly returns the empty set by construction and the
verified score is always zero; contentHash is stored on
every record and consulted by no write path, leaving the material for a
tombstone unused; the memory events are published to an event bus rather
than persisted, so there is no durable record of what changed; the scope
gate enforces consistency rather than entitlement; and sixteen workspace
manifests carry floating version ranges |
iai-pme |
A verbatim records row in one of five tiers, carrying
an embedding, a hypervector, community and centrality,
pinned and never_decay,
last_reviewed and labile_until,
tombstoned_at and live, a JSON provenance list
of every capture, recall, hint and rescue that touched it, tags
including entity: anchors, a language, and an
s5_trust_score float; typed edges between
rows, contradicts and invariant_anchor among
them |
SQLite by default with every text field AES-256-GCM-encrypted under
the record id as associated data, or the project's own
lilliengine — a SQL parser, executor, catalog, pager and
WAL in Rust that CI runs the suite against — behind one
hippo table layer; an encrypted capture spool; an
in-process exact-cosine matrix and an HNSW index that are caches, never
the source of truth |
An exact-cosine authority over a resident matrix beside an HNSW
lane, a warm BM25 lane fused by rank, the community graph and Hebbian
edges as rank inputs, anti-hits read off contradicts edges,
a stale downweight of 0.5 for a hit whose derived valid_to
has passed and a cap just below its best served corrector;
memory_search is reciprocal-rank fusion of BM25 and cosine;
memory_temporal_recall bounds rows by
created_at and tombstoned_at at an
as_of |
memory_capture stores a turn verbatim and folds a
near-duplicate at cosine 0.95 into the existing row as a reinforcement;
per-client hooks capture turns through an encrypted spool a daemon
drains; memory_contradict inserts the corrector as a new
row and a contradicts edge and never edits the original;
sleep cycles cluster, summarise, decay, tombstone, re-score and
re-tune |
No in-place edit of a memory's text. Supersession keeps both rows
and derives valid_to at read time. forget_hint
queues a row and rescue cancels it; the nightly erasure
step tombstones rows by centrality, idle time and age, sparing
pinned and never_decay, and the optimize step
hard-deletes tombstones past a TTL; blob-quarantine and
idem-dedup tombstone with live = 0; a hard
delete marks the HNSW label deleted and journals it |
None. One store per person, episodes_recent is
"GLOBAL across all projects", and session_id lives
only in provenance and event rows |
MCP over stdio through a TypeScript wrapper exposing fourteen tools;
capture and recall hooks installed per client for fifteen named hosts; a
Tauri desktop BrainView; an iai CLI with a 33-check
doctor |
Sleep cycles timed from OS idle with a 48-hour starvation backstop:
cluster replay, summaries, dream decay, erasure, an LLM reconsolidation
critic, curiosity mining, entity linking, knob tuning; at most one
claude -p call per REM cycle, capped at 1% of the
subscription's daily quota |
A float. s5_trust_score defaults to 0.5, is bound into
the structural hypervector as a CERTAINTY role, and gates
an identity-tier write at 0.9 behind a three-of-five consensus and an
injection shield; stale is derived from a corrector's record
time and spent as a 0.5 multiplier and a rank cap, never as a refusal;
labile_until opens a window after every retrieval in which
reconsolidation may rewrite the row |
Supersession that keeps both versions and can serve either on request; a forgetting queue with a visible undo and a tombstone with a TTL before the hard delete; an events table that only grows and encrypts its payloads; seven committed contradiction-benchmark runs whose Markdown records a failing gate beside the passing ones; a doctor row asserting the paid SDK is absent | The README's "validated in a single harness against mempalace" is contradicted by the project's own BENCHMARKS.md, which says the baseline is a published number not re-run, and the harness has no competitor mode; a restated stale fact is folded into the stale row as a reinforcement; the store, the keys and the encrypted spool all sit under one home directory with no scope of any kind; the sleep cycle's LLM critic can rewrite a row inside its labile window unattended |
icarus |
An entry — a typed claim in a Markdown file with evidence pointers, a verified status and a lifecycle | Markdown files with YAML frontmatter under a root directory, written atomically, version-controlled by git | Keyword, embedding or hybrid recall with a status filter that defaults to excluding contradicted and rolled-back | Pydantic validation with extra=forbid, a legal-transition check, and evidence pointers carrying optional SHA-256 | Nothing is overwritten — supersession links forward, contradiction links to the contradictor, rollback is terminal | project_id, session_id and agent are optional filter parameters rather than an enforced boundary | A Python library, a CLI and an MCP server with ten tools, plus start_session and end_session briefings | None — briefings are computed on demand and cached to disk | Four verified states with an explicit transition table, held separate from a two-value freshness lifecycle | Rollback taints every descendant of the reverted entry, and the default search proves they do not come back | The verifier is a free-text string defaulting to manual, so the log cannot tell a person from the agent |
ihmt-memory |
A leaf: a UTF-8 text chunk with a JSON header (timestamp, ingested_at, domain, type, tags, keywords, status) in its own .txt file; beside it, regex-extracted subject-attribute-value facts on a timeline | One directory per IHMT_HOME: layer_0 leaf files by domain, layers/N branch JSON, root.json trunk, state/catalog.json and state/facts.json, all written by atomic replace | Tree descent from root.json: BM25 over sibling descriptors, a beam of three branches per level, zero-score leaves dropped, catalog HISTORICAL leaves skipped; a confidence and tie test returns AMBIGUOUS and asks for a clue | Explicit save_memory over MCP, or CLI ingest; synchronous chunking, fact extraction and consolidation in the call; a leading date becomes the leaf timestamp when the detector picks the temporal chunker | Append-only from the agent. A newer fact demotes the older one to HISTORICAL and annotates its leaf, which stays ACTIVE; only CLI re-ingest of a changed file demotes leaves; no delete or forget verb | Physical: one store per IHMT_HOME directory, shared by every agent pointed at it; per-project code indexes are separate stores. No scope key on a leaf | Stdio MCP server with eight tools, usage rules appended to CLAUDE.md or AGENTS.md, a CLI, a Python facade and a read-only loopback GUI; no session-start hook | None. Consolidation and the trunk rewrite run inside each save; an optional Anthropic summarizer is called there when selected | None as a state. Facts carry ACTIVE or HISTORICAL by recency; retrieved leaves carry OUTDATED notices; the provenance label is mcp://claude-code for every agent | Plain readable files that rebuild their own index; deterministic leaf ids; parent written before children point at it; a refusal to guess on near-tied matches; supersession notices travel with the old text | The fact timeline never reaches leaf ranking, so old and new values tie; under-recall in the beam reads as nothing stored; several agents write one store with no lock on the catalog or the timeline |
inite-brain |
A knowledge_fact — subject entity, predicate, object
value — carrying validFrom/validUntil for
real-world validity, recordedAt/retractedAt
for knowledge time, a status from a six-value set,
supersededBy, derivedFrom, a
confidence, an optional userId, and a
source object naming the recorder; plus
knowledge_entity, knowledge_edge,
fact_usage and memory_outcome rows |
SurrealDB, one database per tenant named
co_<companyId>, with 146 ordered .surql
migrations as the source of truth for the schema |
Hybrid search composing a WHERE from named fences — retraction, contest, insight-row arbitration, user scope, scope tags, validity window — plus vector and graph lanes, a multi-hop expander behind a fail-closed edge fence, an entity profile closure, an entity timeline, and a competing-pair list with its own as-of axis | REST and a native MCP server ingest facts; conflict-aware ingest
sets competing on a contradiction rather than overwriting;
a supersede sets validUntil and supersededBy
and deliberately leaves retractedAt unset; compaction
writes skeletons; the dreams pass corroborates and retracts |
POST /facts/:id/retract stamps retractedAt
behind an ownership fence that 404s another user's fact and 403s a
tenant-global fact for a user-bound token without
brain:admin; entity forget hard-deletes an entity with its
facts, edges and embeddings in one transaction and leaves an HMAC-hashed
forgotten_entity row as proof of erasure |
Per-tenant database; a stored userId on facts and
edges, enforced unconditionally on the search lane and behind
READ_SURFACE_USER_SCOPE on the timeline, the competing list
and entity reads; an ABAC row policy over predicates and sources; PII
predicates gated on caller scopes |
REST under /v1, a native MCP server with read and write
tools, admin routes under /v1/admin behind
brain:admin, packs, skills and a landing app |
A changefeed drain mirroring data changes into
audit_event behind a leader lease, a dreams/consolidation
pass, compaction, embedding and index maintenance jobs, and an
operator-action retention prune |
Stored status, per-fact confidence, provenance through
source and derivedFrom, an ABAC policy with
report-only and enforce modes, and an operator-action log over admin
HTTP calls |
Two time axes kept genuinely separate, with a committed test pinning that the profile and search agree about the same instant; a fail-closed idiom repeated across search, graph expansion and edges; migration comments that name the failure each migration fixes; a retract path whose ownership fence was added in response to a dated audit finding | The per-user fence on the timeline and the contradiction list is off by default, so a personal fact yields no timeline event and a personal contradiction is never adjudicated; the GDPR tombstone proves erasure but no write path consults it, so a re-ingest restores the entity; the data-change audit mirror is disabled by default and the always-on log covers admin HTTP calls rather than memory mutations; the memory-decisions review surface is read-only |
inno-agent |
Three: an L1 learner profile of goals, per-concept knowledge states
and misconceptions; an L2 wiki page in Markdown with typed frontmatter
and [[wikilinks]]; an L3 chunk of one user or assistant
turn |
profile.json plus an append-only
events.jsonl for L1, a Markdown wiki tree with a
manifest.jsonl for L2, and SQLite with FTS5 for L3 — all
under a per-workspace data directory |
L1 is projected and injected whole rather than queried; L2 is
keyword matching over manifest fields falling back to page bodies; L3 is
FTS5 lexical search over conversation chunks with an
excludeSessionId option for cross-session recall |
Tools the model calls — record_learning_evidence and
record_learning_event for L1, l2_archive for
the wiki, automatic background indexing for L3 — plus
patch_learner_profile and
update_learner_profile, which write the profile
directly |
Knowledge state is recomputed from evidence on every read rather than updated in place; misconceptions transition by status; goals and profile fields are edited or deleted from the web panel; L3 chunks are deleted per session | Single-learner by design — the README lists multi-user as a non-goal. Separation between workspaces is the data directory, and no scope key reaches any query | Built on the Pi coding-agent SDK with the kernel unmodified — memory is added as registered tools plus one extension hook. Ships as an Electron desktop app, a React web UI over an HTTP server with SSE, and a terminal CLI, all sharing the same runtime state | A cron scheduler for proactive sessions, mtime-gated incremental L3 indexing, and an L2 wiki maintainer that links pages, detects dangling links, orphans, duplicates and contested pages, and writes an overview | Typed evidence with per-kind weights, a hint-level and spacing multiplier, and an evaluator confidence; a categorical result that constrains the optional numeric score; a misconception status that gates teaching; a learner-facing panel that edits the profile | The evidence model is the most carefully reasoned in this family:
eight evidence kinds weighted from exposure at 0 to
transfer at 1, a hint-level multiplier, a spacing
multiplier rewarding delay, and a rule that the categorical result
constrains the numeric score so "malformed evidence can never invert the
learning signal". The misconception gate is real — one correct answer
under hints does not clear a misconception, and a later linked failure
reactivates it. The L3 indexer excludes the assistant's
thinking blocks and tool results from the searchable store
and proves it with a test. The learner can inspect and edit the profile
the agent teaches from |
patch_learner_profile writes an absolute
mastery, a free-text diagnosis and an
evidence_ids_append list that nothing resolves against
events.jsonl, and update_learner_profile
submits whole knowledge-state objects including
estimate_confidence and the retrieval counters; neither
appends to the event log, so the append-only record does not cover the
profile's write paths. A non-empty evidence_ids raises the
estimate-confidence ceiling from 0.35 to 0.6 and doubles as the dedup
key that makes real evidence be skipped, while the array mixes
event_id and evidence_id values written by two
different code paths. The misconception status ladder has four values
and the read filter tests only active, so
repairing stops blocking teaching immediately. The web
PATCH casts body.status to the status type with no enum
validation where the tool path uses a schema. events.jsonl
rotates at 10 MB and the rebuild replays only the current segment |
inspeximus |
A record with a key, an optional explicit object
carrying the value, a status, a tenant, an owning agent, an event time
and a record time, a nonce and receipt material |
A SQLite row store or a JSON file, plus a hash-chained receipt sidecar, a tombstone chain, an event table, monthly archive segments for captured mechanics, a Merkle transparency log and witness co-signatures | Lexical recall over a filtered view, ranked by relevance and accrued value, with optional embedding ranking when an embedder is configured; read guards quarantine instruction-shaped text and demote keyword stuffing | remember() and route(), both passing the
echo and objectless guards; reaffirm=True and
revert() are the named bypasses, and
store.last_write reports a demoted write |
Correction supersedes by key and object; retire() ends
a key with no replacement; forget(),
forget_subject() and forget_pii() erase and
leave deletion receipts; apply_retention() erases by
age |
Tenant and grant-based agent ACLs in the view every read on a bound handle passes through, for a host that opens one in its own code; optional scope, project, user, agent and session filters on recall. The shipped MCP server reads through an operator handle that binds no tenant, takes the agent name from the caller and lets the caller lift the project scope | A zero-dependency core module, an MCP server, a Claude Code plugin
with five hooks, install --all for nine coding agents,
framework adapters, and LangGraph and ADK packages |
Consolidation and supersession passes on sleep(),
optional retention, an optional prompt daemon, archive tiering, an
erasure auditor, a witness pool and timestamping |
A status allowlist on recall, Ed25519-signed receipt chains with the
head kept outside the store, a Merkle log with witness co-signature,
strict corroboration counting distinct verified keys, GDPR objections
that withhold a subject, PII detection, and a provenance()
whose limits field states what the guarantee does not
cover |
The echo guard is a tombstone keyed on the value, consulted on every
keyed write, with a named bypass and a caller-facing verdict. The
comment above it cites its own probe, gives comparative stale rates
against recency, mem0-v1, a bi-temporal-Graphiti-faithful policy and a
verbatim-hash policy, and states its own defeat condition: paraphrase
resistance "comes ONLY from the OBJECT being value-preserving",
embedding near-duplicate cannot separate a same-value paraphrase (cos
mean 0.95) from a different-value correction (0.84) at "~42% false-block
at a 0.9 threshold", and "an echo that OBSCURES the value (coreferent
'her old hobby') is NOT caught." It records two shipped bugs in the same
place: the guard defaulted off so "the adapters missed it for ten
releases", and the documented off-switch was dead.
_serving_class commits the withheld or served class rather
than the raw status to avoid "chain churn proportional to housekeeping,
and fourteen chances to miss one". The ACL is tested by a sweep over
every public method with its own positive control |
The guard is text- and object-based by design, so an echo that names
the value indirectly is not caught. The ledger is the retired rows, so
retention and erasure remove values from it. as_of() and
believed_at() apply no status predicate, so a provisional
keyed write answers a point-in-time read that recall would
withhold. The shipped agent surface, the MCP server, is an operator
handle: tenant is unbound, recall and get read
everything, the agent name on recall_as is supplied by the
model, all_projects=True lifts the project scope, and
reaffirm=True on remember lifts the guard
unless a revert authority is configured.
remember(agent_id="*") stores * unchecked. The
README's comparison figures are the project's own measurements at n=30
per system, and none was reproduced here. The "one zero-dependency
Python file" framing describes core.py running standalone, not the
package |
intaris |
A behavioural profile keyed on (user_id, agent_id) — a
risk level from 1 to 10, active alerts, a context summary, a profile
version and the analysis that produced it — beside audit rows that hold
the decisions it was derived from |
SQLite or Postgres, with a dual-dialect schema and migrations;
behavioral_profiles, behavioral_analyses,
analysis_tasks, session_summaries,
audit_log and an event index with projection state |
The profile is fetched by key before an evaluation, and human decisions for the current session are read from the audit log and matched by a precedent signature | Every tool call is classified and evaluated, and the row is written whether it was approved, denied or escalated; a background analyzer derives profiles from that history | A profile is replaced by the next analysis with
profile_version incremented; audit rows are updated in
place when a human resolves an escalation |
user_id is a tenant identifier in every query, with
agent_id beside it in the profile key |
A guardrails service between an agent and its tools — MCP, OpenCode, Claude Code and OpenClaw — with WebSocket streaming and companion services for memory and control | An analyzer that builds behavioural profiles from audit history on scheduled tasks, an idle session sweep, and session summarisation | A risk level of 1 to 10 on the actor rather than a status on a memory; a final human decision is authoritative and judge-authored decisions are deliberately excluded from that class | A durable, versioned profile of the agent's own behaviour read back before the next decision, and precedent matching that generalises one human approval across an equivalent capability family without becoming blanket approval of a tool name | Audit rows are updated in place on resolution, so the record a profile derives from is not append-only; precedent lives only within a session, so the same judgement is asked for again in the next one |
invalidate |
A fact stored verbatim, with a namespace, a kind, a source, a status, a probability of being true, created and updated times, a last-checked time, an optional lease, a superseded-by pointer, and a cursor into the event log | SQLite by default — memories, events and verdicts in three tables — with adapters that put the same lifecycle over another store's rows | Relevance judged by the model rather than by embeddings, over a pool already narrowed to live statuses; a caller may supply candidates from its own vector store and they are re-checked before ranking | A fact is remembered verbatim and born current — the events already in the log are not evidence against it; each new event is judged against every memory that has not seen it | Nothing is rewritten. A contradicting event moves the status and, when the event states the new value, stores a successor and links the old row to it; a hard lease expires a memory on top of the semantic one | A namespace on every memory and event, supplied by the engine to every read and re-checked on caller-supplied candidates | A library, a CLI, client wrappers for two provider SDKs, and adapters for a dozen other memory and vector stores | A sweep for leases, and a lazy mode where recall drains the events a candidate has not been judged against before returning it | Seven statuses of which recall returns two, a separate probability field, a dead band that routes a wobbling vote to review, and a per-source ceiling on how far an event may move a memory | An event read as a question or as an instruction to the system is logged and never written, with prompt injection named as the reason; a kill is re-judged with the memory alone in context before it lands; and every judged pair is kept with its raw votes, including the ones that changed nothing | A fact is born current by design, so re-storing something the log already contradicted is not caught; the verdicts table is append-only by convention rather than by constraint; and the namespace is enforced by the engine, not by the store |
janus-graph |
An episode — text, name, source description — queued in SQLite, then
Graphiti's entity nodes and fact edges in FalkorDB, each edge carrying
valid_at, invalid_at, created_at
and expired_at |
A SQLite WAL queue with a dead-letter table, and FalkorDB (a Redis module) holding one graph per group id; the graph schema is Graphiti 0.29.3's | search_memory, over MCP and the daemon's
/search/memory: Graphiti BM25 plus cosine over fact edges,
MMR-reranked, restricted to invalid_at IS NULL; a daemon
/search/graph BFS from named seeds scored by cosine, with
no validity filter; entity lookup by name substring; read-only
Cypher |
add_episode enqueues with one SQLite insert; a sweep
run by cron or the daemon hands each episode to
Graphiti.add_episode, whose model calls pass through a
schema-repair wrapper |
Graphiti closes a contradicted edge's interval; nothing in the tree deletes an episode, node or edge, and the nightly deduplication and orphan-pruning phases are status strings | One configured group id for every MCP tool; on FalkorDB each group
id is its own graph, so the boundary is a partition — and
search_memory reads the graph a different setting
names |
A stdio MCP server with eleven tools, a CLI, and an aiohttp daemon
with /episodes, /search/memory and
/search/graph |
A sweep every five to ten minutes, and a nightly run whose only working phase requeues failed and dead-lettered episodes | None; source_description is passed to Graphiti as
provenance, and Graphiti's validity interval is the only correction
state |
A durable queue in front of an LLM-heavy ingest, with a reaper, a per-episode timeout and a dead-letter table; Graphiti's temporal edges reached and filtered on the one semantic read path | The repair wrapper replaces a whole extraction with an empty list
when one item is malformed, so facts vanish behind a log line;
search_memory finds nothing under the shipped example
config; dream phases report DONE without running |
jaz |
A markdown page with a slug, a type, a title, aliases, frontmatter,
a body and typed links with backlinks; plus two root-level horizon
files, LONG_TERM.md and SHORT_TERM.md, that
are injected into agent context every turn rather than indexed |
The jazmem engine — a markdown tree with a SQLite index
— pinned as a Go module dependency at
v0.0.0-20260912084437-4d801b950d2b, which is the commit
read here |
Page search and graph neighbourhood over links and backlinks, exposed to agents as a single public search tool over MCP, with the horizon files injected each turn | Pages are written through the engine; the horizon files are written through an HTTP endpoint on the local server that takes the file name from the URL path | A scheduled dream pass maintains the long-term horizon and prunes the short-term one; the maintenance scheduler can be started and stopped | None inside the store — Jaz is a single-user personal host, and the memory is one tree per install | An Electron desktop app over a Go backend with a Bun frontend, driving Claude and Codex and open-source agents, with boards, overnight loops, git control, and connectors to Telegram, WhatsApp, Gmail, Calendar and Slack | The dream runner with its own prompt templates, a maintenance scheduler gated by a live enabled flag, and indexing | The two-horizon split as a policy expressed in prompts, and a memory service documented as the single owner of the enabled gate | A considered long-term view injected into every turn rather than left to a query to find; a stated division of write authority between the dream-maintained and agent-written horizons; typed links that name the relationship and are queryable as backlinks; and a memory service written as the single owner of the engine, the enabled gate and the scheduler so nothing re-derives its own | The long-term horizon is documented as "read-only for agents" in
exactly one comment and nothing enforces it —
WriteHorizonFile accepts either file and the HTTP handler
passes whichever name the path carries; there is no scope, status,
validity or supersession on a page; and the engine is a separate module,
so the memory model is only as pinned as the Go dependency |
joplin |
A note — title, Markdown body, notebook, tags, to-do state, a trash
timestamp, a conflict flag — plus, beside it, chunk rows in
note_embeddings_meta and vectors in a sqlite-vec table
keyed to the note and the model that produced them |
The application's own SQLite database — notes, folders, tags,
item_changes, revisions — extended by
migration 52 with note_embeddings_meta and a lazily created
note_embeddings_vec virtual table; on-device ONNX inference
for the local embedding model; the whole store synchronises through
Joplin's existing sync targets, the embeddings do not |
Keyword search with Joplin's filter grammar through
search_notes; chunk-level cosine search through
semantic_search_notes with strict, normal and loose presets
of k and minimum score tuned for multilingual-e5-small, optionally
scoped to a notebook or a tag; the current note's body pre-loaded into
the chat as a synthetic tool result; no automatic injection of anything
else |
The assistant edits the open note through anchored
editor_ tools and, when a person has enabled each one,
creates, updates, tags, moves and trashes other notes through global
tools; an edit that lands while the note changed underneath it is
refused; the indexer picks up a saved note from the change feed within
about three minutes |
A note is updated in place and its previous states go to
revisions under a ten-minute collapse and a ninety-day
expiry; delete_note moves to the trash, from which a person
restores; a trashed, locked or conflict note has its vectors removed at
the next maintenance; a model change clears and rebuilds the whole
index |
One profile is one store; a notebook or a tag is an optional filter a search may pass, never a boundary the assistant is held inside; per-tool enable switches decide what it may reach at all | A chat panel in the desktop app tied to the open note;
joplin.ai for plugins with chat,
search, getEmbeddings and
getIndexStatus; an HTTP JSON-RPC MCP server, off by
default, that lists and calls the same global tools; providers
OpenAI-compatible, Anthropic and Joplin Cloud, with remote providers
behind their own opt-in |
EmbeddingIndexer ticks every thirty seconds during the
initial scan and every three minutes after, drains the change feed in
batches of a hundred, collapses repeated edits to one embedding per note
per tick, advances its cursor only after a batch completes, remembers
per-session failures, and stops itself where sqlite-vec did not
load |
No state on a note beyond the app's own flags; the assistant's tool results carry a user-facing description; an edit is refused when the note changed during the request; the chat history is not persisted and a note switch inserts a separator; every capability outside editing the current note is off until a person turns it on | Tool exposure as settings with an actionable refusal; an indexer that rides the app's change feed and rebuilds on model change; a scope test written to be non-vacuous and saying so; a token budget that refuses; local and remote classified by host with the LAN counted as remote | The assistant's memory of a conversation ends with the panel; a
trashed note is gone from the index and nothing remembers why; keyword
search returns notes the model can read whole through
read_note while semantic_search_notes returns
chunks; the MCP server hands every enabled tool to any client that
reaches the port; revisions collapse ten minutes of edits into one |
juggler |
One dated bullet — - [YYYY-MM-DD] one fact — in a flat
list under a single heading, order preserved as written |
<project>/.juggler/MEMORY.md, a plain Markdown
file, git-ignored so it never leaves the checkout |
The whole file is a context item on each conversation; there is no search, ranking or selection | One memory tool with two actions, remember
and forget; the assistant is prompted to use it only for
facts that outlive the session |
forget removes every entry matching a case-insensitive
substring and returns the list of what it took; the pin deletes one
entry on an exact date-and-text match; revision is
forget-then-remember |
One file per project checkout, per machine — partition rather than a filter | A context item in the Juggler UI, plus a seeded system prompt; every write appears in the conversation transcript | None | None. A bullet is a fact because the assistant wrote it or the user left it there | A canonical format the writer re-tidies, a per-fact delete control in the UI, and 68 committed test cases against 1,087 lines of implementation | forget still matches by substring, so one careless
match string removes more than it names — the tool result now lists
every entry it took, so the over-reach is visible in the transcript
rather than silent |
jumbo |
A domain event appended to an aggregate's stream — thirteen aggregate types, from goals to sessions | A filesystem event store, one JSON file per event, with SQLite view tables as rebuildable projections | Queries against projections plus a search index, assembled into a context banner at session start | Append to the stream with an optimistic-concurrency version, atomic temp-write then rename | No event is mutated — state is the fold of the stream, and a correction is another event | Per-project stores with project, session and goal views; no tenant key on the read path | A harness-agnostic CLI for Claude, Codex, Antigravity and Copilot, with concurrent-agent support | Three polling daemons — refiner, reviewer, codifier — each delegating a lifecycle step to an agent subprocess | A thirteen-value goal status machine with in-review, approved and rejected as first-class states, adjudicated by an agent | The log is the memory and a committed test replays a stream into a fresh database and compares the result | BaseEvent declares loggedBy as human or machine, nothing sets it, and the reviewer that approves goals is a spawned agent |
kaeru |
A typed node — episode, idea, hypothesis, task, question, summary,
reference, chain, audit event — with a tier, a memory layer from Core to
Frozen, a name, a body, tags carrying statuses, initiative membership
and a Cozo Validity in its key; plus typed, weighted edges
with their own validity |
Embedded CozoDB on RocksDB in a local vault directory, with junction relations for initiative membership; an optional kaeru-cloud service holding shared nodes for a team behind one bearer token | Exact name lookup, typed walk, drill, trace and between over the
graph, Cozo full-text search as a fuzzy fallback, layered re-entry by
awake, and point-in-time at and
history reads; no vector search |
About seventy curator verbs as MCP tools and rig tools — jot, claim with a verdict, link, synthesise, supersede, settle, chain, slot — each re-asserting nodes through the substrate and writing an audit node | Updates and supersession retract the prior validity and assert a new one, so history stays readable; nothing deletes nodes; initiatives can be renamed or deleted as memberships | Per-initiative views through junction relations, selected by the initiative the agent names or the store's current initiative; clearing it shows everything | An MCP server, a rig framework adapter, a portable agent skill, Markdown export, a shared cloud tier and a read-only galaxy visualisation | A hygiene pass, on by default in the MCP server, that moves nodes between memory layers by age and reference count | Hypothesis statuses open, supported, refuted and inconclusive as
tags, and a contradicts edge that puts a node in an
open-review queue; neither withholds a node from recall |
Non-destructive change with point-in-time reads of every node; an audit node per mutation; reasoning chains saved as recallable trails; a deterministic secret guard before anything leaves for the cloud | One time axis presented as bi-temporal; initiative scope is the agent's choice and clears to global; a refuted claim reads like any other; the shared cloud has no per-user isolation |
kage |
A packet — a typed engineering claim with cited paths, per-symbol content hashes and a chain of re-verification records | Markdown and JSON files in git under .agent_memory, conformant to Google's Open Knowledge Format | BM25 over packets with an injection gate, plus semantic expansion and a code graph, and stale packets withheld | Strict captures whose cited paths do not exist are rejected; the verdict path is deterministic with no model | status moves pending to approved to deprecated or superseded; dead packets are deleted after a retention window | scope and visibility are stored and validated but never filtered on; isolation comes from three separate directories | An MCP server for fifteen-plus clients, a CLI, a proxy, a daemon and a web viewer | A structural worker, a daemon, staleness refresh passes and a garbage collector with a retention floor | A four-value status plus a freshness verdict computed from per-symbol hashes, not from time | Staleness judged against the specific symbols cited, so an unrelated edit in the same file does not invalidate | The org audit log is three functions nothing calls, and the scope field is decorative |
kagura-memory-cloud |
A memory row with three layers (summary, context_summary, content plus details JSON), a free type string, importance and confidence floats, tags, source_type, delivery_mode (on_recall, always, on_trigger) and a working or persistent lifecycle | Postgres holds the rows and a neural_memory_edges table; one Qdrant collection holds a dense vector and a Sudachi-tokenized BM25 sparse vector per memory, isolated by payload; an embedded LanceDB backend is a preview alternative | recall fuses normalized dense and BM25 scores 60/40, hydrates from Postgres, drops superseded memories, optionally reranks; load_pinned is an unranked SQL scan of always memories; explore walks the Hebbian graph | Explicit: the agent calls remember or update_memory over MCP, or REST. The row commits with embedding_status pending before the call returns; embedding and the Qdrant upsert run in a background task with a 30-second retry sweep | update_memory overwrites in place; supersedes edges shadow an older memory out of default recall; forget soft-deletes and removes the Qdrant point, and a daily sweep hard-deletes soft-deleted rows after 30 days. No tombstone keyed on content | workspace_id, context_id and user_id on every row and point, all three required on the search path; shared contexts drop the user predicate; agent-bound keys add subtractive per-context and per-type bindings | Streamable-HTTP MCP server with 64 tools, a REST API, a Next.js dashboard, and a Claude Code plugin whose hooks fetch tool guardrails stored as memories | Embedding sweep every 30 seconds, hourly edge decay, a daily hard-delete sweep, and either the opt-in LLM Sleep Maintenance (dedup merge, re-evaluation, consolidation, all undoable) or, when SLEEP_ENABLED is unset, a legacy daily task that hard-deletes unaccessed working memories after 30 days | A context-level trust_tier stamped external only by connector provisioning, excluded by an opt-in recall filter and always by the bootstrap lanes; supersede suggestions surfaced, never auto-applied; contradicts edges annotate and hide nothing | Isolation keys required on every search call and asserted by tests; one chokepoint per predicate (pinned, guardrail) shared by readers and every automated deleter; supersede suggestions with an accept verb and a similarity-keyed dismissal; append-only audit enforced in SQL; an eval program with placebo and CI gates | Default self-host runs the legacy task that hard-deletes working memories untouched for 30 days with no tombstone or audit, over only the 100 newest per user; the pinned lane ignores supersedes edges; any non-viewer member can shadow another member's memory; audit covers agent-bound keys only |
kaisen |
Four kinds, all plain files in the project directory — a single
overwritten lessons.txt, one
memos/gen_NNNNNN.md per deep-work generation, a bounded
history list inside state.json, and a set of
semantic code hashes in seen_hashes.json |
Files on disk under the project directory, plus
.kaisen_snapshots/ holding up to 25 full project copies,
each with a meta.json carrying
{created, reason, kind} |
None. The prompt builder concatenates the lesson, the latest memo, a keyword-frequency line filtered by a stopword list or a user allowlist, and the last eight history entries into one blob; nothing is queried, ranked or selected by relevance | Synchronous and mostly wholesale. save_lesson
overwrites the file, a memo is written once per generation under its own
name, history is appended, and a candidate's semantic hash is added to
the visited set before it is scored |
A lesson is corrected by overwriting it, with no prior version kept outside the snapshot system. History is a ring truncated to the newest 500 entries. The visited hash set only ever grows | Per project by construction — every path is derived from
project.path — with no scope key inside any record and no
cross-project read |
A local web dashboard, a multi-turn agent tool loop, and KAI, a line-oriented stdio protocol letting an LLM spawn KAISEN as an optimization sidecar | The evolution engine runs generations continuously, with periodic deep-work and lesson passes driven by the project spec | No epistemic state. The nearest thing is a failure vocabulary of ten substrings used to hoist failing outcomes to the top of the history blob under an EXPLICIT FAILURE FEEDBACK banner | Separating failure feedback from ordinary history in the prompt, so a repeated mistake is the first thing the model reads rather than the eighth | The record explaining why a candidate was skipped ages out of a 500-entry ring while the block itself is permanent and, by an explicit design note, survives a snapshot revert of everything else |
kannaka-memory |
A HyperMemory: a hypervector with amplitude, frequency and phase, a hallucination flag with parent ids, an effective, observed and expiry time beside the creation time, links to other memories and a retention tier | A local holographic medium in a .hrm file persisted through chiral hemisphere layers, with sidecar files for links, sightings and reactivations; memories cross between agents over NATS and Nostr | Resonance against the medium, cosine over hypervectors with optional beam and temporal factors; rows expired as of the query instant are dropped by default, and dream rows only on request | Local remember with exact-repeat reinforcement that never matches a dream row, dream synthesis that flags what it invents, and wire absorption through one absorb_gate chokepoint that sanitises unconditionally and gates promotion on corroboration | Amplitude decay and destructive interference, a validity window set when a fact is written, and hard delete by id through forget; nothing records a rejected value | Per-agent ed25519 identity and a pubkey-keyed reputation core for peers; the memory store itself is not partitioned by any key | A CLI, an ACP binary, an agent loop with recall, remember and dream tools, a Claude Code plugin and skill, NATS and Nostr transports, and a hive bridge | Dream consolidation with Kuramoto phase coupling and hallucination bridges, belief-core telemetry, swarm loops and collective sensemaking | Ed25519 provenance with domain-separated canonical bytes and a fail-closed replay set, a quarantine staging tier for uncorroborated peer content, a hallucination flag the wire can never set, and a serve guard bounding what an inbound ask may spend | The trust boundary is at the wire, and the modules that hold it are
written like a security review. absorb_gate is one
chokepoint for every wire-to-store path whose sanitisation runs even
when the corroboration gate is dormant, and it forces the hallucination
flag to the local default. provenance.rs signs with
domain-separated, length-prefixed canonical bytes and keeps verification
pure. serve_guard states its invariant, derives the route
from local config "and from nothing else", and splits its rate limiter
because "[a]n abuse control that a stranger can turn into an outage
cheaper than the abuse is not a control". The recall tests carry control
arms that state why: "asserting 'the dream is absent' proves nothing
unless the dream DOES come back by default" |
The licence is the bespoke SPACE CHILD LICENSE v1.0, whose Peaceful Purpose grant and paid Offensive Military licence make it not open source under the OSI definition, while plugin.json and the npm package.json declare MIT. Dream rows are returned by recall by default and RecallResult carries no flag, so the agent's recall tool hands dreams to the model unlabelled. Belief-core snapshots read every right-hemisphere wavefront, dream syntheses included. Validity bounds are set only when a memory is written. Merge records and the disputed flag have no production writer. The memory core is about a quarter of a tree that also holds a swarm, a hive, mail, QUBO tooling and research surfaces |
kektordb |
A vector with a free-form metadata map — content, memory layer
(episodic, semantic, procedural), tags, session and user ids, pin,
access count, and underscore flags such as _is_historical
and _archived — plus typed, weighted graph edges carrying
created and deleted timestamps |
In-memory HNSW indexes over memory-mapped arenas, roaring-bitmap
inverted indexes, B-trees and BM25 postings, persisted by a batched
append-only file with CRC-framed records and periodic snapshots; one
index per namespace, default mcp_memory |
Hybrid HNSW and BM25 fusion with metadata filters and decay-weighted scores; graph-scoped search from a root node; adaptive retrieval that expands along edges to a token budget; path finding and subgraph extraction as of an edge timestamp | save_memory embeds content with a local MiniLM ONNX
model and stores metadata; manual links; evolve_memory
writes a new version, copies incoming edges and flags the old one
historical; a document pipeline and an AI gateway proxy index
documents |
Metadata updates, evolution with superseded_by edges,
soft deletion of edges with a deleted timestamp, vector deletion,
gardener archiving of consolidated memories by flag, and opt-in
epistemic resolution that evolves each conflicting memory into one
consolidated text |
Per index; JWT keys list allowed index names; user and session ids are stored in metadata and used by profiling and session tools, not by recall | 57 MCP tools (49 in the agent profile), a REST server with a web dashboard and TUI, Go, Python and TypeScript clients, an OpenAI-compatible RAG proxy, and a setup command writing MCP configuration for six coding clients, with a plugin for OpenCode and a skill for Hermes | The gardener: consolidation of similar memories, episodic-to-semantic summaries, and eleven detectors for contradictions, importance and sentiment shifts, knowledge gaps, preferences, repeated failures and core facts, of which the core-fact detector's selector matches nothing; decay, vacuum and graph refinement; an artifact watcher that recompiles cached knowledge | Reflections with an unresolved, resolved or needs_manual_review status, archive and historical flags, pinning, invalidation edges, and an epistemic score computed per query into crystallized, stable, volatile or contested; none is a stored status on the memory that recall reads apart from the two flags | A serious storage engine — CRC-framed AOF with corruption resync, snapshots, mmap arenas and HNSW maintenance; versioned memories that keep their history; a large, documented tool surface | Historical and archived memories are filtered only by
recall_memory, and lose that filter when two layers are
requested; the same OR-before-AND composition breaks the dashboard's
status filter and silences core-fact extraction; a person's reflection
resolution changes no memory; no mutation log outlives AOF
compaction |
ken |
A finding: a unique topic, free-text content, JSON tags carrying a kind label, an inline embedding, optional anchors on a file, symbol, tool or error string, and an optional justification of rationale, evidence, SHA-256 fingerprinted file or tree dependencies, assumptions and a recheck note. Beside it, logged prompts, replies and file touches, and formal premise bundles in a second store | One SQLite file per project in WAL mode, .ken/ken.db: cr_findings with cr_justifications, cr_finding_refs and cr_finding_edges, and the session tables cr_sessions, cr_contexts, cr_interactions and cr_session_scores; code vectors in memory-mapped segment files under .ken/vectors/; premises, events and inference checkpoints in .ken/reasoning.sqlite | ken_recall routes by argument: anchors match stored keys, a topic walks a graph of shared-file, shared-symbol, shared-tag and cosine edges, a path reads prose-extracted references, a query scans every finding embedding by cosine, and no argument returns the newest. The prompt hook adds findings above cosine 0.48 to a ranked file block; the session-start hook adds the three newest | Explicit: the agent calls ken_remember, or a person runs ken remember. One BEGIN IMMEDIATE transaction upserts on topic, embeds synchronously, replaces the justification, recomputes references and every edge, and stores anchors. Hooks log prompts, replies and tool touches without a model call | Re-using a topic overwrites content, tags and embedding and drops any justification not resupplied. forget is a hard delete by exact topic with cascades to justification, references and edges. Premise bundles are replaced or retracted by source id, each logged. Logged prompts and replies have no delete path | Physical: one .ken directory per project root, shared by every harness installed there. No scope key on a finding. The premise store filters on a context name the caller passes, defaulting to main | ken install wires Claude Code, Codex, OpenCode and DeepSeek hooks plus a stdio MCP server with twelve tools; hooks POST to a per-project localhost daemon with a bearer token, which injects a resume brief at session start and a ranked block with labelled findings on each prompt; ken tools runs any MCP tool from the shell | A per-project daemon watches the tree and reindexes changed files, snapshots per-file productivity scores at session end, and lazily embeds code. Nothing rewrites findings; the findings graph is recomputed in full inside each remember and forget | Labels only. Every read re-hashes declared dependencies and reports unchanged, stale, unknown or untracked, and a stale or unknown finding is prefixed REVISAR in hook output; kind and justification kind name a hypothesis. No read excludes a finding on any of them. Premise answers are supported, refuted, conflict or unknown, derived per query | Dependency fingerprints re-checked on every read, including tree membership for absence claims and a refusal to record evidence whose hash moved since it was read; whole-conclusion budgeting that offers an expansion rather than a clipped sentence; a premise store with an append-only event log and checkpointed, resumable inference | A stale finding is injected at session start and on prompts with a label and nothing withheld; anchored memories fire only when the model passes the anchor; the MCP recall floor defaults to zero; findings correct by silent overwrite and hard delete with no history; prompts and replies are retained with no delete path |
kept |
A Markdown note with frontmatter — name, description, type, status, verified date, optional depends_on, superseded_by and source — chunked for the embedder | Markdown files under a root, one directory per family and project, with a derived vector index, caches and a search journal in a state directory | A local embedding model on the CPU, cosine over note chunks with learned query-to-note bonuses; active notes only unless archives are asked for | write, append, supersede,
link and verify through the CLI or MCP,
refusing secrets, an existing file, or a near-duplicate of an active
note |
Supersede archives the old note with superseded_by and
rewrites every link to it; verify stamps today's date; nothing
deletes |
A directory per project, which the generated MEMORY.md follows; the prompt hook and search read the whole root | Claude Code prompt hook and MCP server; MCP setup for Codex, opencode, Gemini CLI, Cursor, Windsurf and Kandev; a local daemon and a tray | A daemon that keeps the model loaded and re-indexes changed notes; no model call and no rewrite of notes | A verified date on every note, shown beside each
passage; a hook preamble telling the model the passages may be off
topic |
Plain files any tool can read, a local model with measured cost, a bounded per-project index whose exclusion of archived notes is tested, and a write path that refuses secrets and duplicates | The prompt hook searches every project, so a request in one project can be answered with another's notes; the duplicate check reads active notes only, so a superseded fact can be written back as new |
kglite |
A node or edge with interned property keys, optionally carrying validity properties whose names the graph declares rather than the engine fixing them | An embedded in-process graph with its own file format, no external database service, and a Python wheel with no required runtime dependencies | Cypher, a fluent traversal API, and a graph-shaped MCP tool surface; traversals can be shifted into a temporal context that filters nodes and edges by a validity window | Bulk load from records and dataframes, a schema installer that declares which property names carry validity, and ordinary graph mutation | Graph mutation. A fact that stops holding is expressed by closing its validity property rather than by any engine-level supersession; nothing records that the graph's own belief changed | None in the engine. One embedded graph per process, with the MCP server's workspace modes deciding which graph is served | Rust and Python APIs, a C ABI, a Bolt server, a CLI, and an MCP server whose skills layer is carried by the graph itself | A file watcher for the served graph and a reload path for its skills | None. No status, no confidence, no provenance field — a property is either within its validity window at the reference date or it is not | A temporal context set once and obeyed by a whole traversal rather than repeated per hop; validity property names declared per graph instead of imposed by the engine; a skills layer the graph carries about itself, gated by a predicate over the graph's actual shape; and contract tests that pin the behaviour a dependency update could silently drop | One temporal axis — the graph records when a fact was true and never when it learned it, so a correction is indistinguishable from a change in the world; no trust state, provenance or scope in the engine, which pushes all of that onto whatever embeds it; and every dependency manifest changed inside the seven-day cooldown |
khabeer |
A §-delimited plain-text entry in
MEMORY.md or USER.md, plus a user-owned
SOUL.md; session transcript rows for recall |
Three files under ~/.khabeer/ in the app's private
storage, and an app SQLite database holding transcripts with an FTS5
index where the device's SQLite has the module |
Both memory files injected whole into the system prompt; a
session_search tool over FTS5 with a trigram tier and a
LIKE fallback, tool rows demoted below user and assistant hits |
A memory tool with add, replace and remove addressed by
substring, all-or-nothing batches under a file lock, and an optional
staging queue a person approves |
Substring-matched replace and remove; a remove leaves no record, and rejecting a staged write deletes the staged file | One store per app installation; no user, project or agent key, by the spec's own decision | Native Android app on a Termux runtime, provider-agnostic across OpenAI Responses, Chat Completions and Anthropic Messages | A quiet review call every ten user turns that returns memory operations, routed through the same gate and staging path | Threat-pattern scan on every write and on prompt assembly, drift guard with backup, and a human approval queue that is off by default | Hermes's bounded curated memory and write-approval queue carried into a mobile app with a real review surface and tested batch, budget, drift and strict-UTF-8 behaviour | The system prompt is rebuilt from disk on every tool step, so the frozen snapshot the design copies does not exist; the load-time fence has no test; a rejected write can be proposed again |
khoj |
A UserMemory row — raw text of one fact
written in the user's first person, a pgvector embeddings
column, the search_model that produced it, the owning
user, an optional agent,
created_at and updated_at |
Postgres with pgvector, the same database that holds the indexed
documents (Entry), conversations and agents; the
docker-compose ships pgvector/pgvector:pg15 |
Two arms merged by id on every chat turn —
pull_memories, the ten most recently created facts updated
within seven days, and search_memories, the ten nearest by
cosine distance under the search model's bi-encoder confidence threshold
— with no lexical arm, no reranking and no budget beyond the two
limits |
Deferred: after the response streams, a background task saves the
conversation and calls ai_update_memories, which sends the
last two exchanges and the facts that were retrieved for the turn to the
Muninn prompt and applies its create and
delete lists; automations never write; the user can add
nothing by hand and can edit or delete from settings; a management
command backfills memories from past conversations in batches with a
checkpoint |
There is no update: the prompt says facts cannot be edited and must
be recreated, the API's update deletes the row and inserts a new one
with a new id, and the model's delete list is applied by id with a hard
DELETE; nothing is superseded, archived or tombstoned |
Per user, always; per custom agent when the conversation runs under one, with the default agent reading across every agent's facts; the memory feature is gated by a server-level mode of disabled, enabled-default-off or enabled-default-on and a per-user toggle | Automatic injection as a user-role message —
<retrieved_memories> with one dated line per fact and
an instruction to ignore what is irrelevant — into every chat path
including research and diagram generation; no memory tool for the model;
a REST API for list, update and delete; a settings page with a toggle
and an editable list |
No consolidation, decay or dedupe; the only batch process is the
operator's manage_memories command, which runs the same
extractor over recent conversations |
None on the row — no confidence, state, provenance beyond the user and agent, or record of which conversation produced a fact; the injected prompt carries the creation date and a hedge; a parse failure of the extractor's reply yields empty lists rather than an error | A fact model kept deliberately atomic and first-person; agent-scoped memory with isolation tests that seed the material that must stay out; a three-way server mode over a per-user switch, tested in every combination; extraction off the response path | The extractor sees only the facts recall retrieved for the turn, so a fact that did not match the query cannot be deleted and contradictions accumulate; deletion is by model-supplied id with no guard on a non-numeric value; the API's update discards the row's history; every custom agent's facts flow up to the default agent |
kimetsu |
One lesson string with scope, kind, confidence, usefulness score, validity bounds and a provenance snapshot; kinds are preference, convention, command, failure_pattern and fact | One SQLite file per project at .kimetsu/brain.db plus a cross-project user brain at ~/.kimetsu/brain.db; an events table is the source of truth, and memories, FTS5, edges, facts and revisions are projections | FTS5 BM25, optional BGE-small cosine with an ANN index, 2-hop graph expansion over memory_edges, composite score of relevance, confidence, freshness, scope weight and usefulness, provenance multiplier, MMR, abstention floors and a token budget; an optional cross-encoder rerank | Explicit record and add tools, a SessionEnd distiller that asks a configured model for up to 3 lessons, a coding pipeline that proposes memories, and pack import; confidence 0.7 or more is accepted directly, lower confidence waits as a proposal | Correction rewrites text in place and keeps each revision; invalidation, forgetting, supersession and expiry are events that remove the row from every read; compaction can purge invalidated rows from the projection while their events stay. No tombstone | Physical: one database per project and one per user, and on the remote server one database per repository behind per-repo bearer tokens. The scope column is a ranking weight, not a filter | Claude Code hooks on SessionStart, UserPromptSubmit, Stop, SessionEnd and optionally Bash tool use; an MCP server with memory curation tools; Codex, Cursor, Pi and OpenClaw wiring; a terminal chat; an HTTP MCP remote server | No resident scheduler; session hooks spawn a detached maintain pass for reinforcement, digest, prune reporting and skill detection. Forgetting is opt-in and off by default; proposals expire after 30 days | Pending and rejected proposals are withheld; a provenance multiplier from 0.85 to 1.0 ranks and never filters; similar-but-different memories are queued as conflicts without changing either | Event log with a replay that refuses to lose rows; corrections keep revisions and reset evidence; citations credit only the revision that was delivered; one status predicate repeated on every read path; URL packs quarantined by default; secret redaction before any event is stored | The agent holds accept, reject, invalidate and conflict-resolve by default; the distiller and the agent choose their own confidence and so whether to bypass review; conflict decisions and validity stamps do not replicate through sync; the headline benchmark harnesses are in a private repository |
kipi-system |
A markdown file with frontmatter — auto-memory notes carrying
confidence, provenance, status,
as_of, decay, superseded_by and
supersedes; canonical documents holding talk tracks,
objections, decisions and market intelligence; and JSONL ledgers of
outcomes and judgment receipts |
Files on disk. Auto-memory markdown under the harness's per-project memory directory, canonical markdown in the repository, JSON and JSONL for open loops, outcomes, judgment receipts and the sycophancy log | An MCP server assembles a morning digest by parsing the canonical sources section by section, dropping retired ones; session-start hooks surface low-confidence, stale and low-trust memories as context the model is told to treat sceptically | Agent edits under a PostToolUse validator that blocks a write whose
confidence falls outside zero to one or whose
provenance is outside the six-value enum; outcome events go
through a single writer with an flock and id-based deduplication |
A memory that turns out wrong is superseded with a pointer to its successor, not deleted; deletion is reserved for a memory that was never true, where there is no successor and nothing to learn. Judgment corrections append a superseding receipt to a hash-chained ledger | A fleet of instances from one skeleton, each with its own project directory and memory; the registry names them. There is no in-store scope predicate — separation is by directory | A Claude Code plugin with a marketplace manifest, an MCP server, session-start and post-tool-use hooks, committed git hooks, and launchd jobs for the daily and drift lessons passes | Session-start hooks that prune, index, surface confidence and scores, check freshness and run a monthly sycophancy check; launchd timers for a daily lessons pass and a drift report | Four independent axes on a memory — a bounded
confidence, a six-value provenance
distinguishing a stated fact from an inferred one, a status
of current or superseded, and an as_of date meaning when
the claim was true. Earned trust is separate again, scored from an
append-only log of how each recalled memory actually performed |
A retirement check that reads only a file's first fifteen lines so a document discussing a retirement cannot retire itself; an absence that records why it is absent; one vocabulary table imported by both the write gate and the sweep, added after two lints shipped different enums for the same idea; an outcome log with a single writer, an flock and a validity predicate gating both deduplication and reads; and a deterministic audit of whether the human's approvals are rubber stamps | The permission allowlist grants Bash(python3:*),
Bash(node:*) and Bash(npx:*) while denying
curl | bash and destructive git, so the command deny-list
is advisory — an interpreter on the allow-list reaches everything the
list forbids; most session-start hooks end in
2>/dev/null || true, so a memory surface that stops
working stops silently; as_of is a real validity axis with
no as-of read over it; and the repository carries the author's own
business and personal memory alongside the machinery |
kirocrew |
Three structured kinds — a semantic key-value fact under an allow-listed prefix, an episodic fragment with an embedding, and a lesson — each with a record-metadata row carrying status, validity window, subject, predicate and revision; beside markdown files a person can read | SQLite WAL memory.db per store with an optional FAISS
index, memory_record_meta and a
memory_revisions journal; the global V1 store under
~/.kiro/crew/, and a private V2 store per Crew Member
behind a protected binding |
Eligibility first — non-active or out-of-window records withheld —
then vector similarity admitted on raw cosine with decay for ranking in
V1, FTS5 as fallback; V2 fragments only through explicit
memory_recall; lessons gated by a stored repository
scope |
An ordered validation chain returning one of eight typed
SemanticRejectCodes; in a private store a non-owner,
unverified change to an existing fact becomes a conflict proposal and
the current fact stays |
Status moves to superseded, expired or forgotten rather than deleting; every accepted change journaled with before and after (V1 keeps 20 per record); up to three contradicted episodes retired per write and restorable | Lessons carry a repo_scope applied on injection and
failing closed without a project; members are separate stores; semantic
and episodic rows have no scope predicate inside a store |
A desktop app, a web dashboard with a record editor, a CLI, Slack, Discord and Telegram bridges, Crew Apps, and a private-memory MCP for Kiro, Claude Code and KAS backends | Consolidation, bounded episodic retirement, whole-store backups, event rotation past ten thousand rows, a self-heal path, and a nightly memory benchmark in CI | A four-value record status read on every recall, a confidence float
gated at 0.8, a privileged user_explicit source, and
literal verified corrections bound to the revision the model saw |
Typed refusals with redacted audit snippets; disputed changes parked as proposals for the owner; status and validity checked at read time; a repository scope that fails closed | Refusals are recorded and never consulted; the
user_explicit exemption is a string; path-fragment scopes
can match many repositories; V1 history is pruned to 20 accepted
snapshots per record |
kiwi-mem |
A memory row — content, title, an importance, an embedding, a type of fragment, daily digest or digested, a category, an emotional weight, an access count and the hashes of the queries that reached it, a permanence flag and a resolution that softening lowers | One Postgres database holding memories, the conversation ledger, chat sessions and messages, calendar pages, scenes, dream logs and three tombstone tables | A keyword arm and a vector arm fused, each carrying the project predicate, with heat parameters over access counts and recency | A gateway that sits in front of an OpenAI- or Anthropic-format provider, extracting memories from conversations, plus a nightly dream pass that merges, softens and deletes | Deletion is the system's most developed path: a purge across every table holding an original copy, three permanently retained tombstone tables consulted before a write, a per-session source revision that invalidates any background result derived from material deleted mid-flight, and a global reset generation that catches requests still streaming when the reset landed | A project key on memories, bound in both retrieval arms with the absent case narrowing to global; a three-state conversation scope where unknown attribution is excluded from the global loop rather than admitted | An OpenAI-compatible gateway endpoint, an MCP server, an admin panel and a Docker compose deployment | A dream pass that consolidates, merges and softens memories with a run log and a resume point, a daily digest, and calendar period summaries | Scores rather than states — an importance, an emotional weight, a resolution that softening lowers, a permanence flag that exempts a row from batch deletion. No discrete status filters a read | Tombstones retained permanently with the reason written down, and exactly one code path that may revoke one; a source revision that makes a background summariser discard work derived from deleted material; a reset generation for requests that were in flight when everything was cleared; a registered list of audit findings deliberately not fixed; and an 8,179-line safety suite that asserts against source text as well as behaviour | The anti-drift test matches one spelling of the scope predicate and a second spelling already exists in a diagnostics count; the tombstones are keyed on session, turn and message identity rather than on content, so the same text written under a new id meets nothing; and the test suite's must-not assertions cover log leakage and purge completeness rather than retrieval |
kleos |
A row in one memories table: content, category, source,
importance, tags, a 1024-float embedding blob, and five independent
lifecycle axes — is_forgotten, is_archived,
is_latest/version,
is_consolidated and status |
One SQLite file through rusqlite with
deadpool-sqlite pooling, writes serialized in a writer
transaction; an FTS5 shadow table and a vector index beside the main
table |
Three arms composed — FTS5 lexical, cosine over 1024-dimension vectors, and a graph layer of entity links, community detection and PageRank — ranked with an FSRS-derived decay score so unrecalled memories fade | store infers tags and category, deduplicates by SimHash
within 3 bits against live rows in the same space, resolves the review
status through a pure function, then inserts and updates quota counters
in one transaction |
Correction writes a new version, sets is_superseded = 1
on the original and records old and new content in
reconsolidations, a table nothing reads. Deletion is
is_forgotten with a forget_reason, swept after
a retention window |
user_id on every listed read path and
space_id on the dedup; a migration trigger refuses a memory
link whose endpoints have different owners. Cross-user isolation is
asserted against one shared database |
One Rust binary exposing an HTTP API, an MCP server over stdio and HTTP, a CLI, a sidecar, a desktop GUI and a terminal approval UI for the pending inbox | A feature-gated six-stage consolidation cycle, plus PageRank refresh, community detection and vector sync jobs | status over pending, approved and rejected, resolved
once before the write; pending withholds a memory from
recall, search, listing, timeline and the generated prompt, and is off
by default |
A gate decision resolved once by a pure function over its configuration rather than read from the environment at the write, a quota check inside the writer transaction, a dedup paired with a committed scope-boundary test, and comments that record why a row is excluded rather than leaving the exclusion to look like an oversight | The MCP surface advertises a curated tool list but dispatches any
route name that resolves, refusing only two credential routes, so a
model can call inbox_approve on its own pending memory; the
attribution-header query omits the review-gate predicate its two
siblings carry; the status predicate is a deny-list that admits any
status added later; and reconsolidations costs two writes
per correction and answers no question |
klypix-mcp |
A card — a text item in a spatial canvas, carrying an area, optional evidence records, closes: and verify: fields, provenance, and a lifecycle stamp written into its own prose | One brain.klypix per repository: a ZIP of manifest.json, canvas.json, one JSON file per item and a graveyard of deleted items, committed alongside the code, plus JSON and JSONL sidecars under .claude/ and ~/.claude/project-brain/ | Reciprocal-rank fusion with an on-device BGE bi-encoder when the runtime is installed, where the lexical arm joins only if the query carries an exact identifier, path or version; two measured per-prompt hook lanes that can decide to inject nothing | Deterministic and local, no LLM on the write path. Automatic at turn end on Claude Code from BRAIN markers; explicit brain_note, brain_reconcile confirm and brain_handoff on every MCP host | Supersede on a case-sensitive CORRECTION cue or a same-area overlap of 0.6, resolve, update in place, closes: link, and a dated re-adoption receipt when a decision returns to an earlier stance; a graveyard bin keyed on card id whose purge and restore leave content-free receipts | The file is the scope. One brain per project directory with no scope key on a card; a model-supplied canvas argument may name any brain by absolute path, and search_all_brains crosses projects from a registry | An MCP server with 26 tools (27 on Windows), five Claude Code lifecycle hooks, six optional Codex hooks, generated rules and config files for further hosts, a git merge driver, a commit hook, a Claude plugin mode, a Windows app bridge and an experimental A2A face | No pass rewrites the brain. A supervisor checks npm every 6 hours and hot-swaps the worker; after an update, and at most daily, the updater rewrites KLYPIX-managed config files in every project registered in the last 14 days | Archive containment plus dated superseded, resolved and consolidated stamps parsed back out of the card's text; per-card evidence records whose source status brain_ask and brain_sync report; a judgment sidecar whose actor classes state that no human-confirmed verdict exists | The committed lock benchmark runs unlocked writers as a negative control first and declares itself inconclusive if they lose nothing. Recall surfaces and injection surfaces are separated and asserted in both directions. Every published retrieval number carries its n, and retired numbers are named as retired | The lifecycle is prose and containment, so renaming one container makes every archived card read as current. The agent archives cards itself through brain_note, brain_reconcile confirm and brain_handoff done; the human approval code gates one bulk consolidation path. The capture ledger is ring-capped at 1000 and written by the Claude Code hook alone, restore points are pruned, and a graveyard purge replaces the entry. A scope-locked box is hidden from the canvas read tools and not from brain_ask or the session brief |
knowl |
A knowledge atom — a category, a five-value status, title, content and reasoning, alternatives, tags, affected paths, two separate hashes, an owning repo and an authoring repo, a visibility, a freshness, a confidence, an earned tier with the date it was set, a provenance, a conflict key and scope, a supersession pointer and a version | One SQLite database per project with an FTS5 index and a vector table, plus a global store, portable exports, and an optional cloud workspace with an explicit publish gate and a never-publish list | FTS5 BM25 first, with a LIKE fallback measured to be reached only
when every token is a stop word or the query is an infix of an indexed
token, fused with vector candidates; asOf resolves each
candidate to the assertion in force at that instant |
MCP tools and a CLI write atoms, with a conflict key that decides supersession at write time; every mutation path records a commit carrying its change set | A replaced claim closes its open assertion and opens a successor in one transaction, and the item's status becomes superseded with a pointer to its replacement. A destroyed item leaves an append-only forget-log row with the deciding numbers and an id-keyed tombstone that travels in exports so an import cannot resurrect it | Repo or workspace visibility, persisted independently of the file that holds the row, applied in SQL on the cross-repo path so a peer's private row never enters the process; a federated query filters on the row's own origin repo | 28 MCP tools over stdio, a CLI, host hooks, a local viewer, skills, and an optional hosted connector | A drift check that watches an item's cited files move and flips freshness to needs_review, a garbage collector that records why it took each item, and a tier promoter counting confirmations from the date the tier was set | Four axes kept deliberately apart — a five-value status that filters the read, a three-value freshness driven by drift, a numeric confidence, and a two-value earned tier with its own clock — plus a three-value provenance and an evidence table with a typed relationship | A headline claim backed by a committed ablation whose off arm is retained as a control on the metric; a benchmark log that documents how to misread it and records a false regression the project caught in itself; a schema whose comments explain which fields belong in which fingerprint and why; and more test code than source | The published 98-to-47 figure is the best slice — single-hop at 6k — while the same ablation at 262k is 87 to 42 and both multi-hop arms sit near zero top-one; the tombstone that travels is keyed on the item id, so the same content rewritten under a new id meets no record of its rejection; and 32 dependency ranges float, with four manifests changed inside the seven-day cooldown |
knowledge-worker |
A typed node with a confidence and an excerpt, plus typed edges between nodes | A local JSON-LD graph with a published context vocabulary, OWL and
Turtle export, and an append-only eval_record.jsonl beside
it; provenance edges kept separate |
Context export that drops low-confidence decisions and marks the rest | Extraction, then a validator that rejects, demotes or accepts each node and edge | Merge and review commands; demotion rather than deletion for weak claims. A rejected candidate is logged and not recorded against its value, so the next ingest of the same source offers it again | One local graph per user; no scope key on a read path | A CLI, an Ollama proxy, and export for feeding an AI session | Graph analytics — what matters, what connects, what is weak | high / medium / low, with high requiring an excerpt that matches the source | A fabricated-quote check, with demotion recorded in an auditable manifest, behind a per-node human gate whose every verdict is appended to a durable log | Substring matching catches invention, not misquotation in context |
kube-coder |
A row keyed UNIQUE(namespace, key) — value, a derived
summary, kind, tags, importance, confidence, source, access count, a
monotonic version, expires_at and
deleted_at |
One SQLite file per workspace on the
pods persistent volume, WAL mode with BEGIN
IMMEDIATEretries, plus FTS5 and an optionalsqlite-vec`
table |
FTS5 always, fused by normalized reciprocal-rank with a vector KNN pass when sqlite-vec and an embedding provider are present, degrading to FTS-only with identical output when they are not | Explicit tools only — memory_* over MCP from the agent,
or the dashboard form from a person. A write-time summarizer condenses
long values once into a derived column rather than truncating on every
prompt |
soft_delete sets deleted_at and appends a
history row; upsert on the same namespace and key sets
deleted_at=NULL, so re-writing a deleted value revives it
and nothing consults the history that recorded the deletion |
namespace on every row, applied as an allow-list or a
namespace root on every retrieval arm, with user always in
scope; a project namespace cannot reach a sibling project |
An MCP stdio server spawned per Claude session, an HTTP surface on the pod for the dashboard, and an opt-in top-K injection at task creation with a per-task disable | An embeddings worker draining a pending queue; no consolidation, extraction or rewrite pass | None. confidence and importance are floats
used for ranking, kind is a taxonomy, and no state
withholds a row from retrieval |
The namespace filter is applied to the FTS pass, the LIKE degradation and the vector-only hits alike, so a high-scoring out-of-scope memory can never be fused back in, and the scope suite attacks prefix-sharing siblings and LIKE wildcards rather than only the happy path; the per-prompt injection hook was built, then disabled and stripped on every boot in favour of on-demand retrieval | upsert clears deleted_at, so deletion is
record-keyed and reversible by writing the same key again; the history
that would answer -- this was removed -- is capped at 100 versions and
read by nothing on the write path; and there is no epistemic state at
all |
kwipu |
A Markdown note as a LlamaIndex document keyed by its path, its
frontmatter copied onto the document as fm_* metadata, its
text chunks as nodes with embeddings, and beside them entity and
relation triples of three provenances — a wikilink with a relation
inferred from the surrounding line, a frontmatter key mapped to a
relation, and a model's own extraction of up to twenty per chunk |
LlamaIndex's default property-graph, document and vector stores
persisted as JSON under storage_graph/ by
StorageContext.persist; a .kwipu_meta.json
manifest naming the embedding and generation models the store was built
with; a .file_hashes.json of MD5 digests per note |
Four sub-retrievers under one query engine — a model-expanded synonym walk of the graph to depth three (skipped in fast mode and always skipped over MCP), a vector retriever over chunk embeddings with graph context to depth three, a BM25 scan of every text node in the graph, and a scan that scores date tokens, temporal words, tag lines and capitalised names — synthesised by Ollama under a prompt that forbids anything not in the context and demands file citations | A full build on first run — read the folder recursively, extract frontmatter and wikilink triples in code, then model-extract triples per chunk — and afterwards a watcher: a created note is inserted, a modified note is deleted by document id and re-inserted, a deleted note triggers a full rebuild; every path re-upserts the structural triples | An edited note's chunks and embeddings are replaced under its path; its wikilink and frontmatter triples are upserted with no document id, so a relation the edit removed stays in the graph; a deleted note rebuilds everything, which is the only path that drops a triple; there is no per-fact edit, no supersession and no record of removal | One knowledge directory per process and one graph per storage
directory, both module constants; .obsidian/ is skipped; no
scope key, no user or agent identity, and the MCP tool answers any
client from the whole vault |
A terminal REPL over Rich that builds, watches and answers; a
FastMCP server exposing one tool, query_graph, in fast mode
with no watcher; Ollama for both models, a cloud-suffixed model id
accepted for the build; Obsidian by convention only |
A watchdog observer on the folder with a five-second debounce and an MD5 filter against phantom events, in the REPL only; nothing else runs unattended, and nothing rewrites the graph except the full rebuild a deletion forces | None on a fact: no provenance beyond the file path a node carries, no time beyond a frontmatter date copied as text, no confidence, no state; the manifest refuses to load a store built with a different embedding model, which is a guard on the index, not on a claim | Structural triples from wikilinks and frontmatter cost no model call and survive the model's misses; the embedding-model manifest stops a silent mixed-space index; the prompt's rule seven gives the model an out instead of a guess; content hashing keeps editor save storms from rebuilding anything | A wikilink triple outlives the link that produced it; deletion is a full rebuild of the whole vault; the MCP server never watches the folder, so an agent reads the vault as it was at its first query; the temporal retriever fires on every query and scores any capitalised token; no case asserts that particular material must not be retrieved, and no benchmark scores the anti-hallucination prompt the README names; six unpinned dependencies |
langchain |
In the deprecated package, an entity name mapped to an LLM-maintained summary string, or a turn stored as a vector-store document; in version 1, nothing | SQLite, Redis or Upstash behind BaseEntityStore; any LangChain VectorStore for the retriever memory; version 1 delegates to LangGraph's Store | Exact key lookup on an extracted entity name, or top-k similarity over past turns; no ranking, no fusion | Synchronous on save_context — one extraction call plus one summarization call per entity, on the turn | The summarizer rewrites an entity's summary in place with no history; set() with a falsy value silently deletes the entity | session_id, realized as a separate table or key prefix per session, and required to be a valid Python identifier | BaseMemory on legacy chains; in version 1, middleware plus a store passed through to LangGraph | None in either package | None. An entity summary is a string with no provenance, confidence or status | The clearest published statement of where the window/memory boundary falls, made by deprecating one side of it and delegating the other | Every durable class here is under a removal notice, and the entity summarizer overwrites with no history while an empty summary erases the entity |
langgraph |
An Item — a JSON dict under a hierarchical namespace tuple and a key, with created_at and updated_at | One store table keyed on (prefix, key) plus a store_vectors table, in Postgres, SQLite, or an in-process dict | Namespace-prefix scan with dict-path filters, optionally reranked by cosine over per-field embeddings; no lexical arm | Synchronous put through a batched op queue; embeddings computed in the same call | Upsert by (namespace, key); delete is a put of None and is a hard delete with no tombstone | The namespace tuple is half the primary key and a required argument on get, put and delete, validated on put; search and list_namespaces take a prefix, and an empty prefix is documented and tested to match every namespace | store= on compile(), get_store() from a node, and InjectedStore to hand it to a tool; no memory tools are prebuilt | An optional TTL sweeper thread deletes expired items on an interval | None. An Item is an opaque dict with two timestamps and no status, confidence or provenance | A published conformance suite third-party persistence implementations can run, and a namespace that is part of the primary key on every point read and write | The conformance suite covers the checkpointer, not the store, and the three store backends disagree on created_at, on whether deletion removes the embeddings, and on how many candidates vector search fetches before deduplicating |
langmem |
A BaseStore item; tools write content only, the manager writes kind and content | LangGraph BaseStore, bound by the application | Store search under a namespace prefix; the manager queries with the last message or model-written queries | Agent tool create, update or delete by id; background Trustcall extraction that inserts, patches or removes | In-place overwrite and hard delete through the store; no history or tombstone | Namespace tuple templated from run config, matched as a prefix by the store | LangChain and LangGraph tools, runnables and a reflection executor | In-process debounced queue per thread, or a remote LangGraph Platform run | None in data; confidence is asked for in the extraction prompt text | Small tool surface; a missing scope key fails instead of widening | Tool and manager items are incompatible in one namespace; nothing tests memory behaviour |
leankg |
A markdown file \u2014 bounded MEMORY.md and
USER.md core documents and unbounded
topics/*.md notes \u2014 beside mnemopi-compatible JSONL
bank rows carrying content, a session key and a rank position. No
status, confidence, supersession pointer or validity interval anywhere
in the layer |
A project-anchored plain-markdown tree under
<project>/.leankg/memory or
~/.leankg/memory, with
banks/<bank>.jsonl transcript banks and an FTS5 side
index the package comment calls "its own sqlite file, not the
store". The code knowledge graph beside it is a separate store
derived from source |
FTS5 over (path, body) with unicode61 tokenisation for
the markdown tree, and unique-query-token overlap over the bank rows
with zero-match rows filtered out. The per-project-tagged
merge is ordered rather than scored \u2014 project rows before shared
rows on rank ties |
Direct file operations through one resolver: Create,
StrReplace with unique-substring matching that errors on an
ambiguous old text, Insert at a line, Rename,
Delete. A core-file write that would exceed 2,200 bytes
fails with ErrOverflow rather than truncating |
Editing in place, and Delete removes the file and its
index rows. Nothing records what was removed, so a deleted memory leaves
no trace and can be written again unchallenged |
A three-mode bank scope \u2014 per-project, global,
per-project-tagged \u2014 deciding the write target and the merged read
set, with an unrecognised mode refused rather than defaulted; and a path
resolver bounding every operation to the memory root against absolutes,
.. segments, unlisted shapes and escaping symlinks |
Three MCP tools (import, query,
status) serving 30 actions, plus REST, RPC, a session
layer, a web UI and a multi-project HTTP mode selected by a per-request
project argument |
None on the memory layer. Graph indexing, refresh and watch run beside it over the derived store | None. There is no epistemic status, no confidence, no approval surface and no mutation log in the memory layer \u2014 a memory is current because the file is there | An unknown scope value is an error rather than a silent fallback, with the ported-from behaviour named in the comment; a path resolver that closes symlink escape in both directions; three refusals where an accommodation would have produced a plausible wrong result \u2014 overflow rather than truncation, ambiguous replace rather than a guess, whole entries dropped rather than a half memory; an empty recall rendering as no injection block at all; and an A/B harness that refuses to record a run whose commits and prompt hash cannot be pinned | No epistemic state of any kind, so a memory cannot be doubted,
superseded or shown to have been rejected; a delete leaves nothing keyed
on what was removed; the file write and the index update are not
transactional, though the index is the rebuildable half; the bank scope
arrives as a request argument on a shared multi-project endpoint and is
validated rather than authorised; and the published
\u221265% tokens / \u221285% tool calls claim has a
complete committed harness with no committed result, while the only
committed token A/B in the tree is an archived April run reporting a
+41,048-token overhead |
lemmalog |
A Datalog tuple — subject, relation, object, valid_from, valid_to, asserted_at — annotated with a confidence in a product t-norm and a provenance set of episode ids | An in-process interned fact store with per-position secondary indexes, snapshotted to disk as episodes, EDB facts, rules and escalations with derived views rebuilt on load | BM25 with entity and graph boosting under a token budget, a semantic
side index behind an Embedder trait, and ask /
ask_deep Datalog queries with magic-sets demand
evaluation |
An extractor, or the host model through MCP, asserts base facts at the ingestion boundary and a deterministic policy chooses ADD, UPDATE, NOOP or ADD with an escalation; exclusive predicates close the previous edge rather than overwriting it | Supersession closes valid_to and re-declares the old
tuple with superseded provenance; retraction removes the
open row and recomputes only transitive dependents |
None. One store per process, with no principal, tenant or agent key on a tuple | A Rust crate, an MCP server behind a feature flag with an installer script, a CLI, a REPL and an agent skill | Incremental maintenance on a time advance — the sleep-time slot — rather than a daemon; the MCP server syncs the clock to the wall clock before every read | Continuous. Confidence is a semiring annotation fused by a product t-norm, and provenance is a set union; the annotation type is a trait parameter, and no shipped carrier holds a discrete status | Proof trees with cycle protection, a hypothetical that provably leaves no trace, identity conflicts that derive a fact instead of merging two entities, and a seeded differential oracle over 450 random programs | The shipped writer sets asserted_at to the same value
as valid_from on every assertion, including a backdated MCP
observe, and the default rules discard the position, so the store cannot
answer what it believed at a past time |
lerim |
A compiled record — a decision or an episode — carrying a title and body, a status, two time pairs, a supersession pointer, and the session and events it was derived from, beside prose columns for the decision, the alternatives and the consequences | SQLite, with a records table, a
record_versions table for prior versions, and a
scopes table the records foreign-key into |
Filters compose over kind, role, status, source profile, source session, project and a world-validity window, feeding a cited context brief | Traces are ingested as episodes and a curator agent compiles them into records, choosing the status, the validity window and any supersession pointer as three independent fields | Supersession is a self-referencing foreign key and archival is a
status; the two are set separately, and record_versions
keeps prior versions |
project_id composed into the record filter, with an
empty project list compiling to 0=1 rather than matching
everything, and the same boundary enforced on writes |
An MCP server, an HTTP server with a skill API, a Next.js dashboard and adapters for several agent runtimes | A skill-stewardship pipeline that drafts patches to agent instruction files, validates them, and saves them pending review | None as a field. A record is active or
archived, which is a retention pair; the judgement lives in
decision, why, alternatives and
consequences, prose a model wrote that no query reads as a
condition |
The scope filter distinguishes no-scope from an empty scope and compiles the empty case to a clause matching nothing, with a test named for the behaviour; the as-of read resolves its moment and its status filter together, so a record archived after the asked-about date is still returned, and both directions are pinned by tests; skill patches default to waiting for review and record who applied them | valid_from falls back to creation time whenever no
caller supplies one, so the two axes collapse on those records;
scope_type and scope_id are foreign-keyed
columns the general record filter does not compose, which invites the
assumption that they are enforced; the reasoning columns are prose no
query can act on, so a brief cannot prefer one of two conflicting
records; and the review gate covers skill patches rather than the
compiled records |
leteo |
An observation — a typed, titled body with a project, a scope, an optional topic key, a normalised content hash, counts of revisions and duplicates, a review date and a soft-delete stamp. Prompts and sessions sit beside them, a relation row carries one memory's claim about another, and up to twenty replaced bodies are kept per memory | One local SQLite file with three FTS5 indexes over the same rows — Porter-stemmed, unstemmed, and a per-language Snowball index fed by a registered SQL function — plus a table of 256-dimension vectors local to the machine. An optional cloud server keeps every replicated change in an append-only PostgreSQL log | A cascade: an exact topic-key lookup, then BM25 over the three indexes fused by rank position, then prefix, substring, typo-corrected, any-word and median-floored stages, each only when the one before found nothing. A static multilingual embedding answers by cosine when the words found nothing, above a 0.30 floor, or is merged beside the weakest lexical answer. Every stage shares one visibility predicate | A save normalises the body, strips private-tagged spans, folds case and whitespace into a hash, then revises the memory holding the same topic key, increments a duplicate count on an identical hash inside a time window, or inserts; the vector is computed after the commit | A topic key or an update revises in place, snapshotting the replaced title and body into a version table capped at twenty per memory. Deletion is soft by default with a hard variant. Consolidation inserts one replacement and records a judged supersedes relation to each source; a judged supersedes verdict hides its target from every listing until the verdict changes or the relation is removed | A project and a scope column. The agent's search and context fill the project from the working directory when the caller names none, and read every project when it sets all_projects or when the directory is ambiguous; writes refuse an ambiguous directory. The store API omits a clause it is given no value for | One Rust binary: a CLI of twenty-six commands, an MCP server of twenty-three tools with a twenty-tool agent profile, an unauthenticated loopback HTTP API exposing all of them, plugins and lifecycle hooks for five agent clients, a terminal UI, an Obsidian export and an optional self-hosted cloud server | An embedding backfill thread and an optional autosync loop run beside the MCP server and the HTTP API. Nothing rewrites or summarises the store | A state of active, needs_review or deleted computed per row when it is serialised, so it labels and does not filter. A relation verdict of supersedes withholds its target, and records the actor, kind and model that judged it; every shipped writer supplies agent or system | Comments that carry the measurement and the bug behind each decision rather than the decision alone. Two tokenizers read together because no single one both stems and quotes, with the survival rates of each published beside the code. A narrowing builder that writes a clause or writes nothing, never a clause true for every row. One visibility predicate shared by every stage, including the semantic one, with a comment saying the vector stage was the first tempted to restate it. A semantic floor calibrated on held-out answers with its false-answer rate on controls stated. Consolidation that hides rather than deletes, and is reversed by changing one verdict | The supersedes verdict that hides a memory from every listing is not consulted by the save path: a topic-key save into a hidden memory revises it in place and reports success, and an identical re-save is counted as a duplicate of the hidden row. needs_review is computed after the rows are back and filters nothing. The agent's search reads every project when the working directory is ambiguous or when it sets one argument. A judgement records its actor kind, and no writer records a person; a person's consolidation from the CLI is stamped system. The loopback HTTP API exposes the delete tool with no token. The local outbox is pruned, so outside the optional cloud server nothing records what changed |
lethe |
A row with text and a depth ∈ ℝ — 1.0 just inscribed,
(0,1) sinking, 0 submerged but present, above 1 pinned |
SQLite with three synced tables — the row store, a vec0
vector index, and a non-contentless FTS5 index so DELETE reaches it |
Hybrid vector and BM25 fused by RRF, with lexical=True
for identifier lookup and at=T reconstructing depth from
the event log |
inscribe, then control-plane verbs —
surrender, supersede, edit, pin,
consolidate |
release sets depth to 0 — present but unreachable;
purge deletes from all three indexes;
purge_with_receipt signs the result |
None. One store, no user, agent or tenant key anywhere | A CLI, an MCP server, and a six-adapter benchmark harness that runs the same control-plane contract against other systems | Gravity — depth decays over time — plus consolidation | No states. Every status collapses into one continuous
depth, which is a float and not an epistemic field |
Purge that reaches the lexical and vector substrates by construction, an Ed25519 receipt over a Merkle root of the event log, and a benchmark whose author's own system places third | A purged text can be inscribed again — the receipt records its hash for verification and no write path consults it |
letta |
Core memory block, archival passage, message | ORM database; passages with embeddings; optional git memory | Archival search, conversation search, compiled core prompt | Agent tools mutate core/archival memory | Append/replace/patch, passage insert, block update | Agent, block labels, files/sources | Deep runtime tool executor integration | Prompt rebuilds, manager services | Block tags/metadata, message timestamps; limited truth model | Clear core/archive/recall separation | Agent can rewrite important memory without strong verification |
levh |
A row in one SQLite memories table: content, type,
embedding, importance, frequency, tags, session, project, source, pinned
flag, H-score, decay factor, stability in hours, recall count, a
validity window with a successor pointer, and a workspace id |
One local SQLite file that every MCP client on the machine opens as a separate process, with tables for entities, conflict candidates, attachments, trust scores, held candidates, findings, violations, a recall log, a continuity log, and team handoffs and decisions | Vector similarity under a semantic embedder, or word overlap under
the hash fallback, combined with an H(x,ψ) ranking over similarity,
decay, importance and frequency; workspace and validity-window filters
run before ranking, and an as_of read opens the window at
an instant |
admit_memory runs a four-verdict gate first — admit,
redact, review, reject — and records the verdict in
metadata.admission; under the hash fallback the duplicate
probe is exact match only, so the gate returns reject or admit and never
review |
Edit, pin, delete, an SM-2 feedback call where unhelpful weakens stability without resetting the decay clock, and an opt-in supersession pass that closes an older near-identical memory's validity window instead of deleting it | A workspace id stamped by the store on every row and matched on
every read, with one value in every shipped transport; and a
project string passed as an optional argument to
recall |
MCP over stdio and SSE with four tool profiles, an HTTP API, a Next.js console, a generated TypeScript SDK, signed peer federation, and connectors for Notion, GitHub, Jira, Linear, Slack, email, calendar, transcripts, Obsidian, local git history and local files | A librarian that watches activity and writes findings, decay and reinforcement passes, and a spaced-repetition review queue | An admission gate with a hold queue, deterministic conflict candidates, a computed trust score with a breakdown, attachment hash verification, a violations log for learned rules, and an advisory pre-action check against recorded mistakes | The gate draws a distinction most admission filters collapse:
"review and reject are not the same refusal
and must not share a path. reject is the gate deciding —
too short, or a near-exact duplicate … so nothing is lost by dropping
it. review is the gate declining to decide: the candidate
is close to an existing memory but not identical, which is exactly the
case where the difference may be the part worth keeping." The
held_memories table is the store behind the second verdict,
and the decision path is careful: the row closes only after the admitted
memory exists, the transition is a compare-and-set scoped to the
workspace, and the admitted memory carries
admission.forced. Supersession retires a fact by closing
its validity window, keeps it readable through as_of, and
is tested in both directions |
The agent's own admit_memory MCP tool takes
force, and force=True stores a review-verdict
candidate without holding it; the tool is in the admin and full
profiles, and full is what the stdio and SSE servers advertise when
LEVH_MCP_PROFILE is unset. The documented install omits the
local extra, so the embedder falls back to hashing and the
gate never returns review: the queue cannot fill. When it does fill,
admit and discard are each reachable from one HTTP route, with no CLI
command, MCP tool or console view. The workspace boundary has one value,
because every transport binds the local principal.
valid_from is the write time, retirement is off by default,
and there is no record of what a memory said before an edit |
light-mem |
An observation, a session summary or a user prompt in the store the
hooks write; a memory_items row of kind
observation | summary | prompt | manual in the newer server
schema |
SQLite, in two schemas — a session store holding observations,
summaries, prompts and vectors, and a server store holding memory items,
projects, teams, API keys and an audit log, bridged by
legacy_observation_id and legacy_table
columns |
FTS5 over observations plus a vector table, surfaced through MCP search tools and a progressive-disclosure context block with token costs shown | Session hooks capture turns automatically; text passes through a tag stripper before storage | No supersession or retirement was found; deletion is deletion | A project per root path, with teams, team members and scoped API keys in the newer server schema | Claude Code, Grok, Codex and OpenCode through a shared worker, a plugin marketplace entry, an MCP surface, and a web viewer on the worker port | A worker service and a supervisor; observation and summary generation run off the hook path | Write-time redaction, citations by observation id, and an audit log over the newer HTTP routes | Privacy is enforced before storage rather than by a filter
afterwards, which is the stronger place for it: stripTags
removes six tag families — private,
light-mem-context, system_instruction,
system-instruction, persisted-output,
system-reminder — and a prompt that is empty once stripped
suppresses the observation for that turn entirely. Two of those names
matter more than the privacy one: the tool strips its own injected
context block and the harness's system reminders back out, so it does
not re-ingest what it or the host put into the prompt — the
self-reinforcement loop other systems in this corpus discover only after
it has happened. And PrivacyCheckValidator fixes a
conflation with the reasoning written into the code: an absent
user_prompts row "is NOT a privacy signal — treating it as
'private' silently freezes EVERY observation for the session", so a
missing row now ingests with a visible warning while only a row
present-but-empty-after-stripping suppresses, each case carrying its
issue number |
There are two stores and only one of them is audited. The session
store the hooks actually write — observations, summaries, user prompts,
vectors — carries no mutation record; the audit_log table
with its actor type, action and target belongs to the newer server
schema, written from the v1 HTTP route layer, whose
legacy_observation_id and legacy_table columns
exist precisely to point back at the older store. So an agent's ordinary
capture leaves no audit row. Nothing in either schema is epistemic: no
status withholds a record from a read, nothing supersedes or retires a
claim, and memory_items.kind is a write-time genre. The
privacy fix also chose its failure direction — when the prompt row is
missing because a hook raced worker boot, the turn is ingested rather
than suppressed, which is right for not losing a session and wrong if
the absent row was the redacted one. And the version the README badge
advertises (13.7.4) is not the version in package.json
(0.3.3) |
lightmem |
A Qdrant point whose payload carries memory beside
original_memory and compressed_memory — the
compression lineage kept alongside the stored form — plus
time_stamp, float_time_stamp,
weekday, topic_id, topic_summary,
category, subcategory,
memory_class, speaker_id,
speaker_name, a consolidated boolean, and
optional bam_tags. No status, no owner key, no validity
interval |
One Qdrant collection behind an embeddingretriever
factory that has a single implementation. Beside lightmem
the repository ships two further systems in the same tree —
em2mem at 51,630 lines and fluxmem at 3,386 —
with their own READMEs; this report reads the lightmem
package the paper describes |
Embed the query, search Qdrant with an optional caller-supplied
filters dict and a limit, then optionally apply
filter_by_tags against environment tags. That last filter
is permissive by default: drop_untagged_on_tag_filter=False
lets untagged entries through "during migration", and the
default matcher is binary — a score of 1.0 means at least one tag
overlaps, not vector similarity |
add_memory runs the ladder: a sensory buffer
accumulates messages until a token cap, an LLMLingua-2 pre-compressor
and topic segmenter cut it into topic groups, a short-term stage
summarises each group, and the result is embedded and inserted into
Qdrant with a fresh UUID if the derived id collides.
original_memory and compressed_memory are both
retained on the payload, so what was thrown away is recoverable from the
row |
Two paths, both offline.
construct_update_queue_all_entries scores each entry
against its neighbours and stores an update_queue on the
payload; offline_update_all_entries then applies an action
per entry above a score threshold — delete hard-deletes the
point, update rewrites payload["memory"] in
place with the new text. Neither writes a record of what was removed or
what the text used to be, and the online path performs no update at
all |
None. speaker_id and speaker_name sit on
the payload and no read path filters on them; there is no user, session,
agent or project key anywhere in the package. The bam_tags
environment filter is the closest thing, and it keeps untagged entries
by default |
A Python library with a LightMemory class, a
from_config constructor, an MCP directory, a web frontend,
tutorial notebooks, and per-benchmark experiment scripts. Backends reach
OpenAI, DeepSeek, Ollama and vLLM |
The sleep-time update is the point: consolidation is decoupled from
online inference by construction, so the queue construction and the
rewrite both run outside the request. A token_monitor
accounts for what each stage spent |
None represented. consolidated is a processing flag the
consolidation scan reads to find work; memory_class,
category and subcategory are write-time
genres; there is no confidence, no status and no provenance beyond the
speaker name and the compression lineage |
A three-stage ladder that compresses and segments before anything is stored, so the expensive work happens once on a filtered stream; both the original and the compressed text kept on the row, so a compression decision is auditable after the fact; consolidation moved off the request path by design rather than by scheduling; a token monitor that makes the efficiency claim measurable in the library itself | The offline update hard-deletes and rewrites in place with no record of either, so a consolidation pass that merges two facts wrongly is unrecoverable and undetectable from the store; no scope key at all, so one Qdrant collection is one undifferentiated memory; the tag filter that exists keeps untagged entries by default, which means it fails open; the whole repository carries one test file of two cases against 98,482 lines of Python, and the paper's headline numbers have their harness committed but no result |
lindahaviv-second-brain |
Four tables: an episodic run row (task, action, tool, outcome, reward, detail), a consolidated fact with a category, a dialogue turn, and a tool definition; beside them the content brain of posts, chunks and compiled wiki pages | One Oracle AI Database 26ai schema, local container or Autonomous Database, with 384-dimension MiniLM embeddings computed inside each INSERT; on the default backend the closed oracleagentmemory package adds its own BRAIN_ tables | Memory recall is exact cosine distance in SQL, top k; content search fuses vector and LIKE keyword results with reciprocal rank fusion and source weights; the default backend adds the package's hybrid search, merged with three consolidated global facts | The research agent records every run; ask.py and MCP search queries record dialogue turns; MCP ingest_note and save_chat write content rows; a nightly LLM pass rebuilds semantic facts; on the default backend the package extracts memories per exchange | Semantic facts are deleted and rewritten wholesale by each consolidation; raw runs and turns expire after 90 days, content rows first appended to a local JSONL archive; the deny-list sweep deletes matching package memories. No tombstone | A visibility sensitivity key on episodic, dialogue and content rows, written by a regex deny-list or an LLM classifier and filtered to content on every read; semantic facts and wiki pages carry none; one user per deployment | A stdio and hosted MCP server behind WorkOS OAuth and an allowlist, read tools plus two gated write tools and four prompt playbooks; a CLI research agent; a read-only web UI | A daily sync: loaders, a classify safety net, wiki refresh, consolidation, 90-day raw expiry licensed by a fresh consolidation, a report-only hygiene review, and the package privacy sweep on the default backend | None as state. A second LLM pass fact-checks each research answer against its own tool evidence and marks unsupported claims (unverified) in the text; the consolidator prompt is told not to promote those | Sensitivity decided at write time by a deterministic check and enforced in every SQL read; expiry refuses to run unless a consolidation ran within seven days; a regex sweep backs a prompt-only privacy instruction; privacy tests with positive controls | Nightly consolidation deletes every fact and inserts whatever the model returned, with no size or diff check; save_chat stores chat summaries as content with no deny-list check; the default backend is a package with no published source |
linggen-memory |
A fact with content, an optional vector, hierarchical
contexts, free-form prefixed tags, a type, a
tier, an optional outcome, an origin of user, agent or derived, a
working directory, an optional account and three clocks |
LanceDB — two tables on one connection, semantic for
curated long-term memory and episodic for staged
short-term; no ANN index is built and recall scans the filtered set |
Cosine plus an IDF-weighted keyword boost over the whole filtered row set, gated by a score floor; the filter carries account, archive, working directory, type, tier and time | Synchronous embed-and-insert with exact-content dedup within and
across the two tables; the host agent's dream promotes episodic rows to
semantic and merges with replace_ids |
A replace_ids merge archives semantic losers with
expired_at and superseded_by and hard-deletes
episodic ones; a sweep deletes judged episodic rows past TTL;
delete is hard |
An AccountScope enum whose default compiles
account_id IS NULL, beside a nesting working-directory
scope for recall and an ancestor list for session-start rules;
all_accounts widens it from any caller |
A CLI, an HTTP API and an MCP server on one daemon, and Claude Code, Codex and OpenClaw plugins whose hooks start the daemon, recall per turn and stamp the working directory | Daemon-side storage compaction on a measured condition; the dream that judges days, promotes and merges runs in the host agent through the memory verbs | None as an epistemic status. origin records who
authored a fact and outcome records how an action went;
neither withholds a fact from a reader |
A scope default that is closed rather than open, with the reasoning written down; merges that archive rather than delete; a condense detector that is read-only and zero-LLM so judgement stays with the caller | The exact-content dedup lookup ignores the archive and the account, so a byte-identical re-statement of a merged-away fact is folded back into the archive and one person's identical write lands on another's row; no audit of mutations |
lint-ai |
A SourceDocument: for hook capture, a short Request/Result/Affected paths record per Stop, PreCompact or SessionEnd; for the memory API, one message per row; for the workspace, one file. Claims are regex-extracted from its sentences at refresh | Per-project directories under .lint-ai: memory for captured sessions, workspace-memory for indexed project files. Each holds pretty-printed records.json, a binary core, a segment manifest and Tantivy segments | Tantivy BM25 over a query augmented with focus terms and entities, per-session segment routing, temporal scoring, optional conversational rerank and spaCy relation facts. Superseded documents are removed from the candidate set before ranking unless the query reads as historical | Automatic: lifecycle hooks capture the last user request and assistant result, redacted and capped at 1,500 bytes per field. Explicit: MCP add_memory, HTTP /add, Python Memory.add. Key phrases are extracted in the background | HTTP and Python update, delete, supersede and expire act on rows owned by a user id. The agent's MCP surface has add and get only, and hook-captured records carry no user id, so nothing deletes them. Supersession is also inferred at refresh from claim chains, correction words and timestamps | Physical per project for agent memory, with provider as an optional filter. memory_user_id is a keyed filter on the memory API, skipped on search when empty | Capture and recall hooks for Claude Code, Codex, Gemini CLI, AGY and OpenClaw, event recording only for Muse Code, a Hermes plugin over the HTTP API; per-provider MCP servers with search, list_memories, add_memory, get_memory, a bulletin board and recording controls; a loopback HTTP server; Python bindings | A key-phrase worker per process, backfilled synchronously at query time for short-lived hook processes; incremental rebuild of claims, relations and a temporal fact table on every refresh | A derived SemanticStatus of current, superseded, conflicted or historical per document, recomputed from content at refresh. Only superseded is filtered; conflicted is annotated on MCP search results and absent from hook-injected context | One prepared-query executor reached by CLI, IndexStore, hook and MCP entries, so the supersession filter cannot be skipped by an entry point; history queries invert the filter; captured revision and ancestry status are printed beside each injected memory; an incremental relation store differential-tested against a full rebuild; a test that fails the build on a store bypass | Inferred supersession suppresses only single-claim documents, so captured session memories are at most marked conflicted and the hook drops that mark; a capture that outlives the 2-second hook budget is abandoned; nothing can correct or delete a hook-captured record; expiry is filtered after ranking; the temporal fact table is rebuilt every refresh and read by nothing |
living-mind-cortex |
One Postgres row per memory: content, type (episodic, semantic, procedural, relational), tags, importance, emotion, source with a confidence derived from it, access counters. A RAM-only concept node mirrors its first 120 characters | PostgreSQL over a hardcoded Unix-socket URL, schema re-applied on every boot; an in-process thermal substrate and hot pool that start empty with each process; identity rows mirrored to identity/journal.json | One-row phase-vector match against substrate nodes hotter than 0.12, then pg_trgm similarity with importance, type and tag filters; results re-sorted by mood, directive overlap and recency, then expanded by linked ids and Hebbian edges | HTTP learn, inject, trace, inbox and session routes plus some twenty-five call sites inside the runtime and its scripts, one of them a heartbeat row every 30 seconds; a synchronous insert with no extraction on the write path | No update or delete route. Every recall decays confidence 5 percent and bumps access counts; old, thrice-read episodic rows become semantic; an evening or night dream pass hard-deletes weak agent-tagged rows from the last 24 hours. No tombstone | None on the agent paths. A session tag is written by several routes and filtered only by a standalone curriculum script; one database serves every caller | FastAPI on 0.0.0.0:8008 with no auth; CSM's OpenCode plugin reads GET /api/agent/context for hormone, circadian and interoception state and ignores its memories; the Python client the README names is not in the tree | A 10-second pulse loop writes heartbeat rows, ticks the substrate every 100 seconds and dreams every 200 seconds, storing LLM hypotheses as identity memories; a 60-second heartbeat runs an idle REM cycle whose third phase selects from a table no DDL creates | None as a filter. source maps to a confidence float that no read path consults; LLM dreams and crystal copies carry the identity tag, which exempts them from the only prune | CHECK constraints on type, emotion and source; one recall function behind every caller; generated flashbulb and identity columns; a small, legible heat-equation module with its own benchmarks | Every memory not recalled within about 40 minutes gains a 0.90-importance identity copy; the route CSM polls rewrites access counts and confidence on every call; REM phase 3 fails at a missing table and keeps REM re-firing; no auth on a 0.0.0.0 bind; asyncpg absent from requirements |
livingfeed |
A consolidated episode — a summary under 500 characters, an
importance float, the four factors that produced it, mandatory
source_event_ids, and tags |
Three layers — Redis lists for working memory, the event store as the permanent episodic original, Qdrant for the semantic index | Vector search per world collection, filtered on
actor_id, an importance floor, and
decay_at > now |
Consolidation at tick end folds the tick's interventions, responses, emotions and actions into one episode; summaries are template-first with LLM reserved for high importance | Nothing is updated. Semantic points carry decay_at and
fall out of recall; the episodic original is never deleted |
A Qdrant collection per world_id, plus a
must filter on actor_id inside every
search |
An actor engine with tick, director, emotion, goal and relationship services over a shared event store | The tick loop. Consolidation runs at tick end; reflection is a separate module | An importance float composed from emotion, relationship, goal and rarity — with the components stored, not just the total | Storing the importance factors so the coefficients can be tuned offline by replay; forgetting that expires the derived index and keeps the source; deterministic embeddings so CI does real similarity search | A recall failure is caught and returned as an empty list, so an actor with an unreachable index is simply amnesiac and nothing upstream is told |
llamaindex |
Block-owned content; no memory record | Chat history in any AsyncDBChatStore, SQLAlchemy by
default; blocks hold their own state — a vector store for the vector
block, an in-instance list for facts |
Per-block: vector retrieval, extracted facts, static text — composed, not fused | Short-term history overflow flushes token_flush_size
into blocks |
Condensation rewrites the fact list wholesale; no tombstone | session_id keys the chat store and is stamped on
flushed vector nodes and filtered on vector retrieval, but the filter is
written into the block instance and kept for later sessions; fact and
static blocks ignore it |
LlamaIndex agents and workflows; custom blocks via
BaseMemoryBlock |
None; extraction runs on flush | None — extracted facts record no source | One explicit budget split, flush-on-overflow into composable blocks, and a condense prompt that states its full-replacement contract | No shipped block implements truncation and blocks default to never-truncate; a vector block reused across sessions keeps the first session filter; facts carry no source or scope |
llm-memory-api |
A markdown document in a namespace, chunked into
memory_chunks for indexing, with a kind, a client-supplied
metadata object and a soft-delete stamp; beside it chat messages, mail,
and discussions with participants, ballots and votes |
PostgreSQL with pgvector, built by 279 migration files;
docs/schema.sql is a snapshot from 24 July 2026 and the
root schema.sql one from 8 April 2026 that lacks
note_permissions |
Vector search over chunks with a BM25 boost, a filename boost, time decay by kind or cognitive type and an access boost, narrowed to one permitted namespace or, for a wildcard query, to the readable namespaces plus note shares; a substring or regex grep over notes | REST and MCP tool handlers write documents into a namespace after a permission check, falling back to a note-level share; a chunker splits them; embeddings and enrichment run as services | Edit in place by search-and-replace; delete is a soft delete that removes the chunks and can be restored; a daily cron soft-deletes notes whose decay factor falls below 0.05 and empties retired conversation notes to content-free rows; permissions are rewritten wholesale by an admin route | A namespace_permissions row per actor and namespace
carrying can_read, can_write and
can_delete, with / as a wildcard and an
implicit grant on the namespace named after the actor;
note_permissions shares an exact slug or a folder with one
actor or all, matched as a prefix on the access check and in search |
An MCP server plus a REST API, a web dashboard with a notes tree, OAuth for claude.ai including public clients, installers and a deploy script; presented as working with Claude Code, claude.ai, Cursor, Windsurf and any MCP client | Embedding and enrichment services, a daily cleanup cron for decay, call-log purge and conversation retention, a dream consolidation service with a shared cron, and virtual-agent rate limiting | Per-actor permission tables, per-agent API keys and HMAC OAuth tokens, an identity check that refuses a tool argument naming another agent, an error log, and discussion outcomes derived server-side from closed votes | A deliberation model with participants, ballots, majority or unanimous votes, a realtime or async mode, and an outcome derived from the closed votes rather than declared by the concluder; a permission table that separates read from write from delete; every retrieval path, including the context assemblers, reads through a namespace check | The note-share check and the search filter match every
slug_pattern as an unescaped LIKE prefix, so a share of one
note grants its prefix siblings to a model-supplied slug; the
ingest-status listing passes the actor type where the name belongs; any
registered user can list every share in the deployment; a discussion
concluded with no closed vote is recorded as consensus; no test covers
either permission service; permissions are cached for two minutes and
HMAC OAuth tokens do not expire |
llm-wiki-cli |
Two shapes in one database. A wiki Page — slug, title,
an optional kind and summary, a Markdown body whose
[[slug]] links become edges, the paths of the sources
supporting it, an ordered provenance list, created and
updated. And a memory_event — a 64-character fingerprint,
an event type, a context, occurred_at,
recorded_at, an optional validity interval, a
pinned flag and a logical byte count — with
memory_fragments typed observed,
decision, constraint, learned,
unresolved or outcome,
memory_changes holding a subject with its before and after
values and a reason, memory_evidence holding a reference
and an excerpt, and memory_relations typed
supersedes, contradicts,
resolves, supports or
related |
SQLite with a versioned migration chain, one database per scope:
.lwc/wiki.db under the project root and a separate store
under the home directory. There is no scope column —
Scope::Project and Scope::Global resolve to
different files and Scope::All opens both read-only. An
FTS5 contentless index sits over the memory events, and changesets and
checkpoints sit over the wiki |
Two arms. The wiki search is weighted lexical with graph awareness —
title thirty-two, path sixteen, generic eight, a graph-match and a
graph-hub term — and decorates each result with the page's provenance.
Memory recall is FTS5 bm25 with column weights, bounded by
a configured age window and optional
since/until on event time, with every
candidate resolved forward through the supersedes chain and
re-ranked by a feedback score clamped to plus or minus three |
An agent drives it as a CLI or over MCP. A page cites its sources
with a repeated --source and declares
--provenance otherwise; a citation adds
source-grounded automatically. A memory event is a capsule
of JSON — remember — deduplicated by a 64-character
fingerprint and idempotent under a request_id, where a
replayed request with a changed payload conflicts instead of mutating. A
semantic wiki relation is refused unless its type is one of six, its
provenance one of four, its reason non-empty and its confidence a finite
number in zero-to-one |
Supersession rather than deletion at the memory layer: a new event
points a supersedes edge at the old one, recall returns the
successor, and the old event stays reachable behind an explicit flag.
