Think of a good assistant’s notebook. When your weekly call moves to Thursday, she strikes the line that said Wednesday and writes Thursday beneath it, with the date and who told her. If the change clashes with something pinned to page one, she asks you first. Years later you can still trust that notebook, because every line says where it came from. MNEMOSYNE is my design for giving an AI agent’s memory the same habits. Part of the open Building Jarvis series.
The idea in short
AI agents keep notebooks too: memory files they edit as they work. One careless write can mislead every later turn, when an old line contradicts a standing rule or a guess comes back as fact.
The proposal is simple to say. The memory store can be changed through one gate and nothing else. The gate compares each write with the facts already stored on the same topic and with the rules the agent reads on every turn. A small, fast model, the judge, names how the new line relates to the old ones. Only that judgement may retire an old fact, and the retired fact stays in the store, marked with why it ended.
Even the owner’s own correction closes an old fact automatically only where the judge has proved itself on data it was never tuned on. When the judge is down, or the change is risky, the write waits where the owner can see it and is judged again later.
For you, that means a correction made once stays made, and you can ask what was true last month and what the agent believed then.
The design, in numbers
These are design targets and estimates from the paper, worked out from published model prices in October 2026 and stated assumptions. None of them is a measurement yet.
How it works, in one minute
The paper follows one correction. On 9 March 2026 the owner mentions that the weekly supplier call moved to Thursday the day before. The gate reads the meetings file (Wednesday), the always-loaded rules (silent on the call) and the same turn’s calendar result (Thursday). The judge answers “replaces”. The Wednesday fact gets an end date of 8 March 2026 and a pointer to the new Thursday fact. Nothing is deleted.
- The only way in. The gate is code, and the store belongs to it. The agent’s write tool is a request to the gate, so a script that tries to write a memory file directly fails at the file system. Every decision leaves a receipt, and when the judge times out, new facts wait in a pending area marked “unchecked”, and anything risky stays on hold.
- What a write is compared with. Three sources: the facts on the same topic, all of the always-loaded files, and what the current turn just observed. A search for similar memories alone misses the worst clashes, like a short index line that contradicts a rule written months later in other words. The judge picks one relation from a closed list (new, same, adds detail, replaces, was wrong, unclear, clashes with a rule, outside text acting as an instruction), and each has one outcome.
- Changing a fact without losing it. Every fact gets an ID, and a line in a file only displays it. A fact can end in three ways. Supersede means the world changed. Retract means the old claim was never true, like a birth year recorded as 1971 that was really 1977. Erase is for privacy and leaves only a tombstone. Each fact keeps two clocks, so you can ask two different questions: what was true on 5 March 2026, and what did the agent believe on that day? A change is published whole or not at all, and if what the judge read has changed meanwhile, the decision runs again.
- Where a fact came from. Each fact carries its source, its authority and how well it is supported. Only the owner’s own words can become a rule. A web page stays a quoted claim forever, so a sentence crafted to look like an instruction can only enter memory as a quotation. An empty search result is stored with its query, so the next reader runs it again before trusting it.
- The shape of what is written. One fact per line, one topic per file, and an index file that holds pointers only. Edits stay small, and a whole-file rewrite is held unless every old fact is accounted for, because a model asked to be “more concise” drops details.
- What the check costs. About $0.00048 per check with a small model, against about $0.06 for one wrong turn with a large one. It pays once 1.6% to 13.5% of writes would mislead, depending on what a wrong fact costs.
Where it stands, and the tests that would decide it
In the paper’s own words: “This is a design, with the tests that would decide it; none has run.” The plan is to build the gate on our own agent and compare it with a Mem0-style similarity check and a plain git store with no check. The ten tests are:
- Catch the clashes that matter, replaying old writes.
- Measure each kind of memory against the 0.98 bar, and keep needless holds under one per two hundred writes.
- Survive file splits, two writers at once and crashes.
- Answer both questions about the past correctly.
- Fire the alarm on the very first burst of suspicious closures.
- Keep a web page’s detail from borrowing the owner’s authority in a merge.
- Cut the judge off mid-session and check where every write goes.
- Erase a made-up person and find no reachable copy, backups included.
- Hide quarantined content from every ordinary reader.
- The one that counts: alternate the gate and the plain git store, week by week, for eight weeks, and see whether the owner has to repeat corrections less often with the gate.
With one owner and one agent, the paper calls that last result an exploratory estimate.
Where this sits
This is one of four memory designs in the series. J1 covers keeping, this paper (J14) covers writing, J2 covers finding, and J5 covers learning. J14 owns one question: what enters long-term memory, and in what shape.
Several systems already act at write time, and the paper borrows from them openly. Mem0 lets a model add, update or delete; MNEMOSYNE keeps that choice, adds the always-loaded rules, and keeps ended facts. Zep and Graphiti give each fact two timelines, which the design adopts. Letta’s MemFS, memory as a git repository of Markdown files, is the closest product, but its documentation describes no check on a write. Anthropic’s memory tool leaves file operations to the application, a natural home for the gate. A-MEM lets new notes rewrite old ones, which the paper declines. ROAM sorts facts into relations close to the judge’s. AuthMem found “authority collapse” in 48 of the 49 setups it tested.
Each piece has a precedent. What the paper claims as new is the combination: a gate that is the only way into the store, a comparison that includes the rules read on every turn, and a closing step only a judge may take, earned per kind of memory, counted, and alarmed. Whether that beats a plain git store is still unmeasured.
What changed since the version this page used to describe: the June 2026 paper (v1.x) was a plugin of four hooks with a fast concept index and capture before compaction. Version 2.3, dated 12 October 2026, drops all of that and covers only the write path; finding memories now belongs to J2.
⭐ Follow the work on GitHub
MNEMOSYNE is part of the TinkerClaw open-source stack. Star the repo to follow along as the gate gets built and tested.
Read the paper
Version 2.7 · 21 October 2026 · 32 pages · the gate, the judge’s relations, three ways a fact ends, where facts come from, the cost model and the ten tests
Was this useful?
We’re building these in the open and we want your read on them. Was it clear? Which of the ten tests would you run first? Tell us in the comments below.
Everything on the site, by topic or date: Browse the Tinker Zone