Version: 2.0 — Deep Research Edition
Date: 2026-05-10
Scope: Self-learning agent memory — architecture, algorithms, edge cases, unsolved problems, production engineering, research frontier
- First-Principles Foundation
- What Your Original Blueprint Got Right
- Critical Gaps — What Was Missing
- Memory Edge Cases Catalog
- Complete Bottleneck Resolution
- Architecture: DeltaCore v2 — Full System Design
- Novel Algorithm Approaches
- Exception Handling Methodology
- Adversarial Memory & Security Model
- Multi-Agent Memory Coordination
- GDPR & Machine Unlearning
- Sleep-Cycle Consolidation Engine
- Unsolved Problems & Research Frontier
- Complete Data Model
- Full API Specification
- Production Failure Modes & Recovery
- Testing & Evaluation Strategy
- Cost & Scale Governance (Extended)
- Implementation Roadmap
- Research Papers & Resources
| Requirement | Naive Approach | Right Approach |
|---|---|---|
| Compress raw experience | Store raw logs | Causal-delta tracking: what changed + why |
| Retrieve relevant context | Semantic similarity search | Multi-index: semantic + temporal + causal + utility |
| Update without forgetting | Append-only log | Schema versioning + delta provenance chains |
| Generalize patterns | Hope embeddings cluster | Explicit schema extraction from redundant deltas |
| Forget noise automatically | Manual pruning | Utility decay + retrieval miss tracking |
| Cost-balance in real time | Ignore cost | Governor: budget enforcement + auto-scaling |
| Resist adversarial inputs | Trust all writes | Trust-scored writes + sanitization pipeline |
| Comply with regulations | Ignore | Verifiable machine unlearning layer |
| Handle partial observations | Assume full state | Belief-state memory with probabilistic tracking |
| Survive multi-agent conflicts | Last-write-wins | Byzantine-tolerant consensus with provenance |
Agents don't need to remember everything. They need to remember:
- What changed — causal delta tracking
- Why it mattered — utility scoring with context
- How it improved decisions — schema evolution with outcome linkage
- What to distrust — adversarial signal detection
- What to forget legally — unlearning with verifiable erasure
- What is uncertain — belief-state tracking over partial observations
This shifts memory from raw embedding dumps to a causally-indexed, utility-driven, adversarially-resilient, compliance-aware knowledge fabric.
Your v1 design correctly identified:
- 6-layer tiered architecture (Ingest → Extract → Store → Consolidate → Retrieve → Govern)
- Causal delta extraction as the right abstraction over raw logs
- HOT/WARM/COLD tiering with correct latency targets
- Utility decay as the primary pruning signal
- Schema abstraction over raw text retrieval
- Cost governance as a first-class concern
- Multi-agent provenance IDs for conflict resolution
- No fine-tuning required — memory-layer adaptation
- Arrow + Parquet + Qdrant + DuckDB as a solid tech stack
These are correct. The v2 design preserves and extends all of them.
| Gap | Why It Matters | Solution in v2 |
|---|---|---|
| No adversarial memory model | AGENTPOISON achieves 82% retrieval success at <0.1% poison ratio | Trust-Scored Write Pipeline + Memory Sanitizer |
| No belief-state tracking | Agents operate in POMDPs; deterministic memory is wrong | Probabilistic Belief Memory Module |
| No temporal contradiction resolution | New facts conflict with old; agent oscillates | Temporal Versioning + Contradiction Detector |
| No machine unlearning layer | GDPR Article 17 requires verifiable erasure | Forget API with Membership Inference Auditing |
| No cold-start protocol | Zero history = zero schemas; agent is blind at launch | Meta-schema bootstrap + transfer from domain priors |
| No Byzantine fault tolerance | Malicious agents corrupt shared memory | CP-WBFT consensus for multi-agent writes |
| No semantic drift detection | Vector index ages poorly; retrieval quality degrades silently | Drift Monitor + Periodic Re-embedding Pipeline |
| No sleep-cycle consolidation | Continuous consolidation competes with hot-path queries | NREM/REM-phase offline consolidation model |
| No schema drift handling | External tool APIs change; stored tool-use patterns break | Schema Validator + Version Pinning |
| No write amplification control | Tiered migration writes data 3-4× | Copy-on-write delta compression |
| No memory under distribution shift | World changes; agent's beliefs become stale | Temporal decay + staleness detection + refresh triggers |
| No compositionality layer | Cannot combine stored patterns for novel situations | Compositional Schema Algebra |
| No exception taxonomy | Failures were undifferentiated | 9-class exception taxonomy with recovery playbooks |
What happens: Agent learns "user prefers Python" (t=0). Later learns "user switched to Go" (t=100). Old schema still fires on Python preference.