Retention does delete — an age pass evicts events past the configured
window and a byte-budget pass evicts the oldest, both skipping anything
pinned or carrying an unresolved fragment, with the counts kept in a
memory_state row. The wiki layer has changesets with
restore and rollback |
Physical rather than keyed. A project store and a global store are
separate SQLite files chosen by a Scope enum, and
Scope::All reads both and labels each result with the store
it came from. No record carries a scope key and no query filters on one,
so this partitions the way a per-project configuration directory does
rather than the way a tenant column does |
A CLI on npm as @i-xor/lwc and on crates.io as
lwc, an MCP server, and a published skill; documented for
Claude Code, Codex, Cursor, OpenCode, Gemini CLI, Kiro, Hermes,
Antigravity, Copilot in VS Code, Copilot CLI, Copilot for JetBrains and
pi. READMEs in seven languages |
A hint engine runs inside every remember: it returns up
to three prompts to the agent — a contradicts or
supersedes edge needing review, five or more events sharing
an exact type and context, an unresolved fragment older than fourteen
days, and storage past eighty per cent of the byte budget — each
suppressed by a seven-day cooldown row that a prune pass clears when it
expires. Beside it, age and capacity eviction, ingest jobs with a status
ladder, checkpoints, and a git-backed sync |
Three separate vocabularies. The wiki has a four-value ordered
provenance — source-grounded, user-provided,
agent-observed, hypothesis — rejected at the
boundary if unrecognised, decorated onto every search result, and
filtered on nowhere. Memory events have latest_known versus
superseded, resolved from the relation graph on every
recall and used to drop the replaced event, beside an
unresolved_conflict flag and a live_verified
field pinned to false. And memory_feedback
records a useful or not-useful signal with a
mandatory reason, aggregated into an integer clamped to plus or minus
three that adjusts rank by five per cent and never excludes
anything |
A recall that walks the supersession chain and hands back the
replacement, with the history one flag away and each result labelled; a
provenance vocabulary that names a hypothesis as a hypothesis and
refuses an unrecognised value; retention that protects pinned events and
anything still marked unresolved, so the open questions are the last
thing forgotten; benchmark adapters that pin the upstream by commit and
the dataset by content hash and stamp a limited run
partial=true; an operations log written through one helper
from fifty-four sites; a mandatory reason on a wiki relation and on a
feedback signal alike |
The wiki's provenance ladder is stored, ordered, validated and
attached to every result, and no read path acts on it, so a hypothesis
ranks like a cited fact; valid_from and
valid_until are written, cross-validated and returned but
appear in no WHERE, so the explicit validity interval is a
column rather than a mechanism; recorded_at is never a
predicate, so there is no as-of-record-time query; scope is a choice of
database file rather than a key, so nothing partitions two callers
sharing a store; the memory layer is off unless a scope enables it; and
123,311 lines of Rust from two authors in about six weeks is a lot of
surface per commit-month |
llm-wiki-memory |
Typed Markdown atom, plan/investigation, daily capture, or full document | Filesystem wiki, per-category embedding caches, private git history | Metadata prefilter, on-device EmbeddingGemma cosine over leaf and chunk caches, priority bands, federated locality boost; a lexical backend that serves as a degraded fallback rather than a fused channel | MCP/CLI writes, transcript and plan hooks, daily compile, full-document absorb | Upsert/relocate, archive/re-enable, exact delete, supersedes, opt-in dedup/refresh consolidation | Private brain plus explicit repository wiki levels; workspace/area/task/subject facets | MCP, CLI, Claude Code lifecycle hooks, shared instructions, and a local web app that edits through the engine | Detached flush, daily compile, opt-in consolidation, cron healing, git/cache maintenance | Body hash, capture audit, git history, user-gated lessons, and a
fail-closed quality judge whose memory.quality: unverified
marker the code itself calls a reserved affordance — preserved on every
write, consulted by no read; no candidate/verified/rejected state |
Recoverable capture, explicit targets, deterministic layout/topology, excellent operational tests | LLM atoms become active without verification; the one epistemic marker has four writers and no reader; vector-only primary retrieval; linear scans; git is not erasure |
lobu |
An immutable events row — title, payload text or JSON,
semantic_type, occurred_at, provenance columns
for connector, connection, feed, run, client and author, an
entity_ids array and a supersedes_event_id
edge — beside a typed entity graph whose rows carry a jsonb body,
per-field human-ownership controls and normalised identity claims |
One Postgres database with pgvector: events append-only
under a DELETE-blocking trigger, event_embeddings as
per-chunk 768-dimension vectors, a generated search_tsv
column, and entity, identity, relationship, ACL, run and approval
tables |
Hybrid on one SQL statement: ts_rank_cd over the
generated tsvector plus an ILIKE bonus, linearly combined with the
best-matching chunk's cosine similarity at a default 0.6 vector weight,
over a candidate set expanded through identity-graph joins; filters for
entity, semantic type, classification, date on occurred_at,
automation and per-agent scope |
save_memory appends synchronously and returns an id
that is lexically searchable at once; the embedding is left null and
filled by a */5 backfill run per organisation, reported to
the caller as indexing_status. Connector ingest supplies
its vector inline. No LLM extraction on the hot path |
Append-only throughout: a correction is a new row carrying
supersedes_event_id, a delete is a
tombstone-typed empty row doing the same, a unique partial
index allows one superseder per target, and the
current_event_records view masks every superseded row from
all recall. Nothing is physically removed except an organisation cascade
or an explicitly opted-in maintenance transaction |
Three ANDed SQL predicates compiled from one AuthzScope
— tenant, private-versus-org connection ownership, and
member_of membership of the source system's own resource
mirrored from GitHub and Slack, failing closed while the ACL sync is
stale — plus a per-agent metadata->>'agent_id' filter
on search_memory's content arm and a per-entity-type read
policy applied to agents in application code |
A remote MCP server with fourteen advertised tools over OAuth, a
connect CLI for Claude Code, Codex and OpenCode, a
capability-scoped TypeScript SDK sandbox behind
query_sdk/run_sdk, REST and OpenAPI, and
Lobu's own persistent agents whose turns run a recall-and-capture plugin
and a pre-compaction memory flush |
Cron jobs on the server: embedding backfill every five minutes, ACL graph re-sync, classifier reconciliation, approval expiry, feed polling and scheduled automations; a worker drains runs and an embeddings service holds the model | Provenance is thorough — connector, connection, feed, run, OAuth
client, author and acting agent on every row, with a server-owned
_lobu_ metadata namespace stripped from caller input — and
epistemic status is absent: no memory carries a state that withholds it
from being believed, and classifier confidences are returned but never
filtered on |
The scope predicate is worked out to an unusual depth: one compiler, three composed fragments, a three-state ACL split that fails closed on a stalled sync, and end-to-end tests that pair each exclusion with a control asserting the row is visible without the gate | Correction is masking, not refusal — a retired value can be re-saved as new and nothing is keyed on the value; the per-agent fence quietly narrows a Lobu specialist's own recall to what it wrote; and the plugin's auto-capture appends verbatim turn pairs into the shared org store with no extraction or deduplication |
local-memory-mcp |
A learning (category, content, project, tags, confidence, episodic or semantic), a decision with reasoning and alternatives, an entity with time-bounded observations and typed relations, a session summary, and profile and goal strings in a meta table | One SQLite file per user under the OS data directory; one FTS5 table kept in sync by triggers and one sqlite-vec vec0 table of 384-dimension vectors from multilingual-e5-small run in process | memory_search fuses FTS5 BM25 and vector cosine with RRF k 60, then multiplies by a recency, usage and importance boost; memory_recall is FTS5 over learnings; entity_open reads live or as-of observations and one hop of relations | Explicit MCP tools, synchronous; each row and its embedding commit in one transaction. Exact-content duplicate learnings bump a counter; there is no fuzzy merge and no model extraction | learn_update overwrites content in place and re-embeds; learn_archive sets archived with an optional reason; observation_supersede closes the validity interval; entity_delete hard-deletes an entity and its observations. Decisions cannot be edited or retired. No tombstone | Optional project and tag predicates on search and recall for learnings and decisions; entities and observations are unscoped; session_start ranks the current project first without excluding others. Single user per file | Stdio MCP server with 25 tools and server instructions asking the model to call memory_session_start first; README offers a CLAUDE.md line or a SessionStart hook that only tells the model to call it | None, apart from a boot-time backfill of missing entity embeddings. A contradiction scan and a reflection summary run only when called | None. Confidence is a caller-set float that is stored, exported and compared by the contradiction scan but never filters; verified columns have no interactive writer | Row and vector commit atomically; a fuzzy merge that overwrote unrelated learnings was removed and its test rebuilt to fail if it returns; retired observations stay queryable as of a date; import validates every record with the interactive schemas and canonicalises ids; search reports when it downgraded from hybrid to FTS | An archived learning is re-stored verbatim as a new live row; export then import drops every learning archived with a reason; reflect calls a learning never recalled when nothing records recall; the importance boost has no interactive producer; entity_delete leaves the entity's own vector |
logseq |
An outliner block or page in a DataScript graph, typed by user-defined tags (classes) and properties with declared types and cardinality | DataScript over SQLite, local-first; FTS5 trigram index and a 384-dimension vector index alongside; optional multi-device sync | Four lexical arms — exact title, FTS5 match, LIKE, fuzzy — plus optional local vector search, fused by RRF with early exit when cheap arms suffice | Synchronous and literal. A human types, or an agent calls upsertNodes with add/edit operations; no extraction, no LLM in the write path | :db/retractEntity hard retraction with orphaned-page
cleanup; agents cannot delete at all — no delete tool exists |
A graph is a separate database; there is no principal, tenant or agent key inside one | MCP server over the desktop API with six tools, an HTTP API server, and the editor itself | Embedding upserts in batches of 1024 and index maintenance; nothing derives or consolidates memory | None. A created-by-ref property exists in the schema,
is set by sync, import and emoji reactions, and the agent write path
never sets it |
A schema the user defines and the agent must obey; genuinely local hybrid retrieval; the best editing surface in the atlas | Agent writes land live, unmarked and indistinguishable from the user's own; hard retraction with no history |
longterm-memory-mcp |
A row with content, a SHA-256 content hash, free JSON metadata that also carries a reinforcement accumulator, an embedding, tags, an importance from 1 to 10, a memory type, and created, updated and last-accessed timestamps | SQLite through sql.js compiled to WebAssembly, loaded
into memory once at start and exported as a whole file on every persist,
with no lock and no reload; a schema_meta version whose
mismatch drops the memories table |
In-process cosine over all-MiniLM-L6-v2 embeddings of
every row, ranked by similarity alone; type and tag listings ordered by
stored importance; a creation-date range |
save_memory with exact-content dedup — a repeat throws
naming the existing memory's id — and update_memory, which
overwrites content, metadata, tags, importance or type in place |
Half-life decay per memory type with per-type floors and protected
tags, applied lazily on access; hard delete_memory by id
and delete_all_memories; deleted rows survive in the
automatic backup snapshots until ten later ones prune them |
None in the store. One database file shared by every client and
project unless MEMORY_DB_PATH points elsewhere; the
companion skill writes the project name into the content as a prefix and
a tag, and nothing filters on either |
An MCP server launched by an unpinned npx -y, with a
Claude Code plugin that installs the server and a companion skill
telling the model to recall at session start and save after tasks,
silently |
No timer. Decay and reinforcement are computed on access; a copy of the database file and a JSON export run on save — the first save in each process, then every 24 hours or at a count that is a multiple of 100 — keeping ten | Nothing epistemic. Protected tags exempt a memory from decay; the schema version protects the code from an old file by discarding the file's memories | The forgetting policy is one table: half-lives of 10, 30, 45, 60, 90
and 120 days for ephemeral, task, conversation, general, preference and
fact, a floor per type, and a protected-tag set (core,
identity, pinned) that exempts a memory
entirely. computeDecay is exponential on idle days, rounded
to the nearest half point and clamped to the floor, and every constant
sits in DECAY_CONFIG under a name. Reinforcement banks 0.1
per access in an accumulator and moves importance only at 0.5. Dedup
throws with the colliding memory's id, so the caller knows what to
update |
Every non-protected read writes.
applyDecayAndReinforcement updates the accumulator and
last_accessed and exports the whole database file, and
search_memory runs it for every candidate above the
similarity threshold before the limit is applied. Each server process
loads the file once and writes its own copy back with no lock, so two
sessions on the shared default file overwrite each other's saves. A
schema version mismatch in either direction drops the memories table, by
design and under test. Decay below the half-point step is discarded,
because the access that skipped it resets the idle clock. Nothing is
epistemic: no status, provenance, supersession, validity interval or
change record, and updates overwrite |
loongflow |
Message in graded tiers; Solution with score and
timestamp in the evolving population |
In-memory or Redis for the population; pluggable storage for graded tiers | Graded tiers by recency; population by Boltzmann selection with adaptive temperature | Messages flow through stm to mtm to ltm via a compressor; solutions appended with a score | Compression across tiers; population turnover by selection pressure | Not traced | LoongFlow agent SDK | Auto-compression between tiers | Score on each solution; no trust state on messages | The only stochastic recall in the atlas, and the Boltzmann selector is tested as a distribution rather than a value — repeated draws asserted to favour higher scores, and low temperature asserted to concentrate more than high | Two unrelated memory models under one package; the temperature falls
as diversity falls, so selection tightens on a converging population;
the diversity function that makes the temperature adaptive is named in
no test, its docstring says sigmoid where the arithmetic is linear, and
its sample_size samples solutions while documenting
pairs |
loreai |
A knowledge entry with a stable logical_id across
immutable versions — category, title, content, tenant, project, a
cross-project flag, a confidence on a separate metric register, a
sensitivity, an approval status with approver and time, a promotion
status, the provider and model that produced it, and
last_reinforced_at for decay |
SQLite with a vector extension, an immutable knowledge
version table behind a knowledge_current view, a
knowledge_meta metric register keyed by
logical_id, plus a curated .lore.md in the
repository |
Distillation feeding a gradient context manager feeding a knowledge curator; hybrid vector and lexical search, with entries injected into a session and re-injected after the first turn | A transparent LLM proxy observes traffic and distils it; the curator writes entries; structured import from other memory formats; edits append a new version | An edit appends a version and demotes the prior one; a delete appends an immutable death certificate with no physical DELETE; confidence decays when an entry is not reinforced; contradictions are detected and left for a person | Tenant, project, an explicit cross-project flag, and a team scope a project is bound to, with promotion policy per scope and an optional per-project override | A standalone gateway proxy, an OpenCode plugin, a Pi extension and a shared core engine, published as separate packages | Idle-time contradiction detection, embedding and vector workers, a decay pass, curator consolidation | Approval and promotion states, sensitivity levels, per-entry
confidence with reinforcement decay, attribution of which worker model
produced an entry, and a .lore.md diff that shows up in
review |
A delete that leaves a readable record and two import lanes that consult it; contradiction detection that refuses to pick a winner; an approval that survives a content edit; the curated file being version-controlled Markdown a team reviews in a pull request | The approval status that decides team sharing is documented as local and not synced, so the gate is per-machine state on a system whose premise is shared memory; the proxy sits in the path of every prompt and response; the licence is FSL-1.1, source-available and converting to Apache-2.0 later, not open source at this pin |
lorekit |
A lesson addressed by (scope, key) — a text value up to
64 KB with tags, source_agent and trigger |
Supabase Postgres with row-level security and a generated FTS column; or a local two-tier Markdown store in the CLI | Exact scope equality plus
websearch_to_tsquery full-text; the narrow-to-broad ladder
is three separate calls the agent is told to make |
memory.write upserts in place on the unique key; no LLM
anywhere; a GitHub webhook writes PR review comments through a
deterministic signal filter |
Upsert overwrites the value with no version kept; soft archive, restore, TTL expiry, and two hard-delete purge RPCs | global, project::, repo::,
branch:: — validated, applied as a read-path filter, and
backed by Postgres RLS and org roles |
MCP over a Supabase edge function, a CLI, and marketplace plugins for Claude Code, Cursor and Codex | None scheduled in-repo; purge is an RPC called by the dashboard, an MCP tool, or a pg_cron job the operator sets up | No status on a memory. Provenance is source_agent and
trigger; the recurrence and entrenchment guards are prose
in a skill file |
An authenticated tenancy boundary in the database rather than a scope tag, and an audit log made append-only by having no update or delete policy | The audit log records that a value changed and never what it was; archive deliberately frees the key so the same lesson can be re-asserted |
loreweave |
A fact — subject, predicate, object, a display form, a valid window, a recorded time, supersession columns, a source type, the note path and block anchor it came from, and a confidence — written as a markdown line and replayed into a row | A markdown vault as the durable store, with a SQLite index of notes, blocks, links, entities, mentions, edges, facts, fact links, embeddings and an access log, rebuilt from the vault whenever an index sees a changed note | Lexical search over blocks, embeddings, and a graph of entity mentions, co-occurrence and current-fact edges, with a rerank stage and a retrievability decay fitted from the vault's own access history; facts are queried by slot, as of a valid date, or as known at a record date | lore assert and lore invalidate from the CLI, lore_assert_fact and lore_invalidate_fact over MCP, a capture path that appends timestamped bullets to any vault note, and extraction from frontmatter and field syntax in any note | A new value closes the slot's previous one; an invalidate line closes the current value at a date; nothing deletes a fact, and removing one means removing its markdown line or the note field it was extracted from | None — the vault is the boundary; search takes optional folder and tag facets chosen by the caller, and no fact carries a scope key | A lore CLI, an MCP server with fifteen tools, a file watcher, and a session-resume delta computed from record time | A dream pass that consolidates, proposes links, writes a digest and a review-queue note, and fits the vault's forgetting-curve shape from its own retrieved-then-used history | Provenance on every fact through the note path and block anchor it came from, a stated, extracted or inferred source type honoured from a line only under lore/journal, and a confidence; supersession closes rather than overwrites | The authoritative artifact is the user's markdown, and the index is a replay that can be wiped. Assertions and closures are appended to a dated journal before any row changes, and a rebuild reproduces the same fact state, which a test pins. The code refuses inputs it cannot make meaningful and says why: a subject that normalises to an empty key, a close before its start. Totals are returned rather than requested: a capped fact query or aggregate reports how many matched, because the bug each replaces was a caller not asking. Commit messages carry the reproduction for each fix, with the measured output before and after | There is no scope of any kind, so two agents sharing a vault share every fact in it. The record-time axis has gaps. valid_until is one column rewritten by each close, so asOf combined with an earlier asKnownAt answers from a close learned afterwards. An invalidate records no transaction time. An extracted fact's recorded_at is its note's modification time, and a recorded_at attribute in any note is believed. By reading, an invalidate on a slot held only by an extracted fact is lost at the next replay, because extraction inserts after the journal's closes are applied. source_type withholds nothing from retrieval. The only adjudication surface is an MCP tool description addressed to the model |
lossless-context-mcp |
One version of one file, addressed by the SHA-256 of its content, with a git blob sha1 beside it and an event recording when and how the agent came to see it | A content-addressed blob store on disk plus per-writer append-only JSONL event logs, and per-session working-set manifests under a context root | Rank and re-emit rather than search: restore_context
replays the ranked working set from current disk state under a token
budget, packs rank stable hot files across sessions, and receipts
resolve exact versions |
Hook-fed. A PreCompact sweep parses the session transcript and archives every file the session touched — native Read/Edit/Write included, not only MCP reads — and blob writes are content-addressed, idempotent, temp-file-then-rename | Nothing is updated. A new version is a new blob under a new hash;
deny-listed paths are never written at all, and their events carry
excluded: true so the record of the access survives without
the content |
Session and repo are recorded on every event and manifests are per-session files; the deny list is the enforced boundary, applied at write time rather than at read time | An MCP server plus five Claude Code hooks — sweep at PreCompact, manifest injection at SessionStart(compact), an edit guard at PreToolUse, an edit publisher, and an epoch reset | None scheduled. The sweep runs on the compaction path and is benchmarked to sit there — one 14 MB transcript in 361 ms | No epistemic state on content. What the system tracks instead is whether the model has actually seen the current version of a file, and it refuses an edit when it has not | A benchmark that publishes the project's own negative result on the realistic workload, with losslessness as a mandatory second metric proved by byte-for-byte reconstruction after every operation | The compression premise does not pay on real sessions by the project's own measurement, and the value that remains — restore, coordination, receipts — is the part the benchmark does not score |
m-flow |
Typed graph nodes — Entity, Facet, FacetPoint, Episode — each with an event-time interval beside its record time, plus versioned Procedure nodes built from key points and context points | SQLite for users, datasets, ACLs and a node-and-edge ledger; an embedded Kuzu graph and LanceDB vectors, one pair per dataset under access control; Neo4j, pgvector and others as alternatives | Five recall modes the caller names; the episodic mode scores each Episode by the cheapest path from a vector-hit node, where an edge costs its own text's distance to the query, a missed edge 0.9 and a hop 0.05 | memorize summarises documents into Episodes, Facets, FacetPoints and Entities with model calls; procedural extraction is off by default and, when run, sends every summary to a model router first | A procedure's new version deprecates the old node and links it by a supersedes edge; a patch merges into the same node; document delete removes the subgraph and stamps deleted_at on ledger rows | Datasets, by stored read permission and current tenant, resolved before any retriever runs; each permitted dataset has its own graph and vector database. One environment value turns it off | Python library, FastAPI server, an MCP server with memorize, search, learn, delete and prune tools, a Next.js frontend, an OpenClaw skill and a starter kit | The MCP memorize tool runs the pipeline as an in-process task and returns a task id; a Modal worker queue replaces direct graph and vector writes only when MFLOW_DISTRIBUTED is true, on the Neo4j and pgvector adapters | A procedure status of active or deprecated and a high or low confidence, both spent as ranking penalties and a card label; nothing withholds a memory from use | Query-conditional edge costs with a minimum over paths, documented and implemented as documented; dataset isolation that fails closed on unsupported backends and is tested across users and tenants in CI | The procedural governance package — worth-storing, deterministic-first conflict detection, the two-layer trigger, version diffs, active reconciliation, usage statistics and the sensitivity screen — has no importer; the CYPHER recall mode runs caller text as Cypher behind read permission |
m3-memory |
A memory_items row: type from a closed list, title, content up to 50,000 characters, metadata JSON, agent_id, user_id, scope, importance, confidence, valid_from and valid_to, is_deleted | SQLite by default (agent_memory.db with FTS5 and BLOB embeddings), PostgreSQL as an alternative primary; separate SQLite files for chat logs and indexed files | Hybrid BM25 plus exhaustive cosine over BGE-M3 vectors, MMR, optional reranker; an FTS exact-substring short-circuit; opt-in graph and session expansion on the routed search | Explicit MCP or CLI memory_write; content-safety regex gate; embedding inline when a fast embedder is up, else deferred; automatic contradiction check that can supersede older rows | memory_update in place with history; memory_supersede closes valid_to and soft-deletes the old row; soft or hard delete; gdpr_forget erases a subject; no tombstone | user_id, scope (agent, user, session, org) and agent_id columns with SQL predicates, all caller-supplied and empty by default; requesting_agent isolation opt-in | stdio MCP server with lazy tool loading, a Claude Code plugin whose hooks capture chat turns on Stop and PreCompact, a JSON CLI, an HTTP bridge with bearer auth, LangChain, CrewAI and PydanticAI adapters | A cognitive loop running classification, embedding backfill, entity extraction, observer and reflector model passes, and hourly maintenance: decay, reinforcement, retention and expiry purges | Float confidence from provenance and a corroboration ledger, ranking only and off by default; no status withholds a memory | Supersession closes validity with a compare-and-set so racing writers cannot double-close; one scope predicate builder shared by every candidate path; content_hash per row; failures in the embed path logged with cause and repair command | A write with cosine above 0.92 and different content soft-deletes an older same-type memory, across agents when agent_id is empty; as_of cannot see superseded rows; the FTS short-circuit drops requesting_agent, as_of, variant and conversation_id; model-supplied identity on stdio |
magic-context |
Memory with separate lifecycle and verification state, plus compartments, facts, primers | SQLite (70 migrations) with FTS5, embeddings keyed by
(memory_id, model_id), git commits indexed |
Hybrid semantic + BM25 with source boosts and
matchType, over memories and raw history |
Agent, user, historian, or dreamer writes; synchronous promotion, async embedding | Supersession and merge lineage; archived, not tombstoned | project / ecosystem /
universe lattice plus a shareable flag |
Pi ExtensionAPI and an OpenCode adapter sharing one
store |
Dreamer: verify, map, classify, promote, retrospective, at commit boundaries | Four-actor sourceType, mutation logs, per-memory
verified_at |
Memories re-verified against the files they describe when git says those files changed | Verdict is an LLM call; no rejected-value tombstone; very large surface |
magicore |
A Memory record — text, a required UserId,
AgentId, RunId, Scope, metadata,
CreatedAt, UpdatedAt, ExpiresAt,
a content hash, a Behavior and a MemoryType; a
spatial observation or a robot's evidence rides as JSON in the metadata
under its own MemoryType |
An in-process store; a VectorDataMemoryStore over any
Microsoft.Extensions.VectorData connector — Postgres with
pgvector, SQLite and in-memory in the samples — with a second collection
for history; a Qdrant store over its HTTP API that keeps no history |
Cosine top-k from the store with the scope filter pushed down and re-applied, BM25 over the candidates plus entity and graph boosts when hybrid, an optional reranker, an optional recency bias; a reference-time range from an explicit range or a regex interpreter that fails open below a confidence; point-in-time search re-embeds the reconstructed rows at query time | Optional LLM extraction and an LLM conflict resolver, or raw text; an optional admission gate — injection signatures, novelty, authority — whose refusal reason is discarded; dedup on hash plus reference time; every add, update and delete writes a history entry | Update by id, delete by id, delete by filter,
ForgetStaleAsync by retention window, and
RollbackAsync to a timestamp that restores snapshots and
deletes later rows without writing history |
UserId, AgentId, RunId and
Scope compiled into the backend filter and re-checked in
MemoryFilterEvaluator; a search with no filter crosses
users; spatial and robotics recall add MapId and
FrameId after the scan |
A .NET library multi-targeting netstandard2.0 to net10; a nine-tool MCP sample server; Agent Framework, Semantic Kernel, Ollama and ONNX samples; a Godot robot sample that sends beliefs, relations and recent attempts to a vision model with the current frame | None; ConsolidateAsync and
ForgetStaleAsync run when called |
Behavior marks a row factual or speculative at write
time and search withholds the speculative by default; robotics recall
derives Observed, Stale, Occluded, Missing, Uncertain or Conflicted per
object at read time and stores none of it |
Event time beside record time with a confidence-gated interpreter that fails open; a history entry per mutation with the old and new text; robot evidence replayed by capture time so an old sighting cannot outrank a newer absence, and a belief state that says when to look again | The history collection is written and never read — point-in-time reads and rollback run on an in-process queue and do not survive a restart, and the Qdrant store keeps no history at all; rollback mutates without a history entry; spatial recall is a full scan and a JSON parse of every row in scope |
mainline |
A sealed intent: goal, title, what, why, decisions, rejected alternatives, review notes and a semantic fingerprint of files and subsystems, written by the agent at seal; beside it explicit constraint, risk and follow-up records | One commit per event on a per-actor Git ref under refs/mainline/actors, pushed with the repository; merge evidence as Git notes on main; a rebuilt JSON view and SQLite index under the git-ignored .ml-cache directory | Deterministic additive scoring over file overlap, path-derived subsystem, keyword hits in title, what, why and decisions, open risk and follow-up text, recency and same branch; top five by default, superseded lineage pulled in after its replacement | Agent-driven through the CLI: start a draft, append turns locally, seal with a JSON payload that lint must pass; constraints only through an interactive guard add that refuses a non-terminal stdin | Abandon writes an event; superseded and reverted are read by every surface and written by no command in the tree; no delete of a sealed intent or a constraint | Physical: the repository and its remote. Actor id and branch are provenance and a ranking boost; no read path filters by them | Session-start and prompt-submit hooks for Claude Code, Codex, Cursor and Pi inject a status snapshot capped at 32 KiB and 16 KiB; a skill tells the agent when to run context, start, append and seal | None scheduled. Every session-start hook runs a sync that fetches all actor logs, replays every event and rewrites the view; auto-pin writes merge notes on main | Lifecycle and a derived retrieval status of current, superseded, abandoned or stale that labels and multiplies by 0.85 and filters nothing; drafts are excluded; constraints are the only records presented as hard rules | The event log is the state and appends by compare-and-swap; seal refuses agent-authored constraints, risks and follow-ups; resolved risks drop out of scoring with a negative test; supersession lineage is pulled in and ordered after its replacement; hook context has byte budgets | Superseded and reverted have no producer, yet two thirds of the published eval advantage is on a superseded fixture; any actor can abandon or re-seal another actor's intent; nothing in the store can be deleted, and it travels with every push |
maka |
Three. A fact item in memory.sqlite: content, kind, fact, plan or prediction, event bounds, global or workspace scope, keys and the user-message events it quotes. A MEMORY.md entry with a status and an optional session scope. A free-form document in an agent-maintained index whose links cite original messages | memory.sqlite under the storage root in WAL mode with synchronous FULL: items, keys, sources, write receipts, per-Session extraction cursors and failures. MEMORY.md and PENDING.md as files with one backup per kind. The personal assistant's network.sqlite: documents, fragments, references, indexes, entries, links and an append-only commits table | The Recall tool returns up to 10 facts by exact or prefix key match, ranked by matched-term count then recency, plus BM25-ranked transcript passages from up to 200 Sessions. MEMORY.md active entries are injected into the prompt only when agent reading is enabled. Index documents are read by key or literal search through assistant tools | Facts: memory_remember extracts in the foreground and memory_extract or a compaction checkpoint in a background lane, with up to 3 model calls, admitted only when every citation is a substring of a user message. MEMORY.md: a person saves the file. Index: the assistant agent writes documents with MemoryIndexWrite and MemoryIndexEdit | Facts have update, archive and restore verbs with compare-and-swap, and none has a production caller; nothing deletes an item, and a purged Session leaves its facts. MEMORY.md entries are archived or edited by hand, or reset to the default. Index documents are replaced in place, and empty text deletes one | Facts: a global or workspace scope_key equal to the Session's workspaceRoot, filtered in SQL on the fact read. The same Recall call returns transcript passages from every Session on the Host with no workspace predicate, so the agent read path is not scoped. Global versus workspace is the extraction model's choice. MEMORY.md: session-scoped entries shown only to their Session. Index reads assert the caller's source visibility | Built into the Maka Runtime Host shared by the Electron desktop, TUI, CLI and an ACP agent: memory_remember, memory_extract, Recall, RecallMore and RecallMaterial for root Sessions, a Local Memory prompt block, memory.query and memory.mutate host operations, and nineteen Memory tools in personal-assistant Sessions | A per-Session extraction lane for memory_extract and automatic compaction-time extraction, on by default; one retry of a failed range, then a durable discard. The memory network schedules index maintenance every 12 hours once enabled, run by a background Maka agent session | No epistemic state on facts: lifecycle is active or archived, and origin records agent_extracted or user_requested. MEMORY.md has review_required, rejected and active, but proposals land in PENDING.md, which no prompt reads, and no shipped client sends propose or approve | Admission that cites user-authored text only; one-transaction commits with idempotency receipts and a per-Session cursor that never re-reads a range; a workspace predicate derived from the Session header on both sides; secret redaction before matching; an append-only log of every index write | No production path corrects, archives or deletes a fact; one Recall call joins a workspace-scoped fact layer with transcripts from every workspace, archived Sessions included; the extraction model chooses global scope; event bounds are stored and never read; the MEMORY.md review queue has no producer and no actor check |
mama |
A judgment row in the decisions table: topic, kind (decision, preference, constraint, lesson, fact, task, schedule, workflow), summary, details, confidence, status, event date, provenance columns and a JSON payload; guidance kinds carry an applies-when line and workflows ordered steps | One SQLite database per product via node:sqlite, with FTS5, an in-process cosine cache over 1024-dimension e5-large embeddings, and scope-binding, event, receipt and edge tables beside it | memory.search fuses FTS5 BM25 and vector hits by reciprocal rank with a topic-affinity rescore, optional graph expansion over decision edges and an optional learned ranker; the owner session also receives every active guidance record at start and a delta when one changes | Explicit: the agent calls memory.save through the action catalog or the MCP save tool. Each save is one command with an idempotent id and one transaction; raw messages and files are stored separately as immutable observations, with no model extraction | Append-only. replaces supersedes named records, memory.retire appends a stale or superseded amendment with a reason, outcomes append amendments. No path deletes a judgment or an event row | Rows bound to global, user, channel or project scopes; catalog reads are bounded by the caller's grant and fail closed on an empty grant. The MCP dev-memory surface leaves scopes optional and unscoped by default | MAMA OS runs one Claude or Codex CLI session fed by a durable mailbox from Telegram, Discord, Slack and source connectors; the Claude Code plugin adds SessionStart, PreToolUse, PreCompact and PostToolUse hooks and a stdio MCP server | No memory consolidation or decay. Connector polling, scheduled reports and a channel-summary audit run in the daemon; nothing rewrites stored judgments | A status column that recall filters; provenance columns stamped from host-attested session facts rather than caller input; untrusted source content wrapped as evidence. No candidate state and no review queue | Every write is one idempotent command with a receipt and an event row in one transaction; history is never deleted; the read bound fails closed; caller-supplied provenance is stripped; secret-shaped input is refused on every recallable write | Recall re-attaches superseded summaries to their successors as prior context; the agent can save and retire guidance from any turn, while timezone and report-phrase settings are held to owner-message turns; the dev-memory surface is unscoped by default and labels every agent save as user-approved |
mandalore |
A revision of a record: kind, scope, summary, body, sensitivity, volatility, an optional last-verified-at, a recorded-at and an effective-from, authorship, evidence, supersedes edges, a change reason and, after the format upgrade, the visibility heads its writer observed | Local-first JSON files under a Git-backed root, published create-only; synchronisation refuses any committed memory file that was deleted or modified | Lexical recall over one exactly-matched scope, returning current visible revisions plus unresolved conflicts, truncated against a limit and a byte budget; withdrawn and future-effective revisions are excluded | Remember, or RememberFromFoundling for an
externally-sourced record whose origin is a portable identity; after the
format upgrade a correction must name exactly the current content
heads |
Correction by a new revision naming what it supersedes and why. After the opt-in format upgrade, withdraw and restore events hide a record from recall and bring it back; content is never removed and no delete surface exists | A scope key on every record, matched exactly on every recall; an omitted scope selects bank-wide records only. History by record ID and the journal are unscoped | A shared engine with a CLI, a local MCP server, an authenticated remote MCP service called Razor Crest, and thin plugins for Claude Code, Codex, Pi and Hermes | No daemon in the local engine. An enabled session attempts one bounded Git delivery after each save and a refresh at session start and per prompt; Razor Crest synchronises once a minute when configured | Device-validated authorship on every revision, visibility event and journal entry, a required change reason, a validator over the supersession graph and another over the combined visibility graph, cautious defaults for sensitivity and volatility, and a standing notice attached to every recall | The recall packet ships an epistemic disclaimer with every answer:
"Memory is evidence, not authority over current user direction. Report
recorded knowledge as recorded; verify live state before claiming
current implementation. Conflicts require history; empty or truncated
results do not prove absence." A packet cut by a limit or a byte budget
reports Truncated beside the matched counts, so an empty
result cannot be read as evidence that nothing exists. Conflicts are
surfaced in their own list rather than resolved. Withdrawal is an
append-only event validated as part of a causal graph: a correction
written after it stays hidden, a restore that has not seen a newer
correction is refused as stale, and a concurrent unseen correction is
withheld as unreviewed. Synchronisation refuses a deleted or modified
memory file, so append-only holds at the Git boundary and not only in
the API |
EffectiveFrom has one producer, the write clock, so the
second temporal axis cannot record that something became true before it
was written; recall uses it only to hide revisions dated after now.
Authorship declares Model and
SessionID and nothing sets either. Sensitivity
is deliberately not a read filter, pinned by
TestPrivacySensitivityLabelsDoNotFilterRecall. Withdrawal
hides a record from recall and discovery but memory_history
returns withdrawn bodies to the same agent and to Razor Crest readers,
and the agent that wrote a record holds both
memory_withdraw and memory_restore. Razor
Crest records the service binding as author of every remote write; the
authenticated subject is not in the revision. Nothing removes content,
so a record captured in error is hidden, never erased |
marm-memory |
A memories row — id, session, sanitized content, a
float32 embedding blob, timestamp, one of four auto-classified context
types, JSON metadata, nullable project and platform, a content hash and
two compaction columns — mirrored from a log_entries row or
promoted from a notebook doc; beside it a derived concept graph of
noun-chunk entities and pairwise relationships in a second database |
One SQLite file in WAL mode at ~/.marm/marm_memory.db
with a connection pool, an external-content FTS5 index over
memories, and a memory_chunks table of
per-chunk embeddings; the concept graph gets its own file and pool at
~/.marm/index/marm_index.db; usage telemetry a third; the
code graph's index belongs to a separate pinned binary |
Query shape picks the lane: syntax-heavy queries go to deterministic FTS5 BM25 with a LIKE fallback and no semantic rerank; natural language pulls up to 200 FTS candidates, scores them against the query vector with chunk-collapse, then blends BM25 at 0.05 and a 30-day recency half-life at 0.1, falling back to a bounded 10,000-row embedding scan with an explicit truncation flag | Only marm_log_entry puts agent text into semantic
memory, dual-writing a log row and a memory row through a single-worker
async queue; embedding is computed on the request, chunk embeddings
after it. Exact-hash and semantic-merge consolidation exist but are off
unless CONSOLIDATION_ENABLED=1 |
Hard delete only: deleting a log entry or session also deletes its
mirrored memory rows by metadata.log_entry_id; the Console
deletes memory rows directly, restoring compaction sources and pruning
the summary's source list. Compaction supersedes by setting
compaction_role='source', which every read query excludes.
Concept entities have a real correction path — merge to an alias,
dismiss a pair, or remove with a durable name suppression |
session_name filtered by default and
project/platform filtered when the caller
names them, on all four read queries. The write side is process-global:
MARM_PROJECT is the server's working-directory name
resolved once at import, and no agent-facing tool can override it |
One FastAPI app exposing 14 MCP tools over HTTP via fastapi-mcp and the same 14 over STDIO via FastMCP, plus a runtime CLI, a bundled React Console with an embedded PTY, a Docker image, and a skill installer for detected agent harnesses | A single-worker write queue; a durable concept-index outbox drained about 30 seconds after a write; a code-graph auto-index poller with a filesystem watcher and a git content signature; a delayed compaction scan per session; both index workers coordinated across transports by leased rows in the memory database | None at the memory layer — no trust field, no confidence, no
provenance beyond metadata.source. Prompt-injection defence
is a paragraph in the injected protocol asking the model to treat
retrieved memories as context rather than instructions, plus an
HTML-escaping sanitizer applied to every stored memory |
A value-keyed entity suppression that a full graph rebuild cannot undo, a deliberate exact-lexical lane for config keys and file paths that never gets semantically reranked, cross-process serialization by leased database row rather than in-process lock, a durable outbox that commits the indexing task with the memory, and a README that publishes its own negative results | Every stored memory is HTML-escaped with no inverse anywhere, so
code and config come back as < and
&; the write-side project scope is the server's own
working directory, so a shared HTTP server tags every agent's memories
with one project the recall filter then splits on; concept extraction
turns every noun chunk into an entity and every pair of the first 25
into an edge; and the causes predicate is unreachable for
the verb cause because uses matches it first |
marsnme |
A memory row or a vault chunk, carrying an origin from a constrained allowlist | Postgres on Supabase with a schema per profile, plus a Cloudflare deployment | Semantic search over a 1024-dimension Jina embedding through a Postgres RPC, read back through three tools of escalating detail — an 80-char preview, a 300-char summary, the full text | Sixteen MCP tools; every chunk's origin must match a database CHECK constraint | Short-term memories expire; closing a session promotes those about to | A Postgres schema per profile; body is the addressee for handoff notes and for board posts, where the read filter is written and then discarded | MCP across Claude, Cursor, Perplexity and Warp, with a curl-to-bash installer | Auto batch_promote on session close — 48-hour window, up to five memories | Origin as provenance, enforced by a constraint; nothing epistemic on a memory | An addressed, indexed, read-marked handoff note between agents | board_read sets its addressing filter and overwrites it
one line later, so a post addressed to one body is returned to every
caller; one profile schema has the origin constraint and the other does
not, as documented |
marvis |
A learning row: title, category from a closed set, description, prevention, severity, tags, module, project, frequency and last_occurrence. Handoff markdown files and indexed project documents sit beside it | One SQLite database with FTS5 tables and a sqlite-vec table for the document mirror; project metadata directories on disk hold handoffs, context and decision files | check_learnings is a LIKE match over five columns that retries with up to eight extracted terms when the exact phrase finds nothing; search fuses six lanes (semantic, KG FTS, documents FTS, tasks, inbox, learnings FTS) with weighted RRF; session_brief returns the five learnings with the latest last_occurrence | Explicit: create_learning over MCP or HTTP by an operator-role caller, embedded into the document mirror after the row commits. A brain cycle proposes, and never writes, learnings | update_learning edits in place; delete_learning hard-deletes the row and prunes the FTS, vector and salience mirrors. Supersede columns exist but no reachable path sets invalid_at | workspace_id on every learning and a predicate on every learnings use-case read; the hybrid search KG lane over the graph_nodes mirror of learnings carries no workspace predicate and is post-filtered by project grant, not at all for the local account. A NULL project means visible in every project of the workspace | In-process MCP server (stdio or hosted HTTP) with a 91-tool surface; the guidance text tells agents to call session_brief at cold start and check_learnings before risky work. Hooks installed by marvis hooks are PreToolUse governance gates, not memory injection | A brain cycle digests events into findings and pending memory-operation proposals; a nightly dream-cycle pass and a warehouse consolidation are written, the first with no caller and the second default off | None on learnings: a learning is live on insert and a status column added in migration 049 is read by nothing. Brain proposals carry an approval state, which no learnings read consults | One use-case layer shared by HTTP and MCP, so the workspace predicate is written once per read; delete prunes every derived index in one writer transaction; the temporal read filter is binary exclusion, applied on check, list, get, search and the cold-start bundle alike | The supersede pipeline cannot fire: the write-time decision runs before the learning is embedded, the dream cycle has no caller, the resolver is a no-op, and approval yields guidance with no apply path. The approve verb is on the agent's tool surface. Learning mutations write no audit row |
mastra-observational-memory |
Two units: a dated observation group derived from raw messages, and a knowledge record — text about a node, with a scope, a stamped ceiling, a capture time and an optional validity time | Mastra storage adapters. The knowledge domain adds nodes, records, mentions, an activity log and a semantic outbox, with the record bound and the description bound part of the storage contract every adapter enforces | Sequential active observations plus a recent raw tail for the context path; for the graph, scope-filtered listings by node, mention and relation, with a semantic index maintained through an outbox | Processor observes at token thresholds; reflector compacts observations | Range replacement and buffered activation for observations.
Knowledge records are immutable — an edit is a remove plus an append —
and removal is a soft delete stamping deletedAt and
deletedBy; the curator has no tool to restore or physically
erase one |
org < resource <
thread, applied as a filter on every graph read, plus a
per-record maxScope ceiling re-checked on append and
rescope and raisable only through a dedicated call |
Deep Mastra input/output processor integration | Early async observation and reflection buffers with activation, plus a subconscious of observation agents (capture, remind) and reflection agents (curate, learn) over a worklist whose cursor advances only on completion | None as a field. A knowledge record carries free-form
metadata holding the capture agent's stated reason, and no
status, confidence or verification anywhere |
A ceiling that caps how widely a record may ever be shared, re-checked on every rescope; an activity log of every mutation on the storage base class; a rescope that re-enqueues the semantic index for both the old and the new scope, so the vector view follows the permission change | Distributed locking and progressive summary drift, and a soft delete that nothing consults on the capture path — a curator removes a superseded record and the next observation of the same fact writes a new one |
mateclaw |
Fact, recall record, workspace file, and dream report | A relational database behind MyBatis-Plus with Flyway migrations — MySQL, PostgreSQL or KingbaseES profiles — holding facts, recall records, workspace files and their projections | Provider prefetch, fact projection, and search
package |
Turn lifecycle events drive syncTurn across registered
providers |
Contradictions are detected, queued and adjudicated by a person into KEEP_A, KEEP_B, MERGE or IGNORE; no fact is retired by the verdict and the SPI has no deletion hook | MemoryScope string column with TEAM and GLOBAL shared;
MemoryOwnerResolver |
MemoryProvider SPI with decorators; tool beans; Vue
memory UI |
Scheduler, dream reports, nudge service | A confidence and a trust float per fact ordered by trust at recall; contradictions carry a human verdict but no fact status changes with it | A provider contract that carries scope, retry and metrics as decorators, and committed isolation tests that assert what a populated result must not contain | No deletion hook on the SPI, and the four resolution verbs are stored and read by nothing that touches a fact |
matrix-os |
A row of six columns — id, content, source, category, created_at,
updated_at — where category is one of fact, preference,
instruction or event and defaults to fact |
SQLite through Drizzle with a hand-maintained
memories_fts FTS5 table beside it; a markdown export exists
and nothing outside the tests calls it |
FTS5 with the query's terms joined by OR, ordered by
rank, ten results by default, with an optional exact-match filter on
category |
A regex extractor over user messages only — nine patterns, no model
— plus a direct remember on the store; a repeat of
identical content updates the existing row rather than inserting |
forget(id) deletes the FTS row and then the record;
there is no update path for content, no supersession and no record of
what was removed |
None. The table has no user, agent, session, project or tenant column, and no read path filters on one | A kernel memory store reached over IPC, a gateway extractor on the
message path, and a memory_search tool |
None for memory. Extraction runs inline on the message path | None. category names a kind rather than a status, there
is no confidence field, and a pattern hit is stored with the same
standing as a deliberate remember |
Capture costs no model call and is deterministic; the FTS projection is maintained on both write and delete; and the memory tests run about two lines of test per line of implementation | Two of the nine capture patterns match ordinary conversational
filler and there is no confidence, review or trust state to mark the
result, so a false capture is durable and indistinguishable from a real
one; exportToFiles has no caller outside the test
suite |
maximem-synap-sdk |
Not defined here. The SDKs address memories, user and customer contexts, conversations and profiles on the Synap service | Delegated to the hosted Synap service; this repository is clients, connectors, MCP servers and integrations synced out of a private monorepo | Delegated. The SDK offers fetch against user, customer
and conversation contexts, and an as_tool surface that
hands the agent a retrieval tool |
memories.create, create_from_file,
conversation.record_message and
ingest_transcript, all posted to the service |
Not exercised in the client surface read here | A B2C/B2B identifier contract validated client-side: on a B2C
instance user_id is the whole identity and a
customer_id is refused before the call is made; the
isolation mode comes from GET /api/v1/auth/whoami, and an
unknown mode deliberately refuses nothing |
Python and TypeScript SDKs on PyPI and npm, plus MCP servers, connectors and a generated table of framework integrations | None client-side | The identifier contract and its call-site guard; the server is described as authoritative and rejecting independently | scoping.py is a model of documenting why a guard
exists: it names the failure it prevents — a customer_id
sent to a B2C instance filed the write under the customer while the read
asked for the user, both returning success — and quantifies it, "[o]ne
client ran 4,634 consecutive empty fetches across seven days without a
single error to look at", before stating the principle: "[a]n SDK that
stays silent about a misuse it can see is not being permissive, it is
hiding the bug." Its unknown-mode branch fails open on purpose, with the
reasoning written down. And the Python suite enforces coverage
structurally:
test_every_public_method_taking_a_customer_id_checks_it
parses the package's own AST, enumerates every public method taking a
customer_id, and asserts each calls the check, with a
justified exemption list and a
test_the_guard_is_not_vacuous control so the rule cannot
"pass for the wrong reason" |
The TypeScript SDK ships the same checkCustomerId and
applies it at five call sites — context fetch, two conversation paths,
two memory-create paths — and has no equivalent coverage test. The
surfaces it misses include the two closest to the original failure:
user/interface.ts get_profile reads
customer_id or customerId from its options and
forwards it as a query parameter without checking, and
tool/as-tool.ts builds three request bodies carrying
customer_id with no check anywhere in the file, while the
Python SDK guards both. A JavaScript caller can therefore still produce
the silent empty read the module was written to prevent. The store
itself is hosted and closed: no memory mechanism — schema, ranking,
consolidation, forgetting — is inspectable from this repository, and the
README states it is generated and synced out of a private monorepo |
mazemaker |
A row in memories: an integer id, a free-text
label, content, an embedding blob, a salience,
created_at, last_accessed and an access count
— no status, no validity window, no owner |
SQLite by default with a Postgres backend for the dream engine; a C++ core providing Hopfield associative recall, vector-symbolic binding, an LSTM and kNN over SIMD primitives | Semantic, hybrid, advanced and three cost-reduced modes; fusion, MMR
reranking, a neighbour walk over graph edges that honours an
at_time window, and a supersedes traversal that
rescores |
remember(text, label) with optional conflict detection,
auto-connection and supersedes detection at ingest; batch variants;
importers for Hindsight and Honcho |
A supersession is a directed edge from older to newer, not a state change; the dream engine's sleep phases add edges, insights and bridges; connection history and old dream sessions are pruned by age | A caller-supplied scope argument matched against the
free-text label — None, all and
* match everything, curated and
auto match named prefixes, anything else is an fnmatch
glob |
A Python package with a client and an MCP schema, a Hermes plugin, an embedding server, and a C++ library behind a C API | A dream engine with nrem, supersedes,
rem, insight and afe phases, plus
an access logger that records every recall for LSTM training |
Salience, edge weights, an access log, and a
superseded_by tag attached to a result at recall time |
A consolidation engine with named phases and a mixed sampler that reaches old slices rather than only recent ones; edges carrying event, ingestion and validity times with an as-of read; an idempotent supersession pass; a documented fix for a phase that had been a silent no-op on one backend | Supersession requires differing numeric tokens, so a correction with
no number in it is never detected; a superseded memory is demoted by
half a point and still returned; the validity columns live on edges
while the memory row has none; ingestion_time is written
and returned but never appears in a filter; the recall scope is a
caller-supplied glob over a free-text label that defaults to matching
everything |
mcp-context-server |
A context entry: text or text plus images, a source of user or agent, JSON metadata, a tag set, an LLM summary, chunk embeddings and optional per-heading node summaries | SQLite with FTS5 and sqlite-vec, or PostgreSQL with tsvector and pgvector; embeddings stored TurboQuant-compressed by default, fp32 on opt-out | Tool-mediated: filter listing, FTS, semantic search over compressed chunk vectors, hybrid RRF at k 60, FlashRank reranking, regex grep, and by-id reads; search returns 300-character previews plus summaries | Explicit store tools, plus a Claude Code hook that stores every user prompt; synchronous, blocking on embedding and an LLM summary, and nothing is stored if either fails; dedup against the latest same-thread same-source entry | update_context overwrites text, metadata, tags or images under a version compare-and-set and regenerates embeddings and summary; delete by id or whole thread is a hard delete. No history, no tombstone | thread_id on every row, applied as an equality filter by every search when supplied and omitted for cross-thread search; get-by-id and the navigation reads take no thread. owner_id and visibility are stamped on every row and read by no query | MCP over stdio or HTTP with none, bearer-token or JWT auth; Claude Code hooks map session_id to thread_id, save prompts and inject a retrieval protocol into subagents; skills describe the retrieval sequence | None. Embedding, summary and node summaries run inside the store call; migrations and re-embedding are operator CLIs | None as state. source user or agent is recorded and the shipped skill tells agents to treat user entries as authoritative, which no read enforces | Generation before the transaction so a failed embedding or summary stores nothing; a version compare-and-set on every text update; the dedup update re-asserts the observed content hash; SQLite and PostgreSQL held to parity by one validation chokepoint per input; the project states in its own docs that reads are not access-controlled | Any connected principal reads every private entry and can update or delete it, since only a visibility change checks ownership; get_context_by_ids, the step every search result leads to, takes no thread; grants are written and never read; summaries from a 0.6B local model are the preview agents triage on |
mcp-memory-service |
A Memory — content, a content_hash that is
its identity, a tag list, an optional memory_type validated
against an ontology and canonicalised so Decision and
decision are one type on disk, a free metadata dict, an
optional embedding, and created_at/updated_at
in both float and ISO form beside a legacy timestamp.
Quarantine, belief membership and archival status all live in that
metadata dict rather than in typed columns |
A backend chosen at runtime: SQLite-vec, Cloudflare, Milvus, or a
hybrid that combines them, behind a MemoryStorage base with
a migration runner and shared mixins. A separate graph store backs
relationship inference. Forgetting archives to a filesystem tree under
~/.mcp_memory_archive rather than deleting |
Semantic search over the backend's vector index with tag and time
filters, plus a scoring package and a reasoning layer.
search_by_tag is the tag path. Twenty-eight MCP tools front
it. No scope key is applied by the server: a proj: or
user: tag is a convention a caller may filter on, not a
predicate the read path enforces |
store_memory over MCP hashes the content, validates the
memory_type against the ontology — warning and defaulting
to observation when it does not match — checks tag
namespaces and logs the invalid ones without rejecting, then writes. A
contradiction check may follow and quarantine the new memory, which the
write response reports as "⚠️ Memory quarantined: contradicts an
active belief" |
Deletion by content hash and by tag. Consolidation is the
interesting path: a decay score, a compression pass, and a forgetting
pass that archives rather than deletes, writing to a daily archive tree
outside the store. Quarantine marks a contradicting memory with metadata
and a quarantined tag; unquarantine_memory
clears both |
None enforced. TagTaxonomy defines six namespaces —
sys:, q:, proj:,
topic:, t:, user: — and validates
them at write time by logging the tags that do not match, with legacy
unnamespaced tags explicitly still supported. Nothing on the read path
filters on a namespace, so proj: and user: are
a convention rather than a boundary |
Twenty-eight MCP tools, a REST API, a web surface with OAuth, a CLI, ingestion and harvest paths, a sync package, health checks and a backup module. Distributed for several agent harnesses with a discovery mechanism | A consolidation scheduler running associations, clustering, compression, decay, forgetting, insights, belief derivation, contradiction detection and relationship inference, with a run tracker and a health module. each concern is its own module rather than one consolidation pass | Two layers with different answers. A belief carries a typed, indexed
status of candidate, active,
superseded or disputed in its own table,
promoted only when confidence clears a floor and the supporting count
clears a provenance floor, demoted when confidence falls back, and read
with WHERE status = ? AND confidence >= ? — so a
candidate, superseded or disputed belief is excluded. A memory carries
no status: the contradiction detector quarantines one that disagrees
with an active belief by writing a metadata flag and a tag, with a
threshold defaulting to three, and no retrieval path consults either, so
a quarantined memory continues to be returned by search |
A belief ladder with two floors to promote and one to demote, filtered in SQL rather than scored; a consolidation package that models associations, decay, compression, forgetting, belief and contradiction as separate concerns with their own modules and a run tracker; forgetting that archives to a dated tree instead of deleting; a memory-type ontology that canonicalises spellings so a filter matches either; committed LoCoMo and LongMemEval harnesses with no score asserted without them; a retrieval test that asserts a non-empty result and a present control before asserting what is absent | The memory row skips the pattern the belief table demonstrates — the
quarantine writes a flag no read path consults, so the mechanism that
detects a contradiction does not stop the contradicting memory being
retrieved; every epistemic attribute lives in an untyped metadata dict
rather than a column, so nothing at the storage layer can enforce or
index it; no scope key is applied, so a multi-project or multi-user
deployment separates memories only by a tag a caller must remember to
filter on; storage/base.py carries an MIT licence header
while the repository ships Apache-2.0 |
mcp-memory |
An OKF v0.2 record — a markdown document with YAML frontmatter (type, key, namespace, tags, status, verified, stale_after, sources, generated) — stored as an okf_payload TEXT column and mirrored to a .md file | One per-project SQLite database (WAL) with an FTS5 mirror; the OKF markdown files on disk are a human-browseable copy written after the DB commit, never read back | FTS5 prefix search ordered by rank, or updated_at DESC with no query; tags filtered in Python after the fetch; exact key+namespace lookup; no vector or semantic search | memory_store upserts by (key, namespace) via ON CONFLICT, overwriting content in place with no version history; each store and delete adds a dated line to log.md; a system/last_memory checkpoint carries continuity across sessions | Update is an in-place upsert; delete is a hard DELETE plus os.remove of the .md; deprecation is a status string that nothing reads, and re-storing deleted content is always accepted | namespace is a key on every row and a predicate on retrieve and delete, but an optional argument on search, which spans every namespace when it is omitted; project_root selects one SQLite file per project, a physical partition with no project key on a row | A FastMCP server exposing six tools (store, retrieve, search, delete, get_last, update_last); each call takes a project_root to locate the per-project store; stdlib sqlite3, no external services | None — every operation is synchronous within the tool call; no daemon, extraction, consolidation or decay | OKF status (draft/stable/deprecated, silently coerced to stable), a verified actor-event list, and stale_after are all serialized into frontmatter and read by no retrieval or gating path | A small, self-contained, dependency-light MCP memory server whose store is human-readable OKF markdown mirrored to disk, with a dated change log beside it | The OKF trust and lifecycle model is write-only — verified, status and stale_after are stored faithfully and consulted nowhere; the conformance validator is never called on the write path; and an unqualified search reads every namespace |
megamemory |
A concept node with name, one of six kinds, summary, why, file_refs, parent_id and created_by_task, plus a 384-dimension embedding; typed edges in five relations between nodes | One SQLite file per working directory through libsql, .megamemory/knowledge.db or MEGAMEMORY_DB_PATH, in WAL mode; embeddings are float32 blobs on the node row | understand embeds the query in process with all-MiniLM-L6-v2 and scores every active node by cosine, top_k default 10, no threshold; get_concept by exact id; list_roots for the top level. Each hit carries children, edges both ways and the parent | Explicit MCP tools the agent calls after a task: create_concept, update_concept, link. The id is a slug of the name under the parent id. Installed instructions tell the agent to query before work and record after | update_concept overwrites fields in place and keeps no prior value; remove_concept sets removed_at and a reason and hard-deletes the node's edges; no tool removes a single edge; conflict resolution hard-deletes the losing copy | Physical: one database per project directory. No scope key on any row and no predicate on any read | A stdio MCP server with nine tools; an installer writing MCP config and workflow instructions for opencode, Claude Code, Codex and Antigravity; bootstrap and save slash commands; a read-only web explorer with a time slider | None. A two-way merge command for knowledge.db files that diverged on branches keeps conflicting concepts as suffixed copies until resolved | None. Every active node is returned as fact; unresolved merge copies are searched like any other node, and the agent resolves conflicts itself | Small and legible; soft delete with a stored reason, filtered on every agent read; a per-call timeline table; a merge that raises removal conflicts instead of dropping them; no API key and no network after the model download | Removing a concept makes its name unusable under that parent, refused with a raw UNIQUE error; MCP resolve_conflict turns foreign keys off inside a transaction, where SQLite ignores the pragma; a default merge discards the timeline; the explorer binds every interface with open CORS |
mem0 |
Text fact in vector payload | Vector store plus SQLite history/messages | Semantic, optional keyword/BM25, entity boost, optional rerank | LLM additive extraction, hash dedupe, entity linking | Explicit update/delete APIs; V3 default append-oriented | user_id, agent_id, run_id,
filters |
Python SDK, tool/API style | Extraction and linking on write | Attribution metadata, history; weak epistemic trust | Practical SDK, pluggable stores, hybrid search | LLM facts can become durable claims without verification |
mem9 |
A memory row with content, tags, an embedding, a type, a four-value state and a supersession pointer | Postgres with pgvector, TiDB and a third backend behind one repository interface | Hybrid recall over pgvector with tag and state filters, surfaced through a dashboard | HTTP handlers into a service layer; version increments and updated_by are recorded | state moves to deleted and superseded_by points at the replacement; no rejected-value record | A database per tenant, resolved from the route by middleware; inside
it agent_id, session_id and
app_id are optional filters taken from the request
body |
Plugins for OpenClaw, Claude Code, OpenCode and Codex, plus a CLI, a dashboard and webhooks | Webhook dispatch with a signer, runtime-usage outbox and metering | None epistemic — state is lifecycle and version is a counter | Three storage backends behind one repository interface, with the tenancy keys indexed on every path | The committed CRDT e2e suite drives endpoints and fields that exist nowhere in the published server |
memanto |
Typed memory with title, content, confidence, tags, and session linkage | Moorcheh vector service, hosted or on-prem; conflict reports as dated JSON on disk | Vector search with filters, confidence, and an
as_of_date read |
Direct store, batch write, and LLM extraction from conversation | Update and delete APIs; conflicts resolved by keep_old, keep_new, keep_both, remove_both, expire_old, expire_new, expire_both, or manual — the expire actions retire the losing memory reversibly, the others that remove one delete it | agent_id throughout the API surface; per-agent conflict
reports |
FastAPI service, CLI, web UI, MCP, plus LangGraph, CrewAI, Claude Code and Hermes integrations | Scheduled daily analysis producing an AI summary and a dated conflict report | Per-memory confidence; typed conflicts with old/new ids and a recommendation | A conflict workflow that ends in a resolution, including
keep_both and human-authored manual |
Detection is one unvalidated LLM pass; resolution does not tombstone what it removes |
memary |
An entity mention with a timestamp, and an entity with a cumulative mention count; graph triplets underneath | Neo4j or FalkorDB for the graph, plus two flat JSON files for the streams | LlamaIndex KnowledgeGraphRAGRetriever, with a count-ranked entity list injected alongside | Chat turns append entity mentions; graph triplets are extracted from the agent's own web-search output | Age-based truncation and index-based removal on the JSON lists; the
graph has exactly one deletion, MATCH (n) DETACH DELETE n,
behind a Streamlit button that clears everything |
None in the read path; a FalkorDB deployment gets a database named
after user_id, which defaults to the constant
falkor, and a Neo4j deployment gets the single database
neo4j |
A Python ChatAgent class with a tool registry, plus a
Streamlit app |
None | Mention count stands in for confidence; external search results enter the graph unverified | The smallest legible instance of reinforcement-by-frequency, and an honest single-file store | _select_top_entities sorts ascending, so the
least-mentioned entities are the ones injected; the only graph deletion
removes every node, and it runs after the JSON stores are already
cleared, inside a try/except that only logs |
membase |
A Message with a role, content, a type of
stm, ltm or profile, and a
per-conversation memory_index |
Two parallel stacks: an in-process list, and SQLite plus a Chroma
collection under ~/.membase/<account>/; both mirror
to a remote hub |
Recency and index-range reads from SQLite; Chroma vector search only
through LTMemory.retrieve |
Synchronous insert on the calling thread, followed by a blocking hub upload when auto-upload is on | Delete by memory_index from SQLite only; the Chroma
document and the uploaded hub blob both survive |
A wallet address is the account namespace, applied on both tiers;
conversation_id partitions the SQLite reads but not the
vector one, where it is metadata the caller must choose to filter
on |
A library. No agent loop, tool surface, prompt assembly or MCP server ships in this repository | One daemon thread per LTMemory, waking every 60 seconds
to summarise each full block of 16 messages |
Ownership is proved by secp256k1 signature on every hub call; nothing grades or gates a memory's content | The client refuses to send an owner other than its own signer address, so ownership is possession of a key rather than a claim in a field | The similarity threshold selects the least similar documents and silently degrades vector search to substring matching; deletion never reaches the index retrieval reads |
membrane |
One MemoryRecord row in six flavours — episodic,
working, semantic, competence, plan_graph, entity — carrying a typed
payload, sensitivity, confidence, salience, scope, tags, provenance
sources, typed graph relations, an ingest-side interpretation and an
audit log |
One Postgres database with pgvector: fifteen tables, thirteen of
them children of memory_records(id) with
ON DELETE CASCADE, an ivfflat cosine index over per-record
embeddings, and an entity term/identifier index |
Layered candidate list in a fixed type order under a SQL scope/sensitivity/salience predicate, then vector cosine ranking when an embedding provider is configured, a three-signal selector for competence and plan_graph, and bounded graph expansion from ranked roots plus entity-term roots, whose neighbour hydration applies no salience floor | CaptureMemory over gRPC or the Go library writes the
source record, resolves mentions to canonical entities and materializes
edges in one transaction; an ingest LLM interpretation is optional and
synchronous; a six-hourly consolidation sweep promotes successful
episodes to semantic facts and twice-repeated tool signatures to
competence records |
Supersede, fork, merge, contest and retract, each atomic and each appending an audit entry; retract and merge set salience to zero rather than deleting; a decay sweep drives salience down and prunes auto-prune records at the floor, cascading their history away | A scope string per record enforced as a SQL predicate
and re-checked in Go, clamped server-side against configured read and
write scope lists; records with an empty scope are readable from every
context |
A gRPC daemon with eleven RPCs, an embeddable Go library, TypeScript
and Python SDKs, an OpenClaw memory plugin with three hooks and a
membrane_search tool, and a five-tool OpenAI-function agent
harness |
Two in-process tickers — decay every hour and consolidation every six hours by default — both full-store scans, plus a one-shot embedding backfill at start | Five sensitivity levels gate reads, with a one-level-above redacted
metadata view; derived records inherit the maximum sensitivity of their
sources and unsafe entity backreferences are pruned; a semantic
active/contested/retracted status
is written, copied into the response and never filtered on |
A typed record model wired to a written specification, a byte- and row-bounded retrieval contract enforced below the network boundary, a monotone sensitivity policy for derived records, and a checker with its own committed negative controls | Retraction is only a salience of zero that callers must opt into
filtering and that graph-neighbour hydration never filters, the same
zero makes an auto-prune record eligible for hard deletion with its
audit history, the episodic consolidator can reinforce a retracted fact
back above zero, and the decay sweep compounds because it never advances
last_reinforced_at |
membukkit |
An atomic fact — text, a timestamp, entities, a subject, a topic bucket and document provenance — beside the verbatim turn it was distilled from, both rows in the same store | A named on-disk store per memory: facts.jsonl, a
vectors.npy matrix aligned to it, a document registry and
the raw sources, under ~/.membukkit/stores/<name>/.
Turbopuffer is the hosted alternative behind the same backend
interface |
Topic-bucket routing over a partitioned embedding space with a
recorded trace, an optional BM25 lane fused by reciprocal rank, a
cross-encoder utility reranker, and an is_active_as_of
filter that drops superseded facts from the evidence pool |
add distills turns into atomic facts through an LLM,
keeps the verbatim turn beside them, then links supersessions by cosine
over the new ids. It returns a write receipt — n_stored,
superseded, status — so an empty extract
reports noop rather than success |
Nothing is overwritten. A newer similar fact sets
superseded_by and valid_to on the older one;
deleting a fact revives what it had superseded and drops the verbatim
turn behind it when no other fact needs it |
None on the read path, by design: subject is stored and
never filtered on, and the docstring states that retrieval is not scoped
by subject because one store is one memory |
Python API, CLI, a prebuilt local GUI, an HTTP service and an MCP server, all over the same stores; hosted or fully local through Ollama | None. Supersession linking runs inline on the write path | No status field. superseded_by and
valid_to are stored and fact_status derives
current / superseded / historical
at read time for the receipt |
An as-of read filter that actually excludes superseded facts rather than ranking them down; a write receipt that makes an empty extraction legible as failure; frozen benchmark recipes pinning reader, distiller, judge and encoder, with a tolerance band whose width is argued from binomial standard error | There is no record-time axis, so the store can answer what was true in May and not what it believed in May; supersession is automatic at cosine 0.78 with no review and no record of what it displaced beyond a pointer; and no scope key reaches any query |
memcontinuum |
A topic — one markdown file, one question — whose body is an ordered list of links, newest first. A link is one ruling: date, status, kind, an optional reverses with a reason_for_change, a ruling and a rationale each carrying their own authority, alternatives with what was rejected and why, evidence, revisit_if, an optional checkable invariant, typed edges, and recorded_by and recorded_at. A topic may name some of its own links as standing. Beside topics sit concept records naming what the code already contains | Markdown under a git repository that is the store — topics/area/slug.md, and inbox/ for proposals — projected into a SQLite index with FTS5 and whole-record embeddings; a separate SQLite code index of chunked source; a per-session JSON edit ledger and a hook log rotated across a bounded number of files under MEMCONTINUUM_HOME | for-path maps a file being edited to every topic whose code_refs cover it and returns the whole chain, every link regardless of status; on a miss the hook runs a labelled search on the path's words. A session-start digest delivers active owner-level links that topics name as standing. search is FTS5, vector or hybrid with a default status of active and inbox records excluded; an opt-in channel searches on the user's prompt; why walks path to concept to governing topics | A person or an agent appends a link to a topic file and commits. Nothing extracts: there is no summariser and no consolidation pass. current is hand-set to the newest active link and the linter errors when it disagrees | There is no update. A change of mind is a new link with reverses and a reason_for_change; the predecessor keeps its text and gains status superseded with superseded_by. Three lifecycle fields may each move forward once and only alone; every other field and the link's raw bytes are frozen against the last commit, and a removed link or a deleted record file is an error. Topic-level frontmatter is outside the guard | One decision database per project, enforced rather than assumed: records is keyed by path alone, so opening the same file under a second project is refused with the reason in the error. A project column sits on every record and most queries carry it; the chain read keys on the topic path. The code index is the multi-project store, keyed by path, project and code root | Claude Code hooks — a pre-edit lookup on Edit and Write with a search fallback, a post-edit ledger, session-start and user-prompt nudges with the standing digest and an opt-in prompt search, a precompact persist, a session-end stamp — plus two skills, a store-side git pre-commit and post-commit, an installer, an updater, and a per-machine registry of which repositories have a store | None on the memory. A post-commit hook reindexes, a watchdog bounds each hook at two seconds, and the nudges are triggered by the edit ledger rather than by a timer | Five authorities — owner-verbatim, owner-ratified, reviewer-finding, code-derived, agent-inference — carried per field, and five statuses. Together they select one of three citation tiers; the tier decides whether a violated invariant fails a manually run drift check, is reported, or is skipped, and only active owner-level links reach the standing digest. Cited commits and file:line references are checked against the code root at lint time | An append-only guarantee enforced by a linter and a git hook rather than asserted, freezing new fields by default and raw bytes as well as parsed values; an authority vocabulary where only the owner's own or ratified words may block work or ride in every session; a retrieval timeout and a search miss that each say what was not established; a public retrieval benchmark with a negative control | A declined ruling is handed to the model and nothing prevents its re-adoption; the authority and status on a link are whatever its writer typed, so an agent can write owner-verbatim; every hook except the commit gate fails open, and a shell edit gets no lookup; the drift gate runs only when a person invokes it; CI re-running the append-only check is documented and not shipped; topic frontmatter, including code_refs and standing, changes without a recorded event |
memcp |
An insight node in a four-edge graph, with a feedback score and an importance | SQLite for the graph, the filesystem for contexts and chunks under ~/.memcp | Intent-aware traversal — causal edges for why, temporal edges for when | remember, with secret detection and optional embedding-based deduplication | Consolidation with a preview step; forget; activation-based edge decay | One store per user directory; no scope key found on the read path | An MCP server with 24 tools and only two required dependencies | Hebbian co-retrieval strengthening and exponential edge decay by half-life | feedback_score in [-1, 1], moved twice as far down by a misleading report as up by a helpful one | Negative feedback weighted heavier than positive and propagated to the edges | The benchmark report's comparison column is asserted, not measured |
memento-brain |
A document holding a captured conversation, owned through the machine it arrived from; a separate knowledge layer holds entity and relation rows carrying a direct user id | Postgres with pgvector, documents keyed to machines and machines to users, plus a separate embedding table and an access log | Hybrid keyword and pgvector cosine, fused by reciprocal rank fusion with the constant cited to the original paper; the semantic branch returns empty on any failure so a slow embedding server degrades the endpoint to keyword rather than failing it | Collectors on each machine parse tool-native conversation formats and ship them to the server; redacted thinking blocks are recorded by size rather than content | No supersession, no tombstone and no soft-delete column. Removing a document, a user or a device cascades to the access-log rows that reference it | Ownership runs through devices: every scoped read resolves the
caller's machine ids once through a shared helper and filters on
machine_id, with an empty list matching nothing and admin
or owner bypassing the filter entirely |
An MCP server mounted on the API, a web interface, and collectors for several coding tools across CLI, desktop and mobile | Session compaction, title healing, orphaned-subagent repair and workspace extraction, each with its own test file | None. Nothing carries a status, a confidence or a validity window; a memory is a record of what was said rather than a claim the system holds a position on | The scope is resolved once and passed, so the keyword and semantic branches cannot disagree about the caller; the admin bypass is a return value decided in one function rather than a condition repeated at each call site; the empty-device case is documented as 'sees nothing' before anything depends on it; and the timeouts and constants carry the reasoning behind their values, including why a shorter embedding ceiling would produce false unavailability | Nothing in the suite asserts the isolation the filter's docstring
describes — seeding two users and checking the second sees none of the
first's documents is about fifteen lines and is absent;
admin and owner see every user's documents
unconditionally; the codebase carries two scoping idioms, a helper on
documents and inline predicates on entities; and ownership is by device,
so transferring a machine moves its history with it |
memento |
A recorded entry with transcribed segments, plus derived profile facts, threads, pins and concepts above it | Postgres — entries, segments with a GIN full-text index, concepts, threads, profile facts, pins, daily summaries | Two concurrent lanes over segments — Postgres full text and an HNSW vector neighbourhood capped at cosine distance 0.33 — plus category listings over the derived tables, with soft-deleted rows excluded by partial index | A worker pipeline — upload, transcribe, embed, index — then a reflection pass that derives facts, threads and pins, refusing a fact within cosine 0.35 of a live one | deleted_at everywhere, with every live index declared
WHERE deleted_at IS NULL; status vocabularies for threads
and pins |
user_id on every table and in every partial index |
A Next.js journal app with a Python worker; the agent writes through annotation, pin and fact tools | A worker loop that transcribes, indexes, unseals due capsules, compiles daily summaries and runs the reflection pass | source distinguishes agent from user on annotations,
facts and pins; source_entry_id points a derived fact back
at its recording |
Time capsules — a sealed entry is outside indexing and retrieval until its delivery date, then enters the normal pipeline | PolyForm Noncommercial, so nothing here is usable in a product; and
a fact's provenance link is ON DELETE SET NULL, so deleting
the source silently orphans it |
memesh |
A named entity with a type, an optional title, a list of observation strings, tags and typed relations; metadata JSON carries trust, provenance, replaced history, pin and forgotten-observation hashes | One SQLite file at ~/.memesh/knowledge-graph.db with a contentless FTS5 index, shared by the MCP server, the CLI, the HTTP server and ten hook commands | FTS5 BM25 with a strict all-terms pass and an OR fallback, reranked by relevance, recency, frequency, confidence and a recall-impact ratio; session start injects a project-scoped, trust-gated block under a 4,000-character budget | Explicit remember, learn and task_state tools; deterministic hooks capture session snapshots, commits and compaction summaries; imports and Claude Code note files arrive untrusted; agent work packages stage pending proposals | Append by name, replace with up to 20 prior versions in metadata, supersedes relations archive the target; forget archives or deletes one observation, and a forgotten snapshot observation is kept as a hash the Stop hook refuses | A project tag derived from the git remote, joined on every automatic read; a personal, team or global namespace column; explicit recall spans every project unless given a tag | Claude Code and Codex plugins with ten hook commands and a skill; an MCP server with twelve tools; a CLI; a loopback HTTP API and dashboard; Hermes and OpenClaw memory-provider plugins | No model calls. Confidence decays by 0.9 for rows unaccessed for 30 days, at most daily on open; the Stop hook counts whether injected memories were cited; accepted digests archive their sources | A trusted or untrusted marker and an import source gate every unasked injection; explicit recall is ungated; work-package proposals stay out of the graph until a person accepts them | One trust gate shared by the hooks and the MCP briefing; a forgotten snapshot observation survives the hook that would restore it; contentless-FTS deletes handled transactionally; committed LongMemEval per-question results that recompute; a benchmark page that documents its own earlier measurement failure | Any plain remember on an imported memory promotes it to trusted; ingested note files are stamped untrusted and never auto-injected, contrary to the ingester's header; guard and relation proposals have appliers and no producer; valid_from and valid_until are never written; the accept verb has no actor check on the CLI or the loopback API |
memex-zero-rag |
A Markdown wiki page — source, entity, concept or synthesis — with
YAML frontmatter and inline [confidence:],
[sources:], [verified:] tags |
Files in a git repository. raw/ is immutable input,
wiki/ is the LLM's output, L1/ is per-install
context tracked only as *.example templates |
A case-insensitive substring scan over every page, unranked,
stopping at the first limit hits in directory order |
One MCP tool writes a page and commits it; everything else the design describes is returned to the model as numbered instructions | Overwrite behind an overwrite flag, with git history as
the only prior version; no deletion path and no forgetting |
None. One wiki per checkout; L1/ is private by intent
and ignored by git, with its templates tracked as
*.example |
An MCP server with thirteen tools — search, read, read-by-slug, list, query, ingest, lint, graph, stats, confidence, write, flag and revalidate — plus ingest scripts for Markdown, PDF, web clips and voice | None. confidence.py backs the
wiki_confidence tool and the hybrid searcher is imported
lazily by wiki_search when its dependencies are
present |
Four-level confidence tags the LLM writes about its own claims —
high | medium | low | uncertain — mapped to 4/3/2/1 and
applied as a min_confidence floor on search, which is a
graded threshold rather than a state that withholds |
An honest architectural bet — sources immutable, wiki derived, git as the whole audit — and a clean separation between what the human owns and what the model owns | The citation rule and the contradiction stop are convention with no
code behind them; a quarantine or stale status
is a label no read path consults; wiki_revalidate needs no
person |
memex-zettel |
A markdown card addressed by slug, with required title, created and source frontmatter, optional category, tags and author, and wiki-style links to other cards | Files under a cards directory in a memex home chosen by MEMEX_HOME, the nearest .memexrc above the working directory, or ~/.memex; an archive directory beside it, an embedding cache keyed by content hash, and optional git sync to a remote | Lexical scoring with code-token awareness by default; an opt-in semantic mode blends embeddings from an OpenAI, Azure, Ollama or local provider with a keyword boost; an optional category, tag, author and date pre-filter runs before either | The write command passes input through a credential detector before the file is written; the openclaw and flomo importers and the link command call the store directly and skip it | Editing a card is editing a file; archiveCard renames it into the archive directory, replacing any earlier archived card of the same slug, and records nothing about why | No scope key. One home directory per MEMEX_HOME or .memexrc, a physical partition; the category, tag, author and date filter is a caller-chosen facet that applies nothing when omitted | A CLI, an MCP server, a Claude Code plugin with SessionStart and Stop hooks, agent rules files for Cursor and Windsurf, a Pi extension that shells out to the CLI, and a VS Code extension that registers the MCP server | None over the store; embedding refresh runs on a semantic search and skips cards whose content hash is unchanged, and auto sync commits and pushes after a write when enabled | None. A card carries no status, score or confidence | A credential detector on the write and search commands, tested for false positives as well as rejections, with a fixed rejection message asserted never to echo the token it refused | The detector sits in the write command rather than the store, so three CLI write paths skip it; archiving records nothing and overwrites an earlier archived copy; no scope, status or audit |
memex |
One Markdown page with OKF v0.2 front matter under docs/global/{type}/{slug}.md or docs/projects/{folder}/{type}/{slug}.md; five built-in types, five catalogue knowledge types and project-declared custom types, each page carrying a status | The filesystem is the source of truth; SQLite FTS5 in
mem.db is a disposable index rebuilt from the pages, and
generated index.md files per directory serve as a second,
index-free search surface |
Weighted BM25 over FTS5 with alphanumeric tokens, scaffolding phrases and stop words removed, matched with AND and retried with OR on zero rows; filtered to active pages inside their validity window, and to one project when project scope is requested | memex_write(type, title, body, scope, description, tags, importance, links, parent, supersedes, depends_on, project_id, project_label)
— no slug field, so every call derives a new one; consolidation writes
knowledge types as pending |
forget is hard, soft or
decay from the model and also archive from the
CLI; approve, merge and import
are CLI-only. No tool on the model's surface changes an existing page's
content: a repeated title becomes title-2 |
A global or project scope on every page,
the project id a hash of the Git remote. Project recall filters on it;
global recall, the default and the one the per-turn hooks use, returns
every project's pages |
Five MCP tools; per-turn injection hooks for pi and Claude Code, transcript capture for pi, Claude Code and Codex, and a CI workflow for Copilot | An optional polling watcher re-indexing hand-edited pages; at capture, an episode summary from a spawned harness CLI and an opt-in consolidation; decay and consolidation otherwise explicit commands | A four-value page status filtered on every recall path, a pending
queue for consolidated knowledge, provenance from a page back to its
transcript, reserved provenance fields a caller may not set, and
memex verify as a CI gate |
The index is disposable and the code means it:
rebuild_index deletes rows for missing pages, re-syncs
links, and rewrites the front-matter hash of a page edited outside the
tool, so hand-editing a memory is a supported operation. Model-distilled
knowledge waits: consolidation writes entity, preference, procedure,
catalogue and custom pages as pending, every recall path
hides them, and the approve verb is a CLI command absent from the MCP
surface. And memex verify turns "the agent should have used
memory" into an exit code — --require-recall and
--require-write fail a build when nothing was read or
written since a cutoff, beside parse, index-freshness, link and OKF
checks |
No tool on the model's surface can update a memory.
WriteInput has no slug field, Memex.write
builds a WikiNode with an empty slug, and
WikiStore.write derives a fresh collision-suffixed one, so
the same title written twice is two active pages; the consolidator's
updating = bool(node.slug) and self._store.exists(node.slug)
tests that empty slug, so nodes_updated is always empty.
The memex_write description says the opposite — "Writing an
existing slug updates it, preserving creation history and access counts"
— and the tool is annotated idempotent_hint=True.
supersedes on a write is a link edge only; the replaced
page stays active. The per-turn hooks recall in global scope, so pages
from every project are injected. And memex import drops
status, so an imported or round-tripped page lands active
whatever it was |
memharness |
A MemoryRecord — the triple state_text,
action_text, memory_text plus the episode and
step it was distilled from, the reward and success of that episode,
retrieval counters, and a value with its
value_source and value_update_step. Storing
the situation the lesson came from beside the lesson is what
makes the critique step possible |
A Milvus collection per task
(agent_memories_<task_name>), run locally as Milvus
Lite; the trajectory window itself is an in-process list inherited from
verl-agent |
The policy writes its own query, the store embeds it and returns
top-k by cosine with a min_score floor, optionally
restricted to records from successful episodes, then near-duplicate hits
are dropped in embedding space before anything reaches the prompt |
After each episode a summarizer distils experiences from the trajectory and writes them back with embedding-space deduplication; nothing is written during the episode | No correction and no per-value rejection. A record's utility
counters update after every episode that retrieved it, and
prune_low_utility_memories deletes those whose smoothed
success rate falls below a threshold once they have been used a minimum
number of times — both numbers supplied by the caller, 0.35 and 3 from
the trainer and 0.0 and 0 from the HTTP surface |
task_name is stored on every record and AND-ed into the
dedupe probe and the random-state sampler, and it is absent from the
filter on the retrieval that feeds the agent. Isolation comes from the
collection name defaulting to the task |
Not a library an application calls — a training stack. The memory manager sits inside a verl-agent rollout, and the loop is exercised through ALFWorld, WebShop, AppWorld, Sokoban and a search environment | None over the store during an episode. Write-back runs at episode end; the utility prune runs every N global training steps, wrapped so a failure prints and lets training continue | A value that is a Laplace-smoothed success rate —
(succ + 1) / (use + 2), so an unused record sits at 0.5 —
updated from the outcome of every episode that retrieved it. There is no
discrete status, and success records the source episode's
result rather than any judgement about the memory |
The stored situation travels with the lesson, so the policy can be trained to compare the two and reject a memory that does not fit rather than paste it; and the ranking prior is computed from measured outcomes rather than asserted at write time | The memory subsystem has no test of its own in a repository whose inherited suite is large; the scope key is applied on two auxiliary paths and not on the retrieval that reaches the prompt, so task isolation rests on the collection name; and the headline numbers have no committed run artifacts |
memhop |
A turn topic: an LLM-distilled keyword track over the turn's user and agent text, with the verbatim originals as separate archive records under the topic id for seven days. Also Dream-fused topics, one profile per domain, scene hypergraph nodes, shared L3 graph nodes and plan steps | One .meh append-only record log per database: 26-byte CRC-checked frames carrying agent_id and id_hash, A/B headers, an mmap read path and a snapshot checkpoint, with in-memory indexes rebuilt on open. One process per file under an exclusive lock | No scored retrieval. Search returns the current scene's depth-1 topics and their keyword tracks from an in-memory cache with no LLM call; SearchL4 filters archives by case-insensitive substring, time, topic, kind and plan step; L3 nodes by substring, type or id, plus a BFS subgraph walk | The host opens a turn with Search, appends originals and events with AppendArchive, and closes it with Update, which makes one LLM keyword-extraction call inside the domain lock before the topic is written. ImportL3 and UpdateL0 write the graph and the profile | DeleteTopic and DeleteScene cascade to archives and plan trees; MergeScenes and RenameTopic. Every delete and overwrite appends a tombstone or a new frame, so the old bytes stay in the file until CompactTo writes a copy the host swaps in. No value-level tombstone | Agent domains: every frame carries an agent_id and every index lookup is keyed by it; a sub-agent is registered by name. Scenes scope the surface read inside a domain. The L3 graph pool is file-wide and shared by every domain | A Go module only; the MCP surface was retired in v1.6.5. The host drives Search, AppendArchive and Update each turn; the integration guide suggests tool bindings and keeps the delete verbs off them | Dream, scheduled when a scene passes 24 depth-1 topics or called by the host: seven-day sweeps of archives and plan nodes, LLM consolidation of topics into fused groups, scene hypergraph rebuild and decay, and profile distillation. It holds the domain lock throughout | None. Keyword tracks and model reconstructions reach the surface without a state; a Dream summary carries the role dream, which a host append cannot claim | CRC frames, dual headers and torn-write recovery; domain isolation tested on keyword and id-addressed reads with positive controls; reads cost no LLM call; merge groups validated against the listing handed to the model, with rollback; tool-argument shapes tested against the guide | After seven days only model-derived keyword tracks survive, and a fused group's track is keywords of a model reconstruction of keywords; the sweep bounds what reads reach, not the file, until CompactTo; Dream holds the domain lock across LLM calls; any domain's model can overwrite the shared L3 graph |
memhtml |
One semantic HTML5 file per fact in a git repository, carrying a title, type, claim, entities, facets, citations, event time, validity, confidence and supersession metadata, addressed by its path | A git repository of HTML under MEMHTML_ROOT in PARA directories; a rebuildable SQLite index.db projected from HEAD and the working tree; a state.db access plane exported to a committed append-only JSONL sidecar | FTS, vector, recency and salience arms fused by reciprocal rank in one SQL statement, then MMR; one scope filter string handed to every arm, archived and task rows excluded by default | CLI write and apply, fifteen MCP tools, or a person's own file tools; every write door commits to HEAD and re-indexes HEAD; hooks recall and index transcripts and never write a memory | A correction archives the loser with superseded-by and gives the winner a supersedes link in one commit; eviction and compression are a git mv into archive/YEAR; nothing deletes a memory file | Caller-supplied type, workspace, tag, entity, facet and date axes in one filter; workspace is stored per memory from its projects/ directory and applied only when a caller names it | Two binaries, an MCP server over stdio with fifteen tools and three resources, and installers for Claude Code, Codex, Cursor and OpenCode that record a SHA-256 receipt per owned file or fragment | A seventeen-phase sleep run on a dated sleep branch, each committing phase its own commit; sleep merge fast-forwards main after a discrimination gate over a generated fixture corpus | Two-state lifecycle status taken from the path, supersession links in both directions, an as-of lens, tasks that propose rather than assert, and a merge step a person runs from the CLI | The single scope filter: "[p]er-arm filters would let a scope apply to three arms and not the fourth, which surfaces as a scoped query returning a result from outside the scope. No type catches that leak", with a stated rule that anything narrowing one arm's candidates belongs in that arm and "must never enter this filter". The empty result that answers: when a named scope matches nothing, archivedMatches counts the archived rows the same scope matches, so an agent "can tell 'never existed' from 'archived'" and follow supersededBy to the replacement. And adversarial controls derived from the system's own anti-merge predicates, each validated against its own family rather than the disjunction | Unmerged curation is not withheld from search. A successful sleep run leaves HEAD on its branch, every write door re-indexes HEAD, the runbook's cron re-indexes every ten minutes and a deep run re-indexes mid-run, so the agent can retrieve what a person has not yet reviewed, and an agent write in that window lands on the sleep branch. The merge gate measures a generated fixture corpus and does not read the branch it guards. The mutation record is git history. Scope narrows only what a caller names, and the session-start hook recalls across every workspace. Write-time dedup and conflict checks read active rows only, so a corrected claim can be written again unchallenged |
memini |
A Memory — content, an optional summary, a namespace, a
tier of working, episodic,
semantic or procedural, a derivation
level of explicit or deduced, free tags, a JSON metadata
map, an importance in [0,1], access counters, an optional expiry, an
optional superseded_by pointer, a
valid_from/valid_to interval, an optional
corroboration confidence and an optional LLM-assessed importance |
One Go binary over SQLite with a vector extension, or Postgres; both
implement the same Store interface and are exercised by one
shared conformance suite. A row with no vector is kept
keyword-searchable rather than rejected |
Vector and keyword legs per namespace in parallel, an absolute semantic floor before fusion, fusion within then across namespaces with first-seen order breaking ties, then a composite of relevance times a quality modifier, a durable-tier reserve, a turn-echo guard, dedup and an optional reranker | A ten-step pipeline: validate and resolve the tier, route the namespace, stamp provenance, scrub secrets, sanitize, gate low-signal captures, exact-dedup before embedding, embed, near-duplicate dedup, then store and hand off to background jobs. Some writes are accepted but not stored, and the response says so | memory_forget deletes by id after reading the row for
the activity log; supersession points a predecessor at its replacement
and stamps its valid_to; an optional tombstone TTL, off by
default, hard-deletes superseded rows. Re-writing a superseded value
creates a fresh live row, because the exact-dedup lookup reads live rows
only |
Namespaces with a cascade — primary, ancestors nearest-first, home, links — where every cascade leg is restricted to durable tiers. Recall, briefing and answer take no namespace argument; memory_list, memory_get, memory_history, memory_update and memory_forget take one from the model and accept any valid namespace, and API keys carry no namespace grant | Nine MCP tools including memory_answer,
memory_briefing and memory_history, a REST API
generated from an OpenAPI document, a CLI, a UI, and plugins for several
agent harnesses |
An hourly sweeper purging expired rows, capping short-term tiers, demoting stale durables, optionally purging old tombstones and pruning the activity log; separate jobs for promotion, repair, chunk backfill, periodic dedup and LLM importance assessment | A corroboration confidence that grows logistically on
re-observation and decays without reinforcement, nil meaning untracked
and treated as fully trusted; a derivation level of
explicit or deduced; an assessed_importance cleared
whenever a caller sets importance explicitly, so it can only ever refine
a guess |
A ranking composite that multiplies relevance by a quality modifier instead of adding a flat recency or importance bonus, with the unused weights left at zero and the documentation saying so; a write path that degrades to keyword-only rather than failing when the embedder is slow or absent; a store interface whose comments state the contracts the backends are held to, and one conformance suite that runs them | Five MCP tools accept a model-supplied namespace and resolve any valid one, at every tier, with no grant on the key, so the tier-bounded cascade is not the only cross-namespace read; the activity log is pruned hourly to 720 hours and 100,000 rows by default; the benchmark table's source JSON is gitignored and was never committed, and the README's reading of that table says hybrid never trails a single leg on the session sets where the table shows it trailing keyword |
memlayer |
An extracted fact or entity, in a vector store and a NetworkX graph | ChromaDB for vectors and NetworkX for the graph, or graph-only in lightweight mode | Vector similarity plus graph traversal, in three latency tiers | A salience gate scoring against prototype sentences, in one of three modes | Not a focus; the store accumulates what passes the gate | None found on the read path | Wrappers for OpenAI, Claude, Gemini and Ollama; three lines to adopt | Proactive reminders scheduled against stored tasks | Nothing on a memory; salience decides entry, not standing | A storage decision made by readable, editable example sentences rather than a prompt | No secret filtering anywhere, and credentials are written into the
salience rules three times — a prototype sentence, a regex for "my
password is", and password, ssn,
key and token in the keyword list |
memledger |
A (subject, relation, value) tuple with a layer, a
status, an impact score and a sessions-seen count, projected from an
event log |
SQLite — an append-only events table plus
records, vectors and an FTS index rebuilt from
it |
Hybrid FTS and vector scoring over active records, with deleted, superseded and expired filtered out | Every mutation is an event carrying its actor, its cause, the hash of the policy that produced it, and — if derived — the ids it derived from | A validated state machine over quarantined, active, superseded, deleted and expired; deleted and expired are terminal | None on the read path. user and session
are recorded on events as provenance; records has no user
column |
A Python library and a CLI whose why command returns a
record with its creator event, its sources and its history |
None. Projection is applied per event and can be rebuilt from the ledger | Status is the epistemic state; superseded,
deleted and expired are withheld from recall
unconditionally and quarantined only when the policy says
so, which it does not by default; every event names the policy version
that caused it |
A policy file canonicalised and hashed into every event it
influenced, and an Event.validate that refuses a derived
event with no sources |
The dedup lookup filters status != deleted, so a
deleted fact is re-created rather than blocked — the one decision the
ledger cannot explain away |
memmachine |
Raw Episode (a conversation message) plus derived
SemanticFeature — category, tag, feature name, value —
carrying citations back to episode IDs |
Episodes in SQLAlchemy (SQLite or Postgres); semantic features in Neo4j or Postgres/pgvector; vectors in sqlite-vec, Qdrant, Milvus or in-process hnswlib | Parallel episodic and semantic search, optionally orchestrated by a retrieval agent that reranks and dedupes long-term hits, or by a multi-hop variant that intersects a direct and a two-step search and splits hops with spaCy before falling back to a model | Raw episode committed synchronously; semantic extraction deferred to a background loop polling every 2s in batches of five per set | LLM emits add/delete commands; features hard-delete; episode deletion cascades to semantic history; no rejected-value record | org_id, project_id and session_key threaded through the read path, with org-level set types bypassing project_id | REST API v2, MCP over stdio and HTTP, Python and TypeScript clients, OpenClaw integration | Ingestion loop with backoff, consolidation above a 20-feature threshold, and a queued session-deletion worker | Citations from every feature to the episodes that produced it, resolvable because episodes are retained; no candidate/verified/rejected state | Provenance that actually resolves; a fast and stated write lag; reserved-key impersonation guard; ~1,978 test functions | Deletion is acknowledged before it happens; a duplicated method silently drops error handling on the delete path; the scope key is a composed string whose identifiers are interpolated unescaped and validated nowhere; consolidation dilutes citations |
memmy-agent |
A layered structured note — a MemoryRow with memory_type, status, visibility, key/value, tags, a memory_layer (L1 trace, L2 policy, L3 world-model, Skill), a content_hash and a version — with vectors in a sidecar table | One local SQLite database at ~/.memmy (better-sqlite3) with an FTS5 mirror and a sqlite-vec vector sidecar; local embeddings; an optional opt-in hosted OpenMem/MemOS cloud backend that is not the default | Hybrid multi-channel — vector (sqlite-vec over summary/action/content), FTS5 lexical, plus pattern and structural routes fused by per-channel max score, with LLM multi-query rewrite; filtered by layer, status and tags | Turns ingest into raw_turns/episodes; a background evolution pipeline distills L1 traces, induces L2 policies (candidate pool + similarity dedup), abstracts L3 world models and mines Skills, all by LLM prompts | Soft-delete (status=deleted, deleted_at) and archive; import conflict strategy skip/replace/error; a negative-experience pipeline synthesizes anti-pattern avoid policies keyed on a failure signature; content_hash dedup | Scope keys (user/agent/app/session) exist and episode reads assert scope, but the primary semantic recall filters only layer/status/tags — cross-agent pooling is deliberate, so recall is shared across agents | One local HTTP daemon (127.0.0.1:18960) plus an injected per-agent CLI skill written into ~/.claude, ~/.codex, ~/.cursor, ~/.openclaw and ~/.hermes so every agent reads and writes the same store; a CLI, not MCP | An evolution job pipeline (evolution_jobs + workers) consolidates, dedups and promotes memories up the layers and mines skills and anti-patterns — this is what 'self-evolving' means in code | Two nested states: a row status (activated/resolving/archived/deleted) recall filters on by default, and a six-value policy lifecycle (candidate/active/verification_required/quarantined/superseded/archived) where only active and candidate reach a prompt and the candidate is labelled unverified | A genuinely local layered memory shared across every connected agent through an injected CLI skill, with an LLM evolution pipeline that induces reusable policies and anti-patterns from experience, and append-only change and audit logs | The shared brain has no scope on its main recall — every agent's memory pools into one and cross-agent isolation is deliberately absent; audit and change logs are retention-pruned; 'MemOS-powered' is lineage and branding, and a hosted cloud backend is one config flip away |
memo-local |
A record carrying a validity interval — valid_at and
invalid_at — beside its created record time,
with a source path for vault-derived memories and an entity graph
alongside |
SQLite: a corpus, a separate history.db audit database,
and per-vault exclusion files as plain text under the state
directory |
Search with an optional as_of that selects a valid-time
filter through the live index, or a separate family of transaction-time
tools that reconstruct the corpus from the audit log |
Saves, updates and deletes each log to the history database from the operation performing them; deleting a vault-derived memory additionally records an exclusion glob for its source note | Deletion removes the row and tombstones the source so a scheduled re-ingest cannot resurrect it; supersession is decided by a shared belief module during maintenance rather than per read | None — single-user and local by design, so there is no principal to scope against and no stored scope key on a read path | An MCP server with profile-gated tool families, hooks and slash commands for several editors, launchd and systemd units, a statusline and a web chat | A scheduled vault re-ingest, nightly Dream passes including a contradiction pass, consolidation and maintenance | None consulted at recall. belief.py decides which side
of a contradiction supersedes, and its own header says it runs only in
the maintenance path, never the five-second recall hook, so a
contradiction found since the last pass is not yet reflected |
The tombstone is keyed on the source note rather than the deleted row, which is the only thing that survives a scheduled re-ingest, and its docstring states the resurrection scenario it exists for; the two as-of questions ship as two tool families with the difference written into the module header; the audit log is the input to reconstruction, so it is checked every time that feature runs; and the contradiction rule is one pure read-only module kept off the recall path | The exclusion is keyed on a path glob, so moving or renaming an
excluded note takes it outside the tombstone; a second, weaker marker
shares the word and consolidation.py records that an upsert
clears it; supersession is resolved only during maintenance, so a
contradiction found since the last pass is returned like any other
memory; and the screen found six auto-run surfaces — hooks, launchd and
systemd units, an installer and editor command files — which is inherent
to the product and a larger execution surface than most systems
here |
memobase |
A free-text memo of at most five sentences, keyed by topic and subtopic, plus tagged events and their embedded gists | Postgres with pgvector; composite (id, project_id) primary keys on all seven memory tables | Profiles selected by topic preference and token budget; events by tag filter and gist embedding similarity | Buffered — blobs queue in buffer_zones until a token threshold or a one-hour flush, then one LLM extract-and-merge pass | An LLM rewrites the memo in place (APPEND / UPDATE / ABORT); no prior value is retained | project_id and user_id in every memory table's primary key, foreign key, index, read-path filter and Redis cache key | REST API with Python, TypeScript and Go clients, an MCP server, and an OpenAI-compatible wrapper | Buffer flush, plus organize_profile when a topic exceeds max_profile_subtopics | None represented; a memo is a string, and a rewrite leaves no record of what it replaced | Scope is structurally impossible to omit; context assembly has a real token budget and a profile/event split | persistent_chat_blobs defaults to false, so the source transcript is hard-deleted after extraction |
memoir-cli |
Two kinds — an entry file (markdown with YAML frontmatter, one of six types) living in whichever host tool's memory directory owns it, and an item in the session working set keyed on its normalized text | No store of its own for entries: eleven adapters read and write the
host tools' own directories. Its own files are
~/.config/memoir/session.json, events.jsonl,
and AES-256-GCM ciphertext in Supabase storage |
Field-weighted lexical scoring over parsed docs — aliases, name,
description, headings, body — with saturating term frequency, a
coverage-squared multiplier and prefix/plural folding, returning matched
passages rather than files. A depth-3 $HOME crawl backs it,
behind a 60-second index cache that a fresh CLI process never hits. No
scope filter |
Synchronous. Explicit writes through 16 MCP tools; auto-capture parses Claude Code's own JSONL transcripts with regex extractors behind a quality gate, redacting secrets against 27 patterns first | Union-merge with newest-wins per identity, and two tombstone classes
— hidden monotonic for decisions, done_at
temporal for next actions. Both are honored on merge and both have
shipped writers — memoir forget and
memoir_forget for the absolute one,
memoir_complete_next for the temporal one |
A project identity — a hash of the git remote or the home-relative
path — stamped on each item and applied by memoryVisibility
on every recall and session view, with shared visible
everywhere and allProjects as the opt-out; profiles select
a sync destination, not a memory scope |
An MCP server with 16 tools, an installer that configures 11 host
tools, and a marker-delimited block injected into
~/.claude/CLAUDE.md and three other always-loaded
files |
None. A debounced autopush and a Stop hook run in the turn; nothing rewrites the store on a schedule | No epistemic state. A decision is live or suppressed, and provenance
for an auto-captured one is the string auto-captured:
prefixed onto its prose rationale field |
A merge spec where every normative rule cites the production data-loss bug it exists to prevent, with the monotonic-tombstone rule argued correctly and implemented as argued | Retraction is text-keyed, so a paraphrase of a hidden decision is a different identity and is not suppressed; and hiding is irreversible by design, with no review step between the confirm prompt and a permanent tombstone |
memoir |
A timestamped facet entry at a semantic path like profile.professional.skills.python | A ProllyTree over a git object store, with a file backend as the alternative | Path discovery within a namespace, then keyword or LLM-powered search over the paths | A collision strategy selected by the memory type the taxonomy prefix implies | Six strategies — append, replace, confidence-gated, LLM-merge, merge-on-read, reject | namespace is a key prefix and the argument to every store.search call | A CLI, an MCP server, plugins for several agents, a TUI and a web UI | Aggregation at semantic locations; a watch service | A confidence float per facet entry, and a status field read but only ever written active | Merkle inclusion proofs, memoir blame, and a git-gc hazard found, fixed and disclosed | A fully specified LoCoMo harness with no results published anywhere in the tree |
memoket-kite |
A fact element — text, kind,
who, an event time t, a three-valued
conf, topic and entity codes, facet codes for object class,
place, event type and duration, and src ids pointing at the
line elements it was extracted from, which stay in the same
file as evidence |
One XML artifact per memory, holding a vocabulary of topic and entity codes, a timeline of sessions, their facts and their raw lines. No database, no index files, no embeddings; the package declares zero runtime dependencies and the posting lists are rebuilt in memory on load | Symbolic and lexical only. Each question is compiled three times into a JSON plan — select, where, and a pipe of sort, head, tail and count — and a deterministic scorer keeps the candidate that returns the most rows. The plan runs as prune by time, match by code closure and postings, filter, rank, refine and pack, fused with an IDF-weighted keyword channel over every fact and line. A refine ladder relaxes constraints in a fixed order and abstains rather than return the corpus | remember() is one LLM call per session that returns
facts and retrieval facets, appended to the XML timeline and written
back through a staged temporary file that is parsed by the loader before
it replaces the original. Synchronous, immediately retrievable, no
background pass. A session id already present is refused rather than
merged, and the docs rule out concurrent writers |
Absent, and it is the design's central bet. The public API is load, remember, recall, answer — no delete, no forget, no edit, no supersession field. A superseded fact stays in the file; the evidence pack is sorted by date and the default reader prompt says the most recent contradicting row wins. A vocabulary merge in the package rewrites stored topic and entity codes, and only the benchmark build scripts call it | The artifact is the boundary: Memory.load takes one or
more XML paths and everything in them is in scope. who
filters by which speaker said something, which is a content axis rather
than an access one, and no tenant, user or project key exists on a
fact |
A Python library and nothing else — no CLI entry point, no MCP
server, no HTTP surface. A second, lower-level research API
exposes the plan objects, a profile protocol, the execution trace and
per-stage telemetry for method evaluation |
None. Extraction happens in remember and indexing on
load; topic and entity consolidation and instance alignment are library
functions that only the benchmark build scripts call |
Every fact carries its source line ids and the raw utterances stay
in the file, so an answer's receipts resolve to the words someone
actually said. Epistemic status is a conf of low, med or
high, ordered by a dict named CONF_ORDER and spent on a
ranking bonus and an optional conf_min floor the public API
cannot set; no value means a fact should not be believed |
The benchmark machinery is built to be checked by a sceptic — dataset revisions and SHA-256s pinned in a manifest, results sealed by digest, a verifier that recomputes the published metric from the sealed bytes without an LLM, and a contamination gate that scans shipped prompt text for terms concentrated in a small fraction of the corpus | Nothing can be corrected or removed, so a wrong extraction is permanent and an erasure request has no path but a text editor; on the default path a contradiction is settled by the reader model following one prompt line; and the two headline scores come from a benchmark configuration the library does not ship and cannot be checked by a reader, because the sealed rows are named in the manifest, not committed, and the release carries no assets |
memomind |
Hindsight's units — source chunks, world and experience facts, observations, reflections | PostgreSQL with pgvector, in a per-user embedded instance the installer provisions | The vendored engine's four-arm hybrid recall with a CUDA cross-encoder | Retain through the engine, plus importers for AI chat archives and a life planner | A weekly job deleting observations with proof_count <= 1 older than 30 days | Bank isolation, inherited from the engine rather than added here | MCP over stdio, a dashboard, Windows and WSL2 installers | Engine consolidation, plus a scheduled backup-and-prune script | proof_count is the only signal this project acts on, and it acts on it by deleting | A documented patch set naming four real defects in an upstream memory engine | The installer sed-replaces password with trust across the database's pg_hba.conf; and the README asserts MIT with no licence file, over 160 vendored upstream files carrying none of their own |
memoose |
A typed relation between two named entities, with a one-sentence description, a free-text evidence pointer and optional valid_from and valid_to; also source chunks, session context entries, lessons, and Procedures joined by Transitions carrying condition, advice and pitfall | One SQLite file per dataset under ~/.memoose, with FTS5, a float32 embeddings table and WAL; a project dataset named from a hash of the working directory plus one user dataset | A regex router picks one of eight modes; lexical bm25 and brute-force cosine are fused by reciprocal rank per kind, top entities expand to their relations, weights multiply; superseded facts drop except in temporal mode; project then user dataset with reserved slots | Explicit remember through 26 MCP tools or the CLI; a Stop and PreCompact hook runs a Haiku keeper through claude -p that writes through the CLI; deterministic ids merge by name, and functional relations supersede on write | supersede sets a flag, a pointer and a reason; forget hard-deletes an entity with its relations, a relation, a session or the dataset file; re-asserting a superseded relation clears its flag. No tombstone | Physical: one SQLite file per dataset. No scope key on any row; every tool takes a dataset name, and list_datasets names every file on the machine | Claude Code plugin with SessionStart, UserPromptSubmit, Stop, PreCompact and PostToolUse hooks, four skills, a memory-keeper subagent and an advisor; installers for Codex, OpenCode and Cursor copy the skills | Capture per turn on Haiku through claude -p, asynchronous; a maintenance nudge at most once a day at session start; no daemon | A superseded flag filters default recall; a contested flag on facts in an open contradiction is disclosure only; the keeper is told to skip anything it is unsure of | Evidence pointer on every fact; functional supersession ordered by valid_from rather than arrival; every hook excludes superseded facts and a test proves it; a dismissal ledger stops the same maintenance candidate being re-proposed; LoCoMo rows committed and the headline recomputes | Re-asserting a superseded fact revives it and, on an undated functional relation, supersedes the newer value; the capture keeper runs claude -p with unrestricted Bash and --dangerously-skip-permissions over transcript text; a non-zero keeper exit still advances the cursor; the headline benchmark never exercised the graph |
memora-engine |
A Memory row typed SEMANTIC,
EPISODIC or PROCEDURAL, with importance,
confidence, strength, an access count, a lifecycle status and an origin
of USER_STATED or LLM_DERIVED |
Postgres through Prisma, with a pgvector vector(1536)
column and a memory_relationships table of typed, reasoned
edges |
Semantic and keyword arms merged and ranked by five configured
weights — semantic 0.4, keyword 0.2, importance 0.15, confidence 0.15,
recency 0.1 — over ACTIVE rows only, with every score
explainable |
LLM extraction from a conversation, exact-normalised deduplication against recent active memories, batch embedding before any insert, then an LLM conflict pass that must not block the write | A contradiction the LLM classifies above 0.75 confidence sets the
older memory SUPERSEDED and records the edge with its
reason, in one transaction; archival by a decay pass; restore; and a
hard delete endpoint |
None — the schema has no user, tenant or agent key; one deployment is one user's memory | Fastify REST API with Zod schemas, a typed TypeScript SDK, and a demo agent that calls both | None scheduled; decay and archival run when an operator invokes
pnpm memory:lifecycle |
Origin separates stated from inferred, and reflection refuses inferred memories as evidence; nothing withholds an inferred memory from search | Supersession that keeps the loser and its reason, a guard that an older memory cannot supersede a newer one, and a deterministic evaluation that asserts stale memories stay out of a populated top five | Deduplication consults only active memories, so a superseded value can be extracted again, stored as new, and — being newer — supersede the correction; no scoping; no licence |
memora |
Memory row with content, tags, metadata, importance, and access count | SQLite with FTS5, embeddings, crossrefs, events, actions, tombstones and an absorb in-flight table; D1 cloud backend; one database per named instance, selected by the configured backend | FTS5 plus embeddings, ranked with age-and-access importance decay, with a lineage mode that defaults to excluding superseded rows | MCP tools, documents and images, and an absorb path
that classifies extracted facts against existing rows; the server's own
type inference is advisory and returns suggestions without writing. The
shipped Claude Code plugin adds a second, automatic write path: a
PostToolUse hook that captures git commits, test results,
documentation edits and research fetches above a significance threshold,
and stamps a type by keyword — a test run whose output matches
failed, error or failure is
written as an issue with status: open and
severity: major |
Pairwise relation classification into supersession edges; superseded rows excluded from public list and search by default, and a superseded id resolves to its current leaf. Retirement additionally writes a tombstone keyed on a normalised hash of the content, which the absorb and import paths consult and refuse, so the same text cannot re-enter by either automatic route | Separate databases per named instance — a physical boundary rather than a predicate, with a committed test that retires a row in one and asserts the other is untouched. No scope key on a row and no scope clause on a query; tags form a dotted hierarchy | MCP server, CLI, and two graph viewers — a Python server and a Cloudflare Worker force-graph | Supersession sweeps, embedding backfill, cloud sync | memories_events and memories_actions logs;
contradicts as a relation between memories; per-vector
writer and dimension provenance |
Correction that can be rehearsed — dry_run defaults to
True — a read path whose omitted argument is the safe one, and a
retirement that is keyed on the content rather than the row, so
re-ingesting the same text is refused with the reason it was retired
for |
The shipped plugin's hook re-introduces keyword classification on an automatic write path, the layer the server's own write path had it removed from; and no epistemic state exists — a memory is present or superseded, with nothing marking it candidate, verified or rejected |
memorax-code |
A fact returned by the service, rendered into a
<memories><facts memory_type=…> block; what is
stored is decided remotely |
None of its own — a hosted MemoraX service behind
/v1/memories/*, with a local buffer for pending
writebacks |
One POST /v1/memories/search per turn start, rendered
into a char-budgeted context block; ranking and matching are not in this
repository |
Automatic per-turn writeback: buffer, chunk, redact,
POST /v1/memories/add with async_mode: true —
acceptance is the last thing the client learns |
No delete, no correction and no supersession anywhere in the client; the API surface it speaks has three endpoints and none of them removes anything | A required RepositoryMemoryScope —
git-repository, local-directory or
general — refused rather than defaulted; the key sent to
the service is baseUserId@repositoryName, so same-named
repositories share one namespace by design |
Deployment adapters and hook runtimes for Codex, Claude Code,
DeepSeek Harness and OpenCode against one local backend, plus a
memorax memory CLI |
A writeback buffer with chunking, and per-client reconciliation of a turn interrupted before its writeback | None in the client — no status, no confidence read, no provenance beyond the scope and the turn it came from | Credential redaction before anything leaves the machine, with a positive control against over-redaction; scope refused rather than defaulted | Every question this atlas asks about correction is answered on the other side of an HTTP boundary that is not in this repository — and the scope key that boundary receives is a bare repository name |
memori |
An entity fact — content, embedding, num_times, and a normalized content hash — joined to every conversation that mentioned it | Six SQL dialects plus MongoDB, from one Rust core with Python and TypeScript bindings | Embedding search and lexical search over facts, ranked with a frequency index | Durable turn first, then best-effort augmentation; extraction runs in the vendor's hosted API | Upsert increments a counter and never rewrites content; deletion is per-entity only | entity_id and process_id foreign keys applied on every read, with ON DELETE CASCADE throughout | Python, TypeScript and Rust SDKs, plus plugins for Claude Code, Hermes and OpenClaw | A Rust worker drains a write queue; augmentation is asynchronous and best-effort | None represented; num_times is a frequency counter, and no fact carries a status | Fact-to-conversation provenance as a real join table, and a capture path that survives extraction failure | The dedupe key strips all non-ASCII, so facts in non-Latin scripts collide into one row; extraction is a closed hosted service |
memorix |
An observation — an entity, a type such as decision,
gotcha, trade-off or
why-it-exists, a project id, a visibility of
personal, team or project, a
creator agent, an optional shared-agent list, an
admissionState and a valueCategory; separately
a long-term memory of kind episodic, semantic
or procedural with a scope, a lifecycle state, a
portability and typed evidence rows |
Local-first: SQLite plus an Orama search index under a project data directory, with a coordination store for team identity | A compact search, timeline and detail API over lexical and vector
lanes with a code graph and reranking, plus
selectLongTermMemoriesForTask, which filters on scope,
lifecycle and portability before scoring |
MCP tools and agent hooks capture observations; long-term memories are created as candidates, manually or from evidence, and advance only through explicit transitions | Deduplication and consolidation merge project-visible observations only; retention and cleanup passes; a long-term record is archived or superseded, never silently rewritten, and each transition appends an event | Project id plus a three-value visibility on observations; project, user or team scope with a project-bound or portable flag on long-term memories; team visibility requires an active coordination membership | An MCP server used by many agent hosts, a CLI, agent hooks and rules, a TUI, a dashboard, and packages for agent-core, ai and memcode | Consolidation, deduplication, compaction checkpoints, freshness and retention passes, entity extraction and auto-relations | Admission state, the long-term lifecycle with required evidence and recorded reasons, an attribution guard, a secret filter, and a disclosure policy | A visibility check applied at every read seam rather than at one gate; consolidation that refuses to merge personal or handoff records so they stay individually inspectable; a long-term ladder that will not advance a record without evidence and a stated reason | The MCP transfer tool's import inserts records verbatim — no
visibility validation, no project re-stamping, no reader check, no
admission gate — while export on the same tool is reader-filtered; an
unrecognised visibility value resolves to project-wide and a missing
admission state is treated as deliverable, both for upgrade
compatibility; the module named audit tracks files written
into the project rather than memory mutations |
memorizer |
A titled Markdown document with free-text type, source, tags, a 0 to 1 confidence nothing reads, an owner (workspace or project) and an archetype of document, record, archived or system | One Postgres memories table with two pgvector columns (content and title-plus-tags embeddings) and a trigger-maintained weighted tsvector; memory_versions snapshots and memory_events rows beside it | search_memories runs HybridSearch: a vector leg over the title-plus-tags embedding and an AND-prefix full-text leg, fused by RRF with k 60 and a 10 percent tag boost. The minSimilarity argument is accepted and not applied, by ADR, so a non-empty scope always returns hits | Explicit, through MCP tools, the HTTP API or the web UI. A store embeds twice synchronously and inserts one row; no extraction, no deduplication, no LLM on the write path | edit, update_metadata and revert snapshot the old state and write one event in a transaction; archive hides a row from default reads; delete removes the row and cascades its versions and events. Snapshots are capped at 50 per memory | owner_type and owner_id on the row, applied as a predicate when the caller passes projectId or workspaceId; unscoped by default. No tenant, no user and no authentication on the HTTP or MCP surface | Streamable HTTP MCP server at /mcp with 21 tools, seven prompts and a workspace-tree resource; an MVC web UI and REST API on the same port; Docker compose with Postgres, pgAdmin and Ollama | Operator-started Akka.NET actors for title generation, embedding regeneration, dimension migration and version purge; a startup pass embeds rows missing a metadata embedding. Nothing rewrites memory content on a schedule | None as a state. Archived is a retention flag the agent sets and clears; the record archetype is described as immutable and nothing enforces it | Version snapshots with diff and revert in one transaction; hybrid retrieval chosen by a committed eval corpus and recorded in an ADR; argument guards that turn MCP binding failures into correctable messages; scoped search cases that assert exclusion beside inclusion | Six declared event types, two with producers, and time purge and cascade delete both erase events; delete_workspace reports memories moved to Unfiled and moves none; store accepts archetype system or archived, hiding a memory at birth; no authentication with any-origin CORS by default |
memory-compiler |
A row in one of four canonical Markdown tables — a durable fact, an open item, a decision, or a rejected value | Four Markdown files at a topic root, plus a JSON session ledger and recovery candidates | None — the agent reads the files; the compiler only validates them and regenerates a disposable index | A person or agent edits the Markdown directly; nothing is extracted automatically | A superseded value moves to TOMBSTONES.md add-only,
with a pointer to its replacement rather than a copy of it |
One topic directory per project; no scope key inside the files | None shipped — --open and --close are
meant to be wired to session hooks the adopter writes |
None; every check runs on the close | One tag, candidate, applied only to recovery-sourced
facts — deliberately not a ladder |
A rejected value reasserted verbatim in a canonical file blocks the session from sealing | The collision scan ignores values under twelve characters, which excludes both tombstones in the shipped example |
memory-engine |
Row in one memory table: content, name, meta, tree
path, temporal range, embedding |
PostgreSQL 18 — ltree, pgvector/halfvec, BM25, JSONB, tstzrange; schema per space | Hybrid BM25 plus semantic via Reciprocal Rank Fusion, computed in SQL functions | JSON-RPC create/batchCreate requiring an explicit tree; importers for git, sessions, packs | Update, delete by id or path, deleteTree for a subtree;
onConflict error/replace/ignore. A replace overwrites the
row, and a trigger writes the prior shape into memory_event
— so the correction is recoverable from the log within the retention
window rather than from the table |
A _tree_access jsonb is the first parameter of
search_memory and hybrid_search_memory, so
authorization is inside the ranking query rather than a post-filter. A
restricted API key carries per-space and per-tree-path declarations that
act as a ceiling, intersected against the member's live grants at the
deeper of the two paths |
JSON-RPC over HTTP, MCP, CLI, web UI, harness adapters for Claude, opencode, Codex, Gemini | Worker pool; embedding generation; importers | None about the memory. Authorization is by principal and path,
authenticatedAs is recorded for observability and
explicitly never gates authz, and a cause the caller
declares is journalled beside every mutation — provenance of the change,
not a claim about the content |
A delegated credential is a ceiling rather than a grant, intersected with the holder's live access in both path directions, and an inconsistent key/member/space triple yields no rows at all — the safe direction. Every memory mutation is journalled by trigger, and an update that changes nothing writes no event | No trust state and no tombstone; memory is a well-governed store, not a belief model. The mutation log is bounded — where TimescaleDB is installed a retention policy drops audit events after thirty days, so per-memory history has a horizon |
memory-garden |
A source atom — a paragraph of a note with line range, record time, explicit event time and authorship — plus derived stance snapshots, discovery candidates, and the user's verdicts | One SQLite database per vault with FTS5 (trigram), per-model vector rows, sources with revision history, the discovery, verdict and reaction tables, and user-authorized memory items | Switchable BM25, character hashing, embedding or RRF-fused hybrid over atoms, filterable by authorship and a date window, through eight read-only tools | Read-only sync from the vault; offline stance extraction, deterministic or by a model in batches; discovery scans that write candidates; the person's verdicts and reactions | Notes change in the vault and are re-synced as new revisions; a denied change pair is skipped on later scans; a memory item is superseded by a later verdict or revoked by the person, and neither is deleted | None inside a vault — each vault is its own workspace with its own application and database | A single-agent harness over an OpenAI-compatible model, a local web workspace, a CLI, and an MCP server exposing the same read-only tools | None scheduled; discovery scans and snapshot extraction run when invoked | Candidate, reviewed-and-confirmed and reviewed-and-denied states set by the person; authorship separates the user's own words from quotes and AI drafts; the harness refuses a final answer until its evidence plan is complete | A system built around the rule that only the person can confirm what they believe, with the refusal to re-propose, the authorship boundary and the causal-claim guard all in code | The denial is keyed on atom ids derived from the whole file's revision hash, so any edit anywhere in either note reissues them and the denied pair can return; event time and record time are stored apart and queried as one |
memory-industry |
A row in one of three content tables — observations, episodes,
errors — each carrying a trust tier and a
project_id; facts are mirrored apart into
brain_facts as subject/predicate/object with a validity
window and a confidence |
PostgreSQL 18 with pgvector; row-level security enabled and forced
on the content tables under a tenant_isolation policy that
admits every row while no project is bound |
Hybrid text, BM25 and vector arms fused, with an optional cross-encoder reranker and an optional associative expansion over the entity graph; the observation and episode arms carry the trust predicate, and every arm carries the project predicate when a project is bound | An MCP tool call resolves the trust tier before the insert, from the
source, an optional caller-supplied tier and a policy that quarantines
LLM inference only when an environment variable enables it; each
observation is mirrored into brain_facts with
valid_from set to the clock |
cuba_eco action=correct rewrites an observation in
place and keeps its newest 20 prior versions in a JSON array on the row;
cuba_cronica deletes by id and cuba_forget
hard-deletes an entity with everything that references it. Facts are
closed only by a sync import. Deletions leave a row-keyed tombstone for
sync; nothing keys a rejection on the value |
A project bound to the session by the agent's own
cuba_jornada start project= or
cuba_proyecto switch, or in the HTTP daemon from the
client's workspace root. Every search arm reads
project IS NULL OR project_id = project, so with no project
bound nothing is filtered; include_unscoped=true also
admits rows with no project |
An MCP server with thirty cuba_* memory tools plus
cuba_tools and cuba_call to find and invoke
them, run on stdio or as one shared HTTP daemon, with a CLI, published
to PyPI, npm and the MCP registry |
Embedding backfill, calibration over recorded outcomes, deduplication, a REM consolidation queue and a code-graph indexer | Two discrete tiers, trusted and quarantined. A quarantined
observation or episode is stored, listable and admitted by no
cuba_faro arm until promoted; the error arms, the context
assembler, entity get and the entity resource read without the
predicate. The promoting action sits on the tool the writing agent
already holds |
The trust predicate is written as an allow-list so a new tier fails closed; each must-not test is paired with the control that would catch a filter excluding everything; database CHECK constraints were added with a comment naming the illegal states the schema had permitted; and the README retracts its own published retrieval score and the two conclusions drawn from it | The project scope is optional state the agent sets with its own arguments, and with none bound every read spans every project; the quarantine predicate is missing from the error search arms, the context assembler and entity get; the hash-chained audit log records trust transitions only and drops a failed append; both time axes on a fact are stamped from record time |
memory-lancedb-pro |
A three-level memory — abstract, overview, content — with a category, a tier, a layer and a fact key | LanceDB as the single vector store, with metadata carried as a JSON string on each row | Hybrid vector plus tag search with query expansion, an outsourced reranker, and a Weibull decay composite | An LLM admission controller scores every candidate and can veto it outright before anything is stored | Fact-key collision scan within scope, then invalidated_at on the loser and a superseded_by pointer | A scope filter applied in the store read path, denying rows whose scope is null against any real filter | An OpenClaw plugin with before_prompt_build hooks, plus a CLI and MCP-style tools | A dreaming engine on a nightly cron for decay, tier promotion and compaction | A confidence float and a three-value state whose middle value is never written by any writer | Validity time that reaches an as-of read, and a feedback loop that suppresses memory the agent kept ignoring | The pending state was disabled to unblock recall, so admission is the only gate and it is an LLM score |
memory-palace |
A memory row addressed by one or more (domain, path) pairs, chunked for retrieval, with derived gists, summaries and procedures above it | SQLite through SQLAlchemy, FTS5 for lexical, a vector table or sqlite-vec for dense, JSON snapshot files on disk | Four profiles from keyword-only to reranked, RRF-fused, with deprecated rows excluded in the channel SQL | A Write Guard searches for near-duplicates first and returns ADD, UPDATE or NOOP; a snapshot is taken before the first change to a resource | Version chain through migrated_to, deprecated marks the old row, archive requires a review token, purge is a human action | domain and path_prefix are optional filter parameters, not an enforced boundary | One MCP server for Claude Code, Codex, Gemini CLI and OpenCode, plus a React dashboard and a FastAPI backend | Maintenance jobs for compaction, vitality decay simulation and snapshot retention, all explicitly invoked | review_state is draft, human_reviewed or rejected — and drafts are never recommended | Derived memory is unusable until a person approves it, enforced on the read path and at the schema | The rejection is keyed on the row, not the content; and the L0 access log is created, modelled, and never written |
memory-project |
A fragment or session summary carrying strength, stability, memory_type and consolidation_level | One ChromaDB collection plus a plain-text activity log; embeddings from a local all-MiniLM-L6-v2 | Cosine similarity weighted by a forgetting-curve strength, topic as a 1.5x boost, plus an associative second hop | jot() for one-line fragments and ingest()
for session summaries; background transcript extraction at session
end |
prune() archives below a strength floor and is
reversible via recall_cold/revive_from_cold;
purge() is the only true delete and rebuilds the collection
so the embedding does not survive.
purge(doc_id, tombstone=True) additionally records the
rejected claim, and jot() refuses a later write within 0.82
similarity of one |
topic derived from the working directory, applied as a
ranking boost and never as a filter — cross-project recall is the
goal |
Claude Code hooks — SessionStart backstop, prompt-time recall, SessionEnd capture | Session-end transcript extraction in a subprocess;
prune() and feedback consolidation are on-demand, not
scheduled |
No status field; strength and stability stand in for confidence, and a confirmed activation reinforces harder than an ordinary hit | Two-speed forgetting where routine cleanup is reversible and deletion is a separate deliberate act; consolidation drafts rules a human must approve | The tombstone check runs on jot() and the rebuild is
O(corpus) on every purge, which the docstring accepts as the price of a
rare operation; scoping is a ranking boost and never a filter, because
cross-project recall is the goal |
memory-ts |
A two-tier memory — a headline always shown, full content expanded on demand | A filesystem-backed store with vectors and cosine similarity, no external service | Semantic surfacing filtered to active status, with rules for auto-expansion | A curator extracts memories from the session transcript at session end | superseded_by, plus a five-state status and a per-session decay counter | project_id and domain on a memory; no scope key found as a read predicate | Hooks for Claude Code and Gemini CLI, handling concurrent sessions | Curation at session end, with session resumption support | status active / pending / superseded / deprecated / archived, filtered on retrieval | A schema history recording which fields were deleted and the evidence for each | The curator is a subprocess call to a CLI, with one ad-hoc test script in the tree |
memory-vault |
A chunk — content, an embedding, an importance, a space, a JSONB metadata bag carrying a content hash, the forgotten flag and its timestamp, with entities and relations extracted into a knowledge graph beside it | One self-hosted Postgres with pgvector, nine numbered migrations, and live graph views over the chunk table | Hybrid semantic and keyword search over two arms sharing one WHERE-clause builder, with optional space and since filters and a forgotten exclusion that both arms inherit | An MCP remember tool, a REST ingest, a CLI file ingest,
and a chunker; a unique index on space and content hash stops two
concurrent remembers storing the same text twice |
Forgetting marks the row, zeroes its importance and stamps the time;
the row stays out of every default read and is destroyed only by a later
purge-forgotten pass with a thirty-day floor. A memory can
also be moved between spaces, rebuilding its graph entries |
Memory spaces as namespaces for projects or domains, bound into the query when named, failing closed when the names resolve to nothing, and absent when the caller names none | An MCP server, a REST API, a web dashboard, a CLI, and a local-LLM chat over the operator's own memories | Entity and relation extraction into the knowledge graph, live graph views, and an operator-run purge of forgotten memories | A binary forgotten flag with its timestamp, excluded by default everywhere, plus an importance that the forget path zeroes. No confidence, no provenance, no supersession pointer | An empty scope list that compiles to a false predicate rather than to no predicate, with the widening bug it closes named in the test; a forget that hides first and destroys later behind a day floor; migration comments that state the race each index fixes and say when a later migration narrowed them; and a threat model that declares what it does not defend against and ships a re-runnable pentest script | With no space named a search spans every space, which the single-tenant threat model makes deliberate but which becomes the boundary the moment a deployment breaks that assumption; the least-privilege database roles are opt-in group roles that no deployment adopts by default; and the content-hash unique index guards concurrent duplicate writes rather than recording a rejected value, so forgetting a memory and storing the same text again succeeds |
memorybank |
One dialogue turn — query, response, memory_strength, last_recall_date, memory_id — plus a per-day summary and a per-user personality portrait | A single JSON file keyed by user name, and a FAISS index rebuilt from it | Cosine top-6 over HuggingFace embeddings, with a monkeypatched neighbour-expansion that assigns every result the same score | Append the turn to today's list and rewrite the whole JSON file; summarization and personality analysis are separate manual passes | Recall increments memory_strength; startup deletes turns at random against a retention probability and rewrites the file in place | memory_bank[user_name], but the per-user filter in the forgetting pass is commented out and the FAISS index is built from every user's turns | Two Gradio demos and two CLIs, for ChatGLM, BELLE and ChatGPT; no library, API or MCP surface | None. The forgetting pass runs synchronously when a user logs in | None. No provenance, no confidence, no status | The first and clearest statement of recall-strengthened decay as an agent-memory primitive, with a committed bilingual probing-question dataset | The retention formula is inverted, forgetting is destructive and stochastic against the only copy, and logging in as one user deletes other users' memories |
memorybear |
A Statement or Entity node in Neo4j, with an ACT-R activation value derived from its access history | Neo4j for the graph and Postgres for configuration, cycle history and operational state | Graph traversal and vector search, both scoped by end_user_id, with activation as a ranking term | Perceive, extract, associate — an LLM pipeline producing statements and entities behind a FastAPI service | Low-activation node pairs fuse into a MemorySummary with DERIVED_FROM edges; originals are deleted | end_user_id on every node and every relationship, ANDed into the retrieval Cypher; one of the seven search templates makes the predicate conditional on the key being non-null | A FastAPI service, a web console, an e2b sandbox and a Docker Compose deployment | Activation-driven fusion cycles, triggered on demand through the API — the Celery beat entry that ran them on a clock is commented out | An importance score feeding activation; no epistemic state on a statement | Forgetting produces a summary that keeps typed provenance to what it replaced, not an absence | Every published benchmark figure is an image in the README, with no harness or result file in the tree |
memoryops-ai |
A record with content and normalized_content,
embedding, importance, confidence, sensitivity, status, source, weight,
reinforcement count and revision |
Postgres with pgvector and row-level security, or an in-memory store for keyless local runs | Hybrid: a dense candidate search behind a recall gate, then BM25 over just the returned candidates — a few hundred rows, so no lexical index is needed — blended by configurable ranker weights, with tenant and user scope applied as database policy rather than as a query predicate | An admission gate decides save, drop, block or pending-approval; sensitive content is held rather than stored | Soft delete with deleted_at and a compaction pass;
supersession by revision; no value-keyed rejection |
tenant_id and user_id as transaction-local
Postgres GUCs enforced by RLS policies, described as defense in depth
beside the application check |
A FastAPI service, a published memoryops-sdk on PyPI, a
worker, a Next.js playground, and a hosted demo |
Loop runs and worker leases with their own tables; compaction of deleted records; extraction and eval harnesses | A discrete status including pending, plus
separate confidence, importance, sensitivity and reinforcement
count |
Tenancy enforced in the database behind a behavioural probe that fails closed once a database answers; a per-tenant tamper-evident audit chain; committed adversarial and isolation eval cases; and an external benchmark against Mem0 with an ablation twin whose published finding is that these probes do not distinguish the governed path from the ungoverned one | Deletion is record-keyed, so a re-asserted value returns as a new active record even though the normalized key that would stop it is already stored |
memoryos |
QA pair in short term; topic session segment in mid term; profile string and knowledge entry in long term | JSON files by default; a separate ChromaDB variant | Embedding similarity per tier, with mid-term segments ordered by a heat score whose third term is a constant in practice | Dialogue pairs appended; LLM segmentation into topic sessions; profile and knowledge updates | LFU eviction at capacity; bounded knowledge deques; profile merged by rewrite | user_id and assistant_id on the store |
PyPI package, MCP server, ChromaDB variant, playground | Segmentation, profile and knowledge updates on threshold; the heat
recomputation inside rebuild_heap is commented out, so
stored heat is never re-decayed |
None found — no source, actor, or status on a memory | A committed LoCoMo harness with its dataset, and an explicit promotion signal | Heat mixes two signals and a constant: three of its four call sites
overwrite last_visit_time immediately before measuring
decay from it, so R_recency is exactly 1.0; the LoCoMo
harness additionally uses different weights from the shipped library; a
second LFU counter can disagree with the heat |
memorywhale |
A lesson — a free-text label with a working directory, a creation time, the author's kind and name, the session it came from, an approval flag and a lifecycle status. Beside it sit the bulky evidence surfaces it was distilled from: command runs with their output and error fingerprint, session transcripts, and agent turns | One local SQLite database with an FTS5 index over commands and an
embeddings table, plus numbered PRAGMA user_version
migrations that add columns with constant defaults so a populated
database is never rewritten |
Full-text search over captured commands with prefix-expanded terms, a scorer with named reasons, and an optional embedding path | mw mark and mw remember record a lesson as
human; the MCP surface records one as agent with the client's name.
Every note-writing surface routes through one function, which applies
the capture gate before the database is opened |
Approval is a one-way flag a person sets. A lifecycle status retires a memory without removing it — expired by the sweep, stale by judgement, superseded in favour of a named replacement — while rejection from the review queue deletes the row outright. Bulk evidence is compacted rather than deleted, by a rulebook that names which rule fired | A project and a machine on the session. Both are narrowing
arguments: the query is (?1 IS NULL OR project = ?1), so a
caller that passes nothing gets no predicate |
A Rust CLI on crates.io, a Tauri desktop dashboard, a terminal UI, shell hooks that capture commands, an MCP surface for coding agents, and a sync path to MemPalace | None over memory. An expiry sweep and a compaction pass are commands | Provenance on every lesson — the author's kind, the author's name and the originating session — an approval gate that defaults to on for agent writes, a four-value lifecycle filtered in the same query, and a loader that refuses a schema in which review filtering could not be enforced | The review gate is decided at write time and enforced at read time,
and the seam between them is defended: a schema carrying the lifecycle
column without the approval column is rejected as unsupported rather
than quietly falling back to a weaker filter, because "no released
migration creates it". Provenance is structural — one function records a
human and a different one records an agent with its client name — so the
queue can be exactly the agent-written unapproved rows. The compaction
policy is a pure rulebook with its thresholds passed in, its rules in
evaluation order, and a named reason attached to every decision, opening
with the rule that matters most for a debugging memory: "Failures
outrank successes. A failed command or an errored run is exactly what
future-you will search for, so it is never auto-compacted." And the
migration comments say what each one does to an existing database,
noting that ADD COLUMN with a constant default never
rewrites rows |
The scope keys do not bind. Project and machine sit behind
(?1 IS NULL OR column = ?1), so a caller that supplies
nothing reads across every project on the machine — the boundary is the
caller's habit rather than the store's rule. Nothing records mutations:
fifteen tables and none of them a history, so an approval, a
supersession and a rejection leave the same trace, which is none, and
the rejected row is gone rather than tombstoned. Because rejection
deletes and nothing is keyed on the lesson's content, an agent that
proposed a lesson a person threw out can propose it again with nothing
in the store positioned to notice. And the review gate is a setting: it
defaults to on and is documented in the safe direction, but a single
line in config.toml or one environment variable makes every
agent lesson retrievable the moment it is written |
memos |
Textual item, graph tier, preference/skill, KV cache, LoRA | Configurable vector/graph stores, dumps, cache/model artifacts | Direct vector or graph + BM25 + rerank + reasoner; optional auxiliary memories | Reader extraction into a memory cube; scheduler transformations | Module-specific update/delete/soft-delete/dump semantics | User plus registered memory cube | MOS chat/runtime, APIs, CLI | Scheduler and activation-memory refresh | Source metadata varies by module; no uniform trust state | Treats memory as heterogeneous mountable resources | Umbrella API hides uneven guarantees and maturity |
mempalace-code |
A verbatim drawer: a structure-aware code or prose chunk, a manual note or a diary entry, with wing, room, language, symbol, heading, line range and source hash. Beside it, subject-predicate-object triples in SQLite with a validity window | One LanceDB table per palace with a 384-dimension FastEmbed MiniLM vector; a SQLite knowledge graph that the CLI keeps at a global path unless --palace is given and the MCP server always reads inside the palace | Vector nearest-neighbour with a SQL prefilter on wing, room, language and symbol type; optional token-overlap rerank and deterministic intent rerank over an overfetched pool; substring and glob post-filters; KG expansion of matched symbols filtered to current facts | Mining: per-file blake2b hash, structure-aware chunking, batch embed and add; the changed file's drawers are deleted first. Manual: mempalace_add_drawer after a 0.9 near-duplicate check, id from content prefix and wall-clock time; diary entries under a per-agent wing | No update verb. Mined drawers follow their source file: a changed file is deleted and re-added, a vanished file is swept under a provenance guard. Manual drawers are deleted by id or by wing. KG facts are closed by setting valid_to | Wing and room on every drawer, applied as a prefilter when the caller passes them; palaces are separate directories. The duplicate check and the knowledge graph are not scoped by wing | MCP stdio server with 29 tools in five static profiles; the packaged agent plugin registers the four-tool minimal profile with no delete. CLI, file watcher, Stop and PreCompact hook scripts, and a prose usage-rules block | Optional watcher re-mines on a 5-second debounce after a fail-closed pre-watch backup; post-mine optimize with an optional backup first; version cleanup and rollback on demand | None. No status or trust field on drawers or triples; KG confidence defaults to 1.0 and no MCP path sets it | Structure-aware chunks with symbol, language and line-range metadata; hash-gated incremental mining with a stale sweep that deletes only rows it can prove are regenerable; a minimal plugin profile that withholds destructive tools; release gates that pin the reviewed upstream commit | delete and get by id interpolate the id into SQL unescaped, so a crafted drawer_id to mempalace_delete_drawer can delete every row; CLI mine and MCP read different knowledge graphs by default; the duplicate check reads across wings; the changed-file delete lacks the stale sweep's guard; no mutation audit |
mempalace |
Verbatim drawer chunks, closets, and KG triples carrying a validity interval beside the instant they were extracted | Local Chroma default; sqlite_exact, Qdrant, pgvector; SQLite KG | Direct drawer vector search, BM25 rerank, closet boost, metadata filters, FTS fallback | Mine files/convos or MCP add drawer; deterministic IDs; chunk/upsert verbatim text | Delete/update drawers, bulk get and delete of up to 500 ids, delete
by source, dedup, repair, plan-then-apply room, wing and predicate
rewrites; in the graph, supersede closes the predecessor
and opens the successor at one shared instant so an as-of query at the
boundary returns only the successor |
Palace, wing, room, source file, parent drawer, backend namespace | MCP, CLI, hooks, skills, wake-up stack, and a remote hub one host owns while a fleet of agents connects over MCP | Mining, closet/hallway/tunnel computation, repair/sync/backup, and anti-entropy replication of the coordination log between palaces | Strong source provenance; weak candidate/verified/rejected trust state | Evidence-preserving raw baseline, hybrid retrieval, operational hardening | Raw stores get large/noisy; contradiction resolution mostly outside core recall; the write-ahead log misses mining and the CLI repair tools |
memsearch |
A markdown chunk in a daily journal, plus durable PROJECT.md and USER.md notes | Markdown as the source of truth; Milvus as a rebuildable shadow index | Three-layer recall — search, expand, transcript — with dense, BM25 and RRF reranking | Automatic capture per conversation turn, SHA-256 hashing to skip unchanged content | Compaction and maintenance passes over the durable notes; the markdown is editable | One .memsearch store per project directory; no scope key found on the read path | Plugins for Claude Code, OpenClaw, OpenCode and Codex CLI, plus a CLI and Python API | A file watcher indexing in real time; optional workflow mining and note maintenance | Nothing on a memory; skill candidates carry a candidate/installed distinction | Skill candidates are inert until installed, in their own git repository | Retrieval quality is evaluated only for the embedder choice, not for the pipeline |
memseek |
A record: workspace, entity, collection, optional key, type, status active or draft, JSON content carrying text, derived_from parent ids and a sequence number. Keyed collections version by key; event collections only append | One Postgres table named record, with a pgvector HNSW index and an English full-text GIN index, beside job, cursor, catalog, artifact_use and backfill tables. Turbopuffer is an optional disposable search projection | Named views over one shared scope predicate: text, vector, hybrid, recent and structured modes, multi-source reciprocal rank fusion, an optional LLM rerank of a bounded prefix, graph traversal over edge collections, and a canonical Postgres recheck of every candidate | Public ingest over HTTP, the SDK or one MCP ingest tool bound to a fixed collection. Background derivations run declared LLM tasks over bounded sources and emit cited drafts that commit only if schema, citation, budget and captured-head guards pass | No content update. A keyed write appends a successor, a retraction appends a keyed tombstone, and review-required emissions stay draft until promotion copies them active. Erase deletes a provenance closure and leaves a hash-only record | Workspace from the bearer key on every row and every read predicate; entity on every row, filtered when a view or caller names it. An MCP agent supplies the entity argument itself | HTTP API, async Python SDK, MCP over stdio or Streamable HTTP with a catalog-declared tool allowlist, and a Claude Code plugin with SessionStart, UserPromptSubmit, Stop, PreCompact and SessionEnd hooks | A Postgres job queue drained by a worker: enrichment and embeddings gate readiness, write and change triggers enqueue derivations with debounce, plus cron scans, retention purges and index upsert and delete jobs | Status active or draft; drafts are withheld by the default search, document, timeline and context predicates and become active only through promotion. A derived record may cite only ids its run was shown | Citations validated against a read receipt; a run record per commit with basis, divergence and model calls; promotion rechecks captured heads and refuses stale candidates; an explicit MCP allowlist whose one write kind is append-only; erasure follows provenance | One workspace key authorises every route including promote and erase; the MCP ingest bridge forwards status, derived_from and scores the tool schema omits; the flagship catalog's L1 supersession is a content array no read filters on; the predecessor edge chains a pipeline's runs into one erasure closure capped at 10,000 rows |
memsem |
A subject/predicate/object triple with importance, confidence, frequency, tags, theme, an archived flag, a trust level, a short evidence string and a validity interval | One SQLite file via node:sqlite, six versioned
migrations, plus history, edges, episodes, audit, candidate and
suppression tables |
Strict lexical by default over an FTS5 index with a
unicode61 tokenizer, ranked by
importance × confidence × recency × frequency and filtered
by validity interval; an opt-in relax mode adds cosine over JSON-stored
vectors and two-hop graph propagation |
memory_add is refused outright when the normalised
value carries a suppression; otherwise it upserts a triple, and a
differing object for the same subject and predicate fades every live
rival and records a contradicts edge |
Supersession by attenuation — pinned rows exempt, critical rows
floored above the archive threshold; a human rejection writes a durable
value-keyed suppression, and purge deletes the row and
cascades to its history and edges |
project filters every read path and holds even when a
theme is given, with crossProject: true required to cross
it; a focus list attenuates rather than excludes |
An MCP server with eighteen tools, an opencode plugin, and a CLI with list, edit, forget, purge and doctor | Session-end extraction, consolidation into patterns, and a
pairwise-comparison scoring pass — all sub-agents driven by prompts in
plugin.ts |
inferred / verbatim /
verified as a field, with verified reachable
only through memory_verify — itself an MCP tool, whose
evidence argument the agent supplies; a separate
pending/approved/rejected candidate status; plus importance, confidence,
frequency and a pinned flag |
A committed offline benchmark that reproduces exactly, an ablation over its own constants, an audit log carrying a reason and a dry-run flag, and a value-keyed write gate with committed adverse-case tests | Only a candidate rejection writes a suppression and
memory_candidate_review is an MCP tool, so the agent can
approve or reject its own candidates and mark its own memories verified;
automatic supersession writes no suppression, so a repeated value
returns and fades its own correction; import writes past
the gate |
memspec |
One markdown file with YAML frontmatter. A claim typed
fact, decision or procedure, or
an observation with a hard expiry. The frontmatter is the
schema spine: id (a ULID), kind,
type, state, created,
source and source_kind, tags,
scope, check_by, stale,
last_verified, verified_with,
pinned, anchors, probe, the six
typed edge lists, expires, valid_from,
valid_to, and an ext bag whose conventions are
documented in the type definition |
The markdown files under .memspec/ are canonical —
"lose the index, lose speed — not data" — with
memory/, observations/ and
archive/ directories and git as the history. A derived
SQLite FTS5 cache sits beside them, rebuilt when any source file's mtime
is newer, and dropped and recreated when its schema predates the running
version. A project store and a global ~/.memspec/ merge at
read time, project first, and a repository with no store of its own can
point at external stores through a .memspec.yaml |
FTS5 with BM25 weighted title ten, tags five, body one, over a
porter-stemmed index, with a four-step fallback — exact-AND, prefix-AND,
exact-OR, prefix-OR — so a multi-term natural-language query does not
return nothing because one term is absent. There is no second retrieval
mode: v0.11 deleted src/lib/embeddings.ts and its config
surface outright, and at the previous pin nothing under
src/ imported that module either, so the hybrid engine was
a scaffolding prompt and a config key rather than a code path. Optional
graph expansion follows the typed edges one or more hops, tagging each
neighbour with the expanded_via that surfaced it. Filters:
type, active scope, and an as-of validity instant |
remember for a claim, observe for a
point-in-time note, both CLI and MCP. A write refuses when an active
record of the same type already carries the same title, naming the
survivor rather than accepting a duplicate. anchor records
the git blob SHAs a claim depends on, probe records a shell
command and the sha256 of its output, relate and
unrelate manage typed edges. normalize →
distill → reduce turns raw harness transcripts
into weekly digests without the transcripts leaving the machine |
Nothing is edited in place to correct it: supersede
writes a new record, links the pair in both directions, and preserves
the reason on both. Passing check_by sets a
stale flag at read time and never deletes.
sweep is the only removal path, runs at a terminal only,
and either prompts a person per item or reads an answers file of
<id> <y|n> lines in which an unlisted id means
keep. Retired and superseded records move to archive/ and
out of the search index, reachable through the lineage chain or
--include-superseded |
Two mechanisms with different jobs. claims: routes
writes between stores by working directory, holding unclaimed content
local so nothing crosses a sync boundary by default.
scopes: partitions one store on the read path via a
scope field with three states — absent,
universal, or a name — applied inside the FTS SQL and as a
hard wall on graph expansion. An unknown scope name is an error, not an
empty result |
A fourteen-tool MCP server for Claude Code, Cursor and Codex, carrying no removal verb; a CLI with twenty-three commands; three Claude Code hooks — a session-start context injector that no-ops gracefully when no store is found, a claims check, and a consolidation pass. Generated agent addon text rather than a rewritten instruction file | No daemon. A dream pass reads the last N days of writes
and git log and asks a model for stale memories, supersede candidates,
verify candidates, missing relations and rules worth promoting — output
is review material, never applied. reconcile scans anchored
claims for drift including uncommitted edits. A local
usage.jsonl records retrieval hits and feeds a boot-context
recency boost; v0.11 adds outcomes.jsonl beside it —
append-only, gitignored, useful | dead_end | corrected
recorded after a memory was used — which never mutates the record and is
read only to compute the cold and promotion-candidate sections of
status |
A discrete lifecycle — active, superseded,
retired — that decides what search can see, plus a
verified_with witness ladder of anchor,
probe, operator, evidence,
assertion that annotates and never filters, and a
stale flag that warns and never withholds. Confidence as a
number was removed in v0.3 and replaced by the witness; the type
definition says so. A source tier of operator,
agent or import protects operator records from
being superseded or edited without an explicit override. The override is
clamped off for unrelate on the MCP channel in code; for
supersede it is a tool parameter the caller sets, so that
half of the protection is a convention rather than a boundary |
Anchoring a claim to the git blob SHAs of the files it is about, so
drift is detected against the code rather than against the calendar; a
scope predicate inside the query rather than over the page, with the
starvation case as a test whose comment records the mutation check;
refusing to traverse through an out-of-scope record because a
traversable-but-unreturnable one leaks the foreign graph's shape; an
unknown scope name that throws rather than under-retrieving silently;
removal reserved to the terminal and absent from the tool surface; a
write refused outright when scopes_require is set and no
scope resolves, rather than landing visible from everywhere; a ranking
normalization added in v0.11 with a comment saying which weight it still
ignores and why; a benchmark page that pins its datasets by sha256,
reports a saturated result as "continuity, not bragging
rights", and notes that an upstream file's hash changed since the
earlier runs |
The generated config still advertises
min_confidence: 0.7, threaded through
search.ts and the store into the FTS options where
fts.ts declares the field and never reads it — a leftover
from the confidence field v0.3 removed. The ranking block
beside it is half-fixed: v0.11 normalizes relevance per result set so
the relevance and recency ratios now actually move the order, and the
confidence weight is ignored with a comment saying so.
memspec_supersede hands the agent the
override_operator flag that memspec_unrelate
refuses it. Duplicate refusal keys on an exact title match within a
type, so the same claim in different words is accepted.
verified_with orders five witnesses by strength and no read
path uses the order. The benchmark samples twenty questions per dataset.
Three release tarballs are committed in the tree. And the whole design
assumes a person who runs reconcile, answers
sweep and reads the dream output — the mechanisms that keep
memory honest here are all operator-driven |
memtomem |
A chunk of a markdown file with heading hierarchy, a chunk type, a namespace, tags, a scope tier and project root, an optional validity window from frontmatter, an origin naming the writer when the consolidation policy produced it, a redaction count and a source span hash | Markdown files on disk as the authority, indexed into SQLite with FTS5 and sqlite-vec; the user tier under ~/.memtomem/memories, project tiers under the project, and read-only roots that memtomem indexes and never rewrites | Hybrid BM25 plus dense search with an always-on scope fragment, a namespace filter, a validity gate at an as-of instant or the current one, and an adjacency expansion that re-checks system prefixes, scope and validity before showing a neighbour; chunks of a missing source are held out of ranked search | mm add on the CLI and mem_add or mem_batch_add over MCP, both resolving a scope tier to a canonical directory and passing content through a redaction guard; folder indexing for existing markdown; a candidate queue that turns session events or external proposals into pending candidates, and approval writes through mem_add | Files are the source of truth and are edited directly; a missing source keeps its chunks hidden until it returns or is purged; consolidation applies a summary only to a virtual path it owns; export and import bundles carry an HMAC self-provenance marker | Three tiers, user, project_shared and project_local, resolved to directories, stored on the chunk with a project_root, and enforced as an always-on SQL fragment with the caller's filter layered on top as intent; mem_list, mem_consolidate and mem_export read every project | An MCP server also started as mm serve, a CLI, an HTTP API with a web dashboard, Claude Code plugins including opt-in prompt and write hooks, Kimi skills, an OpenCode integration, a Hermes plugin and a recall-only Hermes memory provider | Indexing, a file watcher, a scheduler, consolidation proposals and policies, entity extraction, session and maintenance-run pruning, and quality experiments with replay and gates | A credential-redaction guard at the write boundary with 19 secret-class patterns kept in sync with a sibling project, a two-gate consent record for writes into git-tracked directories, a candidate queue whose transitions are recorded with actor and reason, and an HMAC marker that distinguishes a self-export from a foreign bundle | A scope fragment that cannot come back empty on any retrieval path, with id-addressed reads answering an out-of-boundary id as a missing one; adjacency that re-checks visibility and only widens it; consolidation that refuses a summary path holding foreign chunks; documentation that states what each guarantee does not prove | mem_consolidate, reachable through mem_do in the default tool mode, returns previews and ids of every project's chunks, and mem_list names every project's files; the candidate queue's approve verb is on the agent's own tool surface with reviewer defaulting to user; a rejected candidate blocks only the same session's re-extraction; the git-tracked write consent is a boolean the agent sets; the self-export marker skips the redaction re-scan for bundles that may hold pre-guard rows |
memu |
RecallFile on a memory or skill track, sliced into
RecallFileSegment search units |
Pluggable repositories over SQLite, Postgres, or in-memory | Single-shot, LLM-free: segments ranked by embedding, rolled up to files by max score | commit_results writes recall files, resources and user
state in one call |
Segments dropped and recreated when a file is re-sliced; no supersession found | A configurable user-scope model merged into every record; the read
filter is an optional caller-supplied where, and the host
retrieve passes none |
Host adapters for Claude Code (with Cowork), Codex, Cursor, OpenClaw, Hermes, Cola, WorkBuddy, Pi | Scheduling module; agentic backend for richer flows; a client-event spool flushed on the bridging pair, never on the per-turn hook | Timestamps and track only; no source, actor, or status on a record | Ranking on segments and returning files, with local/remote ordering parity as an invariant | No trust state, provenance, correction path, or tombstone; opt-out telemetry on by default |
memv |
A semantic knowledge statement with valid_at, invalid_at and expired_at | SQLite or Postgres behind one storage layer, with vector and BM25 indexes | Vector similarity plus BM25 fused by reciprocal rank; expiry and an optional event time filtered after fusion | Predict what the episode should contain, then extract only the prediction's gaps | Supersession sets expired_at and, when the model names the old entry, superseded_by; delete is a hard DELETE | user_id is a predicate inside both index searches; the MCP tools take it as an optional argument | A Python library with an MCP server, a terminal dashboard, and pluggable LLM and embedding adapters | Extraction on process or flush, or as a background task at a message threshold; a LongMemEval harness with checkpointing and ablation presets | No status field; validity and expiry carry the epistemic weight instead | Extraction gated by prediction error, sourced only from the original messages | The prediction criterion is unmeasured; the one committed benchmark is a 30-question default-configuration baseline with no ablation run |
memvid |
Immutable frame; structured memory card keyed
entity:slot with a cardinality |
One .mv2 file — payload, internal WAL, TOC, footer,
lexical/vector/time indexes, no sidecars |
Lexical, vector and graph search over frames;
get_current and get_at_time per
entity:slot |
Append-only frames through a WAL; supersede links; enrichment recorded per engine and version | Active | Superseded | Deleted; supersedes/superseded_by
chains; a Tombstone WAL op |
ACL module over a single file; no multi-tenant model traced | Rust library and CLI over a portable file | Enrichment workers, maintenance, doctor | A three-value frame status whose demotion unlinks the frame from all three retrieval indexes, checksums per frame, and enrichment provenance by engine and version | Immutable frames plus as-of reads and session replay — the memory can be rewound | Headline benchmark numbers with no committed result artifacts found; correction is frame-keyed |
mengram |
A fact, an episode, or a versioned procedure with steps, triggers and preconditions | Postgres with a GIN index on procedure entities; versioned procedure rows | Multilingual hybrid search and rerank over facts, episodes and current procedures | Procedures evolve from failed episodes; a revision must pass the regression gate | A new version is promoted only if it breaks no dependent; otherwise quarantined | user_id and sub_user_id are arguments to every procedure read | Python and npm SDKs, an MCP server, an Obsidian plugin, a VS Code extension | Procedure evolution from episodes, with an evolution log recording each diff and refusals written to a quarantine file for a person | A regression gate decides is_current before promotion; the database carries two partial indexes on it, and needs_review records the reason beside it | A correction is tested against the other current procedures before it is applied, and one that breaks a dependent is quarantined rather than promoted | The quarantine queue is rendered but has no exit — no verb promotes or discards a gated revision, so it waits indefinitely once a person has read it |
mentedb |
A memory row with an embedding, a type, a salience and a confidence, carrying agent, user and space ids and an optional validity window | A purpose-built page store with a write-ahead log for crash recovery, an HNSW vector index and a BM25 index beside a graph crate | MQL, a query language with similarity, substring and set operators
over typed fields including Created for record time and
AS OF for validity, beside a hybrid HNSW and BM25 core that
the turn and injection paths call directly |
A turn is processed into extracted memories; a contradicting value closes the loser's validity window rather than deleting it | Supersession by closing valid_until and adding a
Supersedes edge; the row stays readable at an earlier
instant, and a bare MQL recall with no AS OF returns it
beside the live value |
agent_id and user_id on the row, compared
on every candidate by the hybrid recall core the turn and injection
paths use, with nil-owned rows shared; both ids are optional there, and
MQL recall and the server's recall and search routes take none.
space_id is stored and read by no retrieval path |
A Rust library with Python and TypeScript SDKs, a CLI, a server crate with REST, gRPC and WebSocket surfaces, and a replication crate | Consolidation, enrichment and entity linking run over the store; a WAL checkpoint underneath | A confidence score and a salience score, both continuous;
speculative ghost memories are tagged unconfirmed at write
and kept out of injection only; conflict resolution picks a strategy
rather than recording a state |
Two time axes that are both queryable fields, an AS OF test whose four negatives each sit beside a positive, and cross-user and cross-agent recall cases asserted against a populated store | Scope is an optional argument: None recalls every
owner, the server's recall and search routes pass none whatever the
token says, and MQL's Agent filter is never evaluated; a
bare MQL recall returns superseded rows |
mentisdb |
A Thought — a semantically typed record (one of 30 thought types across 8 roles) with content, confidence, importance, tags, concepts, typed relations, an index, a prev_hash and a SHA-256 hash; embeddings live in a separate vector sidecar | One append-only, hash-chained log per chain through a swappable StorageAdapter (only the length-prefixed bincode binary backend ships; JSONL is legacy read-only); vectors in sidecar files; a separate git-like skill registry | Multi-signal — BM25 lexical, cosine over local fastembed vectors, and personalized PageRank over the concept/relation graph, plus type/tag/time/confidence filters and chain traversal | Append a Thought; prev_hash links it to the last and its SHA-256 is computed over a canonical encoding; near-duplicate detection can auto-attach a Supersedes relation on append | No update, no delete, no hard forget — correction is an appended thought carrying a Supersedes/Corrects/Invalidates relation to a prior id; superseded ids are excluded from default reads and readable only with include_invalidated | A MemoryScope (user/session/agent) stored as a tag and filterable on read only when the caller opts in; not enforced by requester identity | A standalone daemon exposing an MCP tool surface (and REST + a web dashboard) over HTTP/HTTPS with optional bearer auth; harness config generators for Claude Code, Codex, Copilot, Cursor, Gemini and others | Append-time near-duplicate auto-supersession and vector-sidecar sync; integrity verification runs on open | confidence is an optional float and there is no discrete status field; the trust guarantee is integrity — every record is chained and re-hashed on load, and a tampered chain refuses to open | A genuinely append-only, sequenced, SHA-256 hash-chained thought log that is integrity-verified on open and refuses to load if tampered, with validity-time on relations and a signed, immutable, git-like skill registry | Tamper-evidence is detection not prevention, two record fields are excluded from the hash, thought signatures are stored but never verified (only skill signatures are), and scope is an opt-in tag rather than an enforced boundary |
merchantbench |
One Markdown document per agent per run, replaced whole, with every superseded version appended to a sibling history file | Two files on disk under the run directory; the twelve-table SQLite database holds world state and no memory | None. read_memory_doc returns the whole document; there
is no query, no ranking, and no index |
write_memory_doc overwrites the document synchronously,
capped at 256 KiB, deduplicated by an idempotency key of agent, step and
tool-call id |
Overwrite is the only update. No delete tool, no TTL, no supersession record; the previous text survives only in the history file the agent cannot read | Run and agent id, applied by deriving the file path; the tools expose no scope argument | 26 HTTP tools over an OpenAI-shaped /act endpoint, a
Python SDK, a ReAct baseline, a rule-based baseline, and a browser
playground for human participants |
None on the memory path. The simulator ticks hourly and activates the agent every twelve hours | None. The document is whatever the model last wrote; no provenance, no confidence, no status field, no verification | Memory failure is scored as money rather than as recall; the version history makes a wrong belief traceable to the turn that wrote it | One turn's warning before the context is cut, no re-injection afterwards, and a memory the agent must remember to read |
mercury-agent |
UserMemoryRecord graded on confidence, importance, and
durability |
A better-sqlite3 database with an FTS5 virtual table kept current by insert, update and delete triggers, plus people and relation records | FTS5 over summary and detail, with a LIKE fallback over
normalized terms; retrieval records lastUsedAt and
lastUsedQuery |
Candidates with narrowed evidenceKind;
evidenceCount on corroboration |
dismissed boolean and supersededBy; no
tombstone |
durable, active, subconscious
tiers; single user |
Internal, with a brain/Memory.tsx page offering
per-record edit and delete, and a /memory chat menu
carrying the shared-learning toggle |
A heartbeat that consolidates reflections and prunes — demoting rows
unseen for 30 days to subconscious, promoting corroborated
active rows to durable, hard-deleting
dismissed rows — and a cloud pull, an incremental fetch of
shareable=1, non-dismissed rows newer than a cursor |
Four-way evidenceKind, corroboration counts, free-text
provenance |
Durability separated from importance; a subconscious tier; a learning-pause switch | Stored scores only ratchet upward — a merge keeps the larger of
each, and no automatic path lowers one; dismissal is not durable; and
shareable ratchets the same way — a merge promotes a
private record, nothing demotes one |
meridian |
A capture frame — an app name, a window name, a timestamp and extracted text in exactly one of two columns, OCR or accessibility tree — rolled up by an ETL into sessions, a timeline, day tasks and worklogs | One SQLCipher-encrypted SQLite database on the machine, keyed with a raw 256-bit key rather than a passphrase, written by the tray's in-process capture engine and read by the daemon's ETL | Timeline and session queries over the rolled-up tables, a dashboard, and an MCP server that reads the database through a WebAssembly SQLite build | A capture engine in the tray writes one row per frame; an ignore list drops a frame before the write when its app name matches exactly or its focused URL matches a domain | A retention pass deletes capture frames below the ETL watermark and older than the cutoff, so nothing is pruned before it has been processed. Adding an app to the ignore list is forward-only and leaves existing history untouched, which the setting says in capitals | None. One user, one machine, one database; the ignore list is a write-time filter rather than a read predicate | A Tauri tray application with in-process capture, a Rust daemon, a dashboard, an OAuth crate for tracker integrations, and an MCP server package | Continuous screen capture with OCR and accessibility-tree extraction, an ETL that builds sessions and detects gaps, a retention prune, and a daily worklog draft | None on a frame. Extracted text is OCR or accessibility output with no confidence, no provenance beyond which of the two columns holds it, and no status | An ignore list enforced before the write with its semantics and its forward-only limit documented, and unit-tested in both polarities including the suffix trap a naive domain match would fail; a retention prune gated on the ETL watermark so nothing is deleted unprocessed; a raw-key SQLCipher setup with the reason for skipping key derivation stated correctly; and a cross-user collision in the export path found, explained and fixed | Two plaintext copies of the capture database persist with nothing in the tree deleting either — the timestamped backup the encryption migration leaves beside it, and the temp-directory snapshot the MCP reader exports on every read because its WebAssembly SQLite cannot open an encrypted file; the export passes the database key through a child process's environment; and the ignore list matches an app name exactly, so a renamed or differently-titled window of the same application is captured |
metaclaw |
MemoryUnit with type, status, importance, confidence,
access count, reinforcement score |
Store with embeddings, per-scope policies | Under a live MemoryPolicyState: mode, unit cap, token
budget, weights |
Conversation writes plus consolidation; no actor gate | superseded_by lineage and expires_at, with
garbage_collect hard-deleting any superseded row no active
row names in its forward supersedes list — which only the
merge path writes; no rejected state |
scope_id throughout store, retriever, policy,
metrics |
OpenClaw plugin with a written spec and a sidecar manager | Self-upgrade worker: candidate → replay → gate → promote | A three-value status filtered in the read query and
evicted from the full-text index by each of its nine writers, plus a
source session and turn range; reinforcement is kept apart from
confidence, and confidence itself defaults to 0.7 with no verification
path |
Retrieval policy replayed offline and promoted only on non-regression across eight metrics | Optimizes overlap proxies; gate thresholds are themselves defaults;
the memory package is vendored twice and the two copies have diverged,
store.py by 414 lines including an RLock that became a Lock
in the sidecar |
mettaclaw |
A triple of timestamp, atom and embedding — the atom's representation left to the agent, so several formats coexist in one AtomSpace | Chroma for the items, a SQLite kv table for the
promotion ledger, an append-only history.metta transcript,
and an exported persistent.metta AtomSpace |
Embed the query, over-fetch ten times the recall budget, then return a promotion-ranked slice appended to a distance-ranked slice, deduplicated and capped | Only when the agent calls (remember string). Nothing
extracts, and nothing writes on its behalf |
Neither. (demote time) decrements a promotion score
toward zero, which removes a memory's ranking advantage and leaves it
retrievable by similarity |
None. One collection, one agent, no scope key anywhere in the tree | A MeTTa agent core of about 200 lines on PeTTa, with skills for shell, files, web search, IRC and Mattermost, and Non-Axiomatic Logic available as a callable tool | None. Promotion decays as a function of elapsed time when it is read, not on a schedule | A promotion float in [0, 10] that decays as a power law of days since it was last set, rated by the agent itself | The reinforcement signal is a deliberate tool call rather than an inference from retrieval telemetry, and recall refuses to collapse two priors into one score | Every read and write goes through lib_chromadb, a
second repository pulled by git-import! with no tag or
commit, so the storage semantics are unpinned; the rater is the model
whose recall it improves, promotion is keyed on a timestamp so it moves
every memory written in that second, and there is not one test in the
repository |
mex |
A typed Wiki entity (decision, convention, pattern, component, fact, risk, spec and others) embedded in Markdown with an id, lifecycle, revision, relations, sources, provenance and code groundings; beside it free-text project notes in a JSONL log, Inbox proposals and Relay handoffs | Canonical Markdown and JSONL under .mex in the repository, shared by Git commit and push; per-checkout rebuildable SQLite indexes wiki.db (FTS5) and graph.db; drafts and identity under the ignored .mex/local | Agents read ROUTER.md and follow its routing table to whole context files; on demand, mex wiki query runs FTS5 per field with archived excluded and lifecycle and grounding health as tiebreakers, wiki related walks relations, for-code joins groundings to code nodes, timeline filters the note log by substring, file, type and date | Mostly direct Markdown edits by the agent under the GROW checklist; structured writes through wiki apply with a plan and an explicit apply flag; model synthesis proposes operation plans gated on its own confidence; Inbox approval materialises a proposal into a Wiki operation; mex log appends notes | Wiki operations update, set properties, supersede (old entity marked deprecated plus a supersedes relation) and archive (status only, body kept); there is no delete operation, so removal is a hand edit; notes are append-only | Physical: one .mex scaffold per repository and branch; no scope key on an entity and no scope predicate on a read. Relays carry recipients, used by an opt-in mine perspective and by the acknowledge check | CLI mex-agent with instruction anchors for Claude Code, Codex, Cursor, Windsurf, Copilot and OpenCode, Inbox and Relay skills, a loopback Hub web UI with session and CSRF protection, a post-commit drift hook, and an unpublished source-only MCP server | None scheduled for memory. mex check scores drift of paths, commands, dependencies, staleness and groundings; mex sync hands the drift brief to an interactive agent session; mex watch installs a post-commit drift check | Lifecycle in_flight, promoted, deprecated, archived; only archived is filtered and the rest rank. Grounding health fresh, changed, missing, ambiguous, unverified is derived per checkout and only lowers rank. Synthesis maps model confidence to promoted or in_flight | Code groundings with a MinHash identity fingerprint and a body hash, so a claim can be flagged when its code changes; a crash-safe two-phase operation ledger that never logs bodies; precondition hashes and re-planning on apply; lifecycle and grounding health kept on separate axes; bounded, truncation-reporting reads everywhere | The default write path, direct file edits, bypasses the operation layer and its ledger; the router file reads that agents actually use apply no lifecycle filter; deprecated entities are returned by default; the Inbox approve verb is on the same CLI the agent runs; model confidence alone chooses promoted |
mgi-mind |
Three kinds in one Qdrant instance: a memory chunk of up to 500 characters keyed by a UUIDv5 of library and content; a vectorless fact triple keyed by a UUIDv5 of subject, predicate and object with a lifecycle status; and procedures and skills stored as typed points in the memories collection | A local Qdrant the binary downloads and starts on loopback: a memories collection with dense and sparse vectors, a _kg_facts collection, a predicate registry and a procedure-stats side collection. Files under MGIMIND_HOME hold the audit log, session logs, pinned blocks, an access journal and an encrypted vault | Memories: dense multilingual-e5-base and a sparse term-frequency arm fused by RRF in one Qdrant query, then a bge-reranker-base cross-encoder over the top 20, filtered by optional library, author, source and date. Facts: full-text match on subject, predicate or object with the hidden statuses excluded. Procedures and skills: dense plus sparse over their own type | Explicit tools: mind_add writes directly; mind_ingest runs a secret scan, a cheap relevance gate, a token-novelty check and a near-duplicate check, routing rejects to quarantine; mind_fact add runs the duel rule under a per-axis and a cross-process lock. An optional local Qwen extractor is behind a cargo feature that is off by default | Memories: content-addressed upsert, delete by id, soft archive and restore, quarantine promote and expire. Facts: the duel marks a loser stale or superseded with valid_until; invalidate sets valid false; re-adding the same triple rewrites the whole payload, reviving an invalidated or stale value. No tombstone | A library key on every memory, applied as an optional caller filter on MCP and enforced only for library-scoped HTTP tokens, whose JSON recall still returns facts and procedures from outside the allowlist. Facts, procedures, skills and sessions are global | MCP over stdio, which the README counts at 29 live tools plus deprecated aliases; a loopback HTTP API with per-agent tokens and a library allowlist; a CLI; a loopback viewer with delete, edit and promote; a Python client. No host hook; AI_INSTRUCTIONS.md asks the model to call mind_session and mind_context at session start | Inside the warm MCP process an hourly, load-aware re-test loop recomputes confidence_score on up to 50 entrenched facts per tick and moves the doubt counter; access counts flush to a journal; consolidate, archive and prune are CLI-only | Fact status filters stale, superseded and quarantine_candidate from the fact query and the duel's rival set; memory quarantine is excluded from search; the doubt window ships in shadow mode and only reorders; the inheritance discount has no producer | One status-visibility function drives both the Rust gate and the Qdrant filter; per-axis plus cross-process locking around the fact duel; a falsifiable library-scope canary test with positive controls; audit lines chained by BLAKE3; benchmark figures that recompute exactly from committed per-question files | On the default path the duel flips any contradicted fact younger than about nine months, and re-adding an old value flips it back; JSON recall leaks global facts and procedures to a library-scoped token; the briefing admits quarantine_candidate facts; mind_history shows quarantined memories; the advertised bi-temporal model has one time axis |
midas |
A verbatim turn or statement with a kind, an importance 1-5, a provenance and an actor — never an LLM rewrite | One SQLite file, optionally encrypted, with an in-memory mirror refreshed off PRAGMA data_version | Dense plus BM25 with optional fusion, MMR, ColBERT and ANN, all local, plus recall(as_of=) over validity windows | Zero LLM calls at ingest; embed, stamp provenance and actor, and optionally supersede a contradicted belief | Typed belief revision through superseded_by plus a validity bound; forgetting returns a content-hashed erasure receipt | A namespace metadata key applied as a read-path predicate on every MCP tool, propagated into neighbour expansion | An MCP server, a Python library, a TypeScript port, hooks, a LangGraph store and a CLI | None required — no worker, no queue, no model to keep warm | A four-value provenance vocabulary that decides what a memory may authorize, not how likely it is to be true | A deterministic use-gate with a published attack-success rate and a benign-pass floor beside it | The gate believes the provenance stamp; the erasure receipt proves what was forgotten and cannot stop it returning |
mimir |
A node row with a kind — memory, doc chunk
or code symbol — carrying uid, content, a normalized
content hash, project id, JSON meta, deleted_at and
superseded_by, joined by a typed edge
table |
One SQLite database with FTS5 over node text, an
embedding table keyed by model and content hash, and
migrations; no server process required |
BM25 over FTS5 fused with local ONNX embeddings, scoped in SQL, with symbol and doc nodes searched in the same pass as memories | Explicit remember through CLI or MCP, plus indexing
passes for docs and code; a normalized content hash dedupes an exact
restatement before it lands |
forget soft-deletes with a deliberate tombstone that
refuses the same text or a rewording of it on every later
remember unless --force; edit
snapshots the prior wording into node_revision;
consolidation sets superseded_by rather than removing a
row; a hard delete purges the revisions too |
project_id on every node, composed into the query by
scope_sql, with the read-path index carved on
(kind, project_id) WHERE deleted_at IS NULL |
A globally registered MCP server, a CLI with brief/context/graph/rules subcommands, systemd units for a daemon and a watchdog, and session hooks | Consolidation, document and symbol indexing, embedding backfill, a
review scan for expired memories with unmet conditions;
recall_event, injection_log and
savings_event record what was retrieved and injected |
No state on content; an author confidence separate from usage, a grounding link that can be falsified, and a mutation ledger of who changed a memory, when and why, by hash | Committed eval fixtures carrying forbidden_ids
alongside expected hits, supersession as a stated invariant of the
consolidator, and a context guard that turns an impending window clear
into one structured handoff memory |
The review queue is a person's to open; the tombstone matcher scans the newest 500 deliberate deletions by reword and misses an older one; as-of recall ranks more lexically than present-tense recall because the vector cache holds live nodes only |
mind-mem |
A typed Markdown block with an ID header and Key: Value fields (decision, task, entity, incident, signal, dead end, task frame), carrying a Status and optional provenance fields such as ActorId, ActorRole and ContentSource | Plain Markdown files in a workspace directory by default, with an FTS5 index under .mind-mem-index, a JSONL evidence chain and a SQLite hash chain under memory; encrypted and Postgres block stores are opt-in | BM25F over FTS5 with optional vector, graph, knowledge-graph and entity-prefetch legs fused by RRF; each leg's candidates pass an admissibility allow-list before fusion; status boost 1.2 for active, and superseded blocks are served unless active_only is set | Doors are tiered: auto-capture and the dream cycle write pending signals, the inbox, importers and agent messages write quarantined blocks, and only applying an approved proposal writes an active block; the default governance mode detect_only refuses every apply | Proposal ops append_block, update_field, set_status, replace_range and supersede_decision, with snapshot, receipt and diff per apply and rollback by receipt; supersede sets Status superseded plus SupersededBy and Supersedes; delete is admin-scoped and keeps the deleted text in a recovery journal; no value-keyed tombstone | Directory namespaces, shared and one per agent, with a JSON ACL; an agent-bound recall filters indexed hits by source path, and an unbound stdio session reads every namespace | FastMCP server over stdio or HTTP (the README counts 107 tools), a REST API, the mm CLI, SessionStart and Stop hooks, and installers for Claude Code, Codex, Cursor, Gemini and others; retrieval is tool-mediated apart from a task-frame resume brief at session start | Stop hook runs regex capture over the daily log and optionally transcript capture; the integrity scanner stages revoke proposals for contradictions and dead decisions within a per-run and per-day budget; compaction archives resolved signals after 60 days | Admission tiers with an allow-list on status, a release decision to admit quarantined content, an admin-scoped approve verb, a contradiction check that can block an apply, and a hash-chained evidence record per admission | A write invariant enforced at the store seam and by a static test that fails on a new raw writer; withholding applied per leg before fusion so ranks do not leak withheld content; paired positive and negative retrieval tests; scope taken from the server environment or a verified token, never a tool argument | The governed path is Python while the store is editable Markdown, so an editor or an agent with file tools bypasses every gate; the approve verb reaches the agent under the documented Qwen config and through the apply_engine CLI; superseded decisions stay in default recall; valid-time edges have no record time; the deleted-text journal outlives deletion |
mind |
A named memory in a space: free-text content, at least one tag, a tier of 1 to 3, a pinned flag, an access count, directional labelled links and an optional embedding. Checkpoints and session summaries are memories told apart by tags | One SQLite file in WAL mode for every project and agent: spaces, memories, tags, links, an FTS5 porter index and a contentless trigram index synced by hand, and a logs table. Optional per-space Markdown mirrors under .mind/ when experimental autosync is enabled | memory_query fuses phrase, all-terms, any-term, trigram, fuzzy, LIKE and token-set channels, plus cosine over stored embeddings when RAG is on, into a weighted score with a high, medium or low bucket; it returns names, tags and tiers without content. memory_read fetches content and links and promotes the memory one tier | Explicit: the agent calls memory_add, memory_update, link_create and checkpoint_save through MCP, following an installed skill. Writes are synchronous with no model call; an embedding request follows the commit when RAG is on. A person writes through the CLI, the web app or autosync Markdown files | memory_update overwrites content and replaces the tag set in place. Supersession is a protocol: tag the old memory status:superseded and link the new one with contradicts. memory_delete and space_delete hard-delete with cascading links. Tier overflow demotes, it never deletes | A space name on every memory and a space predicate on every read that names one; the model picks the space per call, memory_query accepts '*' for every space, links and bare references resolve across spaces, and one database serves every project the agent opens | MCP over stdio or HTTP with 18 tools, a mind-management skill and protocol installed for Claude Code, Codex, OpenCode, Cursor and others by mind setup, an OpenCode plugin and an opt-in Claude Code Stop hook, a CLI and a local web app | None over memory content. Hourly log pruning, autosync file watchers when enabled, and an OpenCode plugin that writes a metadata-only session summary when a session is deleted | None enforced. status tags such as superseded, obsolete or failed are conventions in the protocol; every read returns the memory and shows its tags, and the space orientation previews include superseded rows | A computable tier rule with fixed caps and LRU demotion that never deletes; a fused lexical pipeline with confidence buckets that works without an API key; atomic checkpoint-to-summary completion that refuses pending work; a large test suite with scope, NOT and deletion negatives | The model can read every space with '*'; supersession is a tag no read honours; the log of mutations is pruned after seven days and clearable from the web app; the HTTP API has no authentication and binds Bun's default host; correction overwrites with no prior version |
mindcache |
One of four typed rows — user, knowledge, episodic, decision — each anchored to a node in a topic tree, with decisions additionally carrying a status | SQLAlchemy over SQLite by default with embeddings as blobs; Postgres
with pgvector when DATABASE_URL says so |
A collapsed-tree cache scored by a lemmatised inverted index and embedding cosine, then an active path through the tree; an optional cross-encoder rerank | An LLM extraction into a Pydantic schema with a reasoning step, denoised first, then anchored into the topic tree | Supersession by status, decided by an LLM over a semantic cluster of related decisions; no delete beyond a whole-user wipe | user_id on every memory table and applied on every
retrieval path, with _fetch_memories_batch refusing a
missing one; the ingestion-grounding read is scoped by an exception
rather than a filter |
A Python client plus an MCP server with five tools — add, process, search, inspect memories, inspect tree | Extraction runs as a job queue; the topic tree reorganizes itself, and a repair pass re-anchors detached memories at cache-build time | A five-value decision status — active, inactive, superseded, rejected, conditional — as a database enum, filtered to active and conditional on retrieval | The epistemic status is applied at every read path including the embedding fetch, so a superseded decision stops being retrievable rather than merely being labelled | Two benchmark badges over three committed eval files that carry no
score of any kind, a detached-memory repair that re-files by argmax with
no similarity floor, and an ingestion-grounding lookup whose scope fix
raises TypeError on every call into a handler that logs at
INFO |
mindmemos |
One Qdrant point per memory, content plus mem_type, validate_from, status and a content hash; in the schema algorithm each point is one timestamped value of an entity property | Qdrant for memories, entities, sources, add and search records and skills, with dense and BM25 sparse vectors; Neo4j mirrors Memory, Entity and Source nodes and their edges; Kafka carries async work | Hybrid dense plus BM25 fused by Qdrant RRF, one-hop Neo4j expansion re-filtered in Python, optional rerank, text dedup, and an optional token-budget packer; an agentic loop and a schema entity search are alternatives | LLM extraction from dialogue after recall of related memories, proposing ADD, REINFORCE, UPDATE, MERGE or SKIP through a deterministic gate; sync or async through Kafka; direct update and delete by id | Delete archives the point with a reason; add-path and API updates overwrite content in place; feedback updates and dreaming merges write a new point with DERIVED_FROM to an archived parent. No tombstone | project_id from the credential on every read; user_id, app_id and agent_id are request fields applied on search and add recall only when supplied | FastAPI HTTP API, a Python SDK and CLI, OpenClaw and DeepSeek Harness plugins that inject recalled memories before a turn and store the last turn after it, and an agent skill describing the CLI | Kafka workers for async add, schema episode drain, feedback, dreaming and skill evolution; dreaming runs only when requested | active or archived, filtered on every read; extraction confidence gates update and merge and is otherwise unused | Project isolation resolved from the credential and checked again at the store; a status predicate on every read including graph expansion; deterministic gating of model-proposed updates; lineage kept for feedback and dreaming corrections | Dreaming clusters and archives across users in a project; list and scroll ignore the user_id they accept; delete is soft and leaves the text in add records; low-confidence updates become duplicate facts |
mindreader |
An explicit relationship between stable entities —
project → uses → Neo4j — carrying layer memberships, a
spike classification, a weight, store validity and optional
world-validity bounds |
Neo4j, reached over Cypher, with a vocabulary of classes and properties kept global by construction | Lexical and label matching fused with semantic similarity and a bounded structural context, ranked by spike tier then weight then score | MCP tools only, and only what the agent deliberately decides to keep: "Mindreader never listens to conversations or extracts facts on its own" | Corrections coexist rather than overwrite; withdrawal and duplicate
merge soft-retire by setting validTo and pointing at the
survivor |
Layer memberships stored on nodes and edges, checked on subject, relationship and object in Cypher; an empty request scope sees the global layer only | An MCP server shipped as a Rust binary, a crate, an npm package, a Docker image and a bundled agent skill | None on the memory itself; merge and retirement are explicit operations with expected-row-count assertions | Provenance through Episode nodes per mutation, a spike classification of how well-founded a fact is, and supersession and contradiction edges kept out of search | Three things. The scope default is the first: "Empty
scope is global-only", so asking for no scope returns the
global layer rather than the entire graph — the inverse of the usual
arrangement, where an omitted scope argument quietly means everything,
and the failure it prevents is the one that produces a confident answer
from the wrong project. The second is that the visibility predicate is
applied to all three elements of an assertion and to the anchor beside
it, so a hidden endpoint cannot be reached through a visible edge. The
third is
assert!(!SEARCHABLE_RELATIONSHIPS.contains(&"SUPERSEDES"))
and the same for CONTRADICTS: the edges that record a
correction are barred from ordinary search by a committed test, so the
bookkeeping that says one fact replaced another can never itself come
back as content. Behind all of it is a thesis stated plainly —
"Mindreader gives AI agents a memory they must curate, not a history
they can search", with nothing captured secretly and nothing silently
overwritten |
SpikeRank is a ranking input rather than a status that
withholds, and the doc comment says so: "Epistemic fact classification
used in retrieval ranking (Knowledge highest)." A Signal —
the lowest tier, a lone unconfirmed observation — is ranked below a
Knowledge fact and returned all the same, so the epistemic
vocabulary sorts the answer rather than gating it, which is the same
shape the atlas found in OKF Agent Memory one report earlier. The
point-in-time path has a quieter consequence: because a fact enters an
$effectiveAt answer only when
effectiveQualified is true, and qualification is the
agent's choice at write time, an as-of query over a corpus where nobody
set those bounds returns nothing rather than the current state —
correct, and surprising, and worth knowing before relying on it. The
layer check is a visibility filter rather than an authorization
boundary: it is applied in Cypher against a caller-supplied union, with
no identity behind the request, so it separates contexts and does not
defend against one. And the durable store is a Neo4j server, which is a
heavier dependency than the single-file stores this family usually
ships |
minecontext |
A typed context with an event time, a confidence and an importance score, keeping its raw properties beneath it — plus todo rows with an open/done lifecycle | SQLite for structured rows, with ChromaDB or Qdrant for vectors | Vector search per context type, plus tool-shaped retrieval for todos, activity and entities | Passive capture from screenshots, folders, vault documents and web links, then LLM extraction and typed merge | Update and delete exist on the API and nothing in
frontend/src calls either; the only todo endpoints in the
tree sit under /api/debug/, and no rejected-value record is
kept |
None on contexts or todos; user_id appears only on the chat conversations table | An Electron desktop app over a FastAPI server, with generated daily and weekly reports | Continuous capture, typed merging, and a SmartTodoManager that generates commitments from observed activity | Integer confidence and importance scores on extracted data; no status and no provenance chain to the screenshot | Event time separate from record time and allowed to be future; raw properties retained under every extracted context | No test file anywhere in the tree; commitments are inferred from
screen capture, and the only endpoints that list, update or generate
them are under /api/debug/ and are called by nothing |
mini-agi |
An expert — one .npz file holding three weight matrices and their Adam moments. Below that there is no unit: what a conversation taught the model is a delta spread across the trunk and whichever experts were on the card | A directory of files — manifest.json, core.npz, routers.npz, optim.npz and one e00000.npz per expert. No database and no index over content | Each character ranks the whole pool with the router and asks for its top 8; a forward's first pass adds those requests to a vote over its whole text since position 0, and the forward may use the 32 most voted. It chooses which weights load, never which text comes back | One gradient step per 2,048 characters of whatever is being read, the model's own replies included. Inline and blocking; no queue, no extraction, no summarisation | No correction of any kind exists. Pruning deletes an expert file the router has not chosen inside the survival window, which is capacity reclamation rather than forgetting a fact | None. One model, one weights directory, one person — no user, session or tenant key appears anywhere in the tree | A Flask chat server bound to 127.0.0.1 that learns from every exchange unless told not to, and a CLI subcommand that reads a directory of files | None. Growth, pruning, checkpointing and the learning-rate controller all run inline on the reading loop | None. An expert carries born, last_seen and a gate; all three are usage lifecycle, and no read path asks whether anything is believed | The forgetting mitigation is measured, with the probe and every arm's raw scores committed and the losing arms published beside the winning one; pruning reads staleness, ignores admissions bought by exploration, and documents why the gate is anti-predictive; reading a book and serving a reply are one code path | Nothing learned can be named, corrected or deleted, and the file reader has no secret filter; the chat server persists into the weights by default while the CLI reader does not; a dry read writes trained expert files back once the pool is larger than the RAM cache; there is no test anywhere in the tree |
minta |
A ContextObject: id derived from the title slug plus four digits of the epoch, one of nine types, title, summary, body, tags, source, a four-value status and an integer confidence. Beside it, seven fixed text slots per user, and an inbox of pending, archived and discarded items | SQLite by default through SQLAlchemy, MySQL by URL; one Chroma collection for all users with user_id, type and status as vector metadata; Autopilot decision logs as JSONL files. The evaluation plane is a separate SQLite file of raw messages with float32 embeddings in a column | POST /api/search: Chroma cosine candidates scoped by user metadata, re-read from SQL with an owner and status predicate, re-ranked by 0.25 title-summary and 0.10 body token overlap. The MCP search tool is a substring match over the full owner list. Slot packs inject pinned slot text up to 3,500 characters | Explicit: minta_write_context stores an active object directly; minta_append_inbox and Autopilot postflight write pending inbox items from Chinese keyword triggers on the agent-supplied user message; confirming an inbox item creates an active lesson_learned object; a reflection route appends regex-matched sentences straight into slots | PATCH edits in place and toggles active and archived; DELETE removes the row and the vector. Discarded inbox items keep their text and nothing reads them. Slot overflow trims to the size limit, archiving entries only when the content has blank-line breaks | user_id on every row and vector, applied on search and list; NULL-owner rows are shared. Slot scope and the inferred project scope are stored or printed and never filtered | A stdio MCP server and an HTTP MCP transport exposing 13 tools, including confirm and discard for the inbox; an Autopilot preflight and postflight pair; a DeepSeek Harness preset; a CLI that registers editors. The hook scripts the CLI installs are not in the tree | A lifecycle scan of staleness, redundancy, fragmentation, conflict and empty fields that writes its suggestions to the inbox; the scheduler adds its job with next_run_time None, which APScheduler 3 treats as paused, so it runs only when POST /api/lifecycle/scan is called | A status enum of draft, active, stale and archived, and search returns active only by default. The one code path that writes stale, resolve_and_persist, has no caller; draft and stale arrive only from a client that sets them at create | A two-stage scoped search where the SQL join is authoritative over the vector index; a user export and delete that walks an explicit table inventory, the vector index, JSONL logs and the eval store, with a test per category; an evaluation plane with deterministic idempotent ingest and a strict-isolation test asserting exact equality | The agent can confirm its own inbox items; the conflict resolver and the bitemporal check are written and unwired; the scheduled scan is added paused; a confirmed lifecycle finding becomes a new memory instead of acting on its target; the HTTP MCP transport authenticates nothing and acts with the server's key; reflected slot text past the limit is cut from the tail and not archived |
mira |
A first-person memory row — text, a 768-dimension embedding, an
importance score in [0,1], created and updated stamps, an optional
expires_at and happens_at, access and mention
counts, inbound, outbound and entity links, an is_archived
flag with its timestamp, a last_tended_at, activity-day
snapshots taken at creation and last access, free annotations, and the
conversation segment it was extracted from |
Postgres with pgvector, row-level security on eleven tables and a
separate global_memories table outside it; Valkey beside
it, and a vault for secrets |
Hybrid vector and lexical search over the personal and global legs
UNIONed, ranked by a thirteen-step importance formula kept in
scoring_formula.sql as a single source of truth |
Conversation turns stay live while relevant; a segment collapses on an inactivity threshold and is distilled into first-person memories, with entity extraction, hub discovery and link typing following behind | Archival rather than deletion — the curator agent triages sampled low-value memories as archive or salvage, and every read filters archived rows out; entity merging consolidates duplicates | Postgres RLS keyed on app.current_user_id, with shared
material held in a separate table outside RLS and tagged
source='global' in results |
A FastAPI and Hypercorn service with its own clients and agents rather than an MCP surface; one conversation thread per user, with no way to start a new chat | A dispatcher running the curator on a use-day cadence, a memory floor trigger sampling untended memories, batch extraction, entity garbage collection and proactive recall | An importance score computed by SQL from access rate, hub position,
entity links, explicit mentions and a newness grace period, passed
through a sigmoid; decay counts the user's activity days so a fortnight
away does not degrade the store, while happens_at and
expires_at count calendar days because deadlines do not
pause |
Two clocks chosen per purpose — activity days for decay, calendar days for real-world deadlines — with the reasoning in the formula's header; a curating agent whose tool schema excludes memory creation so it cannot manufacture what it is meant to prune; and an isolation contract re-checked against the live catalogue on every boot instead of being asserted once in a test | No committed test exercises any memory behaviour — a
find for test files returns two, both about HTTP and URL
safety — so a thirteen-step scoring formula, a graph curator and a
collapse pipeline rest on a startup probe and manual use; there is no
audit or event table in the twenty-two-table schema, so nothing records
what happened to a memory; and archival is one-way, with no writer
anywhere returning an archived memory to circulation |
mirix |
Six typed rows — episodic event, semantic concept, procedural skill, resource, knowledge-vault secret, core block — plus raw_memory evidence, verbatim conversation messages, and distilled skill experiences | Postgres with pgvector, or SQLite with FTS5; Redis Stack as a search-capable cache | Per-type search by embedding, BM25/full-text or string match, selected by the caller | Deferred — messages accumulate, a meta agent routes them to specialist writer agents; sessions tagged task feed a skill-distillation pipeline instead | Tool-driven replace, implemented as hard delete followed by insert; no supersession record | organization_id, user_id, client_id and a filter_tags scope, applied on every read path including the cache | REST API, Python client, outbound MCP client, read-only React dashboard | auto_dream — a consolidation pass run through POST /memory/auto_dream, and in procedural mode on a session-count trigger — that loads up to 500 items per memory type and lets an agent merge and rewrite them | None represented; no status field, no confidence, no provenance beyond a free-text source string | Scope enforced across schema, queries, cache and the SQLite fallbacks, with tests on each; a raw evidence table; skill experiences carrying evidence, credibility and lineage | auto_dream can hard-delete a correction; credentials stored as plaintext in knowledge_vault; bulk erasure endpoints were unauthenticated until July 2026; last_modify is last-write-only |
mnemo-cortex |
A memory JSON with a sealed testimony and a mutable filing, beside a structured fact keyed on (entity, attribute) with a confidence rung and an evidence source | Per-tenant JSON memories and a ledger.jsonl chain, with
facts.sqlite and an append-only fact_history
shared globally in WAL mode |
Vector search with a lexical channel, and an explore mode that deliberately surfaces adjacent rather than best-match results | A classifier tiers incoming material, a bounded near-duplicate check runs before writeback, and a capture gate lets a user pause auto-capture during sensitive work | Memories are never deleted — demotion keeps the JSON, so a missing
sealed file is reported as news; a fact is demoted to false
and keeps its value |
A tenant per directory with scoped tokens pinned to one agent, enforced as a 403 on mismatch rather than as a predicate on a query | An HTTP server, a CLI, MCP bridges, and a USB courier that carries deltas between two full installations with no cloud | A nightly dreamer that synthesizes the day across agents and reclassifies filings | A discrete confidence ladder — false, high_probability, verified — excluded from the default read at its lowest rung | Sealing only the half that must not change; a ledger honest about being local evidence rather than proof; five verification states including one for records a broken chain cannot vouch for | false is the lowest rung of the ladder, so the
judgement that something is wrong is the one an ordinary
higher-confidence write can overwrite |
mnemo |
A memories row of at most 5,000 characters with category, tags, source, a context_type of six kinds, an importance float, an optional subject, and valid_from, valid_to and superseded_by columns; an LLM-extracted entity graph beside it | One SQLite file in WAL mode with an FTS5 index kept by triggers and a sqlite-vec table; one file for the shared default namespace and one per user under subs/ in multi-user mode | FTS5 BM25 in phrase, AND, OR tiers fused with sqlite-vec cosine by RRF, weighted with recency half-life, access frequency and importance, then a cross-encoder rerank; current, unarchived rows only | Explicit tool calls. add_memory inserts after a non-blocking duplicate warning; capture returns the existing id when word overlap with the top FTS hit reaches 0.92, and otherwise compresses the text through an LLM before inserting | Update closes the row with valid_to and superseded_by and inserts a successor under a new id; delete sets valid_to and removes the vector; import with mode replace hard-deletes every row. No tombstone | Physical in the MCP server: one SQLite file per authenticated namespace in multi mode, one shared file otherwise. The subject column and its predicate exist only on the CLI core's search and fetch, and an omitted subject reads everything | An HTTP MCP server with eleven granular memory tools, a deprecated composite memory tool and a config tool; a Claude Code plugin whose SessionStart hook prints a nudge; six skills; a mnemo CLI for capture, recall, reflect, fetch and standing pages | Fire-and-forget asyncio tasks per write score importance and extract entities; every hundredth capture triggers an archive sweep by age times one minus importance | None. Importance, context_type and archived_at rank or retire rows; nothing marks a memory unverified or rejected. The CLI core redacts secrets and emails on write and on read | Supersession in one UPDATE ... RETURNING guarded by valid_to IS NULL, with a race test that fails if the guard is removed; one column tuple shared by export, import and the schema; an embedding-identity stamp that refuses a model change rather than mixing vector spaces | The memory_audit table, the extracted supersedes list and the temporal_supersession settings have no consumer; delete leaves the text readable through history and export; capture can swallow a one-word correction as a duplicate; the plugin manifest launches a stdio server the entry point no longer provides |
mnemon |
An insight row — content, category, an importance of 1
to 5, tags, entities, a source label, an access count,
created_at beside a trigger-set stored_at,
last_accessed_at, a computed
effective_importance and a nullable deleted_at
— linked by typed edges restricted by a CHECK constraint to
temporal, semantic, causal and
entity |
One SQLite file per named store under
~/.mnemon/data/<name>, holding insights, edges and
the oplog, with an active file naming which store the CLI
opens. Optional embeddings are a BLOB column filled by a local Ollama
model; there is no vector database and no server |
Intent-adaptive beam search over the four graphs, following MAGMA:
the query is classified as why, when, entity or general, each intent
selecting its own beam width, depth and visited budget; anchors come
from keyword search and, when embeddings exist, cosine similarity;
candidates expand by BFS with structural and semantic weights of 1.0 and
0.4. A plain keyword path remains for search |
remember is one CLI call inside one SQLite transaction:
diff the new content against existing insights, soft-delete the one it
replaces when similarity crosses the bar, insert, embed if a local model
is configured, build temporal, semantic, causal and entity edges,
recompute this insight's effective importance, auto-prune if over
capacity, append the oplog row. Synchronous, immediately recallable, no
background worker |
Soft delete throughout — deleted_at set, edges removed,
every read path filtering deleted_at IS NULL. An update is
a replacement: the superseded row is soft-deleted and the oplog records
replaced by <new id>. Nothing is keyed on the value,
so the same sentence remembered again after a forget is a new live
insight |
Physical, not predicated. Named stores are separate SQLite files
selected by the active file; a store has no user, project
or tenant column and no read path carries a scope predicate |
A CLI first — remember, link,
recall, forget, gc,
show, log, receipt — with
structured JSON output, plus
mnemon setup --target <host> which installs a skill
file, hooks and prompts into OpenClaw, Cursor, NanoClaw, Zcode,
Qoderwork and others. The host's own LLM is the supervisor: importance,
links and forget decisions arrive as arguments the agent chose |
None in the memory path. Decay is a formula evaluated when something
recomputes it, auto-prune fires inline on a write over capacity, and the
corpus-wide recompute happens only when gc is invoked |
Provenance is a source string and the oplog; there is
no epistemic state. Importance is an integer the supervising LLM
assigns, and it drives ranking, an immunity rule and pruning order —
nothing distinguishes a memory held on record from one believed |
The deviations from the paper it implements are written down in a table — entity extraction, causal reasoning, node types, storage, embeddings and deployment, each with the paper's choice beside the implementation's — which is the rarest form of honesty in a system that cites research | Auto-prune orders by the stored effective_importance
column, and the only thing that recomputes that column across the corpus
is the agent-invoked gc; on a store where nothing runs
gc, the decay the design is built around never reaches the
automatic deletion path, which then drops rows by their scores as of the
day they were written |
mnemonic |
A markdown file with YAML frontmatter carrying a title, tags, a lifecycle of temporary or permanent, an optional role and importance, an alwaysLoad flag, a project id, and typed relationships to other notes | Plain markdown in two kinds of git-backed vault: a project vault in the repository's .mnemonic directory, committed with the code, and a main vault for global notes; embeddings and projections are gitignored; no database and no always-on service | Reciprocal rank fusion over semantic, lexical, graph-spreading, exact-identifier and full-text channels, plus bounded priors for project, role, recency and canonical notes; brief output shows a summary and the best-matching passage | remember, update, relate, consolidate, move_memory and forget, each producing a git commit in the vault it touched, with an optional push | forget deletes the file and strips inbound edges; consolidate merges notes in supersedes or delete mode and prune-superseded deletes notes marked superseded. A supersedes edge is stored on the superseded note, refreshes its updatedAt, and does not lower its recall rank | A project derived from the git remote of the caller-supplied cwd. With scope omitted, weak semantic matches from unassociated global notes are held back; an explicit scope of project, global or all is honoured as given, and the main vault is always searched | A local Node MCP server with a full and a core toolset, server instructions sent at initialize, and read-only document sources that index another repository's markdown alongside the notes | No daemon. Embeddings are backfilled lazily during recall; document sources are re-indexed by sync when the indexed commit or the extractor, chunker or embedding identity changes | A signal strength and a high, medium or low confidence computed from frontmatter role, lifecycle, recency and relationship count for display on each result; recall diagnostics that disclose suppression and widening | The recall tells you what it did not return. Alongside the ranked matches it reports suppressedGlobalCount, the weak global matches held back, and widenedScope, set when the gate lifted after the admitted pool came back empty, with the response text saying "weak global matches suppressed" in words. Both are asserted end to end, in both directions. A caller can tell nothing matched from something matched and was held back. Every weight, prior and threshold in the ranking and in the displayed confidence is a named constant, and compact evidence decomposes a final score into its channel ranks and priors. The notes stay plain markdown with YAML frontmatter, so uninstalling loses nothing | The scope argument runs opposite to the usual expectation: gateActive = scope === undefined && project !== undefined, under the comment "Explicit scopes run fully ungated." Omitting scope is the stricter path, the model chooses the scope and the cwd, and the main vault is in every search order, so this is a relevance heuristic and not a boundary. Supersession does not lower recall rank: writing the edge stamps the superseded note with a fresh updatedAt, the decay half-life it gets feeds only a prune suggestion in project_memory_summary, and the evidence line on a superseded note reads "supersedes 1 note", the inverse of its structured superseded flag. Nothing is epistemic: lifecycle is a retention genre, importance is a ranking prior, and confidence is computed after selection. The write record is git, which forget and delete-mode consolidation rewrite the working tree past. Screening flags a devcontainer, Copilot instructions and an OpenCode bundle as auto-run surfaces |
mnemopi |
A typed memory — one of fourteen types, each carrying a
veracity provenance class; a per-type Weibull decay table
exists and recall does not read it |
Bun SQLite, one database per named bank under
~/.hermes/mnemopi/data/banks/, with optional local ONNX
embeddings |
Polyphonic — four scored voices (vector, graph, fact, temporal) combined per memory, with MMR and an episodic graph beside them | Regex type patterns assign a type, a base confidence and one of nine priority classes with no model call; an LLM path is optional | forget(memoryId), update(...), and a
sleep(dryRun) consolidation pass that can be run without
applying anything |
Two layers. A bank is a separate database file selected by
setBank, and inside one, beam recall filters on stored
session_id, scope and channel_id
columns — unless the caller passes ignoreSessionScope, or
an author filter without a channel, which the MCP recall tool accepts
from the model |
The memory engine behind the oh-my-pi coding agent, with retain,
reflect, render and edit tools and a memory://
protocol |
sleep and sleepAllSessions consolidation,
plus SHMR clustering with similarity and harmony thresholds |
Veracity as a provenance class — stated, inferred, tool, imported, unknown — mapped to a fixed weight | A per-type Weibull decay table with a shape as well as a scale, as a design to wire; a dry-run consolidation pass, a triple store that supersedes by closing a validity interval, and 456 committed cases of which 158 assert an absence | unknown provenance is weighted 0.8, above
tool at 0.5 and inferred at 0.7, so a memory
with no known origin outranks one whose origin is known; the extraction
path writes triples with raw SQL and never reaches the only code that
closes a predecessor's interval, so self-derived facts never supersede;
memoria_facts declares a whole fact-versioning column set
that nothing in the repository writes or reads; and the Weibull table is
imported only by a test, so every type ages on one recency curve |
mnemora |
A memory with content, digest, a five-value status, a strength bounded at 1, occurred and recorded times, an optional validity window, an optional claim key, caller attributes, and a provenance that is a discriminated union | Postgres with pgvector, behind store interfaces a shared conformance kit tests; an outbox table carries background work, and a memory_events table records each status change | Similarity × decay × tag match × freshness × strength over vector and lexical candidates, gated by status, validity and decay, with contested companions pulled in, an association frame, a digest band, and a stored record of each recall | Observations in, LLM extraction to memories; creation is idempotent on observation, extractor version and content hash; an optional claim key marks a conflicting pair contested | Compare-and-set status transitions with an event per change; forget then purge, which overwrites content with a fixed string and keeps the row; a separate erase-tenant routine deletes every table's rows for one tenant | A required tenantId on every call, applied as a predicate on every read; an optional subjectId organises memories within a tenant. Both are opaque caller strings and nothing authenticates them | A library to sit beneath LangGraph, Mastra or a hand-written agent; adapters for OpenAI, Anthropic, a local embedding model and BullMQ; no tool surface of its own | Embedding, extraction, consolidation and reflection through an outbox drained by tick(), a decay archive sweep, and an event retention purge the operator runs | Provenance as a typed union checked at the store's write entry, a contested status that stays in recall with its companion, an event per status change with a caller-declared actor, and a strength ceiling | Provenance is the tag of a discriminated union,
stated | inferred | consolidated | reflected | imported,
and each arm names its own evidence: stated a source
observation and a time, inferred a model, a prompt version,
basis ids and a confidence. The store checks the arm at its write entry
and Postgres checks the kind and the source observation. A contested
memory is surfaced with its counterpart rather than resolved at write
time. Every multiplier in the ranking formula is bounded and the bound
exported, MAX_STRENGTH = 1 among them. Status transitions
are compare-and-set, and each writes a memory_events row
with the digest at the time |
The tenant is an opaque caller string with no existence check and no
authentication, so the isolation the read path enforces is only as good
as the application's choice of string. inferred provenance
records the model the caller configured, unknown when none,
not the model the provider ran. The event log is pruned by a per-tenant
retention setting and erased with the tenant, so it is not an audit log.
Forget is record-keyed: the same content in a new observation is
extracted as a new active memory. Background consolidation and
reflection run under the seed memory's subject, so a subjectless seed
gathers neighbours from the whole tenant. A forgotten, unpurged memory's
digest stays in earlier recall records |
mnemory |
A fact with a category, importance and memory type as a revision in a lineage in Qdrant — a revision state, a validation state and count, a fact hash, a source kind and fingerprint, evidence root ids — optionally pointing at a larger artifact held separately | Qdrant for vectors and for the _mnemory_operations
journal, S3 or MinIO for artifacts, stateless HTTP in front of both |
Multi-query semantic search with temporal awareness, a score threshold, an active-revision condition in the query, and a recall penalty applied to raw and superseded layers rather than an exclusion; a validation-aware slow decay when enabled | One LLM call extracts facts, classifies metadata and deduplicates against existing memories, resolving contradictions in the same pass; the dedup outcome is an ADD, a CONFIRM against an independent evidence root, an UPDATE that creates a successor revision, or a SKIP, and each is an operation in the journal | A revision model: an update is a successor revision with the
predecessor marked superseded, a delete is a
retract that keeps the content under a retracted state,
consolidation marks its inputs source; every transition
writes an operation record with actor, reason and fingerprints, guarded
by If-Match preconditions; a privacy delete erases a
lineage and its records; no record of a rejected value, and a retracted
fact can be re-added |
user_id as a must condition on every
Qdrant query, with a separate owner scope for shared memories, and a
per-user lease that serializes trusted semantic decisions |
An MCP server with sixteen tools plus a REST API with an OpenAPI spec, native plugins for ten-plus clients, a built-in management UI, and two signed-request routes for trusted user events and evidence that ordinary API keys cannot use | A three-phase consistency check runnable on a schedule with auto-fix, journaled per action and recoverable after a partial apply; consolidation into layers; TTL expiry; slow decay with a longer half-life for confirmed memories | revision_state — active, superseded, source, retracted,
aborted — filtered to active on every read;
validation_state unverified or confirmed with a bounded
count of independent evidence roots, used to extend TTL and slow decay
and never as a filter; an importance score; a source kind on every
revision |
The consistency check screens for injection with a regex before any LLM reads the memory and re-screens what was already stored; every mutation since September 2026 leaves an operation record and a lineage history a client can read; a retracted memory keeps its content; fsck actions are checkpointed and resumable | A superseded memory is penalised in ranking rather than excluded, so a corrected fact can still be returned; a retracted fact carries no bar on re-assertion; the journal is a per-operation checkpoint updated in place, not appended rows, and a privacy erase removes it; provenance and confirmation reach only the two signed routes, so an ordinary API-key write starts unverified and stays so; fsck's own accuracy is unmeasured |
mnemos |
A chunk of a markdown or source file, addressed as uri, heading path and line range; a document may name its replacement in superseded_by, and a journal document holds one captured session turn | Markdown files under the workspace kb root, or external trees registered and indexed in place read-only, with a SQLite index (FTS5, optional vectors) from one cgo-free Go binary | BM25 over chunks with a heading boost, optional recency decay and a 0.25 multiplier on superseded documents; journal documents and deny-listed collections are filtered out. Hybrid vector search and 1-hop link expansion are opt-in | Ingest or add a directory, remember a note, okfy a file, or capture each session turn into the journal from a Stop hook; file content is secret-scanned before indexing while exclude_secrets is on, the default | Edit the file and re-ingest; a directory ingest or reindex evicts documents whose file is gone; forget and move are MCP tools behind allow_delete; reviewed journal entries are pruned by age from the CLI | A collection key on every document, filtered only when the caller passes one; projects are separated by resolving a per-project database, and an operator deny list hides whole collections from every read | An MCP server and a CLI in one binary, a Claude Code skill, and three hooks: a session-start working set, prompt-time recall and per-turn journal capture | None required; an optional watcher reindexes on file changes and reconciles deletions | No epistemic state. A superseded_by pointer demotes a document and travels with the hit; a journal entry's promoted_to is its review state, written by the agent's own tool | A held-out retrieval eval that strips each query from its host chunk, parses with the ingest configuration and runs in an ephemeral database; a secret scanner whose finding cannot serialise the matched value; a server-side collection deny list with must-not-surface tests on search, context, list and read | The collection filter is a model argument that, omitted, searches every collection, and read by uri takes no collection, so nothing confines a reader to one partition. Supersession demotes on the lexical and graph paths while the vector arm reads no superseded_by. The ingested-event rows cascade away with their document. The versioned baseline the eval compares against is not committed |
mnemosyne-nabzx |
One node: a caller-chosen string id, any JSON content, five optional provenance strings and an optional event_time. Immutable and content-addressed, so an update is a new object under the same id | One redb file per store directory, .mnem/store.redb, holding objects, refs, staging, staged deletions and a derived change index; HEAD and config are text files beside it | None by relevance. recall returns one node by exact id or the whole working memory; recall_at reads any past commit; the LangGraph adapter adds a namespace-prefix and substring filter | Explicit. Every MCP remember, revise, remember_many or forget is a stage and a commit: a new state snapshot and a commit object, synchronous, the branch moved by compare-and-swap | Update writes a new node object under the same id. forget stages a deletion that the next commit applies, and every past state keeps the node. No hard delete, no garbage collection, no tombstone on a value | Physical: one .mnem store per directory, chosen by path or MNEM_STORE. Branches are named pointers, not row keys. The LangGraph adapter encodes namespaces as a colon-joined id prefix with no validation | MCP server with ten core tools and three harness tools behind a flag, a LangGraph BaseStore, an OpenAI Agents SDK Session, a Python SDK and the mnem CLI. No automatic injection | None. No model calls, no network, no compaction; the change index is rebuilt only on import or on request | None. Every node in HEAD's state is equally current. A semantic-merge seam can return a Contradiction verdict that nothing persists and a blanket strategy overrides | Append-only content-addressed history with the exact state at any commit; blame through merges to the introducing commit and its provenance; bisect over a first-parent chain; deterministic three-way merge that returns conflicts instead of guessing; import re-hashes every object | forget is not erasure, and recall_at hands forgotten memories back to the agent; a failed commit leaves a staged node that recall serves; namespace and session ids are joined with an unvalidated colon, so one scope can read or clear another; the README calls a 50,000-case fuzz CI-gated while CI runs 600 |
mnemosyne |
A working-memory row that ages into an episodic row, plus extracted subject-predicate-object facts consolidated into a separate table keyed by the hash of the triple | One SQLite file at
~/.hermes/mnemosyne/data/mnemosyne.db, with sqlite-vec and
FTS5 virtual tables, optional int8 or bit vector quantization, and
per-bank database files for isolation |
Hybrid 0.5 vector plus 0.3 FTS5 plus 0.2 importance, or a four-voice polyphonic path fused by RRF with k=60, then multiplied by veracity and tier weights | Fully synchronous — insert, commit, embed, regex-extract and consolidate all on the caller's thread; no queue and no worker | invalidate sets valid_until and
superseded_by; read paths filter both; a superseded
extracted fact cannot be re-asserted because the dedup lookup finds the
tombstoned row |
session_id with a scope = 'global' escape,
applied as a WHERE clause on every read, and separate SQLite files per
named bank |
Forty MCP tool schemas, a Python SDK, a CLI, an OpenWebUI bridge, an OpenClaw provider and a first-party Hermes Agent plugin | sleep consolidation is additive and manual; SHMR
clustering and persona promotion run on demand; the tiered-degradation
compressor has no caller |
Two independent fields — veracity as a five-value
provenance class with a scoring weight, and trust_tier as a
four-value injection-defense class that nothing reads |
A rejected fact is pinned by the hash of its own value and cannot return; consolidation is additive rather than destructive; committed regression tests assert what must not be recalled | unknown provenance is weighted 0.8, above
tool at 0.5, and an unrecognized source maps to
STATED, the highest trust tier, under a comment calling
that the conservative default |
mnesio |
A memory node in a property graph carrying scope, tags, keywords, a
source reference, an evolution count and two time intervals; beside it a
versioned PolicyArtifact — a system prompt, heuristic or
retrieval rule — produced from batches of outcomes |
A single append-only event log with the graph and indexes as projections over it, rebuildable by replay | Lexical, vector and graph traversal, every step taking a scope and an optional instant | Memories written directly; policy artifacts proposed by a reflective loop — reflect, propose K candidates, shadow-evaluate, Pareto-select — and committed only through the gate | Evolution invalidates the previous version and emits a new one rather than rewriting; erasure is crypto-shredding through a keyring, and a redaction pass covers structured secrets | Scope stored inline on each node and required as a
parameter by every traversal step, re-resolved at each hop |
An HTTP service, an MCP server, Python bindings and a Node SDK, plus
a mnesio-code CLI that maps a codebase without a
server |
A bounded async worker that retroactively re-tags and re-links related memories on write, and a procedural compiler that batches outcomes into candidate policies | A three-condition baseline gate no configuration can relax, shadow evaluation before activation, canaries, a safety probe, and an objective delta that must not be negative | The gate is the thing, and what makes it worth reading is that it is
defined as a floor rather than as a policy.
EvalReport::is_committable() is three conjoined conditions
— every canary passed, the safety probe passed, and the objective delta
at or above zero — and the README's claim about it is the unusual part:
"setting every configurable gate threshold to its weakest value
still cannot bypass the baseline." That is not left as prose.
fully_relaxed_gates_still_reject_baseline_failure_through_pipeline
runs the whole compile pipeline with the gates relaxed and asserts the
rejection anyway, beside unit tests that trip each of the three
conditions in isolation with a message naming which invariant broke.
Most systems this atlas reads have an escape hatch that a configuration
can widen until it admits anything; this one has a floor underneath the
configuration, and a test standing on it. The bitemporal design is the
second piece: two intervals per node with is_live_at
requiring both, justified by a concrete failure — "[a] flat 'current'
graph would lose that lineage the moment the worker fires" — and tied to
a replay invariant the view layer also enforces |
The procedural loop is the product and its honesty depends on the
evaluation behind the gate: canaries, a safety probe and an objective
delta are only as good as the cases and the objective somebody wrote,
and nothing in the repository pins those to a corpus the way the gate
itself is pinned by a test. Erasure is crypto-shredding through a
keyring, which makes a payload unrecoverable and leaves the graph's
structure — nodes, edges, intervals, evolution counts — in place, and
nothing is keyed on a shredded value, so the same content can be written
again with no record that it was once erased. There is no person
anywhere in the loop: is_committable is a mechanical floor
rather than an approval, and a policy artifact that clears it activates
without anyone reading it. And the repository is early — the README
notes that the documented install line "starts working at v0.1.1"
because "v0.1.0 predates it and carries no binaries", which is a candid
disclosure and also a statement about maturity |
mnestic |
A tuple in a stored relation, keyed on its user columns followed by
up to two trailing temporal columns — a user-settable
Validity carrying a microsecond timestamp and an
assert/retract flag, and an engine-assigned TxTime |
The CozoDB storage engines, unchanged in shape: in-memory, SQLite, RocksDB and TiKV behind one memcmp-ordered key encoding, with the temporal axes as the trailing key components so versions of one logical key are contiguous and newest-first | Datalog. Relational scans with @ (vt: V, tt: T) as-of
selection or a query-wide :as_of, HNSW vector search,
full-text search with BM25, and graph algorithms over the same
relations |
:put appends; a retraction is a new row with the assert
flag cleared, not a delete. Writes to a transaction-time relation are
buffered per statement and stamped with one transaction time at commit,
so every row of a transaction shares its belief timestamp |
Corrections are new rows at a higher transaction time — a value
correction re-asserts at the same valid time, a cessation writes a
retraction, and an existence repudiation is done by copying the
predecessor's value, a limit the spec states rather than hides.
::evict is the one operation that removes history, and it
writes an audit row in the same transaction |
None in the engine. This is a database; tenancy belongs to whatever is built on it | Embedded in Rust, with bindings for C, Java, Node.js, Python, Swift and WebAssembly, a standalone server binary, and Python integrations for LangChain, LangGraph, LlamaIndex and MCP | Index maintenance, non-blocking HNSW build, graph projection freshness with a commit fence, and a history garbage collector that preserves the latest belief per key and valid time | No epistemic status field. The assert/retract flag is a valid-time statement about the world rather than about belief, and the belief dimension is the transaction-time axis itself | A second temporal axis the caller cannot set, refused with its own
error; a commit clock whose high-water mark is persisted inside the
committing transaction, so a crash cannot leave it behind;
:create-time validation of the temporal columns where
upstream had none; a spec directory of twenty-two contracts, one of
which is pinned by a test that validates the document against the
source; and a changelog that attributes an inherited corruption to
upstream site by site rather than claiming or dodging it |
Two doc comments still say nothing calls the transaction-time commit
path in production, while commit_tx_inner routes every
qualifying commit through it; the repudiation-by-copy idiom is a
snapshot rather than a reference, so a later correction of the copied
predecessor does not propagate, which the spec states and does not fix;
a transaction may not both assert and retract one key, an error the
caller has to split around; and four Python integration packages declare
dependencies with no lockfile beside them |
mobius |
A markdown file with name and description
frontmatter and a free-text body — the same format skills use, through
the same parser |
<CORE_DATA_PATH>/memories/user=<userId>/{default_project|project=<projectId>}/<slug>.md;
SQLite holds the platform around it — users, projects, issues, messages,
ACLs — but no memory table |
None. Every memory in scope is rendered into the session context
wholesale by session-context.ts, built-ins first; there is
no search, ranking or selection |
Human CRUD through auth-gated HTTP routes, plus one side door —
.imac/project_knowledge.md in the project's repository is
synced into a fixed-slug project memory on every project-scope read |
Full CRUD plus copy and move between scopes. The project-knowledge
sync retains 30 timestamped .bak.md versions; every other
memory is overwritten in place with no history |
The scope key is the directory path — user=<id>
and project=<id> segments — resolved from a
reversible id and validated to stay inside the root, with a separate
visibility filter over the platform-wide copy catalog |
A web platform driving Claude Code and Codex through tmux; memory reaches the agent only as injected context, and no agent-facing tool reads or writes it | None on a timer. syncProjectKnowledgeForProjectId fires
on every project-scope memory read, so the write is triggered by a
read |
No epistemic state, no confidence, no provenance and no timestamp in the file format — a memory is a name, a description and a body | Memory and skills share one on-disk format and one parser, so the editing surface, the import path and the scope model are written once | Scope is a path segment composed from a caller-supplied id, and the containment check that makes that safe was added to the read path after the write and delete paths already had it |
moltbrain |
An observation typed decision, bugfix, feature, refactor, discovery or change | SQLite for observations, summaries, sessions and prompts; ChromaDB for vectors | Semantic search over the Chroma mirror, plus project- and type-filtered SQL listings | XML blocks emitted by the agent, parsed into typed observations and structured summaries | None on the write path; a standalone cleanup-duplicates script deletes by id | project is an indexed column and a WHERE clause on the observation read paths | A Claude Code plugin, MCP tools, a web viewer on :37777, OpenClaw and Virtuals plugins | ChromaSync mirroring SQLite into the vector store, fail-fast by design | Nothing — no confidence, no status, no supersession, no provenance beyond the session | A fixed-field session summary the model fills in rather than free-text prose | Observations accumulate with no correction path; a wrong one is permanent until scripted away |
moltis |
Chunk of a Markdown file | Markdown files as the source of truth, indexed into one SQLite database with FTS5 and embedding blobs, or into zvec collections with a redb cache, or handed to the external qmd CLI | FTS5 plus a brute-force cosine scan fused by reciprocal rank or a weighted sum; the agent's tools post-filter to its workspace, the per-turn prefetch does not | Agent save, delete and forget tools, three model extraction turns, a raw session-log hook on new or reset, and hand edits, all reindexed by sync_path or a periodic sync | Delete exact text or the file and reindex; agent-initiated writes first copy the prior file into a restorable checkpoint | Agent tools filter results by the agent's workspace path; the default-on prompt prefetch searches every agent's files | In-process crates inside the Moltis gateway: agent tools, a prompt prefetch, and MEMORY.md injected into the system prompt | File watcher, a full resync every 15 minutes, a model extraction turn every 5 turns | A longterm or daily label derived from the filename; citations to path and line | Every agent-initiated memory write snapshots the prior file first; keyword_only() makes a no-embeddings mode constructible and inspectable | Prefetch ignores the agent scope and indexes every agent's persona files; session logs are raw while a sanitizer sits unwired; transcripts and curated notes rank identically |
monet |
A concept (slug, title, body, kind, status, confidence, circle, embedding) with attached observations as evidence; the marketed principle/rule/correction trio are values of concepts.kind plus a rule-to-stage binding | One local SQLite file at ~/.monet (better-sqlite3, WAL) with ~30 tables; on-device ONNX embeddings; only better-sqlite3, zod and the MCP SDK as runtime deps | Principles always injected as a standing skeleton; rules pulled at a named stage; facts by hybrid on-device vector plus lexical-overlap ranking returning pointer cards then a fetch | memory_store proposes a concept/observation; memory_declare (human-only) writes a principle or a blocking rule; a correction attaches as an observation opening a contradiction that flips the concept to disputed | safeUpdate-style supersession — the losing observation is marked superseded_at and excluded from ranking; memory_resolve mediates a contradiction (accept-new / keep-current / dismiss); retire/restore lifecycle with a content-free concept_tombstones sync event | A circle (project scope) on nearly every table, filtered on read and enforced with explicit refusals in memory_resolve; cross-circle exclusion is tested; rules also carry a per-model tag | An MCP server (~20 tools) plus a with-monet harness of agent roles; a standing skeleton materialized to a file and auto-prewarmed into the first tool response | Contradiction detection and resolution, near-duplicate handling on write, embedding on-device; the RAG source-ingestion subsystem was removed, leaving a retirement module in its place | concepts.status (active/disputed) plus a confidence float, consumed on read — disputed principles are dropped from the skeleton and only active rules are delivered at a stage | Genuinely local-first with on-device hybrid retrieval, real circle-scoped reads, human-in-the-loop declare/ratify/resolve governance, and append-only resolution and gate event logs | The headline mechanisms are softer than the prose — moments are lexical token-matches on user-authored stages and the shipped harness relies on the agent pulling rules, and corrections are supersession (retrieve-the-winner) rather than a value-keyed tombstone that prevents recurrence |
moth-memory-template |
One Markdown file holding one fact: name, a one-line
description written in the words you would search with,
metadata.type of user, feedback, project or reference, then
the fact and its why-and-how |
A directory of .md files. No index, no service, no
database — the walker reads the tree on every query |
Shipped: word-boundary term matching over name, description and
body, weighted 4 / 3 / capped-at-4, times the square of query coverage.
Specified in BUILD_PROMPTS.md and measured there: a
persistent index, chunking, RRF fusion, a SPLADE sparse tier, a dense
embedding tier and a cross-encoder rerank — the last two measured and
the rerank rejected |
A person or an agent writes the file. findable.py is
asked first — will this be found, and will it win — and
memory_echo.py shows the nearest existing memories before a
new one is added |
Editing or deleting the file. The reinforce / supersede / archive lifecycle is stage 10 of the build prompts, not code in this repository | None. --root selects a directory; nothing is stored on
a record that a query filters by |
A paste-in prompt block in docs/AGENT_INSTRUCTIONS.md,
and command-line tools an agent shells out to |
None | None. metadata.type is a kind, not a status, and the
candidate queue carries no verdict |
A findability gate applied at write time, a benchmark whose three sections are never summed, and a coverage tool that says out loud that addressed is not implemented | Six of twenty-one architecture boxes ship code; the write gate now models a ranker that changed underneath it; and the README's stated field weights are not the ones in the scorer |
munder-difflin |
A dated ## <date> — <title> section inside
one memory.md per agent, in a three-region file: pinned
durable facts, one rolling recursive summary, and the newest K verbatim
sections |
Plain markdown under
<harnessHome>/hive/agents/<id>/, beside an
inbox, an outbox, a cursor and a settings file; the hive keeps an
append-only log.jsonl and a registry |
The agent reads its own memory.md. Semantic recall
across the team is delegated to the MemPalace CLI over a shared palace,
and degrades silently to nothing when that binary is absent. A third,
opt-in tier searches an organisation-supplied document store by
keyword |
The agent writes its own markdown under a prompt — read your memory.md and drain every message in your inbox. A miner re-indexes the file into MemPalace when its mtime changes | No delete and no correction of a claim. The only rewrite is condensation: a timer finds oversized files and replaces the tail with a model-written summary, behind a backup, a six-check verification and an atomic swap | Deliberately absent between agents. One palace is shared so the whole team can recall by meaning, and the text fallback searches every agent`s memory.md including archived ones | An Electron desktop app wrapping terminal coding CLIs — Claude Code, Codex, Gemini, Grok, Kimi, Qwen, OpenCode and others — with an inbox/outbox message bus and a read-only memory graph | An in-process timer condensing oversized memory files, and a miner re-indexing changed files into MemPalace. Both live in the Electron main process because launchd-spawned shells are denied the folder grant on macOS | None. A pinned region is protected from condensation, which is a retention property rather than an epistemic one; nothing withholds a memory from being read | A verification gate over a model-written rewrite that names six failure modes, requires the kept sections to round-trip byte-for-byte, treats a no-op condense as a failure, and leaves the original untouched whenever any check fails | The condensation gate is exported, pure and unexercised — 124 test
files sit in test/, one of them loads
reflect.ts for its reply parser, and none calls
verify() or parseMemory; nothing runs the
suite on the way in because CI typechecks and builds without it;
semantic recall belongs to a separate project and vanishes silently when
it is not installed; and nothing records a correction, so a wrong line
survives until a model summarises it away |
muninn |
A memories row — the raw exchange, a one-sentence
summary, tags, a tsvector, a 384-dim embedding, a scope of
personal or shared, and the message it came from; separately a
wiki_proposals row holding a full drafted page and its
status |
One Postgres database with pgvector and an HNSW index, 75 migration files, plus a Markdown wiki on disk that the gardener and agent sessions write | Reciprocal-rank fusion in one SQL statement — an FTS CTE and a vector CTE, each limited to 30, joined FULL OUTER and scored 1/(60+rank) per arm | A background Haiku call per exchange decides worth_remembering and returns summary, tags and scope; the memory is embedded and inserted without a gate. A wiki Remember button distils a Q&A turn into a personal memory. Wiki drafts wait for approval | No update of content or scope and no per-row delete. Deleting a non-main topic deletes the memories its messages produced. Wiki proposals resolve to applied, rejected or stale, and a retire path exists for pages | bot_name plus (scope='personal' AND user_id) OR scope='shared', narrowed to user_id alone when the instance authenticates, applied inside both arms of the hybrid query | Telegram, Slack and web chat over one pipeline; Claude CLI, Claude Agent SDK, Copilot SDK or an OpenAI-compatible endpoint per bot; MCP tools per bot; a dashboard with a memory panel and a gardener review queue | Extraction per exchange, goal and task detection, proactive watchers with quiet hours and dedup, a wiki gardener that harvests, drafts, triages and retires, and a weekly wiki linter that proposes fixes into the same queue | A six-value status on a drafted wiki page and nothing at all on an extracted memory | A committed golden-set retrieval eval with recall@k, hit-rate and MRR, persisted per run with a per-query breakdown; a compare-and-swap on the file a proposal was drafted against; scope applied inside both fusion arms and narrowed by auth mode in both search functions | The automatic tier is the ungoverned one — a model decides what is worth remembering and who may read it, and the row can be removed only by deleting the whole topic it came from; main-topic memories cannot be removed by anything in the tree |
muninndb |
An engram — a ULID-keyed record with a discrete
TrustLevel, importance and two strengths, valid-from and
valid-until, and typed edges to other engrams under a workspace
prefix |
Pebble key-value store with prefixed keyspaces, an archive tier for evicted edges, tiered caches, and replication and backup as first-class packages | ACT-R style activation over the engram graph — base-level decay, spreading activation across Hebbian edges, and an abstention gate that can decline | Explicit writes over MCP, REST, gRPC and a binary protocol, with background workers deriving Hebbian weights, transitions, consolidation and confidence | evolve supersedes and records the predecessor,
Forget and BatchForget are first-class API
verbs, and a deleted-engram listing exists on the REST surface |
A workspace prefix threaded through the storage API, plus vaults at the transport layer with committed tests that a session on one cannot touch another | One binary serving MCP, REST, gRPC and a custom binary protocol, with SDKs, semantic triggers that push rather than wait, and a web console | Hebbian long-term potentiation, transition recording, consolidation, decay and confidence workers, each on its own lifecycle | TrustLevel as a discrete label — unset, verified,
inferred, external, untrusted — feeding use-time effective importance
rather than replacing it |
Cognitive primitives implemented in the engine rather than around it, a provenance record whose format comment reasons about its own extensibility, and valid time kept apart from record time | A provisional patent is asserted over the core primitives and the licence is BSL 1.1, so the mechanisms are readable and their use is constrained twice over |
musclememory |
A procedure with numbered revisions; each revision is a step graph compiled from one successful tool trace, with files read and changed, the test command, applicability conditions, avoid and recovery notes, success and failure counts, and a validation status | SQLite at ~/.musclememory/memory.db by default, PostgreSQL with pgvector and partial HNSW indexes for teams; runs, events, procedures, revisions, evaluations, artifact postings, failure contrasts, tombstones and an audit_log table | Candidates from exact file and command postings, BM25 (PostgreSQL FTS on that backend) and MiniLM cosine with a 0.40 floor, fused by RRF; only active, validated, approved, fresh and capability-compatible revisions score; hooks deliver the top candidate only after finding its edited code in the current project | Hooks for Claude Code, Codex and Cursor record every tool call; a Stop whose last test run after the last change passed counts the session as a check on a matching skill or compiles a new one. MCP, REST, SDK and hooks learn compile the same way, and every new skill and revision waits for a person's OK | A revision is added by learn with revise_procedure_token and needs a new OK; one failed check flags a revision for good; retire and delete store a fingerprint of every revision that refuses the same compile later, and a retired procedure takes no revision. Traces expire after 30 days through a manual purge | Tenant from the API key and namespace from a granted visibility_scope on every read; the local install puts every agent and project in one namespace unless a key and hook config are made per project; no project key | musclememory connect installs hooks that inject one compact JSON pointer per prompt, at most two per session, after a local file check; five MCP tools; Python and TypeScript SDKs; a CleanSlate host adapter; a dashboard; export of a Ready skill as SKILL.md | None in the server. Hooks queue events in a local SQLite and deliver them on each hook call; trace purge is a CLI command to schedule externally | Two stored statuses and an approval timestamp gate every read, and approving needs an admin key agent keys lack; success and failure evidence is whatever the capture or the caller reports, and the hooks flag a skill only when its own test runs last and fails | A two-check promotion rule that excludes the training run and re-runs the skill's own test; approval on every write path behind an admin grant; a content fingerprint that keeps a removed skill removed; failure contrasts on value-free action shapes; a bounded pointer that never cuts code mid-string | Completion evidence is caller-attested; the CLI that mints admin keys opens the database directly, so a shell running as the user can approve; the tombstone matches the exact compile only; a flagged skill is never buried and can be learned again as a new procedure; one namespace spans every project by default |
muse-brain |
An observation — content, territory, texture, mood, type, tags, an embedding, an access count, a novelty score, a processing count and notes, and entity tags — alongside entities, links, letters, open loops, desires, tasks and captured skills across thirty-six tables | Postgres with pgvector and full-text indexes for the deployed path, and a key-value backend keeping each table as a collection for local and test runs | Vector similarity with full-text and trigram lookup, link traversal and co-surfacing, reranked by recency, novelty and retrieval hints | An MCP tool surface writing observations, letters, loops and skills, plus daemons that absorb, consolidate and propose | Edits write a numbered observation version carrying a change reason; deleting an observation removes its versions too | A tenant bound to the storage client at construction, plus a deployment allowlist for cross-tenant reads and a per-project sharing flag, both defaulting closed | An MCP server on Cloudflare Workers with thirty-three tools, a CLI, a runner with a speech-to-text service, and lease-based agent identity | Absorption, consolidation, dream and skill-health daemons; a wake log and delta; charge phases that move an observation from fresh to metabolized | Lifecycle vocabularies everywhere — captured skills run candidate, accepted, degraded, retired; proposals run pending, accepted, rejected, deferred — but no read path defaults to excluding the discredited values | A tenant that is structurally impossible to vary per call, two independent cross-tenant gates that both fail closed, and a bibliography mapping sixteen papers to the specific mechanism each one produced | The skill registry's review decision and reviewer label are parameters on the tool the agent itself calls; the audit table is built for memory mutations and one operation writes to it; and the licence is Creative Commons non-commercial, applied to the code as well as the prose |
mushroomdb |
An entity node with properties and normalised aliases, a Note node linked to what it is about, hand-written fact edges, and rule-derived edges that carry the rule, the score and the property values that produced them | A directory on disk: an append-only WAL over mmapped snapshot sections, with an overlay-over-base column, topology and edge-property view; roles and commit times in sidecar files | Cypher-shaped queries, vector, full-text and hybrid search, traversal and shortest path through a view that can carry a node mask, and a recall digest over the full-text index | remember with entities and facts in one commit,
upsert_entity, ingest_json and Cypher writes;
a rule declared once derives matching edges on every later write and
retracts them when it stops matching |
Derived edges are retracted by the rule engine in the commit that
invalidates them; deleting a rule removes exactly the edges it owns;
forget tombstones a node, removes a property or retracts a
hand-written fact, and refuses a rule-derived edge |
A role bound to the bearer token on the HTTP surface, resolving to a
node mask a caller-supplied mask can only intersect; a read-only scoped
handle in the Python binding; on the stdio MCP surface role
is an argument |
Twenty-three MCP tools over stdio by default, twenty-five with --all-tools; an HTTP server with role-bound tokens; Rust, Python and npm distributions; an installer writing a skill, an MCP entry and session-start and per-prompt hooks | None; no model call anywhere in the tree, and vectors are supplied by the caller | Per-edge provenance answering why two nodes are related, a
what_if that computes without writing, history reads
bounded by a reported horizon, and a provisional mark on stub entities
that a describing write clears |
A hidden key returns the same 404 as an absent key, under a comment
naming the reason — "[h]idden keys must respond identically to absent
keys (no oracle)" — and the history handler filters edge-added and
edge-removed entries whose other endpoint is hidden, because "[a] role
token must not learn about hidden nodes via edge history events". Three
failure modes resolve to deny: an empty role sees nothing, an unknown
role is an error rather than a grant, and a corrupt
roles.json poisons every role until it is fixed. The
sidecar's version numbering is a security decision: a file using
visible_where or namespaces is deliberately
not loadable by an older binary, because such a binary "would resolve a
narrowed role to its full label set". The scoped handle carries the same
contract into the engine, refuses the whole-store reads it cannot
narrow, and is pinned by a test file that fails when a method has no
leak row. Making a relationship a schema rule that retracts its own
edges is the right shape for derived memory: the edge carries the rule
and the values that produced it, so explain_association
answers with evidence rather than an assertion |
The enforcement and the advertised surface are not the same surface.
The MCP server is JSON-RPC over stdio with no identity —
dispatch_call takes no role — so query's
role is an argument, one of "[t]wo ways to ask the same
restricted question", and forget has no role check by the
project's own statement. The session brief and the per-prompt recall
digest read the whole store, and so do analyze and
suggest_rules. The identity preset's SAME_AS
rules carry no namespace, so same-named entities in different namespaces
link. The core's history reads bypass masking — "[a]pply masking at the
caller level" — which the HTTP layer and the scoped handle do. History
is bounded: a truncating snapshot ends it, and Python's
snapshot() truncates. Nothing here is epistemic — an edge
has a score and a rule, not a status or a validity window — and the
project is pre-1.0 alpha |
nano-brain |
A document row: title, content, tags, free JSON metadata, collection (memory for agent notes, sessions for harvested transcripts or their summaries, code for indexed source) and an optional supersedes_id pointer. No status, author, confidence or validity time | PostgreSQL 17 with pgvector: documents, chunks with a trigger-maintained tsvector, and 768-dimension embeddings under HNSW. Session summaries are also mirrored to markdown files under the summaries directory | memory_query runs BM25 and pgvector legs in parallel, fuses them with dynamic RRF, deduplicates, boosts code and recent documents, optionally reranks; memory_search and memory_vsearch run one leg each; memory_wake_up lists the newest memory and sessions documents | Explicit: memory_write over MCP or POST /api/v1/write, chunked and committed in one transaction, embedded later by a queue. Automatic: a harvester every 120 seconds summarises finished OpenCode, Claude Code and Pi sessions through an LLM, or stores the raw transcript when no summariser is configured or it fails | An upsert on source_path replaces content; supersedes records a pointer and hides nothing. memory_delete and DELETE /api/v1/documents/:id hard-delete a row and cascade to chunks and embeddings. A deleted session summary is regenerated on the next harvest while the transcript remains on disk. No tombstone | A workspace_hash on every document, chunk and embedding, applied as a predicate by every named-workspace read, the OR fallback included. memory_ticket and GET /api/v1/sessions/by-ticket take no workspace and return session snippets from every workspace. The search tools also accept the value all as an explicit caller choice. Writes require a registered workspace | Nineteen MCP tools over streamable HTTP and SSE, a REST API, and a CLI; init writes MCP client configuration for Claude Code, OpenCode and Codex. No session hook injects memory; the agent calls memory_wake_up and the search tools itself | Session harvest every 120 seconds, LLM summarisation (single shot below 4,000 characters, map-reduce above), an embedding queue that rescans pending chunks every five minutes, a file watcher that re-indexes code, telemetry cleanup. An LLM consolidator that merges and deletes memory documents is written and never constructed | None. Every document is retrievable on equal terms; a superseded note ranks by relevance and recency like any other | Transactional write of a document and its chunks; parallel lexical and vector legs that degrade to one when the other fails; a refusal to bind beyond loopback without authentication; memory_search's OR relaxation skipped when a time filter is set, with the reason written down; committed cross-workspace isolation tests with positive controls; committed benchmark result files | The hybrid search's OR fallback drops the time-range and tag predicates the first leg applied; memory_ticket returns session snippets from every workspace and has no argument to scope it; deleting a harvested summary does not stick; the Claude Code and Pi harvesters have no active-session check, and presence dedup freezes the first summary; the README's headline precision trio mixes workspaces |
nanobot |
Markdown durable files plus JSONL summary lines | SOUL.md, USER.md,
memory/MEMORY.md, history.jsonl, git |
None; durable files are always in context | Consolidator appends evidence; Dream is the sole durable writer | Surgical edits under git; no tombstone | One workspace | Internal, with WebUI and cron | Dream on cron, gated on tool-error-free runs | Git history over an explicit durable-file allowlist | Dual cursors, and a cursor that refuses to advance after tool errors | No provenance from claim to evidence; single workspace scope |
nanoclaw |
One Markdown concept file per entity, YAML frontmatter with a
type; plus 500-char conversation echo rows in SQLite |
Markdown tree under groups/<folder>/memory/,
mounted at /workspace/agent/memory; SQLite for sessions and
per-session mailboxes |
Two files injected at every new context window; anything deeper is
rg and find run by the agent. No index, no
embeddings |
The agent edits files with ordinary file tools. No extraction, no consolidation, no background pass | Editing or deleting the file, guided by prose. No supersession record, no tombstone, no history | cli_scope stored per group in
container_configs, applied as a post-handler row filter;
sessionHistory self-scopes to the caller's agent group |
Per-agent Docker container; one memory hook realized per provider contract — a SessionStart hook for Claude, re-run before every turn by the OpenCode provider skill | A host sweep prunes pending echo rows (50 newest, 7 days). Nothing touches the Markdown tree | None on the memory tree. The doctrine tells the agent to re-read specifics rather than recall them | Committed wiring tests on the memory scaffold and hook; a stated audience-subset invariant with twenty negative cases; an agent-editable doctrine | The durable layer has none of the enforcement the conversation layer has, and it is the wider audience of the two |
neko |
A fact, reflection or persona entry with a scope and a source; reflections and persona entries also carry independent reinforcement and disputation counters with separate decay clocks, facts carry none | Per-character JSON views — facts, reflections, persona, directives — with reflection and persona changes behind an append-only event log, plus embeddings and archive shards | Scope filter, then a hard filter dropping disputed reflections and suppressed rows, then BM25 and cosine fused by RRF, with no model stage; a separate LLM-reranked pool chooses what Stage-2 signal detection sees | Extraction into an outbox, deduplicated, with reflection synthesis, promotion and refinement running as background workers | Disputation drives a reflection's or persona entry's score negative and out of recall; archival needs sustained negative days; scoped subjects archive by staleness; no rejected-value record survives archival | MemorySubject with group and participant scopes,
missing fields failing closed to legacy_private, filtered
before any ranking; the subject list is optional at the memory server
and built by the host |
A companion runtime — voice, vision, avatar — with memory as an
internal subsystem and a built-in recall_memory tool on the
private path; the QQ plugin exposes its own recall_memory
whose scope list is host-derived and ignores any subject the model
supplies |
Embedding worker, Stage-2 signal detection, reflection synthesis and refinement, dedup, an archive sweep, and an outbox so mid-flight tasks can be re-run | Two unrelated axes. On the memory: reinforcement and disputation
with independent decay, deriving pending, confirmed, promoted or
archive-candidate at read time. On the speaker: a server-authoritative
trust pool keyed by account, stamped onto a fact's provenance at
extraction and used to arbitrate contradictions, with None
as an explicit abstention distinct from a low score |
A dispute signal structurally separate from reinforcement; a tested hard filter that drops disputed reflections and keeps merely ignored ones; a do-not-mention list whose life extends with repetition and which drops any proactive draft naming the term; and committed tests that a model cannot forge the speaker provenance its arbitration depends on, nor widen its own recall scope | The status is derived from a score rather than stored; ban-topic directives expire 3 to 30 days after the last time they were said, and the project's own constant comment records that there is no user-facing way to delete one; facts.json writes are not journaled |
nemoclaw |
None of its own — a declared state directory belonging to a wrapped agent | Durable volume per agent; snapshots taken by
nemoclaw backup-all |
None; the wrapped agent retrieves from its own store | None; NemoClaw governs the container, not the contents | destroy wipes declared state dirs; restore reinstates
snapshotted ones verbatim |
Per-agent state directories under one config dir, each marked for backup or kept machine-local | Sandboxes Hermes, OpenClaw, LangChain Deep Agents Code, Pi and the experimental NemoCUA in OpenShell | Backup, restore and destroy over declared state; SQLite databases captured with the online backup API | Credential sanitization on backup; typed key allowlists on config restore; nothing epistemic | An explicit, inspectable backup-and-destroy contract over agent memory, declared per agent and validated when a manifest loads | Memory is snapshotted and restored verbatim, so a restore can reinstate deleted memories |
neo-agent-brain |
One agent turn: prompt, thought and response verbatim, with sessionId, userId, agentIdentity, agent, model and tool-call counts. A per-turn miniSummary is added later on the graph node; sessions get an LLM summary with scores | A daily JSONL write-ahead log on local disk, a Chroma memory collection and a session-summary collection, and AGENT_MEMORY nodes in a SQLite graph (better-sqlite3), all under one plane data root | Three read families: vector similarity over Chroma (query_raw_memories, with an opt-in concept-graph walk), reverse-chronological SQL over graph nodes plus WAL-pending rows (query_recent_turns), and a full session listing (get_session_memories). No lexical arm | Agent-called add_memory at the end of every turn, as the tool description instructs. The WAL append is the acceptance point; graph projection and the embed drain follow asynchronously, and a mini-summary backfill runs under the orchestrator | No edit. purge_session hard-deletes a session's Chroma rows and summary; archivedAt hides a row from every read and is set by the no-content and generation-timeout backfill exits. A by-identity archive exists with no production caller | userId and agentIdentity on every row from the transport's resolved identity. Policy team (default) reads deployment-wide, private filters by userId, legacy admits own, shared and untagged; a caller may narrow and not widen. Recency is always tenant-filtered | Streamable HTTP or stdio MCP server with 52 operations; memory, summaries, graph, mailbox and presence share it. Harness hooks record turn presence and lane state and inject no memory | Embed daemon drains the WAL into Chroma; a graph-projection drain loop; mini-summary backfill; session summarization on close and by drift sweep; REM graph extraction; integrity diagnosis with a heal-event ledger | A provenance tier resolved at read time from a hardcoded author table (owner, peer-trusted, unclassified and five more). Opt-in minTrustTier filter; a ranking weight on the context frontier. No per-memory state | Acceptance and searchability reported separately on every write; WAL-first durability so an embed outage never loses a turn; a sharing policy that clamps widening; the recency read fails closed with no tenant; tests that name their own vacuity hazards and carry positive controls | purge_session leaves the graph node and its miniSummary, which query_recent_turns keeps returning; thought is withheld from peers on the recency read only; the team default returns every maintainer's turns; with no resolved identity the agent argument sets the author and so the trust tier |
neo4j-agent-memory |
Conversation turn, extracted entity, preference, and reasoning trace with tool calls | Neo4j — one graph shared across agents rather than per-agent silos | Graph queries over entities and relationships; embeddings; reasoning steps with parent context | Conversation capture, GLiNER extraction pipeline, traces recorded via a context manager | supersede_preference, idempotent, with
valid_from / valid_until bounds |
Multi-tenant mode that raises when a user identifier is missing | MCP server, CLI, AWS Strands tools, OpenAI Agents SDK examples | Consolidation; extraction pipeline | Trace outcomes with success, error kind and metrics; no trust state on a fact | A reasoning tier that captures failures automatically, and fail-closed multi-tenancy | No value-level tombstone; supersession covers preferences rather than every memory kind |
neoth |
Five tiers plus an operator vault; the tier this report reads is a ground-truth fact — statement, source, scope, asserted and revoked timestamps, fact state, a source-count map, confidence, episode backlinks, maturity and a confirmed count. Beside it, a structured operator profile whose claims are extracted from conversation | SQLite indexes beside a write-ahead log with a single-writer invariant, O_APPEND, fdatasync per flush, mode 0600 and segment rotation at 16 MiB or 24 hours | Three lanes per prompt: verified, unrevoked ground truth matched by substring and prepended; region-routed episodic recall fused across semantic and episodic lanes; and pending contradictions touching the topic | Operator-attested sources write verified facts; imports, crons and transcript feeds write candidates or raw rows that corroboration by distinct sources promotes; the opt-in consolidation sweep writes mature episodic clusters as candidates | Revocation sets revoked_at; a polarity contradiction flags the lower-credibility side and a value divergence is recorded for the operator; topic forget deletes across the episodic, profile and graph tiers, revokes matching facts, and installs a never-recreate sentinel | A scope column on ground truth that keys corroboration and contradiction peers; no scope predicate on any recall read | A local daemon with chat, channel bridges, a GUI, a plugin SDK with a WASM sandbox, sub-agent personas and origin-bound consent before any outbound provider route | Decay, opt-in consolidation and synthesis sweeps, an opt-in daily contradiction resolver, drift detection, a compaction guard and an evaluation harness | A decay-immune ground-truth table with a six-value fact state gating every model-facing read, corroboration-based promotion, polarity-only automatic demotion, and a forget sentinel that profile extraction and peer gossip consult | The ground-truth module is built against a failure it names in its
own header: "[s]liding 'if importance ≥ 0.95 treat as fact' is the
failure mode this module exists to prevent." Facts get a separate table
with "no Hebbian decay, no FORGET_FLOOR sweep, no consolidation pass", a
six-value state that every model-facing read filters, and placement
ahead of every episodic row. Who wrote a fact decides where it starts —
an operator assertion is verified, an import or cron output a candidate,
extracted bulk text raw — and only agreement between distinct sources
lifts the rest. The contradiction detector splits a statement at the
first copula, excludes a superset ("'nas at X' vs 'nas at X primary' is
NOT flagged"), and hides a fact automatically only for a polarity flip,
leaving "a legitimately multi-valued attribute (two meetings, two
servers)" to the operator. A forgotten topic leaves a lowercased
sentinel that profile extraction checks twice, once before the apply
transaction and once inside it, and consent to a remote provider is a
marker file an operator can audit with ls |
The importance threshold the header rejects reaches the table
anyway: the opt-in consolidation sweep writes any cluster spanning seven
days with mean importance of at least 0.5 into ground truth, as a
candidate, so the fact state rather than the separate table keeps it out
of recall. The profile approval gate, default-on in configuration and
announced by the init wizard, is never constructed outside tests: every
production profile run passes no gate context and applies directly. The
forget sentinel is not consulted by groundtruth::insert,
document claims, bulk-text import or episodic ingest. The opt-in
contradiction resolver supersedes the older fact by assertion time and
closes genuine conflicts as human_review, which drops them
from the pending-contradiction recall lane while both facts stay
verified. scope keys corroboration but filters no recall
read, and ground-truth mutations write no log frame: the WAL codes for
them are emitted only by tests |
neurakeep |
Four durable kinds — event, fact, failure and section — each carrying source and section citations and the same five governance columns | One local SQLite vault with FTS5 over sections, raw files on disk, and a JSONL governor audit | BM25 over an FTS5 index, re-ranked by eight named components whose breakdown is returned with every hit | An extractor proposes; a governor blocks uncited or do-not-remember
items; nothing durable is applied without a proposal being applied — but
memory_apply_update is one of the MCP tools, so the
applying caller can be the agent that proposed |
Facts carry supersedes_json,
valid_from/valid_until and a
review_after date; the audit supports a real undo |
A space column on every table, applied on the read path
as (? IS NULL OR space = ?) — mandatory for failures,
optional for sections — beneath a new hosted tenant layer whose
isolation is a separate vault per tenant |
An MCP server over stdio and HTTP, a CLI, and a local web review app | A self-memory loop that files the agent's own daily notes as a proposal rather than applying them | Three discrete trust levels plus a poisoning scan that downgrades to
untrusted, used as a ranking boost rather than a gate |
A write cannot become durable memory without a citation, and the review queue is the only path to durability | The MCP search tool passes an optional space, and an omitted space matches every space |
neuralmind |
A content node in a code graph with synapse weights learned from use, ingested documents, and an architectural decision: title, rationale, commit, affected files with a git blob fingerprint each, a confidence and a status | Local project state under .neuralmind: SQLite for decisions and synapses, a JSONL hash-chained audit trail, and the code-graph index with its vectors | BM25 and embeddings with a context selector and compressors, graph-aware; decisions by FTS5, a local embedding scan, or both fused by reciprocal rank, ACTIVE only unless a status is asked for | Backend build over a repository, document ingestion, hook-driven usage learning, and decisions recorded through the CLI or an MCP tool | The index is rebuilt; a synapse namespace can be cleared and weak edges decay away; a decision is amended in place, marked STALE by the post-commit scan, invalidated or restored; the decision delete method has no caller | Per project directory, chosen on every MCP call by a path the caller supplies; synapse weights partitioned by git-branch namespace, with personal and shared merged into every read | An MCP server, Claude Code hooks, a Hermes plugin, editor extensions, a CLI, a daemon and a dashboard | A post-commit decision scan, synapse decay and team-memory import at session start, a daemon with backpressure, a CI tuner and benchmark workflows | A status on every decision that search filters on, a stale-decision warning before an edit, two hash-chained audit trails with strict verifiers, role-gated MCP tools, and a test suite that gates the project's own published numbers | Staleness is computed from the repository rather than from time. Recording a decision fingerprints the git blob of every file it names; the post-commit scan marks it STALE when a commit changes one of those files, unless that commit holds exactly the fingerprinted blobs, so the commit that carries a decision does not retire it and the next edit does. Search withholds STALE and INVALIDATED decisions, and the PreToolUse guard shows them, with the reason recorded on each, before the agent edits a file they govern. The audit verifier fails on an unreadable line, a hashless record after the chain starts and a broken link, and a committed test pins the one tampering it cannot see. And tests/test_site_claims.py gates the project's own marketing: every N× ratio on a high-traffic page must appear in site/claims.json with a source and a reproduction command, private names may not appear under site/, and the guards carry negative controls built from the copy that shipped | _emit_audit wraps the append in a bare except Exception: pass, so a build or ingest whose audit write fails leaves a gap nothing counts, and records cut from the end of the log verify clean because the hash carries no key. The chain records a decision change only as the name of the MCP tool that made it: an amend overwrites the rationale, a status change is an UPDATE, and invalidation is published only to the in-process event bus. The maintenance view called stale returns ACTIVE decisions untouched for 90 days and never a decision whose status is STALE. dependency_constraints and author have no writer, so cascade invalidation never fires. The project boundary is a path the MCP caller supplies, the default declared identity takes its role from the call, and the edit guard tells the agent itself to run restore |
neuroca |
A MemoryItem with structured or raw content, a status, importance, strength and tier metadata | Pluggable backends behind a factory — in-memory, SQLite, vector — under three tiers | Per-tier search through a MemoryManager; the vector arm is a
complete cosine implementation guarded by if embedding:,
and nothing in the tree produces an embedding |
Added through the manager, which routes to a tier and triggers maintenance | A five-value status including forgotten, meaning marked for deletion but not yet removed | None on the read path; tiers and backends partition storage rather than access | A CLI, an API, adapters including Ollama, and a monitoring tier | A lymphatic consolidator and scheduler, an annealing optimizer with phases, and tubule weights | importance and strength as floats; status is lifecycle, not belief | Consolidation records consolidated_from and consolidated_at, so a promoted memory keeps its source | Every integration test of the memory system is skipped at module level, pending a refactor |
neuron |
A markdown entry in .neuron/*.md — content, category, tags, importance, config-declared typed fields, and a supersededBy link — mirrored to a SQLite row | Markdown files are the store of record; a per-machine SQLite database with FTS5 and ONNX embeddings is a rebuildable index reconciled from the files on every command | Hybrid RRF over a vector leg and an FTS5 lexical leg, gated by an FTS match plus a cross-encoder reranker threshold, hard-excluding superseded rows | Synchronous through one enforceFieldSchema chokepoint that refuses a required-field or enum violation before the row lands, then writes markdown and reconciles the mirror | supersededBy is a one-way forward link set only by the write gate; a superseded row is hard-excluded from every read; a wrong mark is corrected by a new entry, not by clearing it | Every SQLite read filters on a project_id hashed from the project root; markdown lives per-category under configurable roots | A CLI plus harness hooks with a published deterministic/best-effort/instruction-only fidelity ladder that neuron init verifies against each harness's real registration | None scheduled. Reconciliation from markdown to the mirror runs inline on every command; a mass-deletion tripwire warns rather than blocks | importance is a scalar and there is no verified or rejected state; the epistemic move is supersession, not a status field | A schema enforced at one write chokepoint that the agent's prompt cannot talk past, and a recall hook whose fidelity is measured and labelled per harness rather than claimed | The store of record is markdown a hand-edit can corrupt, and a stray --- once made the parser undercount a category and mass-delete the mirror to match |
neurostack |
A memory row — content, tags, an entity type from a small vocabulary, the source agent, a workspace path, a session, an embedding, a revision and merge count, an optional expiry and a uuid — alongside the vault's own notes, chunks, summaries, wiki-link edges and extracted triples | One SQLite database with FTS5, stored embeddings and a link graph, entirely separate from the Markdown files it indexes | Full-text search with optional semantic reranking, a hybrid path, graph queries over wiki-links and communities, and a soft context boost on workspace or tag match | Indexing never modifies the vault; memories are written by agents through MCP tools, and harvest and synthesize write machine-generated ones | Nothing is destroyed. Forget, merge-source, TTL expiry and prune all copy the row into an archive table carrying the reason and the time, then delete it from the working set; a restore moves it back | A workspace string on each memory, matched as an exact or prefix filter when a caller passes one; no default and no requirement | An MCP server with twenty-four tools, published to PyPI and npm, with a client setup command that merges configuration for Claude, Cursor, Windsurf, Gemini CLI, VS Code and Codex | Consolidation, synthesis of recurring memories into learnings, drift detection against the notes a memory references, a promotion queue in four buckets, and a status reconciliation driven by usage | No epistemic state. Drift and ignored triggers are recorded and feed a worklist; note status moves between active and dormant on usage and is superseded at ranking time by a continuous hotness blend | Four delete paths that converge on one archive helper whose target table has no index and no embedding; expiry enforced by relocating the row at read time rather than by a clause every caller must remember; and a redaction pass applied to unattended writes and deliberately not to deliberate ones | The archive is keyed on the row, so re-saving the same sentence after a forget stores it again; the near-duplicate check runs after the insert and reports rather than refuses; and workspace is an optional argument with no default, so an omitted one reads every workspace |
nexusmem |
A node — kind, project, event timestamp, source, title,
body, a signal float and a JSON meta blob —
with an id of sha256(projectId + kind + naturalKey); eight
kinds declared and seven collected, with shell_command
carrying exit codes from a shell hook and from Claude Code tool
calls |
One better-sqlite3 file per repository:
nodes plus an external-content FTS5 index, a
sqlite-vec vec0 table partitioned by project, a
node_files path index, a node_links edge table
and a file_edges import graph replaced wholesale on every
sync; two machine-wide JSONL logs feed it, one for shell commands and
one for agent tool calls |
Three read paths. A query fuses BM25 over FTS5 with cosine over
sqlite-vec, ranks by relevance x signal^e x recency^e with
the two priors sharing one overturn budget, and packs to a token budget.
A Claude Code hook looks up past failures of the command that just
failed by an execution hash, and a session-start hook prints a digest of
recent failures; neither uses the ranker, an embedding or a model.
precheck matches staged file basenames against unresolved
failures |
Collectors per source, cursor-resumed, all through
upsertNodes. Opt-in shell hooks append command, cwd and
exit code to a JSONL; opt-in Claude Code hooks append each Bash call and
edited path to a second one, redacted before the write. Redaction covers
shell, agent, conversation and session text in full and code diffs on a
high-confidence profile; docs, git commits and GitHub threads are stored
as read |
Three granules. forget deletes every node matching a
value and writes a standing deny list consulted at every future write,
with a hash-only tombstone per node and an audit row;
--prune-source wipes one source across the live project id
and its prior identities and writes an audit row with no tombstones;
sync --rebuild clears the project unrecorded.
mark-stale down-weights without deleting, prompted by a
local model that judges whether a newer node contradicts an older one. A
deny-list entry cannot be removed |
project_id on every node and a predicate on every read:
both retrieval arms, the vec0 partition, ambient recall, the session
digest, precheck and the MCP listings. One database file per repository,
so inside a file the key separates the repository's current identity
from prior ones; a cross-project query opens each registered database
and tags every hit with its origin |
A CLI, a six-tool stdio MCP server (search, sync, status,
list-recent, list and resolve stale suggestions), three Claude Code
hooks installed by agent install (capture, recall after a
Bash call, a session-start digest), a VS Code extension with search,
recent-memory and stale-review views, and opt-in git pre-commit and
post-commit hooks |
No scheduler. Collectors run inside nexusmem sync,
started by hand, by the MCP sync_project tool, by a git
post-commit hook, or detached by the Claude Code SessionStart hook.
sync also spends at most three local-model judgments per
run on contradiction checking, on by default |
Three fields and no gate. trust_state is
candidate until a person runs nexusmem review,
then verified or rejected; a rejected node is
multiplied by 0.3 in ranking and still returned, which is why the mark
is withheld. provenance is a four-tier ordering set per
collector that scales recency decay. An agent command's
outcome is unknown when a pipe hid its exit
status, fixed at capture. Ambient recall derives resolved, stale,
superseded and uncertain at read time from links and revert commits, and
changes its wording rather than what it returns |
A value-keyed deny list whose test proves the resurrection case;
exit codes for the commands an agent ran, which git cannot supply;
recall keyed on an execution hash that survives cd and
exit-echo wrappers and is silent on no match; a fix that failed again is
reported as one that did not hold; a ranker that bounds how far
query-independent priors may overturn the query; an ambient-memory
experiment whose null results are recorded beside its design |
A forgotten value stays in cleartext in the deny list and the audit
detail, in both JSONL logs, in any pre-scrub backup and in freed SQLite
pages until a scrub runs; sync_project gives an MCP caller
a source prune confirmed by its own yes flag; GitHub thread
bodies are stored unredacted at the same provenance tier as the user's
own words; project admission is lexical on cwd, so a case-insensitive
macOS volume loses recall; signal is a prior nothing
updates from use; the pre-commit warning fires on a basename token
match |
no-human |
A row in memories — a type of rule, skill, fact or
anti_pattern, a title, a content body, JSON tags that double as trigger
terms, a checkout path and a remote-hash scope, a source
that says whether the queue may see it, an origin that says
which signal produced it, structured JSON evidence naming the task and
event, a dedupe key stored in file_path, and the lifecycle
flags confirmed, confirmed_by, activated_at, archived, superseded_by,
paused, quarantined, use_count and last_used_at |
One SQLite database at ~/.no_human/no_human.db —
memories, the append-only memory_uses ledger,
the append-only learning_events trail and the
review-recurrence record beside the task tables; confirmed skills are
also written verbatim to
.claude/skills/<name>/SKILL.md; the hosted team brain
lands in its own brain_* tables and never in
memories |
No search at retrieval time — every confirmed, unarchived,
unquarantined, unpaused row in the task's scope plus the globals is
loaded, a rule with tags is kept only when one tag or a vocabulary alias
appears as a whole word in the task's title, description, acceptance
criteria and planned file paths, a vendor-term screen holds the rest,
and rank_and_select orders by importance tier, a
fourteen-day recency decay and normalised use count under a ceiling of
25; nh recall is substring matching over confirmed
rows |
No hot-path extraction — proposals come from a reviewer FAIL round's blocking findings distilled by a utility model, from supervisor corrections, escalations, repeated review failures and tamper trips clustered on a deterministic gist and proposed only at two or more occurrences, from mined transcripts and operator replies, and from the curator; every write passes one chokepoint that refuses an unqueueable source, dedupes on the key, drops personal data and stamps provenance and quarantine | A human's reject deletes an unconfirmed proposal from the outcome,
review or reply path together with its dedupe key, archives one from a
batch-driven origin, and pauses a confirmed row;
nh rules remove, nh skills remove and their
API routes hard-delete any row an id prefix resolves, with no audit row;
archive is the verb for the 45-day sweep of unconfirmed proposals, the
90-day retirement of auto-activated rows, a supersede on confirm with a
superseded_by pointer, a failed activation screen and the
UI's Delete; pause withholds without archiving; restore reverses any of
them; a human confirm overwrites an auto confirm |
Per repository by remote hash with checkout-path fallback and explicit globals, applied on the injection query, the sessions recall query and the CLI; per channel by construction — the reviewer never receives an auto-confirmed review-origin rule and the team brain never enters the coder's local table | Injected as an importance-tiered block after the rules block of the
coder's and supervisor's prompts and as a filtered copy for the
reviewer, up to 8,000 characters of critical rules and 4,000 of relevant
ones; nh recall is named in the coder's instructions as a
Bash command; a FastAPI surface and a React pane in Settings; no MCP
tool for memory |
HarvestJob every twelve hours clusters corrections and
failure signals into proposals and, with
learning.auto_manage on by default, activates up to ten
screened proposals per rolling day; RetirementSweepJob
daily archives unconfirmed proposals older than 45 days and
auto-activated rows unused for 90; a terminal-state finalizer fills the
ledger's outcome column; nothing rewrites content |
Five discrete flags on the row; a write-time quarantine that fails closed on a matcher error and a read-time term screen that fails open, stated as such; provenance JSON on every insert; a personal-data gate that drops rather than redacts; auto-activation gated on dedupe, PII, provenance and terms with a daily cap and a kill switch; a ledger labelled correlational, not causal, in the migration and in the CLI | One injection chokepoint enforced by an AST test with its own known-positive control; a queue lifecycle whose every verb is reversible and audited; a reviewer channel that cannot consume its own verdicts; measured flood numbers written into the code that fixed them; a dedupe key that survives rejection so a batch producer cannot re-propose a refused lesson | Auto-activation is on by default and the ten-a-day cap is the only
ceiling on a store the operator has not read; the sessions source is a
second SQL route into the prompt that each new flag has to be added to
by hand; the vendor-term screen ships with eight names outside the
operator's private supplement; a memory_uses ledger row per
injection on every attempt; 21,785 lines of orchestrator around the
chokepoint; four remove commands hard-delete any row by id prefix,
bypassing the lifecycle and the audit trail |
nocturne-memory |
A node in a memory graph addressed by a URI — core://domain/topic | A graph service over a relational store, namespaced per user or persona | read_memory by URI, search_memory by text, plus generated system:// views | update_memory with an old_string target, falling back to normalized matching | In-place patching of node content; no supersession or tombstone | namespace is an equality predicate on the graph and glossary queries | An MCP server over SSE and streamable HTTP, plus a REST API and a web frontend | Recent and glossary views generated on demand rather than materialised | Nothing — nodes are text | URI-addressed memory with a boot document and generated index views | demo.db is committed, and nothing marks a node stale or superseded |
nodedb |
A row in a collection, in whichever engine the collection uses — key-value, document, columnar, graph, vector, text, array, spatial or CRDT; a bitemporal collection adds required system-time and valid-time columns | Its own storage stack: a write-ahead log, columnar segments, CSR graph indexes, HNSW vectors, an FTS index, with Raft replication for the clustered deployment | SQL and a RESP protocol surface over one planner, with vector,
full-text, graph and spatial operators in the same process, and
AS OF SYSTEM TIME for point-in-time or all-versions
reads |
Statements through the planner, with row-level write policies admitting or rejecting each row image before dispatch | MVCC versions addressable by system time; a bitemporal collection
closes a row's _ts_valid_until rather than losing the prior
interval |
Tenant, database, collection and row: row-level policies compiled to predicates and injected into the physical plan, plus scope grants with expiry, grace periods and conditions, an API-key and JWT/OIDC identity layer, and namespace authorization | Embedded in-process on device or run as a server; RESP and SQL surfaces, a client crate, a bridge, and a Docker image | Raft consensus, WAL catch-up, compaction, catalog recovery checks that verify the in-memory policy store against the catalog, and a CDC event plane | An immutable hash-chained audit log for authentication, authorization denials, privilege and tenant changes, snapshots and DDL; row-level policies; scope grants with conditions; redaction; rate limits; emergency and escalation paths | The RLS walker is exhaustive over every engine's own op enum with no
wildcard in any of the nine dispatch modules, so adding a plan variant
fails to compile rather than silently escaping the filter — the property
most access-control layers in this corpus assert in prose and cannot
enforce. Each variant resolves to one of four named outcomes and "[a]
write is never a silent no-op"; a write check left un-run is detectable
as PendingInjection rather than defaulting to allow, and a
second pass refuses undecided writes. The one wildcard in the subsystem
rejects. The end-to-end test requires an excluded row to read as absent
rather than as an error, because the distinction is itself a probe |
The memory framing is not backed by code: the README offers
"[s]emantic, relational, episodic, and time-series memory in one
engine", and the string episodic does not appear anywhere
in the engine's Rust — the four kinds are the vector, graph, time-series
and document engines under memory names. nodedb-mem, the
only crate whose name suggests agent memory, is RAM arena and budget
management. There is no memory-specific schema, no decay, consolidation,
importance or provenance model, and no agent-facing memory API; a caller
gets a database and supplies those itself. The licence is BUSL-1.1 with
a change date of 1 May 2030, so the current release is not open source.
The audit log covers security and DDL events rather than row-level data
mutations, which go to the WAL — a durability log, not a queryable
mutation record |
nooa-memory |
Memory typed info, skill, episode, intent, todo,
reflection or scratch, with typed edges |
SQLite with owner/status columns and pluggable vector backends,
opened with check_same_thread=False behind a re-entrant
lock the store takes on every connection and index access |
ACT-R activation — relevance, base-level recency, importance, plus graph spreading over k hops | Authoring via a memory skill; reflection distils episodes into gists | Retention decay archives below threshold; archived
flag, record-keyed |
owner column, indexed, applied on the retrieval
path |
Exposed as a memory skill inside the Object-Oriented Agents framework; tracing bridge | Reflection: dedup/merge, edge formation, re-scoring, prune — deterministic steps need no LLM | Separate importance, salience and confidence; per-access score components retained | Every retrieval leaves behind why it ranked where it did, on the record itself | Archival is record-keyed, the access log is capped, the two bi-temporal columns the schema declares and the package README documents are written by nothing, and the harness behind the README's six-row results table is not published in this repository |
noosphere |
A capture, promoted to a candidate, promoted to a wiki article with topics, revisions and scopes | Postgres through Prisma, with an optional hybrid embedding tier behind consent state | Postgres full-text with optional embeddings, gated by restricted tags and the caller's scope | A serializable transaction that locks the lineage, refuses a revoked digest, then creates the capture | Revocation writes a tombstone keyed on an HMAC subject hash and enqueues a durable cleanup job | privateScopeTag on the principal and on every row, plus a RestrictedScope table and restricted tags | Plugins for OpenClaw, OpenCode, Kilo Code and Hermes, a five-tool stdio MCP server installed into Codex, an injected-memory package, an installer that pins its backend script and Hermes bundle by SHA-256, and a web wiki | Durable jobs with idempotency keys for cleanup, embedding and backfill, plus TTL expiry | A candidate status enum — ephemeral, pending review, rejected, promoted, expired, quarantined — of which only quarantined has a writer, set by lineage revocation; the promotion review is an in-memory type nothing persists, and recall reads articles, never candidates | The tombstone is checked across every retained HMAC key version, so rotating the key cannot resurrect a revocation | The tombstone expires after ninety days by design, so the refusal is durable for a bounded window; the candidate tier and its five usage counters are schema with one writer, so the promotion ladder the enum describes is not a mechanism the code runs |
nornicdb |
A graph node or edge with properties and an optional vector, under a Neo4j-compatible model | Badger with MVCC snapshot isolation, an HNSW vector index and prefixed key spaces per index type | Cypher — including temporal procedures that take a validity instant and an MVCC commit version independently — plus hybrid graph and vector search, with knowledge-policy scoring applied as a visibility filter | Transactional, anchored to an MVCC version, with declarable constraints including a TEMPORAL kind | MVCC versions with a retained floor; pruning keeps the head and fails historical reads below it | A namespace component in every storage key prefix, plus multi-database separation | Bolt and Cypher for Neo4j clients, gRPC, GraphQL, a Qdrant-compatible endpoint and MCP | Access accumulation and flushing, decay driven by temporal access patterns, retention and replication | A confidence property filtered through a per-property Kalman filter that dampens single-measurement spikes | Validity can be declared and enforced as a constraint, and a single query can fix both clocks — what was recorded then about what was true then | The hybrid and vector search arm is current-state only by design, so the two clocks are reachable from Cypher and not from the search path a memory client is most likely to use |
nougenshards |
A shard: event time, event type, title, content, tags, a utility
prior, an access count, a unique content hash, a domain key, a
sensitivity, an embedding, a source URI, the writing host,
learned_utc, valid_until and
last_verified |
Local SQLite across up to nine grid databases, with private and secret bodies AES-256-GCM encrypted before they reach the file; a separate dedup index maps content hashes to grid databases, and history.db holds the event log | Keyword, embedding, title and optional distilled lanes fused by reciprocal rank and blended with the utility prior; filterable by tag scope, by what the node had learned by a date, and by an event window | nougen brain scan harvests traces from Claude, Gemini,
Cursor, Codex and others and stamps them at import time; capture
redacts, hashes, embeds and encrypts in that order; the MCP, HTTP, tube
and sync paths may supply the original event time |
The dedup index refuses identical content; mark_shard
moves the utility prior; the network node's MCP amends by appending
dated text, retracts by title prefix, tag and zero utility, or deletes
the row and leaves its hash in the dedup index |
A domain_key derived from the working path on write. On
read an implicit domain only boosts, an explicit one falls back to every
domain when it matches nothing, and agent, user, machine and project tag
filters are optional arguments. The network node gives each
authenticated tenant its own vault directory |
A CLI, a local MCP server, a network node serving HTTP and MCP behind tenant tokens, hooks, a Tauri desktop app and a Docker image | Scanning, federation between nodes, a dream pass that consolidates and decays utility, and opt-in write-time consolidation tags | Credential redaction before hashing and embedding, encryption by sensitivity, a command denylist, and an execution sandbox that refuses the single-command MCP tool by default and runs the batch tool's code as trusted | Two safety mechanisms carry disclaimers written by the person who
built them. The command gate: "This is a defense-in-depth speed-bump,
NOT a security boundary. It is a best-effort denylist meant to catch
obvious destructive commands and slow down accidents; it can be
trivially bypassed by obfuscation (encoding, indirection, aliases, etc.)
and must never be relied upon as the sole protection against malicious
input." The sandbox: "this is process-level isolation (no parent env, no
shell), NOT a full security sandbox". The capture ordering is the other
decision to copy: credential-shaped text is redacted before hashing,
embedding, indexing or encryption, "so neither SQLite nor an embedding
blob preserves a recoverable copy of a leaked credential". Encryption
states its edge too: "[t]itles and tags stay plaintext: they are the
only handle recall has on an encrypted shard, so keep identifying detail
out of them". Federation keeps that edge: /sync/pull ships
encrypted bodies as ciphertext |
The licence is source-available and not open source: commercial use
needs a subscription or written permission, and redistribution for a
fee, competing hosted services and use to train, develop or improve
competing AI memory or retrieval products are prohibited. The MCP tool
batch_execute_sandboxed runs agent-supplied code with
trusted=True, so the opt-in that refuses the single-command
tool does not apply to it and only the denylist stands. The brain scan,
the product's central import, discards the timestamps its parsers read,
so the event axis says nothing about scanned history.
domain_key organises rather than isolates.
shard_forget leaves the hash in the dedup index, so
identical content is refused afterwards with durable: true
for a row that is gone. The node's temporal_query answers
as_of on event time |
nova-ai |
Two units — an interaction event, and a concept with senses, relations and a per-concept audit log | SQLite for events (plus a JSONL mirror and an archive table); one
concepts.json rewritten whole, atomically, for
knowledge |
SQL LIKE over the event JSON,
difflib.SequenceMatcher over the newest 500 rows, and graph
walks over is_a/part_of/causes —
no embeddings anywhere |
Event-bus fan-in with a 50-event/5-second buffer; a relation from a typed sentence waits for a typed yes, while auto-extraction and Wikipedia append unverified edges without asking | weerleg marks a sense, concept or relation
rejected; reasoning ignores rejected rows while
get_senses() shows them; add_sense tests the
rejected status first and returns a blocked signal, with
re-admission behind a typed yes/no that writes its own audit entry; a
placeholder upgrade that runs first bypasses the check, and a Wikipedia
refresh replaces a sense's relations; a hard delete is refused until
everything is rejected first |
None — a single named user, no scope key anywhere | An in-process event bus; a Linux daemon in Docker with a Windows client over an unauthenticated WebSocket; a 24/7 loop that decides when to speak unprompted | Six-hourly maintenance — RAM trim, 90-day archival, 365-day gzip, vacuum, backup rotation, health check; four-hourly classifier retraining; a 15-minute contradiction sweep that reports conflicts to the user | A three-value status on every sense and relation —
unverified, confirmed, rejected —
set from the source and filtered on four reasoning reads, beside
source, confidence and a per-concept audit
log; nothing promotes an unverified relation |
A rejection keyed on the definition text that no automatic source can lift and a person lifts only by answering for that value, negative cases with positive controls, and an audit log on the concept itself | The refusal matches definition text exactly and is skipped when a placeholder sense is upgraded first; a Wikipedia refresh resets a confirmed sense and replaces its relations, rejected ones included, unaudited; and a licence that forbids reuse |
npcpy |
A MemoryItem — content plus context, tied to a message,
conversation, npc, team and directory, carrying an initial and a final
text and a status |
A JSON-backed knowledge store per directory, a knowledge graph with concepts and links, and a separate index | build_context takes only human-approved
memories, capped; the knowledge graph and index are searched
separately |
A background processor extracts candidates from conversation, then a terminal review loop decides each one | update_memory(mem_id, status, final_memory) — approval,
rejection and edit all move the same row |
npc, team and directory are recorded on every item and none of them
filters build_context |
A CLI-first agent framework with NPCs, teams, jinxes and a set of knowledge skills | A threaded queue extracts memory candidates without blocking the conversation | pending_approval, auto-extracted,
human-approved, human-rejected — a stored
status, and only one of them is retrievable |
A five-way review loop with edit and defer, and a retrieval path that reads approved memories only, so an unreviewed extraction cannot reach a prompt | A rejection is a status on a row; re-extraction of the same content produces a fresh candidate with nothing consulting the earlier no |
nuum |
One Markdown bullet per fact, in one of three tiers — a standing
fact in profile.md, or a dated fact or note in
log/YYYY-MM.md — with no id, source or confidence |
Two kinds of Markdown file per agent under
agents/<id>/memory/, beside an append-only JSONL
transcript and a prompt-cache.json holding the frozen
memory section |
No query-time retrieval: standing facts to 100 and dated facts ranked by tier and a 30-day recency term under a 4,000-character budget are injected into the system prompt; the agent greps the files with its own ripgrep tool for the rest | An update_state tool the agent calls, and a background
extractor after every completed turn that emits profile:,
log:, note: and remove: lines;
both deduplicate on normalised text across tiers |
No update; forget deletes lines whose normalised text
matches exactly, from either path; deleting an agent removes its
directory |
One memory directory per agent, a physical partition; every agent's file tools can read every other agent's memory, and the private memory is rendered into Work runs too | An Electron desktop with a Host process owning state and a Kernel process running the model loop; memory reaches the model only through the system prompt and the agent's file tools | One tool-less model call per completed, non-small-talk turn, over the whole exchange including tool output; compaction at 75% of the context window re-renders the frozen section | None. A line records no source, so a fact from a peer agent's message, a Work instruction or a file the agent read reads the same as one the user stated | A deliberately small, human-readable store with a prefix-cache discipline that is thought through and tested, a small-talk gate that counts CJK correctly, and a prompt that says how much memory it left out and where it is | The extractor never sees the memory it is asked to contradict, so its removals match only by exact wording, and a removed value can be extracted again; background writes and removals reach the frozen prompt only at the next epoch |
obelyth-cortex |
A Markdown note at a fixed path shape (profile.md, projects, notes, log, history; archive read-only), with optional description, tags, decays and reverify frontmatter. Beside it, bubble working-state items of four kinds with a project key | A private GitHub repository through the Contents, Trees and tarball APIs; optional Supabase Postgres for a verbatim mirror, bubble items, access log, scores and a derived edge graph; Upstash Redis for guest proposals, guest policy, call log and answer cache | In-process BM25 over the tarball of the branch head, byte-budgeted packs; exact-path reads; a boot call of profile, a temperature-ranked router and recent logs; a handoff bundle that adds graph neighbours from derived link, tag, coaccess and correction edges | Explicit MCP tools: brain_write (create, replace, append, exact-once edit) and brain_capture (daily log), each one GitHub commit returning its SHA; brain_bubble for working state; guests may only brain_propose | Edit in place or mark in text with a SUPERSEDED banner or (was: ...) correction; no delete tool; archive and deletion happen by hand in the repository; bubble items are filed or aged, never deleted; rejected proposals leave nothing | Single operator. Bubble items carry a project key filtered on scoped boot and handoff reads; guest answers draw only on configured path prefixes; notes carry no scope key | Streamable HTTP MCP server on Vercel with a bearer door, a URL-secret door and a separate guest door; a passcode dashboard; a nightly groundskeeper prompt template for a scheduled agent | Read-path sweeps age bubble items after 14 days; a mirror sync and edge rebuild are scheduled after corpus loads; a 15-minute cron runs the ops ledger and dates undated notes; deletion nominations only from a manual script | Every brain_ask reply carries a deterministic quote check stamped VERIFIED, PARTIALLY VERIFIED, CORRECTED, SUPERSEDED or UNVERIFIED; retraction is a text convention, not a field; credentials are redacted on egress | Quote verification against file bytes at the served commit, with retraction and correction markers recognised; honest coverage lines on every bounded reply; a guest door that cannot list write or review tools; retrieval changes gated on a labelled eval; CI that refuses skipped native suites | Trusted doors write without review and no tool deletes; a replace that races another write overwrites it on retry; the labelled eval set lives in the operator's private brain; retraction depends on house-style words; deletion nominations have no decision writer |
obsidian-mind |
A markdown note in a topic folder; a cross-repo capture with scope, confidence and superseded_by frontmatter | An Obsidian vault on disk, with .base database views and a QMD hybrid index in a local SQLite file | A budgeted eager layer at session start; QMD hybrid search; an MCP recall tool filtered by scope and supersession | Agent-written notes checked by a PostToolUse hook; MCP remember and record_work tools with a write-time contract | Editing the markdown; a capture is corrected by a new one naming it in supersedes, and nothing is deleted | Captures carry scope, projects and platforms, filtered on recall; exposed roots and never-expose gate other surfaces | Claude Code, Codex and Gemini, with lifecycle hooks, slash-command skills and an MCP server for other repos | A QMD refresh riding the validation hook; a pre-compact script; no scheduled pass | A caller-declared confidence of verified, inferred or unverified, capped by contract flags, displayed and never filtered | An enforced, measured, self-reporting injection budget; a default-deny recall predicate with supersession that follows reach | brain notes carry no status a read path consults; the reason spawn's scope boundary is a prompt |
obsidian-wiki |
A Markdown page with YAML frontmatter: title, category, tags, summary, sources, created and updated, plus lifecycle, base_confidence, tier, typed relationships and optional valid_from, valid_until and superseded_by. Beside it, profile facts and todos as rows of Markdown tables under _meta | Plain files in an Obsidian vault: category folders of pages, _raw for unpromoted captures, _staging for opt-in review, an append-style log.md, a generated index.md and hot.md, profile and todo tables per scope, a trust ledger JSON and a manifest. Git is the backup | graph-query scores title, tags and summary terms with a link-degree bonus and tier weight over an index built from every page on each call, after dropping pages outside their validity window; a context pack scores body text too and fits pages to a token budget; the agent also reads hot.md, index.md and greps | Explicit. Skills tell the agent to write pages with its own file tools, capture drops notes in _raw, and wiki-ingest compiles them into pages. Memory.add, memory_write and memory profile or todo commands write through code. A memory sync call then logs, reconciles index.md and regenerates hot.md under one lock | The agent rewrites pages in place. Supersession sets lifecycle archived and superseded_by, which nothing filters; valid_until filters the search path only; dedup leaves a redirect stub no code honours. forget deletes a profile row; deleting a file drops it from the regenerated index | Physical: user_id selects a separate profile and todo file per scope, and pages stay shared. The recap's project filter is a substring match that falls back to every thread when nothing matches. public_only on the context pack drops pages tagged visibility internal or pii; search applies no scope | 40 skills symlinked into Claude Code, Cursor, Codex, Windsurf, Gemini CLI and others; a SessionStart hook injecting a recap and a Stop hook asking for a quick capture; a CLI; a Python Memory class; a FastAPI and MCP server with eight tools; a browser extension writing to _raw | None in the package. The Stop hook asks the model to capture; daily-update and wiki-rebuild are skills the agent runs. Every memory sync rescans all pages to rebuild index.md and hot.md | A five-value lifecycle and a base_confidence per page, labelled in the context pack and in the agent's citations and filtered by no code; a manual trust ledger whose approve flag is an assertion the caller makes; inline inferred and ambiguous markers in the prose | Human-readable store with every generated file reconciled rather than overwritten; one lock and atomic replace for every memory file; event-time filtering with a successor pointer and an as-of query; a framed, word-capped session recap; refusal to clobber a hand-curated vault until a backed-up migration | The MCP mount carries no API-key check while the REST routes do; lifecycle is a label nothing filters; the window filters search but not the context pack; the recap's project filter falls back to everything; the agent can promote its own staged writes; CI never runs the server tests |
octobrain |
A titled note with content, a memory type (22 are defined), tags, up to 20 related files, the git commit at write time, importance, a source tier (user_confirmed, agent_inferred, auto_linked, imported) and a lifecycle state (working, consolidated, archived) | One LanceDB database under ~/.local/share/octobrain/memory with a memories table and a memory_relationships table, both carrying a scope column; Bitmap, BTree and FTS indexes, and an IVF_PQ index once the table is large enough | LanceDB hybrid search (BM25 plus vector, fused by RRF) with a Rocchio query expansion, weighted with recency and decayed importance, multiplied by the source tier; superseded memories scaled by 0.1; up to three 1-hop graph neighbours appended; an optional cross-encoder rerank | Explicit, through the memorize MCP tool or the CLI. The model sets type, importance, tags and the source tier. Without related files, up to five files from git diff against HEAD are attached. Auto-linking to similar memories runs as a background task | Update re-embeds and upserts by id. forget deletes by id, or deletes every hit of a semantic query. A supersedes edge down-ranks the old memory. Closing a goal marks its sources consolidated and cuts their importance to a fifth | A scope column set from the normalized git remote, with the empty string as global; a project read also returns global rows. Scope comes from the MCP client's session handshake or a per-call or CLI argument; with none, reads cover every scope and writes go to global. An optional role column filters searches | An MCP server over stdio or streamable HTTP with four tools (memorize, remember, forget, knowledge), a clap CLI, and a git-backed knowledge-box index beside the memory | At startup: a git-aware stale-file sweep that deletes or penalises memories, a sleep consolidation that clusters the last seven days' memories into synthetic goals every 24 hours, and LanceDB compaction; auto-linking after each write | A source tier stored per memory and shown as a label; used only as a ranking multiplier. The archived state is filtered out of searches and nothing writes it | A real scope key with a predicate on every store read; soft supersession that keeps the old fact queryable; a stale-reference sweep that follows git renames; access bumps throttled to one per hour so reads do not fragment the table; a BEIR harness over the knowledge path | Every rewrite stamps the session's scope and role on the row, so a global memory touched from a project moves into it; the global flag on memorize never takes effect; forget of a global memory reports success and deletes nothing; auto-attached files can get a memory deleted; similarity thresholds are compared to rank-based scores; no test opens the memory store |
octop-memory |
An AtomCard: one assertion with a verbatim quote of at most 200 characters, the raw event ids it came from, an entity, importance and confidence levels, occurred_at, and superseded_by and deprecated_at. Candidates, raw events, entity pages and episodes sit around it | SQLite with FTS5 by default, one set of tables per namespace under a name prefix; PostgreSQL in one shared schema with namespace-first keys. Chroma and Qdrant adapters exist for an opt-in vector arm | A routed pipeline: FTS over atoms and raw events, page headlines for a resolved entity, and vectors when an index is injected; a five-factor linear rerank, a per-entity cap, Jaccard suppression and a character-proxy token budget. Raw is dropped once any durable hit exists | Automatic on OpenClaw: the agent_end hook stores raw events, an LLM extracts candidates, and five rule checks drop, merge, park or promote each one. Hermes captures only; its extraction runs from the CLI. Manual Memory.store writes raw event, candidate and atom without a model | Replacement creates a successor atom and supersedes the old one; deprecate and delete set deprecated_at. GC hard-deletes deprecated atoms after 90 days and rejected candidates after 30. No tombstone | One namespace per Memory instance, usually one per agent. A column and a predicate on every PostgreSQL read; a table-name prefix in SQLite. No user or project key on the read path | OpenClaw plugin over a stdio JSON-RPC bridge and Hermes provider in-process, both registering memory_search and memory_get and capturing each turn, OpenClaw also extracting; a Python MemoryService; a click CLI; a source-only FastAPI dashboard | None in-process. On OpenClaw, extraction and promotion run synchronously on agent_end. GC, consolidation, vacuum and the seven-day fallback run from the CLI or a host's idle timer | A candidate status with needs_review and conflict queues a person resolves. Atoms carry importance and confidence levels that rank, and deprecated_at that filters on the FTS arms | Model output never reaches the status column; a candidate cites raw event ids that are checked before promotion; high-importance assertions must equal the quote; promotion writes atom, supersession, tree leaf, page flag and journal in one transaction; own recall echoes are refused at capture | The web dashboard's approve writes no atom; three approve paths treat a conflict three ways; deprecate and delete leave the vector entry, and the vector arm reads atoms without the deprecation filter; conflict detection is a negation-token flip; a value rejected twice is re-queued and then auto-promoted by the same fallback pass |
octopoda-os |
A named node holding JSONB data and a 384-dimension vector, versioned by a validity interval | Postgres with pgvector and HNSW indexes, a SQLite fallback, or a proprietary native engine not in this tree | Prefix lookup, JSONB full-text and cosine similarity over LLM-extracted facts, all tenant-filtered by the database | Optional multi-provider fact extraction before embedding, then a version-closing update and an insert | A new version closes the previous one by stamping valid_until; ephemeral keys hard-delete every prior row | Row-level security policies on five tables, with USING and WITH CHECK against a per-transaction setting | A Python SDK, an MCP server, a live dashboard, LangChain hooks and framework instrumentation | A daemon, garbage collection, heartbeats, recovery, and an asynchronous audit writer | Confidence on graph relationships; nothing epistemic on a memory node itself | The isolation cannot be forgotten by a query — Postgres refuses the row, not the application | Version history is written on every update and no read path ever queries it |
ods |
Three operator-owned Markdown files per agent —
MEMORY.md, AGENTS.md, TOOLS.md —
each restored from a baseline; only the example baseline splits
a file with a --- into operator and scratch halves |
Markdown files on disk, plus timestamped archives under
data/memory-archives/, pruned after thirty days and
captured by no backup type |
None by ODS — the deployed agent reads its own file | The agent appends below the separator; the operator authors everything above it | A scheduled reset archives everything below the separator and restores the baseline verbatim; with no separator in the file it copies the whole file aside first | One config section and one baseline per agent; local and remote agents over ssh | A shell daemon plus systemd units, shipped inside a deployment system for a local AI stack | Two systemd user timers — MEMORY.md every three hours,
AGENTS.md and TOOLS.md every sixty
seconds |
Position in a file is the authority boundary: the agent cannot durably edit anything above the separator | Forgetting is scheduled, recoverable, and refuses to run against a suspiciously small baseline | The boundary is the last --- in the file, so an agent
writing a horizontal rule silently drops its own notes — and on the
shipped baselines that is the only way the separator path is ever
reached |
ogad |
Three units. A chat message in a conversation that may carry a project id; a document chunk in a project knowledge base; and a captured memory, a sentence of at most 280 characters an LLM filter kept, with entities and entity facts extracted from it | One SQLite file, memories.db, encrypted with a key held by the OS keychain when available; embeddings as JSON text in SQLite columns, plus a LanceDB table for the semantic arm of universal search | Project chats: a LIKE term-count search over sibling chats through the search_knowledge_base tool, and a recency injection of twelve sibling messages on the rag:chat path, both filtered by project id. Project knowledge base: brute-force cosine over every chunk of the project plus up to 2,000 captured memories. Universal search: FTS5 and LIKE lists fused with LanceDB hits by reciprocal-rank fusion, plus recency and own-content boosts | Chats and documents are explicit writes from the UI. Captured memories pass an LLM store-or-drop filter at one of three strictness settings, then length, generic-phrase and substring-duplicate checks; entities pass a pure admission policy. The producers of captured material sit in the private pro submodule | Chat messages edit in place or truncate; conversations, memories and entities hard-delete; delete-all and per-category clears reach SQLite, directories and LanceDB. Deleting a memory leaves the entity facts derived from it. No tombstone | None on captured memories: they carry no project key and join every project knowledge base unless the project turns include_memory off. Chats and uploaded documents, which are not memory, carry project_id and are filtered by it | In-app chat with a tool loop: search_knowledge_base in a project chat, search_memory in the All memory scope, which the chat UI offers only to Pro builds. No memory tool on the OpenAI-compatible gateway or the MCP server | None in the public tree. The LanceDB backfill, the capture pipeline and the reprocess trigger have no caller outside tests and the private submodule | None. Retrieved chats, chunks and memories are injected as context; the only gate is the LLM filter at write time | A project predicate on chat and document reads, tested through the real IPC handlers; a SQLite-is-truth check drops semantic hits whose row is gone; one registry drives delete-all so new stores cannot be missed; entity admission as a pure function before persistence | Captured memories cross every project by default while the prompt tells the model not to use other projects; the first 2,000 memories in table order are the whole candidate set; a changed memory or entity keeps its first vector and snippet; derived facts survive the memory they came from; the memory producers cannot be read |
oh-my-hermes |
A project-memory record with a summary, a revision, a scope, a retention class, a safety evaluation and an admission block; plus memory blocks by label and tier for prompt assembly | JSON files under an OMH home — candidates/,
records/, reviews/, scopes/,
operations/, tombstones/ — written atomically
under a store-wide file lock, with an index rebuilt from the
directories |
Scoped lookup over the record index with ranking, plus a separate rejected-decision recall surface that is deliberately not prompt-eligible | Capture produces a candidate; approval promotes it to a record.
Batch staging, review and apply are three distinct CLI commands, and the
apply requires an explicit --apply |
Revisions with a staleness check that fails closed on a changed card; forgets and scope changes write a tombstone keyed on the item and are verified afterwards against the expected end state; lifecycle demotion, retirement and reapproval have their own executor | Records carry a scope, stored one directory per scope with a principal ref; the scope selects which scope file is read rather than being applied as a predicate to a shared query | An operating layer installed alongside NousResearch's Hermes Agent —
omh CLI, skills, roles and a plugin bundle, keeping Hermes
in place rather than replacing it |
Operation recovery on startup for interrupted writes, evidence pruning on a retention window, lifecycle scans for stale and expired records, and sync-fidelity validation of applied batches | An admission state on every record that gates prompt assembly and replay; a safety evaluation re-run at approval time, not only at capture; credential-like reviewer metadata refused; blocked candidates refusable only by rejection or recapture | The approval is a property of the record rather than an event in a
log — approved_manual and approved_auto_safe
are distinct stored values, so a record admitted without a person is
permanently marked as such instead of being indistinguishable
afterwards. The single-candidate approval does its read, its staleness
check and its write under one hold of the store lock, with a comment
naming the interleaving that made the guard advisory before. Safety is
re-evaluated against the current policy at approval time, so a candidate
captured under a looser policy cannot be admitted under it. The
rejected-decision surface keeps refusals retrievable while marking them
not renderable as instruction. Operations carry a state machine with
recovery counts, so an interrupted write is resumable rather than
ambiguous |
The governance is not uniform across write paths.
approve_project_memory_candidate — the ordinary way a
record is admitted — writes no operation record, while the batch,
lifecycle, migration and principal-assignment paths all do. The
per-candidate review file is keyed review_{candidate_id}
and written with atomic_write_json, so a re-approval
overwrites the previous decision rather than appending to it, and a
candidate's decision history is not kept.
prune_expired_memory_evidence deletes operations and
tombstones older than thirty days by default, so the evidence behind an
old admission expires while the record it admitted does not. Tombstones
are keyed on the record id and revision, not on the value, so they mark
that something was forgotten rather than preventing the same content
being re-captured and re-approved. In auto-safe mode a
candidate passing the safety evaluation is admitted with no person
involved |
okf-agent-memory |
A concept: one markdown file with YAML frontmatter carrying type,
title, description, tags, a generated provenance stamp,
verified entries, status,
governance, code_refs,
stale_after, sources and an optional attestation |
Plain markdown under knowledge/ in the repository,
parsed by a zero-dependency Go library; no database and no vector
store |
In-memory BM25 over the bundle, plus a code-path leg matching
code_refs, ranked with a governance multiplier |
okf create and okf update from the CLI, or
okf_create and okf_update over MCP; both
round-trip the frontmatter through the parser rather than editing
text |
An update rewrites the file and appends a log entry; there is no delete in the library, so erasure is a file removal outside the tool | The bundle directory is the boundary; there is no scope key on a concept and no scope predicate on a search | A single Go binary serving a CLI and an MCP server with six tools,
plus okf agents link, which symlinks CLAUDE.md
and other tool instruction files at a single source of truth |
None; validation, linting and search are invoked, and CI runs the validator over the repository's own bundle | generated records which agent wrote a concept and when,
verified and attestation record checking, and
a validator gates the bundle's structure in CI |
The write path is built as though the thing writing it is not
trustworthy, which for agent-written memory is the correct assumption.
mutate_security_test.go covers path traversal on save and
on parent-index update, reserved root and subdirectory filenames,
symlinks pointing at reserved or non-markdown targets, external symlinks
on load, YAML quoting, and newline sanitisation on both log entries and
relations — and TestSaveConceptRejectsFrontmatterInjection
is the one that matters most here, because a concept body reaches other
agents as instructions: okf agents link symlinks
CLAUDE.md and its equivalents at the bundle, so a
frontmatter key smuggled through a description would be read as
configuration by every tool in the repository. The second thing worth
taking is the log: a dated, in-band change record that the MCP path
cannot disable, which is a stronger claim than the git log
the README offers, since a commit records what a human chose to stage
and this records what the tool actually wrote |
Three frontmatter fields read like epistemic state and only one of
them reaches retrieval. status is parsed, validated against
draft|stable|deprecated, and serialized back, and no read
path consults it: okf search ranks a deprecated concept
exactly as it ranks a stable one. stale_after is the same
shape — the validator emits a warning once the date has passed, and
search is unaffected, so a concept the tool itself calls stale is still
handed to an agent at full weight. governance is the one
search does read, and it multiplies the score, so the effect of the
trust vocabulary on retrieval is to promote rather than to withhold. The
hold level compounds this: EffectiveGovernance
documents it as "execution freeze / manual signoff required", but the
freeze exists only as a line of bootstrap prompt text —
IF governance == "hold" => STOP("Subsystem frozen by governance. Request explicit human confirmation.")
— so the code ranks the concept higher and asks the model to stop, which
is an instruction rather than a gate. Smaller:
okf update --help offers 'active' as an
example status, and the validator rejects it, while stable,
the value that is valid, goes unmentioned |
ollama |
None at this commit. Until the agent was removed, a skill: a directory containing SKILL.md with YAML front matter naming it and describing when to use it | Markdown files on disk across four roots — two under the home directory, two under the project | No search. Name and description are listed in the system prompt; the full body loads only when something asks for it by exact name | A person writes the file. The model can only draft one by following the bundled skill-creator, and the tree says a new skill is not seen until the next session | Edit or delete the file. Name collisions across roots resolve by precedence, project over user, with no diagnostic | Four roots in precedence order, later wins; the cross-client .agents/skills convention sits beside Ollama's own .ollama/skills at both levels | None at this commit; ollama launch starts external
agents. Until the removal, a skill tool in the agent registry, a
synthetic tool call for explicit activation, and slash-command
completion in the TUI |
None | A skill never grants permission — the comment says so and the prompt repeats it to the model; a model-initiated load needs human approval, an explicit one does not | Two-stage retrieval that keeps the catalog in the cached prefix and the body out of it, and approval on the recall rather than only on the write | The whole memory surface was removed with the built-in agent; while it existed, nothing the agent learned in a run survived it, and compaction discarded rather than saved |
omega-memory |
A node with content, a memory_type, a validity interval, an entity link and a JSON metadata blob | One local SQLite database with an embedding index, plus an entity index, a graph edge table and bandit arms | Hybrid search with query expansion and a cross-encoder reranker, then supersession, point-in-time and flag filters | A pre-storage conflict gate, then contradiction detection against candidates using four heuristic signals | Supersession sets valid_until and status; deletion writes a row to an append-only forgetting log with a reason | project applied on the read path, with an OR clause admitting null and empty projects everywhere | An MCP server for any client, hooks, a CLI, an OpenClaw skill and an Obsidian export | Maintenance passes for decay, dedup, clustering and forgetting, plus a dead-letter queue for failures | A feedback score from helpful, unhelpful and outdated ratings, with minus three removing a memory from recall | A real valid_at query filtering both ends of the interval, and a deletion log that keeps the reason | flagged_for_review is set at minus three and never cleared, so recovery in the score does not restore the memory |
omegaclaw-core |
A triple of timestamp, atom and embedding, with the atom's representation left to the agent | Chroma for long-term items and an append-only
history.metta tailed by character count; a single
overwritten pin slot for working state; the reasoning
AtomSpace is rebuilt per invocation |
One arm — embed the query, return the top twenty by distance. No re-ranking, no second signal, no threshold | Only on an explicit (remember string) call by the
model, asserted by a live test that no other input path writes |
Neither. Nothing in the tree deletes, supersedes or expires a memory item | None. One collection per deployment and no scope key on the item | A MeTTa core of about 200 lines on the Hyperon stack, with Telegram, Slack and WebSocket channels, NAL, PLN and ONA available as reasoning tools | A continuous execution loop with its own goals; nothing sweeps or rewrites the memory store | None on the item. Truth values live in the per-invocation reasoning space and never reach a stored memory | A negative write test run against a real model with its positive control beside it, and documentation that names its own failure modes including confirmation bias and confidence-propagation error | Recall is similarity alone with no way to mark a memory wrong or stop preferring it, and the formal reasoning tier is discarded after every call |
omi |
A fact — canonical predicate plus slot-keyed
arguments, a subject entity id, qualifiers carrying
validity time and epistemic_status, and a list of
Evidence rows each naming its extractor and version |
Firestore, memories as a subcollection under the user document and encrypted per user at rest; Pinecone for vectors; an append-only per-user commit ledger with the document store as its projection | Hybrid, graph, agentic and RAG paths under
backend/utils/retrieval/, with a safety.py and
explicit tool-result boundaries; the read path drops anything a user
reviewed away and anything invalidated |
Transcription and screen capture into conversations, then extraction into candidate facts; every mutation is a typed entry in a hash-chained commit, applied through an outbox worker that reloads the canonical row before any external write | Nine typed mutations — supersede, refine, retract, tombstone
evidence, merge and split entities, reassign subject — plus
invalidate_memory, which keeps the document and stamps
invalid_at; delete is a separate verb with batch and
account-wide forms |
uid is structural — memories live in a subcollection of
the user document rather than behind a predicate — and the payload is
encrypted with a per-user key on write and decrypted on read |
A wearable, a macOS and Windows desktop app, a Flutter phone app, an MCP server, a plugin/app platform and a public API over one backend | A bounded outbox worker for projection and vector writes, a vector-repair outbox with its own telemetry, a scheduled memory-maintenance job, and a review queue with a timeout decision | Eight epistemic statuses mapped to permitted uses, two independent
confidence axes — capture_confidence for the source and
veracity for the claim — plus
subject_attribution and typed
uncertainty_reasons |
ACTION_POLICY maps each status to what the memory may
be used for, and an irreversible action requires an accepted
fact — trust gating capability rather than only visibility |
Nothing is keyed on a rejected value, so a fact the user rejected can be re-extracted from the retained transcript that produced it and re-enter as a fresh candidate |
omniclaude |
Not stored here — a pattern fetched from OmniIntelligence, plus an emitted injection record of what was placed in the prompt | No memory store of its own; patterns come from an in-process projection cache or OmniIntelligence's HTTP API, and telemetry goes to a SQLite cost database, JSONL hook logs and an emit daemon | A per-domain projection cache, falling back to GET /api/v1/patterns over-fetched 10x; then domain and confidence filters, provisional patterns dropped by default, and a sort that reduces to confidence then pattern id because every mapped pattern scores zero | Writes no memory; emits an injection.recorded event carrying the cohort, the seed, the effective salt and percentage, the compiled content and the token count | None — correction lives in OmniIntelligence | None on the pattern read: the query carries domain, confidence and limit, and a docstring says scoping is server-side while no key is sent for it to act on. An off-by-default memory-fabric source sends the repository's directory name | A Claude Code plugin whose internal-dev manifest registers 56 hook commands and no injection hook; the consumer marketplace ships one delegation skill and zero hooks; a separate delegation installer merges a SessionStart hook into the user's own settings | A cost-accounting hook, an all-events capture hook, a trajectory log, and a read-only harness comparing hooks-off against hooks-on windows | Consumes OmniIntelligence's lifecycle status: provisional patterns are excluded by default and dampened to half score only when admitted; any other status maps to none, which scores as validated | One session in five is hashed into a control cohort that receives no injection, and the assignment's parameters are recorded on the emitted row | Cohort identity falls back to the session id, so the same user is re-randomized every session; the ranking formula is inert on the production call, because the mapper sets usage to zero and the caller passes no evidence resolver; and registration is the only switch a repository gate can see among four that turn a hook off |
omniintelligence |
A learned pattern — a signature clustered from session events, carrying a lifecycle status, an evidence tier and rolling outcome counters | One Postgres schema, 27 migrations, with the pattern row, its transition audit, its injections and its attributions as separate tables | SQL over status, domain, keywords and a confidence floor, served to
clients as GET /api/v1/patterns |
Kafka-dispatched ONEX nodes cluster session events into candidate patterns; outcomes arrive as separate events | A four-state lifecycle moved only by a reducer, with a 20-point hysteresis band between promotion and demotion and a 24-hour cooldown | project_scope is a column with two indexes and a SQL
predicate that the HTTP API exposes no parameter for |
A FastAPI pattern query endpoint plus Kafka topics; OmniClaude is the client that injects into sessions | Promotion checks, demotion sweeps, attribution binding, and a guardrail node that nothing calls | A four-tier evidence ladder enforced monotonically in the UPDATE's WHERE clause, whose top tier nothing writes | Demotion is deliberately harder than promotion, and every transition is audited with a snapshot of the gates that justified it | The cold-start promotion path is refused by the reducer it calls, and the manual kill switch reads a materialized view nothing refreshes |
omnimem |
A Valkey hash under mem:<namespace>:<ulid>
in one of five namespaces — episodic, project, knowledge, preference,
skill — with a 384-dimension embedding, a lifecycle state,
a surface_score, and on episodic rows an effort score, an
outcome and a JSON graveyard of abandoned approaches |
Valkey with valkey-search: one HNSW cosine index per namespace over
the vector plus tag and numeric fields, AOF-persisted in a Docker
volume; a topics:suppressed set, log:recall:
hashes with a 30-day TTL, a queue:enrich list and
meta: hashes beside the memories |
A keyword fast-path over the graveyard before embedding, then KNN per namespace with the state and project filters pushed into the query, scored as similarity × surface score × recency decay × experience weight × a temporal boost when the query names a date, suppressed topics dropped, deprioritised rows with a matching reinstate hint pinned to 0.6, extracted facts collapsed into their verbatim source | remember embeds, refuses a near-duplicate above cosine
0.92 unless forced, warns on a negation-pattern contradiction among
similar rows, stores, and queues Claude Haiku fact extraction that
writes facts to the knowledge and preference namespaces at half surface
score; force=True skips all three checks |
A four-state lifecycle — active, deprioritised (×0.2, with a reason
and reinstate hints), archived (×0, excluded from search), deleted (key
removed) — driven by MCP tools, the web UI and a maintenance pass that
archives the older members of duplicate clusters and expired RSS
articles; forget previews before it deletes |
project on every row, pushed into the search filter for
three of four searchable namespaces and re-applied in Python for all,
with a bulk deprioritise, reinstate and delete per project |
A FastMCP server of 44 tools over Streamable HTTP or SSE with OAuth 2.1 for claude.ai, a 199-line instruction block delivered on connect, a Starlette web UI on a second port sharing the same memory package, an RSS worker, and connection guides for ten agents | An enrichment thread consuming the extraction queue; an RSS ingester on a schedule; a maintenance pass every tenth briefing per project — dedup, negation-pattern contradiction scan, knowledge expiry; a daily skill scan that proposes drafts and writes nothing | A lifecycle state with a stored reason and a surface multiplier, an experience weight, and append-only contradiction links; no state records whether a memory is believed true, and a link is never resolved | A graveyard checked by keyword before any embedding, surfaced first
and auto-suppressed when a costly approach is abandoned; a skill
compiler with no model in the loop whose write path commits only a
reviewed, sha-pinned draft; a why_did_you_mention tool over
a 30-day recall log |
A contradiction link is appended to both rows and removed by
nothing, so the briefing warns until one side is archived by hand; the
reason given to archive is discarded; a suppressed topic is
a substring over every memory's content; and force=True
bypasses the duplicate check, the contradiction check and enrichment
together |
omnimemory |
A row in a memories table carrying lifecycle_state and lifecycle_revision, plus Pydantic domain models; nothing in this repository inserts a memories row | Adapters for Qdrant, Memgraph, Valkey, Postgres and the filesystem; the memories table migration has expires_at and archived_at but no expired_at column | A hybrid node (vector and full-text legs fused by weighted reciprocal rank, then activation decay) whose only initialisable backends are in-memory test doubles that nothing seeds; any non-stub configuration raises NotImplementedError | ONEX nodes dispatched from Kafka topics through a runtime plugin; lifecycle writes are one compare-and-set UPDATE per expire command | A five-state lifecycle with a frozen transition map that nothing consults; ACTIVE to EXPIRED is the one routed transition, archive is acknowledged without acting, DELETED has no writer | No memory-level scope key on any read path; persona snapshots are fetched by user_id and subscriptions by agent_id | A kernel plugin registered at the onex.domain_plugins entry point, Kafka topics, contract.yaml per node | A lifecycle tick sweeping expired and unarchived rows exists with no caller in this repository; runtime-tick commands reach a bridge that only starts adapters | A six-level trust enum derived from a float by threshold; a promotion tier with QUARANTINE and BLACKLISTED that nothing writes or reads; a lifecycle state the read path never consults | A default-deny AST gate with positive and negative controls over its own checker, and a test that names what the suite does not prove. The expire dispatcher publishes exactly one outcome event per command and nacks when no publisher is wired. Compare-and-set with both revision and source state in the WHERE clause | The routed retrieval node serves empty in-memory doubles and cannot be configured onto Qdrant. archive-memory and runtime-tick are acknowledged without effect. The expire UPDATE writes an expired_at column the shipped migration does not create, and its tests run against a pool that ignores the SQL |
omninode-knowledge-base |
A Markdown artifact with typed YAML frontmatter, one of nine kinds, each with its own status vocabulary, plus an id, topics and a cross-reference list | Git. 430 artifacts across eight populated sections, plus three generated index files | None the repository runs. Three generated indexes, chronological, by topic and by type, plus grep over the tree | A pull request. CI runs pytest, then eight validator checks: registered locations, frontmatter schema, filename shape, unique ADR ids, refs resolution, sanitization, index freshness and relative links; a separate job scans commit messages and PR text | Supersession by frontmatter on ADRs only: supersedes, superseded_by and a status moved to superseded. One pair uses it, and nothing checks that the two sides agree. Two architecture documents carry superseded with no field to say by what | A topics list used to group a generated index; not applied as a filter anywhere | A CLAUDE.md addressed to a coding agent, listing the commands and the rules; no API, no tool surface. Other OmniNode repositories call a reusable drift-guard workflow that reads this repository's migration manifest | None. generate_indexes.py runs on demand, and CI fails if its output differs from what was committed | A per-type status enum validated against a discriminated union on every file, then printed as a label in the by-type index; no code reads it back to decide anything | Every check gates a merge, and the validator's checks have tests behind them; ADR ids are unique with no exemption; the commit-message and PR-text gate refuses the author allowlist the artifact scan honours | The rule the README leads with, that a decision is not accepted until its evidence artifact exists and is referenced, has no check, and no accepted ADR or pivot links one. Supersession reciprocity is by hand |
one-agent-many-hats |
Five units in five stores, separated by lifetime and owner: a
Lesson (behavioural rule with status, confidence, tags and
canary counters), a Takeaway (question/answer pair with a
feedback verdict), a Persona (size-bounded list of inferred
facts), an authored org-context.md, and the run
transcript |
Plain files under ~/.hats/workspaces/<slug>/:
memory/lessons.jsonl, memory/takeaways.jsonl,
memory/persona.json, org-context.md, plus a
rag/ chunk index. No database, no server, no runtime
dependency |
Takeaways by BM25, or by cosine when an embedding model is
configured; lessons by
confidence * 2 + tagHit * 1.5 + min(textHit, 4) * 0.25 with
a deterministic canary slice gating unproven ones. The workspace
document index is separate: BM25 and cosine fused by reciprocal rank,
each hit labelled with the ranker that found it |
Post-delivery distillation by a second light-tier model
call that returns one takeaway, zero or more lessons and at most one
persona fact; the agent has no tool that writes memory. Human feedback
is the other writer |
A rejected takeaway is filtered from retrieval and stays on disk; a
corrected one is re-rendered as its correction.
persona.forgetFact drops one inferred fact,
lessons.setStatus(id, 'disabled') retires one lesson, and
hats space prune memory deletes the whole folder. Nothing
is keyed on a value, so a re-derived conclusion returns |
One directory per workspace, which is the whole boundary.
Lesson.scope (run | workspace | global) is
stored, used for dedupe identity and printed by
hats memory, and no read path filters on it |
A CLI (hats), a REPL, a local HTTP panel, MCP client
support, and one read-only tool — recall_memory. Memory is
composed into the system prompt before the first model call |
None over memory. A scheduler runs unattended jobs and a retention sweep ages runs at 30 days and transcripts at 7; no pass re-reads or rewrites the memory stores | LessonStatus draft/canary/active/disabled with
confidence arithmetic and a deterministic canary slice, plus a
FeedbackVerdict of none/accepted/rejected/corrected on
takeaways where rejected withholds the record from
retrieval |
A lesson that tries to widen access is refused when it is written rather than ignored when it is read, by a rule file that names the function enforcing it and a registry that refuses to load a rule naming an enforcement point that does not exist; unproven lessons are staged through a deterministic canary slice, so the runs without them are a control group | The hash-chained audit log records no memory mutation at all —
data.written and data.deleted are in its
vocabulary with no producer — and every call site uses the non-throwing
auditQuietly the module argues against; the memory JSONL
holding distilled conversation content is created without the
0600 its own helper supports; scheduled runs read memory
and never write it |
ontofelia |
An RDF triple in a named graph, paired with a core:Claim (subject, predicate, object, status, confidence, sourceKind, learnedAt, assertedInGraph) and an optional core:Evidence holding the source span, message id or document hash. Beside it, episodes, skill traces and goals in cog graphs behind default-off flags | Embedded Oxigraph (WASM) in process, the whole dataset rewritten to one dataset.nq file by temp file and rename after every update; Fuseki as a legacy option. Named graphs per role: self, worldview, one per user, schema, claims, evidence, conflicts, inferred and per-user inferred. Session transcripts as JSONL with a SQLite index | Each turn the runtime injects the sender's user graph and the self graph, 30 triples from worldview plus user graph with no ordering, and one-hop facts for entities a label matcher finds in the message. Tools: memory_ask templates, memory_explain provenance and model-written SPARQL behind an AST allowlist | Automatic and synchronous: a parser LLM extracts facts from every non-trivial user message and attachment before the answer model runs, and each is stored accepted with a claim and evidence; memory_store lets the model write directly. Two reasoner runs per fact materialise derivations into an inferred graph | A new value on an owl:FunctionalProperty supersedes the accepted claim in the same graph, deleting its triple and writing a Conflict record. memory_retract, owner-only and Guardian-approved by default, hard-deletes the triple, its claims and evidence and rebuilds the inferred graph. DELETE /api/knowledge drops everything after writing a backup | Named graph per user, keyed by the channel sender id, applied as a VALUES or GRAPH predicate on every runtime read and enforced on model SPARQL by a parsed allowlist. A shared worldview takes the owner's third-party facts and a non-owner's when the model passes source user. Host tools, including memory_retract, are owner-only | A Fastify gateway with WebChat, Telegram, Discord and WebSocket node channels, a React web UI and a CLI; memory context assembled into the system prompt every turn; memory_store, memory_ask, memory_explain, memory_sparql, memory_query, memory_retract, memory_reflect and ontology tools on the agent's tool surface | None on the default path. A reflection route runs the conflict detector on request and stores unresolved conflicts nothing resolves; an episodic retention sweep is a no-op unless its flag is set; procedural consolidation and the cognitive cycle run only behind flags that default off | Claim status accepted or superseded, with confidence recorded as a label and number that gate nothing; provenance per claim with source span and evidence; Guardian approval on memory_retract and ontology_propose as tool calls; no candidate state and no review queue for facts | The named graph as a scope key on every quad, with a SPARQL AST allowlist for model-written queries; supersession that keeps the old claim and links it forward; truth maintenance that removes only inferences the retired triple alone supported; tests on a real embedded store asserting cross-user absence beside a positive control | The eval's forget and contradiction results run eval-local code with 20 functional predicates; forgetting leaves nothing keyed on the value and keeps it in episodes and transcripts; the reasoner runs twice per write for output no automatic read uses; recent facts are unordered; non-owners cannot forget their own facts |
ontomem |
One merged record per composite key, shaped by a caller-supplied Pydantic schema, with the raw pre-merge extractions of each contributing document kept beside it when the ledger is on | Files: the merged store, a FAISS index with an
index.meta.json companion, and an optional source ledger
holding the current version of each source's raw results |
Vector search over the merged records, with O(1) secondary lookups by custom key and an optional restriction to named source ids or tags | add(items, source_id=...) extracts and merges into the
existing record for a key, through either a deterministic merger or an
LLM one |
remove_source() re-merges the surviving sources for
every affected key; upsert_source() replaces a document in
one step; edit() removes one wrong fact from a record with
key-invariance validation and a dry run |
None enforced — source_ids and tags are
optional search filters the caller supplies, with union semantics across
a key's contributing sources |
A Python library, published to PyPI, with a documentation site; no server and no agent protocol surface | None; consolidation happens on the write that triggers it | Provenance through the source ledger, an embedder signature that refuses vectors from a different embedding space, and key-invariance validation on a semantic edit | The source ledger earns its overhead by naming the problem it exists
for: "because merges are destructive, the only way to remove a source's
contributions precisely is to re-merge the surviving sources' raw
results for the affected keys." That sentence is the whole design. Most
stores that consolidate on write cannot answer what a particular
document contributed, and so cannot take it back — they can only delete
every key it touched. OntoMem keeps each source's raw pre-merge
extraction, which lets remove_source(strategy="exact")
recompute the affected keys from the survivors and delete only those
nothing else contributed to. The coarse alternative is kept and named
rather than hidden: strategy="touched" deletes every key
the source touched, which is what a system without the ledger is forced
to do. The overhead is stated as a number ("~1.5-2x storage") and
bounded on purpose, since only the current version per source is
retained. Two smaller pieces are worth taking: the FAISS index records
an embedder signature in an index.meta.json companion and
refuses vectors from a different embedding space, which turns a silent
similarity-nonsense bug into a load-time refusal; and
edit() validates key-invariance before applying a semantic
edit, so removing a wrong fact cannot quietly move the record to a
different key |
Nothing here carries epistemic state. A merged record has no status,
no validity interval, no recorded-at, no confidence and no supersession
link, so a claim that stopped being true and one nobody has checked are
indistinguishable from one that was verified this morning — the merge
produces a single current value per key and the history of how it got
there lives only in the ledger's current-version-per-source snapshot,
which is not an append-only record of what changed. Scoping is a
caller-supplied search filter (source_ids,
tags) with union semantics, so a key contributed to by
several documents matches when any one of them fits; there is no stored
key applied on the caller's behalf, and nothing separates one tenant's
records from another's. Deletion has no memory:
remove_source reverses a document's contribution and leaves
nothing keyed on what was removed, so re-adding the same document
restores the same claims with no sign the store was once asked to drop
them. And the surface is a library — 5,774 lines across 36 files, no
server, no agent protocol — so everything above is the caller's to
wire |
open-brain |
Live: a memory row — source, content, embedding,
entities, tags, importance, capturing agent — and an idempotent
event with identities and a payload; declared but
unwritten: assertions, decisions, outcomes, projects and tasks |
One PostgreSQL database with pgvector and 16 migration files: memory, events, identities, sessions, imports, event compactions, context caches, and the assertion, proposal, execution and tombstone tables | Memory search by embedding, or a substring ILIKE match when the query cannot be embedded, with source, tag, capturing-agent and date filters; context packets built from project, task, decision, outcome and assertion rows and project or task rollups, all of which need project rows nothing creates | MCP, REST and the Hermes provider store memories with tagging and entity extraction; connectors write Gmail, Telegram, WhatsApp, Claude Code logs and folders straight into the memory table; adapters ingest events with idempotency keys; staged importers record Hermes, Mem0, Honcho and Hindsight exports as import records that nothing promotes | No delete path for memories or events; the one memory update rewrites an embedding; event rollups supersede earlier rollups; assertion lifecycle, consolidation and pruning proposals would change statuses through reviewed, reversible executions | Events carry user, agent, workspace, session, project and task identities; memory search takes a capturing-agent filter the caller may omit; context packets filter rollups by project or task | A native Hermes memory provider, adapters for Medusa, Codex and Claude Code, MCP tools, REST, a CLI, a Streamlit dashboard and a provider conformance suite | A bounded maintenance orchestrator that generates consolidation and pruning proposals, cleans the context cache, reports tombstone retention and compacts project or task events when given an id | Declared: assertion statuses from candidate through confirmed to contradicted, authority and confidence, and trust labels on context items; live: a constant curated_memory label on event rollups | Idempotent, provenance-carrying event ingestion; deterministic event rollups with source fingerprints; staged imports with rollback; a careful review-and-reverse design for every automated change | Nothing writes assertions, evidence, decisions, outcomes, projects or tasks, so the status model, reviews, tombstones and context packets are unreachable; the Medusa, Codex and Claude Code adapters remember into the event log and recall empty packets; no licence file |
open-bridge |
One Markdown file per fact, named type_slug.md, with name, description and metadata.type frontmatter (user, feedback, project, reference); MEMORY.md is a one-line-per-fact index | Plain files in work/memory/ inside a private git repo, or Claude Code's own auto-memory directory under ~/.claude/projects; a script resolves which one an instance uses | None by relevance. The index is loaded whole at session start by Claude Code or printed by memory-location.py index; memory-location.py get fetches one fact by file name or name slug | No code path creates a fact. The agent, Claude Code's auto memory, or a person writes the file and its index line, guided by prose rules; archive distillation proposes candidates and writes accepted ones | Edit or delete the file by hand, with git as the history. migrate copies any legacy fact missing from the target, so a fact deleted during or after migration returns on the next run. No tombstone | Physical: one repository instance per client or company. No scope key on a fact; export includes memory only in its user scope, and a pre-push hook keeps work/memory/ off public remotes | rules/operations.md Phase 1 tells any harness to run memory-location.py index at session start; Claude Code loads MEMORY.md itself with auto memory on; the same skills tree serves Claude Code, Codex and Copilot CLI | None for memory. /archive Phase 5 distils durable facts from the work log when a person runs it, and unattended runs defer every candidate to a proposal | None on a fact. Proposals carry pending, accepted, rejected, deferred, implemented and superseded, but a proposal is a separate file and an accepted memory has no status | One resolver for where memory lives, with worktree and settings precedence tested; a lint for the harness's 200-line and 25 KB index cut-off; a session-link counter against transcript retention; a path-escape guard on get; a ledger that measures its own timestamps and commit hashes | Every memory gate is prose the agent executes; three documents name three different writers for an accepted memory; migrate resurrects deleted facts from the legacy directory; the exporter resolves the harness path and misses work/memory on a default instance; an inline archive reject leaves no record |
open-cowork |
A core memory entry — one category.key string value in
a map of at most 24 — and an experience chunk with summary, details, raw
text, keywords and an embedding |
Two JSON files under the app storage root,
core_memory.json and experience_memory.json;
sessions and messages stay in SQLite for rebuilds |
A prompt prefix built before every run: the whole core map plus ten chunks and five sessions ranked by lexical score, cosine similarity, a workspace boost and recency, expanded by an LLM navigator | After every memory-enabled session, an LLM emits add/update/delete actions on the core map and a second extracts experience chunks; no write gate | Core keys are overwritten by extractor actions and evicted past 24 without a record; deleting a session removes its experience memory but not core keys it produced | Workspace is a filter on the Settings search and a ranking boost on the prefix the agent receives; no user or tenant key | A runtime extension with before-run, after-run and session-deleted hooks; the memory tools are defined and not registered | A per-session in-process promise chain for extraction; no scheduled pass | Memory is escaped and labelled untrusted evidence inside the prefix; no status, confidence or verification on stored entries | A fenced, escaped memory prefix under test, and deletion that wins a race with queued extraction | Core facts outlive the sessions they came from, the 24-key cap evicts silently, and the eval harness and prompt optimizer run only in tests |
open-graph-memory |
An agent memory episode with a status, a problem signature, a JSONB scope, a search vector, and a supersession pointer — beside attempts, outcomes and promoted patterns, and a separate document-and-chunk graph of entities and relations with provenance | One Postgres, with alembic migrations, full-text search vectors, composite scope indexes, and an ARQ worker for extraction | Full-text search over episodes with status, problem-signature, repository and domain filters, plus structured graph routes for entity search, bounded subgraph expansion, two-hop paths and relation evidence | Document upload and a deterministic extraction pipeline that resolves entities and records provenance; episodes, attempts and outcomes written through an agent-memory API, with patterns promoted on observation and confidence thresholds | An episode is superseded by pointer with both ends checked first — neither may already be superseded — and the retired one stays, excluded from the default search and drawn as a supersession edge in the graph view | A project context bound into the memory reads, a dataset beneath it for documents and chunks, and a composite index on the pair; the isolation is exercised by a runtime gate against a live stack | A FastAPI service, a worker, a web app, a Python SDK and a contracts package | An ARQ worker running extraction and indexing, with the gate waiting on both indexed and graph-complete states before it asserts | A six-value episode status with supersession and rejection excluded by default — a denylist that archived is not on — an outcome score derived from success, partial or failure, and confidence thresholds that gate pattern promotion | A runtime gate that boots a fresh stack and proves tenant isolation through the public routes rather than in a unit test; a golden fixture that names what must not be extracted and freezes its thresholds at 1.0; and an evaluation README that removed two benchmark gates when the API they measured was retired, saying the current endpoints cannot honestly reproduce those metrics | The excluded_relations list in the golden fixture is
read by nothing, so a gate failure reports a precision number rather
than naming the relation that was invented; the retired milestone's
published baselines remain in the tree as JSONL artifacts scored by an
evaluator that never calls a model or store; and every dependency
manifest changed on the day of this reading |
open-knowledge-format |
A concept: one markdown file with YAML frontmatter,
type the only required key, carrying optional
sources, generated, verified,
status and stale_after families and, for an
Attested Computation, a runtime, typed parameters, an executor and an
attester |
A directory tree of .md files — a bundle — distributed
as a git repository, a tarball or a subdirectory; index.md
per directory for progressive disclosure, log.md for prose
history |
None in the format beyond opening files by path: an agent walks
index.md listings a level at a time; the shipped viewer's
search matches title, id and tags and draws edges from relative links,
dropping the absolute form the spec recommends |
The reference agent writes one whole document per concept through
write_concept_doc, a full replacement that stamps
generated and, during the web pass only, refuses a
BigQuery Table doc whose schema or sources
list shrank |
Supersession by status: deprecated on the retired file,
kept for links and history; no delete, no tombstone in the spec; a
not: block with term, why and instead appears in one
hand-authored sample and is defined nowhere |
None — a bundle is the unit, and nothing in the spec or code keys a read on a project, user or tenant | Google ADK agents for the BigQuery and web passes, a CLI, a self-contained HTML viewer, and a documented push/pull connector into Dataplex Knowledge Catalog that carries seven frontmatter keys | None; enrichment is a batch command, index regeneration runs at its
end, and nothing sweeps stale_after |
generated.by and a list of
verified {by, at} events; a tier of unverified,
machine-confirmed or human-reviewed derived by whether any verifier
carries the human: prefix; status of draft,
stable or deprecated; every one of them advisory — no read in the tree
filters on any |
A verification event separate from generation, so who confirmed a document is never conflated with what wrote it; an attestation contract that makes 'did the sanctioned SQL run' a text comparison rather than a judgement | The trust tier and the staleness flag are computed and rendered and never enforced; a regenerated document keeps its human-reviewed tier; the shipped attester trusts the receipt an agent assembled; and the viewer, the index generator and the sample bundle all disagree with the spec on reserved filenames and link form |
open-second-brain |
A markdown file in an Obsidian vault — a signal, a preference
(pref-*.md) or a retired rule (ret-*.md) —
carrying evidence counters, a status and a computed confidence in its
frontmatter |
The user's Obsidian vault. Brain/preferences/,
Brain/retired/, Brain/active.md, and an
append-only Brain/log/pref-audit/<pref-id>.jsonl per
preference |
Hybrid — a semantic phase and a lexical phase fused by reciprocal rank fusion, with MMR diversification, then visibility-scope and agent-ownership result filters; a scope key partitions dedup and filters the read when one is supplied | Signals are captured during the session; nothing becomes a preference until the nightly dream pass, which is a pure planner over a scan plus a separate applier | Promotion and demotion both run on evidence counters. Retirement
moves the file preferences/ → retired/ and flips its id
pref- to ret-, with the frontmatter status
cross-checked against the folder on every read |
An owner/session/project composite scope key makes dedup per-scope and filters search results; a suppressor's scope decides which signals it can swallow, and an unscoped call filters nothing | An MCP server in read and writer scopes plus adapters for Claude
Code, Codex and OpenClaw; the agent emits signals and reads the digest,
and a person runs o2b brain reject |
The nightly dream pass — scan, plan, apply — plus refresh, retirement and digest phases; it rewrites confidence for every preference it touches | unconfirmed, confirmed and a
quarantine probation state, with confidence as the Wilson
95% lower bound on the applied rate multiplied by a linear freshness
decay |
A user's explicit rejection is durable and value-keyed: a retired
preference carrying user_rejected_reason suppresses the
signals that would regrow it, per topic and scope, with an event emitted
for each |
The whole epistemic model rests on evidence counters an agent emits
about itself, and a system with no independent check on
applied can be talked into confidence by a compliant
reporter |
open-webui |
A Memory row — id, user_id, a
two-value type (user or context),
an optional path, free-form content, a JSON
meta, and created_at/updated_at
in epoch seconds |
One SQL memory table plus one vector collection per
user, named user-memory-<user id>; four migrations
added the type, the path and meta, and two indexes |
Three tiers assembled per turn: every user-type memory
unconditionally, up to four context memories per path hint,
and up to eight vector hits — then each tier is sorted alphabetically
before injection |
A manual endpoint, a built-in tool the model can call, and a background review that fires every tenth user turn and asks a model for add/replace/move/remove operations | replace overwrites content in place and
remove hard-deletes the row; neither keeps what it
replaced, and there is no supersession record |
user_id filtered on every live SQL read and re-checked
on every mutation; the vector side is a separate collection per
user |
A FastAPI backend behind a Svelte front-end, with memory exposed as built-in model tools and a settings modal | An opt-in background review as a fire-and-forget asyncio task on a turn-count interval, whose failures are logged at debug | None on a row. type is a write-time genre deciding
which tier a memory lands in, not a judgement about whether it is true;
there is no status, confidence, or validity field |
A scope key that is actually applied on every live path, provenance recording the chat, message and model behind each agent write, and a relevance-threshold comment that states plainly why top-K alone is not enough | That relevance threshold defaults to 0.0 and the code gates on
> 0.0, so a default install has no floor; the vector
ranking is discarded by an alphabetical sort before injection; a
correction overwrites its predecessor; and the reviewer proposing
corrections sees existing memories capped at eighty from a query with no
ordering |
openakashic |
A claim — one sentence with a role, a confidence and a review status — and a capsule above it carrying summary, key points and cautions built from source claims | Postgres for claims, capsules, entities, evidence and links; a Markdown vault of notes behind the MCP server | Full-text, trigram and mention matching summed into one score on the public API; lexical plus semantic ranking over the vault, with superseded notes dropped before indexing | Any agent with a token, provisioned in one call under a global daily cap; writes land as claims or notes and are reviewed afterwards rather than gated | Reviews accumulate and Sagwan consolidates them into uphold, revise or supersede; revise rewrites the body in place, supersede writes a successor with lineage links | None. The store is global by design — owner guards who
may rewrite a note, and no read path filters by it |
An MCP server with search, upsert, review and confirm tools, an installer for nine clients, and a token-free public HTTP API | Sagwan, a scheduled LLM loop that consolidates accumulated reviews on a capsule and decides its verdict | Five review states — unreviewed, confirmed, disputed, superseded, merged — each a fixed score delta, beside confirm and dispute counts capped at twelve | Supersession is disclosed to the caller rather than hidden, and the note search excludes superseded material before it reaches the ranker, with a committed test asserting exactly that | On the public API's claim path the supersede penalty is a flat −0.42 while the confirmations that offset it accumulate linearly, so the best-established claim resists demotion most — and the closed-web server scores the same states multiplicatively with the confirmation boost zeroed for superseded rows, so the fix is committed on one surface and not the other |
openclaw |
A markdown section — MEMORY.md and wiki pages of
record, chunked into snippets with a path and line span, indexed rather
than stored as rows |
Markdown files as the record, indexed into a per-agent SQLite
database with an FTS table and a sqlite-vec vector table;
LanceDB is one optional backend extension |
Hybrid — vector and FTS keyword arms combined with a candidate multiplier and temporal decay, degrading to either arm alone when the other is unavailable | Session transcripts ingested on a cursor, promoted short-term to durable, and consolidated by a three-phase dreaming pass | forgetMemoryEntries with a dry-run preview, a workspace
lock, and refusals for entries of mixed lineage; a forgotten session is
tombstoned so consolidation will not re-ingest it |
agentId — a predicate in the LanceDB backend, and a
separate SQLite database file per agent in the core |
Plugin contract, tools, CLI, doctor health checks, and a memory wiki with human-editable regions | A dreaming cron in three phases — light, deep and REM — plus an auto-capture cursor with fingerprint drift detection | Category and an imported-conversation risk level; no verification state on a durable entry | Scope composed into the predicate, a review gate that withholds risky imports from durable candidacy, and a regeneration path that refuses to destroy human notes | The durability policy is a hand-tuned additive scorer over twenty-one English keyword regexes visibly fitted to one operator's life; the session tombstone is keyed on the source, not the claim; the host event journal is capped at 10,000 entries |
opencode-mem |
A memory row with content, two vectors, a container tag, a type and project metadata | Embedded Turso/libSQL with F32_BLOB vectors and a DiskANN index, sharded per scope | vector_top_k approximate nearest neighbours, then a container_tag filter on the rows | Prompt-based extraction with auto-capture, deduplication, and fail-closed redaction | A cleanup service, a dedup pass, and a user-profile changelog capped
at a retention count and cascaded away with its profile; memory deletion
is DELETE FROM memories WHERE id = ? with no record of what
left |
Two layers — memories for a scope live in their own libSQL file
under a validated 16-hex scope hash, and container_tag = ?
is a predicate on every vector-search read path, pinned in the emitted
SQL by a test. An all-projects mode drops the predicate
deliberately and walks both scopes' shards |
An OpenCode plugin with a bundled React web UI behind a generated auth token | Migration from legacy SQLite shards with a .legacy.bak per shard, dedup, cleanup | is_pinned only. MemoryType is
string, and the closed vocabulary in the schema is
MemoryMetadata.source — manual,
auto-capture, import, api — which
is provenance rather than belief |
A published self-audit with graded findings, exploit paths and regression tests; a suite that asserts the shape of the generated ANN query rather than only its results; and a bidirectional isolation test over the per-user learning buffer | The audit document is pinned to an earlier commit than the code; a delete is a plain row delete with nothing keyed on the removed value; and the profile changelog trims to a retention count on every write, so it is a version history rather than an audit trail |
opencode-session-recall |
One derived card per OpenCode session (identity, parentage, directory, project id, first user line, last text line, identifier inventory, files, tools, error signatures, family rollup, optional LLM summary and embedding) plus up to 5,000 slim-index rows of human text, reasoning and tool inputs; OpenCode's own database stays the source of truth | One SQLite file at ~/.cache/opencode-session-recall/store-v1.db in WAL mode through bun:sqlite, with an external-content FTS5 table; a schema stamp, a vector generation counter and a single-writer distill lease in a meta table; ephemeral mode opens no file | Card tier ranks every card with MiniSearch BM25 over card fields, a code-token multiplier, a seven-day recency prior and an optional static-embedding blend; an FTS5 needle lookup adds sessions the cards missed; the top twelve sessions are drilled through bounded SDK pages and re-ranked with BM25 and structural boosts | No agent write. A background distiller holding the lease builds cards on a cold pass and re-distills on session.idle, appending new rows or fully replacing them after a removal, compaction or prune; an opt-in summarizer writes nl_summary through a throwaway worker session | session.deleted deletes the card and its rows in the lease holder; a removal event forces a full re-distill; nothing is corrected in place and there is no agent-facing delete; a session deleted while no holder observed the event keeps its card, because the cold pass never removes an undiscovered session | card.directory and card.project_id classify each card exact, project or global against the caller's directory; scope project and directory arguments filter the card and FTS arms and the deep sweep; the default is global; the opt-in autoRecall hook applies no scope, and the global: false option is checked only by recall and recall_sessions | An OpenCode server plugin registering five tools (recall, recall_get, recall_context, recall_messages, recall_sessions), a system-prompt nudge on by default, an opt-in chat.message auto-recall hook and an opt-in compaction hook | A lease-holding distiller: one cold pass on lease acquisition, debounced event-driven re-distills, a 30-second lease TTL with a 10-second heartbeat, and an opt-in summarizer queue run after the cold pass capped at 200 prompts per pass | None stored. Hits carry an evidence class and a structural authorship bucket computed at query time, and auto-recall frames its block as verify before relying on it; nothing is marked believed, rejected or stale | A two-tier read that answers from a derived store before fetching anything, a deep sweep refused unless the caller supplies a scope, self-ingestion guards for the plugin's own tool output, auto-recall block and summarizer worker, and removal events that force a full replace rather than an append | Deletion and removal propagate only through the lease holder's own events; the cold pass never evicts a card for a session that no longer exists; auto-recall injects cards from every project and ignores global: false; the embedding model is fetched from Hugging Face main with no hash check |
opencode |
None — sessions, messages, parts and todos; instruction files are read, not stored | SQLite via Drizzle: session, message, part, todo, project, workspace tables | None for memory; instruction files resolved by nearest-ancestor lookup | None for memory; plugins may transform messages and the system prompt | None; no durable claim exists to correct | Project and workspace ids on sessions; nothing scopes memory because there is none | Plugin hooks, MCP, skills, LSP, tools | Compaction, with two hooks around it | None applicable | A compaction hook and a system-prompt transform — the two seams a memory plugin needs | Both are experimental, and there is no memory contract, so plugins reach past the API into SQLite |
opencompany |
A memory item — content, optional title, category and tags, an
integer version, an optional expires_at, and a namespace
id; embeddings live in a separate projection row that is never the
source of truth |
SQLModel tables owned by the memory plugin —
agent_memory_items, agent_memory_namespaces,
agent_memory_embedding_projections — with an FTS5
projection on SQLite and a parameterized LIKE fallback elsewhere |
Lexical and authoritative: FTS5 where available, SQL
LIKE otherwise, filtered by namespace, category, tags and
expiry; a cosine index over optional local embedders sits beside it as a
rebuildable accelerator |
An explicit memory tool the agent invokes —
remember, recall, list,
get, update, forget — plus a
human CRUD panel over the same store; nothing writes memory
automatically from a transcript |
update and forget take an
expected_version and raise on conflict, under
SELECT … FOR UPDATE; forget deletes the item,
its FTS row and its embedding projection; a separate
clear_namespace empties a node's items while the namespace
and mutation receipts survive |
A SHA-256 namespace derived from authenticated owner, workflow and memory-node id, applied as a predicate on every read and mutation; the field is absent from the tool schema so a model cannot name it | A drag-and-drop workflow canvas with 146 nodes; memory is one tool node wired to an agent's tool input, with a WebSocket panel for the human | None for the durable store. Conversation transcripts are written per turn inside a reserved write transaction, and a cross-store clear can be invoked from the frontend | None on the item. Memory rows carry no status, confidence or provenance field; the only status in the schema belongs to the embedding projection and describes indexing, not belief | The namespace is derived rather than supplied and reaches every query; lexical retrieval is authoritative so an embedding outage degrades to a named state rather than an empty result; and the committed isolation test pairs its negative with a positive | A forgotten item leaves no record keyed on its value, so the same fact returns on the next extraction; the durable mutation ledger is an idempotency table whose coverage depends on a caller-supplied id; and three separate stores answer to the word memory with different clear semantics |
openconcho |
None of its own. It renders Honcho's workspaces, peers, sessions, messages and conclusions, plus a client-side grouping of conclusions it calls a dream | Delegated to the Honcho instance. Locally it keeps only instance
configuration — base URL, token, name — in localStorage,
plus seed kits and a demo flag |
Honcho's own API through a generated OpenAPI client, with client-side filtering and time-clustering over what comes back | Creating a conclusion, creating and deleting workspaces, sessions, peers and webhooks, and chatting through the peer playground — all against the remote instance | Deletes issued straight to Honcho: workspace, session, session peers, conclusion, webhook endpoint. The conclusion delete is confirmed and described as permanent | Workspace and peer as URL path parameters, exactly as Honcho models them; the client adds no boundary of its own | A Tauri-style desktop app and a web UI over one React codebase, connecting to a user-supplied Honcho base URL with a bearer token | None on the server side; the client clusters conclusions into dreams on each render and polls dream progress | A token-transport rule enforced where instances are configured — "API tokens require HTTPS unless connecting to localhost" — and a conclusion type vocabulary surfaced from Honcho and rendered per item | It is one of the few artifacts in this corpus whose whole purpose is
letting a person look at, and delete, what a memory system has concluded
about them. The conclusion browser is a real review surface rather than
a dashboard: create, inspect, permanently delete. The client is candid
in source about its server's limits — a comment records that the
generated schema is from Honcho 3.0.5 while live 3.0.11 returns
level, and that premises and
reasoning_tree "are still unserved — the premise tree stays
empty until Honcho ships them". The token-transport guard is checked
where an instance is saved, with loopback exempted deliberately |
inferConclusionType ends in ?? "explicit",
so a conclusion whose level is absent or unrecognised is
displayed as an explicit statement — the most certain of the four types.
Against a Honcho version that does not serve level at all,
which the adjacent comment says is what the generated schema describes,
every deductive, inductive and contradiction conclusion renders as
something the user simply said. A "dream" is not a Honcho object: the
client derives it by grouping conclusions with the same observer,
observed peer and session that fall within a 60-second gap, so the unit
the UI is organised around exists only in the viewer. The reasoning tree
the interface is built to show is always empty at this pin. Instance
tokens are held in localStorage |
opencontext |
A doc — a file on disk, indexed by an id, a unique relative path, a human description and a stable_id | Markdown files under contexts/, a SQLite index of folders and docs, and LanceDB for chunk vectors | Keyword, vector or hybrid RRF over chunks, aggregated by content, doc or folder | A person or an agent creates a doc and sets its description; the body is written with whatever file tools the agent already has | Rename, move and remove exist in the core crate and the CLI; the MCP surface exposes neither delete nor a content write | Folders organise and aggregate. There is no scope field on the search options and no scope filter on the read path | Ten MCP tools, a CLI, a Tauri desktop app, a local web UI and an Expo iOS client | An in-process event bus drives index sync on document lifecycle events; embeddings are fetched from an API | None. A doc carries a description and two timestamps — no status, no provenance, no confidence, no validity interval | Memory stays as files the agent can already read and edit, so the store is an index rather than a second copy | The doc_type filter runs after the candidate set is cut — with no
over-fetch at all on the content-aggregation path, so a filtered search
there returns fewer than asked by construction; and
npm test runs only the 55 JavaScript cases, leaving the 78
Rust cases in opencontext-core to test:all |
openexecutive |
Three tables written by an extraction pass — a decision
(timestamp, domain, summary, rationale, outcome, tags, session,
department), an initiative (title, status, created and
updated timestamps, summary) and an advice_given row —
beside a decision_instances ledger of gated actions |
SQLite for episodic memory, the decision ledger and the audit log; ChromaDB for built-in MBA knowledge and uploaded company documents in separate collections | Two vector collections queried per specialist call, plus a rendered
<past_decisions> block assembled from the newest five
decisions, active initiatives and two advice rows, bounded by a
character budget that drops oldest advice first |
A background claude-haiku-4-5 pass after every response
extracts decisions, initiatives and advice; consolidation merges
duplicate initiatives; nothing writes memory synchronously on the
turn |
PATCH and DELETE on every memory type through the API and the
memories UI; an initiative reaching completed drops out of
the active read; no supersession record and no tombstone |
session_id branches the decision and advice queries
when the caller supplies one, and the channel handlers do;
department is stored on every row and filters nothing;
initiatives are global by design |
One orchestrator over eight specialist agents, a Next.js UI, a
scheduler claiming due actions with UPDATE … RETURNING, and
an optional Honcho deployment for per-person memory |
The extraction pass, an initiatives consolidation pass, and a single-instance job runner the README warns must not be horizontally scaled | None on a memory row. A decision carries no status or confidence;
initiatives.status is task lifecycle, and the eight-value
state machine with a confidence float belongs to the action ledger
rather than to anything remembered |
The injection block is thread-scoped with the reason written down and a test over the rendered artifact; every extracted memory is editable and deletable by a person through a purpose-built surface; and the action ledger records the approver, the edit and the reversal reason | The audit log's fourteen event types cover what memory was shown and
none of what was written, so a background extraction and a human
deletion both leave it silent; department is a scope key
that reaches no query; and the last commit is seven weeks before this
reading |
openhands-sdk |
A line in an agent-maintained MEMORY.md index, in a
user tier or a project tier, with dated daily logs beside it holding the
detail |
Markdown files under ~/.openhands/memory/ and
<workspace>/.openhands/memory/. No database, no
index, no schema |
None. Both MEMORY.md indexes are concatenated into the
system prompt under a 6,000-character budget; daily logs are never
injected and the agent reads them on demand |
The agent writes its own memory files with ordinary file tools. No code in the SDK creates, parses or validates one | The agent's to overwrite. Over-budget text is truncated line-wise
from the top behind a visible [earlier memory truncated]
notice, and nothing records what the truncated lines said |
Two tiers by path — ~/.openhands/memory/ for the user,
<working_dir>/.openhands/memory/ for the project —
with the workspace path supplied by the conversation |
AgentContext.load_memory, default False,
resolved lazily by LocalConversation on the first
send_message() / run() and rendered into a
<MEMORY_CONTEXT> prompt block |
None | None. The prompt asks the agent to record what was expensive to learn and not to record secrets, and nothing checks either | The budget is explicit, the split between tiers is fair-share with rollover, truncation keeps the tail rather than the head, and the truncation notice is charged to the budget so the model can see that its index is a fragment | There is no schema, no writer in code, no validation and no record
of what truncation dropped; the feature is off by default; and a
credential the model writes into MEMORY.md is injected into
every session afterwards |
openhuman |
A memory_docs row — namespace, key, content, category,
session and a taint column — plus tree chunks keyed by
source and owner, tree summaries, event_log claims and
profile facets |
SQLite and on-disk markdown in the workspace, served by the TinyMemory module over TinyBus: a namespace and document tier beside TinyCortex's chunk, vector, tree and queue tables, with a git repository as a derived diff ledger | Namespace recall over documents, hybrid and vector chunk search, a summary-tree walk, and a lexically gated pre-turn auto-recall of facts about the user | Reject secret-shaped identifiers, canonicalize PII keys, redact content, stamp taint; ingest source to canonical markdown to chunks to scores; event extraction by regex always and a local LLM on segment close | Upsert by (namespace, key); forget, clear-namespace and delete-by-source hard-delete rows and clear the source ingest gate, so a still-connected source re-ingests; tombstones only for unembeddable rows | A namespace the model names on recall, defaulting to 'global'; an agent profile's source allowlist narrows chunk and tree reads through the guard, and namespace recall does not apply it | One collapsed memory tool dispatching eleven actions,
goals and tree tools, memory RPC families behind a policy guard,
Composio and workspace sync |
Ingestion and re-embed queues, tree summarisation, and a goals reflection agent spawned when a conversation is summarised | MemoryTaint — Internal or ExternalSync, failing closed;
stamped by sync paths and raised under a source scope, and read only by
auto-recall to fence notes as untrusted |
A policy guard that is the only memory handle product code holds, with a ratchet test on bypasses; scopes that intersect rather than replace; a taint that survives redaction | The external-effect refusal that consumed taint lost its producer when the subconscious module was removed; profile source allowlists do not reach namespace recall; nothing records a rejected value |
openkb |
A markdown wiki page — a per-document summary, a cross-document
concept, a named entity, or a saved exploration — carrying code-managed
frontmatter and [[wikilinks]] to its neighbours |
A directory per knowledge base: wiki/ holding the page
trees plus index.md and log.md,
sources/ holding raw document content, and
.openkb/ holding a content-hash registry and mutation
journals |
No index in the search sense and no embeddings anywhere. A query
agent reads index.md, follows it to summaries, concepts and
entities, and reaches source pages through a full_text
frontmatter pointer or a page-range call into the PageIndex tree |
An LLM compiler writes page bodies while code owns the frontmatter; pages are published through a journaled, fsync'd mutation with rollback | Recompilation rewrites a page body in place and remove
deletes a document and its derived pages; a lint pass reports
contradictions, staleness and orphans into reports/ without
changing anything |
The knowledge base is a directory. _is_kb_dir requires
both .openkb and wiki to exist, and a
model-chosen page name is sanitised and then checked to be inside its
own page directory before any write |
A CLI, an HTTP API, a React frontend, and a Skill Factory generator; PageIndex supplies tree indexing for long documents | A file watcher that recompiles changed sources; lint runs on demand | None on a page. Contradictions are found by an LLM linter and written into a report; nothing marks the page they concern | A markdown knowledge base with database-grade write mechanics — journaled mutations, fsync, rollback with a capped retry — and a post-resolve containment check on every model-chosen page name; frontmatter owned by code rather than by the model that writes the prose | There is no epistemic state anywhere, so a contradiction the linter finds is a line in a report and the page it concerns is served unchanged; and the operations log records that a recompilation happened without recording what it changed |
openlore |
An ordinary Markdown file in a docset, optionally carrying OKF frontmatter for provenance, trust and lifecycle | Markdown on disk behind a virtual filesystem; beside it a JSONL history index, a commit journal carrying every committed changeset, and content-addressed pre-image blobs. No database, no vector index | The Unix toolchain reimplemented in Go — ls, cat, grep, find, awk, jq — run against the scoped virtual filesystem over SSH, plus MCP | Compare-and-swap against the version the session last read, serialized through one ordered log with a single applier | Whole-file writes and removes, both logged with before and after hashes; a remove keeps its per-file history and the removed file's pre-image. Nothing records that a claim was wrong | Per-identity grants on named docsets, applied as a read filter on the session filesystem with the most-specific docset overriding its ancestor; the history query filters by plain prefix and skips that override | SSH as the primary interface, MCP for agents, an HTTP API, a read-only web dashboard, and a generated AGENTS.md block | None for memory content; an analytics indexer computes per-file size and usage facts, and a daily job rotates the commit journal | A validated vocabulary that nothing filters on — OKF
status is draft, stable or deprecated and
verified is a list of {by, at} events, both shape-checked
on write and selected on by no read path |
A read scope where a nested docset overrides an ancestor grant, and a startup check that refuses two docsets sharing a display root because read and write authorization would resolve the tie differently | The human-approval protocol is complete on every side except the one that asks a person; the only producers of a pending change are three test files. A removed file's content stays in the history store unless retention is configured |
openmake-llm |
A row in user_memories — a sentence of up to 2,000
characters, a source of explicit, candidate or batch, an
is_active flag and an accessed_at nothing
reads |
One Postgres table with a partial index on the active rows per user, beside the workspace's conversation, preference and audit tables | None. The newest fifty active rows are injected into every system prompt as a numbered list under a 2,000-token cap, after the static guard blocks; nothing is searched, ranked or matched to the query | POST /api/users/me/memories from the settings tab,
capped at fifty per user and audited; an optional regex extractor and an
optional one-call-per-message LLM extractor, both off by default, the
model's lines kept only when they begin the user…, deduplicated
by normalised text and by token overlap against every row the user has
ever had, active or deleted; a CLI backfill over past sessions with a
dry run |
Soft delete by id or all at once from the same tab; no edit, no expiry, no decay; the deleted row is a tombstone the extractors and the backfill consult, and the person can re-add the same sentence by hand | user_id on every query, taken from the session; the
whole block is skipped for guests and for a user whose stored preference
is off |
A Next.js workspace over an Express API, a WebSocket chat, agent tasks, an MCP layer, native clients and a Discord gateway; the memory block is assembled for the chat pipeline and for agent-task system prompts, both behind the same stored preference | None. Extraction runs fire-and-forget inside the request; the backfill is a manual CLI command; a shell script aggregates the table, the audit rows and the cap logs into the daily report | None. source records how a row arrived — a person, the
per-message model call, or the backfill — and nothing reads it but a
badge in the tab |
A memory that costs the local model nothing unless an operator turns extraction on, a stored toggle the client can tighten but not loosen, a delete that the extractors remember, and an observability script that names the numbers that would justify adding search | Account deletion writes no audit entry, the prompt block is tested only against a mocked repository, the tombstone reaches only the newest 500 rows, and the fifty-row cap is first-come with nothing retiring a stale sentence |
openmasq |
A MemoryCard — an entity name, up to six aliases, a
category of personne, organisation, projet or autre, a bounded
facts string of at most 600 characters that compacts rather
than grows, a factsLog of up to three replaced sentences, a
source: "auto" when the extraction wrote it,
reviewedAt, createdAt and
updatedAt — plus one always-injected profile
of at most 1,200 characters |
The memoire field of the settings object — in the
desktop app's per-account libSQL file, encrypted at rest in packaged
builds through an Electron safeStorage key and stripped
from the plaintext localStorage mirror whenever that
database exists; in an account-keyed localStorage entry
alone in the browser preview; per-card e5 vectors and text hashes in a
memory_embeddings table on the desktop; cards and profile
ride the end-to-end encrypted user-data sync without
factsLog or reviewedAt |
At send time a deterministic client-side cascade on real values —
the typed text mentions the entity or an alias, the entity is in the
conversation's vault, or a distinctive token appears — then one hop
along cards whose facts name a certainly-mentioned entity, filled by
score then recency under a 4,000-character budget; on demand,
memory_search scores cards by content-word hits and tops up
from an on-device multilingual-e5-small index above cosine 0.88 |
Deferred: an idle timer of 120 seconds after a turn, a flush on blur or switching conversations, and a startup sweep over at most three recent conversations run one extraction call with the conversation's own model at temperature 0 over the replayed wire of turns whose redaction completed, off by default; an explicit « retiens que… » runs regardless, re-reads a few earlier turns, includes the assistant's, sweeps up to four calls with an exclusion list and reports its count; every entity must anchor verbatim in the real text or is dropped | An attribute fact replaces its competing sentence and the loser
enters factsLog; a restatement keeps the richer version and
logs nothing; saturation evicts whole sentences oldest first; a card
updates in place; delete is immediate with a six-second undo and syncs
as a tombstone keyed on the card id; there is no supersession record, no
TTL and no value-keyed rejection |
One store per signed-in account, selected by a per-account database file or storage key at load; no scope key on a card; a per-conversation switch cuts both the injection and the tool; an organisation's remote flag hides the Mémoire screen and leaves injection, search and extraction running | A block titled « Mémoire de l'utilisateur » inside the system
content of every send, built before the user-message pass so its
entities are forced into the vault, then pseudonymised through the same
engine as the message; a memory_search tool offered to the
model only when the store is non-empty and the conversation allows it,
whose query is un-redacted and whose result is re-redacted; a « Mémoire
utilisée » caption under each message naming the cards that rode it, by
id |
No consolidation pass; autoCleanMemory runs on every
store change as an idempotent fixpoint — migrating auto-written
self-preferences into the profile, merging same-key cards and identical
notes, recompacting a card that repeats itself — and the desktop
re-embeds changed cards 800 ms after an edit |
Provenance is one flag; the vault is the anti-hallucination filter, since an extracted entity must resolve to text the user or the assistant actually wrote; a pseudonym the vault cannot map back is refused; secret shapes are dropped; a real failure is shown as « réessayez » instead of a count of zero; no state ever keeps a card out of a prompt | Egress-neutral extraction by design, replaying only redacted turns through the send-time substitution; injection selected on real values and forced into the redaction vault so a remembered name cannot leak under the regex engine; attribute replacement with a restorable history; measured thresholds with the measurements written beside them; a scenario suite that runs the product's own pipeline over a growing memory | Cards live in the clear on the machine and in plaintext
localStorage wherever there is no host database; the inbox
is the only review and nothing waits for it, which is why no review mark
is carried; a card's only time is its last update, injected as a date
the model is asked to reason from; the restorable history and the review
state stay on the device that wrote them; French-keyed attribute and
glue lists |
openmemory |
An immutable, content-addressed HydroNode with a facet,
a world, provenance, a reasoning contract and five timestamps; mutable
lifecycle state is stored beside it |
SQLite hydro_nodes, hydro_edges,
contradictions and entity_aliases, keyed on
tenant and user; an in-memory store for embedded use |
Several recall modes over one engine — current, historical and strict SQL candidates, plus graph traversal over executable edges — returned within a token bound | An immutable ingest pipeline shared by the library, CLI, HTTP server and MCP transports; connectors import external sources and sync their deletions | Supersession closes a node's transaction and records
superseded_at; a deleted connector source is ingested as a
non-reasoning marker with a supersedes edge |
tenant_id and user_id in every query,
unconditionally; world_id optional beneath them; identity
bound per engine instance rather than per request |
A TypeScript package, CLI, authenticated HTTP API, thirteen MCP tools, a Next.js dashboard, a VS Code extension and host plugins | Consolidation and reconsolidation passes over the hydrograph | A read-time gate in code — status, use_for_reasoning, confidence, grounding, source requirement, expiry and source permission decide eligibility per node; the SQL that states the same policy is never executed and is stricter than the gate that is | Strict recall asks what was true at a time and refuses a fact under unresolved contradiction, in one legible query | No committed test exists anywhere in the tree, and the fourteen stated invariants are returned as strings rather than asserted |
opensre |
One markdown file with YAML frontmatter — slug, a five-value type, a
200-character description, created and updated timestamps — beside a
generated MEMORY.md index |
A per-principal directory of files at
<org root>/users/<actor id>/memory/, mode 0700
with 0600 files, written atomically under a directory
FileLock |
Mostly none: the whole store, newest first, is rendered into every
prompt within an 8,000-character budget. memory_recall adds
case-insensitive substring search over slug, description and body |
An agent tool the model is told to call unprompted, plus an LLM extraction pass after every recorded turn and again synchronously at process exit | Reusing a slug updates in place and preserves
created_at; memory_forget and
/memory forget unlink the file. Nothing records that a
value was rejected |
A ContextVar storage scope resolved per turn selects a
directory per actor, inherited by the extraction thread through
contextvars.copy_context(); no record carries an owner, and
OPENSRE_MEMORY_DIR puts every actor in one directory.
Memory is off by default on shared Slack and Telegram hosts |
Three tools — memory_remember,
memory_forget, memory_recall — gated by
is_available, plus /memory slash commands in
the interactive shell |
One coalescing daemon thread carrying the latest transcript snapshot, so rapid turns share a single provider call; the process-exit pass runs synchronously | None as a field. Trust is enforced at the gate instead: an infrastructure or incident memory is refused unless its distinctive tokens appear in the user's own messages | A deterministic grounding check that keeps assistant and tool output out of durable memory; secret patterns blocked from the store and redacted before the transcript reaches the extraction provider; the feature disabled on surfaces where its own scoping is incomplete | No rejected-value record, so a fact deleted mid-session sits in the same transcript the next extraction pass reads; substring-only search; the miss ledger is org-wide while memory is per-user |
openviking |
Typed memory file with L0 abstract, L1 overview, L2 content, links and backlinks | Pluggable vector/graph stores plus native Rust/C++ index | Directory-recursive dense + sparse, level filter, per-type quota, rerank, hotness blend | LLM extraction into typed files; write target resolved before persistence | Merge ops with
upsert/add_only/update_only; no
rejection state |
Tenant and permission via RequestContext; user space
plus peers/<id> |
Server, SDKs, CLI, web studio; Hermes and OpenClaw provider | Extraction, streaming update, reindex, hotness maintenance | URIs, types, timestamps; no evidential spans or trust state | Three-granularity progressive disclosure; hotness kept apart from confidence | Headline benchmark numbers lack committed raw artifacts; AGPL-3.0 |
openvurp |
A row in a per-agent memories table — free text, a
category string, an optional float32 embedding, created_at,
accessed_at, access_count, JSON metadata —
beside Markdown lesson files, JSON profile/pattern/project files, JSONL
learning and journal events, and a cases.json of
corrections to replay |
SQLite with an FTS5 external-content table and embeddings stored as
BLOBs, one vector_memory.db per agent under
memory/agents/<id>/ and one for the platform; a
shared chats/chats.db in WAL mode for conversations;
everything else is files |
Keyword scoring over memory files plus a semantic section: FTS5 over an OR of the query's words with bm25 normalised to the best hit, cosine similarity computed in Python over every embedded row, fused 0.7/0.3, decayed by a 30-day half-life on 30% of the score, cut at 0.3, diversified by word-overlap MMR, top 5 | remember inserts synchronously (an embedding call to
Ollama or OpenAI on the hot path when available); corrections, feedback,
tool failures and completed tasks append learning events;
learning_review groups events into candidates;
learning_promote writes a lesson file after a verification
gate and a human approval; store_lesson also indexes the
lesson into the vector store |
No update path; VectorMemory.forget and
MemoryManager.forget exist and nothing calls them. A
nightly fade archives rows older than 45 days, not recalled
in 45 days and recalled fewer than twice, to
.faded/faded.jsonl and deletes them — on the platform store
only. cleanup() at start-up deletes platform lesson files
older than 90 days by mtime with no archive.
learning_rollback moves a lesson into
lessons/.retired/ with a reason |
The agent id, held in a contextvars.ContextVar set
around every tool a roster agent runs and used as a directory:
memory/agents/<id>/{vector_memory.db,lessons,learning,mirror};
the platform keeps memory/ itself. No row carries the id
and no read filters on it: the partition is the file opened. Retrieval
is only assembled for session_type == "main" (the terminal,
the page, a DM) and never for a group chat |
A Python wallet: a local web page on 127.0.0.1:8420, Telegram,
Discord, Slack and WhatsApp all through one conversation core; tools
remember, learning_feedback,
learning_review, learning_promote,
learning_rollback, task_journal,
reflection_note, open_loop, pact,
capability_lease; a /specchio command; an
/api/memory overview |
A heartbeat thread every 30 minutes in active hours, two-tier so the model runs only on changed state, an event, or every four hours; once a day it fades the platform store and runs each agent's Mirror — up to five corrections replayed at two model calls each | None as a field. A lesson passes through candidate
(candidates.json), active (lessons/*.md) and
retired (lessons/.retired/) as directories; the header line
verificata: sì|forzata|no is written by
_write_lesson and read by nothing; a manual promotion with
no candidate is stamped verificata=sì because the gate has
nothing to check |
A correction that becomes a nightly regression test with a per-case pass streak; a promotion gate that refuses low evidence, secrets and duplicates and writes its provenance into the lesson; a scope carried as a context variable so parallel agents cannot overwrite each other's identity; secret redaction on every learning event and journal line; a runtime-enforced pact that outranks the approval mode | User corrections typed to a roster agent never reach a learning log
— the hook lives in Agent.run, which a direct agent chat
bypasses — so the per-agent Mirror replays only feedback the agent filed
about itself, and against the platform's lessons; the nightly fade is
bound to the platform store so agent memories never fade; the daily note
of every scoped correction is appended to the platform's own memory
directory and retrieved there; auto mode pre-approves
lesson promotion for the heartbeat; two forget methods and
a memory_consolidate tool name survive with no caller and
no registration |
openwolf |
Markdown section entry (cerebrum.md), action-log row
(memory.md), file record (anatomy.md + JSON
index), bug record (buglog.json) |
Per-project .wolf/ directory of Markdown and JSON,
atomic writes, an anatomy lock |
Section extraction into a token-budgeted session digest; grep over
anatomy.md and buglog.json by instruction |
Twelve hook registrations write the mechanical stores under a read-modify-write lock; cerebrum entries come only from the model following OPENWOLF.md, nudged by the Stop hook | Destructive daily consolidation of memory.md; no scheduled rewrite of cerebrum.md since 2.5; no delete surface for a single memory | One .wolf/ per project directory; no scope key on any
read |
Hooks for Claude Code, Codex, OpenCode, Cursor, Antigravity and Gemini; an OpenCode plugin; a local daemon and read-only dashboard | node-cron daemon: stale-gated anatomy rescan, daily memory consolidation, weekly token audit; no model calls | None — no status field, no provenance, no confidence anywhere in the store | A read-path hook that can deny a duplicate file read; a derived-copy mirror into Claude Code auto-memory that deletes what its source no longer holds | The only code writer of beliefs replaces the whole file with model stdout, routed by a substring check |
openworker |
A row with a three-value scope, optional key, content, a one-line
summary, workspace, session and created_at; no status,
confidence or provenance field |
SQLite (coworker.db) alongside sessions and
workspaces |
A listing filtered by scope and workspace, rendered into the system
prompt at session start and frozen there; over a threshold it flips to
an index of one-line summaries the model expands by id with
memory_read |
Three agent tools — remember,
memory_update, memory_forget |
Update by id and hard delete by id, with the previous text captured before the write so the inline save notice can offer an Undo; no supersession and no tombstone | A Scope of global, workspace or session; the injection
path passes scope and workspace explicitly, while list()
filters only on the arguments a caller supplies and
memory_read fetches by integer id with no scope check at
all |
Tools wired into the agent loop with guidance injected only when a store exists | None for memory | Timestamps only, with no status or confidence on a row. What ranks above an agent-written memory is the user's own rules block, which no tool can write, edit or delete | Every write is announced inline with an Undo carrying the previous text; a human-authored rules block outranks anything the agent learned and no tool can touch it; and the tests pin what a mid-conversation delete does and does not reach | memory_read takes integer ids and never checks scope,
so the model can read a memory the injection path would not have shown
it; a forgotten fact leaves no record; and the session
scope is declared and never written |
openyak |
One row per workspace directory holding a free-form plain-text document capped at 200 lines | A single SQLAlchemy table with a unique index on the normalised workspace path | None. The whole document is wrapped in
<workspace-memory> tags and injected when
non-empty |
An LLM rewrites the entire document from the previous version plus the conversation, after a debounce | Whole-document overwrite, a PUT from the settings
editor, and a hard DELETE; no history of any kind |
The normalised workspace_path is the primary key and
the read-path filter |
A desktop agent with a settings tab that edits the document directly, plus list, refresh and export endpoints | A debounced async queue keyed by workspace path so concurrent sessions in one directory cannot race | None. There is no unit below the document to attach a status, a source or a confidence to | Debouncing by workspace rather than by session, and refusing to write when the model returns nothing | A short rewrite silently replaces a full one, the 200-line cap truncates the tail without warning, and a bundled skill documents a memory system the code does not implement |
openzync-core |
Two units. An episode is a raw message turn — role,
content, metadata, sequence number, embedding, an enrichment status
bitmask and a soft-delete flag. A fact is what an LLM
extracted from it: a subject, predicate and object with types and
optional entity ids, a confidence float, the source episode,
valid_from/valid_to/invalid_at, a
superseded_by_fact_id and its own embedding |
PostgreSQL with pgvector (768-dimension columns under HNSW cosine indexes), pg_trgm and btree_gist, 62 Alembic revisions; Redis for the ARQ job queues and cache; a pluggable graph backend defaulting to FalkorDB with one graph per organisation and project, with SurrealDB and a deprecated Postgres-native backend beside it | Five legs run in sequence — vector over episodes, vector over facts, BM25 over episodes, BM25 over facts, and a breadth-first graph walk — fused by reciprocal rank at k=60 with episodes and facts fused separately and entities bypassing fusion, then an optional cross-encoder rerank. Any leg failing aborts the whole search rather than returning a partial result, and there is no relevance threshold anywhere on the path | POST /v1/projects/{id}/memory stores the turn inline —
archived-project check, idempotency key, session resolution, an atomic
content-hash claim, fail-closed PII redaction, sequence numbers under a
session row lock, batch insert, commit — then enqueues three background
jobs per episode: one LLM call producing classification, entities, fact
triples, structured extractions and contradiction invalidations in a
single response, applied in independent savepoints, plus embedding and
entity linking |
A fact is never edited. Re-asserting the same normalized triple with
new content, or an LLM-detected contradiction, closes the predecessor's
window with valid_to = now; retraction sets
invalid_at; each is recorded in
fact_invalidation_events as superseded, llm_invalidated or
retracted, and the fourth permitted kind, time_expired, has no writer.
The retracted set is consulted before every insert. The project wipe
soft-deletes episodes and stamps invalid_at on every fact,
so each wiped triple becomes a tombstone and the facts stay readable
through an earlier as_of |
An organisation and a project column on every record and a membership dependency on every project-scoped route; the four search legs filter on the project and the graph leg opens a per-organisation-and-project graph; row-level security on the organisation binds only a role that does not own the tables | A FastAPI service with thirty-one router modules, an ARQ worker with fifteen task types and a cron schedule, a Streamlit chat client, Docker Compose and Helm charts, OpenBao for secrets and a Grafana stack. The MCP server the README advertises is not in this repository | Enrichment with contradiction invalidation, embedding, entity linking, blob text extraction, audit writes, entity merging, community summarisation, observation computation, webhook delivery, user summaries, orphan-blob cleanup, and cron jobs that reconcile stalled enrichment and expire graph edges | A confidence float on a fact, thresholded at 0.3 once at extraction time and offered as a sort key on the fact listings; no status, no state, and no retrieval leg ranks or filters on it | One effective-at test applied on every fact search and listing, with an as-of instant threaded from the route to the graph backends; a retraction gate keyed on the normalized triple and consulted on both insert paths; a negative test that forces the ranking to fail if the filter does; a cross-tenant search test with a positive control | The project wipe stamps the retraction column on every fact, so
wiped facts stay readable through an earlier as_of and every wiped
triple is refused if it is said again; the effective-at test is restated
inline at most read sites rather than shared; the search SQL carries the
project key and not the organisation key, and row-level security binds
only a role that does not own the tables, which the tag-deploy
workflow's single database URL does not arrange; a superseded triple is
inserted again by design; no GitHub Actions job runs the cross-tenant
suite; episodes.token_count is returned to clients and
written by nothing; the context formatter's community section is always
handed an empty list |
optmem |
One line of at most 280 bytes, fixed width, position-addressed | LOG.txt append-only, never edited; TREE/
of compressed blocks, a rebuildable cache |
wake prints a budgeted cover of the merge tree —
verbatim recent, compressed ancient |
note appends one line and may return a compression for
the agent to answer |
forget <lo>-<hi> drops a summary; the next
nap rebuilds it. The log is never edited |
One store per $MEMORY_DIR; none within it |
A 426-token prompt block pasted into AGENTS.md or CLAUDE.md | None, by design — every compression is requested inline in the
output of note |
None; the log is append-only and everything derived is rebuildable from it | Detail decays by geometry, not policy, and no job can rewrite memory behind your back | No licence file; no scope, trust, or correction of the log itself |
orbital |
A markdown entry with a machine id — a DECISIONS heading, a numbered LESSONS item, a PROJECT_STATE bullet — stamped with id, created, touched and an optional pinned tag in a one-line HTML comment; and an ask, which is a line of events rather than a record | Plain files in the project folder under orbital: four budgeted Layer-1 files, their read-on-demand archives, and ASKS.md | Whole-file injection each turn, capped per file by a budget derived from the active model's context window; over the cap the newest entries within budget are shown plus the oldest three, with a note saying what was omitted | The agent's write and edit tools, routed through a per-file chokepoint that stamps ids, re-applies the format contract and enforces the append-only rule on the asks log | Nothing is deleted. An oversize durable file demotes its coldest entries to an archive and leaves an addressable pointer in their place; PROJECT_STATE moves only lines older than a fourteen-day probation window and stays over budget rather than cutting recent work; INDEX alone is tail-trimmed, because it is regenerable navigation | One project folder per project, with the memory-file router resolving symlinks and requiring the parent directory to be the project's own orbital directory; no scope key reaches a query | A desktop app for Windows and macOS with a daemon, a web Workbench, a calendar hub, and worker agents driven over Claude Code, Codex and Cursor transports | A session-end pass: a deterministic size backstop that never calls a model, then an LLM memory editor that proposes archives, merges and ask closes by id, behind a mandatory backup and a single-flight lock | No epistemic state on any entry. An ask carries a lifecycle — open, done, dropped, reopen — with the actor on every close; a durable entry carries only a pinned tag and its touched date | A demotion path that refuses to move an entry with no id, on the stated ground that an unaddressable entry could not be recalled; an archive written before the live file shrinks, with the failure branch leaving the live file intact; and a set of rules written as comments beside the code that each name the incident that produced them | The dropped-ask refusal keys on exact normalised text while the fuzzy matcher built for that job sits in a module with no callers; the format contract the agent reads is normalised over whatever the agent wrote, so a project cannot keep a local variant; and the budgets are tuned to one named model, with everything below roughly eighty thousand tokens falling back to a proportional scale |
orgtree |
A Markdown file in the agent's scratch folder: CLAUDE.md as curated standing notes and breadcrumbs.md as an append-by-convention log. Archived sessions (knowledge bearers) and a hash-checked handoff record per session boundary sit beside them | Plain files under scratch/SLUG/NODE, shared by every generation of one seat; the node records, bearer lineage and the cheap_compacted marker live in the org's PostgreSQL store | None by relevance. The CLI loads CLAUDE.md at session start, or the engine mirrors it into the managed prompt on lanes that do not; the newest 12,000 characters of breadcrumbs.md are spliced into the first turn after a cheap compaction; anything else is read by the agent with its own file tools or orgtree_read_scratch | The agent edits its own files with its CLI's file or shell tools, prompted by the managed system prompt to append to breadcrumbs.md as events happen. No engine verb writes either file | Edit or overwrite the file. A user-only delete removes the scratch folder; retiring keeps it. No tombstone, no version kept by the engine | Physical: one scratch folder per seat. Cross-agent reads pass an access check: self, descendants in the org chart, or earlier holders of an open docket item the reader is listed on | Managed system prompt for Claude Code, Codex, Antigravity and OpenRouter lanes; MCP tools orgtree_read_scratch, orgtree_read_transcript, orgtree_cheap_compact and orgtree_rehire; a warm-process identity hash that respawns an agent when its notes change | None for memory content. An opt-in auto cheap compact replaces an idle session when its context passes a set fraction; the boundary exports the transcript and publishes a handoff record | None on the notes. The handoff record labels every quoted line as a claim with a cited transcript line, and its prompt splice is behind a flag file nothing in the tree creates | One promise made true on every provider lane by mirroring the notes into the prompt; first-turn-only breadcrumb splice with declared truncation and a no-fabrication fallback; memory edits move the warm-process hash; item-scoped cross-agent reads pinned by refusal tests | The notes have no structure, provenance or status; breadcrumbs.md is append-only only by instruction; the scratch transcript copy keeps only the newest predecessor; the handoff record's rejected-forgery tests are cited in a file absent from the tree; breadcrumbs.append_note has no production caller |
ori-mnemos |
A markdown note in a vault, with wiki-links as graph edges | Markdown on disk with a SQLite index; git as the version control layer | BM25, embeddings and PageRank fused, with per-stage gating by a contextual bandit | Notes written to the vault; the index derives edges from wiki-links | Vitality decay and ACT-R base-level activation; nothing marks a note wrong | One vault per project directory; no scope key found on the read path | An MCP server, a CLI, adapters, a scaffold, Smithery packaging | Hebbian co-occurrence from retrieval patterns, importance and vitality recomputation | Vitality and importance as floats; nothing discrete and nothing epistemic | A warmth audit recording each result's base rank, final rank and the movement between | The README's numbers do not appear in the bench README's, and no run artifact is committed |
origintrail-dkg |
A Knowledge Asset — a named set of RDF quads in a context graph,
with a lifecycle subject in _meta carrying state, layer and
per-transition PROV events, and on Verifiable Memory a Merkle root
anchored on chain and a protocol-stamped trust level |
A local triple store — managed Oxigraph by default, Blazegraph supported — with named graphs per context graph, layer and agent, a file-backed snapshot store for shared memory, and Knowledge Asset commitments on Gnosis or Base | Read-only SPARQL scoped to a view — working, shared or verifiable memory — with an optional minimum trust level on the verifiable view; the OpenClaw memory slot fans a literal-substring scan over three layers in two context graphs and ranks by layer weight | Additive quad writes to a Working Memory draft, sealed with an EIP-712 author attestation, shared by gossip to peers, and published to chain for a fee; chat turns persisted by the agent adapters | Drafts are discarded and recreated; a published asset is updated by
a new committed version linked with prov:wasRevisionOf;
shared memory is TTL-bounded and its snapshots garbage-collected by age
and free space |
Context graphs with allow-lists and on-chain access policy, sub-graphs within them, and a Working Memory graph per agent address checked against an agent-scoped token | A daemon HTTP API and CLI, adapters for OpenClaw, Hermes, ElizaOS and Prime Agent, an MCP server set up into Cursor, Claude Code and others, and a node UI | Gossip replication and catch-up for shared memory, async share and publish jobs, chain reconciliation, random-sampling proofs, and snapshot garbage collection | Trust levels SelfAttested, Endorsed, PartiallyVerified and ConsensusVerified, written only by publish, endorse and verify confirmations and filterable on verifiable-memory queries when a caller asks | A clear private-to-shared-to-anchored progression with each step an explicit call; trust metadata that authors cannot write; per-agent Working Memory isolation tested in both directions | Agent recall is a keyword CONTAINS scan that ignores trust levels; the lifecycle event history can be skipped in lite mode and swept on re-create; an operator token reads every local agent's drafts |
osiris |
An object of a declared type with graded properties, links and provenance; an assertion is one source's claim about a property, chained to the one it replaced | PostgreSQL 16 with pg_trgm: objects, assertions split
across a hot and a cold table, links, an object_events log,
audit_log, a durable outbox, and embeddings as
real[]; a Redis 7 event bus |
One search over active objects fusing strict full text, OR-relaxed full text, trigram and local static embeddings by reciprocal rank, weighted by evidence grade and recency; graph traversal and a per-object provenance timeline beside it | One actions layer; parsers declare an evidence class and the confidence is derived from it; a write that repeats a source's current value moves its observation time instead of adding a row | Within-source supersession by a new row; merges, status changes and renames as events with a projection, undone by compensating events. A daily job deletes audit rows past 90 days, duplicate audit rows, no-op re-assertions and old layout rows | One graph for every agent and project; reflections alone are house-scoped on the search, provenance and select reads | A streamable-HTTP MCP server, Claude Code hooks for prompt, tool and compaction events, a CLI, and a bridge plugin for the DeepSeek Harness | An arq worker running cron heartbeats: retention, storage housekeeping, embedding backfill, mining, crawl frontier and dissemination | An evidence-class taxonomy behind every confidence, a lifecycle status every search route filters on, provenance on every property and link, and event rows for every identity and lifecycle change | The evidence module names the defect it replaced: "every parser invented its own confidence number (0.4 → 0.99) with no shared meaning". A parser declares how it knew — self-declared, authoritative API, direct observation, derived, co-occurrence — and the confidence is "a projection of the class, not a guess". Corroboration is not a class a parser may store; the crawl frontier computes it from two or more distinct sources at read time. The lifecycle status is enforced where it matters: every route of the agent's search requires an active object, and the embedding index drops an object that leaves active, so a merged or retired object cannot return through the semantic route either. Supersession is within a source, so one source correcting itself never silences another. Merges, unmerges, status changes and renames are events carrying a justification, undone by compensating events. Reflections are house-scoped on the search path, with tests asserting that another house's caller gets no hit | The append-only rule is stated in the module header and the README
and relaxed by the system's own housekeeping: a default-on daily job
deletes audit rows older than 90 days, retires audit rows that repeat an
assertion, deletes superseded assertions that restate their predecessor,
and deletes old layout assertions, all through raw SQL outside the
actions layer. A repeated observation moves the existing row's
observed_at in place. Work knowledge is fleet-readable by
design. The reflection boundary is not applied by dossier
or list_assertions, which return any object's current
properties by reference, and the search and provenance functions take
their reader from a caller argument that a saved
composition can set to the operator. Search ranks by grade and withholds
nothing by grade, and it never computes corroboration |
osk-system |
A Markdown node file with a fixed six-field frontmatter (id, created, updated, author, drafter, summary) and optional derived-from and conflicts edges; plus one 1,500-character scope memory note per scope, and append-only transcript rounds as evidence | A Git-backed vault directory: nodes under 00_Scope, 00_Domain and 00_Person, transcripts under each scope's _raw, and JSON Lines ledgers with UUIDv7 ids and causal parents under 00_Scope/Workbench/_ledger | Character-bigram BM25 over every node's title, summary and body, rebuilt from the files on demand; Workbench transit and governance nodes excluded; an exact title sorts first; no scope, author or recheck filter. read_node by title or id, read_raw by round coordinate | Agent-driven through MCP create_node and update_node, prompted by hooks at input turns 9 and 15 or run in a background fork of the same harness after every 9 final answers; a scheduled growth runner distills Scope into Domain. Full rewrites need the read hash or a unique anchor | update_node edits in place under a hash or anchor check; no delete verb on any surface. Scope memory is edited by anchors and refused over its cap, and lines cut after a refusal go to an evictions ledger. Removal is a file deletion in Git | Physical: one directory per scope, one scope memory file per scope, sessions bound to a scope in a routing ledger. Writes are confined to the bound scope and cross-scope citations are refused; search reads every Space | MCP stdio server with 12 tools; SessionStart, UserPromptSubmit and Stop hooks for Claude Code, Codex, Kiro and Antigravity; a CLI; Obsidian as a viewer; an optional Git sync daemon | Background review forks in the source session's harness; a scheduled growth runner with plan, review, eviction and recheck queues; recheck candidates whenever a cited target's body hash changes | None as a filter. author is fixed to agent for every MCP write and nothing reads it; protected regions keep an approved snapshot a person can approve or revert through a terminal-only CLI, but reads serve the working copy | Evidence down to the transcript round with a body-hash recheck that propagates along citations; append-only ledgers with causal parents that survive multi-device union merges; CAS on every full rewrite; authority verbs kept off the MCP surface by an AST check; a scope memory cap that refuses rather than truncates | Search spans every scope while writes are confined; the recheck cascade stop and the Person-space confirmation rule are prompt or governance text, not refusals; node creation and edits leave no ledger record outside Git; the delegation check holds whether or not a delegation is approved; one maintainer and governing documents in Korean only |
ostk-recall |
A claim — kind, claim_key, subject, predicate,
value_json, text, polarity, confidence and a validity
interval — beside a separately-ingested corpus chunk |
SQLite for claims, the concept ledger, the audit tables and the access chain log; LanceDB (Arrow plus Tantivy) for chunk vectors and BM25 | model2vec dense vectors and Tantivy BM25 fused by RRF, an optional cross-encoder rerank, and a diffusion walk over both the reified and latent halves of the concept graph | Two MCP tools, recall and remember;
record_claim inserts inside one transaction with an
idempotency receipt, and ingest runs as a separate scan-and-embed
pipeline |
Supersede with a superseded_by chain, retract, forget
and restore as state transitions on the claim id; forget
reports an anti-resurrection tombstone that no write path consults |
A project column on claims and chunks, compiled into
the LanceDB filter predicate on the read path and indexed as
(project, claim_key, state) in SQLite |
An MCP stdio server or a shared local-socket daemon, plus an ambient memory-lens resource aligned to the current attention vector | A turn observer, an auto-weaver linking new chunks to thread anchors, an idle curator that fades inactive threads with hysteresis, and a consolidation pass that promotes latent bridges | A seven-value state — active, disputed, unsupported,
superseded, retracted, suppressed, expired — driven partly by an
automatic conflict detector, plus a separate confidence
float, a polarity flag and an origin on every
concept edge |
Edge conductance derived from confidence and recency rather than
stored, promoted bridges that must earn their conductance or decay, and
a conflict detector that moves claims to disputed and back
without a human |
The forget warning asserts an anti-resurrection
property the code does not implement, and nothing committed asserts that
a suppressed claim stays out of a recall result |
otis |
A session event in an append-only JSONL log; a fact, one Markdown bullet with an optional source and added date in a topic file indexed by MEMORY.md; and a skill, a directory of Markdown loaded by name | Files under the platform data directory: one directory per workspace, named for a hash of its absolute path, holding its session logs and its memory folder, and a global memory folder beside them; directories 0700, files 0600 | Each scope's MEMORY.md is placed in the system prompt. The recall tool ranks workspace and global facts by how many whole query words they contain and appends up to eight transcript excerpts from every workspace except the asking session. Skills load by name | Every prompt, response, tool activity and compaction is appended as an event. Facts are appended by the remember tool, the /memory command, the desktop settings page or an import of Claude Code, Codex or Gemini CLI memory, after a regex redaction. Skills arrive by an explicit install | forget removes the one fact whose text matches exactly or by substring and rewrites its topic file; a memory folder that is a git repository gets a commit per change. A session can be deleted or not written with --ephemeral; a skill is updated by git pull --ff-only | Facts are workspace or global by directory, and recall reads both. Session excerpts in recall come from every workspace. The workspace directory is the basename plus 12 hex digits of a sha256 of the absolute path, and workspace.json records the path | The agent is the product: a terminal UI, a headless CLI, an Electron desktop app and an otis serve daemon, over managed llama.cpp, Ollama or OpenAI-compatible servers and several hosted providers, with nineteen tools including skill, recall, remember and forget | None over memory. Compaction runs in the turn loop at a token threshold, routines run scheduled prompts as ordinary sessions, and nothing rewrites the fact store on a schedule | No epistemic state. A fact holds until forgotten, a skill is trusted because it is installed, and the memory prompt tells the model the repository and the user's instructions win on disagreement | Compaction is lossy for the model and lossless for the store, because the session log is never rewritten and an in-turn checkpoint archives the segment it summarises. Facts are plain Markdown a person can edit, committed per change when the folder is a git repository, and both remember and recall pass a credential and personal-detail redactor | A remote skill is pinned to a URL and not to a revision, while the bundled skill is content-addressed and the binary checksum-verified. Recall returns transcript excerpts from every workspace to whichever model is answering. remember and forget run without asking under the interactive default auto mode. A moved project starts with no sessions or workspace facts under its new path |
ouroboros-agent-os |
A ledger entry — one decision about one specification key, carrying a value, a source, a confirmation authority, a confidence and a status; plus the acceptance criteria and ontology fields those entries crystallize into | One global SQLite event log at
~/.ouroboros/ouroboros.db for the audit trail, JSON state
files at 0600 under ~/.ouroboros/data/ for content, and
content-addressed blobs under .ouroboros/artifacts/ |
No search of any kind. State is replayed by aggregate id, or
projected per project through a filter on a stored
project_id that raises rather than truncate past its run
limit |
Synchronous. An answer is classified at the moment it is recorded, conflicts resolve against a fixed source-priority ladder with no model in the loop, and the entry is durable before the turn continues | Append-with-demotion — a superseded entry becomes WEAK and keeps its value and a written rationale. Artifacts expire by TTL and per-contract retention, and a replay after pruning raises rather than return empty | A project_id derived from the project root and
validated against it on construction, written onto session events and
applied as a read-path filter; a partial identity is rejected, not
repaired |
An MCP server plus a CLI, driven from fourteen named agent hosts; the harness talks to the ledger through tools, and the interview is answered through a surface a person and the auto driver both reach | None over memory. Evaluation and execution run as jobs; nothing re-reads or rewrites the store on a schedule | Two orthogonal axes — what authority a value rests on, and how the decision was reached — with the two model-derived provenances gated behind an ambiguity threshold before a spec may execute | An adopted fact is structurally barred from becoming a requirement, and four separate render surfaces are pinned by one parametrized test asserting the fact never appears | The belief is scoped to one build. Nothing carries from a finished run into the next one, so every project starts from an empty ledger and re-derives what the last one settled |
outworked |
A (scope, key) → value row in
memory_entries |
better-sqlite3 in the Electron main process, with a versioned migration table | LIKE %q% over key and value within one scope, newest
first, limit 200 |
remember upserts on (scope, key); no
extraction, no model call, no background pass |
Upsert overwrites the value in place; forget is a hard
DELETE with no record |
global, agent:<id>,
project:<path> — documented in the tool description
and taken from the caller's argument |
An always-mounted MCP server exposing remember,
recall and forget to every agent, plus IPC for
the renderer |
None on the memory path; a cron scheduler and triggers drive agents, not memory | None — no status, no provenance, no confidence, no timestamps beyond created/updated | A zero-LLM capture path, an escaped LIKE, and a scope vocabulary stated where the model reads it | The session knows the agent id and injects it into other tools; the memory tools take the scope from the model instead |
ownmem |
A markdown topic in the repository with front matter, carrying a lifecycle, a logical type, a risk tier and scope tokens | Files in the git working tree — topics, a candidate ledger with a rejected map, append-only promotion receipts and daily JSONL event files | A feature-weighted lexical ranker over tokenized topics; scope tokens are one scoring feature among many rather than a filter | Extraction proposes candidates; nothing reaches a delivered context
from candidate, and promotion is a decision record with a
risk tier and an automation mode |
A refusal is kept — rejectMemoryCandidate requires a
reason, retains the summary, and later extractions of the same digest
are suppressed |
Scope tokens on a topic contribute to the ranking score; there is no stored scope key applied as a filter on the read path | A CLI, a Claude Code plugin, a Gemini extension manifest, skills and commands — all reading and writing files in the repository | None over the store; extraction, duplicate auditing and benchmarking run on demand | A nine-value lifecycle from observed to superseded, with R0-R5 risk gating whether promotion may be automatic at all | A rejection ledger keyed on a digest of the observation, with the reason required; schema-level invariants that bind a hand-built decision, including that the control plane cannot promote itself | The rejection digest includes the first failure timestamp, so a fresh failure run of the same identity is not suppressed; scope is a ranking feature, not a boundary |
ox |
Several, in two repositories. In the team context: MEMORY.md, the server-written daily, weekly and monthly summaries, and observations, written as Fact JSONL, one new file per put. In the project ledger: session records, murmurs, plans with an events log, and plan feedback. Recorded discussions carry server-distilled atoms with valid_from, valid_to and superseded_by | Two git checkouts provisioned by the SageOx server: a team context per team holding MEMORY.md, SOUL.md, TEAM.md, memory/ and discussions/, and a sparse ledger per project repository holding sessions/ and data/ | MEMORY.md injected at session start up to 200 lines, with the summary directories advertised by file count. On a prompt that looks like recall, a hook injects up to four hits from an in-memory term-frequency search over the ledger's sessions, murmurs, plans and plan feedback from the last 90 days. ox query sends the query to the server's search by default | ox memory put writes its observations to a new UUID-named file under memory/.observations and commits it under the team-context repo lock; ox memory distill posts pending observations to the SageOx API, which writes the summaries | Nothing in this repository rewrites a memory entry. Each put writes a new file; the summaries and discussion distillations are server-written; a plan revision overwrites plan.md and appends a lifecycle event; git keeps the history | Separate checkouts: one team context per team, one ledger per project repository, and a server-side team-membership check before discussions are read. ox query passes caller-supplied team and repo ids to the server, whose filter is not in this repository | A CLI with hooks for Claude Code, Gemini CLI, Codex, Cursor, OpenCode and others, a Claude plugin, agent priming, session upload, and a daemon that pulls and pushes both repositories | A daemon syncing both checkouts and, when an environment variable names an LLM binary, running a tiered conflict resolver on ledger pulls; server-side distillation of observations and discussions | An LLM binary allowlist; a merge post-condition that refuses output missing any conflicted line or holding a duplicate key; a hard-deny list keeping MEMORY.md and memory/ out of accept-theirs; a lint test pinning the recall hook to local-only search; secret redaction before session upload | The comment on the ledger's DefaultResolveRules is engineering judgement written to be checked: it names the failure (a deterministic wedge that never escalates and never self-heals), quantifies it (341 ahead and 1,055 behind for 13 days with 281 conflicts), names the canonical source of each auto-resolved artifact, and ends its SAFETY note with do not weaken that guard. The LLM merge tier counts every non-blank line on either conflict side and refuses output that drops one, and a conflict where both sides rewrote the same line is left for a person. Memory entries are conflict-free by construction: every put writes a new UUID-named file | Distillation, the step that writes the summaries agents read, runs on the SageOx server, so what a team remembers is decided outside this repository. The merge post-condition counts lines kept and not lines added, so a merge that keeps both sides and inserts a sentence neither wrote passes. Recall and prior-art search read plans without their lifecycle status, so a superseded or abandoned plan resurfaces beside the live one. Discussion atoms honour a rejection on read, but the rejection is written by the server, and draft and finalized distillations are served identically |
palazzo |
A verbatim text with four free-text taxonomy tags — category, wing, room, hall — and five temporal-validity columns | One Qdrant collection of 768-dimension points, plus an append-only JSONL write-ahead log on local disk | Cosine search with optional facet, time-range and author filters,
and an opt-in score × exp(-age/half_life) re-rank |
Agent tool calls over MCP; a duplicate probe runs before every write and short-circuits only on an exact text match | palace_supersede stamps valid_until and
superseded_by and the read path hides them; two hard-delete
tools with a confirm flag and a count-echo guard |
None by default. One collection, one palace; author is
an unverified optional facet and the taxonomy tags are categories, not
tenancy |
An MCP server over stdio or streamable HTTP, eleven tools, no UI | None. Every operation is synchronous inside the tool call | author is a claimed, unverified email the code itself
calls provenance rather than proof; nothing grades a memory's
content |
A destructive operation that aborts when its own audit entry cannot be written, and a dedup probe that deliberately refuses to match superseded points | The duplicate probe reports on cosine alone while the writer short-circuits only on cosine plus an exact text match, so the probe calls a paraphrase a duplicate and the writer stores it; the human approval is a sentence addressed to the model |
paperclip |
A markdown page under wiki/ in a company's configured local folder: source summaries, entities, concepts, synthesis, and per-project standup, index, decisions and history pages. Raw sources sit beside them under raw/ | Markdown files in a plugin-declared local folder, one subfolder per non-default space; a Postgres namespace holds page and source metadata, revision rows, operations, query sessions and distillation cursors, runs and snapshots | Tool-mediated. wiki_search is a case-insensitive substring match on page path and title and on source path, title and URL, never on page text. The agent reads wiki/index.md first, then pages and raw sources by path. Nothing is injected into other agents | The managed Wiki Maintainer agent writes pages with wiki_write_page while running ingest, distill, query and lint operation issues; the board writes through the plugin UI; a deterministic distiller templates project pages from issues, comments and documents and auto-applies them unless a bundle warning or a public deployment forces review | Overwrite in place with an optional expected-hash check; contradictions are marked in prose by an instruction to add a callout. No delete tool, no tombstone; a review_required distillation discards its proposed patches | company_id and space_id on every row and in every metadata query, both taken from tool arguments; plugin SQL is not bound to the invoking run's company. Spaces are also physical subfolders. Personal and team access scopes are stored and not enforced | Experimental bundled Paperclip plugin: ten agent tools through the tool gateway, hidden plugin-operation issues assigned to a managed claude_local agent, three paused routines, a board UI with a query stream and file-as-page | Three managed routines, all paused at install: cursor-window processing every 6 hours, nightly lint at 03:00, index refresh hourly. Paperclip events only bump distillation cursors | None on pages. Distillation runs carry a review_required status and patches a confidence label that is returned and not stored; secret-like comment and document bodies are suppressed before distillation | Provenance-heavy distillation records: source snapshots, cursors, run rows and page bindings keyed on source hash; stale-hash refusal on writes; control files protected from agent writes; secret suppression with a committed test; auto-apply refused in authenticated public deployments | Scope values are tool arguments and plugin SQL is not company-bound, so metadata tools read another company's page titles; search never reads page text; review_required discards the proposal it asks a person to review; revisions keep hashes, not text or author; issue descriptions are not redacted |
papez |
A node with a summary, optional full content, an embedding, a consolidation status, a decay score, causal weight, reactivation count and timestamps, a stability term, a pinned flag, a category and entity references, plus an owner, an org id and a visibility | An in-process causal graph with optional JSON persistence, partitioned per user; the hosted service's Postgres backend is not in this package | Vector search, keyword search and graph traversal combined, then reranked by spreading activation, a date-anchor window when the question carries an absolute one, and a multiplier that pushes superseded hits down | An MCP store tool that embeds, auto-links, runs contradiction detection against high-similarity neighbours and can record an explicit supersession through an amend tool | Correction is a new node with a SUPERSEDES edge and the old node's status deliberately left alone; forgetting is a hard delete of the row, gated on five conditions holding together | Per-user partitioning inside the store plus an org-visibility union, resolved from request-scoped identity that raises when unset | A stdio MCP server, a Dockerfile, a PyPI package and a compatibility shim under the project's former name | A maintenance loop on a cadence: rescore every non-core node, evaluate status transitions, then sweep for forgetting | A consolidation ladder — tagged, active, episodic, semantic, core — plus dormant, and contradiction and supersession as edge types. Supersession lowers a hit's rank and labels it; no read withholds a memory on any of these | A forgetting rule whose fifth criterion exists because the other four fire immediately, with the reasoning written down; a contradiction heuristic whose stopword and unit handling each cite the false positive that produced them; and a benchmark claim published with a frozen protocol, a stated oracle ceiling and a separate reproduction harness | Forgetting deletes the row outright, so a pruned memory leaves nothing behind and the pruned status in the enum is never set by anything; a superseded memory is ranked down and tagged rather than withheld, so a caller that ignores the tag sees a correction and the thing it corrected as peers; and the configuration namespace is still the project's former name |
particles |
A particle: one claim-granular sentence with confidence, uncertainty kind, asserting principal, status and reason, subject ids, tags and provenance refs to corpus snapshots; corpus entries hold the verbatim source | SQLAlchemy over a local SQLite file by default or Postgres; embeddings as JSON on the particle row; a content-addressed blob store for the append-only corpus | Cosine over every ACTIVE embedding loaded per query, filtered by tag, subject, structured claim, recency and an optional project observer, ranked by effective confidence composed from trust, recency and utility at read time; an LLM answer cites the hits; a zero-LLM digest at session start | Deposit then LLM claim extraction, inline or in a nightly cycle; agents assert one claim at a time over MCP with an excerpt deposited as provenance. Every candidate is routed: exact-duplicate suppression, retired-value hold, then the conflict ladder | Nothing is edited. Supersede and retract move status; a contradiction quarantines the newcomer behind an INCONSISTENCY record; operator corpus delete is the one hard delete | One store per database; an optional project observer derived from project tags on the source corpus entries, honoured only when the MCP server is launched bound or the hook config says project, and only after a rescope has run; lifted by an all_projects argument on every scoped tool | Read MCP server with eight opt-in write tools, a drop-in replacement for the reference memory server, Claude Code session-start digest and session-end harvest hooks, FastAPI HTTP engine, CLI, LangChain retriever and tools, exporters | A nightly consolidation cycle: extract catch-up, reconcile sweep, contradiction census with an LLM second reading, disclosure records, curation queue, utility mining, MEMORY.md projection | Discrete status with a quarantine; value tombstone on judgment retirements; review via CLI or HTTP turns rulings into source-trust statements; agent writes clamped to 0.90 confidence and own-beliefs-only | Server-built trust, status and identity on agent writes; a retired value held for review on both write paths; a transition table enforced at one seam; an append-only operator event log; a published LongMemEval headline that recomputes from committed per-question records | Project scope is opt-in and widenable by the caller; brute-force cosine over every ACTIVE row; review DISCARD does not arm the tombstone; with the default dev-key a loopback engine accepts operator mutations and review with no credential, against its own comments |
pensyve |
Four kinds behind one enum — episodic, semantic, procedural and observation — each carrying a salience set at encoding, a monotonically increasing storage strength, an event time distinct from the encoding timestamp, supersession pointers and an invalidation time, and agent and user scope columns | SQLite or Postgres with pgvector behind one storage trait, the Postgres side carrying row-level security policies forced on every policied table | A retrieval engine fusing vector, lexical and graph signals with reciprocal rank fusion, a reranker, activation and decay, every query bound to a namespace and filtered on supersession in the statement | Observation, extraction and consolidation pipelines, with a surprise signal, a salience estimate and a classifier deciding what is kept | A supersede path stamps the prior memory with its successor and an invalidation time rather than deleting it; a GDPR module and a namespace export handle removal and portability | A namespace id as a predicate in every handwritten statement, with forced row-level security as an independent second layer on Postgres, plus agent and user columns for multi-tenant scope | An MCP server, a gateway with a REST surface, a CLI, and bindings for Python, Go, TypeScript and WebAssembly | Consolidation, decay, embedding migration across versioned embedding spaces, snapshots, and a mesh and sync layer for peers | Supersession and invalidation bound in the read, and kept out of the erase and purge paths on purpose; a salience at encoding and a storage strength that never decays; a reliability score on procedural memories. No approval surface | Two scope layers whose tests each disable the other so neither passes for the wrong reason; a sabotaged-statement test that proves the backstop without the predicate; two documented ways row-level security had been silently inert, both fixed; a startup that reports the role's own exemptions because a BYPASSRLS role makes FORCE enforce nothing with no other symptom; and supersession filtered inside the statement rather than after the fetch | The activity feed is written at the tool boundary with its result
discarded, so a mutation reaching storage another way leaves no row and
a failed write is silent; event_time is stored as distinct
from the encoding timestamp and nothing reads the store as of a past
moment; and four dependency manifests changed inside the seven-day
cooldown |
people-context |
A person, with facts (a predicate, a value, a validity period, a recording time, a confidence, a sensitivity and provenance), observations, interactions, traits backed by typed evidence links, relationships in a vocabulary, groups, organizations, preferences and reminders | One local SQLite file; no account, no cloud, no network call | Person resolution first, then the stored context for that person; timelines, upcoming reminders and insights, each bounded by the ordinary sensitivity levels unless widened | MCP tools and a pctx CLI; imports are extracted, staged
into import_staging, reviewed, then committed by named
candidate id |
A fact carries a validity period and a recording time — the domain calls it "bitemporal-lite"; erasure logic works against the staged shape as well as the durable one; vault export renders a relationship from the exported person's perspective | Sensitivity as the disclosure key — PUBLIC,
PERSONAL, SENSITIVE, RESTRICTED —
with ordinary reads bounded to the first two; the store itself is one
person's local file rather than a multi-tenant service |
An MCP server and a CLI, with an Obsidian plugin, an OpenClaw
plugin, an mcpb bundle and skills |
Import extraction and staging, consolidation insights, source cursors for incremental import | Per-fact confidence and provenance, typed trait evidence links that name the record type as well as the id, import provenance carried through commit, and sensitivity levels that bound disclosure | A default-narrow disclosure rule with the widening made explicit; a selection parser that refuses a whole selection on one unknown member rather than committing the part that parsed; a staging model whose docstring reasons about which validations belong at which boundary; an eval suite with a committed fixture world and must-not rubric items | Sensitivity bounds what ordinary reads disclose but this is a single-user local store, so it is a discipline rather than a boundary between principals; the validity period is carried on a fact and no read path found here gates a query against a past instant, so "bitemporal-lite" is the honest description; the subject is personal data about third parties who never consented, which the project handles carefully and cannot solve |
perseus-vault |
An entity — category, key, JSON body — carrying status, type, layer, certainty, verified flag, decay score, and bi-temporal bounds | One SQLite file with FTS5, AES-256-GCM bodies encrypted by default on a fresh install, an entity history table, a hash-chained journal, sign-bit embedding signatures, and a rejected-value tombstone table holding digests | Hybrid BM25 (FTS5) plus dense vectors fused by RRF, with a Hamming
prefilter on embedding sign bits and workspace filters applied in the
query; every recall carries a RecallOutcome naming why it
is empty or degraded |
MCP tool calls into a Rust binary; supersession writes history rows
and sets superseded_by, with a trust-admission path in
front |
Supersede, correct, demote, archive with a reason, forget, and purge — purge erases history and redacts the journal; a rejected value is refused on every remember-path write by a digest-keyed tombstone that also follows derived provenance, so a summary of a rejected source is suppressed even though its own digest differs, with an audited trusted override | workspace_hash on entities and journal rows, a
(category, key, workspace_hash) identity index, and a
visibility column; applied in entity read queries and in
the journal listing, with a strict binding path beside the compatibility
one that refuses an unbound profile rather than treating it as an
unscoped legacy session |
An MCP stdio server with ninety canonical tools, plus LangGraph, CrewAI, AutoGen, PydanticAI and Praison adapters; one binary, no services | Decay ticks, cohere and dream passes, consolidation, hygiene scans, community detection | A discrete status, a separate
epistemic_state
(candidate/verified/corroborated/rejected/defensively_recalled),
a verified flag, a certainty float and a
source field — four distinct axes rather than one
score |
Three full benchmark runs per prompt variant with a config stamp, published means that recompute exactly, a claims audit that retires what it cannot back, and a blocking memory-quality gate whose required categories read like an acceptance suite | A database created before the default flipped stays plaintext until
an explicit init --rekey, the encryption key sits beside
the database it protects, and the new capability split is documented
fail-open when no authority manifest exists |
pi-jarvis |
A record of kind note (title, body, category user, feedback, project or reference, global or project scope) or conversation (one finalized user or assistant message), with lane, session and event provenance and created and updated times; its id is a SHA-256 of the scoped normalized title, or of the event identity | One node:sqlite file under the Pi agent directory, mode 0600 in a 0700 directory, WAL: records with an external-content FTS5 index and a tombstones table of ids. A separate opt-in archive SQLite file holds raw session entries and can be encrypted | FTS5 BM25 over title and body, title weighted 8 to 1, notes ahead of captures, terms quoted and ORed. Each request injects the 3 newest global notes, 5 notes by keyword and 2 captures from other sessions, capped at 6,000 bytes of escaped JSON. A search tool returns up to 10 | The model calls jarvis_memory_remember, an upsert on the scoped title; finalized visible user and assistant text is captured at turn boundaries; a person uses /jarvis-memory remember and edit or the TUI editor. Synchronous SQLite, no model call, best-effort secret redaction | Same-title upsert overwrites the body in place. Forget deletes the row and writes a tombstone on its id, which blocks every later automatic save under that scoped title until a person's explicit remember lifts it. The model's forget needs a human confirmation; bulk forget is human-only. Captures past 10,000 are pruned | A project key, the canonical cwd, on every record. The recall and the default search filter to global plus the current project, and get-by-id applies the same rule; the agent's search tool accepts scope all and widens to every project with no confirmation | A Pi extension mounted in the main session and in the Jarvis side session, three model tools, request-local context and policy injection, /jarvis-memory commands and a TUI editor; global, project and trust settings gate every tool call | None. Captures are queued on message_end and written on turn_end or agent_settled; retention pruning runs inside the save transaction | No status field. Recalled records are framed as untrusted historical data, with lane and session provenance, and the guidance tells the model to ask on conflicts | Identity by scoped title, so a rename or forget leaves a tombstone that refuses the model's next save of that title; request-local recall that is never written to the transcript; trust and policy rechecked at each tool call; a schema and integrity validation that refuses to open a store it does not recognise | The tombstone is keyed on the title, so the same fact under a new title is admitted; the model's upsert silently overwrites a note a person wrote; the agent's search tool reads every project with no gate, though the same repository gates the archive's identical widening; no record of prior values |
pi-memory |
An entry of a Pi session journal (a user, assistant, tool-result, bash, custom, compaction or branch-summary line), indexed by entry id, parent id, timestamp, kind, role, tool name, character count and the byte offset and length of its line | Pi's own JSONL session journals hold the text; a derived SQLite index holds file cursors, entry rows and a contentless FTS5 table of redacted terms, and can be deleted and rebuilt from the journals | One on-demand tool: BM25 full-text search with all-terms-then-any-term fallback and a one-month recency discount, a newest-first listing, a list of compaction summaries, and a paged read of one entry reread from its journal line; filters by local-day or ISO date range, kind and a project, session or global scope | No memory writes by the agent. The index follows the current journal on session start, message end, compaction and tree moves, and one process at a time backfills other journals under a lease | Index rows follow the journal: a journal that shrank is dropped and
reindexed from the start. /memory rebuild deletes the
index; /memory gc lists junk journals and
/memory gc confirm hard-deletes exactly those, if unchanged
since the preview, with their index rows |
A project root derived from the session cwd is the default filter; the agent may pass session or global instead, and a read by entry id is not scoped | A Pi extension registering one tool, memory_context,
and one command, /memory; it hooks no context, prompt or
provider event |
Incremental indexing in 12 ms time slices with a yield between them, a delayed backfill of older journals under a two-minute lease, and a user-run junk-journal collector | Secret redaction before terms are indexed and again on every returned text, FTS syntax quoted to literal terms, and a deletion that touches only the files a preview listed | The store keeps no second copy of anything: the index holds search terms in a contentless FTS5 table and a byte pointer into the journal line, and every returned text is reread from the journal and redacted on the way out, so deleting the index loses nothing. Secrets are redacted before they become search terms, and a committed test asserts a key is neither searchable nor readable. Nothing reaches the model unless it calls the tool, and a test asserts the context, prompt and provider hooks are not registered. The junk collector deletes only the files its preview listed and keeps any that changed since | The project scope is a default, not a boundary: global
is a value of the agent's own scope argument, and a read by
entry id is not filtered by project at all. A read seeks to the stored
offset and returns whatever entry parses there without checking its id,
and a journal is reindexed only when it shrinks. Redaction is
pattern-based and the journal keeps the unredacted text.
/memory gc confirm hard-deletes Pi's own journals, which
are the only copy. The curated-fact databases of earlier versions are
left on disk, and nothing in this tree reads or deletes them |
pi |
None — a session entry (message, compaction, branch summary or application custom entry), or a typed durable value or list under an application namespace, not a memory record | A session is an entry tree plus typed values and lists, behind JSONL, node:sqlite and in-memory backends | None; context is a branch walked to its root, custom entries projected by registered projectors, and discovered resource files; a session search interface ships without an implementation | Append to session; compaction replaces a range | None for memory; application values can be replaced or deleted and lists deleted whole, and a written fork policy decides which state a fork carries | None | Own CLI/TUI/SDK; 20+ extension events, none memory-shaped | Compaction and branch summarization | Deterministic readFiles/modifiedFiles on
compaction entries |
Deterministic file manifest kept out of the model's output; branchable sessions | No memory contract at all, so scope and deletion have nowhere to live |
pltm-claude |
Two competing units — a subject/predicate/object atom, and a typed_memories row | SQLite; an atoms + provenance schema and a separate typed_memories schema with FTS | FTS and embedding search, filtered by user_id, with strength and decay | A four-judge jury deliberates before the insert: approve, reject or quarantine | Rule-based conflict detection on subject, predicate and opposite-predicate matching | user_id is a WHERE clause on the typed-memory read paths | An MCP server for Claude Desktop with 136 advertised tools, plus a React dashboard | Consolidation, decay, embedding backfill | strength and confidence floats; quarantine is appended to the context string | Opposite-predicate conflict detection, which similarity search structurally cannot do | The headline 99% and 100% figures score the system against its own hand-written cases |
plur |
An engram — an id, a version, a status, a commitment, a type and a scope; a statement with a rationale and contraindications; lineage through source, derivation count, pack and abstract; activation strengths; typed relations and weighted associations; provenance with an origin chain and a reserved signature; attribution naming the runtime, model and tool that asserted it; a claim class; feedback and usage counters; and an optional temporal block, episodic block and insight block | Plain files under ~/.plur — engrams.yaml
is the source of truth, beside episodes, tensions, candidates, packs, an
exchange directory and a config; history/YYYY-MM.jsonl
holds the audit; SQLite, PGLite or Postgres may be attached as an index,
and the code is explicit that these are caches rather than truth |
BM25 with k1 1.2 and b 0.75 over a rewritten lexical query, optionally fused by reciprocal rank at k=60 with a local ONNX embedder over the original query, then an opt-in cross-encoder rerank. There is no relevance threshold in either leg; the fusion score is surfaced so a caller can apply one | The model authors the statement and it is stored verbatim — the only rewriting is stripping tool-call envelope artifacts and a derived eighty-character summary. Content-hash dedup against active engrams absorbs a repeat. A batch path lets a model decide add, update or merge, and a failure report has a model rewrite a procedural statement | Three correction paths with different memories. The batch dedup and the failure report both preserve the prior text in a history event with the deciding model as the actor; the direct update overwrites in place with no history event and no version bump. Forget decrements a reference count and, at zero, sets status retired — the row and its full statement stay in the YAML, and no pruning of retired engrams exists | A free-form scope string with segment-aware containment, a personal-family pass-through, mounted-store grants, and a separate exact-membership authorization filter whose empty list matches nothing | 43 MCP tools, a CLI, a Claude Code and an OpenClaw plugin manifest, a read-only loopback dashboard, a migration package, and Python packages for Hermes and LangChain | No consolidation pass on the memory. Sessions, packs and an outbox sync are explicit operations; the audit history is never synced | A five-value commitment where draft withholds from injection, a four-value status where retired withholds from retrieval, a claim class naming how a statement was arrived at, an attribution block naming the asserting runtime and model, and activation strengths used for ranking | A withholding state whose gate is enforced in the injector rather than in a caller; validity time separate from record time and filtered on both read paths; a scope filter whose empty grant matches nothing, stated in the source as a security rule; an append-only mutation history in the store's own directory; 4,893 committed test cases against 66,632 lines of source | A retired engram is excluded from the content-hash dedup by design,
so re-asserting it creates a new engram and a committed test pins that
behaviour; nothing in this repository can approve a draft, and the
schema points at a separate enterprise repository for the write sites;
the direct update path destroys the prior statement without a history
event; the candidate status is declared and assigned by
nothing, which leaves a shipped promote tool with nothing to act on; the
benchmark harness behind every published number was moved to another
repository |
plur1bus |
A LanceDB card with a version number and a link to the version it replaced, plus JSONL neo records carrying a status and a trust level | Per-agent LanceDB tables, per-agent JSONL neo store,
node:sqlite caches, and an optional Obsidian vault
mirror |
Vector plus lexical over LanceDB, graph hydration of neighbours, reranking before the final cap, at most two rows of one split message, a decision trace per recall, and additive lens and reactivation passes, all under one aggregate character budget | Deferred to the agent_end hook through a per-agent
scheduler; a long message with several independent statements is stored
as several rows linked by a group id; nothing blocks the reply |
safeUpdate writes a new version, then supersedes the
old row; the /forget chat command archives behind a
confirmation token, while the model-facing memory_forget
tool tombstones with no token at all and is on by default; either path
writes a durable content-fingerprint tombstone that every card writer
consults before adding new text; a claim carries a real-world validity
window separate from its record time |
checkAccess fails closed on agent-private, workspace
and user scopes, applied as a read filter in the adapter and the recall
pipeline; derived records stamp a visibility, filtered only
when a caller passes a requester, which the REM-dream reader does and
most others do not |
OpenClaw plugin — chat commands, an agent_end capture
hook, background crons registered through the host's public plugin
capabilities, Telegram accept and reject buttons on critical pushes, an
operator dashboard with opt-in write actions, and an Obsidian review
vault behind per-agent confirmation receipts |
Daily consolidation, which also caps and rewrites the neo JSONL files; garbage collection; skill mining; critical-push classification with a daily lapse of unconfirmed cards to plain notes; and two dream passes | Seven-state record status and a six-level trust ladder scored off
the newest revision, with demoted and
invalidated both withholding a record from recall outright
and conflict deliberately left as a penalty, plus an
append-only destructive-operation log |
A correction path that demands evidence, records the event, and orders its writes so a crash cannot lose the memory | Fifty-five config groups over one careful core;
conflict is a ranking penalty rather than a filter, and the
code says why — the detector is an unvalidated LLM and a live probe
found 4,017 newest-revision records carrying it; the drift gate is
skipped on the one human caller and fires only on the automated one; and
the reconsolidation log that holds every correction's evidence is capped
at its newest 5,000 lines |
pluribus |
One distilled statement row of kind constraint, decision, failure, pattern or state, with integer authority 0-10, applicability, status, optional occurred_at and agent_id, tags, a JSON payload and an optional embedding | Postgres with pgvector and a generated tsvector column; Redis caches search results and recall bundles; advisory experiences, candidates, contradictions, relationships, utility events and curation chores sit in side tables | Recall compile unions a full-text top-K, per-keyword ILIKE bridges, an authority-ordered fallback and a pgvector slice, filters by status and date, drops the losing side of unresolved contradictions, and ranks relevance times authority with tag, recency, salience and situational boosts | record_experience stores an advisory row and inline forms a probationary memory at authority 1 or 2 after junk and harmful-advice screens; memory_create writes directly, capped at authority 4; distilled candidates become memory through a curation call | Status moves only: supersede marks the old row superseded with deprecated_at and a supersedes edge; quarantine and soft delete set status and status_reason; TTL and idle probationary rows archive; no memory row is hard-deleted; exact duplicates reinforce instead of inserting | None by design: one global pool. Tags shape ranking and filter only the authority slice; agent_id is stored for attribution and corroboration and is applied to no read | HTTP MCP at /v1/mcp with 59 registered tools, 7 listed by default and all callable; REST API; Claude Code plugin with SessionStart wakeup and UserPromptSubmit recall hooks; rule packs for Cursor, Zed, VS Code, OpenCode and others | Hourly curation scheduler: archive expired TTL and idle probationary rows, open chores from contradictions and quarantine, scan embedding near-duplicates, backfill embeddings, prune rejected advisory rows; auto-promote is off by default | Status lifecycle: quarantined, deleted and rejected are excluded from recall and enforcement; pending is recalled at a 0.88 dampener; authority rises only on a distinct agent's use; agent-voted chores release quarantine to pending | Status filtered in SQL and again after the lanes merge; a deterministic harmful-advice screen quarantines poisoned lessons at ingest; self-use never raises authority; non-destructive supersession with historical recall labelled by lifecycle role; a CI-run lifecycle recall gate | recall_context's Activity lane reads advisory rows that quarantine and delete never touch; tools/list tiering hides tools that tools/call still runs; no auth by default and agent identity is a self-declared string; one vote releases quarantine in the shipped config; memory_create skips the harm screen and an authority-4 governing row binds enforcement at once |
pmb |
One row in the events table: typed content (fact, qa, activity, preference, summary, goal and others), a metadata JSON blob, importance, access count, a decay tier and an archived_at stamp. Lessons, failures and keyed facts are facts told apart by metadata | One directory per workspace under ~/.pmb/workspaces: events.sqlite as the source of truth, a LanceDB vector table, and a pickled BM25 index. Entity graph, arcs, dedup queue and lesson-surface log are further SQLite tables in the same file | BM25 plus dense vectors fused by normalised weights, entity-graph expansion, personalized PageRank, temporal and keyed-fact boosts, optional cross-encoder rerank, then importance and recency. A predictive cache can short-circuit it. Every fetch filters archived_at IS NULL | Explicit MCP tools (record_batch through a durable outbox, record_keyed_fact) plus hooks: a Stop hook journals the turn when the agent did not, and a prompt hook writes a draft lesson when a message reads as a correction. Exact and cosine dedup at write time; secrets redacted | forget archives and is reversible; delete --hard purges the row, vector and graph links. A keyed fact supersedes the prior value by archiving it with superseded_by and valid_to. A negating statement archives the current keyed value. No tombstone | Physical: one SQLite file and one vector table per workspace, chosen by env var, a .pmb/workspace.yaml, a persisted default, or a hash of the git remote or path. A project filter over metadata and content exists on the MCP recall tool and is optional | MCP server over stdio, a local daemon, or streamable HTTP with one bearer token. Hooks for Claude Code on UserPromptSubmit, SessionStart, PreToolUse, PostToolUse and Stop; rules appended to CLAUDE.md or AGENTS.md; CLI and a localhost dashboard | An embed queue and a write-outbox drainer. The daemon runs a maintenance tick every 24 hours of idle uptime: importance decay over every active row, archive of cold rows, conflict and declutter reports. Optional LLM passes for consolidation and borderline dedup | None. No status field; a correction draft is excluded from lesson lists by source, and the server instructions tell the model to trust any result scoring above 0.2 over code | Durable outbox makes the sub-millisecond async write crash-safe; every read path filters archived rows; hooks inject without the model calling a tool; lesson follow-through is measured with Wilson intervals and kept out of ranking; decay floors lessons and never deletes; secrets redacted at the persistence boundary | Restating a keyed fact's current value within 90 days archives the only current row; a negated keyed value is re-asserted by repair-keyed; the as-of query is reachable only from tests; git sync ships a pickled index by default; dashboard POST endpoints check no origin; the only default injection recall is unscoped |
polyphony-arc |
A per-game workspace of model-written files (the Heuristic System's engine, state I/O and planner code, hs.md, per-level reasoning logs and reports) plus a handoff summary written at each compaction and asked for under 2,500 words | Files in one run directory per game; the latest summary is also overwritten into progress_notes.md there. Nothing is indexed | After a compaction the successor gets a notice, a code-written state pointer that lists five model-written files as authoritative, the summary, and up to 20,000 tokens of its newest turns; otherwise the model reads and greps its own files | The model writes the files through its tools. At 200,000 tokens the harness asks it for the summary, rejects one that is tool-call markup, and keeps up to the 16,384-token generation cap; the 2,500-word limit is prompt text | Each compaction overwrites progress_notes.md and drops the previous summary from the history. Files are the model's to overwrite, except the recorded frames and eleven tooling scripts its file tools refuse | A fresh workspace per game run, copied from a template; nothing crosses games or runs. The file tools read any absolute path | A compaction check before every generation in each game's coding session, deliberately without per-turn trimming; a separate trouble protocol clears the conversation and restarts from the main prompt | None | None as a field. The state pointer is headed as code-written and to be trusted over memory, and its file listing as authoritative; the engine code is checked against the recorded frames by a verifier the model runs | The summary's stakes are stated to its writer; the state pointer is written by code rather than the model; source comments record the two failures the design answers; the recorded frames are refused to the model's file tools | No tests. The compacted context loses the main prompt; each summary is written without the previous one; the authoritative listing names only model-written files, one of them the previous summary; a summary cut off at the generation cap is accepted |
pond |
A message row in Lance — session_id, id,
role, source_agent, project,
content, search_text, a vector
and its embedding_model, a timestamp, and
parent_session_id/parent_message_id so a
forked or resumed session keeps its lineage. Beneath it a part row: an
ordinal, a type, a provenance of
conversational or injected, and for a tool
call a tool_name, a call_id and an
is_failure flag |
Lance columnar datasets in storage the user owns — a local directory or their own S3 bucket — with a row-id map for hydration, snapshots, and a sync-state record per source. Ingest is described as lossless: the transcript goes in whole, including the parts that will never be searchable | Two arms over the Lance datasets, hydrated from a row-id map so a
hit takes the exact row rather than re-finding it with an
IN predicate. search_text is the lexical
column and a vector column with its
embedding_model recorded beside it is the semantic one. A
SQL surface exposes the corpus for arbitrary queries, and results reach
an agent over MCP |
Adapters per harness parse a session and upsert messages and parts,
returning an UpsertStatus so a re-ingest is idempotent
rather than duplicating. search_text is computed at write
time from the conversational parts only, so what is indexed is decided
at ingest and what is stored is everything |
Re-ingest upserts rather than appending duplicates, and a sync-state record tracks what each source has already contributed. The archive is the point, so there is no forgetting pass, no decay and no deletion verb for a memory; what exists is a store the user owns and can delete at the filesystem or bucket level | project and source_agent are stored on
every message and are available as optional filters — the project filter
is a contains-or-regex predicate a caller supplies. Nothing is applied
by default: the corpus spans every tool and every project on the
machine, which is the product's argument |
An MCP server so an agent can query the corpus directly, a CLI, and Homebrew and Scoop packages. Sessions can be restored into any supported client and continued there, so a session is no longer locked to the tool that wrote it | A scheduler for periodic ingest, snapshotting, and a prewarm that builds the row-id map so hydration can take rows directly. No consolidation, no summarisation and no decay — the corpus is meant to grow | One discrete field, and it is about origin rather than truth: a part
is conversational or injected, and an unknown
value is a hard parse error rather than a default. Only conversational
parts reach the index. Beside it, is_failure on a tool part
records that a call failed. No confidence, no verification state and no
validity interval anywhere |
Storing the whole transcript and indexing only the part a person actually said, so harness scaffolding is preserved for reconstruction and cannot be retrieved as speech; an unknown provenance value that fails the parse instead of defaulting; a paired test that drives the real function on both arms; Lance columnar storage in a bucket the user owns rather than a database the tool operates; session restore across clients, which makes the archive useful for continuation and not only for search | No scope applied by default, so one corpus answers across every
project and tool on the machine and the filters are a caller's option;
session content is not redacted on the way in — the codebase redacts
credentials in pond config show and does nothing of the
kind at ingest, so a lossless archive of every session is a lossless
archive of every secret pasted into one; no epistemic layer at all, so a
wrong conclusion from a year ago ranks by relevance like anything else;
the provenance field is two-valued and decided at ingest, so a harness
whose adapter mislabels a part has no second chance to be corrected |
portable-handoff |
A labelled claim — text plus provenance,
trust, evidence_refs and
captured_at — inside a single Markdown capsule |
One Markdown file per capsule under .handoff/capsules/ in the repository, with an embedded canonical JSON document; stdlib only, no database | There is no query. load renders a fixed subset of the
newest or named capsule into a briefing and reports how far the
repository has moved; --format json and export
return the whole document or its prose half |
Two phases: preflight writes local git facts to a JSON
file, the model writes a draft, finalize reads both back,
re-hashes named files, redacts and budgets, and runs no git of its own;
trust is capped against the provenance each claim declares |
A capsule is never rewritten and validation refuses an edited one;
decisions carry active/superseded; there is no
delete, and capsules are related only by filename order |
One repository per capsule directory; the recorded root is re-checked on load and a mismatch is reported, not refused; no principal scope | A skill plus slash commands for Claude Code, Codex CLI and Cursor, a draft-only path for hosts with no shell, and read-only transcript adapters | None — every step is a command | Five discrete states; verified is downgraded to
claimed at parse time beside a conversational or inferred
provenance, while the draft author declares both fields and file and
evidence records skip the cap |
Repository facts and file hashes come from local git calls, never from the draft; the briefing states the capsule's age, recorded publication state and drift; the secret scan records that it ran | No state withholds anything, and verified is open to
any draft author who names a deterministic provenance; finalize trusts a
preflight file the agent can edit; what the budget dropped is printed at
finalize and not kept in the capsule |
potpie |
A typed context record — fix, bug pattern, preference, policy, decision, verification, or free-form — lowered into claims and edges in a per-pot context graph | A graph behind a port: FalkorDB by default with an embedded
falkordblite option, Neo4j as an extra, and NetworkX
in-process; claims, edges and invalidations all carry provenance
columns |
Claim queries filtered by pot, predicate, source system and time, with an optional native vector arm; invalidated claims excluded unless asked for | An ingestion submission validated against a discriminated-union schema per record type, then lowered to semantic mutations and applied as typed graph operations | InvalidationOp with a required reason
stamps valid_to and writes a SUPERSEDES edge from the
replacement, preserving the row rather than deleting it; there is no
delete verb for a claim |
pot_id is a required argument on every graph query and
on the claim filter, so the scope reaches the query rather than being
available to it |
A CLI, a daemon, an MCP surface and agent bundles shipped as skills for Claude Code and other harnesses | Reconciliation over ingested events, an LLM-planned mutation path validated before it is applied, and quality-issue creation as a typed mutation | A verification_status on a fix that starts
unverified and can become failed, a separate
verification record carrying worked / didnt_work / partial against an
existing fix, a confidence on the provenance, and an invalidation state
that withholds on read |
Every mutation carries provenance answering where a fact came from, when it was observed, when it was written and who produced it; an invalidation cannot be recorded without a reason; and a conformance test asserts the invalidated claim is absent by default | Invalidation is keyed on the entity or edge, not on the value, so re-extraction of the same claim under a new key is not refused; the approval gate guards the workbench commit path only, the reconciliation agent's plans apply through apply_mutation_batch without it, and approved_by is a caller-supplied string nothing verifies |
powermem |
An LLM-extracted memory row with retention metadata, plus distilled Experience and Skill records above it | SQLite, pgvector or OceanBase for memory; the skill and source stores are OceanBase only | Vector, FTS and graph fused by RRF, with recency and retention scores applied | LLM extraction with a simple and an intelligent path, plus background workers | Update and delete APIs; forgetting is a retention score falling below a threshold | user_id, agent_id and run_id built into effective filters and carried into the store | Python SDK, HTTP server, MCP, CLI, VS Code extension and a Claude Code plugin | Decay, promotion and archival evaluated during search, with some updates dispatched to a thread pool | None; retention and importance are scores, and no memory carries a status | The atlas's most complete forgetting-curve implementation, with promotion, archival and reinforcement as separate decisions | The history table has no callers anywhere in the repository; search writes to the store |
prime-agent |
A HarnessEntry: id, kind of prompt, memory, skill, subagent or factory, title, content, path, scope, reference and argument contracts, metadata, source and a version counter | harness_state.json per store, written by temp file, fsync and rename under a lock directory the Rust host and the Python kernel share; a global store under ~/.prime/agent/harness/ and a local one in the session's directory; global refinements also append to refinement_history.jsonl and every refinement to the session JSONL | A digest at cold boundaries (session start, resume, compaction head): three entries per kind ranked by weighted term overlap with the goal and the last four messages, 140 characters each; plus a tf-idf term search the agent calls from the Python kernel | Two paths. /refine plans create, update and delete edits as JSON, validates each per kind, refuses one whose target moved since a baseline taken before planning, and applies under the store lock with before and after snapshots; the kernel's rlm.harness methods create, update and delete entries directly | A /refine delete keeps its before snapshot in the refinement record, so the refinement inverts into a rollback proposal by id; a kernel delete removes the entry and leaves no record | Two files, local and global; a local refinement plans against both and applies only to the local file; continue and resume filter saved sessions by stored working directory | /refine and /refine rollback in the TUI, refine.run from the IPython kernel, rlm.harness CRUD and search in the kernel, all served by a daemon with one worker process per session | An automatic review after compaction, on by default with a 20-minute cooldown: a model decides whether to refine, then a local-only refinement plans and applies between turns | A version per entry, a source string, a stored scope and a model-written rationale on each refinement; no candidate, verified or rejected status | Before and after snapshots on every refined edit, rollback by id, a baseline check that refuses an edit whose target moved during planning, a local refinement that cannot reach the global file, and one lock shared by the Rust host and the Python kernel | The kernel CRUD path bypasses the snapshots, the refinement log and the base-prompt id check; nothing is keyed on a rejected value; the Rust history reader ignores the refinements.jsonl the TypeScript product wrote |
prism-coder |
A session_ledger row — project, conversation, user, a
summary and title, the agent's name, JSON arrays of todos, files
changed, decisions and keywords, a native 768-dimension
F32_BLOB embedding beside a compressed copy, an
importance score,
is_rollup/rollup_count for consolidated
entries, session_date beside created_at, and
archived_at/deleted_at — with a separate
session_handoffs row per project holding live state under
an optimistic-concurrency version |
One libSQL/SQLite file locally, or Supabase for a hosted multi-tenant deployment behind the same storage interface; fifteen tables covering the ledger, handoffs and their version history, an agent registry, memory links, a semantic knowledge store, an HDC dictionary, a retrieval access log, and verification harnesses and runs | Three tiers with explicit fallback, documented in a reviewer note in
the source: native vector_distance_cos() over the F32_BLOB
column with a DiskANN index; on failure a JavaScript asymmetric
TurboQuant scan over compressed embeddings; and FTS5 keyword search as
the last resort. A similarity threshold filters the result, optional
spreading activation expands it over memory_links, and the
tier that produced each hit is carried into the rendering |
session_save_ledger writes synchronously through an MCP
tool the agent calls; the embedding is computed for the summary, PHI is
scanned and redacted before storage, and importance decay is kicked off
fire-and-forget afterwards. Consolidation is explicit rather than
scheduled — session_compact_ledger rolls old entries into
an is_rollup row, and
session_backfill_embeddings repairs vectors the write path
missed |
Soft delete throughout — archived_at and
deleted_at, filtered on 29 read paths, and the interface
calls the second a tombstone in its own comments. Correction of live
state is versioned instead: every handoff save appends a full snapshot
to session_handoffs_history, and
memory_history plus memory_checkout let the
agent list past versions and restore one, moving the version forward
rather than rewinding it |
user_id from the server's environment on every read,
never from a tool argument, with project and
role as optional narrowings; handoff writes additionally
take an expected version and fail the update rather than clobber a
concurrent one |
An MCP server with 41 tool definitions over stdio, published to npm
as prism-mcp-server and to the MCP registry, plus a Claude
Code plugin marketplace entry, a Smithery packaging manifest, a local
dashboard with authentication, a CLI, and Python and Vercel AI SDK
adapters |
A background scheduler and an auto-update path run inside the server process; importance decay is fired and forgotten after a write; and a drift timer tracked on the session context nudges the agent to re-check rather than doing anything itself. Nothing rewrites the store on a timer | Provenance is the agent name, the project and the conversation id,
and the honest reporting of how a result was found. There is no
epistemic status on a memory: importance is a number spent
on ranking and decay, and nothing expresses that an entry is on record
but not to be believed |
Nine contract and honesty tests whose subject is the accuracy of the
system's own self-report — that a hybrid hit is not labelled semantic,
that a lexical rescue never renders as N/A similar, and
that a health check returns an explicit unknown rather than a fabricated
zero, the last written after a hardcoded
missingEmbeddings: 0 reported HEALTHY through an outage in
which 100% of 8,560 rows had no vector |
The ledger records no mutation anywhere — a soft delete writes
nothing, and the one table named ..._log records retrievals
— so the correction story that exists for handoff state has no
counterpart for the memories themselves; and 20.18.0 in seven months
from one non-bot contributor, over a dependency surface of 33 floating
ranges and a postinstall, is a lot of release velocity for
a store holding a developer's project history |
prismer-cloud |
A PKF (HTML) wiki page at a workspace path, typed hub, leaf, decision, glossary or archive, with a visibility scope, version, content hash and source refs | Per-workspace SQLite at ~/.prismer/memory/SLUG/memory.db: pages, append-per-write versions and content, URI-keyed links, FTS5 with a CJK bigram column, an outbox to the closed cloud, and a replica state row | FTS5 BM25, AND then OR fallback, plus a one-hop link-graph band below every text hit; recency and supersede or contradicts terms re-rank; a text miss returns INDEX and hub entry points instead of hits | Agent memory_write through a capability-gated loopback RPC with placement, description, PKF and deliverable gates; post-turn in-daemon LLM extraction of up to six pages; cloud down-sync into the replica | Overwrite by path, one version row per write; supersede, merge, rewire and delete forward to the closed cloud, which then deletes the local rows; page delete cascades its versions. No tombstone | Workspace key and a six-kind visibility on each row, filtered per hit on search, list, load and hook recall and not on the turn-start digest, which puts every hub's path and summary in the system prompt; one database file per workspace; a signed per-agent capability on the RPC, none on the hook route | Hermes memory provider plugin and shell hooks; memory_search, memory_load, memory_browse, memory_write and memory_curate tools shared across Claude Code, Hermes, OpenClaw and Codex adapters; a turn-start digest in the system prompt | Post-turn extraction and compaction workers, an outbox flush, cloud replica reconcile and WS invalidation. The daemon Dream timer is hard-disabled; consolidation is a cloud-dispatched orchestrator task | None local. A stale flag the cloud sets hides a page from local recall; supersession only re-ranks; the correction and deletion authority is cloud-side and not in the tree | One visibility matrix shared by RPC search, list, load, browse and recall; a self-signed per-agent capability with the acting identity taken from the cap, never the body; recall closes when the cloud authority lease expires; write and outbox in one transaction; a three-page leak test with member controls | The hook route trusts identity from the request body; the turn-start digest injects every hub's path and summary with no visibility check; MEMORY.md mirrors land in a database nothing reads; the authoritative store, the correction verbs and the full ACL are closed; no public CI runs these tests |
pro-long |
An action section in a plain-text log — a header, the tool call, the resulting 64x64 board, and the agent's own prior analysis — delimited by an eighty-column rule of equals signs | One logs.txt per game on the host, plus whatever the
agent writes into its Docker workspace; no database, no index, no
embeddings |
None supplied. The agent greps and parses the log itself with Bash and Python, which is the entire thesis | The harness appends every action and board state; the agent's
[PLAN] block is folded into the same file unless the
stateless arm suppresses it |
Neither, on the harness side. Nothing is ever rewritten or removed —
but what reaches the agent is a truncated copy governed by
--log-window |
A directory per game and a Docker bind mount; no scope key is stored on a record or applied as a filter | Two backends — Claude Code and Codex — each driven headless in a network-isolated container with a proxy to the model API only | None. Everything happens on the turn boundary; the runner appends, copies, and calls the agent again | No field. The agent keeps hypothesis-versus-confirmed in prose in
its own notes.md, and nothing reads it |
Committed per-game results with third-party replay links, matched ablation arms, and a budget-matched rerun published because the unmatched comparison flattered the result | The incremental log sync takes its offset from the size of a file the agent is invited to write to, so an agent that edits its own log silently loses history |
pro-workflow |
A learning row — category, rule, mistake, correction, project,
created time, a times_applied counter nothing increments —
with an FTS5 shadow row; beside it wikis of Markdown pages with FTS5,
claims with a confidence and a last-verified time, seeds and sources,
and optional page embeddings |
One SQLite file, ~/.pro-workflow/data.db, with
learnings, sessions, the wiki tables and the
skill-optimizer tables; wiki pages as Markdown under
~/.pro-workflow/wikis/<slug>/ or
<project>/.claude/wikis/; compaction snapshots under
the OS temp directory |
For learnings, FTS5 BM25 over rule, mistake and correction with a
project filter, or the five most recent; for wikis, BM25 with snippets,
an optional embedding arm with reciprocal-rank fusion, and a prompt-time
search whose hits go to stderr; the model reaches learnings by running
sqlite3 under the replay and search commands |
The Stop hook parses [LEARN] Category: rule blocks with
optional Mistake, Correction and Wiki lines out of the assistant's reply
and inserts each; the learn command tells the model to confirm with the
person and then run an INSERT; the prompt hook detects correction
phrases and prints a reminder; nothing blocks |
updateLearning and a hard deleteLearning;
no status, no supersession, no archive; the FTS triggers keep the index
in step; a wiki page is upserted by content hash |
project on a learning, applied as
project = ? OR project IS NULL on every read that passes
one; wikis carry a scope of global or project that picks
their directory |
A Claude Code plugin from the author's marketplace, also installable across agents through a skills installer; 24 hook events; no MCP server of its own; an example MCP config; the wiki research loop and the skill optimizer call Anthropic, OpenAI, OpenRouter or Fireworks through their own clients | A cron-driven research tick runs the wiki loop one page at a time behind a STOP file; a skill optimizer runs epochs of patches, scored against frozen validation prompts, with budget and rejection tables; nothing rewrites a learning | None on a learning; a wiki claim carries a confidence defaulting to 0.8 and a last-verified time; an optimizer patch carries a status and a rejection reason | FTS5 with triggers in a 253-line schema anyone can read; a project filter in the SQL rather than after it; the optimizer's rejection and validation tables record what a patch changed and why it was refused; a compaction snapshot the post-compact hook can describe | The session-start hook prints loaded learnings to stderr, so the
harness shows them to the person and never to the model; the Stop hook
saves any [LEARN] block the model emits, approved or not;
times_applied has no producer; the replay skill greps two
Markdown files no hook writes; no licence file behind the MIT badge;
plugin manifest at 3.3.0 beside a package at 3.4.0; one test file, for
the optimizer; 86 commits and quiet since 18 July 2026 |
project-golem |
A text passage with metadata and a stable id derived from its content, plus a separate experience record of rejected proposal types | LanceDB with a pluggable embedder — Gemini, Ollama or a local provider — and a flat JSON file for the experience store | Vector recall with an optional rerank, then a canonicalisation pass that resolves each hit against visibility and drops duplicates | memorize(text, metadata) with a content-derived stable
id; the experience store is written by proposal outcome |
updateMemory, deleteMemory, hidden and
deleted flags applied on read, plus export and import; and a firewall
rule keyed on the rejected phrase that suppresses it on every later
recall |
None. One store per working directory, no user, agent or session key | A desktop agent with a proposal loop, a memory firewall consulted by the protocol layer, and a dashboard | None scheduled; the wake-up timer in the experience store is a field nothing reads | None on the memory record. Judgement lives outside it — in the experience store's avoid list, and in firewall rules keyed on phrases the owner asked never to hear again | A rejection record that is consulted before the next proposal — the shape the atlas asks for, at thirty-three lines | The avoid list holds three entries, accepts duplicates, is keyed on proposal type rather than content, and any single success clears it entirely |
projectmem |
An event — issue, hypothesis, attempt, fix, decision or note — with
a summary, an outcome of worked, failed or partial, files, a location, a
git commit, capture source and confidence for automatic events, and an
optional supersedes pointer to an earlier event |
.projectmem/events.jsonl per repository, append-only,
with generated summary.md, per-issue Markdown files, a
project map and a plan; a registry of projects and a machine-wide
~/.projectmem/global/ holding library gotchas, patterns and
stack preferences as JSONL |
Generated summary and context blocks within a token budget, per-file history for precheck, case-insensitive substring search over summaries and notes, and global gotchas filtered by the project's detected stack | CLI and MCP verbs append events; git hooks, a churn detector and a CI parser append automatic events with a confidence; secrets are redacted before the write; failed attempts and prefixed decisions or notes that name a library the project uses are promoted to the global store | Nothing in the project log is edited or deleted: a later event
supersedes an earlier one and the retired set is computed at read time;
the global store is rewritten by remove and
prune |
One log per repository, resolved from the project argument or the working directory; the global store is shared by every project on the machine and filtered by detected libraries | An MCP server serving every registered project, a pjm
CLI, git hooks, a watch mode, instruction blocks written into CLAUDE.md
and AGENTS.md, and HTML dashboards |
None required; git hooks and an optional watcher capture events as they happen | Supersession by explicit pointer, staleness flags from git history for a person to confirm or retire, capture confidence on automatic events, and secret redaction | An append-only log with supersession computed on read; warnings before a commit that repeats a failed approach; staleness judged from the cited file's git history rather than age; a test pinning every agent-facing module to the retired-event filter | A correction worded like the gotcha it supersedes is skipped as a duplicate by global promotion, so other projects inherit the retired lesson; the MCP event search ignores supersession; the global store is rewritten without a record |
promptx |
An engram — content, a schema, a type, a timestamp and a strength — reachable through the cue words indexed against it | One better-sqlite3 database per role under the role's
own directory, plus a network.json and an anchor
state.json |
Cue-word lookup into a spreading-activation network, with a two-phase recall strategy and pluggable activation and weight strategies | A remember operation on the cognition layer;
prime and recall are the other two operation
types |
Engram deletion cascades to the cue index by foreign key; no supersession, no rejected-value record, and no correction vocabulary in the package | One database per role by construction — the network directory is the role path, so a read cannot cross roles because it opens a different file | An MCP surface, a desktop application and a CLI, with roles as the organising unit | Weight and decay maintenance over the activation network | None. strength is a float on the engram and there is no
status, provenance or verification field |
Cue-indexed spreading activation with pluggable strategies, and per-role isolation that holds because each role is a separate database file | The product framing hides the memory — the mechanism is nowhere near
the directory named memory — and there is no correction
path of any kind |
provem |
A TemporalFact — subject, relation, object — with
valid/invalid times, confidence, evidence ids, supersession links,
source type and trust, and a privacy policy |
Pluggable backends behind a governance layer; its own local store, or Mem0 and Graphiti adapters | Dense recall with an exclusion pass that returns a reason per rejected record — erased, do_not_use, wrong_tenant, scope mismatch, quarantined | Governed admission — prompt-injection quarantine, sensitive-without-consent hold, provenance and scope stamped at write | forget(term, scope) deletes matching records, appends
the term's tokens to a per-tenant erased set consulted on every later
recall, and writes an erasure certificate |
Tenant and subject scope enforced on the read path, with cross-tenant defense in depth for backends that do not pre-filter | An MCP server, a CLI, and adapters that let the governance layer sit over Mem0 or Graphiti rather than replacing them | Reflection, consolidation, and a deterministic governance benchmark that needs no API key | Discrete statuses — hypothesis, accepted, proposed, pending review, quarantined — plus source trust, confidence and an abstain-on-conflict policy | A replay script that asserts every published number and passes; a claim register that marks its own claims unsupported; losing configurations published | Erasure suppresses at read rather than refusing at write, so the store retains what a subject asked to erase; the governance benchmark is self-authored |
pydantic-ai-harness |
A Markdown file. MEMORY.md is the notebook; other files
hold focused notes, each versioned by a content hash in the file store
and a counter in the database stores |
A MemoryStore Protocol with four implementations —
in-memory, Markdown files in the run's workspace with a JSON receipts
file, a SQLite table, and Postgres — plus an optional
SearchableMemoryStore extension all four implement |
A bounded excerpt of the notebook plus a file listing injected per
request under a token budget; read_memory for a prefix and
search_memory for bounded text search |
Model tool calls only — no extraction pass. Optimistic concurrency on a version, with an idempotency id derived from the run and tool call | write_memory appends or replaces one unique fragment;
delete_memory removes a file and the main notebook is
protected. No record of what a delete removed |
{namespace}/{agent_name} composed by application code,
absent from every tool signature and from the prompt, filtered in SQL by
both database stores and re-checked by the toolset on return |
A Pydantic AI capability —
Agent(..., capabilities=[Memory(FileStore(...))]) —
contributing four tools and a user-role context part |
None. Writes are synchronous tool calls; snapshot loading is a journaled durable operation; the file store settles an interrupted mutation's receipt against the file on the next mutation of that path | None. A memory is a line in a Markdown file; there is no status, confidence, provenance or source on any of it | Scope the model can neither name nor see, re-checked on return; idempotent writes under optimistic concurrency; 2,540 lines of tests to 2,492 of code, asserting what must not reach the prompt | Delete is content-free by design and every receipt holds digests, never content, so nothing records what a write changed; the file store allows one writer per directory; the Postgres scope predicate is untested |
qwen-code |
Auto-memory entry typed
user | feedback | project | reference, with source
refs |
Markdown context files on disk; the team tier is committed to the repository | Indexed scan with a relevance selector; async recall on demand | Background extraction from sessions, cursor-tracked;
dream consolidation; skills reviewed before use |
forget by candidate selection, by match, or by entry;
no value-level tombstone found |
Directory per tier — user, project and team roots — with the project root keyed by git root or exact workspace; recall unions the roots, and no stored scope key is filtered on a read | Built into the CLI; memory channels for intent and recall | Extraction with a resumable offset cursor, dream consolidation, skill review nudges | Source session and message ids; extraction and dream record
updated or noop |
A shared tier that is source-controlled, with secret writes refused
even when the tier is off; a pinned/ directory the
automation is blocked from editing by the tool permission layer, not
only by its prompt |
Correction is entry-keyed, and re-extraction from retained sessions is unguarded |
qwen-mm-plugins |
In video-memory, a node in a four-level tree — Root, SuperEvent, MacroEvent, and a leaf Subgraph of typed entities, timestamped micro-events, on-screen text and labelled edges. In omni-memory, a semantic triple, an episodic clip record or a person entity | video-memory writes graph_memory.json and embeddings.npz into a directory named after the video with a .memory suffix; omni-memory writes one store.json per video or per namespace directory | Hybrid — dense cosine over DashScope embeddings and a BM25 index, fused with reciprocal rank fusion and filtered by node type; OCR and ASR search fall back to a word-overlap scan, and a store whose embedding width disagrees with the query backend is searched by BM25 alone | An offline batch pipeline over the video, driven by a vision-language model in three phases — segmentation, per-segment subgraph extraction, hierarchical aggregation; nothing is written during a session | Neither in video-memory. In omni-memory a contradiction found during a build overwrites a same-key triple or leaves both active; the stamped superseded copy is counted and discarded | The video path, or in omni-memory a namespace directory. Both are physical partitions; no user, tenant or agent key exists in either schema | Nine MCP tools plus a SKILL.md that routes any video over thirty minutes away from frame sampling and into the memory; omni-memory adds twelve tools of its own | Build only, and resumable — a JSON checkpoint of phase-one segments, one subgraph file per completed segment, a liveness check on the producer process, and a done marker per phase | None as a field. The skill instead instructs the agent to re-read the video at a narrow time range because memory is coarse and may be wrong | Retrieval that is hybrid rather than vector-with-a-fallback; an embedding-width check that keeps a mismatched store from ranking by the wrong vector space; a routing rule that says when not to use the memory | Nothing can be corrected or deleted; a wrong extraction is permanent until the whole memory is rebuilt; a width mismatch drops the dense arm with only a log line; omni-memory's supersession stamp never reaches the store |
ragflow |
A message document — message_id,
message_type, source_id,
memory_id, user_id, agent_id,
session_id, content,
content_embed, valid_at,
invalid_at, forget_at, status.
Every agent turn produces one raw document plus zero or
more extracted children pointing back at it through
source_id |
Two stores plus a counter. The memory configuration row
is a Peewee model in RAGFlow's metadata database (MySQL by default,
PostgreSQL and GaussDB supported); the messages live in the doc-store
engine under a per-tenant index memory_{tenant_id} with
adapters for Elasticsearch, Infinity, OceanBase/SeekDB and GaussDB;
Redis holds the global message-id sequence and the per-memory byte
total |
One hybrid pass — a query_string match over
tokenized_content_ltks with synonym expansion and term
weights, a kNN match on q_{dim}_vec, fused by
FusionExpr("weighted_sum", top_n, weights) where slot 0 is
the keyword weight and slot 1 is 1 - keyword_weight, then
sorted valid_at descending. status = 1 and
forget_at absent are added by default |
The agent's Message component awaits
queue_save_to_memory_task, which embeds and indexes the raw
turn inline and then enqueues one Redis task per memory; the task
executor runs the LLM extraction and a second embed-and-insert. There is
no dedupe pass and no consolidation pass |
No update of an entry's content anywhere. forget_at
hides a document from retrieval and moves it to the front of the
eviction queue; status = 0 withholds it from retrieval and
leaves it listed; FIFO eviction hard-deletes forgotten documents first,
then the oldest valid_at. Neither forget nor disable
follows source_id to the extractions made from the
entry |
tenant_id on the memory and permissions of
me|team, resolved to an accessible id list before every API
query and forced into the doc-store predicate as
condition['memory_id']; the index name is per tenant.
user_id, agent_id and session_id
are stored on the entry and are optional query filters, not
boundaries |
Two agent components on the workflow canvas — Message
with Save to Memory, Retrieval with source
Memory — plus a REST surface, a Python SDK, and a second
complete implementation of the same API in Go. No MCP tool touches
memory |
One Redis-queued task type, memory, consumed by
rag/svr/task_executor.py; it performs the extraction that
the inline write skipped. No consolidation, decay, re-embedding or
nightly pass exists |
A boolean status the UI labels Enable,
which filters retrieval, and nothing else. No confidence, no provenance
beyond the writing agent's id, no record of who disabled what or
when |
The access boundary is resolved before the query and re-forced
inside every adapter; the capacity check refuses the write rather than
silently dropping when it cannot decide what to evict;
forget is a two-stage soft delete that hides first and
evicts first; and the Go port ships committed cases asserting another
tenant's memory never reaches the doc engine |
The four memory types are a prompt instruction and a string copied
out of the LLM's JSON keys — nothing validates the type or checks it
against the memory's own bit field; invalid_at,
zone_id and storage_type: graph have no reader
or no producer; a failed extraction reports success; the Go server
validates memory_size and forgetting_policy
and never enforces either; and msgStoreConn is left
None for two of the seven supported doc engines |
rainbox |
A claim with a kind, a five-state status, a sensitivity, a scope and structured subject, predicate and object keys; evidence rows beside it; separately, immutable revisions of the operator's diary files parsed into dated entries and passages | Postgres through SQLAlchemy, pgvector for claim and diary embeddings, a generated tsvector and optional pg_trgm index for diary passages | Claims: hard filter on status, sensitivity, expiry and scope, then a 0.55 vector, 0.30 full-text, 0.15 entity blend. Diary: a room-bound diary_query with search, literal, timeline, read and continue modes; search fuses identifier, full-text, joined-word, fuzzy, variant and optional vector routes by weighted reciprocal rank | The assistant's memory_remember writes a room-scoped candidate through record_belief; the /memory review page activates, rejects, corrects and resolves conflicts; a confirm-tier memory_activate runs only after an operator approves it. Diary files enter only through the operator's diary CLI | Reject, supersede, reactivate, expiry, sensitivity and scope edits on the claim row; rejection and supersession write a value-keyed tombstone; correct_belief supersedes and tombstones the old claim and records the replacement in one locked transaction. Diary: file exclusions by path, prune of old revisions, purge of a source | Global, agent, room and project scopes on claims; the query arm of memory_query, the chat context and the profile digest filter room and agent before ranking and exclude project; the uuid arm of memory_query applies no room or agent predicate; diary sources bound to one room and optionally one agent; sensitivity public, private or secret | A local-model assistant application: chat agents prepend a fenced profile, seed and memory block; the assistant calls memory_query and diary_query; an operator review page at /memory | Embedding refresh on status change, backfill and prune; retrieval and feedback telemetry; feedback promotable to eval cases; no background extraction and no background diary sync | A model actor's write is a candidate and a human actor's is active; value-keyed tombstones refuse a model's re-assertion; lattice-aware write-time conflict detection; confirm-tier writes bound by payload hash; recalled memory and diary passages fenced with angle brackets neutralised, failing closed | Filter before rank in one shared function every query-driven claim read calls; a correction that supersedes, tombstones and replaces under one advisory lock; a candidate state no retrieval returns until a person activates it; a diary read gated by model locality, citing byte ranges into immutable revisions, and fenced as history rather than fact | Explicit chat commands such as remember that and correct that have handlers in memory/ops.py and no caller, so the explicit_human_command actor has no producer; memory_forget by text matches claims in every room and, on an ambiguous match, lists their uuids, and the uuid arm of memory_query then returns any of them in full if active and non-secret, with no room, agent or expiry check, so two calls on the assistant's own surface read another room's claim; memory_forget by text or uuid also rejects and tombstones a claim in any room, recorded as confirmed_by_user; epistemic_confidence and retrieval_strength have writers and no reader; sensitivity, scope and expiry edits overwrite the row with no event record |
rck |
A subject-relation-object triple in a sharded hyperdimensional (HRR/VSA) knowledge base, with provenance held in a separate dict keyed on the same triple | In-process hypervectors across shards, persisted by session snapshot, with an append-only JSONL write-ahead log per KB for crash recovery and JSONL sidecars for skills, provenance and query memory | HRR cleanup against a codebook, multi-hop chain walking, rule instantiation and induction, with denied triples filtered out of candidates | Triples ingested from documents, dialogue or bulk load; corrections parse natural-language retractions into a store-and-forget pair; a second exact-index backend runs the same reasoning layer | deny stores an explicit negative, corrections forget
the value they replace, belief revision and fact pruning operate on the
store, and conflicts resolve by source priority |
None by principal. universes.py gives copy-on-write
branches for counterfactual exploration, which isolates a hypothesis
rather than a tenant |
A CLI, an HTTP server, an MCP server, and a Python API frozen at 27 public methods | Consolidation, dreaming, curiosity and skill promotion passes; a checkpoint that truncates the WAL only after the snapshot is confirmed | Per-fact confidence, count and last-seen in provenance, plus a per-query epistemic state of KNOWN, AMBIGUOUS or IDK computed at read time rather than stored | A denial blocks the inference that would regenerate the answer, not just the answer; and the project measured its own central architectural bet against a plain index and published that it lost | The write-ahead log is truncated at every checkpoint, so it is a recovery mechanism and not a retained audit; the epistemic state is recomputed per query and never persisted; and the substrate the design is named for is, by the project's own measurement, slower and larger than an exact index at identical recall |
re-call |
A source document chunked and indexed with declared validity, lineage and supersession; beside it an AtomicFact (namespace, subject, predicate, object, context, valid_from, valid_until) applied into an append-only fact ledger | The caller's own PostgreSQL with pgvector, every memory table under forced row-level security keyed on a tenant GUC; the rejection ledger and the agent stale-report queue are SQLite sidecars beside the markdown corpus | Dense, sparse and graph legs fused, reranked, then judged: each hit returns a verdict, a score and provenance, and only ok hits become evidence. Two Claude Code hooks inject memos without the verdict | Generation builds from a manifest, an MCP fact write behind a deterministic evidence check, harness hooks that index sessions, and a review path where a person turns an agent report or a model proposal into a supersedes declaration in the memo | A declared supersedes edge in the newer memo makes the older one superseded; a rejected claim is recorded by claim key and refused on every later write; forget() erases a source and writes a permanent per-source tombstone every build re-checks | Tenant isolation is an explicit predicate on every statement with forced row-level security behind it; folder and facet scope is a separate caller-supplied retrieval dimension; the prompt-time hook is scoped to one project's memo directory | A CLI, an MCP server, a Codex plugin, Claude Code hooks at session start, prompt submit, pre-tool-use, pre-compact and session end, a local review dashboard, a desktop packaging path and Docker compose files | Generation builds, graph rebuilds, calibration fitting and invalidation, dependency invalidation, a garbage collector over superseded generations, and an opt-in model arbiter that proposes supersession pairs for review | A closed ten-value verdict vocabulary, calibrated thresholds with a certification status, strict mode that refuses rather than answers, and a degraded mode with a verdict of its own so it cannot be mistaken for a judged result | The off-topic pool is the passage to read: the subjects lived as Python literals, a code corpus rooted at the repository ingested them and disqualified all twenty-five, and the measurement against a third-party corpus of the same size, which kept eleven, is what showed the fault was self-ingestion. The pool moved to JSON, the distinctive words are never named in prose, and three committed guards hold it. The verdict vocabulary is argued rather than listed: unverified exists so a degraded hit cannot pass as a judged one. And the review path closes in both directions: an agent can report that one memo replaces another, a person decides off the agent's surface, and a rejection is keyed on the claim so neither the agent nor the model arbiter can raise it again | Licence first: AGPL-3.0-only, with a commercial licence for closed products and unpublished hosted services, and the Claude marketplace manifest declares Apache-2.0. Then weight: a required PostgreSQL with pgvector, three auto-run surfaces and three build-time execution points at this pin, among them a setup.py that executes at install time and a conftest.py that runs on pytest collection. The two Claude Code injection hooks bypass the trust gate: the prompt-time hook ranks memo files by BM25 and tells the model to follow a hit that settles the question, and the write-time hook injects chunk text by raw SQL, so a superseded memo can reach the prompt through either. Development mode serves unverified results and generation_promoted_unsafe_development is a real audit event. The reviewer is a typed name. The decision ledger is off by default and best-effort, so the record of why a search abstained is as complete as the operator configured it |
reasonix |
One Markdown file per fact with frontmatter — an immutable
ID separate from a renameable Name, a
monotonic Revision, a four-value Type, a
SubjectKey naming which question it answers, an
Activation, a Volatility,
ExpiresAt and LastVerifiedAt — beside a
MEMORY.md index |
Plain files, no database: a per-project directory and a global one, each with its own index, plus an archive directory for forgotten facts and a revisions directory per fact | The cached system prompt carries a fixed memory protocol and the bodies of pinned facts, and no index. Each user turn appends a BM25 recall block after the user's text, with expired facts left out and stale ones ranked down; the memory tool searches, lists and reads the rest | The model calls remember, behind a person's approval unless the write is a bounded new project fact; a # quick-add appends to an instruction doc; the Memory panel edits a fact in place. A second fact claiming a held SubjectKey is refused with the holder's id, so a new answer becomes a revision | forget archives by name rather than deleting; every overwritten revision is kept as an immutable snapshot under .revisions/ID/, restorable as a new revision. A pinned body stays in the cached prompt until the next session | A per-project directory root plus a global tier that loads in every project; project facts shadow global ones on recall. One machine, one user — there is no tenant or principal boundary | A Go kernel reachable five ways — terminal CLI and TUI, the Reasonix Studio desktop app, a browser over its own HTTP server, and editors over ACP — with memory exposed as remember, forget and memory tools | None on the memory path. Freshness is computed on read from volatility and the verification clock rather than swept by a job | No epistemic status. Freshness classifies a fact fresh, current, stale or expired from its age and LastVerifiedAt; stale lowers a recall score and only expired withholds — a statement about age rather than belief | A committed memory benchmark whose tasks are the failure modes a memory store should be asked about, with a paired memory-off arm that reports which tasks memory hurt and what recall cost in characters; a subject key that refuses a second answer to one question; a memory approval that no posture switch answers | A forgotten fact stays in whichever text already carried it — the cached prompt for a pinned fact, an earlier turn for a recalled one; the contradiction task cannot pass; scope is a directory partition with no principal; and there is no mutation audit |
recall-substrate |
A cell — a typed claim from a ten-kind vocabulary with a ten-position score legend and signed edges | SQLite per project, registered in a projects table, with a read-only federated union across them | Compiled and pushed into every turn rather than queried, ranked by evidence mass and graph structure | An admission firewall — validate, screen for secrets, attenuate unsupported confidence, then calibrate by actor | Supersede chains kept in a lineage array; contradiction is a signed edge, not a deletion | A project and tenant pair on every cell, with project a
generated indexed column and a real SQL predicate — used by the subgraph
and page reads, never by the compile path that pushes memory into the
turn |
Claude Code and Codex hooks that hold the turn open until memory was consulted or updated | Standing programs and an operator that decays currency and salience between calls | A four-value verification field, plus a Brier-scored per-actor calibration factor attenuating effective confidence | Confidence is scored against outcomes per writer, so an overconfident actor is discounted automatically | requiresReview is rendered everywhere and set true only in tests, so the review surface does not exist |
recallnest |
A LanceDB row with text, vector, category, scope, importance and timestamp, and a metadata JSON string carrying layer, authority, canonical key, evolution status and version, L0, L1 and L2 text, confidence, triggers and privacy tier | One LanceDB database with memories, memory_triggers and kg_triples tables; JSON files for conflict candidates, session checkpoints and workflow observations; an audit.jsonl log | Vector search by default, BM25 fused at 0.7 and 0.3 in hybrid mode, optional trigger-phrase and PPR graph arms, then decay, tier floor, boundary weight, length normalisation and an active-status filter; four retrieval profiles | Explicit store_memory, batch_store, store_case and store_workflow_pattern tools and HTTP routes; transcript ingest from Claude Code, Codex, Kimi, Gemini, Antigravity and Minis onto an evidence layer; promotion from evidence to durable | A canonical key per durable row: latest-wins categories are rewritten in place with the old version archived as a superseded history row; a cross-category collision opens a conflict candidate; forget deletes the row and its graph triples and records a text fingerprint | A scope column filtered in SQL on every store read, with prefix matching for colon-less scopes; allScopes is a caller flag; MCP search widens to all scopes when a scoped search is empty; the canonical-key match on write reads every scope | MCP over stdio with tools in core, advanced and governance tiers, a loopback HTTP API, a token-gated read-only gateway, a Claude Code plugin, and CLAUDE.md rule blocks telling agents to call resume_context | Cron-driven CLI jobs: incremental transcript ingest, dream consolidation and synthesis, archival GC by age and retention policy, weekly distillation. Nothing runs inside the MCP server on a timer | A layer field fixed at write: transcript and unstructured ingest are evidence, structured writes are durable. Evidence rows are excluded from resume_context's stable section and slightly down-weighted in search. pending_review is searched like active | Evidence and durable layers with provenance on every row; a belief replaced in place leaves a superseded history row; forget cascades to graph triples and leaves a text fingerprint that memory-file reconciliation honours; rejected writes are logged with their text; retrieval audit records the revision served | The canonical-key match on write ignores scope, so a write can rewrite or dedupe against another scope's row; MCP search falls back to all scopes on zero hits under one warning line; audit, conflict and checkpoint files resolve their paths separately from the database |
recallweave |
A memory with a kind from semantic, episodic, procedural or preference, the content, a lexical fingerprint of the normalized content, a provenance pair of source and detail, a confidence, sorted tags, links to other memories, a creation time, an optional time to live, supersession pointers in both directions, and a tombstone flag with its reason | An append-only log file with a hash chain; the current state is replayed from it rather than stored | Filtering and sorting over the replayed live set — by kind, tag, confidence and text — with no vector index and no embedding | Three event variants: assert, tombstone with a reason, supersede naming the replaced id; an assert whose normalized content matches a live memory of the same kind returns the existing id instead of writing | Nothing is edited. Retirement is a tombstone event with a reason, a supersession event, or a time-to-live sweep that tombstones with the reason ttl-expired; compaction drops retired records and re-verifies the chain | None — the store is one local file with no user, tenant or namespace key | A command-line binary and a library, both dependency-free, with a TypeScript viewer beside them | An expiry sweep the caller invokes, a conflict detector that never mutates, and a compaction pass | Tombstoned, superseded and expired composed into one liveness predicate shared by the reads; confidence is a separate number; conflicts are detected and handed back rather than resolved | A log that is the source of truth rather than a record kept alongside it; a digest module that states plainly what it is not; and a conflict detector that refuses to act on its own heuristic | The dedupe consult filters to live memories, so a re-assert after a tombstone is admitted and the fingerprint stops one word short of being a rejected-value key; there is no scope key of any kind; and dedupe is lexical on normalized content, which the code says openly |
recollect |
A claim revision: kind (claim, decision, procedure, handover), subject, predicate, value, rationale, a repository, area and environment selection, a validity interval, freshness, an operational assessment, 1 to 20 exact evidence supports, plus review, lifecycle, admission, origin, actor, device and model derivation | PostgreSQL 17 with pgvector: claims, insert-only claim_revisions with a JSONB body, claim_supports, assertion_rules, memory_decisions and mutation_audit under row-level security; source text as artifact files on disk; Neo4j as a rebuildable projection for graph traversal | One candidate SQL for exact and PostgreSQL full-text matching (websearch_to_tsquery over the simple configuration, ts_rank_cd), optional exact pgvector cosine over text-embedding-3-large and Neo4j graph neighbours, fused by RRF with k 60 and exact matches first; four modes (investigation, strict accepted, strict operational, history); 1 to 20 results in a 1 to 32 KiB budget | memory.contribute or the browser writes a proposed revision after evidence and scope validation; the learning worker extracts claims from sources and captured sessions through OpenAI and, under the autonomous policy, admits them as accepted_by_policy; every write checks rejection rules and stamps blocked_by_rule on a match | Every change appends a revision. Browser review accepts, rejects, corrects, withdraws, revalidates or restores; reject, correct and withdraw write a value-keyed rule. The model may retire its own unreviewed claims as superseded with cited lines. Retention expiry and erasure blank bodies in place; Brain deletion removes every row | Brain as the tenant key under row-level security with reader, writer and admin grants; within a Brain, repository, area and environment selections applied as a recall predicate, with an empty selection meaning Brain-wide; agent operations pin a selection per task | Streamable HTTP MCP server per Brain with 22 tools (8 memory tools) behind a revocable device token; a native companion that installs capture hooks for Claude Code and Codex and runs private tool runners; a React desktop UI; an OpenAPI REST surface | A durable job queue with leases and lanes; an autonomous pass every 10 seconds queues learning for up to 10 new sources per Brain and retries rate-limited runs; semantic indexing, graph projection, analytics cleanup and a privacy journal run beside it | Review state and lifecycle filter every recall mode; rejected, withdrawn, superseded and rule-blocked claims are excluded from investigation and strict recall; strict modes need an acceptance authority, retained evidence and, for operational, a recorded observation; derived handovers inherit the weakest contribution | Value-keyed rejection rules that also withhold raw source text repeating the rejected value; one scope and status predicate shared by every recall channel; a handover is strict-eligible only while every contribution is; row-level security with an insert-only revision table; review refused to bearer credentials | Under the default autonomous policy, captured session text and device-imported sources become accepted memory without a person; default recall serves unreviewed claims; erasure lifts rejection rules; rules match normalised text only; most tests need a live PostgreSQL and no CI runs them; heavy stack (PostgreSQL, Neo4j, OpenAI for learning) |
redcell |
A finding — title, severity, CVSS, CWE, location, a four-value triage status and evidence fields — plus loot and attack-surface hosts, all keyed to an engagement | Postgres for the durable engagement record and, in separate tables, the LangGraph checkpointer; MinIO for report and loot files; Redis for the event bus | No search over memory. Findings, loot and hosts are listed for the session, capped, and pasted wholesale into the chat assistant prompt and, dismissed findings excluded, into a new run's opening recap | Executor tools parse their own output into findings, loot and hosts; each write checks a dedup predicate first; the agent records under candidate by default and may pass verified | A human sets a finding's status to verified, dismissed or inconclusive; merge folds duplicates by dismissing them; dismissed findings are excluded from reports | Every finding, loot item and host carries a session_id, and every repository read filters on it; merge refuses to touch a duplicate in another session | The agent writes memory through structured tools inside the loop; a human triages through the operator console; a chat assistant reads the record back | None over memory. The agent loop checkpoints to Postgres for resume, and a worker drains a Redis queue | A finding's status is a discrete state — candidate, verified, dismissed, inconclusive; dismissed and inconclusive come only from a person, while verified can come from the operator or from the agent's own record_finding call | A memory unit that is a claim which can be false, with human triage as an explicit correction path and dismissal that removes it from the deliverable | Retrieval is a wholesale paste capped at forty findings with no ranking, so a large engagement silently drops the tail, and there is no cross-engagement memory at all |
redis-agent-memory-server |
Working-memory message; long-term MemoryRecord typed
episodic/semantic/message |
Redis with TTL for working memory; pluggable vector DB for long-term | Vector search plus metadata filters, reranked by recency with dual half-lives | Debounced trailing extraction via swappable strategies, then layered dedupe | Exact delete; composite forgetting policy; no tombstones | Namespace, user_id and session_id as optional caller-supplied filters and key segments; the authenticated user never constrains a query, auth is off by default, and an empty namespace-filtered semantic search is retried without the namespace | REST, MCP, CLI, SDKs; backs the OpenClaw Redis plugin | Debounced extraction, compaction, dedupe, forgetting sweeps (off by default) | Session linkage and per-message extraction flags; no trust state | Best-specified retention policy in the atlas; cohesion-gated semantic merge | Deletion is not durable against re-extraction; access-driven reinforcement |
reflexion |
A natural-language plan of action written after a failed attempt at one task, prefixed 'Plan' and stored as a string | A JSON array of env_configs on disk, one entry per task environment, rewritten after every trial | None. The last three plans for that environment are concatenated into the prompt verbatim; there is no query and no search | Synchronous between trials — one LLM call per failed environment, appended to that environment's list | Neither. A plan is never edited, corrected or removed; it falls out of the read window when three newer ones arrive | By containment — memory lives inside the env_config it belongs to, so there is no key to filter on and no way to cross environments | Four standalone research harnesses (AlfWorld, WebShop, HotPotQA, code generation); no library, package or API | None. Reflection runs between trials while the harness waits | None. A plan derived from a wrong diagnosis is stored and reused with the same authority as a correct one | Committed run logs for 15 AlfWorld trials over 134 environments, showing the success curve as memory accumulates | Only failures are recorded, nothing is ever retracted, and the persisted store grows unboundedly behind a fixed three-item read window |
rekal |
A whole captured coding session — its turns, tool calls and metadata — linked to the git commit it produced, kept raw rather than distilled | A .rekal/ directory inside the repo: DuckDB for data
and a derived index, a compressed frame format for the wire, and one git
branch per author as the transport |
BM25, LSA and vector similarity from an embedding model compiled into the binary, fused by weight, plus a facet layer over tool paths, then nudged by recency and by how often an agent opened the session | Captured at every commit by a git hook, scrubbed for secrets and home paths, indexed and embedded in a background pass | Sessions are append-only: a continuing conversation gains turns at the next capture and nothing stored is rewritten. A duplicate re-capture is folded to a survivor; nothing records that a claim inside a session was wrong | Author email on every session row, applied by the optional -a filter on both recall paths; a merge gate on the export path decides what leaves the machine, and each author pushes to their own git branch | A CLI, a Claude Code plugin and skill, and a CLAUDE.md line; adapters read Claude, Cursor, Copilot, Codex, Gemini, Kiro and OpenCode transcripts | A local embedding daemon and an incremental knowledge re-chunk keyed to the commit the index was last built at | None as a status. A per-result confidence number drives the gate, and no field records whether anything in a session was later found false | A citation graph that ranks on the drill edge rather than the recall edge, because the recall edge is the ranker's own output fed back to itself | The gate's abstention path is scored at zero on 446 committed adversarial cases at shipped floors; the adapters compute a session start time that the commit capture path discards |
reme |
A Markdown note with YAML frontmatter and wikilinks: a per-session daily note, a resource note, or a digest node in one of three buckets, chunked for indexing | Markdown files on disk are canonical; chunks persist as JSONL beside a BM25 index, with optional FAISS or zvec vector backends and an optional Neo4j link graph, all rebuildable | BM25 by default; with an embedding store configured, vector and BM25 run in parallel and fuse by reciprocal rank. Results carry one hop of wikilink neighbours and honour caller date, path, metadata and tag filters | Agents write notes with file tools: auto-memory per session from a Stop hook or a job, auto-resource from a watcher, and a nightly auto-dream that consolidates two days of changed notes into digest nodes | Integration returns CREATE, CORROBORATE, REFINE or CORRECT, but the edit itself is unconstrained and a malformed receipt is accepted when one digest file changed. Delete removes the file and the watcher prunes its chunks | One workspace directory per application instance; no scope key on a note. Tags are optional entity facets and fail open when the tag index is unavailable | HTTP and MCP service exposing every served job as a tool, a CLI, a Claude Code plugin with a Stop hook and a SKILL.md, and Hermes, OpenClaw and DSH integrations | A file watcher reindexes changed notes; auto-dream at 23:00 extracts at most five units from changed daily notes; a proactive job at 18:00 keeps follow-up topics; index optimisation at 02:00 | None. A status frontmatter key is reserved in two prompts and preserved by the image-resource step; nothing filters or ranks on it | A validated correction vocabulary with inline contradiction notes; committed per-category benchmark tables with the weak categories left in; negative retrieval cases on edited and deleted notes | The correction verb is a receipt, not a constraint, and a malformed receipt still lands the edit; the benchmark tables come from forked search and memory steps; no scope key |
remem-mcp |
An L0 capture row — id, session key, agent id, type, content, content hash, tags, created_at, metadata. The L1 atom and L2 scenario tables exist and are never written | One SQLite file with FTS5 and sqlite-vec virtual tables kept in sync by triggers; embeddings are 384-dim all-MiniLM-L6-v2 computed locally | Hybrid — FTS5 BM25 and vector distance fused by reciprocal rank fusion at k=60, with keyword-only and vector-only modes selectable per call | Synchronous through the capture tool, redacted before
storage, deduplicated by content hash. The distillation pipeline is a
documented no-op |
forget refused unless confirm is true;
reject(id, reason) sets trust_state to
rejected with a rejection_reason, stamps
deleted_at, and drops the vector row and atoms while
keeping the capture row — which is the tombstone the capture path then
consults by content hash. superseded_by carries
corrections |
session_key defaulting to sha256(cwd),
applied as session_key = ? on the BM25 and vector arms
alike, substituted by each read handler before the storage layer sees
the argument; beside it agent_id, team_id,
user_id and task_id, with an org
scope that deliberately drops the agent filter for cross-agent
handoff |
Six MCP tools — recall, capture, search, forget, handoff, adr — plus SessionStart and Stop hooks it writes into Claude Code and Devin CLI config | None. No consolidation, extraction or maintenance pass exists; the
only pipeline stage implemented is NoopPipeline |
A trust_state column declaring candidate, verified,
rejected and stale; only rejected is filtered out of every read path,
and verified comes from a tool argument the model sets.
atoms.confidence is a per-fact score the rule-based
extractor writes and no read path consults |
A rejected-value tombstone the write path consults by content hash before every capture, refusing with the stored reason and an explicit override; a scope default applied by every shipping read handler and pinned by a test that enters through one rather than through a helper; secret redaction before hashing and storage | The tombstone is scoped to
(content_hash, session_key, agent_id), so the same rejected
value re-asserted under a different agent id or project is not refused;
the audit log records tool calls to a file rather than mutations to the
store; and override_rejection is a plain tool argument the
model can set for itself |
remem |
A memory row with an owner_scope and a
state_key, plus subject/predicate/object facts carrying a
world-time window; claims are projected over both at read time |
SQLite, with an immutable captured_events evidence
ledger, memory_edges for typed relations and a versioned
migration chain |
A retrieval router over lexical and vector arms, assembled into a context bundle at SessionStart, with the CurrentTruth projection rendered into it | Captured events become candidates that default to
pending_review; a planner decides add, update, noop or
defer and records the decision with its reason in
memory_operation_log |
Supersedes and conflicts are typed edges written by a background pass and a graph bridge, carrying evidence ids, a confidence and a reason; the projection reads them rather than the writer resolving the conflict | owner_scope plus a resolved project set composed into
the projection query and the fact reads through one shared scope
helper |
Hooks for Claude Code and the Codex CLI, an MCP server, a CLI, and a localhost REST API | A dream pass that detects conflicts and writes pairwise conflict edges, session rollups, summarization and a spill queue | ValidityState over Current, Superseded, Contradicted,
Stale, Expired and Unknown, computed per read; Contradicted returns no
claim at all, and retention is a separate enum because archival is not
falsity |
A projection that refuses to rank two claims that refute each other and returns both instead, carrying the reason its winner won when there is one; retention and truth kept on separate enums with the distinction written into the type; a review status defaulted in the column rather than at a call site; and a context audit that stores hashes and counts rather than copies of the memories | The per-write operation log has exactly the content an audit wants
and two paths that UPDATE it in place; pending_review is
defaulted independently in four migrations, so a fifth surface has to
remember; the validity window silently falls back to record time where
it was never supplied; and the review separation is of surfaces rather
than of identities, so an operator and an agent sharing a shell are not
distinguished |
remembra |
A memory row: one extracted fact, or one verbatim relay record, with user, project, scope, visibility, memory_type, metadata, an expiry, supersession links and a validity window; plus a verbatim source record per derived store, and entities with relationship edges carrying their own validity dates | SQLite holds rows, an FTS5 index, entities, relationships, conflicts and the audit log; Qdrant holds one vector and payload per memory with user, project, expiry and scope fields; Crew mode adds a separate crew database | Semantic search over-fetched in Qdrant with user and project filters, FTS5 BM25, a recent-rows pool for recency queries and an entity-graph arm, all re-checked by one SQLite row gate, then optional cross-encoder rerank and a mode-weighted ranker packed into a token budget | Synchronous by default: LLM extraction into atomic facts, a word-overlap grounding check that drops unsupported facts, and an ADD, NOOP or SUPERSEDE decision per fact against scoped candidates; relay handoffs skip extraction and cost one embedding; entity resolution runs in the background | Supersession marks the old row and closes its validity window; a PATCH rewrites a memory in place; forget hard-deletes by id, entity, project or account with no tombstone; a sleep-time dedup pass is written to merge and delete but fails on every memory | User from the credential on every read; project in SQL and the Qdrant filter when given or when the key is restricted; optional scope prefixes and metadata filters; spaces share memories across users through an API-layer membership check | REST API, Python and TypeScript SDKs, an MCP server whose tools call the REST API, and remembra-relay session hooks for Claude Code, Codex, Gemini CLI, Qwen Code and Kimi Code that build handoffs from git and the transcript and inject a brief at session start | Entity resolution queued after each store; a six-hourly sleep-time worker for dedup, entity merging, importance rescoring, opt-in decay deletion and community detection; a pending-embedding retry queue; a reprocess job for facts stored during an extraction fallback | A verified flag on facts kept under the non-default flag mode, read by nothing; a per-row injection trust score that withholds handoff text below a threshold at brief time; handoffs labelled key-verified, collected or agent-declared; conflicts recorded with open or resolved status | One row gate shared by every recall arm; supersession that marks instead of deleting and is rolled back with a failed store; verbatim source records behind every derived fact; handoff facts built from git rather than the agent's account, with the summary checked against them | The default sleep-time dedup pass raises on every memory and logs at debug, and its tests pass only through a fake that accepts any keyword; the verified flag filters nothing; memory validity is the write clock; the committed LoCoMo result is invalid by the project's own account |
rememora |
A context row addressed by a rememora:// URI, typed as
memory, resource, skill or project, optionally categorised as
preference, entity, decision, event, case or pattern, carrying an
abstract, an overview, the full content, tags, the agent and session
that produced it, an importance, a use count and a supersession
pointer |
One SQLite database shared by every agent on the machine, with FTS5, a vector index over context embeddings, numbered migrations, and optional encryption | Full-text search with boolean grouping and a noise floor on the BM25 rank, vector nearest-neighbour search, and graph propagation across relations with a depth bound — every arm filtering out superseded rows | An agent calls the CLI over Bash to save a memory; curation extracts memories from session transcripts on demand, never from an automatic hook, and writes a row into the curator audit log for every action it takes | Consolidation clusters similar memories and asks a model to merge,
supersede or keep. A retired memory is not deleted:
superseded_by points at its replacement and retrieval stops
returning it. Each applied decision writes an undo-journal row carrying
the SQL that reverses it |
A project, carried in the memory's URI. The search applies a
rememora://projects/<name>/ prefix filter only when a
project is supplied, so a caller that passes none searches across all of
them |
A Rust CLI any agent can call over Bash, a Tauri desktop app, a plugin directory, Docker packaging and a Homebrew tap — with lifecycle hooks deliberately removed in v1.7.0 | None wired by default. Curation and consolidation are commands a
person runs — rememora curate,
rememora evolve, or rememora dream for
both |
A supersession pointer filtered on every retrieval arm, an audit log naming the model and reason behind each curation action, an undo journal carrying reversing SQL, a cluster-size refusal before the model is called, and a cap on how many memories one model decision may retire | The guards are sized for the model being wrong rather than for it
being right. MAX_SUPERSEDE_PER_DECISION is five and is
documented as "the blast radius of a single LLM call ... so that even a
fully-hallucinated decision can only retire a handful of records",
deliberately set below the cluster limit rather than equal to it. An
oversized cluster is refused before a token is spent, because clustering
is transitive and a big cluster is more likely "one bad edge chaining
unrelated memories than a genuine pile of duplicates" — and the refusal
hands the work back with "review it by hand" rather than proceeding
carefully. A decision that fails validation is discarded whole rather
than partially applied. The undo row is written inside the decision's
own transaction, so a rollback leaves no journal row claiming the
decision happened. And v1.7.0 removed the automatic hooks the project
had previously installed, with setup --apply self-healing
an existing install by stripping them out |
The project key does not bind: the search applies its URI prefix
only when a project is supplied, so a caller that passes none reads
across every project in the shared database — and the database is
explicitly shared by every agent on the machine, which is the design's
whole point and also what makes the missing predicate matter. The
epistemic vocabulary is one bit: a memory is superseded or it is not,
with no way to record that a claim is disputed, unverified or believed
on weak evidence, and the bit is set by a language model's judgement.
Reversibility is narrower than it sounds — evolve_undo
stores and prints the statement that would reverse a decision, and
nothing executes it, so an undo is a person copying SQL; the constant
guarding cluster size still describes consolidation as irreversible.
Nothing is keyed on a memory's content, so a claim retired by
consolidation can be saved again as a new row with nothing positioned to
notice. And the audit surfaces cover curation and consolidation rather
than every write |
reporecall |
A markdown file with YAML frontmatter — name,
description, a type of user, feedback, project
or reference, and optional class (rule, fact, episode,
working), scope, status, summary,
sourceKind, fingerprint, pinned,
confidence, supersedesId, related files and
symbols — mirrored as a row in memories.db |
Markdown under .memory/reporecall-memories/ plus Claude
Code's own ~/.claude/projects/<encoded>/memory/
read-only; a SQLite memories table with FTS5, with
access_count, last_accessed and lifecycle
status living only in the row; beside it the code index — SQLite chunks,
call edges and imports, FTS5, and an optional LanceDB vector table |
FTS5 keyword search with a synonym map, scored by reciprocal rank, a
90-day recency decay, access frequency and a type boost, filtered to
status = active and confidence ≥ 0.55 on the
hook path, cut at 70 % of the top score; no vectors for memories |
store_memory writes a markdown file into the writable
directory and indexes it; the daemon writes a working
memory file per observed prompt and a promoted fact file
after three retrievals; Claude Code's own memory files are imported when
they change; nothing is extracted from conversation text |
forget_memory deletes the file and the row; compaction
every six hours marks same-fingerprint duplicates
superseded and episodes older than 30 days
archived in the index only;
clear_working_memory removes generated working files; a
person edits or deletes the markdown by hand |
One .memory/ per project root, and a scope
of global, project or branch on each file that the MCP tool can filter
on and the hook path does not |
A UserPromptSubmit hook posting to a loopback daemon
that returns code context and a ## Memories block under a
500-token budget with a code floor; a SessionStart hook
with a behaviour instruction; seven memory tools among eighteen over MCP
stdio; a MEMORY.md index regenerated in the writable
directory |
A chokidar watcher with debounce, a compaction timer at six hours, and per-prompt working-memory and promotion passes; all deterministic, no model calls | A confidence number defaulted by source — 0.8 for
Claude Code's files, 0.7 for local, 0.65 for generated — used as a
floor; status is a lifecycle label; nothing reviews a
memory |
Zero-cost indexing of the agent's own memory files, per-class token budgets so rules are never crowded out by episodes, a deterministic benchmark suite with thresholds for the memory layer, and a code index that does the heavy lifting the memory rides on | Lifecycle state that a file edit resets, a promotion whose copy the next compaction supersedes, a scope key the injection path ignores, a package whose source repository no longer resolves while its npm releases ran on to 0.9.1, and a copy at this URL with no commits by its owner |
repowise |
Five layers over one index — a generated wiki page (versioned), a graph node or edge, a decision record with N evidence rows beneath it, a health or security finding, and a git-derived commit and blame record | SQLAlchemy async over SQLite by default at
<repo>/.repowise/wiki.db, or PostgreSQL; FTS5 or a
Postgres GIN index for lexical, and LanceDB, pgvector or an in-memory
store for dense |
Lexical and dense over generated pages, fused and neighbor-reranked,
with a graph walk for structural questions; the answer path grades its
own output twice, as confidence and as
retrieval_quality |
Batch, through an indexing pipeline with a full and an incremental mode; decision candidates from inline markers, git archaeology, README mining, session transcripts and an LLM docs harvest all pass the same grounding gate before persistence | Re-indexing overwrites a page and archives the prior version; a decision is superseded by pointer or dismissed, and a dismissed decision keeps its row so the same identity is never proposed again; authority changes are appended to an acceptance log | Mostly per store. The default is one SQLite file inside the repository; in server workspace mode on a shared database, full-text search takes an optional repository_id predicate and the router fans out per repository when none is given | An MCP server, a CLI, a FastAPI server, a VS Code extension, a web
dashboard and a Claude Code plugin; the MCP surface is a small tool set
built around get_answer, search_codebase,
blast_radius and change_risk |
A watch command and an incremental pipeline re-index on change; staleness rescoring and health snapshots run as invoked passes | Status (proposed, active, deprecated, superseded, dismissed), confidence from source rank and corroboration, verification (exact, fuzzy, unverified), and authority — whether an acceptance row admits the decision — which is what governance reads join on | A grounding gate that deletes an ungrounded field rather than flagging it, and refuses to invent a rejection it cannot justify; and a benchmark page that pre-registers a split, publishes the rows it loses, and writes 'not measured' where a checkmark would have served | The gate's guarantee is conditional on the producer having recorded
a source_text to check against — a candidate that supplies
none is kept and merely labelled unverified; and scope is a property of
the store rather than of the query |
resonant-mind |
An observation: one line of text on a named entity, with weight, emotion, certainty (tentative, believed or known), source, context, charge and novelty. Beside it journals, relations, identity rows, compass values, images, dreams and threads | Neon Postgres through Cloudflare Hyperdrive; 768-dimension Gemini embeddings in one pgvector table keyed by a string id; image bytes in R2 | mind_search appends mood words to the query, takes the top k by cosine over every embedding, drops superseded rows and ranks by 0.5 similarity, 0.2 recency, 0.2 weight, 0.1 access. dream_surface mixes vector hits with novelty and dormant SQL pools | Explicit MCP tools, mainly mind_write. Each observation is inserted as believed and embedded, and any same-entity observation at cosine 0.85 or more among the top 10 hits is retired as superseded. The daemon writes consolidated summaries, reflections and dreams | mind_edit overwrites in place after a pre-edit snapshot, pruned to 20 per observation. mind_delete is a hard delete that drops the embedding first; either member of a supersede pair is held by a foreign key with no ON DELETE clause. No tombstone | One mind per deployment. No user, agent or tenant key; context is a topic label that graph_look can filter on and mind_search ignores | An MCP server of 47 tools in a Cloudflare Worker, and a REST API behind the same key. Tool descriptions tell the agent to call ritual_orient, ritual_ground and ritual_tend on wake; nothing is injected automatically | A cron every 30 minutes: mood, novelty decay, charge progression, orphan marking, proposals, deep archive, retention, Gemini consolidation, reflection, dreams, redolence and an identity hunt | certainty renders as an icon and filters nothing. Superseded rows leave mind_search and graph_look only. The agent accepts or rejects the daemon's proposals itself | Contradiction handling on the write path; statement order chosen so a failure leaves a visible row rather than fragments; consolidation archives originals and records their ids; a rescue is held against every pass that would undo it; write replies state how many embeddings landed; a migration runner with checksums and an advisory lock | Superseded rows still surface through dream_surface, ritual_orient, the orphan queue and the HTTP search; a supersede pair cannot be deleted and the failed attempt strips its embedding; the identity hunt re-proposes rejected additions; similarity, not contradiction, retires the older row; no test reaches search or supersession |
resonant |
A message row in a thread with a 384-dimension MiniLM embedding beside it. Around it: Scribe digest blocks in a dated Markdown file, one handoff carry paragraph, presence and context-card key-value slots, and a diary of the companion's own actions | One SQLite file under data: messages, message_embeddings as float32 blobs, an optional FTS5 table kept by triggers, a config key-value table and companion_actions. Digests are Markdown files under data/digests. Every vector is loaded into one process-memory array at boot | res search embeds the query in-process and scans every cached vector by dot product with optional role and date filters, top k with no threshold, plus two neighbouring messages each side. The UI's keyword search uses FTS5 or LIKE. With a Mind URL set, each prompt also calls the remote Mind by tool name | Every non-system text message over 10 characters is embedded fire-and-forget after insert, and a backfill picks up rows with no vector. A Haiku Scribe digests the daily thread every 30 minutes; an opt-in Sonnet handoff writes an opener and a carry at 00:10. The agent sets presence and context slots through the res CLI | A person edits a message in place, keeping the first original text; the FTS trigger follows and the embedding keeps the old meaning. Soft delete hides a message from search; regenerate and thread delete remove rows and vectors. No delete reaches the digests, the carry or the Mind | None: one user, one store. Role and date are optional filters the agent picks per search, the advertised thread filter is dropped between CLI and route, and Discord and Telegram threads with other people sit in the same archive | An in-process Claude Agent SDK query loop with hooks: a session-mode orientation block prepended to the first message, a one-line env prefix per turn, and a res Bash CLI listed in that block for search, presence, timers and routines. MCP servers from .mcp.json reach the agent directly | Scribe digest every 30 minutes on Haiku, an opt-in nightly handoff on Sonnet, an embedding backfill loop the agent can start, a keyword tone snapshot every 15 messages, and the orchestrator's routines and triggers | None on the archive: a message is what was said. Digests and the carry are model-written and enter context with no provenance mark, and the handoff opener is stored and embedded as a companion message | Fully local semantic recall with no embedding service; every delete path evicts the cached vector after its transaction commits; a thread-aware digest bookmark; a context assembler with named per-section caps; one Bash CLI the model is shown once per session | An edited message keeps its pre-edit vector; the rollover flush re-appends the previous day's tail every 30 minutes until today has five new messages; every Mind tool name but mind_search is absent from Resonant Mind's registry and the calls carry no credential; no test reaches search |
retrodict |
A section of prose in playbook.md, written by the model
for its own successor; beside it log.txt holds every board,
action and plan as raw record |
Two files in a per-game workspace. Nothing parses the playbook and no schema constrains it | The successor reads playbook.md first and greps
log.txt with Python when it needs ground truth; there is no
index and no ranking |
Generic write and edit file tools the
model calls itself — write to lay down a compacted
playbook, edit for incremental updates. The harness never
touches the file |
Overwrite or string-replace, both model-driven. Nothing records what a compaction removed | One workspace per game, by directory. No scope key inside one | ThinHarness with gpt-5.6-sol at max reasoning effort; a plan queue where each committed move carries the cells it predicts, and control returns to the model on a prediction miss | None. Context is dropped periodically and the successor resumes from files | A two-value convention stated in the prompt — a point is checked against the log or still assumed — with an instruction not to build multi-step plans on assumed points. It is prose the model is asked to maintain, not a field anything reads | The memory contract is written down and unusually clear about its own subordination: the raw log is ground truth, the playbook is a convenience, and a contradicted point is to be revised on sight | Every guarantee is a prompt instruction. Nothing verifies that a point marked checked was checked, nothing prevents a compaction from dropping a falsified conclusion silently, and there is no record of what a rewrite removed |
rexleimo-aios |
A memo event: one text with refs, scope, agent, claimStatus, a provenance block, validAt and optional supersedes, entities, confidence and evidenceRef. Beside it a pinned Markdown block per space, and ContextDB session transcripts and checkpoints | Local files under .aios: memo events as one append-only JSONL or one JSON file per sequence number, pinned Markdown per space, ContextDB session JSONL with a rebuildable SQLite FTS5 sidecar, and governance and telemetry JSONL | Tokenised match with ICU word segmentation and a CJK bigram fallback, BM25 over the matched set, an entity boost with one-hop spread, a feedback boost and decay, and an optional hashed bag-of-tokens prefilter; unified search merges memo, pinned, ContextDB, plans, docs and code | Explicit through aios memo add, MCP memory_write and the Pi tool, all landing verified; automatic after a one-shot turn whose model declared verified=yes, landing as a shared candidate or private; aios import lands candidates | Append-only. Correction is a new event whose supersedes names the old one, allowed only within space, scope and owning agent; no delete verb; private rows hidden from recall after 30 days; dream archive and GC exist but are always denied | Space key filtered in collectEvents; scope and agent on every event with a visibility predicate on list and search; the agent is a caller-supplied string. ContextDB filters by agent or project only when the caller passes one | UserPromptSubmit hooks for Claude Code, Codex and Grok inject up to six recall hits in 2,000 characters; an aios-memory MCP server registered for Codex and Pi; a Pi extension; the aios memo CLI | None by default. Opt-in autodream writes dedup and TTL proposals on idle or session close; every approve, archive and GC is denied | claimStatus candidate, verified, observed or legacy_unknown; candidate is filtered from memo reads; promotion is denied by a hard-coded authorize, so candidates never leave the queue; explicit agent writes land verified as local-user | Supersession as an appended event with an ACL on who may retire what, failing closed on unknown targets; valid-time as-of reads; a candidate state the automatic path cannot forge; content-safety scan and receipts on every governance decision; honest A/B eval that asserts its own detector covers a minority of cases | The review queue is undrainable by construction; the agent-facing write tools bypass the candidate gate and are attributed to local-user; the skill tells agents memo add lands as candidate while code and tests make it verified; the ContextDB arm returns candidate text and ignores scope when no agent is passed |
rightmemory |
An addressable Markdown node, a backticked id, one statement and a typed edge list, under anchored headings in MEMORY.md and MEMORY_id.md detail files; plus two capped Agent Correction case files. No author, timestamp or status on a node | Markdown files in a local git repository (default ~/.rightmemory), optionally pushed to a private remote; update_records JSON and a tracked update_queue beside them; an optional hub keeps shared-view packages on disk and tokens, versions and audit events in SQLite | Default: a retrieve model reads MEMORY.md, PURSUITS.md and the correction collections, follows typed pointers and returns a strict JSON selector the runtime renders. Optional: embedding over every entry, top 40 by dot product, a reranker, ten returned, with the agent retriever as fallback. Pending candidates are in both | Agents submit evidence through an MCP tool or the CLI; transcript review extracts more from idle Claude Code and Codex sessions. A worker batches candidates at 15 waiting, or after a one-hour per-session quiet period plus up to 24 hours, and a model updater edits Memory in an isolated git worktree | The updater rewrites or removes nodes in place. A pruner model removes unchanged memory every 70 commits, with the ledger in the prune commit body and revival grace for items written back. Git keeps every prior text. No tombstone | Physical: one root per profile. Hub packages are scoped by a view-bound connect token. Locally, imports are namespaced by view id and all searched; question views reach the provider's whole root under a prompt | Three MCP tools (retrieve, submit_update, capture_guidance); a CLI and JSON-over-stdio daemons; five skills installed for Codex and Claude Code; roles run standalone through Pydantic AI or delegated to the Codex SDK or Claude Code CLI; a local Web Studio and Pursuit map editor | Update worker; transcript review every two hours over sessions idle six hours; Dreamer consolidation after 50 landed updates; Insight reflections after 150; pruner every 70 commits; git sync with a fenced six-hour lease; embedding index refresh | None as state. Pending candidates are retrieved labelled not settled; Uncertain: and Open Context Questions are wording conventions; the updater is told to revalidate candidates | Every automatic write lands only after the runtime validates the role's path set and the whole graph; exact candidate batches are committed beside the diff with an operation trailer; a git compare-and-swap lease with a fencing token serialises updaters across devices; the hub binds each consumer token to one view | Question views expose the provider's whole root to a retriever bounded only by retriever.md, and all consumers of a view share one retrieve session; raw submitted evidence is retrievable before judgement; pruned memory returns with protection; transcripts and exact candidates are committed and pushed |
ripwire-rs |
Two, inherited from the original's file formats. An ack row carries a kind, a 16-hex key, a magnitude and optional cid, now, was, p and reason tokens; the port reads the kind with its origin suffix stripped, the magnitude and the p path. A note is one raw line of free text with no target, date or provenance | Two plain files. .ripwire_quality_acks is committed, holds 542 rows written by the upstream C++ binary, and is read from the analysed root. .ripwire_notes is not committed and is read and appended relative to the process working directory | Acks are a filter on the quality delta: each regression is looked up under its kind by symbol name, file path and bare file, and its gating is cleared when any of four clauses holds. Notes are listed whole by --notes and reach no other verb; the memory_recall tool reads Markdown and doc paths and never ingests the dotfile | No ack writer: --quality-ack and --ack-only are declared and read by nothing, and the ledger header matches the upstream v0.6.5 writer byte for byte. --note-add appends its argument as one line, with no target resolution, date, sanitising or lock | Hand edits to either file. Rows were added and removed in the author's commits; nothing in the port rewrites, rekeys, retires or deletes a row | None. The --scope flag is declared and unread, the by field is not parsed, and an ack aliased to a file covers every symbol of its kind in that file | A single Rust binary with a large flag surface, an MCP stdio server whose quality_delta tool applies the ledger read-only and whose memory_recall tool reads documentation, and seventeen agent skills adapted from the original's, embedded at build time and installed with --add-skills | None. Every read and every write is a command | None. Stale rows get one reason, finding-gone, emitted as disclosure and computed before churn findings exist, so every churn ack is listed stale in the same report in which it suppresses | Format compatibility: the port reads a ledger the original wrote, so switching binaries keeps the accepted-debt record and its reasons. An acked finding stays printed with its gating cleared rather than being removed from the report. The baseline sidecar beside the ledger is written through a synced temporary file and a rename | The ratchet is widened four ways against the original's contract: a twelve-point tolerance, a zero-magnitude ack that suppresses at any size, churn suppressed at any count, and the origin suffix stripped so a new-symbol ack covers a preexisting finding. Suppression is keyed by file. No test asserts an ack must not suppress. The shipped skills describe ack writing, scoping, note surfacing and handoff contents the binary does not implement, and --doctor and --handoff print fixed literals |
ripwire |
Two. An ack is one deliberately accepted finding — a kind token, a
16-hex key over the symbol's path, scope and name, the magnitude it was
accepted at, an optional content hash of the scrubbed body, an optional
scope that wrote it, and a free-text reason. A note is a target — a
canonical path::scope::name or a path — with a date, a
text, and optionally the HEAD sha and branch it was written on |
Two plain files at the analyzed root, both committed:
.ripwire_quality_acks (1,310 rows) and
.ripwire_notes (three rows). Both are sorted for merge
friendliness; the ack file publishes atomically under a cross-process
lock, the notes file truncates and rewrites without one |
Notes are surfaced by exact-string match on a canonical id or a root-relative path, riding along with the symbol or file in the task-scoped map, the default map, the expansion, the edit check and three MCP verbs. Acks are not retrieved; they are consulted as a filter when the quality delta is rendered | --quality-ack[=REASON] merges every finding the current
delta reports into the ledger at its present magnitude;
--note-add resolves a selector through the same resolver
the read verbs use and refuses an ambiguous one, warning loudly on a
target that resolves to nothing. Both are command-line acts; no MCP verb
writes either store |
An ack is replaced in place by a later ack at a new magnitude, and
its reason chain is capped at one hop so an older segment is dropped
rather than accumulated. A rename or a move re-files an ack onto the
current key through a healing pre-pass that rewrites the two sidecars
before anything reads them — by the git-recorded rename map first, then
by scrubbed-content-hash equality — and --quality-ack
writes the healed rows back, so a rescued ack stops depending on the
replay. A rewrite deliberately does not match. Nothing retires a stale
row automatically — a past round retired 109 by hand |
None enforced. An ack row can record the scope that wrote it and the
field is read only to build a disclosure row; the suppression test never
consults it, so an ack filed under one scope suppresses findings
anywhere. The runtime --scope glob filters what is
analysed, which is an argument rather than a stored key |
A single compiled binary with a large flag surface, an MCP server of thirty-one verbs, editor and agent hooks, and a set of agent skills that tell a model when to ack and when to look | None. Every read and every write is a command | None on a stored memory. A stale ack is classified — its target is gone, its finding is gone, or it was filed from a foreign scope — and the classification is emitted as disclosure only; the suppression test consults presence and magnitude alone, so a stale ack keeps suppressing | A ratchet rather than a suppression: an ack accepts a finding at its
measured size and re-reports it the moment it worsens past that, with a
zero-magnitude guard so a finding with no magnitude cannot become a
blank check. The repair for a move is the part worth studying: rather
than teaching nine call sites to try an alias — "each an independent
chance to get the direction backwards" — the two sidecars are
rekeyed forward into the identity the current tree uses, once, before
anything reads them, so computeDelta, the ack ratchet, the
stale-ack classifier and the ack writer become rename-aware with no edit
at all, and it is self-healing because --quality-ack writes
the rekeyed ledger back. The rescue route is kept per row rather than as
a total, because surviving through a git-recorded rename and surviving
through scrubbed-content equality are "different claims with
different trust". A ledger kept committed so what is suppressed is
reviewable in a diff. And a survival measurement the project ran against
its own history and published as the motivation for the repair |
A stale ack is classified and never acted on: its target is gone, its finding is gone, or it was filed from a foreign scope, and the classification is emitted as disclosure while the suppression test consults presence and magnitude alone, so a stale ack keeps suppressing. The rescue that carries an ack across a move is the most load-bearing machinery in the tool and the least visible to the person relying on it — a row rescued by scrubbed-content equality is a weaker claim than one rescued by a git-recorded rename, which is why the route is disclosed per row, but nothing refuses the weaker route. The notes store has no rescue route at all and no lock on its writer. The project's own skill instructs an agent to write acks unattended, and no CI job reads either sidecar, so the review the committed ledger makes possible is a review somebody still has to perform. And the surface is very large for six weeks of work: 172,653 lines across 167 files, with two auto-run surfaces and four unpinned dependency surfaces at this pin |
risuai |
A summary of a contiguous run of chat messages, carrying the set of message ids it was derived from, an importance pin, a category and tags | Per-chat-room JSON in the local database, with an embedding cache keyed by content and model | A token budget split into four bands — pinned, recent, embedding-similar, and random — with RRF from chunks up to parent summaries | An LLM summarizes a run of messages when the context overflows; re-summarization compresses summaries further | Summaries whose source messages no longer all exist are dropped; a person can edit, delete, merge, re-roll or pin any summary | Per chat room and character; no principal or tenant key | The chat UI itself; the selected summaries are injected as one
Past Events Summary block |
None — summarization happens inline on overflow, under a rate limiter | None epistemic. isImportant is a user pin, not a
confidence or a verification state |
Derived summaries carry their source message ids and are dropped when a source is deleted; a full review surface over machine-written memory | Three generations of summarizer ship side by side and none of them has a test |
roampal-core |
A text row in one of five ChromaDB collections: an exchange summary, atomic fact or key takeaway in working, history or patterns; a memory_bank fact with tags, importance and confidence; or a book chunk. Rows carry a raw outcome score, uses, success_count and the last ten outcomes | Five ChromaDB PersistentClient collections in one directory per profile, SQLite WAL on the catalog; session transcripts as JSONL files and a ghost_ids.json registry for removed books beside them | Per turn, two lanes of four (summaries, facts) over working, history, patterns and memory_bank. Query words matched against a known-tag index choose tag-filtered vector queries, cosine fills a 40-candidate pool, and a multilingual cross-encoder score is the final rank. Outcome and Wilson scores only pick which candidates reach the reranker when there are more than 40 | The agent through MCP: score_memories stores a summary and facts in working, record_response a takeaway at score 0.7, add_to_memory_bank a permanent fact. OpenCode's stop hook stores a sidecar summary. A fact within cosine distance 0.32 of a stored fact is not written | update_memory rewrites a memory_bank row by id; delete_memory archives the best semantic match, falling back to the top active hit, and archived rows are hard-deleted when the profile next loads. Working expires at 24 hours, history at 30 days, a low outcome score deletes. No tombstone | Physical: one data directory per named profile, chosen per request by an X-Roampal-Profile header, a directory binding or a persisted default. conversation_id is stored on working rows and no retrieval filters on it | Claude Code UserPromptSubmit and Stop hooks and an MCP server with six tools, both proxying to a local FastAPI server on port 27182; an OpenCode TypeScript plugin with an optional sidecar scorer | Startup cleanup deletes low-score and expired rows and sweeps HNSW phantoms; every 50 outcome recordings a TTL cleanup runs; a one-time background re-embed after an embedder change; optional sidecar LLM tag extraction | None as state. The injected block says memories may be wrong and labels facts as direction, not authority; wilson, uses and last-outcome tags print beside each memory. status is only active or archived | Per-request profile routing that refuses an unregistered profile with a 404 instead of writing to the default store; archived rows excluded at the query predicate and again after search; explicit degraded markers when the embedder is down; a dedup regression guard over recorded real vectors; a published ablation that removed its own Wilson ranking | The model that used a memory rates it, and ratings drive promotion and deletion; delete_memory archives the top semantic hit when no text matches, and the archive is purged at the next load; an empty memory_scores scores another session's cached results; the headline benchmark ran with the lifecycle off; the localhost server has no authentication |
rrsi |
An accepted harness edit: a commit of program text (prompt, control flow, client tool, skill or subagent) on the domain's evolve branch, with one ledger record per edit | Git refs in the operator's own checkout, one evolve branch per domain and one branch per evaluated candidate, plus JSONL and JSON files under the run directory | None by relevance. The next baseline checks out the branch tip whole; the proposer's prompt carries the 40 most recent ledger rows, a prune set and the list of untried components | A proposer agent edits a candidate worktree; a regex denylist and an LLM critic screen the diff, a smoke run and a full evaluation follow, and a noise floor, cost rule and domain guards admit at most one candidate per round, which fast-forwards the branch | Only by a later admitted edit; pruning is a prompt instruction to remove machinery with no recent gain. Readjudicate can move the branch back to the previous incumbent and rewrites that round's ledger records | Physical: one evolve branch and one run directory per domain; no key on a record | A CLI (baseline, run, round, readjudicate, reevaluate, heldout); each domain adapter runs the harness from the candidate worktree. The admitted program is the agent, so nothing is injected at runtime | A sequential driver runs rounds as subprocesses until T rounds or a STOP file | Diffs are screened for task-specific content before evaluation; admission needs the score to clear the best score minus a calibrated noise band, and a cost rule. No status on what is admitted | Component tags checked against diff evidence before the record is written; gains inside the noise band are refused unless cheaper or structurally new; added tokens must be paid for by measured gain; the incumbent is always a commit | The ledger is per run while the program persists, so a new run inherits machinery with no credit record; do not redraw is prompt text over a 40-row window; the offered Memory store defaults to one shared /tmp path and the critic never sees what it holds |
ruflo |
A MemoryEntry with content, a namespace, an expiry, a content hash and a references list that makes it a node in a graph | A hybrid backend — SQLite for structured and exact queries, AgentDB with an HNSW index for vectors — plus a bridge to Claude Code's own Markdown auto-memory files | Reciprocal rank fusion over three arms: dense vectors, FTS5/BM25, and a regex entity tagger, with optional PageRank and community-based graph re-ranking | Insights recorded through a bridge, synced bidirectionally with Claude Code's Markdown memory; a learning bridge fires a neural trajectory on each one | Expiry sweep, content-hash dedup by strategy, and an HNSW rebuild, run on a timer or by a nightly controller | Claude Code's three agent-memory scopes — project, local and user — as directories, plus namespaces and a confidence-gated transfer between agents | A meta-harness over Claude Code and Codex, shipped on npm as claude-flow; memory is a package other components consume | A consolidator on a background timer, and a nightlyLearner controller that delegates to it | A retrieval guard wrapping an OWASP injection-pattern library screens chunks before assembly, annotating or dropping them — and it is off unless an environment variable turns it on | Prompt-injection screening on the read path with a cited attack model, and a refusal to truncate oversized chunks because truncation would defeat the scan | The guard defaults to off and then to annotate-only; nothing records that a memory was wrong; and the memory package sits inside a 5,491-file harness with a rename and a version history behind it |
runar-forge |
An entry with title, content, type, tags, a layer of 1–4, importance, decay score, confidence, a verified flag, an author and a topic key | One static Rust binary over SQLite or Postgres, with FTS5, embeddings, a typed edge table, a debug log and a sync outbox | Fused lexical and vector search with a 1.25x bonus for owner-verified entries, plus separate edge traversal through muninn_related | Synchronous through one propose chokepoint that redacts private blocks and secret patterns, bounds content, stamps the author and dedupes on a topic key | A topic-key collision soft-deletes the old row and writes a Supersedes edge new to old, so reads exclude it and lineage keeps it | namespace applied as a WHERE clause on every read, with project_id and topic_key beneath it | Twenty-two MCP tools across memory, sessions, plans and an icebox, plus a CLI and hook runtime for any MCP-aware editor | A gc pass that recomputes decay and graduates layers, plus a sync outbox drained to a remote | A confidence float with a named preset vocabulary beside a verified flag the agent can set through its own MCP tool; no rejected state, and the Contradicts edge is never written | One redaction chokepoint covering every write path, ordered before truncation, and supersession that removes the old value from reads while keeping it in the lineage | Graduation lists the five hundred most recently created entries and orders by created_at DESC, so in a namespace past that size the oldest material can never be archived |
rushdb |
Any JSON object pushed as a record; the memory contract narrows that
to two labels — EPISODE, one completed user/assistant turn
with a summary, and MEMORY_FACT, a curated fact with a
subject key, confidence, validity dates and an active
flag |
Neo4j as a Labeled Meta Property Graph — properties are nodes, values are relationships, embeddings live on the value relationship — plus Postgres or SQLite for embedding-index rows, tokens, projects and relationship patterns | Managed or bring-your-own vector search over one indexed string
property, composed with arbitrarily deep graph traversal in the same
where; a non-empty filter switches the server from the ANN
index to exact scoring over the filtered candidate set |
Synchronous record write, then a fire-and-forget mark that the
embedding index is stale; the contract upserts on a deterministic
SHA-256 id with mergeBy and
mergeStrategy: 'append' |
An upsert overwrites the properties it carries and leaves the rest;
DETACH DELETE removes a record with its value relationships
and their vectors; a fact is retired by rewriting active to
false, which nothing in the tree does |
One Neo4j property graph per project, inlined as
{ projectId: $projectId } in every match; inside a project
the memory contract adds five scope fields as ordinary record properties
and filters on all five |
A REST API with TypeScript and Python SDKs, an MCP server with 39
general database tools, six installable agent skills, and the
@rushdb/agent-memory-contract package for custom
harnesses |
A once-a-minute cron that embeds records marked pending, an embedding-model migration pass, and a post-approval worker that MERGEs relationship patterns | A trustClass enum of
trusted/mixed/untrusted and a
confidence float on every fact; neither is read by any
filter, ranking or formatter, and recall is labelled untrusted wholesale
instead |
The scope filter is a real Cypher predicate evaluated before similarity rather than a post-filter, the event identity is a documented hash with a cross-language fixture that recomputes, and deletion takes the vector with it because there is no second store to reconcile | The lifecycle half of the design — outbox, fail-open recall, capture bounding, fact deactivation — is specified in shipped prose and implemented in packages that are not in this repository, so what is here is a protocol and a thin client rather than a memory runtime |
rust-self-learning-memory |
An Episode: task description, TaskContext of domain, language, framework and tags, execution steps, outcome, reward, reflection and salient features. Beside it, rule-extracted Patterns in four variants, Heuristics, and template-built Playbooks | libSQL (Turso) as a local file or a remote database for durability, a redb embedded key-value cache, and an in-process map every read passes through; optional embeddings in Turso tables per dimension | retrieve_relevant_context over completed episodes in the in-process map, backfilled from storage: an ANN hybrid or semantic tier when embeddings are on, otherwise a hierarchical tier that hard-filters by domain, otherwise keyword OR-matching. The MCP query_memory tool then keeps only episodes containing the literal query string | Explicit lifecycle through MCP, CLI or the library: start_episode persists an in-progress row, log_step buffers steps, complete_episode runs a quality gate, scores reward and reflection, stores, embeds and extracts patterns. No model call anywhere on the write path | update_episode rewrites the description and merges metadata; delete_episode removes the episode rows and nothing derived from them; capacity eviction also deletes embeddings and journals each backend outcome in process; archive sets a metadata key that only listings read. No tombstone | None by principal. domain is a caller-supplied topic label, hard-filtered on the hierarchical tier only; one database per deployment | An MCP server over stdio whose dispatcher names 48 tools, including create, complete, update and delete episode, query_memory and pattern search; a CLI; the do-memory-core Rust library. Nothing is injected automatically | Optional async pattern-extraction workers and a bounded durable write queue for Turso; a query cache with a 60-second TTL; no consolidation pass over the store | None. Episodes carry numeric reward and quality scores, patterns a success rate and effectiveness score used for ranking; a quality gate refuses storage below a threshold | Deterministic write path with no model; an episode store failure is an error rather than a warning; cache keys and the ANN index carry the embedding provider identity; eviction deletes embeddings and records per-backend outcomes for reconciliation | The shipped MCP server's quality threshold of 0.7 is above the most a fresh episode can score, because reflection and patterns are scored before they exist; explicit delete leaves embeddings, derived patterns and cached results; pattern decay reports removals it does not make; MCP audit lines default to stdout, the JSON-RPC stream; two e2e test targets run zero tests |
ruvector |
Hook store: one JSON object with content, a free-text type, a 64-dimension hash or MiniLM embedding and a timestamp. Shared Brain: a BrainMemory with title, content, tags, category, contributor pseudonym and a Beta quality score | Hook store: one intelligence.json per project or home directory, rewritten whole on every write. Shared Brain: an in-process map with best-effort write-through to Firestore, or SQLite in a separate local binary | Hook store: brute-force cosine over every memory, or an HNSW index rebuilt from the file in each process; no type filter. Shared Brain: keyword-dominant hybrid score over the whole corpus with cosine, personalized PageRank, reputation and vote terms | Hook store: explicit remember from the CLI or MCP, plus hooks installed by hooks init that record every Read, Glob, Grep and Task call and every edit and shell command. Shared Brain: share with PII stripping, and an unauthenticated pipeline inject route | Hook store: no per-memory update or forget; FIFO drops the oldest 1,000 past 5,000, import replaces the whole list. Shared Brain: owner-only delete, votes move a Beta score, page corrections are logged deltas that never change the page text | Hook store: physical, the project's .ruvector directory or the home one, no key on the row. Shared Brain: one global corpus; category and tags are caller-chosen filters and contributor id gates only delete | A ruvector CLI and a stdio MCP server exposing hooks_remember, hooks_recall, hooks_import and eleven brain tools; hooks init writes Claude Code hooks; a Rust MCP client and an SSE MCP endpoint on the brain server | None for the hook store. The brain server runs training, drift and optimizer loops that do not rewrite memory content | None on either store. Brainpedia pages carry Draft and Canonical, but no read filters on them; Contested and Archived have no writer | An embedding-provenance stamp that refuses a write from a different embedder and makes a legacy store read-only until re-embedded; a corrupt store is quarantined, not overwritten; atomic temp-file rename | Ambient tool-call records evict explicit memories through one FIFO; concurrent hook processes lose writes last-writer-wins; the CLI and MCP writers use different field names and ids that collapse on reload; the brain's inject route takes no credential and writes as a system contributor |
sage-memory |
A MemoryRecord — id, submitting agent, content, content
hash, embedding and its hash, a type of fact, observation, inference or
task, a domain tag, a provider, a caller-asserted confidence, a status,
an optional parent hash, task workflow fields, and created, committed
and deprecated timestamps |
Two tiers. BadgerDB holds the consensus state covered by the application hash — the content hash, status, domain, author and classification, and no content. SQLite for a personal node or PostgreSQL with pgvector for a cluster holds the serving projection with the content and the vectors, written only from the consensus path | Cosine similarity over the candidate set with no minimum threshold, after a SQL prefilter on the embedding provider, the domain, the confidence and a committed status; a decayed-confidence floor is applied across all candidates before the top-K trim, then a per-record authorization pass. A BM25 text search and a hybrid mode sit beside it, with an off-by-default cross-encoder reranker | An agent submits through an MCP tool or the REST route; the node re-embeds the content itself rather than trusting the caller, derives a UUID and a content hash, builds a signed transaction and broadcasts it for commit. The block writes the Badger keys and buffers the SQL row, which is flushed at Commit through what the code calls the only path that writes memories to the offchain store | No edit. A challenge transaction moves a memory to
challenged or deprecated and a reinstate
reverses it; deprecation leaves the row in place with a timestamp, and
the voter's dedup refuses the deprecated memory's exact bytes under any
new id until a reinstate. A cleanup pass can evict memories whose
decayed confidence falls below a threshold, and it is disabled by
default and requires an operator and an explicit dry-run flag |
A required domain tag validated on write against a registered domain list, filtered in the query, and authorized per record against the caller's credential on the way out; agents may hold an owned home domain | 38 MCP tools, 119 REST routes, a CEREBRUM dashboard of 65 more, a Python SDK, a desktop shell, a tray app, a libp2p relay as a separate module, and a federation layer that syncs memories between chains under explicit policy | A voter loop polling every two seconds for proposed memories to vote on, the CometBFT block loop, federation sync, and an opt-in cleanup pass | Four produced statuses gating readability, a content-hash dedup that keeps a deprecated memory's bytes out, a caller-asserted confidence decaying on an exponential curve with a corroboration bonus, a per-domain decay rate, and a validator score table | A status ladder that genuinely withholds — a memory is unreadable until something votes it in; a decay floor applied across the whole candidate set before the top-K trim rather than after; a node that re-embeds rather than trusting a caller's vector; consensus-first write ordering with a single documented path into the serving store; a dedup that excludes the candidate's own row rather than every unaccepted row; 4,941 test functions | On the default install the vote is one validator key running three
string heuristics, which the README's opening line states beside its
consensus claim; the dedup is keyed on exact bytes, is a node-local
opinion that fails open on a store error, admits two identical proposals
in flight at once, and does not run on the co-commit path; the MCP
client silently drops a write at 60% word overlap before the chain sees
it; two of the four papers rest on an experiment pipeline excluded from
the tree, which the papers index states; access_logs, the
lifecycle state machine, the validated status and the
record validator all have no production caller |
sage-novelty-gate |
A mem0 fact — an extracted natural-language statement with an embedding, under a user/agent/run scope | The mem0 stack unchanged: a vector store (Qdrant by default) for facts, SQLite for mutation history; the gate keeps an in-process per-scope index | Unchanged mem0 vector search, filtered by the scope ids | Fact extraction by LLM, then a von Mises-Fisher KDE novelty score against an adaptive per-scope threshold; only the UPDATE band calls a merge prompt | ADD writes a new fact, UPDATE merges into the nearest neighbour through one LLM call, NOOP discards the candidate with a log line and no record | user_id, agent_id and run_id as a vector-store filter on read and as the KDE partition key on write | A drop-in replacement for mem0's write path; the fork removes mem0's docs site, SDKs, server and examples | None; the gate is synchronous and in-process, with a hydration TTL that reloads a scope's vectors | None. A routing decision is a write-time genre, not a state a fact carries; nothing records confidence, provenance or that a candidate was refused | Every published headline number recomputes from committed artifacts with no API key, and the accuracy framing chosen is the one that disfavours the system | A discarded candidate leaves only a log line; the generated results paragraph names a category as the site of the gap that its own table contradicts |
scope-recall-hermes |
A claim — subject, predicate, value and conditions — held as a chain
of claim_versions, each with a state, a basis, a validity
interval, a record interval and the exact source spans it quotes; beside
it the source_events the claim was read out of, and
episodes, artifacts and references built the same way |
One SQLite file as the only authority — source_events,
claims, claim_versions,
evidence_links, deletion_operations,
entries and the work queue, schema 1110 — with a vector
companion in LanceDB holding metadata and a vector against an empty
payload, deletable and rebuildable without losing a memory |
Five channels fused by reciprocal rank — exact reference, lexical index, claim, recent and vector — then assembled into a packet with an explicit answerability verdict that can say the corpus cannot answer the question | A turn is captured as a source event; a leased background work item consolidates what a person said or a document stated into claim proposals, never tool output; each proposal is stored only if the span it quotes is literally present in the source, and a deterministic ladder decides whether it lands proposed or active | A change appends a claim version and closes the previous one's record interval; nothing overwrites content or state. Deletion is one operation record applied in dependency order across sources, claims, evidence links, episode membership and the vector rows, with the derived layer fenced so a rebuild cannot resurrect it | A scope_id bound from host identity and carried as
scope_id IN (allowed) on every read; a vector hit is
filtered by the trusted partition list and then re-read from SQLite
under the same predicate before it can enter the packet |
Host adapters rather than assumptions — a Hermes provider with eight tools and one MCP server with nine serving Codex and Claude Code, locally or as entries of a shared store over HTTP; the only write verbs are propose, revise and forget, and revise and forget must quote the session's own most recent human turn | Durable work items with leases, attempt limits and at-most-once publication, for consolidation, embedding, projection rebuilds, purges and candidate evaluation; a crashed pass loses nothing and a provider outage parks work rather than failing it | state IN ('proposed','active','disputed','superseded','retracted')
as a SQL CHECK on every claim version, decided by a rule ladder the
model is explicitly forbidden to influence — the candidate evaluator's
own prompt says
Do not choose a fact state: Core qualification owns that decision |
A stored claim can always name the sentence that caused it, and the check that the sentence is really there runs at the storage boundary rather than in a prompt | Nothing in the tree measures recall quality: the README says every accuracy figure was measured by hand on the authors' own corpora, and the model-evaluation release gate meant to cover it was removed on 27 September 2026 rather than passed |
screenpipe |
A memories row: free text up to 50,000 characters, source, a JSON source_context stamped with the writing device, a JSON tag array, an importance float, an optional frame_id, created_at and updated_at; beside it, captured frames, screen text, transcripts and UI events that agents read but do not write | One local SQLite file with a memories table and an external-content FTS5 index kept by triggers, next to the capture tables and mp4, wav and jpeg media on disk; agent skills as SKILL.md folders with a provenance manifest; an optional cross-device manifest, a Data Sync upload and an enterprise telemetry archive | FTS5 match or a full scan, optional source, tag, importance and created_at filters, ordered by created_at or importance; reached through search-content with content_type memory, the activity summary, a frozen profile snapshot at agent start and an Obsidian digest. No vector arm | Explicit: the MCP update-memory tool, POST /memories from any API caller or writer-preset pipe, the user_profile agent tool, the desktop Brain screen and cross-device sync. Synchronous single-row insert; no extraction, deduplication or consolidation pass | PUT overwrites content, tags, importance and source_context in place; DELETE removes the row and, if it was synced, records a sync_uuid tombstone kept 30 days. Range deletion and retention remove captures but never memories; the enterprise wire format has no delete record | None on memories: no user, project or agent key, one table per machine, and any caller admitted to the memory routes reads or deletes any row. Pipe tokens carry a per-pipe endpoint, app, window, content-type and time policy, and the feedback ledger, a side store, filters a pipe's reads by its authenticated name | A stdio MCP server with a memory write tool and a search tool, a read-only HTTP MCP server, a REST API, Pi and ACP agent extensions that inject a profile snapshot at session start, scheduled pipes, and marker-spliced guidance in CLAUDE.md and AGENTS.md | A five-minute export of memories at importance 0.4 or above to an Obsidian note, cross-device memory sync inside the sync download loop, Data Sync and enterprise uploads, and capture retention; none of them rewrites memory content | None on memories: importance is a float used for ordering and an export floor, source is caller-asserted, and there is no status. The profile path rejects instruction-like and secret-bearing text on write and blocks it again on render | A read-only raw SQL route backed by a query_only connection, not only a prefix check; a profile snapshot frozen per session and fenced as data; agent skills whose write provenance is a hash-matched manifest a manual edit revokes; a pipe's feedback reads scoped by its token, not its argument | Memories are unscoped and any caller with write access can delete any of them; a memory derived from a capture outlives range deletion and retention of that capture; deletions never reach the enterprise archive; the delete tool is annotated non-destructive; sync tombstones expire after 30 days; the only token-bound read scope is on the feedback ledger, not on memories |
second-brain-cloudflare |
An entry with content, a JSON tag array, a source and its derived vector ids | Cloudflare D1 for entries and edges, Vectorize for embeddings, KV for migration ledgers | Vector search with graph expansion, MMR, and a volatility-dependent recency floor | Capture with contradiction detection; the loser is deprecated and its vectors deleted | status canonical / draft / deprecated as a reserved tag namespace | A workspace_id column on entries, applied as a
predicate on the read paths, with each deliberate exemption annotated in
place; personal and team workspaces sit above it |
MCP for Claude, ChatGPT and Cursor, a desktop app, calendar and email capture | A nightly staleness pass writing volatility and stale:as-of tags | status:deprecated is filtered out of recall and graph expansion; canonical raises the floor | A re-embedding migration that reasons about why its own progress marker would lie | Reserved tag namespaces live in caller-writable tags[];
the two hardening fixes that followed the volatility incident were not
carried across to status:, whose reader still stops at the
first prefixed tag rather than the first valid one |
second-me |
Three layers — a document with its raw content, a versioned biography and shades derived from it, and the model weights trained on both | SQLite for documents, chunks and the versioned L1 tables; ChromaDB for embeddings; GGUF files for the model | Embedding search over documents and chunks, plus whatever the fine-tuned model recalls without retrieval | Upload documents, generate L1 as a numbered version, then synthesize training data and run LoRA SFT and DPO | Document deletion cascades through chunks and both Chroma collections, and touches neither L1 nor the weights | None — the design is one person, one machine, one model | A local web app over a Flask kernel, with GGUF export and a decentralized network for connecting AI selves | Training pipelines run as scripted jobs rather than as a scheduler | Pipeline statuses only; no memory carries an epistemic state | L1 is a numbered generation over retained L0, so the derived layer is rebuildable and comparable across versions | Forgetting stops at the vector store; the trained model keeps what a deleted document taught it |
selmem |
A MemoryTrace — a reconstructable gist, a
core set at encode that only merge extends, affect,
fidelity, access, anchor, a
drifts log, and a pointer into a verbatim archive
record |
An in-RAM MemoryStore dumped whole to a vault on save:
SQLite through hand-written FFI against the system
libsqlite3, or a flat SELMEM1 file |
Scored over cues, a 96-dimension embedding, mood congruence and a 0.12 bonus for hours a living axiom cites, then reconstructed rather than replayed | A scored encode gate drops Selfhood events below threshold; World and Log lines and high-permanence events are always kept. What passes is stored as a gist, a core and a verbatim archive record | A nightly pass weathers, rewrites, merges and extinguishes; a
decayed episode becomes Latent, and one that stays spent
through the next night is removed with its drift log and unshared
archive record |
One vault per entity and three channels — Selfhood, World, Log — of which World and Log are exempt from decay and rewrite; no scope key in any query | A library plus selmemd (21 HTTP routes and a
single-file UI) and selmem-chat; with an endpoint set, the
LLM reconstructs, rewrites, distils axioms, reads affect and proposes
cores |
sleep — weather, ladder, rewrite, merge and release on
a deep night; weather and release on a shallow one |
fidelity on every trace and a disclaimer on every
recall; TraceStatus is a threshold projection of
access and fidelity, and a pin raises
permanence and anchor rather than setting a
state |
Forgetting and distortion are the mechanism, model output is admitted to the core only as words the event contains, and the tests assert what must not be reachable | Release removes a spent Latent trace together with its drift log and unshared archive record, and nothing records that it left |
selvedge |
A change event on an entity path such as users.email or src/auth.py::login: change type, diff, reasoning, constraint, stale_when, expires_when, revisit_after, agent, session, changeset, and a supersedes link | One SQLite file per project in .selvedge/, or SELVEDGE_DB, or a global fallback in the home directory; an event_chain hash-chain sidecar, a tool_calls telemetry table and an optional embeddings table in the same file | Entity path exact or dotted prefix, LIKE substring over path, diff, reasoning and agent, and an optional model2vec cosine pass over reasoning for prior_attempts fuzzy. No ranking beyond recency and a confidence tier | Explicit: the agent or a person calls log_change or selvedge log; importers back-fill from SQL and Alembic migrations, git revert commits and Agent Trace files. Validated, size-capped and secret-scanned, but warnings never block the write | Append-only. A reject or revert closes a decision, a supersede event re-opens it by id; nothing is edited. The only delete is an age-based prune gated by confirmation and SELVEDGE_DESTRUCTIVE=1, recorded as a count-only chain tombstone | Physical: one database per project directory. A project column exists and history, stale_decisions and the changeset listing filter on it only when the caller passes it; prior_attempts, blame, diff, search, the gate and the digest never do | Eight MCP tools over stdio; a CLI; a Claude Code plugin with a PreToolUse gate, a SessionStart digest and a PreCompact reminder; adapters for Codex, Cursor, Copilot, Gemini and Windsurf; a post-commit hook; a PR comment Action | None. The post-commit hook back-fills git_commit on events from the last 60 minutes; the embeddings index is rebuilt only by selvedge index | None stored. Status active, reverted or reopened is derived from the newest event on a path; reasoning is self-reported and the README says nothing verifies it | Rejections are first-class records found as exact rows; supersede is a link, not an edit; a gate blocks schema edits on reverted entities until prior attempts are checked; the hash chain makes silent deletion and edits detectable; committed pilot results recompute from their raw rows | Any later non-removal event silently restores a rejected path to active; the gate's prior-attempts check reads telemetry with no session column, so any query in the window unblocks; no per-event delete, so a secret in reasoning stays until an age prune; embeddings outlive pruned events |
semantica |
Two units that never meet. A MemoryItem — content,
timestamp, a free-form metadata dict, extracted entities and
relationships — living in a process dict with a JSON save file. And a
ContextNode/ContextEdge in the context graph,
each carrying valid_from/valid_until, with
knowledge-graph relationships additionally carrying
recorded_at and superseded_at |
In-process dicts plus agent_memory.json for the memory
store; an in-memory graph with Markdown-directory and JSON persistence
for the context graph; SQLite for versions, tags and the mutation log;
and adapters the operator points at — FAISS, sqlite-vec, pgvector,
Qdrant, Milvus, Pinecone, Weaviate for vectors, Neo4j, FalkorDB, AGE and
Neptune for graphs, Jena, RDF4J, Oxigraph, Blazegraph and Anzo for
triples |
ContextRetriever fuses a vector arm and a BFS
graph-expansion arm under a hybrid_alpha weight with a
multi-source boost. AgentMemory.retrieve is meant to add a
third: short-term buffer, then the vector store, then a keyword fallback
— but its vector branch only consumes results when the store exposes
search and not search_vectors, and the
package's own VectorStore exposes both, so for the
documented configuration the long-term arm contributes nothing and
recall falls back to word-overlap keyword matching |
Synchronous and immediate: store() appends to a
short-term buffer, embeds into the vector store when one is bound, puts
the item in the dict, pushes entities into the knowledge graph, and
applies the retention policy — all on the caller's thread, all
retrievable at once. No extraction model on the write path; graph
construction is deterministic by design and an LLM is optional
everywhere it appears |
The context graph distinguishes two operations and documents the
difference: retract_node closes the validity window,
leaving the record in history and in state_at before the
cut, while purge_node removes it and leaves a tombstone
that deliberately excludes the content. An
ErasureCoordinator drives purge across the graph, the
memory store and the vector store and returns a receipt naming which
stores it reached. AgentMemory deletes outright, and its
filtered deletion is where the boundary fails |
Stored but not enforced where it matters. user_id and
conversation_id live in item metadata and are filtered by
the dedicated get_by_user and
get_conversation_history accessors;
_matches_filters — which retrieve,
clear_memory, count and list all
route through — recognises only type,
start_date and end_date and returns True for
everything else, so an unknown filter key is neither honoured nor
rejected |
A Python API, a 22-group CLI, a FastAPI Explorer with a React
workspace UI, a JSON-RPC MCP server exposing graph, retrieval,
extraction, reasoning, decision and export tools, and framework adapters
for Agno, CrewAI, LangChain and others under
integrations/ |
None required. Ingestion, extraction, deduplication and export are
explicit pipeline stages the operator runs; there is no scheduler, no
worker loop and no consolidation timer. Retention is applied inline on
every store() |
Provenance is the product and it is thorough — per-source
credibility, conflict detection across five conflict types, decision
records with causal chains, and a provenance manager with integrity
checks. Epistemic status is not a field: a conflict resolves to a value
with a confidence float, or returns resolved=False with a
requires_manual_review flag that nothing in the tree
reads |
The temporal model is the real thing — four timestamps, both axes queryable, retraction separated from erasure, and a purge tombstone that omits the content on purpose because keeping it would defeat the erasure it records | forget(conversation_id=...) and
forget(user_id=...) — both shown in the method's own
docstring — delete every memory in the store, because the filter keys
they build are ignored by the predicate they are passed to; the same
root cause as the days_old inversion fixed one commit
before this pin, in the same function, with the other two arms left
untested |
serena |
A named Markdown file — a topic path like frontend/debugging — whose body may cite other memories as mem:name | Files on disk: .serena/memories/ per project plus one shared global root; no database and no index | None automated. Names are listed at project activation and the agent reads by name, following mem: links outward from a declared root | Six MCP tools the agent calls deliberately; no extraction, no capture hook, no model deciding what to keep | Real delete, real rename, and a regex or literal in-place edit; renaming rewrites every mem: reference across the store | Project root versus a global/ prefix, resolved on the read path, with a lexical containment check that rejects any name escaping either root | An MCP server whose other half is LSP-backed symbol retrieval; the memory list is injected at project activation | None. Integrity validation and reference autofix are commands a person runs | Read-only and ignored name patterns enforced at the tool boundary; a shipped maintenance memory states what may be written at all | A referential-integrity report over the memory graph — dangling mem: links, and bare names that should have been links — with the similarity thresholds tuned and tested | Traversal is the model's job with no reachability check, the ignore filter has a documented bypass, and nothing records that a memory was ever wrong |
sesa |
A Skill Card — category, pattern, common confusion, key distinction, trigger keywords and up to three query templates — carrying its own retrieved, helpful and hurt counters | One detached Ray actor holding a Python list and a float32 matrix,
persisted as skills.jsonl plus a per-update
skills_step_N.jsonl snapshot and a
meta.json |
Dense cosine over mean-pooled e5-base-v2 on CPU, top three, no score floor and no use of the usefulness counters; one question per call, since the batch method has no caller | Failures only. A bounded queue of failed rollouts is drained at a step boundary and each entry is abstracted into a card by a judge model, then dropped if it is within 0.93 cosine of anything already in the bank | No update path. A card is evicted once net_score < 0
and it has been retrieved at least three times, or forced out by the
800-card cap in ascending net-score order; seeds are immune |
None. One globally named actor, one bank, no user, tenant, run or task key anywhere in the record | Ray actor handle held by the trainer and by the problem extractor; retrieved cards are string-prepended to the solver's user message | A non-blocking Ray future fired at every step boundary, executing on the actor every tenth step when at least twenty failures are pending | Usefulness counters only. is_seed protects a card from
eviction, and there is no state that withholds a card from being handed
to the solver |
A negative usefulness signal that is actually wired to deletion —
hurt_count is written by the same rollout scoring that
trains the model, and a card that keeps losing is removed |
Eviction leaves nothing behind, so a re-observed failure regenerates the card the bank just decided was harmful; the anti-leakage parameter is implemented and never called; the pending queue is cleared before generation, so one judge outage discards up to 300 failures; the paper's 157-skill seed bank ships nowhere in the tree |
session-recall |
Two kinds. A transcript chunk: one user prompt or one assistant text block, verbatim, with session, uuid, cwd, branch, timestamp and byte offsets into the source file. A meta docs entry: one Markdown file with id, project, category (bugs, actions, decisions or user), title, body, PR list, source session keys and created and updated dates | One SQLite file under the data directory with a chunks table, a sqlite-vec vec0 table and an FTS5 table; transcripts stay in place on disk and Cursor is snapshotted to JSONL. Meta docs entries are files in a git repository the user picks, also indexed into the same SQLite file | recall_search runs sqlite-vec KNN and FTS5 bm25 with the same metadata prefilter, collapses identical content by hash, and reranks with Voyage when configured, else keeps KNN order. grep streams every indexed transcript. expand_around and step read raw turns by session and uuid. recent_sessions groups chunks by session | Background and incremental: a SessionStart hook runs sync, which re-indexes changed transcripts in one transaction per file and reuses vectors by content hash. Meta docs: a daily job hands each session's new dialogue to a caged claude or codex agent holding four MCP verbs, search, create, edit and delete; create is refused until search has run | Transcript rows are replaced when the file changes and pruned when it disappears. Entries are edited in place or deleted by the distiller with a reason of at least ten characters that is returned to the model and not stored; each run ends in one git commit per changed project. No tombstone | A cwd column filtered by a boundary-safe prefix predicate when the caller passes scope_cwd; it is optional, the bundled skill says to retry globally when a scoped result is thin, and expand_around and step take no scope. Meta docs entries are indexed with an empty cwd, so every scoped search excludes them. The team hub pools every member's history with owner as attribution only | A stdio MCP server with five tools for Claude Code, Codex and Cursor plugins; SessionStart hooks that background a sync; UserPromptSubmit and Stop hooks that push to a team hub when one is configured; a CLI; a peer-to-peer ask with owner approval | The SessionStart sync; a launchd or systemd timer for the meta docs run, one run at a time under flock, sessions oldest-first with per-session watermarks that advance only after a successful call; a hub indexer on its own timer | None on stored material. Transcript chunks are records of what was said; meta docs entries are written straight into the store and served without a status. The pending, approved and rejected states belong to outbound peer answers | An embedding-space fingerprint that turns semantic ranking off rather than mixing vector spaces, and says so in a degraded field; orphan guards on both retrieval arms; one delete criterion inside the write transaction; a distiller whose dedup and secret checks are server mechanics rather than prompt requests; no transcript left behind by distiller or composer runs | Distilled entries reach every future unscoped search with no review step; the delete reason the tool demands is discarded; meta docs entries are invisible to scoped search and cannot be filtered by source; a peer grant is matched on a repository basename; the codex composer keeps read access to the disk |
shellbrain |
An immutable typed text record (problem, solution, failed_tactic, fact, preference, change) citing episode events, plus concept graph records: concepts, claims, relations, groundings to code anchors, and memory links | Local Postgres 16 with pgvector in a managed Docker container or an external DSN; host transcripts copied into episode tables; code snapshots in a repo-local shadow git | Query lanes run Postgres FTS plus Python BM25 and pgvector cosine over MiniLM embeddings, fused by RRF, expanded through structural relations and the concept graph, then summarised by a Codex, Claude or Inception model into a brief | Background only in intended use: a poller syncs transcripts every 5 seconds and, after 15 idle minutes, launches a Codex or Claude knowledge-builder agent that writes through the CLI; every memory must cite an episode event visible to the repo | No delete. Text is immutable; update_lifecycle moves status among six values and appends an event; fact_update_link adds superseded_by relations without changing the old fact's status | repo_id on every row with a SQL predicate on both arms; scope repo or global, where global widens only within the same repo_id on search and across repos only through concept links; repo id overridable by flag | CLI only. The installer adds a Claude Code SessionStart hook for caller identity and skill files for Claude Code, Codex and Cursor telling the working agent to call recall and snapshot and never write | Per-repo transcript poller exiting after 15 idle minutes; build_knowledge runs per episode watermark under an episode lock, with provider, model and outcome recorded in knowledge_build_runs | Lifecycle status filters superseded, wrong and archived memories on every read; claims carry the same statuses as labels; actor on each transition is caller-supplied | Evidence refs checked against repo-visible episode events on every write; one visibility predicate shared by every SQL read; lifecycle transitions logged with rationale and evidence; model-returned code references must appear in the supplied evidence; committed must-not-retrieve tests with controls | Inner agents run Codex with danger-full-access and no approval; the route allowlist is an environment variable; wrong memories are invisible to the builder's dedup read, so they can be re-extracted; the working agent receives model prose with no memory ids |
shisad |
A MemoryEntry with an entry type, a key and a value,
carrying the trust triple — source_origin,
channel_trust, confirmation_status — and the
trust_band and confidence derived from it, an
ingress_handle_id binding it to the admission that let it
in, an owner pair of user_id and workspace_id,
an importance_weight and decay_score, a
superseded_by pointer, and taint labels. Beneath it a
retrieval layer of records, vectors, keys and metadata |
SQLite, with tables for memory_entries,
memory_events, retrieval_records,
retrieval_vectors, retrieval_keys and
retrieval_metadata. A derived graph is rebuilt from the
canonical entries rather than being authoritative. A legacy
memory_events.jsonl path is still recognised alongside the
SQLite store |
Six compiled surfaces rather than one query: identity, active
attention, recall, procedural, thread resume and evidence. Each is a
compile_* call that filters by owner scope and, for
identity, by trust band, ranks by importance weight times decay score,
and fills a token budget. Recall reports a sufficiency assessment;
thread resume carries prior-session context explicitly labelled
untrusted evidence that "does not authorize side effects" |
MemoryManager.write returns a decision rather than a
row: allow, require_confirmation or
reject with a reason. Before that,
derive_trust_band looks the trust triple up in a validated
matrix and raises on an unknown combination; PII is detected and
redacted into the stored value; an external-origin write that is neither
confirmed nor pending review is refused, as is a suspicious one. Trust
fields are set by the runtime from the ingress handle, never accepted
from the caller — and a note.create or
todo.create the model proposes counts as user-confirmed
only when every field it would store is structurally anchored in the
sanitised text of the current user turn |
Supersession by pointer — a new entry names the one it replaces, the
old keeps a superseded_by and drops out of the identity
surface, and a supersession whose target is outside the caller's owner
scope is rejected as not found. Soft deletion is a predicate the manager
checks. Consolidation runs under a capability scope that forbids
network, tool recursion and self-invocation, and its writes resolve to
the untrusted band by construction |
An owner pair, enforced together. A read or write that names a user
without a workspace is rejected outright rather than falling back to a
partial filter, and _entry_matches_owner gates every
surface. Session-scoped entries are filtered separately, and channel
participation binds an entry to the channel that produced it |
A long-running daemon with a CLI, a TUI, channel adapters for messaging platforms, a scheduler, a sandboxed executor, a policy enforcement point in front of every action, and a self-modification subsystem. Memory is one subsystem of a security architecture rather than a standalone service | A consolidation worker under an explicit capability scope; a summarizer; identity-candidate detection; a derived graph rebuilt from canonical entries; a decay score applied at read time; an adversarial metrics script and gate that a person runs | The trust band is the epistemic field and it admits or withholds;
confidence is a number the same rule carries and is used for weighting.
The triple that produces both is validated rather than free-form, and an
unenumerated combination is an exception rather than a default — except
for pending_review, which short-circuits the lookup and is
untrusted whatever carried it. Consolidation cannot raise trust — its
writes are untrusted by construction. Historical thread content is
surfaced with an explicit statement that it does not authorise
action |
A trust band derived from a validated triple rather than asserted by
a caller, with an unknown combination raising instead of defaulting; an
owner scope that refuses a half-specified request rather than filtering
on the half it was given; an identity surface whose test pins the exact
returned set before asserting what is absent; an append-only event store
keyed to the entry it describes; a consolidation worker that
mathematically cannot upgrade trust; a review queue a person lists and
adjudicates with /identity, on a channel check, while the
model's thirty-five-tool surface carries no memory verb; a
note.create that only counts as user-confirmed when every
stored field is structurally anchored in the text of the current user
turn; a security document that cites the memory-poisoning literature it
is defending against |
No validity time — as_of is a reference clock for
decay, not an interval on the record, so a fact true last quarter cannot
say so; no record of a rejected value on the ordinary write path, so a
write refused as poisoned leaves nothing a later write consults and the
same claim can be attempted again — only
memory.timeline_promote audits its rejects, with a content
digest nothing reads back at admission; the review queue is reachable
only from a cli session in the default mode, so a pending
candidate raised on a messaging channel waits for the person to come
back to the terminal; the six surfaces each filter for themselves, so
only identity applies the trust band and a reader should not assume the
others do |
shodh-memory |
An experience with extracted entities, joined into a Hebbian graph of typed and co-occurrence edges | RocksDB — one instance per user, plus a shared column-family database for audit and cross-user state | Vector plus lexical hybrid with spreading activation over the graph; no model call at query time | Fire-and-forget ingest — NER, YAKE keywords, a fourteen-gate entity filter and a PMI edge gate, all local | Hebbian strengthening split into a strengthen-only retrieval path and an outcome-gated minting path, hybrid exponential-then-power-law decay, pruning by weight, no rejected-value record | A separate RocksDB instance per user rather than a scope predicate on a shared store | MCP, an HTTP API, a TUI, Zenoh/ROS2 transport for robotics, and crates.io, npm, PyPI and Docker packaging | Consolidation, edge aging on a six-hour cadence, audit rotation and index compaction | Edge tiers with promotion rules and an implicit feedback system inferring usefulness from agent behaviour | A committed self-audit written to the standard this atlas uses, reporting its own dead code and broken gates | The upsert path still mints ungated CoOccurs edges, so
every PMI guarantee is void for upsert and webhook traffic — though
those edges now carry a provenance record at birth |
sibyl-memory |
Five tier-specific rows rather than one record type. A warm
entity is a tenant, category and name with a JSON-validated
body and a free-form status; a hot state_document is a
keyed JSON body; a cold journal_event is a timestamp with
four optional JSON payloads; a reference_document is keyed
text with metadata; an archived_entity preserves a body
with an archive time and reason |
One SQLite file at ~/.sibyl-memory/memory.db in WAL
mode, its directory created 0700 and the file 0600, with symlinked or
hardlinked databases and sidecars refused; twelve base tables, five FTS5
virtual tables and a runtime-generated trigram shadow. The schema calls
itself a port of a canonical Postgres schema held elsewhere |
FTS5 with a porter unicode tokeniser, one match per tier, unioned and sorted by a proximity bucket then rank then tier; on an empty head a ladder of relaxed query variants, then a folded-trigram shadow fallback. Over it a retrieve-then-verify layer with a coverage threshold, an anchor band, a document-frequency abstention and a negation policy of abstain. No embeddings anywhere | Four of eight MCP tools write: remember upserts an entity, forget archives one, set state replaces a keyed document, record event appends to the journal. Nothing extracts or summarises; the model supplies the body and a JSON validity check is the only gate besides a capacity check | An entity is upserted in place by its unique tenant, category and
name. Archiving copies the body into archived_entities with
a reason and removes the original; a separate delete is a hard
DELETE with nothing left behind. The MCP forget archives
and the Hermes provider's forget hard-deletes, which is the same verb
with opposite semantics |
A tenant on every table and in every read query, validated at construction and switchable at runtime; in the LangGraph adapter a namespace tuple is stored as the entity category and applied as a prefix filter on read | Five published packages — a client engine, a CLI, an MCP server of eight stdio tools, a Hermes provider and plugin adapter, and a LangGraph store — plus a Dockerfile whose entrypoint is the stdio MCP server and a compose file that states it is not a network service | None. A usage heartbeat fires every fifteen operations or ten minutes, and a capacity check may call out at the storage boundary; nothing rewrites memory | None on a stored memory. The entity status is a free-form caller string with no withholding semantics and is filtered only when the caller passes one; the only constrained status vocabulary belongs to skill proposals, which are not yet memory | A zero result that names which of five causes produced it rather than looking like an empty store; a negation policy that abstains instead of answering; an isolation weakness documented in a lock comment with a named regression test rather than left implicit; refusing to open a symlinked database file; 1,055 test functions against 16,000 lines | Tenant isolation is a post-filter on an unindexed column, which the authors flag and defer; four of twelve declared tables have no writer and one of those is read with a column name it does not have behind a silent except; the review queue has no shipped interface and the CLI command the docs name does not exist; the README's claim that tier verification is the only outbound call omits a usage heartbeat the project's own other README discloses; no CI runs the 1,055 tests |
sift-kg |
Entity node and typed relation edge in a NetworkX MultiDiGraph,
serialised to graph_data.json |
JSON graph plus per-document extraction JSON; exports to GraphML, GEXF, SQLite, CSV | Fuzzy name match and exact id lookup, n-hop subgraph, Leiden-style communities and bridge entities; no embeddings on the read path | LLM extraction per document chunk, then a deterministic rebuild of the whole graph from the retained extractions | Entity merges and relation rejections applied to the graph;
sift build regenerates the graph from extractions and
consults neither decision file |
One output directory per corpus; no scope key on any node or read | CLI, JSON output on every command, and a bundled agent skill telling
a model to orient from sift topology and query before
answering |
None — every stage is an explicit command | A confidence float per entity and relation, and a
DRAFT/CONFIRMED/REJECTED status
on the proposal rather than on the memory |
Raw extractions are retained per document, so the derived graph is
genuinely rebuildable and every entity keeps
source_documents |
The rebuild is what reverts the corrections:
sift resolve truncates the merge decisions and
sift build never reads them |
signetai |
Two layers that never merge: an immutable episodic row — content,
type, tags, importance, agent_id, visibility,
scope, project, a content hash,
memory_kind = 'episodic' and a canonical
evidence_meta payload — and a derived semantic layer of
entities, aspects, grouped claim values, dependencies and epistemic
assertions that Dreaming writes from those rows and projects back as
memory_kind = 'derived' |
One SQLite file behind a single owner process, WAL, 152 migrations
and 114 tables, with FTS5 over memories, artifacts and transcripts and a
vec0 virtual table from sqlite-vec; identity files
(AGENTS.md, SOUL.md, USER.md, MEMORY.md) and a libsodium-encrypted
.secrets/secrets.enc on disk beside it |
Hybrid: FTS5 lexical, sqlite-vec vector at alpha 0.7, graph traversal candidates, prospective hints and a temporal-facet arm, fused as structured evidence, dampened and optionally reranked by an LLM; a content-safety join drops instruction-shaped rows before scoring | Harness hooks stream transcripts into the store;
remember over MCP, HTTP, CLI or a plugin writes an episodic
row synchronously, retrievable at once. No extraction on the hot path —
the semantic layer is built later by Dreaming |
Soft delete with is_deleted/deleted_at,
superseded_by and stale_at, all three excluded
by one shared currentMemorySql predicate; a
preview-then-execute forget; a source purge that also deletes the claim
projections derived from it; the retention worker hard-deletes
soft-deleted rows after 30 days and history after 180 |
agent_id plus a three-valued roster read policy
(isolated, group, shared) applied as SQL on every recall arm, with
visibility != 'archived'; project and a nullable
scope column layer on top. In the default
local auth mode no token binds a caller to an agent id |
A daemon with a Hono HTTP API, a stdio and HTTP MCP server whose base tool set names 62 tools, hooks for session start, prompt submit, pre-compaction and session end, connectors for ten harnesses, a CLI, a dashboard, a tray and desktop app, and a browser extension | A dreaming worker sweeping every 5 minutes for content and hygiene passes, plus transcript capture, transcript recovery and import workers, embedding and synthesis workers, reflection, a 6-hourly retention sweep, database integrity and vacuum | A deterministic content-safety ledger scoring every memory,
artifact, transcript and summary
clean/tainted/blocked with a
reason vocabulary, joined into recall so only clean rows
are eligible; contradictions are recorded as durable observations rather
than resolved into a winner; every Dreaming write must cite a quote that
is a verbatim substring of a scoped episodic source |
An exact-quote citation gate enforced in code before any graph write, an immutable evidence layer the derived layer can always be rebuilt from, a prompt-injection ledger on the read path, agent scope in SQL with tests that cannot pass vacuously, and source deletion that reaches the derived claims | The published 97.6% LongMemEval figure has no committed artifact and
the in-tree ledger's largest sample is 12 questions; CI runs about
twenty named test files while the tree holds 464; a forgotten value can
be written straight back; /api/memory/review-queue selects
three event names nothing writes; and captured transcripts reach SQLite
with no credential scrubbing at all |
silica |
None at this commit; Silica Core indexes files for retrieval. Until
8 September 2026, a markdown note in a vault, with OKF-shaped
frontmatter, a reliability tier derived from whether its verbatim source
is on disk, and per-claim valid_from stamps in HTML
comments |
The vault is a folder of markdown the user owns; SQLite beside it
holds the op ledger, the undo journal and the indices, and
sources/ keeps verbatim originals that are
retrieval-invisible by construction |
A hand-rolled BM25 with optional embeddings (~6% accuracy difference from the CPU-only fallback, per the README), a graph layer, and a context builder that assembles what reaches the model | The harness guides, the LLM proposes, a parser and a finite-state machine verify and execute; every write is checked against its source and reverted if corrupted | Atomic write with an inverse recorded per path per run,
/revert from the undo journal, merge with
mark_superseded_by pointing the loser at the winner, and a
contested flag that neither deletes nor overwrites |
Per vault. An index directory and a ledger per vault, and
sources/ excluded from search by construction; no principal
key inside a vault |
At this commit, five MCP tools and a CLI — files, search, read, code_pack, write_note. Until the cut, a CLI, a Claude Code plugin with SessionStart/PreCompact/Stop hooks, an MCP server, and a web UI — four interfaces over one vault | A run digest that surfaces contested notes, a work queue, checkpoints, and residue/ROI passes; nothing on a timer in the write path | A reliability tier read from whether the verbatim source is retained, a human-verified marker, and a contested flag carrying its reason — the flag labels a claim at the point of use rather than withholding it | Contradictions are kept visible rather than resolved away, the auto-resolver refuses in the direction it would get wrong and measures its own precision, and the eval harness refuses to run a gate whose metric cannot discriminate | The governed-memory layer — contested flags, per-claim clocks, the undo journal and the eval harness — was removed on 8 September 2026. Before that, a contested note was still retrieved — the flag rides along as a rendered reason rather than gating admissibility; the op ledger's UPSERT overwrites the record of a failure with a later success; and the numbers in the README are one run each |
sillytavern |
A World Info entry: human-authored content plus primary and secondary keys, a logic mode, insertion position, order, depth and timed-effect settings | JSON lorebook files per world under the user's worlds/
directory, plus a rolling summary in chat metadata |
Keyword scan over a depth-bounded window, four logic modes, bounded recursive activation, token budget with a cap | A person types it. The optional summarize extension writes one rolling LLM summary into chat metadata | Edit or delete the entry in the editor; @@dont_activate
suppresses an entry without removing it |
Per-world lorebooks, character-bound or global, with an insertion strategy deciding precedence | The chat UI itself; entries are injected into the prompt at author-chosen positions and depths | None for lorebooks; the summarize extension runs on a message-count or token trigger | None. An entry is as true as whoever wrote it, and no field records who or when | Sticky, cooldown and delay as first-class activation state; negative key logic; a budget with a cap | Imported lorebooks carry no author field; recursion plus keyword triggers make activation hard to predict |
silverbullet |
A Markdown page in a folder, identified by path and by the SHA-256 of its bytes; objects — tasks, attributes, tagged blocks, frontmatter — are parsed out of it into a per-client index | Plain files on disk behind a Rust server; an optional git repository in the same folder holds revisions; the object index lives in the browser's IndexedDB | A fuzzy ranker over page names and text, and the object index queried by tag and attribute; no embeddings, no server-side search | PUT with the last-seen hash in If-Match, or POST with base and proposed text for a server-side three-way merge; a human types, a script writes, an external process edits the file, all through the same path | Update is a conditional overwrite; delete is a conditional file delete; git keeps what was overwritten when revisions are managed, and a conflicted merge is written back into the page between markers for a person to resolve | A space is a folder; on a multi-space server each account holds read, write or no access per space, resolved before any handler runs; inside a space there is no key | The HTTP file API with a bearer token or account session, a Server-Sent Events change stream, Space Lua in the browser, and identities an agent can be given a name under | A file watcher classifies every change as the server's own write or external; the revision engine commits dirty paths thirty seconds after quiet, at least every five minutes, and sweeps hourly | None on content; attribution — account, local user, external, system
— travels with the write and lands in the commit author, and a
self-declared -- @name on a block is a label, not a
credential |
Fail-closed preconditions with an ETag any client can carry; a three-way merge that hands the conflict to a person instead of picking a winner; write attribution that survives to git without a server-side database | Everything a writer can reach it can also run, so write access is trust; the object index is per browser and lags; a memory is a page, so an agent that stores facts here gets no state, no supersession and no scope inside a space |
simplemem |
A MemoryEntry — a lossless restatement with pronouns
resolved and times absolute, plus keywords, timestamp, location,
persons, entities and topic |
LanceDB behind a small vector-store wrapper for the text pillar; a separate SQLite schema with seven tables for EvolveMem | Query analysis, then parallel semantic, keyword and structured searches, merged and deduplicated, then an LLM adequacy check that can fire further query rounds | Windowed LLM extraction over dialogue batches, parallelised across workers; entries are added, never revised | The text store has add_entries,
get_all_entries and clear() — no delete, no
update. EvolveMem adds update_content, archive, and a
superseded status |
Absent from the text pillar entirely; scope_id NOT NULL
on every EvolveMem read, with a scope_access
principal/permission table beside it |
A CLI, an MCP server, an HTTP server with per-user API keys, a Claude skill, and a benchmark runner per pillar | None on the text path. EvolveMem runs a closed-loop evaluate-diagnose-propose-guard cycle that rewrites retrieval configuration, not memories | An importance and a confidence float on
EvolveMem units, moved by thumbs-up/down feedback; the text pillar has
no trust representation at all |
Memory units built to be context-independent — coreference resolved and time absolutised at write; an append-only event log recording seven mutation kinds | Six headline benchmark figures and no committed result artifact for any of them; the pillar the papers are about cannot delete or correct a single memory |
sivtr |
A work record — one terminal command or agent turn with a title, start and end time, an outcome and an exit code — stored as a MessagePack blob inside a session | A SQLite archive of sessions, records,
secret_findings, usage_events and
record_embeddings, with each record held twice:
blob in full and blob_light with the part text
stripped |
BM25 over the record index with field selection and filters, plus optional embeddings, and an eval harness of golden queries with IR metrics | Ingest by syncing provider transcripts and terminal history; a re-sync that produces identical refs replaces rows in place | Sessions and their records cascade on delete; re-sync replaces
rather than appends, and secret_findings for a session are
deleted and rewritten on each pass |
A workspace_key and cwd_norm per session,
applied as a filter only when a non-empty key is supplied; an
Origin registry addresses local workspaces and remote
device mounts behind one display type |
A CLI, a VS Code extension, an MCP surface, a packaged
sivtr-memory skill, and a share-web target for published
snapshots |
Provider sync with mtime and size gating, embedding generations, and index caches | A credential-pattern scan on ingest recording the kind and count per
session without storing the match; redaction applied on the publication
and remote paths; a PublicationDraft that counts the risks
needing manual review before anything leaves the machine |
The privacy split is the right one and is stated honestly:
privacy.rs says outright that it "deliberately only removes
high-signal credential formats" and "is a reduction in accidental
disclosure, not a security boundary: callers must still ask the user to
review the resulting snapshot before publishing." On ingest,
replace_secret_findings runs the same scan but discards the
redacted text and keeps only the report, writing a
secret_findings row of kind and occurrence count — so the
index knows a session contains three GitHub-token-shaped strings without
holding a copy, and the raw record stays local where the user needs it.
Redaction then runs on the publication and remote paths. The schema
comments are unusually disciplined about not storing what can be
derived: costs "are NOT stored: they are computed at read time from the
embedded pricing snapshot, so a pricing refresh re-prices history
without touching these rows", the terminal/agent kind "is not stored: it
derives from the record ref", and blob_light exists so a
listing never pays for part text |
The retrieval eval cannot be reproduced from the repository.
sivtr eval is documented as measuring "against a
snapshot of real data (frozen corpus + labeled
queries), so ranking changes are gated on measurable improvement over a
fixed baseline instead of feel" — but no golden-query file and no frozen
corpus are committed, so the baseline is each user's own machine and no
reader can check a ranking claim or reproduce a regression. A
GoldenQuery lists the records a query should surface and
nothing lists records it must not, so the harness measures recall of the
labelled set rather than exclusion. Redaction is pattern-based and the
module says so; anything credential-shaped that misses the nine patterns
reaches a published snapshot, and the stored raw text is unredacted by
design. The workspace filter applies only when a non-empty key is
supplied, so it narrows a query rather than bounding one |
siyuan |
A block in a notebook — a paragraph, heading, list item or document with an id, attributes, references and a content string — plus, per chat, a session file of entries typed user, thinking, assistant, confirm, snapshot or rollback | Markdown-JSON files per document on disk, mirrored into a SQLite
index with FTS tables and a block_embeddings table; agent
sessions as JSON under storage/ai/agent/sessions/; a data
repository of snapshots the agent path writes to before it changes
anything |
The search tool's fulltext action over the
SQLite index and its semantic action, a query embedding
scanned against every block vector in pages of 4,096 into a top-k heap,
then an optional reranker over the candidates |
The agent calls a tool; a write, an egress or a paid call waits for the person's confirmation unless always-allowed; the first local write of a chat is preceded by an automatic snapshot of the data repository; the session file is saved with a revision number and a turn id | Blocks are edited in place through the block and document tools; the
history tool lists, searches and rolls back document
history; a session's snapshot entry lets the person roll the workspace
back to before the agent wrote |
A workspace is the store; the MCP endpoint requires the administrator role so the anonymous publish reader cannot reach it; inside a workspace there is no principal on a block | An in-app agent panel over any OpenAI-compatible, Anthropic or
Gemini endpoint; a Model Context Protocol server on /mcp
exposing the same tools to outside agents; external MCP servers and
frontend capabilities the agent may call after approval |
An embedding indexer that wakes every thirty seconds, embeds pending blocks through an OpenAI-compatible API in batches with backoff, and skips encrypted notebooks | None on content; the compaction summary is injected under a system message that calls it untrusted historical memory; the doom-loop tracker counts repeated failed calls with the same signature | Confirmation by declared effect rather than by tool name; a snapshot before the first write with a rollback entry in the session; a session file with optimistic revisions and orphaned-turn recovery; the MCP surface behind the administrator role | Semantic search needs an API key and scans every vector; the agent's
only durable memory beyond the notes is the session transcript and
whatever it saves as a skill; approval fatigue is one
always allow away from a store the agent edits freely |
skales |
An ExtractedMemory — id, category, content, source
conversation id, extraction time, relevance keywords — plus tiered
memory files and a soul profile of known facts |
JSON files under .skales-data/: one per extracted
memory, plus short-term, long-term and episodic files and the soul
object |
Synchronous keyword scoring — overlap 0.70, recency 0.20, category boost 0.10 — top five, no LLM, behind a 30-second cache | Regex extraction over conversations since the last scan, run every 90 minutes; no model in the write path | Extracted memories and tiered files delete cleanly; known facts have no per-fact delete path in code, and a matching chat phrase adds one on any turn | None. A single-user local application with no user, project or tenant key | An Electron desktop app with a Next.js web surface, chat, cron tasks and a dedicated memory page | A 90-minute scan driven by a cron job, watermarked by
lastScanTimestamp |
A source conversation id on every extracted memory; no confidence, no state, no verification | Zero-LLM capture and retrieval, both cheap and legible; a real memory management page; provenance on every extracted row | The documented deletion path for facts is a chat phrase nothing implements, and that phrase is bound to capture and retrieval instead |
skillcorpus |
A SkillRecord — one SKILL.md body with its
frontmatter name and description, the source repository and path, an
upstream licence string, a 16-class category and tags, a 0-1 quality
score, rule-based safety flags,
has_scripts/has_references structure bits, a
deleted marker and a superseded_by pointer,
keyed by {source}__{slug}__{hash8} where the hash is of the
body itself |
One SQLite database per library — skills beside two
judgment caches, quality_judgments keyed on a body hash and
dedup_judgments keyed on a sorted hash pair — plus a
vec_skills sqlite-vec table and a FAISS sidecar for
near-duplicate search, the skill bundles as directories under the
library root, and a parquet corpus with zstd attachment tarballs as the
published artifact |
Two different readers. The producer queries vectors only to find
near-duplicates at write time. The consumer engine fans out over the
host's skills directory (self-contained Okapi BM25 with CJK tokenisation
and corpus-wide stopword pruning), the SkillHub catalog and optional
ClawHub/skillhub.cn marketplaces, fuses by weighted RRF at
k = 60 with per-source trust weights, then an LLM gate
reads name, description and a 300-character excerpt and returns at most
two |
Writes are a batch build, not an agent action: crawl, parse, regex safety block, structural thresholds, exact-hash duplicate check, LLM near-duplicate judgement, embed, copy the bundle, insert. Nothing an agent does at answer time writes back: no path in this tree persists a usage or outcome signal. The consumer plugin does emit one — it returns the injected skill ids in the segment metadata so the host can correlate skills shown against skills used — and nothing here consumes it. Retrieval latency is a rewrite call, a fan-out and a gate call, each with its own deadline, and a failure injects nothing rather than raising | Exclusion is deleted = 1 with the row retained:
near-duplicate losers carry superseded_by, safety
exclusions deliberately leave it NULL so the two are distinguishable.
Both are re-derived on every build from caches keyed on the content hash
rather than trusted from the row, which is what survives a re-crawl —
the row itself is overwritten by INSERT OR REPLACE under a
hash-derived id. SkillStore.delete and
SkillStore.update have no caller in the repository |
None on the read path. The engine's sources are physical partitions
— a workspace directory, a packaged builtin directory, extra named
directories, a remote catalog — each searched as its own pool and
weighted, with no scope key on a record and no predicate on a query. The
catalog arm applies a hub_min_safety quality floor of 0.7
and a keyword-relevance guard, both content filters |
Five host plugins over two engines with the same file layout in
Python and TypeScript: a UserPromptSubmit hook for
automatic per-turn retrieval, an MCP stdio server exposing
skill_search for on-demand retrieval, and packaged builds
for OpenClaw 1.x and 2.0, WorkBuddy, Hermes, Raven and the DeepSeek
Harness. Raven's automatic mode is shipped inert pending an upstream
slot |
No workers and no scheduler. Everything heavy is a stage of
cli build — quality judging, cross-source dedup, licence
activation, the safety gate, export — run as subprocesses in a fixed
order and re-run in full each time; there is no cadence or incremental
refresh state |
Provenance is per-skill and durable — source repository, path, URL
and licence, with an upstream licence audit that activates only sources
on a GREEN whitelist. Epistemic status is two booleans owned by two
gates, deleted and active, both meaning
excluded from the export rather than doubted; the LLM's utility,
robustness and safety facets are numbers spent on a threshold and a
ranking score |
Every curation decision is cached under the hash of the content it judged, so re-crawling the same body cannot quietly re-admit it and cannot re-roll the verdict; the gates are re-derived on each build rather than trusted from a row | Nothing here is agent memory in the experiential sense — the corpus only flows outward, and no signal from a turn ever reaches it; the exported corpus is third-party instructions retrieved by similarity and injected verbatim, with the injection path defended and the content defended only by the LLM's own judgement at build time |
slowave |
Three layers over one event store. A raw event is an appended session turn with its embedding, an optional agent-supplied source-event time, and the logic version it was ingested under. An episodic memory groups events with their text and provenance. A schema is the durable claim: content text, facets and tags, a scope id and kind, a status and stale reason, confidence and salience, an embedding with packed facet axes and strengths, supporting episode ids, a labile flag, a generalization stage, first-formed and last-updated stamps, and the logic version it was formed under. Beside the symbolic layer, semantic prototypes are latent cluster centroids | One local SQLite database, 33 tables and four FTS5 indexes, with a schema.sql carrying design commentary. Latent prototypes and their edges, symbolic schemas with normalised evidence, relation and co-activation edge tables, sessions and continuities, a raw_events spine appended per turn, retrieval and feedback event tables, a per-candidate retrieval-decision trail, feedback-derived learning projections, a derived procedure-search projection, replay checkpoints, worker runs, graph-health snapshots, and a scope registry. Embeddings are computed locally through ONNX encoders, one of them a multilingual model fetched at a pinned revision on first use | Mode-gated hybrid recall with no LLM call. The MCP tools deliver from a declarative catalog: per-cue FTS and embedding candidates, both scope- and status-filtered in SQL, unioned with a multilingual dense channel, passed through the working-memory gate, and selected for coverage of the task's needs. Recall with full evidence also runs the older pipeline, which adds episode search ranked partly by source-event time and relation expansion under the same status and scope gate. Advisory procedures are retrieved separately, filtered to the exact scope, by reciprocal-rank fusion of applicability, strategy and FTS ranks | The agent decides what is durable and calls slowave_remember, which appends a raw event and writes a schema directly; slowave_activate opens a session, slowave_recall asks for context, slowave_feedback reports whether what came back helped, and slowave_commit closes the session. Every turn lands in raw_events, and the consolidated layer is built by replay and consolidation, both zero-LLM and geometric | Feedback drives the lifecycle: a schema can be reinforced or marked stale with a reason and a named replacement, and salience and confidence are recomputed from the feedback ledger. Consolidation reinforces an existing engram in place, keyed on the primary prototype, and dedup_exact archives exact normalised duplicates into a canonical row. Removal is a hard delete from the dashboard: the schema row goes, and the recall items, feedback events and JSON references naming it are scrubbed in the same transaction. A procedure is deleted by stripping it from its raw_events payload; its row in the procedure-search projection and its FTS entry are left in place | scope_id and scope_kind on every schema, a scope_registry, and SQL filtering on the candidate queries when a scope is set. Cross-scope reach is earned rather than granted: a generalization stage from 0 (scoped, hard-blocked) through 1 (portable within the same scope kind, above a score floor) and 2 (contextual, admitted with a 0.70 score multiplier and the floor re-checked on recall) to 3 (global). The MCP tools fix the mode to strict_scope | An MCP server with five tools, published on PyPI with a Homebrew formula, with a setup command that configures every detected client — Claude Code, Copilot CLI, Codex, Cursor, Cline, Windsurf and Devin Desktop, OpenCode, and Claude Desktop — and installs daemon, worker and backup user services when run, or from the Homebrew formula's post_install, plus a local web dashboard with a Cytoscape graph view. No LLM API key is required for any memory operation | A replay engine rebuilds derived memory from raw_events when the configured logic version differs from the store's, under an optimistic-lease claim so exactly one process rebuilds. Consolidation forms and reinforces schemas geometrically; unrecalled schemas older than 30 days lose salience each pass, remembered ones excepted; a daily timer snapshots the database with seven kept; co-activation edges are rebuilt from the recall and feedback ledgers and decay on a seven-day half-life; a generalization sweep advances or corrects stages; graph-health snapshots and worker runs are recorded | Four lifecycle statuses, two of which withhold a schema from every shipped read path, with a stale reason drawn from contradicted, superseded, outdated, unsupported or withdrawn. Confidence and salience are separate numbers recomputed from accepted feedback, with a shared salience ceiling. is_labile marks a reactivated trace as temporarily uncertain, kept explicitly distinct from needs_review. Contradiction and supersession are described in the source as client-owned history that the store and consolidation never infer | A cross-scope rule stated in the SQL rather than assembled by callers, with one gate function serving recall's direct and graph-expansion paths; an event store with a logic-version stamp so an algorithm change replays instead of migrating; a retrieval-gold contract with required, forbidden and history-only content in the same case, run over the real MCP boundary, with mutation tests that require the negative cases to fail when their guard is removed; a delete preview that counts the evidence links, relations and co-activations a removal will take with it; a schema file that argues for its own decisions; and a memory core with no LLM call and no API key anywhere in ingest, consolidation or recall | The automatic rebuild that runs when an upgrade changes the logic version deletes every schema and re-consolidates from raw events, and consolidation skips any prototype whose episodes hold only remember events, so a memory the agent stored with slowave_remember is not re-formed, a stale or archived status is lost on the schemas that are, and a schema a person deleted at the dashboard can return because its raw events were kept and nothing records the deletion. A status the store does not recognise is coerced to active rather than refused. Event time exists but validity time does not: nothing records when a claim stopped being true and no read filters as of a past state. The dashboard's two delete routes accept a bare localhost POST with no token or Origin check. The published benchmark numbers are LLM-judged evidence containment with the run records behind them kept out of the repository, and the LongMemEval run is an oracle configuration. It is AGPL-3.0-or-later with a separate commercial licence offered. Deleting a procedure leaves its summary, step text and originating query in the procedure-search projection, which the Home activity chart counts. And the surface is wide: 33 tables, a dashboard of over 4,000 lines, and a client-setup module that writes into every detected client and installs user services, which the Homebrew formula runs on install |
smriti |
Two kinds. An episode is one raw turn with session, role and timestamp. A fact is an extracted statement with a subject-predicate-object triple, kind, entities, optional applicability scope, a world validity window and a superseded_by pointer; observations are LLM digests stored as facts | One SQLite file in WAL mode: episodes, facts, entities, aliases, an ingest log, three FTS5 tables and float32 embedding blobs searched by an in-process numpy scan. The enterprise package migrates the same file and keeps receipts in a sidecar file | Default evidence engine: BM25 and exact cosine over episodes fused by normalised score, a session roll-up, assistant, speaker, when and time-window priors, then budget-adaptive packing. Facts come from a rank-fusion pass over BM25, vectors, entity links to two hops and key expansion. Named profiles and a zero-token router choose the policy | Explicit add() of a session. Lite mode stores turns only; full mode makes one extraction call per session, checks each model-assigned scope against the source text with one bounded correction call, and consolidates. Ingest is idempotent on a hash of messages, timestamp and session | Supersession, not overwrite: a single-valued subject-predicate-scope collision closes the old interval for zero tokens, a semantic collision gets one LLM arbitration call. Owner-only erase_session and erase_entity cascade through FTS, entity links, embeddings and derived digests. No tombstone | One database per file. A fact's scope string partitions consolidation and digests and is printed into context, but no read path filters on it | Python library; a stdlib MCP server with six tools, remember, recall, search, facts_about, add_fact and stats, lite mode unless model settings are given; erasure and aliasing are deliberately not exposed over MCP | None scheduled. refresh_observations and the enterprise sweep run when a caller invokes them | Core: none beyond CURRENT and SUPERSEDED labels. Enterprise: immutable origin and a mutable quarantine flag, filtered only by search with strict set | Supersession chain re-sorted by event time on every write; scope validation that refuses to globalise a rejected scoped fact; exact lineage and hold-aware transactional erasure in the enterprise layer; embedder identity pinned per database; committed raw benchmark rows from which the headline accuracy recomputes | Scope is a label on the read path; an MCP add_fact on a single-valued predicate supersedes the user's value with no origin check; trust filtering is opt-in and absent from context assembly; the default audit sink discards; the headline benchmark runs lite mode, so it never exercises facts or supersession |
smythos-sre |
A cache entry — an opaque string under a composed key, with a TTL
and an ACL. The two that carry conversation are messages
(the whole transcript array) and systemPrompt |
In-process Map by default (RAMCache), with
Redis, S3 and a local-file cache as drop-in connectors; persisted chats
go to files on disk through SmythFS |
Exact key lookup only. Nothing ranks, scores or searches — the transcript is loaded whole and then trimmed newest-first to a token budget | Synchronous and total. Every message rewrites the entire transcript array to the store and to the cache mirror | TTL expiry is the primary death: 3 hours for memory components, 1–3
hours for runtime context, 1 hour for the LLM cache.
MemoryDeleteKeyVal removes a value and its scope pointer.
LLMCache.clear() deletes a key that is never written |
An ACL stamped on every entry naming an agent, user or team as owner, checked on the read path. The conversation mirror is written team-scoped; the default account connector resolves every candidate to one team | Four workflow components (MemoryWriteKeyVal,
MemoryReadKeyVal, MemoryDeleteKeyVal,
MemoryWriteObject) an agent author wires by hand, plus
agent.chat(id, { persist: true }) in the SDK |
One expiry sweep per minute in RAMCache, and a
debounced context sync whose cooldown scales with serialized size. No
consolidation, extraction or summarisation pass exists |
None. No field records where a value came from or whether it may be acted on; a tool result and a user statement enter the transcript identically | Access control is a decorator on the connector method rather than a convention, so it cannot be forgotten at a call site; scope violations on the key-value components fail closed as 'key not found' | The transcript handle travels in a client-supplied
X-CACHE-ID header; the mirror's ACL is team-wide and the
default account connector puts everyone in one team; the scope pointer
is written unscoped, so two sessions sharing a memory name silently lose
each other's data |
somnigraph |
A row in memories: content and a
summary, a category of
procedural, episodic, semantic,
reflection, entity or meta, a
JSON themes array, a base_priority of one to
ten, a token count, created_at and
last_accessed, phased counters for startup, recall and
reflect, a status, a superseded_by
self-reference, a source, a layer, a metadata
blob, valid_from/valid_until, a
generated_from list, the last sleep timestamp and a use
count |
One SQLite database under ~/.somnigraph/ holding
memories, a rowid map, memory_edges,
sleep_log, the append-only memory_events, and
a sqlite-vec memory_vec virtual table whose dimension is
fixed at creation — with a startup guard that fails loudly rather than
emitting dimension-N vectors against a dimension-M index. Embeddings
come from an OpenAI-compatible endpoint |
Reciprocal rank fusion over three channels — FTS5 BM25 with the summary weighted about thirteen and themes about six, sqlite-vec cosine, and a separate theme channel — with per-channel k constants and a vector weight all set by a named tuning study. Post-fusion the score takes a UCB exploration bonus over the feedback prior, a Hebbian co-retrieval boost capped and floored, and Personalized PageRank expansion over the edge graph, which replaced naive adjacency for a measured gain. A 31-feature LightGBM reranker sits on top when its artifact is present, and a hand-tuned formula runs when it is not | remember(content, category, priority, themes) over MCP.
The write path strips secrets against eleven patterns, embeds, then runs
a same-category vector dedup: a near-duplicate with lower priority is
superseded and its search rows dropped, and a near-duplicate that does
not beat the incumbent is refused and logged. Auto-captured memories
land as pending. Every write also emits a
write_shadow event recording its three nearest
same-category neighbours and the outcome |
forget() marks a row deleted and drops its
vector, FTS and rowid rows. The supersede branch of
remember() does the same to the incumbent and sets
superseded_by. Per-category exponential decay runs on a
half-life from thirty days for episodic to a hundred and seventy-three
for meta, with entity timeless; dormancy is detected rather
than deleted. Sleep's NREM phase clusters and merges, and its REM phase
looks for gaps and generates questions |
None. One database for one person, with no project, user or tenant
key on a record and no scope predicate on any read.
session_id is recorded on events for analysis, not applied
as a filter |
Eleven MCP tools for Claude Code, registered with
claude mcp add. The README supplies a
CLAUDE.md block prescribing the rhythm —
startup_load at session start, recall with
both a keyword query and a natural-language context,
recall_feedback after every recall, remember
at session end — and a separate guide on budgets, categories and
pitfalls |
Sleep consolidation is a script rather than a daemon, in two phases named after the sleep stages: NREM clusters and merges similar memories and refreshes summaries, REM performs gap analysis and question generation. Decay and dormancy detection run with it. A shadow-load counter tracks memories that keep surfacing without being useful — tracked as metadata and deliberately not used in scoring, because tuning showed the impact was marginal | A three-value status — active,
pending, deleted — where pending
withholds an auto-captured memory from every read until a person
confirms it. Beside it a numeric confidence that feeds
scoring, an EWMA-aggregated utility from explicit feedback with
empirical Bayes priors, and a UCB exploration bonus so an unrated memory
is not permanently buried by one bad score. Nothing records that a claim
was contradicted; superseded_by records that one was
replaced |
Every tuning constant carries the study that set it, its previous
value and the measured delta, and deprecated constants say so rather
than lingering silently. A codified missing-value policy: any feature
whose missing value would masquerade as a real measurement is
NaN-encoded so the model learns an explicit missing branch, while a
feature whose zero means something keeps zero. Secrets are stripped
before storage against eleven patterns with a visible
[REDACTED_*] marker. A dimension guard that fails loud. And
an architecture document that records the project's own three-month
silent regression in full |
It is not open source — Apache-2.0 under a Commons Clause that
forbids selling, hosting or supporting it. There is no test suite:
eleven assert statements in the tree, all in a benchmark
harness. No scope key of any kind. valid_until is written
when a memory evolves and queried nowhere. The
dedup_rejected event is explicitly measurement rather than
gating, so a rejected write is recorded and never consulted. The learned
reranker's model artifact is not in the repository, so a fresh install
runs the formula — now with a loud warning, which is the fix that was
applied to a failure that had been silent |
sonder-runtime |
A distilled lesson with an embedding and FTS text, the interaction it came from and the outcomes credited to it; beside it project facts with an optional validity interval, preferences, session summaries, and owner-reviewed playbook entries in Markdown | One stdlib-only SQLite database with an FTS5 table and embeddings stored as BLOBs stamped with model, revision and dimension; playbook topics as Markdown files under the state home | Lessons by RRF fusion of FTS5 and embedding cosine, a 0.62 relevance floor raised to 0.70 for a candidate without two content-word anchors, then MMR at lambda 0.5, with quarantined lessons excluded first; project facts current at now; past good interactions by project; approved playbook index | A lesson-distillation state machine claims an interaction, extracts a concrete lesson, and refuses vague text, exact and semantic duplicates, and tombstoned values; outcomes carry a required provenance and are credited back to the lessons retrieved; facts are asserted directly with optional validity and supersession; playbook notes are proposed | A nightly near-duplicate pruner deletes all but one lesson per cluster and writes a content-hashed tombstone; facts are superseded by closing their interval or deleted by exact id and project; preferences are upserted in place; playbook entries are approved, rejected, edited or removed by the owner | Facts and recalled interactions are filtered by a caller-selected project on prompt assembly; preferences by a scope column; lessons and playbooks are global; the agent-callable memory_search applies no project; account-backed HTTP requests skip memory injection and are refused the global memory tools | A terminal REPL, a headless service, an HTTP server and an MCP surface over one local database; the agent's leverage on lessons is outcome-mediated, while playbook_note and sonder_remember_fact are direct tools | A nightly self-improvement job drains distillation, backfills embeddings and prunes near-duplicates in a window of the newest 1,024 lessons; quarantine and decay are computed at read time | Lessons are active, quarantined or on probation by outcome statistics; every outcome records who judged it under a NOT NULL closed vocabulary; preferences carry an enabled flag; playbook entries carry a review status that only the owner moves to approved | Outcome-gated quarantine that splits blame across co-retrieved lessons and tests a loss run against the lesson's own frequency-band base rate before suppressing it, with a sampled probation path back; owner review of agent-written playbooks that the agent cannot clear; caller-asserted validity on facts | memory_search, an agent tool on the project-bound list, returns every project's facts, sessions and interactions and returns quarantined lessons; machine-graded outcomes drive quarantine at full weight; quarantine writes no rejected-value record; the pruner never compares lessons older than its newest-1,024 window; refinement_history has no production writer; the fact journal runs only when replication is enabled; memory_export dumps lessons, facts and preferences across projects |
soul-of-waifu |
Four kinds of Markdown file — a psychological state index, a user profile, per-subject topic files, and a dated diary that shares the topics directory | Plain files under .soul/, one directory per character
and chat, with five rolling backups each of the index and the
profile |
Two independent implementations — TopicRAG ranks topics
for the Router and the desktop companion, and a separate loop in the
prompt builder ranks them for the character above a 0.42 cosine
floor |
A Router sub-agent returns JSON that the code renders into a fixed Markdown skeleton; an Archivist writes topic files; a Diary agent rewrites the day's file with one entry appended | The index and profile are overwritten wholesale, backed up first; a
create action within 0.82 cosine of an existing file is
redirected onto it; the pipeline deletes nothing, and a person can edit
any file and delete topic and diary files in the memory viewer |
Per character and per chat, as a filesystem path; no principal or tenant key | The companion app's own prompt builder, the desktop companion's memory snapshot, a memory viewer that edits and deletes files, and a tool registry that carries no memory tool | The pipeline runs every soul_memory_batch messages as
an asyncio task launched after the reply, with the diary generated as a
concurrent task; a batch size of 0 leaves only a manual trigger |
None. The trust_level field is the character's feeling
about the user, not confidence in a memory |
Short-output writes are rejected rather than stored; a truncated JSON generation is repaired, and an unrepairable one retries the batch instead of defaulting it | The de-duplication redirect is applied after the guard that protects
the diary, and that guard's lowercase prefix would not match the
capitalised diary name even below it, so a create action
can land the Archivist inside a diary file |
sovereign |
An EpisodicMemory — timestamp, event_type,
and a free-form content dict, with no identifier |
One JSON file holding the whole SessionState, written
atomically via temp file, fsync and
os.replace |
daily_recall(days) — a timestamp cutoff over the
in-memory deque; no search, no ranking, no query |
add_episode appends to a
deque(maxlen=20000); heartbeat may refuse the
write entirely when energy is low |
None. No update, delete, forget or supersede exists; the deque silently evicts the oldest episode when full | One pilot_signature per session, required at
construction; no scope key on any read |
A Python library plus a runnable demo; no agent framework, no MCP, no tool surface | An optional periodic save thread, off unless
start_periodic_save is called |
None on an episode. Energy, boundary state and an overflow counter describe the runtime, not the memories | A metered refusal with hysteresis and a legible reason string; atomic persistence; a required covenant | Episodes have no identity, so nothing can be corrected; episodic
eviction is uncounted while sensory overflow is counted;
pyproject.toml is invalid TOML |
spector |
An engram: text, id, tier (working, episodic, semantic, procedural), tags, source, importance, valence, arousal, a quantized vector and two flag bytes. Beside it, subject-predicate-object temporal facts with valid time, transaction time and confidence | Memory-mapped off-heap regions per partition bundle under one directory per namespace, with a WAL; no external database. The Synapse server adds JDBC catalogs for accounts and chat, not for memory | Fused SIMD vector scan over quantized slabs with importance and power-law decay, BM25 and SPLADE lexical arms fused by RRF, Hebbian, temporal and entity graph expansion, optional ColBERT rerank and MMR. Temporal facts are woven into matching results | Explicit: memory_remember, REST, SDKs or the embedded API. Synchronous embed and write; eager contradiction checks run afterwards for semantic and procedural writes; a Quartz job extracts entities and facts every 30 seconds | forget sets a tombstone bit and frees the id; purge zeroes the payload and text; suppress hides an id for the process lifetime. Facts are retracted by an appended retraction row. No rejected-value record | Physical: one namespace directory per account or namespace, bound per request after a grant check. No scope key on the record. The recall and remember tool schemas advertise workspace_id and agent_id, which no handler reads | In-process MCP server over stdio or streamable HTTP with 29 tools, REST and gRPC, Python and TypeScript SDKs, Spring AI, an OpenClaw plugin, and an embeddable JAR. No automatic injection hook | Quartz jobs for sleep consolidation, dreaming, default-mode wandering, homeostatic decay, graph enrichment every 30 seconds, index reconcile and checkpoint; an eager consolidator queue after each semantic or procedural write | A contradicted flag set by LLM-judged consolidation, newer wins, filtered by default. Simulated and dreamed traces are withheld unless allowSimulated. Retracted, unverified and restricted flags are read by a release gate and never written | Honest deletion vocabulary: forget says the bytes remain, purge reports what it zeroed and what it cannot reach; a contradiction test that asserts the winner, the hidden loser and the forensic mode; physical namespace isolation with a cross-namespace test; append-only fact log with supersession chains | Valid time written in seconds and compared in milliseconds; factsAbout returns retracted facts; memory_fact_history defaults to a literal predicate named *, so the default returns nothing; a fail-closed gate on flags nothing sets; an eager pass that lets any newer contradictory write bury an older memory; advertised workspace scoping that is ignored |
sqlite-memory-mcp |
An entity with a unique name, a type, an optional project and a list of observation strings, plus typed relations; beside it candidate claims and canonical facts as subject-predicate-object rows, and notes stored as tasks | One SQLite file in WAL mode shared by seven stdio MCP servers, a PyQt6 tray and scripts; FTS5 over entity text; optional sqlite-vec table of 384-dimension MiniLM embeddings | search_nodes: FTS5 terms OR-joined, optional vector arm fused by RRF, one-hop relation expansion, a six-signal multiplicative re-rank, then a 16,000-character budget; search_by_project filters by project; build_context_pack assembles facts, claims, questions and chunks by role | Explicit MCP tools, synchronous; every new observation is also scanned by regex for subject-predicate-object claims whose hit counts can promote them to canonical facts without review | Observations and relations deleted by exact text; entities deleted with cascade; canonical facts never deleted, only superseded, invalidated or revalidated through govern_fact; every step appended to memory_events | A nullable project column on entities, filtered by search_by_project and used as a ranking boost by search_nodes; project values starting with shared select what the bridge pushes | Seven FastMCP stdio servers plus an all-in-one unified server; the core nine tools match the official MCP memory server; no hook injects memory, and an example SessionStart script prints the last two session summaries | The tray auto-accepts up to three task-to-entity links a day and runs bridge sync; audit_memory repairs provenance and counts on demand; bridge push and pull move shared entities, all facts and claims and the whole event ledger through a git repository | Candidate claims rendered as provisional and canonical facts as facts in context packs; facts with a validity end or a contradiction count are left out; no status on entities or observations | Append-only ledger with old and new values on every core write; a governed supersede and invalidate path with rationale and effective time; rejected auto-links suppressed by pair; search responses carry evidence status and exact wire accounting | Promotion defaults to human_confirmed on the agent's own tool; a regex claim seen three or four times becomes a canonical fact with no gate; the re-ranker inverts BM25 and lifts no-evidence neighbours above matches; bridge push exports every observation's text through the ledger regardless of project |
stash |
A fact with an entity, a property and a value — plus hypotheses, goals and failures | Postgres with pgvector, migrations and a background consolidation worker | Vector recall over facts within a namespace; hypotheses, contradictions, goals and failures each have their own MCP listers that recall does not consult | Facts inserted, then checked for contradiction against the same entity and property | valid_until closes a fact; confidence decays; contradictions auto-resolve | namespace_id is a WHERE clause on every query in the brain package | An MCP server, Docker Compose, and an Ollama path for a fully local install | Consolidation of hypotheses, goals and failures; causal-link detection; decay | Hypothesis status proposed / testing / confirmed / rejected, with reasons on both ends | Contradiction detected by entity and property rather than by embedding similarity | The reasoner adjudicates contradictions and hypotheses with no committed evaluation |
state-memory-mcp |
A node: an id, a type (task, decision, artifact, plan, blocker), a
title, a status, a project, a
git_branch, JSON metadata and tags; joined by typed edges
that carry their own project and branch |
One SQLite file per resolved project root, with nodes,
edges, sessions, events,
snapshots and a blackboard |
Graph queries filtered by project and — unless the caller passes one
or * — the current git branch, with type, status and tag
narrowing and a traversal algorithm option |
MCP tools create and update nodes and edges, individually or in
batches, with an expected_version for optimistic
concurrency; every mutation appends an event |
Status transitions on a node; edges cascade on node delete; snapshots capture the graph; the changeset surface reports what moved between two points | The project is a resolved directory selecting which database file to open — a physical partition rather than a predicate — and the branch is a column the read path compares against the detected current branch or a caller-supplied value | An MCP server for Cursor, Claude Code, Gemini and Copilot, with an
mcpb bundle, a CLI, a manifest and project-instruction
templates |
None found beyond a cached branch lookup; the server is deliberately deterministic with no model call | Optimistic concurrency by expected_version, an event
log with before and after state, and snapshots |
A mutation log that records both sides of every change; optimistic concurrency on updates; a deterministic design with no model in the loop; composite indexes that match the queries actually issued | git branch --show-current returns empty on a detached
HEAD, so getCurrentBranch() yields null and
the read builds AND git_branch = ? with null —
a comparison SQLite never satisfies — returning nothing rather than
reporting that the branch is unknown, while a write with no explicit
branch takes the column default main; the project scope is
a directory that selects a file, so nothing inside a store is scoped;
the changeset surface treats an absent branch as no filter while the
main query treats it as the current branch |
statewave |
A compiled Memory row — one of four kinds
(profile_fact, episode_summary,
procedure, artifact_ref) — carrying content, a
summary, a confidence float, valid_from and
valid_to, a status, a list of
source_episode_ids pointing back to the raw events it was
derived from, an optional embedding, a subject_id and a
nullable tenant_id. Beneath it an immutable
Episode: a raw event with a source, a type, a JSON payload
and its own provenance dict |
PostgreSQL under Alembic migrations, thirteen tables —
episodes, memories,
subject_entities, subject_snapshots,
compile_jobs, resolutions,
receipts, tenant_configs,
policy_bundles, query_embedding_cache,
webhook_events, rate_limit_hits,
subject_health_cache. Embeddings are stored beside the rows
with a query cache. Shipped as a PyPI package, a Docker image, a Helm
chart and a Fly config |
assemble_context fetches a bounded candidate pool per
kind — fifty profile facts, thirty episode summaries, twenty procedures,
thirty episodes newest-first — every query keyed on the subject and,
when set, the tenant, with the validity and status predicates applied in
the repository layer. Candidates are scored by a kind priority, recency
and, when a real embedding provider is configured, semantic similarity;
the result is packed into a token budget measured with tiktoken. The
same subject and task at the same point in time is intended to produce
the same bytes |
POST /v1/episodes appends a raw event, idempotent on
(tenant_id, subject_id, idempotency_key). Compilation is a
separate step: compile_memories_from_episodes derives typed
memories once per subject change rather than at query time, running as a
durable job with attach-and-drain semantics. A memory is written with a
valid_from, a valid_to computed from a
per-kind TTL when one is configured, a confidence, and the ids of the
episodes it came from |
Nothing is edited in place on the memory path. Conflict resolution
marks an older memory superseded when a newer one restates
the same claim; the TTL sweep marks a memory whose valid_to
has passed tombstoned; both leave the row and its
provenance readable. Hard deletion exists as a subject-level operation —
delete by subject, with a preview endpoint and a webhook — rather than
as a per-memory verb. Episodes are never mutated |
subject_id is the primary key of everything — a user,
an account, an agent, a repo. tenant_id is a second key
applied by _tenant_filter whenever it is set, and left off
in single-tenant mode. The pairing is enforced structurally: an AST
fitness function fails CI when a repository helper accepts a subject
without a tenant, with an empty allowlist and a docstring forbidding
additions to it |
A FastAPI service with routes for episodes, context, memories, subjects, timeline, receipts, resolutions, templates, handoff, health, SLA and a large admin surface. Deployed as a container beside the application rather than embedded in it, or run from the PyPI package. Webhooks fire on subject deletion and health events | A durable compile-job queue with attach, drain and latency observability; a TTL sweep that tombstones lapsed memories; embedding backfill; health checks with a per-subject cache and alerting; rate limiting. Compilation is the scheduled work, and it is what makes retrieval cheap | status decides whether a memory may be assembled;
confidence is a float used in ranking. Every memory names
the episodes it was compiled from, so a bundle traces to raw events. A
state-assembly receipt records the entries selected, the policy bundle
in force and an as_of, and a replay can re-evaluate a past
bundle against the policy snapshot from its receipt rather than the live
one. A per-kind TTL and a conflict resolver keep the active set from
accumulating restatements |
Compile-then-serve rather than retrieve-then-hope, with the determinism claim made explicit and receipts to check it against; validity time separate from record time and both queried; a tenant-scoping invariant enforced by parsing the repository module rather than by review; a guard that refuses to treat a stub embedding provider's deterministic-but-meaningless vectors as a relevance signal, written after those scores were observed dominating ranking in production; provenance from every memory back to its source episodes | tombstoned is a TTL expiry target rather than a record
of a rejected value, so nothing stops a lapsed claim being recompiled
from the same episodes; there is no audit record of memory mutations,
and the receipts record what was assembled rather than what changed;
single-tenant mode applies no tenant filter at all, so the isolation the
invariant protects is only live when a tenant is configured |
stella |
A node in a property graph (file, symbol, concept, fact, episode, person, artifact, task or memory) with edges carrying a relation, a weight and two time intervals; beside it a context record, an immutable hashed row in a lifecycle ledger; and a policy record, a TOML or Markdown file carrying a statement, a force and a truth axis | One SQLite file per workspace holding the graph, a fingerprinted embedding index, episodic memory and the append-only ledger; policy records live as files in the repository's and the user's rules directories, and in the steering folder of an Oxagen steering repository | Vector, recency and graph adjacency fused by reciprocal rank, deduplicated by content hash and packed to a token budget, every frame carrying a citation label and a source chain, with a coverage gate that falls back to bounded lexical search and labels it as such; policy records render through a truth sweep into a cached and a volatile channel | One transaction per batch; byte-identical content under the active embedder fingerprint is never re-embedded; rules and skills are induced from reflections, recorded as proposals, and a rule file is written only on a person's Keep or a measured auto-activation | Forgetting a node writes a reversible superseded_at marker that a later upsert of the same node lifts; node content is overwritten in place; a declined proposal is a Rejected event keyed on its lineage that induction consults; compaction reclaims only derived index entries whose owner is gone | One SQLite file per workspace. Domain tags sit in their own table, but the session scope recall receives is every domain name in the workspace taxonomy, so the exclusion removes only nodes tagged with a domain since removed from it; the per-query scope ranks and admits and never excludes | A terminal coding agent with its own TUI, an MCP surface, a plugin system with a consent boundary, a fleet layer, a plugin verification ladder, and read-only export views for other programs on the same machine | A truth sweep that re-probes committed claims on their declared cadence, embedding catch-up warmed at mount, a mount-time scan that ends the world validity of anchors whose files have gone, and per-turn induction of rule and skill proposals from reflections | A stored truth axis on every record (basis, probe, time to live, on-expiry) and a stored probe verdict, resolved into a disposition before rendering: selected, selected but stated unverified, demoted to the volatile channel, dropped, or blocked; a non-active status always blocks | An append-only guarantee enforced by database triggers rather than by convention; a refuted claim dropped from the prompt and an expired one demoted out of the cached prefix; a trust tier stamped from the directory a file was read out of; and a declined proposal that stays declined because induction reads the decision by lineage | The domain scope recall runs under is the whole taxonomy, so it partitions nothing. No production caller writes an edge's valid_from, and valid_to is the clock of the scan that noticed a file was gone, so world time is an observation time. The single-valued correction path has no production caller. Re-writing a forgotten memory lifts its suppression. The agent's bash tool can run the review and promotion commands, which record an unverified actor. The export view lists every live memory with no domain predicate |
strands-agents |
A MemoryEntry — content plus a free-form metadata dict and the name of the store it came from. No id, no timestamp and no status at the protocol level; what a store keeps underneath is its own business | Whatever the bound store runs. Three are vended: markdown files under a storage namespace, a JSON file of records, and Amazon Bedrock Knowledge Bases over S3 | Per store. Token-overlap keyword scoring for the two local stores, Bedrock semantic retrieval with an optional score bound for the third. The Python file store hands the query string to its storage backend's search, which only a backend accepting a string answers; the TypeScript file store scans with list and read. The manager fans out to every store concurrently and concatenates in registration order with no cross-store ranking | Background extraction every 5 turns by default: a model call distills the conversation into discrete facts, written through the store's add. Python's synchronous agent call flushes extraction after every invocation, so there the caller waits on it. An optional add_memory tool lets the model write directly, off by default | Neither exists. The store protocol has no delete method, and no path in the memory subsystem calls the delete the storage layer underneath it provides. The design doc's correction story is recency weighting, which one of three vended stores implements, as a tie-break | A scope key on the Bedrock store, stamped on writes and sent as an equals filter on every search; per store instance rather than per request. The other two stores and the manager are unscoped | Two SDKs at parity (Python and TypeScript), a harness that turns memory on by default, a CLI over that harness, and an MCP server | An ExtractionCoordinator with a per-store high-water mark, a per-store task chain, at-least-once delivery and backoff after 10 consecutive failures. No consolidation, no reindex, no sweep | None stored. Metadata is a free-form dict no read path filters on; OpenTelemetry spans cover search, add and extract but land in a trace backend, not in the store | The store protocol is small and its optional methods are detected by inspecting the type rather than by a capability flag; the subagent delegate gets a read-only view that drops write sinks and the store's own tools; extraction excludes tool traffic by default; the scope key is stamped by the writer and enforced by the reader in both SDKs | Nothing can be deleted or superseded, and the harness writes to a local markdown store by default with extraction on; an explicit Bedrock filter silently unscopes search; the Python file store over a storage backend whose search does not take a string writes every fact and finds none, with only a warning logged; the default file store merges corrections into the same file as what they correct; extraction is at-least-once and the default store has no idempotency |
stratagate |
A block of conversation turns held as six layers, L0 title and tags through L5 verbatim messages and tool records; an event card with title, summary, narrative, quotes, source messages, mention and occurrence times with precision and basis, scope, criticality, confidence, status and decay weight; and a graph node or edge with facts carrying status and validity | One SQLite database per harness profile, STRICT tables keyed by namespace: blocks, messages, events and their sources, graph state, derivation jobs, model response history, usage and ingestion receipts, and import jobs | BM25 with reciprocal rank fusion over event fields, structured filters for participants, event type and occurrence range, first or latest ordering, graph node search, raw message search, and block expansion; automatic activation injects up to four events and four graph nodes within 900 tokens each turn | Completed main-agent turns are captured; at a block boundary L5, L4 and L3 are sealed deterministically before a model summarises L0-L2, then events are extracted citing only messages from that block and projected into the graph in batches | L5 is never rewritten; a new event can supersede earlier ones, capping their weight; graph facts supersede by key and close their validity; events can be forgotten or restored through the library; external memory imports are reversible | A namespace per project directory by default, or per session, or global; threads inside a namespace | A DeepSeek Harness plugin with memory tools and an admin Memory UI,
a WorkBuddy integration, and the @stratagate/core
library |
Retrying jobs for block summaries, event extraction and graph projection; block layers decay toward shallower views as later blocks become ready | Source-bound events, an evidence assessment step before relying on a batch, use-only reinforcement from receipts, graph statuses including disputed that filter search at the node level and injection at the fact level, and decay capping for superseded events | Verbatim sources sealed before any model call; events that separate when something was said from when it happened; reinforcement only from evidence the answer used; a committed LoCoMo comparison with per-question results and artifact hashes | Superseded events remain eligible for automatic injection and are rendered without their status; a graph status the model supplies outside the four-name set is coerced to active rather than refused; the as-of read exists only on legacy element cards; forget and restore have no surface in the plugin |
sugar |
A row with a content body, one of seven types — decision, preference, file context, error pattern, research, outcome, guideline — plus a summary, an importance float, an access count and an optional expiry | Two SQLite files rather than one scoped table:
.sugar/memory.db per project and
~/.sugar/memory.db for cross-project guidelines, each with
an FTS5 shadow table kept in step by triggers and a vector table created
only when sqlite-vec loads |
Filter by type, by an importance floor and by an expiry clause, then search — vector where the extension is available, FTS5 otherwise; results are stamped with the store they came from | The caller chooses the type, the importance and an optional TTL that
the CLI parses into expires_at; a manager routes the write
to one of the two files and refuses rather than falling back when a
project store is missing |
INSERT OR REPLACE keyed on id — no version, no prior
value kept and no record that a replacement happened. Expiry never
deletes: the row stays and the read filters it out |
A second database file rather than a predicate. There is no scope
column to filter on, so a project query has no physical access to
another project's rows, and the scope attribute is written
onto results after loading for labelling |
An MCP server, a CLI, a skills directory, a GitHub Action and a Hermes plugin, distributed through a marketplace manifest | None for memory lifecycle — no sweeper removes expired rows; the learning package carries an adaptive scheduler and a feedback processor for work items rather than memories | None. importance is a float applied as a floor filter,
so a memory cannot be kept while being marked unreliable; the only state
a memory can reach is expired |
The scope manager refuses rather than falling back when a project store is missing, so a project memory is never quietly filed where every project can read it; the expiry flag defaults closed and is forwarded to both stores instead of re-derived, so the two arms cannot drift; the FTS index is maintained by triggers on insert, update and delete; and the tests assert the label as well as the result | Corrections are INSERT OR REPLACE, so the prior content
is gone and nothing records that a replacement happened;
importance is a float set at write time with nothing moving
it afterwards, so a memory the agent learns to distrust can only be
deleted; expired rows are filtered but never swept; and the global store
is shared across every project on the machine, so a guideline learned in
one repository surfaces in the next |
superlocalmemory |
An atomic fact typed episodic, semantic, opinion or temporal, with four date fields and an emotional pair | SQLite with a separate audit database, JSON-encoded embeddings, and a profile-scoped schema | Multi-channel — entity, vector and community summaries — with contradiction and supersedes edge types | A trust gate enforces a minimum trust score before any write or delete; reads always pass and are logged | Named retention rules per profile move expired facts to archived,
with tombstoned flagged purgeable and a
projection_tombstones table consulted on the store path —
keyed on fact_id, which is a UUID |
profile_id is NOT NULL on every fact, on every index, and in the read-path queries, beside an ABAC layer | An MCP server, a CLI, nine framework integration packages and a browser dashboard | A compliance scheduler, lifecycle transitions, Fisher-weighted maintenance and evolution passes | A trust scorer with signals and a provenance module, gating operations rather than labelling memories | The audit chain uses its own connection so it survives corruption of the database it audits | A tombstone keyed on a UUID rather than on the value, so an erased fact re-asserted verbatim gets a new id and passes the check; and a governance surface far larger than the memory it governs |
supermemory |
Document, chunk, memory entry, space | Hosted backend; visible schemas/client only | Hosted search/profile API; SDK uses hybrid settings | API/MCP add memory/document | Version chains, relations, forget API | Space, container tags, org/user/project | SDK, AI SDK tools, MCP | Hosted processing not visible | Rich schema fields and relations; implementation not visible | Product/API surface, document-memory graph | Backend black box; semantic forget needs care |
swafra |
Verbatim or synthetic chunk plus directed chunk edges, and a (subject, relation, value) fact carrying a validity end | Adaptive: three JSON files by default, auto-migrating to SQLite with WAL only past 5,000 chunks | BM25 + vector + entity/date/preference heuristics + char n-gram; graph walk; best chunk per title; optional LLM rerank | MCP add; Leiden or exchange/paragraph chunks; synchronous full-file rewrite; optional LLM dedup and entity extraction | Intra-source chunk supersession; fact supersession that fires only when one sentence names both old and new value, and that a new session re-asserts; delete strands cross-session edges | Source ID/title only; no user/project/tenant scope | Python FastMCP, Node MCP over subprocess, Python and JS SDKs, a native CLI, a Claude Code skill | None | Fact confidence score and a validity end; no actor, span-quality provenance, trust state, or injection fence | Compact local hybrid graph-RAG; a real correction path reaching the ranker; optional dependencies; source diversity | Default JSON writes unlocked and non-atomic; dangling edges on both backends; benchmark invalid and its harness broken |
swarmai |
Two kinds — a markdown memory file the agent curates, distilled from raw daily activity logs, and a cultivation proposal carrying a target document and section, content, a confidence, a source run, a lifecycle status and a trust stamp | Files in a workspace context directory for the curated memory and the daily logs, JSON files under an artifacts directory for proposals, and SQLite for workspace configuration | Keyword scoring over the memory file's sections; the curated file is always injected whole, with size bounded on the write side rather than by dropping sections at injection | Distillation from daily logs into the curated file, and a cultivation pipeline that proposes writes into project documents through a trust gate, an adversarial judge and a quality floor | Discarded proposals are archived so they stay recoverable; a decay model scores entries for pruning with a floor so nothing fully vanishes | Per-project directories for proposals and documents; the curated memory file is per workspace | A desktop application, a FastAPI backend, a skill library and one MCP server that sends files on a channel | Distillation, decay scoring, an adversarial judge, an archiving size valve and an evolution changelog | A lifecycle status and a separately-derived trust stamp on every proposal, the stamp resolved from the source run and failing closed; the curated memory file's own rules are prose the agent follows | A trust stamp the proposal cannot assert about itself; one constant shared by the listing and the by-id action so a hidden item cannot be acted on; and a write guard that redacts secrets, strips invisible characters and rejects injection outright before anything reaches the memory file | The automatic path discards rather than escalating, so the review surface governs only what reaches it; the audit machinery covers workspace configuration and not the memory; and the curated memory file's rules are instructions to a model rather than enforced code |
syke |
A memory: an id, a user id, prose content, a created-at and an
optional updated-at — and a link between two memories carrying a
free-text reason |
One SQLite file with memories, links, a
singleton syke_identity, a singleton
current_memex and an FTS5 index, beside a control directory
of receipts, recovery points and an immutable MEMEX history |
FTS5 with a porter tokenizer over memory content, plus the whole
MEMEX.md projection read directly by other agents |
syke record from a person or agent, and a background
synthesis cycle that reads local harness activity and rewrites the graph
and the projection through an LLM |
The synthesis cycle may create, revise and delete memories;
links declare ON DELETE RESTRICT on both
endpoints, so a linked memory cannot be deleted without the link going
first |
A single local identity. Every table carries a user_id,
syke_identity is a singleton with a CHECK constraint, and
the post-cycle gate counts rows outside that identity and fails if any
exist |
A CLI — syke ask, syke record,
syke memex — plus adapter seeds for Claude Code, Codex,
Cursor, Copilot, opencode, Hermes, Pi and Antigravity, and a distributed
MEMEX.md |
An ambient daemon that observes local harness sessions and runs synthesis cycles under a lock, with a recovery fence and reconciliation of an interrupted cycle before the next database use | A recovery point per cycle with copy-on-write cloning where the filesystem allows it, integrity checks on the clone, a fingerprinted baseline of every memory and link, and a post-cycle gate whose invariants are enforced by rejecting the attempt | The gate is the mechanism and its invariants are well chosen: a
pre-existing memory's or link's created_at may not change,
no link may reference a missing memory, the identity must stay a
singleton with no rows outside it, the FTS index must match the memories
table, and exactly one non-empty current MEMEX must survive. Rejections
are marked repairable and the cycle is retried rather than abandoned.
Before any of that, capture_baseline fingerprints every
memory and link and create_recovery_point clones the
database — copy-on-write when the filesystem supports it, a SQLite
backup otherwise — with integrity checks on the copy, and an interrupted
cycle is reconciled before the database is used again. The MEMEX history
is immutable, content-hashed and receipt-linked |
The gate computes memories_removed and
removed_memory_ids, records them in its stats, and raises
no issue for them; no caller reads the number either — the synthesis
backend branches only on valid, which is derived from
issues. A cycle that deletes most of the graph passes. The
recovery point taken beforehand means the state is restorable, but
nothing notices that it should be restored, and the one number that
would catch it is already in hand. The per-cycle graph change set —
created, revised and removed ids for memories and links — is likewise
assembled and never persisted, so the immutable history covers the
rendered projection and not the mutations that produced it. A memory
carries no status, no confidence and no provenance beyond its
timestamps; the link's reason is free text |
synapse-hippocampus |
A graphiti edge carrying valid_at and, once superseded,
invalid_at, with a salience value Synapse layers over it to
modulate decay |
FalkorDB through graphiti-core on a floating
>=0.29.2 constraint; each group id is a separate graph
selected by name rather than a filtered column |
A BM25-style query and a point-in-time query, both assembled as
Cypher strings; the temporal comparison uses
substring(r.valid_at, 0, 10) to work around a FalkorDB
comparison behaviour, which makes it date-granular by construction |
Writes go through graphiti's extraction; the one Synapse-specific
write is synapse_remember, which stores an explicit fact at
maximum salience and exempt from the forgetting curve |
Supersession is graphiti's invalid_at on an edge.
Forgetting is a strength curve rather than a delete:
S(t) = exp(-t / tau) with tau stretched by salience and
recall |
A separate FalkorDB graph per group id, selected by
select_graph(group_id) — physical separation rather than a
key composed into a query |
An MCP tool surface offering search with an optional
at_time and an explicit remember, plus a plugin manifest
and Docker files |
Consolidation, reconsolidation, pattern separation and completion, schema extraction and a prediction-error pass, each named after a hippocampal function | None. Salience is a float that stretches a decay constant, and the permanent tier is chosen by the caller at write time | The forgetting curve is self-contained, parameterised and tested on outcomes, keeping salience and recency as two inputs to one decay rather than one number doing both jobs; and the substring workaround is documented with the database behaviour it exists for, which is what stops the next maintainer deleting it | The temporal filter — the mechanism deciding whether a superseded
fact is visible — is tested by asserting its generated Cypher contains
the clause, so nothing observes an invalidated edge being excluded; the
same query is assembled by f-string interpolation from an MCP tool
argument the model supplies, which the handler passes on with no parse
or pattern and only a ten-character slice bounding it; and the data
model is graphiti's under a floating version constraint, so the
semantics behind valid_at and invalid_at are
whatever installs |
synapse-layer |
One PII-redacted string with an intent label from keyword counts, a trust_quotient, a source_type of validated or inference, an is_critical flag, metadata and a timestamp; the id is the first 32 hex characters of the content's SHA-256 | In-process list by default; opt-in SqliteBackend, one memories table in .synapse/memories.db; ForgeBackend and the Synapse client post to a closed hosted service | SQLite: LIKE substring per query word, joined with OR, filtered by agent_id, ordered by trust_quotient then timestamp; every hit gets relevance 1.0. Default backend: word-hit ratio times trust_quotient over the in-process list | Explicit SynapseMemory.store, the remember decorator storing each wrapped function's return value, or framework adapters; regex PII redaction, keyword intent classification, then one synchronous upsert | INSERT OR REPLACE on the content hash; SynapseMemory exposes no delete; adapter delete and clear edit only the in-process list; ForgeBackend delete and clear return False and 0 | agent_id column with an equality predicate on the SQLite read path; the primary key omits it, so identical content from another agent reassigns the row | Python library with LangChain, LlamaIndex, CrewAI, AutoGen and Semantic Kernel adapters and a remember decorator; the MCP server in the manifests is the hosted one, and the in-tree example server calls the async API without awaiting | None in the SDK. AutoSaveEngine queues embedding jobs against a database protocol no file in the tree implements | A validated or inference label from a 0.85 gate on blended confidence, stored and never read; trust_quotient is the square of that confidence and orders recall | A small, readable local store with the scope predicate inside the SQL; redaction runs before the hash, the row and the log line; the client-side-encryption backend asserts that no plaintext content field reaches the payload; integration adapters for five frameworks | Scope boundary moved by a write from another agent; recall ordered by keyword-derived trust, not by match; deletes in the adapters miss the SQLite file; plugin strategies, recall router and self-healing are declared and never take effect; the documented MCP surface and Trust Quotient are closed |
t-mem |
Five typed objects — a scene (cohesive exchange), an item (atomic fact anchored to a host scene), a topic label, a trigger, and a per-speaker persona — of which only scenes and items are ever returned as evidence | Files. Memory graphs as JSON per conversation, BM25 indexes as
pickle, trigger embeddings as .npy. No database |
Hierarchical topic filter, then scene and item retrieved at their own granularity by BM25 and embedding search fused with reciprocal rank fusion, with an optional reranker and an associative-trigger expansion | A batch pipeline of eight numbered stages over a benchmark corpus, each an LLM pass; there is no incremental write path and nothing writes during a conversation | None. No delete, forget or remove function exists in the tree, and nothing supersedes or edits a stored memory | None on the read path. user_id_list records which
speakers a scene or item involved and is never used as a predicate;
retrieval filters on document type instead |
None. Shell scripts and argparse entry points over a benchmark; no server, no MCP surface and no library API for an agent | None resident. Every stage is an explicit batch invocation | No status on a memory. The one confidence field belongs
to a trigger, which is retrieval-only, so it weights reachability rather
than gating belief |
A write-time rehearsal of the queries a memory should answer, at two granularities and four families; the architectural rule that triggers never reach the evidence path; a per-call cost ledger that logs at the finest granularity on the stated ground that aggregation is one-way | Indexes are loaded with pickle.load and
np.load(allow_pickle=True), so an index file is executable
input; no test file exists anywhere in the tree and CI compiles rather
than tests; the benchmark subset the paper contributes has no committed
result to recompute from |
tanglies-agentos |
A row of up to 4,000 characters of text with an id, an optional session id and a timestamp | One SQLite table at .agentos/memory.db; short-term
session history is a separate in-process LRU |
LIKE substring scoring over English words and Chinese
bigrams, weighted by term length, top five by default |
A remember tool the model calls when it judges
something worth keeping, and a REST endpoint |
Hard delete by id and a clear-all; no edit, no deduplication, no record of what was removed | A workspace and user predicate on every read and delete, resolved
from request context rather than from the model; session_id
is still written and never read |
FastAPI service with an agent runtime, tool registry, planning, delegation to sub-agents, and web and local tools | None | None; recalled memories enter the system prompt as reference text with no framing as untrusted | Small, readable, and honest about being keyword retrieval; CJK bigram matching that works where SQLite FTS5's tokenizer does not | A global store the model writes and every future session reads by
default, with fetch_url always registered — text from a
fetched page can become a system-prompt line in every later
conversation |
task-orchestrator |
A note attached to a work item, carrying its body, the writer's actor claim — id, kind, parent, proof — and the server's verification of that claim; role transitions are recorded as their own rows | SQLite with an FTS5 index over notes, beside tables for work items, dependencies, role transitions, resource leases and an append-only lease history | Full-text search over notes and traversal across the dependency graph; neither consults the verification verdict stored on the row | A write is refused unless the actor claim verifies against a did:web-resolved JWKS, unless the notes a transition requires exist, and unless dependency ordering permits it — with schemas opt-in, and no gates at all without them | No supersession and no rejected-value record. A work item's role-transition history is deleted with the item, while the resource-lease history is deliberately built to outlive the holder it describes | A project root rather than a key composed into a read; the boundary is which graph you are talking to | Fourteen MCP tools plus a Claude plugin carrying hooks for actor attribution, plan capture and a retrospective trigger with a marker, a cooldown and a Stop backstop | Resource leases with TTL refresh and expiry stealing, each hold interval recorded; a retrospective trigger with suppression windows | A five-value verification verdict — absent, unchecked, verified, rejected, unavailable — derived from a cryptographic check rather than claimed, stored on every note and transition, and consulted only to decide whether the write is admitted | Actor identity is verified against a did:web-resolved JWKS rather than taken on the caller's word, and the ladder distinguishes a fresh verification from a stale-cache one from a JWKS fetch that failed; the lease-history table deliberately carries no foreign key so it survives deletion of the work item it describes, with the rationale written into the schema; the gates live in the tool handlers so a non-compliant call errors; and the tests assert refusals by their absent side effect rather than by an error code | Five verification states land on every note and no read path mentions them, so a note stored while verification was unavailable is indistinguishable at query time from a verified one; the role-transition history is cascaded away with its work item while the lease history beside it was built to survive exactly that; and schemas are opt-in, so the default install has no gates and no required notes |
teamai-cli |
A learning — a Markdown document with title,
author, date and tags
frontmatter, named from its title with a date and a hash — at the root
of the team repository's learnings/ directory, where it is
shared with everyone, or under a learnings/<project>/
subdirectory, where only that project's members index it; an index entry
over it with title and tag tokens and a vote score; a per-user votes
file with a recalled and an upvoted count per document; beside them
docs, rules, skills and a codebase wiki indexed the same way |
A git repository per team, cloned under
.teamai/team-repo/ in a project or under the home
directory; manifest/roles.yaml and
manifest/projects.yaml declaring the namespaces;
search-index.json per scope;
~/.teamai/learnings/ as a reconciled cache in user scope;
~/.teamai/votes/<user>.yaml synced to
votes/ in the repository or its reports branch;
usage.jsonl, sessions and contribute state under
~/.teamai/; .teamai/pending-review.jsonl per
project |
A hand-built index over the learnings root plus the member's active
project namespaces — frontmatter parsed, tokens from title, tags and
body, IDF with smoothing, title matches at three times IDF, tag at two,
body at one, a length normalisation, a domain weight, a title-or-tag
match required, a vote score added — searched project-first with a
relevance verdict of RELEVANT or NOT_RELEVANT against a threshold
derived from the index's IDF baseline; the model reaches it through a
teamai-recall subagent that runs the precheck and then the
search |
A session ends, the Stop hook scores its friction — interruptions,
retries, denied tools — and prints a reminder to run the share-learnings
skill, which a team or a member can switch off; the model writes a
Markdown document with the required frontmatter and
teamai contribute queues it and publishes it into a
teamai-learnings worktree that is pushed directly — the
source notes that nothing touches the default branch, so a member needs
no write access to it — filing it under the one active learnings
namespace or, when there are none or several, at the shared root; a
merge-request importer drafts a learning from a merged change and
computes which session learnings it supersedes; the codebase wiki is
written by a local AI CLI the tool spawns |
teamai recall maintenance --prune removes learnings
whose confidence falls under a threshold, or moves them to
learnings/_archive/, which the collector never indexes;
promote rewrites a mature learning into a skill, rule or
doc through the AI CLI; the importer's supersedes list is
logged and consumed by nothing; teamai remove appends a
rule, skill, agent or MCP name to a committed
<type>/.removed file that the next pull uses to
delete every member's local copy and that the push scan consults so a
stale copy is never re-uploaded — a mechanism learnings and docs are not
part of, and one whose pull-side deletion of a skill is conditional: a
tombstoned skill directory holding nested VCS metadata is kept with a
warning, and a skill dropped by a role or tag change is deleted only
when it is byte-identical to its team-repo source; a user-scope pull and
a user-scope contribute reconcile ~/.teamai/learnings/
against the repository with mirrorLearnings, which deletes
a shared root document, an inactive namespace directory and a file under
an active namespace that the repository has dropped before the overwrite
copy, so a prune or an archive reaches every member's cache and the
index built from it |
Project scope from the working directory's configuration, user scope from the home directory, chosen at read time with user results admitted only on opt-in; inside a scope, a project manifest maps an active project to learnings namespaces the index and the user-scope copy admit and every other subdirectory is skipped; roles map a member to knowledge and skill namespaces and tags subscribe a member to resources, both applied on pull | A CLI with init, pull, push,
recall, contribute, review,
digest, dashboard and more; hooks installed
into Claude Code, Codex, Cursor, CodeBuddy, OpenCode, Qoder and others,
dispatched through one hook-dispatch command with a handler
registry; a built-in teamai-recall subagent and a managed
block in each agent's instructions; git hosts including GitHub, GitLab,
GitCode, CNB and TGit; an HTTP local-agent backend as an alternative to
the repository |
A SessionStart pull, a Stop-time friction score and vote sync, usage tracking on skill calls, a dashboard report; no scheduled consolidation; maintenance, promotion and quality drafts are commands a person runs | A confidence per document — recalled and upvoted counts, recency of last recall, an upvote ratio — used for pruning, promotion and a health report; upvotes counted only for documents the transcript shows were recalled; a risk of medium or high on each review item; no state on a learning | Votes that require the document to have been recalled before it can be credited; a relevance verdict that reports its threshold and the matched and missing terms; a review queue with a risk level for machine-written knowledge, behind a hidden opt-in flag; a namespace key applied at the copy, the index and the contribution, with a path-segment guard at three boundaries; scope isolation proved by tests; 3,020 test cases | Supersession is computed and written to nothing;
teamai remove has no learnings handler, so retiring a
lesson by name is a repository edit rather than a record any later write
consults; the skill deletion that does propagate is skipped for a
deployed copy that differs from its source or cannot be compared against
one, which is the copy a member is most likely to have edited; the
learnings reconcile treats its source as authoritative, so a call site
passing a partial snapshot deletes whatever the snapshot omits;
retrieval is title and tag matching with a body fallback, no vector arm;
the recall block tells the model it should invoke the subagent
with four skip conditions, so recall is advisory; documents are required
to be in Chinese by the share skill |
telemem |
A mem0-shaped memory scoped to a character, agent or run, plus video-caption memories | Local by default — Qwen for inference and FAISS for vectors; mem0-compatible backends | Scoped search that always also includes a shared events scope, capped to the limit | add() requires a scope id and refuses without one; infer=False stores raw with no LLM call | Delegated to the mem0 layer; nothing epistemic added on top | user_id, agent_id and run_id become filters on both the write and the search path | A mem0 drop-in (import telemem as mem0), an MCP server with 8 annotated tools | Video frame extraction, caption generation and vector-index construction | Nothing — no confidence, no status, no supersession beyond what mem0 provides | A published evaluation charter with a harness flag behind each of its rules | The charter governs future runs; the README's existing tables predate it, as it says |
tempomem |
A node in a SQLite scene graph — type object, room or region, a
canonical label over a label-mass distribution, a confidence, a centroid
and bounding box in world metres, an EMA feature vector,
n_obs, t_first, t_last and a
parent — backed by the observation rows that fused into it |
One .smem SQLite file in WAL mode with forward-only
migrations: observations, nodes,
edges, node_obs, semantic_edges,
node_properties, smem_events; float32 BLOB
features as the source of truth and an optional sqlite-vec
node_vec index behind the [vec] extra |
A relation phrase plus a whole-word anchor label resolves by edge traversal; otherwise a regex intent router sends the query to recency order, a linear centroid-distance scan, cosine over node features when an encoder is configured, or a label-substring count; a prompt serialiser emits an indented region tree most-recent-first under a token budget that drops whole subtrees and says how many | add_detections inserts observation rows at once and
stages them; commit runs the fusion arbiter per observation
— candidates by dilated bbox overlap, score = 0.2 geometry + 0.2 IoU +
0.5 cosine + 0.1 label, merge at 0.62, reject below confidence 0.30,
otherwise a new node — and every maintenance call fuses the staged rows
first |
update rewrites label, position or confidence in place
and resets the label distribution; forget hard-deletes a
node and its links and leaves its observation rows unlinked;
decay halves confidence per half-life and prunes below a
floor; resplit and consolidate split and merge
nodes; merge folds another store's objects in through
fusion; nothing records that any of these happened |
None on the read path. Observations carry an episode row with a
session string that no query reads |
A Python library with a six-tool function-calling layer that
validates every model-supplied argument and strips control characters
from labels, an answer() path over a bring-your-own
verbalizer, a PerceptionAdapter protocol for RGB-D frames,
a CLI that inspects a store and exports a read-only HTML viewer |
None. Decay, split, consolidate and relation inference run when the caller invokes them, each over the whole store | A confidence float per node that fusion saturates upward and decay pulls down, used for pruning and for a hedging threshold the library documents and does not enforce; no state, no provenance beyond the observation trail | A deterministic arbiter with a fuse-before-persist invariant tested against interleaved maintenance, so the file on disk never holds an observation that is not linked to a node; a tool layer that treats labels as an injection surface; an observation trail that answers where an object was over time | A rejected observation persists as an orphan row that nothing reads
and nothing keys on, so the same low-confidence sighting is re-scored
from scratch every time; forget leaves the same orphans and
no record; update(label=) erases the label history;
answer() serialises the whole scene with no budget and no
label sanitisation; and every retrieval is a linear scan over every
node |
temporalstore |
A ContextEvent on a node timeline: event time,
ingestion time, type, confidence, importance, text and an inline
embedding vector |
An append-structured page store with its own WAL, block store, Raft replication and shared object storage; a Redis-compatible RESP surface on top | A ranked, token-budgeted ContextPack — lexical scores mapped into the same micros scale as cosine similarity so embedded and un-embedded nodes merge into one ranking | Ingest events, extract entities and summaries, embed inline with a drainer for deferred or failed embeddings | Resource lifecycle records carry stale and
deleted flags used for counting and refresh; nothing in the
event path supersedes or retires a memory |
A tenant hash derived from account_id:tenant_id on the
caller's own request, with
acct_local/tenant_local_agent substituted when
either is empty |
Rust and Python SDKs, a proxy, Claude and Codex plugins, agent hooks, and any Redis client through the RESP surface | An embedding drainer that retries deferred and failed embeddings, and resource watchers on an interval | Confidence and importance as continuous filter floors, and a ContextPackAudit recording what a pack was assembled from | The engineering below the memory layer is serious and legible: an
append-structured page store with crash-safe reload, Raft,
shared-storage clustering, 2,404 test functions, and constants
documented with the reasoning behind their values rather than the values
alone. LEXICAL_MATCH_MICROS is set at half the cosine
ceiling with a written argument — so that "in a MIXED store, a strong
semantic (embedded) match still outranks a purely lexical one, while
un-embedded nodes remain rankable (never a flat 0) instead of collapsing
to recency order" — which is a real hazard most hybrid rankers hit
silently. A bool field carries a comment explaining why it
is defaulted explicitly rather than with #[serde(default)],
because an absent field decoding to false would send a
reader to an object URI the record does not carry. The benchmark
documentation is likewise candid where it could have been quiet: it
records that ingestion previously dropped tool messages entirely,
"losing ~35% of real local context"; it states that grading against a
recency slice is the wrong method and says so in italics; and its scope
note admits a missing skills tier and instructs that "adoption claims
should be scoped to memory + resources, not skills" |
The memory layer carries no epistemic or lifecycle state that
retrieval acts on. valid_until_ms is the field that would
close a world-time window, and every constructor in the tree sets it to
0 — the schema marks it "Deprecated hot-schema field:
reserves this field", naming no replacement, while
context_event_matches_filter still reads it under
#[allow(deprecated)], so the branch cannot fire for
anything this code writes. The same filter's status check reads the
in-row status, also deprecated and
skip_serializing, after status filtering moved to a
status_hash secondary index. primary_time_ms()
prefers ingestion time when present, so the as_of
comparison runs on arrival rather than on when anything was true, even
though both columns exist on the row. context_scope_matches
— the rule granting a global layer to everyone and letting an
agent-layer request read user and workspace entries — has exactly one
call site, in skill lookup, gated on
owner_scope_filter_enabled, which is simply whether the
caller sent a non-empty scope string. And the tenant key comes from
request.scope, defaulting to
acct_local:tenant_local_agent, so two callers that omit it
share one tenant. Finally the headline: the 99.92% token saving divides
a ~1,333-token pack by a 1,698,940-token corpus that the baseline arm
never read, because the reproduce command caps it at 8,000 tokens for a
reader whose window is 4,096 — a footnote says so directly, "[t]he
saving headline is still computed against the full corpus", and the
table keeps the number |
temvera |
A belief — subject, attribute, value, a valid interval, a recorded and a last-confirmed time, an authority level, sources, derivation lineage, a status and a supersession link — materialised from immutable lifecycle events | Append-only JSONL event files in a directory, either plain or with each belief's payload encrypted under its own key; Markdown projections and index snapshots rebuilt from them and optionally committed to Git; an independent SQLite oracle as a cross-check | The oracle answers a subject and attribute at a transaction instant and a valid instant. A separate hybrid retriever fuses exact, lexical, hashed-vector and one-hop graph channels by reciprocal rank over a caller-supplied state, applying valid time only when its temporal channel is requested | Events appended through a store that refuses duplicate event ids, with both clocks supplied by the caller. No policy runs on the append path; the ingest and action gates are separate functions | Reconfirm, supersede, expire and purge are events. A purge removes a
belief from the projection and leaves its payload in the plain ledger;
redact_payloads rewrites that payload in place and appends
a receipt, and the protected store erases by destroying the belief's
key |
None in the store or on any read path. A tenant string exists only on the signed evidence envelope the action gate checks | A temvera CLI over the substrate and the experiment
harness, plus adapters for Mem0, LangMem, Graphiti, Cognee and
Hindsight |
None in the substrate. Decay and consolidation studies, a literature-freeze tool for the paper's prior-art review, LongMemEval label adjudication and artifact verification over sealed runs sit in the harness | Five authority levels fixed at ingest and read only by action gates that refuse rather than discount, Ed25519-signed evidence envelopes, derivation-laundering detection, and adversarial probes whose one success is published | Two things, and they are the same habit applied twice. The first is
bypass.py, which publishes the attack that works:
compromised_trusted_signer activates, is declared
expected_limitation=True, and
tests/test_bypass.py asserts that it is the only probe that
activates, so a newly working bypass breaks the suite and the admission
cannot be deleted without the test noticing. The second is the artifact
discipline: "the whole paper can be checked without an API key, a
database server, or a dataset download", and
verify_paper_claims.py pairs each figure as printed with a
recomputation from a sealed run and fails if either half moves, which
catches a corrected number as readily as a corrupted one. The query
protocol makes both instants mandatory, so each baseline is the oracle
with one axis deleted in a single statement |
A research reference implementation at version 0.0.1 under a
provisional API, and the README says "[n]o production readiness is
claimed". The governance layer is not wired to the memory: authority is
fixed at ingest and read only by action gates that no append and no
retrieval calls, the tenant is never stored, and the superseded and
expired statuses are written and never filtered on. The hybrid retriever
and packet builder index superseded and expired beliefs and return them
unless a caller asks for the temporal channel. Transaction time is
supplied by the writer. A purge leaves the payload in the plain ledger,
redact_payloads rewrites that ledger in place, and no
ingest path reads the deletion receipts, so an erased value can return
as a new belief. Regenerating the external comparisons needs an OpenAI
key, a Neo4j server and a second interpreter |
tencentdb-agent-memory |
L0 conversation row, L1 record, L2 scene and L3 persona artefacts, versioned skill | SQLite with FTS5 and sqlite-vec by default; MongoDB and Tencent VectorDB as alternate backends; L2/L3 as files on the SQLite path | FTS5 plus vector, both filtered by the isolation key; conversation search as a tool | Traffic captured at the proxy, L1 extracted by an LLM in a background pipeline worker, deduplicated against existing records | Versioned update and delete through five v2 handlers, each journalled to memory_audit; skills supersede by head flag and keep only recent versions | team_id, user_id, agent_id and task_id as columns and query predicates on L0 and L1, resolved from the request body or x-tdai-* headers | A reverse proxy in front of the model API — no plugin, hook or MCP server; SDKs and an OpenClaw plugin also ship | Pipeline worker and timer scanner for extraction, embeddings, scene and persona generation | Source conversation rows behind every record and an audit row behind every mutation; no verification, confidence or rejection state | Isolation carried into the SQL rather than applied after it; an append-only mutation journal in all three backends | No committed tests anywhere in the tree; a benchmark claim with no harness behind it; deduplication that stores everything when its conflict check fails |
terse-memory |
A typed TERSE object — Preference, Fact, Person, Decision, Pattern
or OpenQuestion — with a required as-of and, for two kinds,
a required status |
One human-readable .terse file, queried and mutated
through terse-py |
CONTAINS and path queries over the tree; the
# Hot buttons tier is always loaded |
The agent writes TERSE by following a skill; no capture function exists in the package | status: superseded is preferred for decisions and an
explicit forget writes [REMOVED], both performed by the
agent |
Containers — Profile, Projects, Sessions — plus a
session: attribute that makes session-scoped forgetting
precise |
A CLI, an MCP server in the same monorepo, and a skill that carries the operating procedure | None implemented. Consolidation is specified and its lint rule is deferred to v0.2 | A status attribute required on decisions and open
questions, whose values nothing in the code validates or reads; a
src: attribute separates the user's words from web and tool
output |
A user-extendable ## Don't tier that is always in
context, and a rule that auto-capture from untrusted content is a
protocol violation |
The package is a linter and a scaffolder — capture, recall, forget and consolidate are the model's job, and the two lint rules that would police staleness and duplication are deferred |
tessellum |
A typed atomic note — a tessellum — small enough to make a single point and tagged with what kind of point it makes, linked into Folgezettel trails | Authored notes as the source of truth under a one-way CQRS split; the searchable index is a projection rebuilt from them and never written back to | Hybrid keyword and vector search over the projection, plus a query protocol that abstains when a claim's computed status is not answerable | Author notes, or hand over a source document and let the digester produce them; a dialectic cycle turns an observation into competing arguments, a counter and a revised rule | Promotion turns an episodic derivation into durable knowledge; a scheduled re-derivation gate demotes, and an inconclusive finding quarantines rather than retracts | None — one knowledge base per installation | A Python package and CLI; it is not an agent-memory store and says so | The scheduled re-derivation gate, consolidation, and a Dung grounded-semantics solver over the argument graph | A blinded re-derivation protocol against a pinned model with an arithmetic verdict, five outcomes each carrying whether it is conclusive, and a labelling that treats an undecided dispute as having settled nothing | The demotion module states the atlas's own central finding better
than the atlas does: "a promoted claim that stops being true has no way
to notice on its own, so a promotion path without a demotion path is a
mechanism for entrenching whatever was believed first. That is not a
hypothetical failure mode — it is the one the memory literature
documents most consistently — which is why this gate ships ahead of
consolidation rather than beside it." Its protocol is a blinded test in
three parts, each closing a way the test could cheat. The claim is
suppressed by construction — the request type "has nowhere to put" its
text or id, and the gate refuses a caller who smuggles the claim into
the question or cites the claim's own rendering as a source. The model
is pinned with an explicit model_id and
frozen_at, because one that re-tunes on the corpus it is
checking "would eventually regenerate its own promoted claim from the
promotion, and the gate would certify itself". And the verdict is
arithmetic — a token-overlap ratio against a floor — because "[a] model
must never decide the verdict: a demotion nobody can recompute is a
demotion nobody can appeal." Three triggers fire independently, and the
first is the one "an attack-driven system misses entirely": a claim can
stop regenerating from its own sources with no attack against it
anywhere in the log |
It is not an agent-memory store, and the README says so in its second sentence — a reader arriving for a memory backend will find a knowledge-construction system whose unit is an authored note. By this atlas's own scope rule it belongs here anyway, because it keeps claims that can turn out to be false and names which part of a losing argument broke; but the marks this atlas awards attach to a store's read path, and the statuses here are computed from the argument edge set rather than stored, so none apply. Two limits the project states about itself are worth carrying: by default the dialectic cycle "treats two arguments as conflicting when their claims are worded differently", with evidence-based incompatibility an opt-in mode — so the default conflict detector is textual, the failure chitta-field's claim-centric detector is built to avoid; and each cycle is labelled on its own, "so a later argument does not yet overturn an earlier cycle's verdict". There is also no scoping, and at 138,183 lines with a vocabulary drawn from Zettelkasten practice and formal argumentation, the entry cost is real |
the-librarian |
A markdown note of one of three types — memory, handoff or reference
— with [[wikilinks]] to its neighbours, plain boolean
is_global and requires_approval flags set only
by admin or curator, tags for organising signal, and a status |
A markdown vault in git; the files are the store and git is the history, readable and editable in the dashboard or in Obsidian | The wikilink graph plus lexical search, with the curator filing each new memory where it belongs and linking it to neighbours so the collection is organised for retrieval rather than only storage | Seven MCP verbs taught by a primer under 2KB; intake runs navigate-judge-route, and grooming reworks the existing vault, both routed through the single apply policy | Create, update and merge auto-apply above a confidence threshold;
archive and split always propose; a requires_approval
memory always proposes; git carries the history of whatever lands |
An is_global boolean, tags, and caller identity with a
canonicalisation contract audited as a dry run before any backfill |
A self-hosted server run by immutable image digest, an MCP surface for Claude Code, Codex, Hermes, OpenCode and Pi, a dashboard, and a cross-harness handoff document so work started in one harness is picked up in another | The resident curator, groomings with a prepass, evidence, fingerprinting and redaction, a chronicle job that narrates activity, and scheduled grooming | The operation-type apply rule, per-memory approval flags, grooming evidence and fingerprints, a redaction pass, a curator pause control, and a caller-id audit that changes nothing until a person reviews the collisions | A single decision point for every verdict, and one keyed on what the operation does rather than on what the model said about itself; destructive operations that never auto-apply; an eval whose headline metrics are absences; a migration audit that previews collapses and applies none | The vault's history is git rather than a record the store keeps, so a question about what a note said last week is a git question; the curator is an LLM whose confidence still decides the create/update/merge cases below the destructive line; the handoff surface moves work between harnesses and is the place where scope assumptions from one host meet another |
theurian |
A knowledge item with an immutable revision chain — title, body, kind, namespace, status, trust level, sensitivity, owner, labels, scope paths, validity window, author and source anchors | SQLite derived from a directory of YAML migrations and Markdown bodies under each project's .theurian directory, with a separately built and published retrieval index | Hybrid search over a published index — a word index, a trigram index and an optional hashed-trigram dense arm fused by reciprocal rank — with status and sensitivity asked before ranking and an optional asOf moment | Migrations applied by the migrate apply CLI. Agents draft proposals through three MCP tools; a proposal lands only through propose accept and migrate apply, both CLI commands | Revisions are immutable; a correction is a new revision. Deprecate, restore and sensitivity changes overwrite the item pointer and are recorded by their migration. A withdrawal purges the published index | A per-project state file under the project root, and a project predicate on every canonical read; the project is a tool argument | A local MCP daemon with seven read tools and three proposal tools reporting writeTools true, a Claude Code plugin of slash commands granting the theurian CLI, and Codex over streamable HTTP | Index builds and withdrawal purges; nothing writes knowledge | Status, trust level, sensitivity and a validity window returned beside every result, a deployment sensitivity ceiling, and a content-identity gate that withholds a row whose body drifted from its revision's hash | The absence proofs test the side channels, not only the content. One query is asked of a corpus holding a withheld record and of one that never held it, and the answers must match field for field — counts, token use, fused scores, budget drops and page boundaries — with a positive control proving the fixture reaches the withheld row. The visibility question is asked while the retrievers are read, because asking late let a withheld row occupy a candidate slot and move every number computed from those slots. A SQL validity filter was removed rather than patched once it was found comparing ISO-8601 timestamps as text. Accepting a proposal replays the whole migration set against a throwaway store and refuses one that would readmit a retired item or lower a sensitivity | Approval is a convention the code does not check, and the README says so: there is no approver field, and migrate apply refuses an uncommitted migration but accepts a local commit. An agent's proposal is written with status approved and whatever trust level the caller names, and the shipped Claude Code plugin grants the agent Bash(theurian:*), which covers propose accept and migrate apply; the plugin's own text calls that containment a documented rule, not a server-side check. The revision table's source_commit column has no writer. The project is chosen by the caller and there is one sensitivity ceiling per deployment, so the store separates projects, not people |
thoughtdag |
A node on a canvas — a question, answer versions with the model, time and context hash of each, a per-upstream record of what each input contributed, highlights, attachments with page provenance, a role, an archived flag, an import source and a frozen source snapshot — joined by wires that are the context; on a node that ran an agent turn, footprint attachments excluded from context by default; beside it two profile documents, preferences and identity, one fact per line, each line with a note of the fact, canvas, time and evidence that wrote it; one dossier per topic in four sections whose sentences cite the turns they rest on; in the why layer, a fact index over other agents' session files and the memory files Claude Code and Codex keep | IndexedDB per canvas (idb-keyval) with a one-minute debounced
.thoughtdag.json folder backup; localStorage
for the profile documents, the memory inbox, the switches and each
canvas's ask-the-canvas turns; ~/.thoughtdag/ for the why
layer's fact index, text index, topic labels and dossiers, and a slim
record of each canvas; a .thoughtdag folder in an agent
turn's working directory for its guard file and copied materials; the
source agents' session and memory files are read and never written |
For a generation, a deterministic walk of the graph — materials, dashed reference blocks, the solid chain in order, the question last — with archived nodes skipped, stale answers marked, an excluded footprint reduced to one line naming its files and imported tool steps folded into one execution record; with recall switched on, up to two topic dossiers whole and verbatim excerpts found by the question's exact words or by judged topic labels, ranked by a decision model when one answers over a light, deep or full reach, inside a 4k, 12k or 40k token ceiling; ask the canvas sends an outline of every live node and the focused node's chain; for the why layer, exact phrase and path lookup with reads hidden by default; no vectors anywhere | A person asks, edits, wires and imports; a model's answer lands as a version on its node; after an ordinary generation a decision model or the chat model decides whether something durable was said, a preference or identity fact is merged into its document by a model rewrite whose new lines are re-checked for credentials and which may drop at most two lines, and a project fact is filed to a topic dossier's inbox or to the memory inbox; dossiers are written by the chat model from labelled turns; Session Atlas mirrors other agents' turns idempotently; the harness bridge forks, injects and queues into live sessions; Pi and Codex turns edit files in a working directory behind a guard | Answers are versioned and never overwritten; a node can be archived — kept, dimmed, excluded from every context walk on its canvas and from the why layer's projection of the canvas at the next index refresh — or deleted; a wire can be removed or converted; an upstream change marks live dependants stale and replay regenerates them in dependency order; a profile rewrite can be undone at the toast or edited by hand; a dossier section can be edited, the dossier rebuilt from the turns or deleted; a recalled item can be struck from a node | One canvas per IndexedDB key and reachability by wire as the only filter inside it; the profile documents are global to the install; recall reads every project's sessions, canvases and agent memory files on the machine by design, leaving out only the active canvas's own record; the why layer's JSON find honours a working-directory filter that no in-tree caller passes; an agent turn is fenced to one working directory per canvas | A React canvas in the browser, an Electron desktop app with fenced
session roots, an Express proxy for OpenAI-compatible, Anthropic,
Google, DeepSeek and Zhipu endpoints plus MCP tools and a pass-through
for decision endpoints, a Cloudflare Pages demo with no server state, a
dsh-thoughtdag plugin mounting the canvas and the why layer
inside DeepSeek Harness through its sidebar, a CLI exposing
why_check, why_file, find and
recall_turn over MCP and listed in the MCP Registry, and
Pi, Codex and the harness's agents as runtimes behind the model
picker |
A file watcher appends new turns of a subscribed session to its mirror; the why index refreshes when a source file's size or mtime moved; the memory judge runs fire-and-forget after ordinary generations; a labelling job asks the decision model one yes or no per topic for up to 600 turns per click; a stale judge asks whether an upstream change bears on each newly stale answer; a node with autoRerun regenerates when an ancestor completes; a dossier with six filed facts merges when the memory page opens | A stale mark on any live answer whose upstream fingerprint drifted, prepended in downstream context; a judge can dismiss the mark, which leaves the badge, the preview, the request and Replay alike; a footprint whose contents are withheld names its files; a basis and completeness on every why-layer event, displayed and never filtered; an identity fact admitted only when the user stated it; a credential pattern checked on the fact and on every new line of the rewritten document; a stated, inferred, manual or folded note on each profile line, display only; conclusiveness levels on takeaways, display only | The preview and the request share one compiler; a request hash written at dispatch; dossier sentences that carry the keys of the turns they rest on; recall items listed, priced and strikeable on the node; archive reaching the index recall reads; a benchmark whose conditions are graph operations, whose traces are immutable and whose scorer can re-score without an API call; source sessions and agent memory files read and never rewritten | The canvas event log drops its oldest thousand events past 10,000, and sees no profile, dossier, recall or ask-the-canvas write; stale is a label and a judge's dismissal removes it outright; recall crosses every project on the machine, and an archived node's dossier sentences and a mirrored turn's session text survive its archive; topic labels and dossier coverage are keyed by a node's position, which an archive shifts; a node with autoRerun reruns while archived; the profile's stated label is the admitted fact's, carried onto every line a rewrite changed; ambient identity and preferences ride every canvas; the proxy's agent and judge endpoints accept any target from any localhost origin |
throughline |
A memory chunk — content, a category from a closed enum, tags, a numeric confidence, a project name, an optional expiry, a source type from a checked vocabulary, a status, supersession pointers and a merged-from array — alongside conversations, messages, entities, relationships and embeddings across thirty-five tables | PostgreSQL 16 with pgvector, one schema holding transcripts from nine tools plus the project-management and access tables | Vector similarity over pgvector with HNSW indexes and text filtering, scoped by category, project and status | Ingest from nine tools' transcript formats, then extraction and reflection jobs that write chunks, supersede them and merge them | Supersession sets the status, the pointer and the timestamp together under a guard that only an active row may transition; a reflection pass can mark a chunk stale; chunks carry an optional expiry | A project name on each chunk applied as an optional filter, and a web layer with users and sessions whose actor is pushed into a transaction-local Postgres setting | A CLI, an MCP server, a web application, a skill, and adapters for nine AI coding tools' transcript formats | Extraction, entity extraction, title generation and a reflection pass that supersedes and merges, driven by a scheduler with durable processing runs | Active, superseded, merged and stale on every chunk, with every read filtering to active and confidence kept as a separate number | A self-ingestion filter whose false-positive direction is tested as carefully as its true-positive one; conflict detection across tools that no single tool's memory could perform; and an audit trigger that computes its own changed-field diff and is made immutable by a second trigger | The audit machinery covers the access and configuration tables and not the memory chunks; the status column has no check constraint while the column beside it does; and the committed eval harness has never been run |
tideline-memory |
A structured narrative (gesture, context, moment, cognition direction, tags, entities, source links, four 1-5 weight dimensions) whose semantic fields are never updated, with an append-only stack of amendments; beside it one live row per key for profiles, self-concept fields and world-stance pages, plus threads, snapshots and a raw context timeline | One SQLite file with FTS5 trigram indexes on narratives, amendments and context; vectors stored as JSON on the narrative row and in an amendment-vector side table; history tables keep the thirty most recent prior values per profile, self-concept field and world-stance page, enforced by AFTER INSERT triggers | Hybrid search over context, narratives and amendments: FTS5 with a LIKE fallback for short queries, cosine above 0.3 on narrative and amendment vectors filtered by model namespace, collapsed to the best score per narrative; session-start injection of self-concept, the latest snapshot, open threads, up to three recent high-weight narratives, raw context chunks, topic clusters and profiles; per-turn semantic prefetch with a keyword fallback | memory_write inserts a narrative and recomputes recurrence and normalised weights; memory_amend appends a correction with a reason and the last attention-log sighting of the target; profile, self-concept and world-stance writes archive the prior value and UPSERT; thread edits overwrite in place; sync_turn, context_record and sensory_ingest append to the context timeline, which a nightly LLM pass solidifies into narratives | No delete tool and no DELETE on narratives, amendments, context or snapshots. A narrative changes only by gaining amendments and having its derived weights recomputed; overwrites of keyed rows keep thirty prior values and a trigger deletes older ones with no marker; thread edits keep nothing | None. The design is one agent's own memory and no read path carries a scope key | An MCP stdio server with twenty-six tools, a Hermes provider plugin implementing session-start injection, per-turn prefetch, pre-compression rescue and session-end persistence, the same lifecycle as Kimi Code hooks, and a four-tier guide matching install depth to intent | Operator-scheduled DREAM passes under three prompts (solidify, digest, sleep), with deterministic scripts for unindexed-context scanning, conflict-candidate scanning, entity-graph building, recurrence refresh, topic and embedding clustering, and amendment-vector backfill under a two-level cooldown | None on memory. Threads carry an open, explored or abandoned lifecycle; conflict candidates sit in a side table with an open, resolved, parked or dismissed status that nothing in the tree moves off open; a sensory consent tier gates writes under a policy the caller may supply | A narrative is immutable and a correction is a timestamped, reasoned layer on top, so the wrong reading stays visible and searchable while one function composes the effective text for every consumer; each amendment records what the writer last saw of the target, or that it never saw it; overwrites of keyed rows archive the whole prior value and a trigger bounds the archive for every writer; the fixture suite asserts behaviour and exits non-zero, including a boundary check whose comment records that its earlier version was vacuous; and a guide names the smallest configuration worth installing | A since or until filter on memory_search reaches only the last of five LIKE clauses on the narrative fallback, because the appended AND binds tighter than the unparenthesised OR chain; thread edits overwrite content with no archive; the archive helper swallows an OperationalError and lets the overwrite proceed; the archive drops versions older than thirty with no marker; the consent policy is a tool argument, so the no-raw-samples default binds only callers that omit it; no runner or CI executes the fixtures, and the provider fixture exits 0 with SKIP in a fresh clone; and the PolyForm Noncommercial licence puts any commercial use outside the grant |
tidemind |
A node: the digest text stored verbatim, typed fact, context, preference, idea, crystal or meta, with four maturity scores, three content dimensions and a tag list; plus typed links carrying a relation array, strength and status | One SQLite file under ~/.tidemind with FTS5 and sqlite-vec segment embeddings, plus a daily Markdown stream log of every raw digest | brain_recall: BM25 plus optional vector, fused with heat and maturity, one-hop expansion over confirmed links, post-filters by tags or source tool, and a heat fallback that fills toward ten; node_id, from_node and vault_file lookups. brain_prepare returns profile, keystones, tags, crystals and recent nodes | brain_digest stores the text verbatim, asynchronously by default, with no LLM call; landing then merges into a neighbour at 0.92 similarity or links at 0.80 confirmed and 0.60 pending. Note sources sync as segments and supersede on edit | Correction overwrites content in place, logging the prior text in node_versions and a meta node; archive hides and drops vectors; the desktop edit creates a new node and supersedes the old one. Nothing hard-deletes except note-source rollback, and the stream keeps the raw text | None. One store for every connected agent and note source; from_agents filters recall on a caller-supplied source_tool string when the caller asks, and brain_prepare has no filter | Stdio MCP server with brain_prepare, brain_recall and brain_digest; SessionStart hooks inject a capped profile and index for Claude Code, Codex, Gemini, Cursor, Windsurf, Kimi and others; an Electron desktop app for browsing, editing and tag rejection | A daemon, and a piggyback on brain_prepare, run annotate, link-evaluate, pending-link GC, link-discover, heat decay, tag-promote, divergent scan, crystal emergence, temporal crystals, profile synthesis and two strategy-learning loops; recall itself triggers LLM reconsolidation that can rewrite content | Links carry pending, confirmed and rejected_by_user, and traversal follows confirmed only; nodes carry no status and are served as written or as last rewritten | Verbatim capture with no model on the write path; archived and superseded rows filtered on every search arm and the expansion; a person's tag rejection survives re-annotation; prior content kept on every rewrite; session injection capped under Claude Code's hook limit | An LLM rewrites memory content on recall with no review; the desktop edit can merge the new text back into the node it then supersedes, hiding both; a later digest of a corrected value can win the dedup merge; forget means archive and the raw stream is never pruned; one unscoped store across every agent |
tigerless-agent-memory |
One Markdown file per memory: name, one-line abstract, type and its schema fields, created, updated, valid_from, optional invalid_at and superseded_by, weight, author, links and provenance pointers into archived session messages; the body is free Markdown | Markdown files at type/group/name.md under one store directory are the truth; a SQLite index holds FTS5 surfaces, optional exact-cosine vectors and the access log; raw sessions and provenance excerpts are appended under archive/ | BM25 over abstract and body chunks with abstract matches weighted double, optionally fused with exact-cosine vectors by reciprocal rank; eligibility first (active interval, or the interval at an as-of moment, and an optional path prefix), then relevance times weight times recency; results are paths, abstracts and anchors | Hooks archive each new transcript increment at Stop, SessionEnd and PreCompact and launch a detached distillation through the host CLI, whose JSON operations the core validates against a reconcile sheet; agents also write directly through the CLI or nine MCP tools | Supersede, merge and delete end an interval and keep the file; correct and same-name writes rewrite the abstract in place, and correct also rewrites the body; mem gc removes invalid files and is a CLI verb only | One store per person, shared by every host. A memory's name is global to the store; type and group are its location, and a same-named write in another project moves the file there. Recall takes an optional path-prefix scope that no hook, skill or default passes | Claude Code, Codex and Muse Code hooks, a mem CLI, a nine-tool stdio MCP server, an agent skill, and a headless host-CLI or endpoint reasoner for distillation and sleep | A detached distillation per boundary hook, which on Claude Code is every Stop; a sleep pass only when someone runs mem sleep, which normalises dates, settles weights, links co-recalled memories, merges exact duplicates, regroups menu directories and hands proposals to the configured reasoner | None as state: a memory is active or invalid. Provenance pointers cite archived message ranges, and trace reads them back; the reasoner runs with tools disabled and its verdicts are applied by the core under per-kind caps | File truth with a lock, an atomic replace and a content-hash check on every rewrite; reconcile handles that confine a conversation-steered executor to new files or memories the sheet surfaced; raw sessions archived before distillation, with a watermark that advances only after the executor answers; as-of recall over validity intervals; a model that only returns JSON, applied by deterministic code | The sleep reasoner can end up to three memories per pass unattended, against a README that says deletion waits for confirmation; in-place correction and split overwrite the prior text unless the store is a Git repository; the access log that decides deletion candidates lives in the index the README calls deletable; nothing schedules sleep; the live injection carries no data framing |
tigrimosr |
A skill — a SKILL.md with a registry row carrying review status, rationale and the sessions it came from — plus one memory.md per project | JSON files on disk (skills.json, projects.json, chat history) and SKILL.md directories, resolved through a project-first overlay in CLI mode | No search; the project's assigned skills and its memory.md are assembled into the system prompt | A synthesizer reads finished sessions, user feedback and subagent traces, then proposes create or update | An update to an existing skill stages as SKILL.md.proposed and becomes live by rename on approval; a newly synthesized skill is written live immediately. Rejection deletes the proposal and records nothing | Project id selects the memory.md and filters the installed-skills block; the CLI scopes instead by launch directory, with skills, persona, settings and history in a local .tigrimos | Native Rust desktop app, embedded web UI, a folder-local
tigrim CLI, MCP servers, plugins, Telegram and LINE
bots |
A scheduler runs the skill synthesizer in the desktop and headless binaries only; compaction hooks track file reads and invoked skills | A review_status of pending or approved is persisted on
an installed skill and rendered as a label. Nothing gates use on it: the
registry branch of the skills block honours enabled, but
the directory scan beside it re-admits any folder holding a SKILL.md,
and load_skill checks neither field |
A staged proposal a person can diff before it takes effect, carrying its rationale and source sessions | Proposal state is in-memory only, so a rejected skill can be re-proposed after a restart, and the CLI never starts the synthesizer that produces skills in the first place |
titen |
An observation with a source, and a claim derived from it — a
subject, a kind from six, a statement, a confidence in (0,1], a trust
level, a visibility, a status, a version, a validity window and a
canonical hash — joined to its evidence by claim_sources
rows typed supports, contradicts or
qualifies |
SQLite via Bun with FTS5 for retrieval and an optional
sqlite-vec peer dependency; a Cloudflare D1 contract is
tested alongside it |
FTS5 over observations and claims, gated by the validity window, the status, and the ABAC access predicate; no embedding provider is required and none is called by default | MCP over stdio in-process, or HTTP; writes are idempotent by request key and canonical hash, and a trust ceiling refuses a claim asserted above the principal's level | Status moves through disputed, superseded,
expired and revoked; evidence can be redacted
or purged, and a purge blocks any later claim that cites it; every
change appends a record_history row with a snapshot
hash |
Organization, workspace and project, with a per-claim visibility of private, team or organization resolved against memberships and time-bounded access grants in one SQL predicate | An MCP server serving the nine reference-server tool names and
memory://knowledge-graph so a client can swap without
noticing, importing the old store on first start; plus a CLI, an HTTP
API, a dashboard and WebAuthn sign-in |
An indexing outbox with a maintenance drain, retirement of claims that stopped being retrievable, and background repair that removes vectors queued by an evidence purge | Four trust levels with a ceiling on assertion, a per-claim
confidence, typed evidence relations including contradicts,
an append-only history with snapshot hashes, and an audit command that
reads other vendors' stores as well as its own |
A deterministic path with no model and no embedding call; a tombstone enforced by a primary key rather than by a remembered check; an access predicate composed into every read; a README that publishes the benchmark's own degradation curve as the store grows | The hero image's claim that dependencies are empty does not match
package.json at this pin, which declares two WebAuthn
runtime dependencies and a sqlite-vec peer; the purge guard
depends on the guard row and the real insert choosing the same
observation id, so it protects the first cited source rather than each
of them; retrieval quality falls steeply as the store pools, which the
project states and does not hide |
token-optimizer |
A checkpoint of a session — decisions, edited files, state — written when the context window crosses a fill band, a quality threshold or a milestone | JSON and Markdown under ~/.openclaw/token-optimizer/checkpoints, one directory per session | Two paths — an automatic SessionStart pointer, and a model-invokable pull skill that scores the user's continuation prompt against each checkpoint with IDF weighting and returns one fenced block or a one-line no-match | A policy fires on context fill at 20/35/50/65/80 percent, on quality dropping through 80/70/50/40, or on a milestone; no model decides | None. Checkpoints accumulate and age out of consideration after a maximum look-back in days | The current working directory filters another project's decisions out of the injected hint, and same-session checkpoints are skipped twice over | An OpenClaw plugin contributing at agent_turn_prepare, a Claude Code
plugin with SessionStart/PreCompact/Stop hooks, an OpenCode build, and a
resume-checkpoint skill the model calls on demand |
None. Everything runs inside a hook or a turn | Recovered content is fenced as data with a treat-as-context-only sentinel, stripped of C0 controls including CR, and has forged copies of that sentinel bracket-swapped so a crafted checkpoint cannot close the fence | Injecting recovered memory as data rather than instructions, defanging forged copies of its own fence, and disclosing that a cross-project filter removed something rather than silently shortening the block | PolyForm Noncommercial; nothing is ever corrected or deleted; and the topic match is keyword overlap, so the wrong session's decisions are one vocabulary coincidence away |
token-savior |
A typed observation; the bandit scores thirteen types, from guardrail and ruled_out down to idea | SQLite with FTS5 and sqlite-vec, plus a JSON file holding the bandit's learned weights | FTS5 and vector k-NN under a 0.86 distance floor, fused by RRF; the memory_index tool is reranked by a LinUCB bandit | Automatic capture from Bash, tool traces and turns, with content-hash and title-Jaccard dedup; agent writes through memory_save | Soft delete by an archived flag; a close title archives its predecessor with superseded_by; no rejected-value record | project_root with a declared is_global flag on MCP reads; the hooks bind it to the most-populous project, not the session | One MCP server combining structural code navigation, memory and Bash output compaction | Decay and TTL archiving at session start, a git log consistency sweep at stop, session rollups; distillation only suggested | A Beta validity score fed only by git log, quarantining below 0.40 and warning below 0.60 | A vector distance floor pinned by committed must-not-return cases that sit beside positive controls | Every prompt-time hook reads and writes the most-populous project, whatever directory the session is in |
tokenmizer |
A graph node — one of fourteen types (task, decision, file, error, endpoint, schema, goal, test…) carrying a label, a summary and one of nine statuses | SQLite: nodes and edges plus a separate
decision_transitions table that survives graph pruning |
query() over the graph, excluding superseded, archived
and invalidated nodes; to_context_block() renders a resume
block |
A hybrid extractor over session messages, with an ontology and a validator, then a contradiction check on every decision node | Supersession when the evidence is clear, CONTESTED on
both sides when it is not, INVALIDATED for explicitly
wrong, plus pruning |
A principal derived from the API key, claimed per session and enforced by a fail-closed dependency on every session-scoped route; no scope predicate inside a graph | A CLI and server for coding sessions — checkpointing, compression, a dashboard and a visualiser | Decay, pruning and compression passes, with idempotence and correctness suites of their own | Nine statuses — pending, in_progress, completed, failed, superseded, modified, invalidated, archived, contested — with the excluded four named in one frozenset and contested deliberately left retrievable | A status for unresolved ambiguity that keeps both sides visible instead of guessing, and a committed ground-truth measurement of extraction recall | The redaction functions are unit-tested in isolation and nothing asserts a secret fails to reach the rendered context block |
tracedecay |
A FactRecord: content, a category, tags, entities, a
trust_score, a source, retrieval and access counts, helpful
and unhelpful counts,
created/updated/last-retrieved/last-recalled/last-feedback timestamps
and free metadata; plus typed fact relations of supports,
contradicts, supersedes or
derived_from with their own confidence |
Local libSQL/SQLite — a per-project store beside the code graph and
a separate user-memory.db per profile for conversations
with no project |
Full-text candidates fused with similarity, filtered by category and a minimum trust score that defaults to 0.3, with retrieval reinforcement recorded against the fact | fact_store over MCP and the CLI, with add, update,
remove, supersede and curate all on the MCP tool surface; a hygiene gate
rejects secret-like content at write time |
Feedback moves trust by +0.05 or −0.10 within [0,1]; curation is run
by a daemon-owned automatic curator whose caller may bound review size
and confidence only, and whose apply authority is checked to be the
machine actor automation:memory-curator; deletion is a
permanent hard delete whose cascade — fact row, FTS mirror, entity
links, feedback events — is pinned by a store-level test |
A per-project store, a separate per-profile user store, a path-prefix scope for code queries, and branch-aware graph state; the fact store itself is scoped by which database is open rather than by a predicate on the row | An MCP server with tracedecay_context,
tracedecay_search, tracedecay_callers,
tracedecay_impact and fact_store, a CLI, a
daemon, a local dashboard, and host integrations |
Extraction workers, a daemon, an automation loop with a memory curator, session reflector and skill writer, each producing validated runs with durable artifacts | A bounded trust score moved only by explicit feedback, a minimum-trust retrieval floor, rule-based hygiene with no model in the Rust path, and an LLM review loop that lives outside it | Hygiene rules that only reject at write time and never delete from Rust; hygiene rules that are deterministic and say so, with the model kept in a wrapper layer; twelve eval scenarios committed with their upstream attribution; a hard-delete cascade pinned by test rather than assumed | Deleted memories are permanently hard-deleted by stated policy, so there is no record a fact was rejected and nothing stops the same content being written again; supersession is a relation a caller asserts and a candidate the dashboard proposes, not a state the read path acts on; trust is a continuous score rather than a status, so a fact that is wrong rather than unhelpful needs three negative votes before it drops below the retrieval floor |
tree-ring-memory |
A MemoryEvent row: summary, details, event type, one of six rings (cambium, outer, inner, heartwood, scar, seed), one of ten scopes, project, agent, workflow and session ids, source, tags, salience, confidence, sensitivity, retention, optional expiry, supersession links and a review flag | One SQLite file in WAL mode under .tree-ring in the project, with an FTS5 table beside it, operation-claim and redaction-tombstone tables keyed on hashes and memory ids, a consolidation ledger and a coordinated-policy table | FTS5 match with an AND query, then the query minus each ring-intent word, then an OR query; candidates are filtered by the caller's keys, then scored by a fixed blend of term overlap, salience, confidence, recency, source type and a ring boost. The startup brief is a separate scoped query capped at 8 results and 6,000 bytes | Explicit CLI verbs: remember, evidence, capture, dox sync, revolve sync and import. A Stop hook blocks the agent once and asks for zero to three capture commands, which are agent-scoped and normal sensitivity only. A regex guard refuses secrets and reclassifies health, financial and similar text | forget deletes a row or redacts it to a placeholder whose id is tombstoned; supersession comes from import, forced consolidation or the TUI; expired temporary rows are deleted by maintain --apply-expired. The forget reason is required and discarded. Nothing is keyed on a rejected value | Key columns on every row; the startup brief always filters on the project and on the caller's identity for private scopes; explicit recall filters on whichever keys the caller supplies; export and audit read the whole store | A tree-ring CLI with JSON output; SessionStart, SubagentStart, Stop and SubagentStop hooks for Claude Code and Codex; an Agent Zero passive binding; generated AGENTS.md, SKILL.md and CLI.md guidance; a Ratatui operator console | None. Consolidation, maintenance, FTS repair and DOX or Revolve sync run only when invoked | Rings are genres that change ranking and startup order; a needs_review flag is set on legacy and sensitive-summary rows and read by no filter. Sensitivity, supersession, expiry and redaction are the only states a read excludes | A startup brief whose scope predicate the model cannot widen; idempotent writes keyed on a hashed operation namespace that survives redaction; a writer-protocol trigger that fences older binaries; an opt-in coordinator capability stored as a hash with a denial log; filters applied before the candidate cap, with tests at 300 distractors | Explicit recall ignores expiry; a memory stored with the default global scope and no project never reaches the startup brief; the agent can write heartwood through remember or evidence in the default open mode; the forget reason is dropped; project identity is the directory basename; the authorization log is silent in open mode |
trilium |
A note — title, typed content, attributes, branches into a tree, a
protected flag — plus its revisions, of which one is saved with
source: "llm" before every assistant edit; chats are notes
of their own type holding the message list |
The application's SQLite database — notes,
blobs, attributes, branches,
revisions with a source column — read through
the in-memory becca cache; no vector store |
Trilium's own search syntax through search_notes, with
a fast mode over titles and attributes, an ancestor filter and a limit;
a current-note hint injected into the user turn; skill sheets loaded on
demand |
Nine note tools and four attribute, hierarchy and attachment tools,
each declared mutates and wrapped in a transaction; a text
edit is a find-and-replace that must match exactly once; the assistant's
chat persists as a note |
Edits save a revision first; delete_note is the app's
soft delete, recoverable from Recent Changes; protected notes refuse
every tool |
One database, one user; a protected note is refused by every tool; the current-note hint and tool access are per-chat switches; nothing keys a read to a principal | A chat note type and a sidebar chat over cloud, local or custom
OpenAI-compatible providers; a Claude Agent provider that drives the
user's own Claude Code with every built-in tool disabled and Trilium's
MCP server as its only tools; a Copilot provider over ACP with a
loopback MCP endpoint; a public /mcp route behind an ETAPI
token |
None; there is no indexer and no consolidation | None on content; a revision saved as llm before each
edit is the one mark the store keeps of what the assistant changed |
One registry serves four consumers; mutates decides the
transaction and could decide more; a revision per assistant edit with
the source recorded; the in-app agent gets the app's tools and nothing
else |
The assistant remembers nothing across chats but the chat note; there is no semantic arm at all; the revision's source is written but no test reads it, and a person finds it only by opening the revision list |
trueforge |
A context message body in an append-only log, addressed by an
AUTOINCREMENT append_id and written exactly once; what a
turn has is an ordered set of (pos, append_id)
rows pointing into that log |
SQLite or PostgreSQL behind one ISessionStore
interface, with an in-process implementation beside them; six tables —
session, turn, turn_thread, turn_thread_context, session_event,
thread_context_log |
None in the search sense. A turn's context is assembled by reading
its pointer rows in pos order; nothing ranks, scores or
searches, and no agent-facing tool queries history |
Synchronous, inside a transaction, fenced on the turn still being
running. Appends write a body row and a pointer row; an
overwrite deletes the pointer rows and writes new ones |
Bodies are immutable and never deleted individually. Compaction
replaces a thread's pointer list with two entries — a generated summary
and a continuation message — leaving every superseded body in the log.
deleteSession cascades and removes everything for that
session |
tenant_id on the session row, applied as a predicate on
session reads and asserted in both directions by the store contract.
Turn-level queries take session_id alone, and the tenant
comes from the request context — a real tenant only in TrueFoundry mode,
default in standalone and OIDC modes |
A chat UI, an HTTP API with a TypeScript SDK, an embeddable UI SDK,
MCP servers with OAuth, git-sourced SKILL.md packs
sparse-cloned into a sandbox, and subagents |
None over the store. Compaction runs as a pre-LLM processor inside the turn when the context crosses a token threshold | No epistemic state. Nothing stored is a claim — a body is a message that was sent, and the only judgement in the system is whether a message is currently in force | Separating a message's identity from its position, so that forking, continuation and compaction are one copy path over immutable bodies and the design can state that structural leaks are impossible | There is no reader. The superseded bodies are retained, addressable and never exposed — no tool, route or query returns pre-compaction context to an agent or a person |
truememory |
A message row, plus derived rows in fact_timeline, summaries and entity profiles | One SQLite file — messages, FTS5, fact_timeline, summaries, entity profiles and style vectors | Hybrid FTS5 and vector search with HyDE, a reranker, a query classifier and temporal SQL filters | Messages appended; consolidation derives facts, summaries and profiles from the log | Contradiction detection sets superseded_by and status='superseded'; the timeline is rebuilt whole | entity_scope is written into fact_timeline and never read back | An MCP server, hooks, a Python API and a CLI; three tiers from an 8M edge model to Pro | Consolidation in three phases — read, compute outside the lock, write in one SAVEPOINT | status active or superseded, read at query time; a superseded fact is halved, not hidden | Benchmark reporting that ranks a competitor first and publishes its own worst category | Contradictions are regex-detected and the timeline is DELETEd and rebuilt on every pass |
tycho |
A file in the per-game workspace, captured into a snapshot as either
inline contents or a content-addressed blob descriptor with
a sha256, a kind and a status |
A per-game workspace directory plus a .workspace_blobs
content-addressed store; snapshots carry snapshot_schema: 2
and are keyed by level and turn-in-level, with a
checkpoint/HEAD naming the resume point |
The agent reads its own workspace files directly; there is no index and no query layer over prior snapshots | The agent writes its world model and helpers as code and data in the workspace; the harness writes turn observations and animations beside them under paths the snapshot excludes | Restoring a snapshot materialises the manifest and removes workspace files the manifest does not name, while leaving harness evidence in place; there is no delete of an individual memory | One workspace per game, separated by directory, with no scope key inside a workspace | A self-directed harness around a multimodal model, with a sandboxed Python runtime, a planner over an executable world model, and container isolation | None for memory. Capture happens at turn boundaries | None on a memory. The status field on a file descriptor
records why a body was not captured — omitted_symlink,
omitted_large — which is capture completeness rather than
belief |
The snapshot draws a provenance boundary between agent-authored state and harness observation and tests it from both sides; large binaries are content-addressed rather than inlined; and a restore is asserted not to destroy the evidence the agent would need to re-derive from | The agent's world model is code with no epistemic annotation, so a hypothesis that has been falsified and one that has held look identical in the file; and nothing records that a prior model was wrong beyond the fact that a later snapshot differs |
ulpia |
A markdown note carrying a hand-written Search for:
line of roughly thirty terms, plus front-matter provenance and a
stage of raw, distilled or derived |
The markdown where it already sits, with a SQLite index over it; one binary, no daemon, no account | A deterministic keyword router that returns the files to open and the words that matched under each, with no embedding model and nothing in the path that improvises | Four outcomes — NOOP, ADD, UPDATE, DELETE — through a write gate, with provenance and stage recorded on the note and the agent holding a right to delete | An update rewrites the note and a delete removes it; history is git, and a wrong answer is corrected by editing the file the router named | Several bases, each owned by a specialist; kb boot
scores a message across them and routes, which selects a base rather
than filtering rows inside one |
A CLI, an MCP server over stdio for Claude Code and similar hosts, and a panel mode that seats reviewers from their own constitutions | None over retrieval; promotion and distillation are invoked passes | Refusal as a first-class outcome, matched words returned as the reason, a provenance ladder on every note, and a panel ledger where each objection is taken, refused with a reason, or escalated | The thesis is a trade stated in full rather than a feature:
"[r]etrieval is plain software: no embedding model, no network, nothing
in the path that improvises. Same question, same answer, today and in a
year, and when the answer is wrong you can read why in words you can act
on" — and then, immediately, the cost: "[t]he price is writing, and it
is paid per note. Each one carries a hand written
Search for: line, roughly thirty terms… Nothing infers it
for you." The abstention work follows the same discipline. It is
measured because it is the differentiating claim, scored in both
directions so a high decline rate cannot be bought with false declines,
and bounded by a paragraph headed "[w]hat 'declined' means here, stated
so nobody reads more into it". The panel is the third piece: reviewers
must back objections with a mechanism rather than style, the round is
priced before it is spent, every objection is "taken, refused with a
reason, or escalated", and the governance rule is one sentence — "[o]ne
agent stays accountable; nobody votes." Its own decision records carry
Search for: lines, so the project is indexed by the
convention it asks of its users |
The provenance ladder is recorded and never read. A note carries
stage: raw | distilled | derived — with a
captured stage kept deliberately distinct from
distilled "so the provenance ladder does not quietly gain a
rung" — and provenance: agent, and no read path filters on
either: no comparison against a stage appears anywhere in the tool
sources, so a raw capture and a distilled note rank by the same keyword
score. That is the third system this atlas has read in short order whose
epistemic vocabulary is validated and then ignored at retrieval. Scoping
selects a base rather than filtering within one, so separation is a
routing decision rather than a predicate on a row. The panel's reviewers
are agents with constitutions, not people, so the ledger records
adjudication by the same kind of thing that proposed the work — the
accountability rule names an agent as owner, not a person. And the
central cost is unavoidable and unhedged: a note without a good
Search for: line is a note the router cannot reach, and
nothing infers one, so the library's recall is exactly as good as its
author's discipline |
ultracontext |
One row in a single nodes table, typed
context or a message. Every node carries a
public_id, the project_id, a JSONB
content and metadata, a
created_at, and three link columns — parent_id
(the context this one was forked from), prev_id (the
previous node in its chain) and context_id (the head it
belongs to). A context is a chain of context nodes; each of
those is a version, and owns a chain of messages |
Postgres by default with a compose file and an
init.sql, or Supabase, or SQLite through the same adapter
interface; the API runs on Cloudflare Workers via wrangler or as a Node
server. Indexes on (project_id, type, context_id), on
context_id, on prev_id, on
created_at, and a GIN index on metadata. There
is no vector column and no full-text index — retrieval is by id, by
list, and by metadata filter |
By identity rather than by relevance. get resolves a
context under the project and walks its chain, optionally at a version
index, at a timestamp, or sliced at a message index; list
pages a project's root contexts with metadata filters. There is no
ranking, no embedding and no search — the MCP server hands an agent
whole contexts, and the agent reads them |
Two paths. A local sync daemon tails the session files of Claude
Code, Codex, Cursor, Gemini and OpenClaw, normalises each line through a
per-agent parser, deduplicates against a local seen_events
table with a TTL, and appends to a session context over the API.
Separately, five SDK methods — create, get, append, update, delete — are
the git-like Context API, with create accepting from,
version, at and before to fork a
source at a point |
Update and message-delete append a new version head recording the
operation and the affected ids, so history survives and any earlier
version can be read or forked from. Permanent delete is a separate path
that removes the rows outright; it is chosen only by an empty body or an
explicit {permanent: true}, and a body that combines
permanent with ids is refused rather than
resolved |
project_id on every node, derived from the API key on
every request and applied by the project-scoped resolvers. The gap is
the fork source: findRootContextByPublicId takes no
project, and it is how create resolves
from |
An MCP server, stdio or built into the API; npm and PyPI SDKs; a CLI with a terminal dashboard that runs the sync daemon. Parsers for five agents and writers for two, so a session can be written back out in another agent's own on-disk format and resumed there | The sync daemon watches session directories in realtime, tracks per-file offsets, deduplicates by event hash with an expiry, and bulk-ingests in batches with per-session concurrency. Nothing consolidates, summarises, decays or re-ranks — the store grows and is read whole | None. A search of the core, storage and API sources for a status, confidence, verified or stale vocabulary returns HTTP status codes and API-key verification and nothing else. A captured event carries its source, host, user id and session id as metadata; none of it is applied as a filter on truth | Writers as well as parsers, so a session can genuinely continue in a
different agent rather than merely being searchable; an
AGENT_COMPAT matrix declaring which CLI versions each
parser was verified against and which resume pairs have fixture
coverage; a delete route that refuses an ambiguous body instead of
guessing, so a typo cannot fall through to a permanent wipe; versioning
that is the data model rather than a side table; a storage adapter thin
enough that Postgres, Supabase and SQLite are genuinely
interchangeable |
The fork path resolves its source without the project key, so a
context id is a read grant across the project boundary. The redactor
runs on the archival raw copy of a captured event and not
on the message text derived from it, so a secret is masked
in one field and shipped in the clear in the other — and no test
mentions the redactor. The compatibility matrix is exported and
consulted only by tests, while the writer is chosen by a bare ternary
with no default, so any target that is not codex gets the
Claude writer. And the hosted service is the default deployment: the SDK
examples take a uc_live_ key |
universal-memory-engine |
A node with a category, aliases and a state, carrying slices for detail, events for change, and edges to other nodes | Cloudflare D1 across eleven migrations, with Durable Objects and an optional vector index | Exact and alias match plus lexical recall, with vectors optional — the golden set is scored with them off | Extraction proposes; a gate resolves against existing nodes, candidates and suppressions, and emits a plan | Candidate promote, reject, merge or suppress; cleanup writes suppressions when a delete must stick | user_id on every table and every query, with per-tool
API and MCP tokens above it |
HTTP API, an MCP endpoint, per-tool tokens and a dashboard that reviews the candidate queue | Extraction runs, cleanup passes and community clustering, each recorded | Candidates hold pending, promoted,
rejected and suppressed with confidence,
evidence and session counts before anything becomes a node |
A suppression list keyed on the canonical label and checked at four points in the write gate, and a 32-query golden set with per-query forbidden ids | happened_at is a real event time only on the manual
path — the automatic gate stamps it with now, collapsing
validity into record time |
usememos |
A memo — Markdown content, a creator_id, a
visibility of PRIVATE, PROTECTED, PUBLIC or SPACE, a
row_status of NORMAL or ARCHIVED, a pinned
flag, an optional space_id, and a JSON payload
holding tags, a location and derived properties such as has-link and
has-incomplete-tasks |
One memo table plus memo_relation,
attachment and reaction in SQLite, MySQL or
Postgres behind a driver interface; the same schema is rendered per
dialect |
A CEL filter compiled to SQL — content.contains(),
tags, creator, visibility, pinned, timestamps, space —
ordered by pin and time and paginated; no full-text index, no
embeddings, no ranking |
A person or an agent creates a memo whole; the server stamps the creator, validates the visibility and space, and derives the payload properties from the Markdown; no extraction, no model on the write path | Update is in place through a field mask; archive flips
row_status; delete is a hard row delete by the creator
only, taking owned attachments and relations with it in one
transaction |
The caller's user id, the memo's visibility and the memo's space,
resolved into a MemoAccessScope and applied as a WHERE
predicate on every list and count, with a fail-closed rule for an
unknown visibility or an invalid placement |
A gRPC-gateway REST API, a web client, and a stateless streamable-HTTP MCP server that exposes twenty curated REST operations as tools with the caller's bearer token forwarded unchanged | A payload runner rebuilds the derived properties of every memo from its Markdown; a webhook fires on memo create, update and delete | None on content; the only states are the visibility audience and NORMAL or ARCHIVED, both set by the author | One audience predicate shared by point reads, lists, counts, attachments and reactions, tested with two users; an MCP surface that is an allowlist over the existing API and inherits its authorization; a design note that says the policy in one sentence | A memo is a note, not a fact, so an agent that writes memories here gets no state, no provenance and no dedupe; PROTECTED means every logged-in user, which is the default audience many deployments read as private; delete is final |
uteke |
A row of text or JSON with a namespace, one of nine types, tags, metadata, importance, a pin, access counters, author and source types, a write-time SHA-256, a deprecation flag with reason and timestamps, and typed edges to other memories; beside it a versioned, chunked document store | One SQLite database in WAL mode with FTS5 over memories and documents, plus a usearch HNSW index file held under an exclusive lock for the life of the process | Default fusion: weighted RRF of a vector ranking (x1.7) and a vector-plus-FTS5 RRF ranking (x1), then additive salience and recency boosts; namespace and tag filters; documents merged by RRF on the default unified path; opt-in graph rerank and relationship expansion | remember over CLI, HTTP or MCP embeds on the CPU and
returns the existing id for a live row at cosine 0.95 or above in the
namespace; an optional contradiction mode deprecates the nearest row
above 0.65; LLM extraction only on opt-in import |
Partial update re-embeds in place; forget, supersede, dedup, aging
and room consolidation all soft-deprecate with a reason and drop the
vector; promote and undo restore; a prune hard-deletes deprecated rows
after 30 days in the default namespace, cascading edges and
events |
A caller-chosen namespace enforced on memory recall; rooms are a cross-namespace join with caller-supplied authors; documents are global; the server has two store-wide tokens | One binary family: a CLI, an HTTP daemon with 75 registered routes and MCP over HTTP, a stdio MCP server with 46 tools, init commands for pi, Claude Code, Cursor, OpenCode and Hermes, a pi extension and a Hermes auto-recall plugin | Server mode only: a weekly lifecycle cycle that ages out cold rows and prunes deprecated ones, and a three-day dream cycle of dedup, contradiction scan, prune and verify | Author and source types map to a derived trust tier shown in a provenance report with a write-time content hash; nothing on the recall path filters on either | A careful local hybrid retriever with a LongMemEval headline that recomputes from committed raw output, a namespace predicate in SQL with CI-run negative tests, and a transactional supersession whose undo records itself | Corrections leave no durable trace: time travel never returns deprecated rows, the timeline misses edits and most automatic deprecations, prune erases the rest and a retired value can be written back; at the defaults neither shipped auto-recall hook injects a memory |
utopia |
A subject-predicate-object fact typed against an editable ontology, with a world-time interval carrying a precision per endpoint, a record-time interval, a confidence float, a supersession pointer and one evidence row per source chunk holding the quote and the model's original wording; entities, derived facts and queued proposals are separate tables | One Postgres with pgvector for everything — graph, ontology, documents, queues, audit ledger and the job queue as a table — plus a data directory holding original files and an embedded Tantivy index | Tool-mediated. Chunk search fuses Tantivy BM25 with jieba
tokenisation and a pgvector scan by RRF, both optionally rewound to a
record-time instant; graph reads walk entity facts, neighbours,
timelines and paths with at for world time and
as_of for record time; a changes tool windows
the belief axis |
Bulk ingest is optimistic: parse, chunk, index, embed, then an LLM
extraction that resolves entities and writes facts directly, with
doubtful cases queued. A sentence recorded through remember
appends a chunk to a per-base Memory log and is extracted into
pending_facts, which never reaches the graph until a person
confirms it |
Append-only. A functional relation's new value closes the old
interval and links back via supersedes; below 0.75
confidence or with ambiguous timing it opens a conflict for a person.
Deleting a document is a recorded event that invalidates only facts
whose every source is gone and is revertible from a named list; purge is
irreversible and leaves a tombstone row |
Knowledge base, applied as a kb_id predicate on both
retrieval arms and every graph read, with owner/admin/editor/viewer
membership on top; personal tokens carry a base list and a read-or-write
scope that is intersected with the holder's role on every MCP call |
One binary serving a REST API, an SSE chat loop with a six-round
tool budget, a Streamable-HTTP MCP endpoint per base exposing eleven
read tools and remember, and a React console with graph
browser, ontology workbench and review queues |
A Postgres job queue consumed in-process with
FOR UPDATE SKIP LOCKED: document processing, memory ingest,
extraction, ontology bootstrap and embedding, vector index builds,
scheduled forward chaining, source sync and an optional governance agent
that adjudicates duplicate pairs by reading the audit ledger for
precedent |
Four tables encode status rather than a score: pending, asserted, derived, rejected. Derived facts never close an asserted one; confidence gates auto-closing and fills the low-confidence queue but filters no retrieval result; an automatic merge is held for a person whenever undoing it could not recall what it already sent outside the graph | A genuinely bidirectional pair of clocks with read predicates centralised in two modules, a rejected-triple key consulted before every memory proposal, an append-only ledger the database itself defends and the governance agent reads as precedent, and a committed 37-question bitemporal question set that asks both axes and excludes its own known gaps from the headline | The nod and the rejected-triple key cover only the
remember path — bulk ingest writes facts optimistically and
can re-assert a rejected triple; the lexical arm has no historical
version so record-time recall under-recalls; the whole extraction path
needs an LLM endpoint, and every source comment is in Chinese |
velantrim-exocortex-crystal |
A fact — fact_id, claim,
source, confidence,
epistemic_state, claim_type,
source_status, significance, a
restricted bit and metadata — in an L1 SQLite table,
projected with its truth_status as a node with edges,
entities and mentions into an L3 canonical graph, with evidence spans
that bind a claim to a byte range of a source |
SQLite for L1 facts, evidence spans, import and review sessions, the erasure log, the audit chain, the per-fact provenance chain and checkpoints; the L3 graph in on-disk SQLite unless the optional LadybugDB package is installed, with Neo4j selectable and a Postgres/pgvector migration written and not authorized; files and receipts beside them | A bounded lexical pass when no embeddings are indexed; otherwise a
hybrid cosine-plus-lexical retrieve over admitted memory with a graph
walk that spreads activation along edges, blocks terminal and restricted
facts and refuses to propagate through them; the public
search and query paths resolve hits to canon,
and query answers only from VERIFIED, evidenced,
unrestricted canon or returns a named refusal |
ingest classifies a claim, stores it as
Observed, refuses it before the gate when it contains a
recorded rejected pattern, and admits it through the truth gate — a
source is required, model output can never be a world fact, and a fixed
confidence floor of 0.05 applies to world facts and interpretations —
into Validated and the canon; a blocked fact stays
Observed for the curator. On HTTP an unprivileged caller is
pinned to USER_REPORTED or LLM_OUTPUT, neither
of which becomes VERIFIED |
transition_esm moves a fact along a declared state
matrix with a revision compare-and-swap; erase_fact
physically removes a fact from L1, the graph, evidence and sessions,
cascades over DERIVED_FROM edges when asked, refuses Ring
Zero, and writes a content-free erasure receipt whose content hash no
write path reads; the rejected-value record is the separate
immune_memory table, written by a curator or by the strict
ingest path and read before the gate |
One store per install; a restricted bit and a
whole-session restriction implement a processing restriction per fact,
not a partition by principal. Curator principals carry
fact: scopes that authorize review writes, not reads |
A FastAPI service with /ingest, /ask,
/receipt, /verify-receipt,
/evidence/{fact_id} and the /review/* routes
behind one bearer token, a read-only stdio MCP server with six tools
that never write, a CLI with ingest, ask, audit, review, erasure, immune
and session commands, and source adapters for PDF, EPUB, BibTeX, RDF,
Wikidata and YAML |
None on the memory; a curator runtime and a review session are
explicit, the L3 outbox drains on the next access, reindexing is a
command, and the consolidate decay pass has no caller |
Eight epistemic states and six truth statuses, a source status that
names model output as such, a Ring Zero of immutable facts, a restricted
bit that wins over every read, an immune memory of rejected claim
patterns that blocks a matching claim before the gate, and a
CURATOR_OVERRIDE status for force-approved facts that
strict grounding refuses |
A truth gate whose one hard invariant cannot be configured away; canonical grounding as a pure predicate that fails closed on any missing or inconsistent field; a review that refuses to approve into a conflict; an audit chain with a checkpoint against suffix deletion; erasure that cascades over derived facts and is idempotent; a force approval that admits a blocked claim without letting it ground a strict answer | No scope key inside a store. Erasure and rejection are separate
records: an erased claim re-ingested from a source returns under the
same value-derived id unless a curator has recorded its pattern, and
erasure leaves a recorded pattern as normalized plaintext in the immune
table. The immune match is whole-token containment, so a paraphrase
passes. The bundled HTTP service maps one bearer token to one curator
principal, so a client trusted to ingest is trusted to approve;
unauthenticated local mode makes every caller the synthetic admin.
source_status is a declared label on the Python path. The
audit detail is content-free by convention, and approve records the
curator's free-text note and reason in it |
velesdb |
An atomic fact of at most 2,048 bytes with an embedding, optional typed links to other facts, ColumnStore metadata the caller supplies, a learned confidence from feedback and an optional TTL; plus entity hubs carrying extracted attributes and hub-to-hub relations | velesdb-core's embedded store — HNSW vectors, a graph and a column store in local files under a single-writer lock — one store per process | Vector recall re-ordered by learned confidence; recall constrained
by typed column predicates; fused recall combining vector hits with
graph reach; why returning the nodes and edges behind an
answer; entity profiles with outgoing and incoming relations; a dated
timeline rendering from a caller-named date field |
remember stores a fact with links and metadata and
calls no model; remember_extracted and an optional
asynchronous autograph worker use a local model to derive facts, entity
hubs, attributes and relations; the context compiler stores sources and
compilation events |
forget permanently deletes a fact and its links and
collects entity hubs no surviving fact mentions; unrelate
removes edges; TTL expiry; feedback updates a fact's
confidence; online embedding migration re-embeds a store |
One store per process and path; metadata predicates narrow recall when the caller passes them | velesdb-memory as an MCP server over stdio or a loopback HTTPS daemon with 27 tools, installers and hooks for Claude Code, Codex and Windsurf, Node, Python and WASM bindings, and skills; the wider VelesDB server, CLI, SDKs and Tauri plugin | The optional autograph extraction worker, TTL purging, and online embedding migration | A learned per-fact confidence from success and failure feedback, provenance of compiled context sources, and loopback-only HTTP unless explicitly overridden | A write path with no model and no network; explainable answers through the evidence graph; careful handling of the race between asynchronous graph wiring and a forget; a README whose performance figures are pinned to committed harnesses by a CI contract | Entity attributes and hub relations carry no link to the fact that stated them, so forgetting that fact leaves them on the entity profile; no scope inside a store; hard deletion with no record; the default embedder matches surface form until a model is configured |
veracium |
A typed edge — subject, relation, object — carrying provenance, a disclosure tier, volatility, a valid_from and invalidated_at, an invalidation reason from a closed vocabulary, and flags for needs-confirmation and ungrounded; dated episodes sit beside the graph and an optional LLM-compiled wiki above it | One SQLite file under a declared schema registry at version 16, opened only on the one qualified SQLite build, with a per-edge event journal and side tables for confirmations, refusals, revocations and redactions | Lexical scoring over the user's edges plus everything off the user node, an optional embedding lane fused by rank, dated episodes and the wiki; quarantined and use-only material renders under a never-assert marker on query and is left out of the session briefing | remember ingests an event and an LLM extracts triples; the event's author and declared source floor the disclosure, the extractor routes third-party claims to a quarantined relation, and valid_from is the event date | Supersession under an effective-authority rule, with declined supersessions recorded; dispute and correct invalidate with a reason; source revocation by source identity; targeted redaction of one record's content with an attestation; per-user erasure | user_id on every memory table and every read; the MCP server binds one user per deployment and takes no user argument; an optional host-supplied principal narrows recall within a user | A Python library over any Complete callable, with a CLI, a six-tool MCP server whose trust baseline the host sets once, export and import, and Claude Code hook examples | maintain runs lifecycle — lapse, decay, staleness flags — and fenced consolidation under a lease recorded in a durable operation table | Disclosure tiers floored by the event's author and declared source, a derived assertable gate, a staleness flag only a host-API confirmation clears, and source revocation that quarantines a revoked source's later events at ingest | Confirmation commits its audit row in the same transaction or fails whole; every edge write is journaled with its full state through one choke point that a test enumerates; nothing from a third-party channel becomes assertable; a declined supersession is recorded with both authorities and the rule version; a redaction receipt names the derived records that may still hold the content | valid_from is the event date, the time a statement was made, so the store cannot record that a fact became true before it was said. Source revocation is keyed on the source's identity, not a value, and is reached through a store-module function the Memory API does not wrap. The QUARANTINED label depends on the extractor's routing; the channel guarantees only the use-only floor. The store opens on one SQLite build and requires Python 3.14. Redaction rewrites journal states and a confirmations column in place |
verel |
MemoryRecord fact/rule/schema/failure/skill |
SQLite local plus backend adapters | FTS5/BM25 default, cosine with embedder; rank adds strength, confidence, trust | Candidate extraction, attested/corroborated promotion | Correction chains, rejected tombstones, decay/prune | Scope lattice | Helpers, MCP, hosted/replicated adapters | Consolidation, promotion gate, replication | Explicit candidate/verified/rejected, provenance, confidence | Best correctness model in set | Complex; may be heavy for product MVP |
verimem |
A fact with a proposition, a status from a closed vocabulary, a writer role and writer principal, grounding evidence, an event time and an optional end of validity, beside episodes carrying task traces and outcomes | SQLite, with a local judge model fetched once for the admission gate and an audit table chained by tamper-evidence primitives | BM25 and semantic recall whose SQL drops orphaned, quarantined and user-belief rows, with each exception a named opt-in keyword, and an as-of read over event time and supersession | Every write passes an admission gate with three tiers — off, fast substring detectors, and full with claim validation against semantic memory — and a local judge, before a fact is persisted | Supersede, quarantine, forget, purge and reset; the destructive ones append an action-only row to the hash-chained mutation table in the same transaction, and a release from quarantine is refused to the principal recorded as the writer | A zero-schema topic-prefix convention, user, agent and run segments ahead of the base topic, applied when the caller passes the scope arguments; the gateway keeps one database file per API key | A CLI, an MCP server registered as io.github.aureliocpr-ctrl/verimem, an SDK client, a REST gateway, Docker compose files and Claude Code hook and plugin bundles | Admission cleanup and requalification passes, source-trust demotion and rehabilitation, anomaly detection, and a sleep-consolidation family | An admission gate with a local judge, grounding scores on the write receipt, a status vocabulary that withholds, a release from quarantine refused to the writer's own label, and a tamper-evident mutation chain | Two habits, visible everywhere. The reasoning is written beside the code and names what it defends against: the mutation audit is action-only because "storing WHAT was deleted — even as a hash, brute-forceable on short text — inside an immutable chain makes GDPR Art.17 erasure a logical contradiction", and both that decision and the fail-closed one are attributed to two adversarial reviews with the finding ids they answer. And the project publishes its own corrections: the README's opening box names the version an old claim was true of, the function that caused it and the test that records the fix, and ends "[t]he fix shipped; the text did not follow it. Corrected here." The review queue does the same for its own shortfall under a DECLARED LIMIT heading, because "[m]easuring the real thing coarsely beats measuring a precise thing that does not" | Two conveniences on the agent's MCP surface undo two guarantees.
hippo_quarantine_restore refuses a release when the
requesting label equals the stored writer label, but
hippo_transcript_promote and
hippo_ingest_conversation build facts with no writer label
at all, both can land quarantined, and the guard needs two non-empty
labels to refuse, so the agent releases what it wrote through those
doors. Scope is a tool argument the agent may omit, an omitted scope
reads every tenant, and the session-start banner applies no scope
predicate. Nothing is keyed on a rejected value, so a purged claim can
be written again as a new fact. The surface is very large for the
guarantee it sells: 129,569 lines across nearly four hundred modules, a
711 MB judge model fetched on first gated write, and at this pin five
auto-run surfaces and three build-time execution points |
vestige |
A knowledge node with FSRS-6 scheduling state, a dual-strength model, sentiment weighting and an optional validity interval | One SQLite file behind a 25MB Rust binary, with embeddings in a blob table and fifteen-plus migrations | Hybrid search with spreading activation, a validity boost, and backward causal reach from a recorded failure | Local capture with no cloud call; contradiction detection surfaces supersede candidates rather than applying them | Merge and supersede go through a preview plan; purge keeps a content-free tombstone row for sync and audit | Tags and connector cursors; no tenant or namespace boundary on the read path | An MCP server with thirteen tools, a dashboard, connectors and a single-binary install | A dream cycle, consolidation, a Rac1 suppression worker cascading decay to co-activated neighbours | Retrieval availability states — active, dormant, silent, unavailable — logged with a nine-value reason vocabulary | Uncertain merges require confirm=true, and every applied operation stores the payload that reverses it | The reader in the committed harness is a concatenator rather than an agent, so answer accuracy there is a retrieval proxy — which the harness says itself, at length |
vibe-cognition |
A typed node from a twelve-value vocabulary (decision, fail, discovery, assumption, constraint, incident, pattern, episode, document, workflow, task, person) with typed edges; people are committed profile files rather than nodes | Per-person append-only JSONL journal files under .cognition/journal, a frozen legacy journal.jsonl, and per-person profile and environment-fact delta files, all committed; a NetworkX graph and a ChromaDB index are replayed from them | Local embeddings in ChromaDB, with hits dropped unless the node is visible in the graph; structural reads by type, recency, context substring and typed-edge traversal; a session-start digest that shows only the head of a supersedes chain | Journal-first: one stamped line appended to the writer's own file under a cross-process lock, then applied by the same last-writer-wins comparison replay uses; refused without a confirmed identity and a complete profile | Workflows and documents version by supersedes edges; tasks and other nodes update in place by appended update_node lines; deletion is an appended remove_node line with removed_by, and the local delete purges the node's vectors | One .cognition directory per project. Constraints are personal by default and every read shows them only to the confirmed identity that recorded them; the agent can confirm any identity, and can load another project read-only by path | A plugin-declared MCP server for Claude Code and an adapter for the Codex CLI, session-start and post-compaction hooks, a token-gated local dashboard, curation subagents, and CLIs for journal status, accept-disk, SVN conflict resolution and identity remapping | Catch-up replay before every synced call, a startup embedding sync that also deletes vectors whose node is gone, re-embedding of replayed nodes at search time, and agent-run curation that writes edges and scope-review flags | A server-stamped recorded_by identity on every write, a caller-supplied from_agent flag that lowers a hit's search weight, seniority from the profile, and conflicted and superseded_by flags computed per search hit; no epistemic status on a node | The journal is the record and the graph cannot shrink below it: a rolled-back file is repaired from a checkout-bound ledger of the lines it wrote, a teammate's lost lines are held in memory and reported, and the one command that accepts the loss writes an audit node first and refuses without it | Personal-constraint visibility follows identity.json, which the agent's own cognition_set_identity tool rewrites with any address it is given, and cognition_load_project opens any path the agent names; the project calls the scope visibility, not secrecy. from_agent is a caller argument. Journals have no compaction |
vir |
A typed markdown note (pattern, gotcha, decision or tool) per session in an Obsidian vault, plus recurring rules mined across sessions, clipped articles, PDFs and composed topic pages | Plain markdown on disk plus a SQLite state database holding note content, status columns, rules and embeddings; embeddings from Ollama or another provider, with a TF-IDF fallback | Vector search over one pool of session notes, articles, PDFs, topic pages and accepted rules, MMR-reranked, with a 0.2 boost for a verified note; TF-IDF over the same files when no embedder answers. Rejected, pruned and archived notes and unaccepted rules are excluded; the MCP tools take a verified_only flag | Transcripts filtered for provenance, scrubbed, classified by a small model, distilled by a larger one, deduplicated and written as notes; an opt-in connect pass proposes recurring rules from clusters of lessons | Re-distillation rewrites a note in place and keeps its review fields. Review rejection and prune move a file to .rejected/ and stamp the row; restore reverses either. Dedupe merges into a winner and archives the loser. Nothing deletes a note except the writer replacing its own prior file | One vault per user. Notes carry a project, which the query tools accept as an optional filter | A CLI, a scheduled daemon, an MCP server of six read-only tools, a shipped agent skill, a JSON contract for an Obsidian plugin, and a writer for marked blocks in CLAUDE.md and AGENTS.md | A scheduled pass over new Claude Code and Codex transcripts, an embedding self-heal sweep, and a desktop notification when a run errored | A per-note verified or rejected verdict written by a person, with rejection carried into every serving query; a per-rule proposed, accepted or rejected status; a model audit whose reject verdicts move notes only on an explicit apply, marked rejected_by audit; a confidence float that selects for CLAUDE.md and ranks nothing | Three independent detectors for agent-internal transcripts, each with a stated false-positive guard; a rule queue that a model fills and only a person drains; a rejected rule refused again by embedding similarity; rejection carried into every database read rather than inferred from a file's location; a retriever that counts rows refused for a stale embedding model | Session notes take effect before review. The non-interactive review path has no actor check. Composed topic pages and project summaries keep text from notes rejected after they were generated, and topic pages are in the retrieval pool. The rule tombstone is skipped when embedding fails. Distillation fidelity has a committed harness and no committed result |
virtual-context |
Three: a segment (a compacted span of turns with summary and full text), a fact (subject/verb/object with a temporal status, typed links and an author actor), and an actor-card entry (a kind-checked claim about a person citing the fact ids it rests on) | SQLite or Postgres with pgvector as the relational store — segments, facts, fact links and embeddings, actor cards, canonical turns, a tag graph, per-tag summaries and a cost ledger — beside Neo4j and FalkorDB fact-link backends, a filesystem backend and Redis for session state | Tag-directed with a local embedding tagger on the request path, so
recall never waits on a model call, plus eight paging tools the model
calls to open a topic, search the verbatim record, query facts or
restore a stubbed tool output, and a temporal remember_when
mode that resolves a date window and can anchor on a state as of a
target date |
Turns are tagged by an LLM after the response, compacted under
budget pressure, and superseded when contradicted — with every accept
and reject written to fact_decisions inside the same
transaction |
A supersession checker sets superseded_by and fact
search appends IS NULL; an actor-card entry can also expire
out of the read path on its own validity window; conversations tombstone
in Redis with a day-long TTL, and a conversation delete removes its
rows, ledger included |
conversation_id is a predicate on every proxy read and
paging tool, with tenant_id above it on
conversations and audience_conversation_id on
canonical turns; the MCP server's domain_status tool and
topic resources read every conversation in the store, and the audience
check withholds a summary drawing on another audience but never a
fact |
A proxy in front of the provider API, an MCP server, a CLI, a TUI, a
Discord community surface and an OpenClaw integration. A typed-judgment
layer can route thirteen named decision seams — rerank, query and
temporal intent, safety, actor-card admission, tag reuse, tag selection,
tag split, tag consolidation, supersession, fact curation, topic
selection and summary grounding — to an external service, globally or
per seam, in three modes: legacy (never called, the
default), shadow (the legacy answer is used and the
external one logged for comparison) and jev (the external
answer is used, falling back to legacy on any failure). The config
comment says it is not tenant-settable in the hosted product |
Tag generation, vocabulary canonicalisation, tag splitting, per-tag summarisation, compaction and a due-queue of actor-card rebuilds | None epistemic. facts.status is a temporal status — is
this still happening — and actor_card_entries.confidence is
a float nothing filters on — it appears in two
ORDER BY e.kind, e.confidence DESC clauses and in no
WHERE, and its only comparison anywhere is a write-time
range check that the value is finite and within 0.0–1.0. The discrete
verdict is on the decision, in the ledger, not on the fact |
An append-only decision ledger a database trigger refuses to let anyone edit, recording the before, the after, the proposal and the reason for every accept and every reject | The ledger has no production reader —
get_fact_decisions is carried through the store protocol
and the composite store, and every caller outside the storage layer is a
test — so the same wrong fact can be proposed and refused forever; and
the MCP server's virtualcontext://domains/{tag} resource
returns the stored summaries of every conversation in the store carrying
that tag |
virtualwife |
Short term, a raw exchange as JSON in Django; long term, an LLM summary of an exchange with an LLM-assigned importance score 1–10 | Two stores behind one BaseStorage interface — a Django
model for the short term, Milvus for the long term |
Short term is the last N rows by timestamp; long term sums relevance, importance and an hourly exponential recency decay | Every exchange is saved raw; with long memory enabled it is also summarised and scored by an LLM before insertion | clear(owner) wipes everything for one owner; there is
no per-memory delete anywhere in the interface |
An owner (character) and sender (user) key
on the long-term path only; short-term retrieval drops the owner
filter |
A Django backend behind a VRM avatar front-end; no agent API | None. Summarisation and importance scoring run inline on the write path | None. importance_score is salience assigned by a model,
not confidence |
A four-method storage contract with owner on every
method, including a scoped clear |
normalize_scores sums three quantities on different
scales without normalising any of them |
vista |
Three things per game: an archived frame — every animation and final frame of every turn as an image on disk; a GUIDE.md the model keeps as its durable model of the game; and a WORKING.md scratchpad with a provenance record of the turn and state it was written at | Files in the game's visible directory — screenshots/,
GUIDE.md, WORKING.md, a
working_archive/ per completed level — plus private JSON
observations, a recovery log and event JSONL the model never sees
whole |
Three read-only tools over the archive — inspect
returns chosen turns, frames and regions as images,
read_pixels samples exact colours, history
returns attempts or a turn range of public actions and results; GUIDE.md
and WORKING.md are read as files |
The model writes GUIDE.md and WORKING.md itself as files; the harness records a provenance stamp when WORKING.md changes, stages a retry state on RESET, and archives WORKING.md at each level boundary | GUIDE.md is overwritten by the model; WORKING.md is cleared at a level boundary after being archived with its provenance; nothing in the archive is ever deleted during a game | One game, one directory, one fresh GUIDE.md; nothing carries between games in a batch except the scorecard | Claude Code with hooks on PreCompact, PostCompact and Stop and a Unix-socket MCP host for the four game tools; Codex CLI through the same controller; Docker containers per player | None; the harness reacts to the runtime's events — a compaction request, a stop, a rate limit — and to the environment's replies | None on content; the compaction hook refuses to let the runtime compact until a checkpoint is saved, and the recovery prompt reintroduces GUIDE.md and WORKING.md as the model's own prior notes with the last event as ground truth | Original evidence stays available as images rather than as the model's description of them; compaction cannot happen before the model has written what it needs to continue; every recovery path — compaction, rate limit, runtime restart, RESET — is a test | The memory is one game deep; the checkpoint's quality is the model's; the archive is disk and grows with every frame; the harness knows nothing about what the model wrote in GUIDE.md and cannot check it |
vllm-semantic-router |
A typed memory — semantic, procedural or episodic — with content, an embedding, an importance score, an access count and three provenance fields | Milvus or Qdrant for vectors, Valkey and Redis for a caching layer, an in-memory store for tests; chosen by config behind one Store interface | Embedding similarity against the user's own memories, then a no-LLM gate applying recency decay, redundancy dedup and a token budget | Per-turn chunking on the request path, or LLM extraction; a jailbreak classifier upstream decides whether the turn produces a memory at all | Update by id, Forget by id, ForgetByScope over user, project and type — targeted deletion in the interface itself | UserID required on List and ForgetByScope, ProjectID optional, both composed into the backend query | An Envoy external-processing filter that inserts memory as a conversation message, plus a /v1/memory REST surface for list, get and delete | A consolidation pass groups a user's memories by word-level Jaccard at 0.60, merges each group into one summary and deletes the originals | Write-path defence is upstream — only requests the jailbreak classifier passed produce memories — with UTF-8 validation and a 16 KB cap as the fallback | A user-isolation test written as a security case, targeted deletion in the store contract, and a characterisation test that documents the absence of contradiction detection with its research basis | No contradiction handling by its own admission, importance is a score rather than a state, and the injected block lands before the conversation so it invalidates the cached prefix from there on |
vortx-emem |
Two planes. A note: a Markdown file at a path under /memories, content-addressed by file_cid, with kind (episodic, semantic, procedural, resource, vault), signer, signature and a signed receipt. A fact: a signed value at (cell, band, tslot) with provenance and signed_at | sled trees for paths, blobs, history, meta, tombstones and indexes; redb for facts; append-only Merkle log segment files; a LanceDB table of 768-dimension BGE vectors for note search | Notes: view by path or by file_cid, list by kind, and search over the whole corpus, dense (BGE cosine scan) or BM25, with kind, path-prefix and attester filters. Facts: recall by cell with optional band, tslot, as_of bounds, scope and provenance filters | Explicit, through MCP or REST: create, str_replace, insert, rename, supersede and delete, each signed by an ed25519 attester; the release default refuses unsigned writes. Facts are written only by the responder's materialiser, enrolled devices or operator-listed keys; other keys register derivations | Edits replace the path's file_cid and append to a per-path history. supersede stamps superseded_by once and refuses to re-aim it. delete unlists the path and writes a path-keyed tombstone; the blob stays readable by file_cid. Opt-in TTL moves expired paths aside | Writes: by_attester/PUBKEY8/ namespaces owned by an 8-character key prefix, first-writer ownership on open paths. Reads of notes are world-readable by design. Facts: an opt-in four-part scope index filters a scoped recall; an unscoped recall returns scoped facts | MCP server (streamable HTTP) with memory tools named after the Anthropic memory-tool verbs, REST, SSE event stream, a Claude Code plugin, Python and TypeScript SDKs, LangMem and LlamaIndex adapters | Polling indexer every 60 seconds; opt-in hourly TTL, daily consolidation of episodic notes into a responder-signed semantic file, a refinement loop drawing disagrees_with edges, and a separate LLM sleep-time merge daemon | Signatures prove authorship, not truth. A contested marker, a superseded_by pointer and a per-band provenance class are shown to readers; the provenance filter is opt-in and nothing excludes a contested fact or a superseded note | Offline-verifiable receipts over content-addressed bytes; a closed fact plane that routes outside contributions into derivations absent from default reads; append-only Merkle log with inclusion and consistency proofs; bi-temporal recall that walks history; code comments that record measured failures | Note search attributes every note to the responder key and every kind to resource, so the attester and kind filters cannot match; namespace ownership compares 8 base32 characters; delete leaves the bytes readable by file_cid; one 96,829-line source file |
voyager |
Executable JavaScript skill plus generated description | skills.json and flat files, Chroma index over
descriptions |
Vector similarity over descriptions, top-5, returns code | Written only when a critic verifies environment success | Same-name rewrite; old versions on disk but unreachable | Single agent checkpoint directory | Research rollout loop; the prompt carries the retrieved five, the environment payload carries the whole library | None | Verified execution is the provenance, by a critic that is a model
under the default mode and a person under manual |
Environment-verified write gate — the strongest in the atlas | The full library is concatenated into the JavaScript preamble sent to the environment on every step, growing without bound — the model prompt itself is capped at five retrieved skills; a rewrite leaves the original filename holding the oldest code; no failure memory; frozen since 2023 |
waggle |
A typed node — fact, entity, concept, preference, decision, question or note — with label, content, tags, aliases, tenant, agent, project and session, evidence records pointing at transcript spans, a validity window and an embedding; typed weighted edges; and the verbatim turn pair it came from | SQLite with sqlite-vec by default at
~/.waggle/waggle.db, or Neo4j for the HTTP deployment;
tenants, API keys, context windows, transcripts, retention policy and
runs, an audit table, and a separate proposals table |
Hybrid by default: BM25 over transcripts and nodes, cosine over
MiniLM embeddings, graph expansion, reciprocal rank fusion and an
optional LLM reranker; a graph-only mode with tiered context windows;
as_of and include_invalidated on graph
results |
observe_conversation stores the verbatim turn first,
then extracts sentences deterministically from both speakers into typed
candidates, merges near-duplicates and adds contradicts
edges for opposed preferences and decisions; direct
store_node, update_node,
delete_node and canonicalisation tools; GitHub event,
transcript handoff, vault and .abhi imports |
Direct updates and deletes over MCP and Graph Studio; conflict
resolution and approved proposals supersede by closing
valid_to and linking an updates edge;
canonicalisation deletes merged nodes; scope clears and retention prunes
delete rows |
Tenant on every read, from the API key on HTTP MCP and from configuration on stdio; project, agent and session as optional filters inside the tenant | MCP over stdio and HTTP, Claude Code hooks, a Codex plugin, a Claude
Desktop extension, a VS Code extension, WebMCP site tools, Graph Studio,
a CLI with Google Drive push and pull, and the portable
.abhi format |
An in-process queue that ingests observed turns off the request path, and a re-embedding pass for stale vectors; retention pruning runs from the CLI or the admin route against a per-tenant policy, with no scheduler in the tree | Validity windows, contradicts edges and a conflict
list, an authority projection for the browser workflow, API-key scopes,
and human approval for WebMCP corrections only |
Verbatim-first persistence with evidence spans on every extracted node; an approval flow that applies only the approved text and detects stale targets; an audit table with actors and request metadata; broad client integration | The default hybrid query ignores validity; REST routes select a tenant from the query string when no key is sent; a read-scoped key can edit and delete over MCP; conflict resolution and canonicalisation leave no audit event |
waku-agent |
Fact (semantic), episode (episodic), and SKILL.md (procedural) | SQLite by default; Supabase, mem0, Zep or LangMem selectable for facts behind one FactStore contract; Notion for episodes | Gated — a small model decides whether to search at all, and supplies the query | Consolidation batched after N new chats, not per message | manage_memory lets the agent search, update and delete
its own facts and episodes mid-conversation; the dashboard gives a
person the same CRUD; no supersession chain and no tombstone |
Single user | CLI agent with a local dashboard; three self-management tools; skills in the Anthropic Agent Skills format | Batched consolidation into facts and episodes | Gate decisions carry a reason string; no trust state on memories | Refusing expensive work at three levels, failing open when the gate errors, and one correction path reachable by both the agent and a person | Nothing is keyed on a rejected value, so a corrected fact is re-learnable on the next consolidation; no trust state or scope; gate adds a model call per turn, and the eval that scores its decisions is a judge-scored measurement whose only hard assertion cannot fail in the needless-retrieval direction |
wax |
A frame in a single .wax file with typed metadata under
wax.* keys, beside a structured fact tier of
subject/predicate/object statements carrying two time intervals |
One self-contained file — double-buffered header pages, a TOC, a footer and a WAL ring | Hybrid text and vector search, then a semantic rerank that adjusts scores and drops expired; the fact tier answers separately through an FTS5 index filtered on both a system-time and a valid-time as-of | put and commit through an actor holding the descriptor, lock, header, TOC and index state | TTL expiry via wax.expires_at_ms; a maintenance live-set rewrite compacts the file | repo and project raise the score by 0.9 and 0.7; they never remove a result | A Swift package, a CLI, and an MCP server with a broker command surface | Maintenance rewrite, WAL proactive commit, CoreML embedding on Apple Silicon | A durability tier, a confidence float and a reviewed flag; expiry is a −10 ranking sentinel | Real crash injection with recovery invariants, and a promotion proposal a person approves | promote defaults approve to true;
memory_promote defaults it to false — the same call |
weave |
A claim — subject, predicate, object as resolved entity ids, with the LLM's proposed labels kept beside them, plus modality, confidence, status, an evidence span and offset, an extraction version and a source | Postgres with pgvector; notes, entities, relations, documents, provenance, embeddings, claims and an audit log across nine migrations | Hybrid lexical and embedding search over notes, entities and claims
plus a graph neighbourhood, with local ONNX embeddings; claims filtered
to active unless the caller opts into contradicted
ones |
An LLM extracts claims from a note against a bounded subgraph; a validator and an optional verifier assign status; writes are idempotent on a SHA-256 of the trimmed content | correct_claim supersedes the old claim and inserts the
corrected one carrying supersedes;
forget_entity deletes an entity; both are audited |
None in the memory service — no user, agent, workspace or tenant column anywhere in its nine migrations. The web application has OAuth, roles and server-side sessions; the memory service is a separate workspace and has none | An MCP server for any agent, a Rust HTTP API, a React Flow canvas, and an admin pipeline tracer that shows the exact prompt, the raw response and the selected subgraph for every ingest | None on a schedule; embedding reindex is an explicit, audited action | A five-value CHECK-constrained status held apart from a confidence float, plus a four-value modality that makes a negation a stored claim rather than a missing one | The recall query is default-deny on status, the audit vocabulary records rejections as well as creations, and the admin tracer shows the prompt and the subgraph that produced each extraction | Nothing consults the rejected set before admitting a new claim, so a refusal does not survive a re-assertion; the memory service has no scope key at all; and its integration tests skip silently when no database is reachable |
weknora |
A MemoryItem of kind profile,
preference, fact, task or
interest, with a status, an origin, an importance and a
normalized key |
Postgres, with a vector table for item embeddings and a separate tombstone table keyed on a content fingerprint | Two tiers — profile and preference ride in a resident block on every
turn, fact and task are pulled only when the query matches — plus an
on-demand search_memory tool with a larger budget |
Explicit remember this, or a background distillation
pass; an inferred item is written pending and is not usable
until confirmed |
A contradiction supersedes rather than deletes, recording
invalid_at and superseded_by; a delete records
a fingerprint tombstone that the write path checks |
tenant_id and subject_id composed into
every statement by one scoped() helper used 46 times |
A Go service behind a REST API, an MCP server, a CLI, IM channels and a web manager; memory is one subsystem of a much larger RAG and agent framework | Distillation into pending items, consolidation, and topic promotion | active, pending, superseded,
archived — a discrete status, with pending excluded from
every prompt |
An inferred memory cannot reach a prompt before a person confirms it, and a rejection is keyed on the value so distillation cannot re-derive it | invalid_at is written at five supersession sites and
read by nothing, so the validity interval is recorded and never queried;
and no memory mutation reaches the audit log the rest of the product
keeps |
wenlan |
A chunk with a typed schema — identity, preference, decision, lesson, gotcha or fact — carrying required and optional structured fields, a retrieval cue, and an event date when its text names one | libSQL/SQLite with F32_BLOB embeddings inline in the memories table, a knowledge graph, page maps, a page history, and Markdown pages projected to disk as the user-facing artifact | Hybrid retrieval with an optional cross-encoder reranker, community routing, a temporal channel over event dates, and confidence decay applied at search time | A rule-based quality gate rejects noise, credentials and non-novel text before embedding; typed schema validation follows. A machine write to a page lands only on the AI's own sentences and stages changes to the person's as proposals | An agent's supersede applies unless the user lowered that agent's trust below full, in which case it is staged with pending_revision. Daemon merges are graded by stability tier, with identity and preference queued for review. Forget is a hard delete | A ReadScope enum of Global, Space and Uncategorized compiled into the SQL. An omitted Space resolves to Global, so a standard-profile MCP caller chooses its own scope; only a WENLAN_SPACE pin set by the launcher fixes it | An MCP server with standard, query-only and web-write profiles, a CLI, a desktop app, a relay for web AI apps, and an HTTP server, all over one local libSQL file | Steep (enrichment and page refresh), refinement, citation backfill, claim derivation, re-embedding and decay-driven archival, queued rather than inline | A confirmed flag, a pending_revision flag that hides a staged replacement from every read, per-sentence authorship on pages, and a page support state whose hiding branch no production code switches on | A dismissed suggestion cannot be re-proposed, enforced by a unique index on a derived fingerprint; a machine write cannot overwrite a sentence the person wrote, and the accept routes for those proposals refuse any caller that names an agent | An omitted Space reads every Space. The agent holds accept_refinement, confirm_memory and accept_revision on local MCP, and a revision card carries its full content, so accepting one replaces the person's sentences the sentence gate would have kept. The changelog is a 20-entry FIFO and deleting a page deletes its history |
widemem-ai |
A Memory — content, user, agent and run ids, a tier of
fact, summary or theme, importance 0-10, a YMYL category, a content
hash, extracted entities, created, updated and optional event times |
FAISS by default, held in process memory unless a path is set, Qdrant or pgvector optional, with metadata on the vector rows and a separate SQLite history database | Vector search with optional BM25 fusion, importance, recency decay and topic boosts, opt-in YMYL decay immunity, entity boost, hierarchical routing between facts, summaries and themes, and a confidence level per result set | LLM extraction of facts with importance and opt-in YMYL classification, then one batched LLM call deciding ADD, UPDATE, DELETE or NONE per fact against nearby memories, with an overwrite refused unless nothing is lost or an atomic memory is quoted as contradicted; a regex prompt-injection sanitizer on extraction input | Updates overwrite in place with the old content logged; a resolver
DELETE hard-deletes its target and stores nothing from the fact;
ttl_days hides old rows from search;
purge_expired() deletes them, sparing YMYL rows by
default |
Optional user and agent ids applied as filters when passed; the write path excludes other users' rows even for unscoped calls, while search, delete by id, export and summarize do not | A Python API, an HTTP server, an MCP server and a LangChain retriever; the console script covers benchmarks only, and the Claude Code skill lives in a separate repository | None; summaries and themes are built when summarize()
is called |
None as a state; opt-in YMYL categories raise importance floors and
exempt rows from decay, retrieval returns HIGH, MODERATE, LOW or NONE
confidence from similarity thresholds, and explain=True
derives an answerable and requires-review verdict per query |
A write history with no update or delete path and a source-walking
test over core/memory.py; README claims checked by tests; a
public corrections log; tested evaluation controls and a committed
held-out split |
Search with no user id returns every user's memories, and the MCP tools take the user id from the model; contradictions delete rather than supersede; the committed LoCoMo runners skip the adversarial category and default to self-grading; the published LoCoMo result files are not committed |
windie-sandbox |
One message row — id, conversation id, parent message id, role,
content, metadata, created_at — with ordered message_parts
beneath it for text and image content |
One SQLite database. Messages form a tree by parent link; sessions, session events, session inputs, compactions, tool schemas and provider state sit beside it | No search of any kind. A selected head is resolved to its root-to-head path by one recursive parent traversal, and that path is the model's context | Synchronous inserts on the parent link. A fork adds a branch without copying ancestors; an edit is an in-place UPDATE of the message content | replace_message overwrites content and keeps no prior
version; remove_message splices children onto the removed
node's parent and deletes a whole tool-call group together;
truncate_after_message cuts a subtree |
Conversation id checked on every message read and write, and the selected-head path is what bounds a request. No user, tenant or agent key — this is one person's machine | A local desktop runtime with a CLI, an MCP surface, and per-tool approval; sessions point at a head rather than owning messages | None running. save_compaction exists as a stored
primitive and is marked dead code with a note that nothing writes
compactions yet |
None as a field. sessions.status carries
WaitingForApproval, but that gates a tool call rather than
the standing of a memory |
Shared-node tree so a branch costs one row; message mutation refused while a session depends on it; a compaction checkpoint deleted in the same transaction as the edit that invalidates it; deleting any part of a tool-call group deletes the group | An edit is a destructive UPDATE with no prior version anywhere, so the product's own promise holds for forking and not for editing; no audit record of message mutations; no search, so recall is whatever the selected path contains |
windieos |
An episodic interaction row (a completed turn) in episodic.db, and the semantic fact-summary row it is later rolled up into in semantic.db, each with an optional FAISS vector id | One local file set — episodic.db, semantic.db, episodic.faiss.index, semantic.faiss.index, watermark_state.json and embedding_space.json — under the OS app-data directory, shared by every user_id on the machine; the backend only computes embeddings and summaries | FAISS inner-product search per memory type, filtered by user_id, returning nothing (non-fatally) when embeddings are unavailable | The SDK requests an embedding from the backend and hands it to the local store; a write with no embedding still lands in SQLite with a NULL vector id and is backfilled later | Hard delete per row; episodic and semantic delete independently with no cross-cascade, and a partial delete drops the row's vector mapping but leaves the FAISS vector in place until the index empties | A user_id column indexed on the memories table, a SQL predicate on the row-addressed reads and a Python post-filter on the vector read; conversation rows keyed (user_id, conversation_id) | A local-runtime Python memory boundary behind JSON-RPC, with the desktop app as the client; embeddings and summaries fetched from a FastAPI backend over HTTP | A summarizer that rolls episodic interactions into semantic summaries on a startup pass and a fixed interval, resuming from a watermark | No status on a row. Low-value material is rejected at summarization time, not marked; there is no verified, rejected or confidence field | Every FAISS index is stamped with the embedding space that built it, and a space change clears and rebuilds rather than silently comparing incompatible vectors | Partial deletes leave orphaned vectors in the FAISS file until the type empties, and there is no episodic-to-semantic delete cascade, so a summary outlives the interactions it was derived from |
windvane |
One MemoryEntry: content, category (rule, mistake, decision, discovery, context, lesson, priority, note), relevance 1-10, tags, related_files, created_at, last_accessed, access_count, source, archived_at, cluster_id and an optional rule detector. No project field and no status | JSON under ~/.windvane: projects/HASH/memory.json per registered project path, a manifest from path to hash, one archive.json at the store root keyed by project path, per-project embedding files, checkpoint rings and a session index | Hooks score hot entries by file match 0.35, tags, recency, relevance, access count and a category bonus, and inject the top three only with direct file relevance. The memory tool's search is word-set overlap sorted by relevance. Past-session search fuses keyword and optional embedding scores over transcript chunks | The failed-tool hook stores mistakes and the prompt hook gated decisions, each deduped by exact text against memory.json only; a detached miner adds decisions, mistakes and preferences; the memory and log tools and a /remember command. Store writes dedupe at 0.85 Jaccard, and a new mistake also against the archive | modify, delete, promote, archive and restore by id; acknowledge_mistake archives; forget removes a project's directory, manifest row and archived rows. Idle entries archive after 14 days; cleanup deletes short entries outside rules, mistakes and lessons as broken. No tombstone | Physical: one memory.json per registered project path. Hook readers merge the path's own store with every registered ancestor's and nothing else; tool reads open the file of a project_path the model may supply. No key on the row | A Claude Code plugin: command hooks on twelve events through a thin daemon client, a TypeScript hooks module registering six tools, slash commands, a pane, a status segment and a subagent-prompt rewrite; a second plugin, windvane-keeper, reloads it | A detached transcript miner at session end, at bootstrap and on a live tick; the session-end and bootstrap runs apply cleanup with decay and archive stale mistakes across every registered project; a loopback daemon serving hooks, tools and embeddings behind an owner-only token, exiting after 30 idle minutes | None as state. Categories are types, archived_at is a storage tier that hook reads skip, and decision capture is a write-time shape gate | Path-aware file matching that refuses bare generic basenames; an injection gate that stays silent without direct file relevance; one decision-shape gate shared by the prompt hook and the miner; archive-not-delete for age and mistake hygiene; stale-save merge by entry id; a daemon token checked before any handler runs | The failed-tool hook dedupes against memory.json only, so a mistake acknowledged into the archive returns to the banners when the hook logs it again; a recurring failure's files are patched onto whichever entry is last in the file; cleanup deletes short notes without an archive copy; the model may name the project any tool reads; no CI |
wordcell |
One Markdown file with YAML frontmatter and a stable document_id; the type field (note, concept, plan, session, profile, market-research, report) decides how path context groups it | Markdown files in a vault directory, normally committed with the repository. Derived and disposable: a QMD SQLite index and per-note lock files under the XDG cache, and an optional Oh graph projection in .wordcell/oh.sqlite | Exact substring and identity scoring over a fresh vault scan, optionally fused by reciprocal rank with QMD keyword and local vector lanes, exact identity matches first; every QMD hit is reconciled against the live scan. Path context returns notes whose repository_scopes equal the target or an ancestor, grouped by type and plan status | Explicit only: wordcell note create, MCP create_note, update_note_body and add_relation, direct file edits, or the Supermemory importer. Each tool write is an atomic temp-file install under a per-note lock, and body updates require the current sha256 revision | Body replace at an exact revision, relation add and remove, or a hand edit. No delete verb: a note is removed by deleting the file, and Git keeps the prior text. A re-import of Supermemory data re-creates a deleted imported note | Physical: one vault per directory, and a portfolio registry selects which vaults a federated search opens. repository_scopes is a code-path association the caller may filter on, not a principal key | wordcell mcp stdio server with five read tools, a context tool when a repository is configured, and three write tools removed by --read-only; a public Agent Skill that routes save-session, plan and query requests to the CLI; a TypeScript SDK | None that writes notes. Opening a search session updates the QMD index and embeds changed notes lazily; wordcell refresh rewrites a managed index.md catalog on request | None on the read path. Plan status splits path context into current and historical groups, and both are returned. The SDK can wrap search results in an execution-untrusted envelope; the MCP tools return note text without it | Markdown is the only authority and every index rebuilds from it; optimistic revisions, a per-note lock and a quarantine-and-restore install make concurrent writes safe; semantic hits are dropped when the note has left the live scan or the filter; code-path routing separates active from terminal plans; bounded tool results report what they omitted | A deleted imported note returns on the next import; superseded imported versions and terminal plans are searched like current ones; the agent can write any note, type or relation through MCP with no review; MCP tool results carry note text as trusted structured content; every tool call re-walks and stats the whole vault |
xerj |
A document with text, optional metadata
and vector, and one stored_at timestamp, in a
namespace that is a reserved index; plus a separate edge record linking
node ids with a validity window |
The engine's own on-disk indices — one reserved index per namespace,
a second one per brain for edges, and an append-only
audit.jsonl beside them |
BM25, server-side semantic kNN, an explicit caller vector, or
hybrid fusing the first two by reciprocal rank; optional
metadata filter, recency blend, and a graph restrict or blend over the
brain's edges |
A single synchronous store call; the memtable is always visible, so a memory is recallable immediately with no refresh wait | Memories are hard-deleted by id or by dropping the namespace. Edges
are soft-invalidated and never removed, so as_of stays
answerable |
A physical partition: one reserved index per namespace, with no
scope key on the document. An index-name grant on the credential is
checked by every /_memory handler and narrows wildcard
reads; open mode, the admin key and the default MCP setup reach every
namespace |
An MCP server with eleven tools, six of them memory and brain tools, a CLI, an ES-compatible HTTP surface, a native router, and a console graph reader for the owner and admin roles | An autoindex daemon that watches a folder, runs nine deterministic detectors and reconciles the edge set, soft-invalidating edges taught by files that left the corpus | None as a status. Each edge carries a confidence float
and a detector tag, both stored and echoed and neither read
by any query |
Two clocks populated from different sources rather than from one
now; a tenant boundary tested through every door that
reaches the backing index, including the percent-encoded spelling |
Invalidation is keyed on an edge id derived from the source file's mtime, so saving the file re-teaches the same claim under a new id; the one-command MCP setup runs as the admin key, so the model-supplied namespace is the only scope |
xiaoo |
Typed kinds over one flat row: instruction, fact, task, prompt-history entry, session summary and durable memory all stored as id, kind, content, source, embedding, updated_at. | SQLite with an FTS5 shadow kept in step by insert, delete and update triggers, plus a content-hash embedding cache. | A per-kind budget rather than a ranking — RecallQuery caps instructions, facts and prompt history separately; semantic search is opt-in and skipped when the query is None. | A chunker, an embedding path that skips re-embedding identical text, and a 1,036-line session module that summarises through a model. | Update in place on updated_at. No supersession pointer, no rejected-value record, no deletion marker. | None in the store. Sandbox permission grants carry a scope; memory rows carry none. | A gateway with memory automation, a skill system, and the cerberus sandbox around tool execution. | Embedding and chunking on write; no consolidation or decay pass over stored memory. | No status field on a memory. The runtime's audit subsystem watches process, file and network access and reaches the memory crate nowhere. | Opt-in semantic recall, per-kind context budgets, all three FTS triggers, and a content-hash embedding cache. | One timestamp makes a memory's age unrecoverable after the first edit; no memory mutation record beside a serious execution audit; tests cover two of ten memory modules. |
yacmemo |
A Markdown note under a git-tracked memory root, its title the
identity and its directory only filing, with Basic-Memory-style
- [category] text observation lines parsed out of the
body |
Markdown files as the sole truth; SQLite (metadata, FTS5 trigram,
collisions, guard events, audit dispositions and an execution timeline)
and LanceDB vectors are derived indexes under .index/,
rebuildable and untracked |
FTS5 trigram and vector search fused by RRF, filtered to the caller's identity, with archived notes dropped for MCP clients, settled curator proposals dropped for every caller, and a ⚠ warning attached to any hit that has an open collision | memory_write(title, content, force, force_confirm)
creates only: an existing path is refused, a near-duplicate title is
refused unless forced, and the force is itself rate-limited |
memory_edit on a unique anchor,
memory_edit_section by heading, move, archive and
unarchive, and an explicit delete. Every one commits to git, so the
memory repository is always clean and any deletion is recoverable |
A separate store root and MCP mount per user; inside it, a private zone per agent and device selected by a token in the request header and applied by one predicate on every MCP read | One streamable-HTTP server that any MCP client joins by URL with
nothing installed locally, plus a bundled Vue web console at
/ui/ behind an optional password |
A weekly LLM curator on a systemd timer that writes a proposal report, and an incremental observation-collision detector on the write path | A deterministic duplicate guard with a counted override, collision warnings only a person can dismiss, per-call usage logging, and git history over every mutation | The duplicate guard anticipates the evasion.
normalize_title strips trailing dates, compact MMDD and
YYYYMMDD stamps, -2-style counters, v1,
更新 and （新） before comparing, so the
rename that would slip a second copy past a naive check is exactly what
it collapses, and the refusal names the near-matches with their scores
and says to edit instead. The override ladder makes the bypass possible,
visible and self-limiting: force=true is counted in
guard_events, and once forced writes in the last 24 hours
cross a configured threshold a second flag becomes mandatory. A person's
verdict on a collision is stored, kept through edits, moves and
rebuilds, and read by every search, and the agent's tools cannot set it.
Identity scoping is one predicate shared by every MCP read rather than a
filter copied into each |
No record covers every mutation. Git commits do, and git history is
not an audit record this atlas credits, because it lives outside the
store and anyone with the directory can rewrite it.
guard_events holds refusals and forced bypasses only, and
call_log trims itself to the newest 20,000 rows and is not
written by the console's archive, tag or disposition routes. The
identity token is a self-asserted header, and memory_audit
prints other identities' private paths with 60-character excerpts. The
agent can declare a curator proposal settled by writing a marker, after
which every item a person did not dismiss is recorded as executed. The
duplicate guard is keyed on title similarity only, so the same fact
under two genuinely different titles is two memories. The console and
the MCP endpoint have no authentication by default; the stated boundary
is the home LAN |
yantrik-mind |
A typed belief in YantrikDB with statement, polarity, weight, evidence trail and Bayesian confidence, plus a scope and a sensitivity class this layer keeps in side tables keyed by the proposition; flat memories with a namespace beside them | One YantrikDB SQLite file, pinned to the published crate at =0.23.0 and shared with Hermes, holding the engine's tables and this layer's own; a hash-chained JSONL read-receipt ledger beside it | Embedding similarity plus 0.1 of the belief's confidence, or keyword overlap without an embedder; flat memories by engine recall with graph expansion off; every facade read passes the scope wall, then the purpose lens | Conversation turns consolidated into beliefs through assert_belief_evidence, refused when a batch mixes members; MCP remember and believe from other minds, stamped with the server-known writer | Bayesian revision in the engine; forget soft-deletes the node and records a fingerprinted, redacted tombstone row; nothing is erased, and no write path consults the tombstone | Shared or Private(owner) per belief, untagged rows private to the primary, four sensitivity classes with default-deny purpose policies, Credentials outside wildcard grants and never readable by another mind | Twenty-one crates in one workspace, a Telegram and web companion, and an MCP server on loopback TCP and on the person's unix socket for other minds | Consolidation, rolling-summary compaction, dream, proactive and research lanes; facade reads are walled and receipted, the transcript reads behind consolidation and compaction are not | Confidence and evidence trails in the engine; a purpose gate with counted suppressions; a hash-chained receipt for every facade read; server-stamped authorship on MCP writes, with a repeated assertion from the same mind not counted again | The purpose gate is one function, monotonic toward denial: outside the audit and maintenance lanes nothing about the activity or the query widens access, only a standing, expiring, revocable grant does, and a grant never widens a principal's viewing scope because the scope wall runs first. Another mind reaches memory only on a credential the desktop validates by its SHA-256, cached at most five seconds and cleared entirely when the door fails, and it reads as the person with ordinary facts by default, Health and Finance only by its own grants, and Credentials never. The engine dependency is an exact published pin with its reasons written beside it, including the two upgrade audits that replayed assert_belief_evidence across schema migrations to six decimals | The MCP machine token maps to the operator audit lane, an unrestricted lane that sees every member's private beliefs and the Credentials class, served on loopback TCP whenever the deploy unit sets YM_MEMORY_SERVER; the receipt records it and nothing narrows it. compact_conversation reads every transcript row with no scope and no receipt and folds them into a rolling summary carried in the primary's prompt, so a member's private lines can reach the primary. The believe tool returns the stored belief's confidence and evidence count unwalled and adds evidence to whichever belief carries the words, whatever its scope. Three dependencies remain path dependencies into a sibling checkout, and the pin comment's first line names 0.18.0 above a =0.23.0 requirement. There is no licence. Run artefacts are committed, including two smoke databases' write-ahead files |
yantrik-os |
An engine memory row the companion writes with a type, importance, domain and source, plus companion side tables for importance tiers, lifecycle states, contradictions and a consolidation log; above them the brain's pulses, entities, baselines, expectations and drives | An embedded YantrikDB engine over one SQLite file, pinned to an exact git revision; the companion reads and writes the engine's tables by raw SQL beside the API, and the brain and cortex keep their own tables over a plain rusqlite connection | The engine's hybrid vector and lexical recall with no namespace, filtered by domain so audit and system lines stay out; a multi-query smart recall, an identity-fact SQL lane, a self-memory lane, and a section from the machine's shared memory server | remember and save_user_fact behind a
similarity dedup, an LLM extraction pass after each turn that also
writes through to the shared memory, and every tool call recorded as an
audit line |
forget_topic and forget_memory set the
engine's status to tombstoned by raw SQL, outside the engine's own
forget; LLM consolidation and pruning demote by setting
half_life to one second, which the pinned engine's ranking
does not read; a startup purge overwrites vault audit lines in the
memories table and the oplog, then vacuums |
None in the companion's store, which writes and recalls one
default namespace. Per-mind grants are answered by the
shell and enforced by the Yantrik Mind memory server, another
repository. A program asking on the companion socket gets no memory in
its prompt |
A unix socket every app publishes state and accepts actions on, seventeen memory tools on the companion's own surface, an MCP client to the machine's shared memory, and an MCP server crate that is not a workspace member | A brain tick and instinct pipeline, a cortex reasoner reflecting every four hours, nightly brain consolidation, and companion maintenance running LLM consolidation, pruning, reference decay, graph weaving and a lifecycle pass | A domain rule keeping audit and system lines out of recall, credential-touching tool results withheld from audit lines, a ceiling on turns a program asks for, a per-mind grants file the shell refuses to widen behind its back, and an output sanitizer | The drive model carries the decision worth copying, and the comment
states the failure it avoids: usefulness_pressure rises
when outputs are ignored and raises the threshold, more selective and
not more spammy. The whole speak-or-not decision is arithmetic a reader
can follow. The vault purge is the most careful erasure in the tree: it
overwrites a leaked audit line in the memories table and in the oplog
payload that recorded it, then runs VACUUM and a WAL truncate because an
UPDATE frees a page without erasing it. The recall tool's audit-line
filter carries a committed must-not-appear case with a positive control
on a real engine |
Three removal paths do not do what their names say. LLM
consolidation's tombstone sets half_life = 1.0 on every row
with that text and leaves the status active, and the pinned engine ranks
on a constant half-life, so a superseded memory stays recallable beside
its replacement. The contradiction detector reads
memories.id, a column the engine's table does not have, so
it never flags. The exclusion list has no production caller. The agent's
own tools tombstone by raw SQL outside the engine's forget, which skips
the oplog and synthesis invalidation, and resolve_conflicts
closes every open conflict in one call. Audit lines reach the prompt
through the self-memory lane the domain rule was written to protect |
yantrikdb-engine |
A memory row keyed by UUIDv7 with a type of episodic, semantic, procedural or emotional, an embedding, decay parameters, a namespace, certainty, domain, source, an event-time range, and typed write-resolution provenance | One SQLite database per store, with HNSW vectors, an oplog,
record_revisions, record_links, idempotency
claims, and a cognition layer of propositions, variables, state
assertions and rule edges |
Hybrid vector and lexical recall with decay-weighted scoring, graph
expansion, thread reconstruction, and recall_as_of for
point-in-time reads |
remember with actor-scoped idempotency keys and a
confidence-basis write gate; correct mutates in place while
archiving the prior state; link records supersession as an
edge |
Correction archives prior_text,
prior_metadata, prior_importance and
prior_valence into record_revisions with an
applied_at; supersession is an edge in
record_links; forgetting sets
consolidation_status = 'tombstoned' with a caller-supplied
tombstone_reason and removes the row from the recall
path |
A namespace column with a
NOT NULL DEFAULT 'default', appended as
AND m.namespace = ? on recall — but the engine's own
signature is namespace: Option<&str>, so a caller
that passes None gets no predicate |
An embeddable Rust library with Python, WASM and TUI crates; wrapped by yantrikdb-server for HTTP and HA, and embedded in process by the YantrikDB Hermes plugin | Decay sweeps over stored half-lives, autonomous consolidation into semantic memories, contradiction detection, a reembed pipeline with staging columns and generation stamps, and a materializer draining the oplog | Consolidation and synthesis statuses as read predicates, a confidence-basis justification tier in a write-gate consistency matrix, actor-scoped idempotency claims, an append-only oplog, HLC ordering, and encryption at rest with a documented erasure step | The bitemporal module states its own limits in its header rather
than leaving them to be discovered: ranking is present-day, forgotten
records stay forgotten, and the as-of pool runs with
skip_reinforce because "archaeology must not masquerade as
usage". A superseding edge only hides a record from an as-of read if the
edge already existed at that instant. The audit op is written inside the
caller's transaction rather than beside it. The reembed path stages new
vectors in separate columns with a generation stamp because in-place
mutation "would dim-mismatch concurrent recalls". An index comment
carries a signed honesty note that the index does not satisfy its
query's ORDER BY and that SQLite may sort the full eligible set |
Scope is offered rather than enforced: recall takes
namespace: Option<&str> and emits the predicate
only when a namespace is supplied, so the boundary is the wrapper's to
keep, not the engine's — which is why the mark sits on the Hermes plugin
and not here. The v26 write-resolution columns —
resolution_kind, dismissal_reason,
prior_rid, confidence_at_write — record the
epistemic operation chosen at write time and no read path consults them
to refuse a re-assertion; the schema comment frames them as a foundation
for a future API. synthesis_granularity and
synthesis_state carry CHECK constraints while
consolidation_status, type,
storage_tier and resolution_kind do not, so
those four accept any string. The schema is
CREATE TABLE IF NOT EXISTS with no migration constants, so
a column added to the constant reaches an existing database only through
the separate ensureColumn-style paths |
yantrikdb-hermes-plugin |
A YantrikDB memory — text, importance, domain, source, certainty and metadata including session and scope — plus entity relations, engine-detected conflicts, skills with an outcome ledger, tasks and triggers | The YantrikDB engine in process (default) against a local database file, or a YantrikDB HTTP server; a local JSON recall-feedback ledger and recent-skills file beside it | Engine recall scoped to the provider's namespace, unioned with
legacy owner namespaces, shared group namespaces, the base namespace, a
shared-brain namespace and mounted pack namespaces when configured,
deduplicated and re-ranked with a reinforcement boost;
why_retrieved reasons per result; low-certainty extracted
facts filtered unless requested; a pre-compression injection of the
highest-salience memories |
yantrikdb_remember writes to the provider's namespace
and mirrors to the shared brain when configured; sync_turn
stores user messages verbatim and runs a cheap extraction pass that
marks candidates source=extracted with certainty at most
0.4, extracting from an assistant turn only after a bare user
confirmation |
yantrikdb_forget by memory id; think
consolidates and scans for conflicts within the namespace;
resolve_conflict keeps a winner or merges; hygiene
recommends removal of low-usefulness memories |
Base namespace plus agent workspace and identity by default; optional owner scoping per person through an identity map and shared group spaces, with base and legacy namespaces still recalled by default | A Hermes Agent memory provider with 23 tools, a pre-compression hook, prefetch, a CLI installer, a read-only local constellation UI, knowledge packs and an agent constitution file | Queued prefetch and turn sync on worker threads with a circuit
breaker; engine maintenance through think |
Engine conflicts with explicit resolution, certainty on extracted facts, recall reinforcement from reported usefulness, and identity-mapped owner scoping | Namespace derived from the host rather than the model; a semantic contract suite run against the real engine; owner scoping with legacy namespaces carried forward; extraction from assistant text only on user assent | Under owner scoping the shared-brain mirror copies each person's explicit memories into a namespace every person recalls; forget and conflict resolution take ids with no namespace check; base-namespace recall stays on by default when scoping is turned on |
yantrikdb-mcp |
A YantrikDB engine memory row written through MCP tools, plus conventions the server adds in metadata: skill records, skill outcome events, a pending_review flag, event_time bounds | The engine in process against one SQLite file, default ~/.yantrikdb/memory.db, or a YantrikDB server cluster over HTTP when YANTRIKDB_SERVER_URL is set | Engine hybrid recall with entity expansion forced on, optional created_at window, client-side relative score cutoff, re-sort by recency or certainty, record-time as_of recall, chain_head for the newest revision | Agent-called remember, single, batch or summary draft, with optional idempotency key, backdated created_at, event_time and stated claims; refused rather than silently dropped when the engine cannot honour a parameter | correct in place with a required reason; forget by rid; conflict resolve and auto_resolve; archive and hydrate; all by id with no namespace argument | A namespace tool argument the model supplies. remember defaults to default, recall and list default to no namespace, which the engine treats as every namespace. Network transports share one store across all clients behind one bearer token | An MCP server over stdio, SSE or streamable HTTP with 21 tools in the full profile and 10 in core, injected server instructions, a portable Agent Skills skill, and integration notes for Hermes Agent and Prime Agent | None scheduled. think and the maintenance cycle run only when the agent calls them; write responses carry a maintenance-debt nudge after 50 writes | Engine statuses applied by the engine recall; a skill write gate off by default with schema, content scanners, rate limit, attribution, JSONL audit and a review queue for rule skills; pack writes gated by an environment flag | Parameters the engine cannot honour are refused with the fix named rather than dropped; the maintenance-cycle dry run defaults to preview after a documented incident; every hit carries created_at and why_retrieved; engine and SDK pins bounded to tested minors with the reason in the manifest | Default recall and the cold-start digest span every namespace; the generic remember writes into the skill namespace past the skill gate, and a skill with no hash is served as valid; the review queue has no reader and default recall returns it; the skill rate limit is keyed on the JSON-RPC request id; auto embedder selection treats its own default store as a legacy one |
yantrikdb |
A memory with text, certainty, importance, valence, domain, source and an emotional state | A Rust server over SQLite with a per-tenant commit log and pack files, wrapped around an engine crate in a separate repository | Multi-signal scoring — vector similarity, temporal decay, importance and graph structure — scoped by namespace | Four routes append to one commit substrate idempotent on op_id; the applier wires four of the seven mutation variants and refuses three by name | correct updates the row in place under the same rid and archives the prior state in record_revisions; the gateway returns 501 | namespace is the read-path predicate in the engine recall SQL; a tenant is its own SQLite file | An MCP server, an HTTP API, a Python client, a WASM build and an embeddable crate | A think loop doing consolidation and conflict scanning, plus packing and reconciliation; no compactor trims the log | A certainty float per memory; the engine three-value claim grounding is read by a gate that ships in shadow mode | Nine write routes return a 501 naming the missing replication path rather than a direct call that would diverge | Crypto-shred destroys per-tenant keys nothing encrypts with, while the shipped at-rest layer uses one server-wide master key |
yesmem |
A learning — a categorized statement extracted from a session, on a 55-column row | SQLite with FTS5, a Go-native IVF vector index, and a separate cap store database | Hybrid BM25 plus vectors through a daemon, with association expansion and a staleness demotion that never fires | A background extraction pipeline turns session transcripts into learnings; the agent does not wait | Supersession graded by a computed trust score; high-trust rows are only proposed, and the proposal is never resolved | canonical_project applied on the read path, with an OR clause that lets every unscoped row through | MCP server, Claude Code hooks, OpenCode plugin, an HTTP API, a proxy and a large CLI | A daemon doing extraction, embedding, clustering, briefing, index maintenance and log rotation | A trust score from use count, source and importance that decides how hard a learning is to overwrite | Correction resistance proportional to how much a memory has earned — the right idea, cheaply computed | Three mechanisms written into the schema and left unwired, including the confirmation the trust gate depends on |
yourmemory |
A memory row with an importance, a recall count and a type-dependent decay rate | Postgres, SQLite or DuckDB behind one connection layer, with a graph and embeddings | 0.5 × normalised BM25 + 0.5 × cosine plus a +0.25 temporal boost, then graph BFS to depth 2 | Semantic dedup by similarity band — reinforce, replace on contradiction, merge, or insert | memory_history logs old content before an update;
Ebbinghaus decay drives a 24-hour prune at strength 0.05, and ranking
ignores it |
user_id is a WHERE clause on retrieval, compaction and the audit read | An MCP server, hook templates, a FastAPI service, a Cloudflare worker, Docker | Compaction, decay, temporal analysis, a 24-hour prune, recall reinforcement | importance and recall_count as floats; nothing discrete and nothing epistemic | A hash-chained audit that logs ids and metadata but never memory content or query text | The dedup replace branch overwrites without a
memory_history row, nothing reads the log back, and
BENCHMARKS.md publishes ranking weights the service does
not use |
z-waif |
A message pair — one user turn and one character turn — reduced to a list of word ids with the common words pruned out | Three JSON files under RAG_Database/: a word table with
counts and values, per-pair word ids and scores, and the raw text |
Six highest-value query words scored against every stored pair by shared-word count, with a length penalty; the best pair and its two neighbours are injected | Every message pair is tokenised into the word table after it is sent; no model is involved at any point | An undo pops the word-id rows and documents that it does not uncount the words; a manual recalculate rebuilds everything | None. One global corpus per installation | The companion app's own prompt builder; the result is injected as a
[System M] block |
A thread recomputes word values every 120 seconds, plus a roughly one-in-three chance of recomputing on any given turn | None. Every stored pair is equally eligible and nothing records where it came from | Inverse document frequency, length normalisation and a cap on the character's own words steering retrieval — all derived from scratch | A three-message window score is computed and never used; the licence is not open source, and one of its three conditions constrains what a memory system may store |
zcode |
One Markdown file per fact, carrying name, description and metadata.type frontmatter, beside a MEMORY.md index that is explicitly not a memory | Files. A per-project directory under the CLI storage root, plus three per-subagent roots; no database anywhere on the memory path | No search. The index file is pasted into the system prompt each session and the model issues its own Read calls against the filenames it names | A background sub-agent on an auxiliary model, scheduled after a turn, capped at five turns and a 60-second drain | Edit rewrites a file and rm deletes one, admitted by a grammar that rejects recursion, globs, redirects, env assignments and relative paths. Nothing survives the deletion | A filesystem partition keyed on workspace identity or normalised path, hashed into a directory name. No key on a record and no predicate on a read | Native to the harness: a system-prompt section, a permission rule, a tool-executor policy and a read-only desktop viewer | Extraction runs detached after a turn, coalescing to the latest snapshot, advancing a cursor only when the run reports success | None stored. The prompt tells the model to verify a memory against the current tree before acting on it; nothing in the store records whether it did | A delete grammar that parses the command instead of matching it; a sensitive-segment denylist whose normaliser strips bidi controls, NTFS stream suffixes and trailing dots; a memory writer confined by its own tool policy rather than by prompt text | No test runner is configured and no manifest declares a test script, while the pre-commit hook invokes one; the delete path checks containment without the denylist the write path applies; memory text is injected under a header instructing the model that it overrides default behaviour |
zenbrain |
A text row in one of four tables: learned_facts with a confidence float and FSRS scheduling fields, episodic_memories with a context string and emotional weight, procedural_memories with steps and a success rate, core_memory_blocks keyed by a label. No status, no validity interval | SQLite through better-sqlite3 with JSON-array embeddings and a cosine UDF, or Postgres with pgvector and HNSW indexes; working and session memory are in process only | Per layer: pgvector-style cosine distance when an EmbeddingProvider is configured, otherwise an IDF-weighted token overlap over the 500 newest rows with a recency fallback at score 0. Every core block is added to every recall at a fixed 0.5 or 0.8. Results merged by raw score, Jaccard-deduplicated, cut to the limit | Explicit store call from MCP, the Vercel AI SDK middleware or the library. Routing by regex for procedures, an emotion lexicon above 0.5 for episodes, confidence above 0.9 for core blocks, otherwise a fact. Every store is an INSERT except core blocks, which upsert on a label cut from the first 50 characters | Core blocks overwrite by label. Layer classes expose delete by id, and the coordinator, MCP server and middleware expose none. Nothing expires; consolidate reports pruned as a constant 0 | None on the recall path. Episodes store a context string, and only EpisodicMemory.getRecent filters on it, with no caller passing one. Facts drop the context. Postgres can run each adapter under its own search_path, a physical partition | MCP server over stdio with four tools (store, recall, consolidate, health); Vercel AI SDK middleware that recalls on the last user message, prepends results as a system message and stores each user turn; examples for LangChain, CrewAI, LlamaIndex, Mastra and Claude | None scheduled. consolidate() is a tool call that promotes every episode above 0.5 emotional weight among the latest 100 to a new fact, optionally summarised by an LLM, and decays the in-process working memory | None. A confidence float filters recall only when the caller passes minConfidence; core blocks report confidence 1.0 regardless of source | Small, readable coordinator; a lexical fallback that says when nothing matched by scoring 0; a SQLite adapter that runs the same vector SQL through a cosine UDF; a CI step that re-runs the paper's ablation and diffs every point estimate against the published JSON; a README that retracted its own benchmark claim with the arithmetic | No forget or update verb on any agent surface; consolidate re-promotes the same episodes on every call; core blocks enter every recall whatever the query; includeContext and taskType do nothing because no writer sets encodingContext; the cross-context layer reads a table nothing writes and pairs each entity with itself; the paper's ablation measures hand-set multipliers in a simulation, not the shipped code |
zep |
An episode submitted to a hosted graph, and the typed fact edge it later becomes — carrying valid_at and invalid_at for world time and created_at and expired_at for the graph's own | Zep Cloud's hosted graph; nothing local. The deprecated Community Edition in legacy/ keeps sessions and messages in Postgres and hands facts to a Graphiti service on Neo4j | graph.search over edges, nodes or episodes, limit 50, reranked by rrf, mmr, node_distance, episode_mentions or cross_encoder; most integrations inject the returned context before every model call | Asynchronous end to end — submit returns batch, episode, message or task handles, wait() polls the tail of each and returns before the fact is searchable, and a poll helper absorbs the rest | No call on the supported path updates or deletes one fact; a triple can carry its own closed interval, and whole graphs, threads and users can be deleted. The Community Edition deletes a fact by UUID | Destination requires exactly one of graph_id or user_id, and every zep-ingest read carries it; the MCP server takes user_id from the model | Nine Python framework packages, three TypeScript, one Go, most with a persist-and-inject hook and several with a model write tool, plus a Go MCP server registering thirteen tools, every one of them a read | All extraction is the vendor's; the client sees only processing handles and an indexing lag it polls through | min_fact_rating is a hosted score on a fact, not a state; nothing is candidate, verified or rejected | A committed retrieval-budget ablation with ten runs per point that isolates memory failure from answering failure | The mechanism is a closed hosted service, and an episode submitted without created_at is silently dated to ingestion time |
zer0dex |
A section of operator-written Markdown on one side — categories, durable summaries and cross-topic pointers — and whatever mem0 stores for the same text on the other | Two layers: Markdown files the operator maintains, and a local Chroma store written through mem0, with Ollama supplying embeddings | Delegated to mem0. The package supplies a CLI and a local server, and its own citation abstract states that wiring the query into model calls remains an agent-host step | Seeding, not capture: Markdown is collected by extension, split at level-two headings and capped at 2,000 characters, then pushed into the store | None modelled. A correction means editing the Markdown and re-seeding, and nothing reconciles the store against a changed source, so a deleted paragraph's chunk stays retrievable until the store is rebuilt | One key, and not spelled scope — every read and write
forwards a user_id into mem0, and --user-id
defaults to the literal agent, collapsing the per-user
partition into one shared bucket unless the operator sets it |
A CLI, a local background server, a skill directory and an
AGENTS.md, plus a TypeScript hook shipped as example source
rather than as a package |
A background server whose state record the CLI detects and removes when stale or invalid, without touching any process | None. No status, no confidence and no validity window; the Markdown layer is trusted because the operator wrote it | The citation abstract states which half the adopter still has to build — that wiring the query into model calls remains an agent-host step — which is a disclosure most READMEs avoid; the heading splitter emits a section only when the buffer holds a non-heading line, removing the empty-section bug common to such splitters; a stale server-state record is removed without touching any process; and a thirty-line test asserts the documentation still matches the code | Retrieval is mem0ai>=0.1.0 — a floating lower bound
on a 0.1 release, and the dependency is the memory rather than a detail
of it; nothing detects drift between the Markdown source and the seeded
copy, so an edited or deleted paragraph stays retrievable until a
rebuild; and the package holds no status, scope or lifecycle of its own,
so every epistemic decision belongs to the layer beneath or to the host
above |
zerostack |
A Markdown file — the global MEMORY.md, a per-project
SCRATCHPAD.md, project notes, and a daily log per date |
Plain files on disk under a store root, with project-scoped
subdirectories and YYYY-MM-DD.md daily logs |
An injected block of open scratchpad items, the two newest non-empty
daily logs and MEMORY.md under a 32 KB budget;
memory_read by source; memory_search with
literal case-insensitive terms, files ranked MEMORY.md
first and then by distinct terms matched |
memory_write and memory_edit as agent
tools behind the permission checker; the pre-compaction flush appends
the model-written summary to today's log outside it;
/memory for the operator |
An edit without old_str deletes a whole note and is
refused for other targets; long_term and
scratchpad overwrites and edits, and note deletions, copy
the file to a single .bak first; note overwrites and daily
or note edits take no backup; the TUI's /memory editor
empties MEMORY.md before opening it |
A project slug derived from the working directory's full path scopes
scratchpad, notes and daily logs by directory; MEMORY.md is
deliberately global and shared across projects |
Four tools when built with the memory feature, a read-only pair for
subagents, system-prompt guidance, and a /memory command in
the TUI and the headless engine |
No worker. Every compaction appends its summary to today's daily log: /compact on demand, and automatic compaction when compact_enabled is set, off by default | None. A line is in a file or it is not; the injected block is wrapped as reference-only | Atomic write-then-rename, a .bak whose extension keeps
it out of listing and search, truncation-with-warning on oversized
writes, whitespace-normalised dedup on long-term appends, and a context
budget that truncates by priority with markers |
The TUI's /memory editor empties the global
MEMORY.md with no backup; backups are one version deep and
skip note overwrites and daily or note edits; the default permission
mode allows all four tools; appends race across sessions; a
MEMORY.md over 128 KB drops out of injection silently |
Capability index
The matrix above says what each system does. This index answers the other question — which systems actually have X — for the mechanisms that most often decide whether a memory layer is usable. It is generated from the same frontmatter as the matrix, so it cannot drift from the reports.
For the same data as a filterable table of every system against all seven marks, see the capability index; this listing is the narrative version, kept here because the counts are the argument.
Definitions are strict, and a flag is present only where the mechanism was found in code. Near-misses do not count, and the near-misses are frequently the interesting part:
claude-memhas "tombstones" that synchronize row deletion across stores, which is not a rejected-value tombstone.- The tombstones are not equal, and they divide on where the check
runs.
verelandrainboxnormalize the value and refuse the write;memsemalso refuses the write, from a table only a human rejection can populate, leaving its automatic supersession path ungated.daimonrefuses the checkpoint write too, on a canonical form of the text — NFKC-folded, casefolded, whitespace-collapsed, confusables translated.provemkeys on a normalized token subset and suppresses on the read path instead. Casing, spacing and homoglyph substitution defeat neither; a paraphrase defeats Daimon's key, while Provem's token subset still catches the erased term restated inside different surrounding text. mercury-agentgrades confidence three ways but has no discrete state.- Most trust-state systems stop short of the state that matters.
verel,rainbox,gini-agentandmemsemcarry an explicitly rejected state — memsem's as a suppression row a human rejection writes, and a pending/approved/rejected status on the candidate it came from.magic-contextqualifies onstaleandflagged— states that withhold a memory from being trusted — and it is the one system here keeping lifecycle and epistemic state on genuinely separate axes, but it has no rejected state and its own report notes thatflaggedhas no resolution workflow. - The mutation-audit flag is deliberately narrow, and five systems
that look like holders are not.
rainbox'sRetrievalEventandatomic-agent's FIFO-cappedvote_eventsare event tables recording use and feedback — the other half of the append-only memory audit pattern, and valuable, but not a record of what changed.llm-wiki-memory,nanobotandbasic-memoryget an audit trail from git, which is a real mechanism and a different one.hindsightandagentmemorycarry it on named artifacts — Hindsight's insert-onlyaudit_logtable and agentmemory'sKV.auditkeyspace under a written deletion policy. Carrying none of these flags is not the same as being bad:waku-agent's entire design is about doing less on purpose, andmoltisis a corpus-and-index system that never claims to model belief.
Rejected-value tombstone — A durable record of a rejected value, keyed on the value, so later extraction cannot silently re-assert it.
68 of 757: agent-memory-doctrine,
aimee, anda-db, argos, breadcrumbs, cass-memory-system,
caura, daimon, dense-mem, fernme, fireweed-mcp, goodmemory, hippo-memory, hive-mind, inspeximus, loreai, marm-memory, memesh, memmy-agent, memo-local, memoir-cli, memora, memory-compiler, memory-project, memsem, mimir, mira, mnemosyne, musclememory, neoth, nexusmem, no-human, noosphere, nova-ai, omnimem, open-second-brain,
openmake-llm, openzync-core, orbital, ownmem, particles, perseus-vault, plur1bus, project-golem, provem, rainbox, rck, re-call, recallnest, recollect, remem-mcp, repowise, sage-memory, scope-recall-hermes,
shellbrain, skillcorpus, sonder-runtime, sqlite-memory-mcp,
stella, tidemind, titen, universal-memory-engine,
utopia, velantrim-exocortex-crystal,
verel, vir, weknora, wenlan
Explicit trust state — Discrete epistemic status as a field rather than a confidence score, including at least one state that withholds a memory from being treated as true.
193 of 757: a-memory, agent-memory-dotnet,
agent-memory-engine,
agent-mesh, agent-working-memory,
agentdatabase, agentic-context-engine,
agentrecall-x, agentrt, aimee, alphaonedev-ai-memory,
anda-db, animus, archeus, arcon, areev, argos, artesian, aura, autobot-ai, beever-atlas, bitterbot-desktop,
brain-db, bwmem, cass-memory-system,
caura, chitta-field, citra, claudinio-brain, codewiki-plus, cognicore, cogz, context-keeper, core-memory, cortana, cortex-hypermnesia,
counterparts, crystalline, cyrene-agent, daimon, demarkus, dense-mem, deus, dreamgraph, elastic-atlas, eliot-memory-os, elizaos, empirica, engram-alpha, engram-format, engram-mcp, engram-provable, engraphis, fava-trails, feltstate, fernme, fireweed-mcp, flowly, gaius, gbrain, genome, gini-agent, global-agent-memory,
gmeow-ontology, gmr, goodmemory, gortex, guild, harness-evolution,
headroom, hexis, hippo-memory, hungry-hippa, huqan, hypha, icarus, inite-brain, inno-agent, inspeximus, invalidate, kage, kannaka-memory, kimetsu, kipi-system, kirocrew, kleos, klypix-mcp, knowl, knowledge-worker,
llm-wiki-cli, loreai, magic-context, mama, mcp-memory-service,
memcontinuum, memesh, memex, memhtml, memledger, memmy-agent, memorix, memory-garden, memory-industry, memory-palace, memory-ts, memory-vault, memoryops-ai, memorywhale, memseek, memsem, memspec, memvid, mengram, metaclaw, mgi-mind, mind-mem, mindcache, mnemo-cortex, mnemora, monet, muninn, muninndb, musclememory, neoth, neuralmind, no-human, nova-ai, npcpy, octop-memory, oh-my-hermes, omi, omniintelligence,
one-agent-many-hats,
ontofelia, open-graph-memory,
open-second-brain,
openakashic, openmemory, osiris, ostk-recall, ouroboros-agent-os,
ownmem, particles, pensyve, perseus-vault, plur, plur1bus, pluribus, potpie, provem, rainbox, re-call, recall-substrate,
recallweave, recollect, redcell, remem, remem-mcp, rememora, repowise, rexleimo-aios, sage-memory, scope-recall-hermes,
second-brain-cloudflare,
shellbrain, shisad, simplemem, slowave, smriti, somnigraph, sonder-runtime, spector, stash, statewave, stella, stratagate, swarmai, theurian, throughline, tidemind, titen, tokenmizer, truememory, universal-memory-engine,
utopia, velantrim-exocortex-crystal,
veracium, verel, verimem, vir, weave, weknora, yantrikdb-engine
Bi-temporal validity — When a fact was true tracked separately from when the system recorded or expired it.
127 of 757: agent-memory-doctrine,
agent-memory-dotnet,
agent-memory-supabase,
agentdatabase, aimee, anatid, anda-db, areev, argos, automem, basic-memory, brain-db, breadcrumbs, bwmem, caura, claude-total-memory,
claudinio-brain,
clawmem, compartment, core-memory, core-redplanet, cortex-hub, cortexdb, crystalline, daem0n-mcp, dense-mem, elastic-atlas, elizaos, engram-alpha, engram-provable, engraphis, feltstate, fidelis, fireweed-mcp, flowly, gbrain, genome, gini-agent, goodmemory, graphiti, hexis, hippo-memory, inite-brain, inspeximus, janus-graph, kannaka-memory, kimetsu, knowl, lerim, linggen-memory, llm-wiki-cli, lobu, local-memory-mcp,
loreweave, m3-memory, magicore, mama, mastra-observational-memory,
memhtml, memini, memo-local, memoose, memory-engine, memory-lancedb-pro,
mempalace, mempalace-code, memsem, memspec, memtomem, memv, memvid, mentedb, mentisdb, midas, mimir, mindreader, mnemopi, mnemora, mnemosyne, mnesio, mnestic, muninndb, neo4j-agent-memory,
neurakeep, nexusmem, nodedb, nornicdb, nougenshards, obsidian-wiki, omega-memory, openmemory, openzync-core, ostk-recall, perseus-vault, plur, plur1bus, pluribus, potpie, provem, re-call, recollect, remem, remembra, rexleimo-aios, scope-recall-hermes,
semantica, signetai, smriti, sonder-runtime, spector, sqlite-memory-mcp,
statewave, superlocalmemory,
temvera, theurian, tigerless-agent-memory,
titen, utopia, verel, verimem, vestige, virtual-context, vortx-emem, waggle, wax, xerj, yantrikdb-engine
Scope enforced in retrieval — A stored scope key (user, project, agent, tenant) applied as a filter on the read path, not merely available as a tag. This certifies that the key reaches the query — not that the boundary is authenticated, nor that a caller cannot widen it by passing a different argument.
318 of 757: a-memory, acontext, adk-python, agent-framework, agent-memory-doctrine,
agent-memory-dotnet,
agent-memory-engine,
agent-memory-supabase,
agent-memory-techniques,
agent-memoryforge,
agentos-framerslab,
agentrecall-x, agentswarms, agno, ai-agent-automation,
ai-maestro, aidememo, aimee, aipass, akb, alma-memory, anatid, anda-brain, anda-db, animus, anything-llm, arcon, arcrift, areev, argo, argos, artesian, aukora-kernel, autobot-ai, basic-memory, beever-atlas, beevibe, brain-db, breadcrumbs, browsentic, buzz, bwmem, bytechef, caura, citra, claude-mem, claude-self-reflect,
claude-total-memory,
codemem, cognee, cognee-rs, cognicore, cognis, commonground, compartment, context-keeper, context-mode, contextmeld, contextstream-mcp,
core-memory, core-redplanet, cortana, cortex-hub, cortexes, cowagent, crewai, crystalline, cyrene-agent, deepcode, deepseek-harness,
deer-flow, demarkus, dense-mem, dsh-ai-memory, ecc, echo-agent, elai, elastic-atlas, elephantasm-core,
elizaos, empirica, empryo, engram, engram-cognitive,
engram-provable,
engraphis, everos, evox-genesis, exomem, fava-trails, fidelis, flair, forgetful, gambletan-cortex,
gbrain, genome, gini-agent, gobii, goodmemory, gortex, graqle, grok-build, halofy, hatchdoor, headroom, hermes-fleet-memory,
hindsight, hippo-memory, hivemind, hivemind-activeloop,
honcho, hungry-hippa, huqan, hyperconsciousness,
hypha, inite-brain, intaris, invalidate, kagura-memory-cloud,
khoj, kirocrew, kiwi-mem, kleos, knowl, kube-coder, langmem, leankg, lerim, letta, lindahaviv-second-brain,
linggen-memory, lint-ai, livingfeed, llm-wiki-memory, lobu, local-memory-mcp,
loreai, lorekit, m-flow, m3-memory, magic-context, magicore, mama, mandalore, marm-memory, mastra-observational-memory,
mateclaw, mcp-memory, mem0, memanto, membase, membrane, memento, memento-brain, memesh, memhop, memmachine, memobase, memoir, memoir-cli, memori, memorix, memorizer, memory-engine, memory-lancedb-pro,
memory-vault, memorybear, memoryops-ai, memos, mempalace, mempalace-code, memseek, memsem, memspec, memtomem, memv, mengram, mentedb, merchantbench, metaclaw, midas, mimir, mind-mem, mindcache, mindmemos, mindreader, minta, mira, mirix, mnemora, mnemory, mnemosyne, mnesio, mobius, moltbrain, monet, muninn, muninndb, musclememory, muse-brain, mushroomdb, nanoclaw, neko, neo-agent-brain, neo4j-agent-memory,
neurakeep, neuron, nexusmem, no-human, nocturne-memory, nodedb, nooa-memory, noosphere, nornicdb, obelyth-cortex, obsidian-mind, octobrain, octop-memory, octopoda-os, omega-memory, omi, omnimem, ontofelia, open-graph-memory,
open-second-brain,
open-webui, openclaw, opencode-mem, opencompany, openexecutive, openhands-sdk, openlore, openmake-llm, openmemory, openviking, openworker, openyak, openzync-core, origintrail-dkg, ostk-recall, ouroboros-agent-os,
outworked, paperclip, papez, pensyve, people-context, perseus-vault, pltm-claude, plur, plur1bus, potpie, powermem, prime-agent, prism-coder, pro-workflow, provem, pydantic-ai-harness,
ragflow, re-call, recollect, redcell, rekal, remem, remem-mcp, remembra, rexleimo-aios, runar-forge, rushdb, sage-memory, sage-novelty-gate,
scope-recall-hermes,
second-brain-cloudflare,
serena, shellbrain, shisad, sibyl-memory, signetai, simplemem, slowave, smythos-sre, sqlite-memory-mcp,
stash, statewave, strands-agents, stratagate, superlocalmemory,
supermemory, synapse-layer, tanglies-agentos,
teamai-cli, telemem, tencentdb-agent-memory,
theurian, tigrimosr, titen, token-optimizer, token-savior, tokenmizer, tree-ring-memory,
trueforge, ultracontext, universal-memory-engine,
usememos, uteke, utopia, veracium, verel, vllm-semantic-router,
waggle, weknora, windieos, yacmemo, yantrik-mind, yantrikdb, yantrikdb-hermes-plugin,
yesmem, yourmemory, zep
Append-only mutation audit — A named append-only event record of memory mutations in the system's own store. Logs of retrieval or feedback are the other half of the pattern and do not count here, nor does git history.
256 of 757: a-memory, agent-context-os,
agent-memory-doctrine,
agent-memory-techniques,
agent-memoryforge,
agent-mesh, agentdatabase, agentmemory, aidememo, aimee, akb, alma-memory, alphaonedev-ai-memory,
anatid, anda-db, animus, anolisa-agent-memory,
arcon, areev, argos, artesian, attune-ai, aukora-kernel, aura, autobot-ai, basemode, bitterbot-desktop,
brain-db, brain-mcp, brain-md, brainapi, breadcrumbs, bwmem, byterover, cambium, cashew, caura, citra, claude-mem, claude-self-reflect,
clawmem, cognee, commonground, compartment, core-memory, cortex-engine, cortexdb, counterparts, csm, ctx, cyrene-agent, daem0n-mcp, daimon, deepcode, dense-mem, dreamgraph, dsh-continual-harness,
dsh-mneme, echo-agent, edda, elai, elephantasm-core,
empirica, engram-alpha, engram-cognitive,
engram-provable,
engraphis, exomem, feltstate, fernme, fireweed-mcp, flowly, forgetful, genome, global-agent-memory,
gmeow-ontology, gmr, gomaa, graft, graphnosis, graqle, graymatter, habitus-ai, halofy, harness-evolution,
hexis, hindsight, hippo-memory, hive-mind, holo-invariant, humans, huqan, hy-memory, hyperconsciousness,
iai-pme, icarus, inspeximus, invalidate, jumbo, kaeru, kagura-memory-cloud,
ken, kimetsu, kirocrew, kleos, knowl, knowledge-worker,
kube-coder, leteo, lethe, llm-wiki-cli, lobu, lorekit, loreweave, lossless-context-mcp,
m3-memory, magic-context, magicore, mainline, maka, mama, mandalore, mastra-observational-memory,
mcp-memory, megamemory, mem0, membrane, memcontinuum, memledger, memmy-agent, memo-local, memoir, memoir-cli, memoose, memora, memory-engine, memory-project, memorybear, memoryops-ai, mempalace, memseek, memsem, memspec, memvid, mentisdb, merchantbench, metaclaw, mex, mgi-mind, midas, mimir, mind-mem, mindreader, minta, mnemo-cortex, mnemon, mnemory, mnemosyne, mnemosyne-nabzx, mnesio, mnestic, monet, munder-difflin, muninndb, musclememory, mushroomdb, neko, neurakeep, neuralmind, nexusmem, no-human, noosphere, nornicdb, nougenshards, nova-ai, obsidian-mind, octop-memory, octopoda-os, okf-agent-memory,
omega-memory, omi, omniintelligence,
open-second-brain,
openkb, openlore, openmake-llm, openmemory, openvurp, openworker, openzync-core, optmem, orbital, osiris, ostk-recall, ouroboros-agent-os,
ownmem, palazzo, paperclip, particles, perseus-vault, plur, plur1bus, potpie, prime-agent, provem, re-call, recallnest, recallweave, recollect, remembra, rememora, repowise, rexleimo-aios, sage-memory, sage-novelty-gate,
scope-recall-hermes,
selvedge, semantica, shellbrain, shisad, shodh-memory, signetai, simplemem, smriti, somnigraph, sonder-runtime, soul-of-waifu, sqlite-memory-mcp,
state-memory-mcp,
stella, superlocalmemory,
temvera, tencentdb-agent-memory,
theurian, tidemind, titen, tokenmizer, trueforge, ultracontext, universal-memory-engine,
utopia, velantrim-exocortex-crystal,
veracium, verel, verimem, vestige, vibe-cognition, virtual-context, vortx-emem, wax, weave, widemem-ai, xerj, yantrikdb, yantrikdb-engine,
yourmemory
Human review surface — A place where a person inspects, approves, or adjudicates memory content before or after it takes effect.
96 of 757: agent-mesh, aimee, argos, auto-company, breadcrumbs, brigade, browsentic, byterover, caura, citra, cortex, craft, crystalline, ctx, daimon, deus, engram-provable, engraphis, evox-genesis, fava-trails, feltstate, flowly, gbrain, goodmemory, graphnosis, halofy, hermes-agent, hestia, huqan, intaris, invalidate, kage, khabeer, kirocrew, knowledge-worker,
lerim, llm-wiki-memory, lobu, loreai, marm-memory, memesh, memex, memorix, memory-compiler, memory-garden, memory-palace, memory-project, memoryops-ai, memorywhale, memseek, memspec, mimir, mind-mem, mnemory, muninn, musclememory, no-human, nova-ai, obelyth-cortex, octop-memory, oh-my-hermes, one-agent-many-hats,
openkb, openvurp, orbital, ownmem, particles, perseus-vault, provem, qwen-code, rainbox, re-call, reasonix, recollect, remem, repowise, risuai, sage-memory, scope-recall-hermes,
second-me, shisad, sibyl-memory, sonder-runtime, stella, swarmai, the-librarian, tigrimosr, universal-memory-engine,
utopia, velantrim-exocortex-crystal,
veracium, verel, vir, voyager, weknora, yacmemo
Negative retrieval assertion — Committed evaluation cases asserting that particular material must not be retrieved.
486 of 757: 7layermem, a-memory, adk-python, aeris, agent-afk, agent-context-os,
agent-memory-doctrine,
agent-memory-dotnet,
agent-memory-engine,
agent-memory-mcp,
agent-memoryforge,
agent-working-memory,
agentdatabase, agentic-context-engine,
agentmemory, agentmemory-markdown,
agentos-framerslab,
agentrt, agents-memory, agno, ai-agent-automation,
ai-brain-starter,
ai-memory, aidememo, aigent-os, aimee, alphaonedev-ai-memory,
altk-evolve, anatid, anda-brain, anda-db, animus, anolisa-agent-memory,
archeus, arcon, arcrift, areev, argo, argos, artesian, athena, atomic-agent, attune-ai, aukora-kernel, aurora, autobot-ai, autoharness, automem, basemode, beads, beever-atlas, bitterbot-desktop,
brain-db, brain-mcp, brain-md, brainapi, breadcrumbs, brigade, byterover, cashew, cass-memory-system,
caura, chitta-field, chump, cindy, citra, claude-engram-mlapeter,
claude-mem, claude-mem-lite, claude-total-memory,
claudinio-brain,
clawmem, clio, codewiki-plus, codex-dev-mcp-suite,
cognee, cognee-rs, cognis, cogz, compartment, context-engineering,
context-keeper, context-mode, contextdb, contextmeld, core-memory, cortana, cortexdb, cortexes, cortexgraph, counterparts, create-context-graph,
crewai, crystalline, csm, ctx-open, cyrene-agent, daimon, deepcode, deepseek-harness,
deja-vu, demarkus, dense-mem, diffmem, distill-kura, dsh-ai-memory, dsh-auto-memory, dsh-continual-harness,
dsh-layered-memory,
dsh-mneme, dsh-mnemon, ean-agentos, ecc, echo-agent, egc, elai, elastic-atlas, elizaos, emem, engram-alpha, engram-cognitive,
engram-mcp, engram-nickcirv, engraphis, enquire-mcp, everos, exomem, fava-trails, feltstate, fernme, fidelis, fireweed-mcp, flair, flatbread, flowly, forgetful, gaius, gambletan-cortex,
gbrain, genome, gh-aw, gini-agent, gitmem, global-agent-memory,
gmeow-ontology, gmr, gomaa, goodai-ltm, goodmemory, gortex, graft, graphify, graphnosis, graqle, graymatter, grok-build, guild, halofy, hatchdoor, heimdall, helix-agi, helm, hermes-agent, hestia, hillock, hindsight, hippo-memory, hipporag, hive-mind, hivemind, hivemind-activeloop,
holo-invariant, holomem, honcho, humans, huqan, hy-memory, hyperconsciousness,
hypha, iai-pme, icarus, inite-brain, inno-agent, inspeximus, invalidate, joplin, jumbo, kaeru, kage, kagura-memory-cloud,
kannaka-memory, kektordb, ken, kept, kglite, khoj, kimetsu, kipi-system, kirocrew, kleos, klypix-mcp, knowl, kube-coder, langgraph, leankg, lemmalog, lerim, leteo, lethe, letta, levh, lindahaviv-second-brain,
linggen-memory, lint-ai, llm-wiki-cli, lobu, local-memory-mcp,
longterm-memory-mcp,
loreai, loreweave, lossless-context-mcp,
m-flow, m3-memory, magicore, mainline, maka, mama, mandalore, marm-memory, mastra-observational-memory,
mateclaw, matrix-os, mcp-context-server,
mcp-memory-service,
megamemory, membrane, membukkit, memcontinuum, memesh, memex, memex-zettel, memhop, memhtml, memini, memledger, memmachine, memmy-agent, memo-local, memoir-cli, memoket-kite, memoose, memora, memora-engine, memorax-code, memori, memorix, memorizer, memory-compiler, memory-engine, memory-garden, memory-industry, memory-lancedb-pro,
memory-project, memory-vault, memoryops-ai, memorywhale, mempalace, mempalace-code, memseek, memsem, memspec, memtomem, memu, memv, memvid, mentedb, mentisdb, merchantbench, metaclaw, mex, mgi-mind, midas, mimir, mind, mind-mem, mindmemos, minta, mira, mirix, mnemo, mnemo-cortex, mnemon, mnemonic, mnemopi, mnemora, mnemos, mnemosyne, mnemosyne-nabzx, mnestic, monet, moth-memory-template,
muninn, muninndb, musclememory, muse-brain, mushroomdb, nano-brain, nanoclaw, neko, neo-agent-brain, neoth, neurakeep, neuralmind, neuron, neurostack, nexusmem, no-human, nodedb, nooa-memory, nougenshards, nova-ai, obelyth-cortex, obsidian-mind, obsidian-wiki, octop-memory, oh-my-hermes, omegaclaw-core, omi, omniclaude, omniintelligence,
omnimem, one-agent-many-hats,
ontofelia, open-cowork, open-graph-memory,
open-second-brain,
openakashic, opencode-mem, opencode-session-recall,
opencompany, openexecutive, openhuman, openlore, openmasq, opensre, openvurp, openwolf, openworker, openzync-core, orbital, orgtree, ori-mnemos, origintrail-dkg, osiris, osk-system, otis, ouroboros-agent-os,
ownmem, papez, particles, pensyve, people-context, perseus-vault, pi-jarvis, pi-memory, plur, plur1bus, pluribus, pmb, pond, portable-handoff,
potpie, prime-agent, prism-coder, prismer-cloud, pro-long, projectmem, provem, pydantic-ai-harness,
qwen-code, qwen-mm-plugins, ragflow, rainbox, rck, re-call, reasonix, recall-substrate,
recallnest, recallweave, recollect, redcell, redis-agent-memory-server,
rekal, reme, remem, remem-mcp, remembra, rememora, reporecall, repowise, rexleimo-aios, rightmemory, ripwire, roampal-core, ruflo, rushdb, rust-self-learning-memory,
sage-memory, scope-recall-hermes,
second-brain-cloudflare,
selmem, selvedge, semantica, session-recall, shellbrain, shisad, sibyl-memory, signetai, skillcorpus, slowave, smriti, smythos-sre, sonder-runtime, spector, sqlite-memory-mcp,
statewave, stella, strands-agents, stratagate, sugar, swarmai, synapse-hippocampus,
synapse-layer, task-orchestrator,
teamai-cli, tempomem, temvera, the-librarian, theurian, thoughtdag, throughline, tideline-memory, tidemind, tigerless-agent-memory,
token-optimizer,
token-savior, tokenmizer, tracedecay, tree-ring-memory,
trueforge, truememory, tycho, ulpia, ultracontext, universal-memory-engine,
usememos, uteke, utopia, velantrim-exocortex-crystal,
velesdb, veracium, verel, verimem, vibe-cognition, vir, virtual-context, vllm-semantic-router,
vortx-emem, waggle, wax, weknora, wenlan, widemem-ai, windie-sandbox, windvane, wordcell, xerj, yacmemo, yantrik-mind, yantrik-os, yantrikdb-engine,
yantrikdb-hermes-plugin,
yantrikdb-mcp, yesmem, zer0dex, zerostack
Three observations follow from the counts, stated no more strongly than the counts support.
Read-path scoping is common; correction is not. Finding 3 above counts the systems that filter reads by a scope key and finding 1 those that keep a value-level tombstone; the distance between those two numbers is the shape of the corpus. That is not the same as saying scope is solved — this flag measures the read path only. It says nothing about write authorization, whether background consolidation respects the same boundary, whether cache and embedding keys include it, or whether deletion reaches every scoped copy. A summary that spans two projects has crossed a boundary the retriever would have enforced, and nothing here measures that.
Trust is usually a number, not a state, which collapses "how sure am I" into "how findable is this" — see decay and reinforcement.
Negative evidence is almost never tested. 486 repositories of 757 assert that particular material must not be retrieved — the assertion every scope, deletion and correction claim in this document ultimately rests on. Read together rather than one at a time, they split cleanly in two, and the split says more than the count.
Five assert a boundary: that a principal cannot
retrieve another principal's material. MIRIX's test_filter_tags_db.py
creates a memory under one scope, searches under another, and asserts
the id is absent. Aukora Kernel
does it better — an unrelated principal reads ok: false, a
subject whose delegation manifest was revoked reads
ok: false, and the owner reads "the secret" in
the same block, so the denial is proved targeted rather than a
blanket failure. EverOS does it at the
endpoint: two owners, the same query string,
assert c_ids.isdisjoint(m_ids) plus a positive control on
each side, repeated for two agent owners sharing a keyword. CrewAI does it over a path hierarchy:
three records written under /other/scope,
/crew/crew-a/inner and /crew/crew-b/inner, a
Memory opened with root_scope="/crew/crew-a",
and an assertion that recall returns exactly one result and it is the
rooted one — a boundary test with its own positive control in the same
three lines. CSM asserts the degenerate
case the other four leave implicit: searchMemories called
in project mode with no project id must return [],
with the assertion message spelling out the intent — "project mode
without a project ID must fail closed". Cheap, and it is the branch
a refactor is most likely to turn into an unscoped table scan.
All five of those systems also hold scope_enforced.
Their negative suites are therefore tests of a capability the
same system already claims — which is worth having, and is not
evidence about deletion or correction.
Ten assert about content: that particular material
must not surface to anyone entitled to search, regardless of who is
asking. open-cowork's service
tests assert that a session deleted while its extraction is queued
leaves nothing searchable; its forbiddenHits eval field,
which would name what a query must not return, is populated by no
committed case. Verel's
tests/test_memory_negative_eval.py asserts a REJECTED fact
is invisible to every recall path — a suite built from the red-team
finding that produced its tombstone. Project
N.E.K.O.'s test_hard_filter_drops_negative_score
asserts that an entry the user disputed is dropped before the
rerank, the docstring giving the reason: "Stage-2 would either
reinforce the dispute or, worse, cancel it." Helm's supersede case asserts a replaced
value no longer appears, agent-afk's
it('excludes superseded facts from search') asserts the
same about its FTS path, and Agno's
test_entity_supersession.py does it against a judged
verdict — a retired fact absent from live_facts() while
both rows remain in the record. The Pydantic AI Harness asserts
it about the prompt:
test_delete_existing_is_content_free requires the deleted
body to be absent from the tool result, one search test requires
all('secret' not in repr(match)) under a character budget,
and two injection tests require a superseded line and a stale fact from
an earlier history not to appear in the captured model context. That is
the assertion aimed at where the damage happens rather than at where the
row lives. Graphify adds the cheapest
version of the shape and one nobody else has:
test_negative_only_node_absent_from_sources asserts that a
source cited only by answers marked dead_end appears in
none of the three lesson lists — a source that failed rather
than a value that was rejected, which is a different object and
the one a coding agent actually wastes time on.
Only these ten probe the question the atlas is actually asking. A boundary test proves the filter works; a content test proves a value that was rejected, disputed or forbidden stays gone. 12 of 757 is the real figure for the second kind, and the two newest are the cheap version of it: a superseded value is easy to assert about, because the row is still there to filter on. The expensive assertion is that a value the system destroyed does not come back.
Two further things the joint reading shows. The positive control — asserting that the denial is targeted rather than an empty result — appears in Aukora and EverOS and is absent from the rest, and a negative test without one passes just as well when retrieval is broken. And the assertion shape is reachable from ordinary engineering practice: three of the six arrived from access-control work rather than from memory research, and one, N.E.K.O., from a companion app where re-raising something the user asked you to drop is a product failure rather than a data-quality one.
Daimon writes the expensive
assertion down.
test_forgotten_value_stays_gone_across_reassertion forgets
a value, re-extracts the same sentence, and asserts it stays out of the
checkpoint on disk, the rendered brief and the recall rows, each
negative paired with a never-forgotten twin that matches the same
keyword (plugin/tests/test_forget_reassertion_e2e.py). Its
docstring says it was written to fail against the code before the write
consulted the forget ledger. The tombstone is the mechanism most in need
of a negative test, because nothing fails visibly when it silently stops
working.