Failure mode: Agent gives Python answers to Go questions. Confidence score appears normal because the schema is high-utility (historically accurate).
Detection:
ConflictDetector.check(new_delta) →
Find existing schemas where subject matches AND predicate matches AND object differs
If found: flag as TEMPORAL_CONTRADICTION
Score by: recency_weight(new) vs. utility_score(old)
Resolution strategy:
- If new delta confidence > 0.8 AND recency < 7 days: supersede old schema
- If confidence < 0.8: store both with belief weights, await confirmation
- Log the contradiction event; surface to agent for explicit resolution if ambiguity persists
- Never silently drop old schema — archive to COLD with
superseded_bypointer
What happens: "deploy the app" and "ship the service" hash to similar embeddings but refer to different deployment targets. Semantic similarity returns wrong context.
Failure mode: Agent deploys to staging when user meant production. High retrieval confidence, wrong outcome.
Detection:
- During ingestion, compute canonical entity hash AND context-window hash
- Flag pairs where
semantic_sim > 0.92butcontext_hash_distance > 0.4→ aliasing candidate - Require disambiguation tag on all high-similarity pairs
Resolution:
struct AliasGroup {
canonical_id: EntityId,
alias_ids: Vec<EntityId>,
disambiguation_keys: Vec<String>, // e.g., ["production", "staging"]
last_resolved: Timestamp,
}What happens: Agent has schema "use tool X with param api_key". Tool X updates to require bearer_token. Schema fires successfully at retrieval but fails at execution.
Failure mode: Silent execution failure. Memory reports high-confidence result; tool call fails at runtime.
Detection:
- Attach
tool_schema_versionto every delta referencing an external tool - On every tool call: validate current tool schema hash against stored schema hash
- On mismatch: flag
SCHEMA_DRIFT, demote delta utility, trigger schema refresh
Resolution:
SchemaValidator.on_tool_call(tool_id, params) →
current_schema = ToolRegistry.fetch_schema(tool_id)
stored_schema = delta.tool_schema_ref
if hash(current_schema) != hash(stored_schema):
emit SCHEMA_DRIFT event
invalidate affected deltas
attempt auto-migration via param mapping rules
if auto-migration fails: route to human-in-loop
What happens: Agent takes 50 sequential actions in a long-horizon task. Only gets success/fail signal at the end. Cannot assign credit to individual decisions.
Failure mode: All 50 actions get the same utility score (pass or fail). Good sub-decisions get pruned; bad ones get reinforced.
Resolution — Temporal Credit Assignment:
- Temporal decay weighting: Actions closer to outcome receive higher credit fraction
- Causal intervention tagging: During execution, tag which actions were causally necessary (could not skip)
- Counterfactual simulation: For failed runs, replay with random action substitution at each step; measure outcome change → proxy credit score
- TAR² redistribution: Redistribute terminal reward backward through causal chain with exponential decay
credit(t) = reward * exp(-λ * (T - t))
What happens: Delta A caused B, B caused C, C caused A. The causal extractor loops forever or assigns infinite credit.
Detection:
def extract_causal_chain(delta_id, visited=None):
visited = visited or set()
if delta_id in visited:
raise CircularCausalChainException(delta_id, visited)
visited.add(delta_id)
...Resolution: On detection, break the cycle at the lowest-utility edge. Log the cycle as a CAUSAL_LOOP event. Store the loop as a first-class pattern — circular dependencies are often a valid pattern (feedback loops in control systems).
What happens: New agent deployment. Zero history. No schemas. No utility scores. Retrieval returns nothing.
Failure modes:
- Agent falls back to base model behavior (ignores memory entirely)
- Consolidation engine has nothing to consolidate → CPU idle
- Cost governor has no baseline → oscillates on first decisions
Resolution — 3-Phase Bootstrap:
Phase 1 (0 events): Domain Prior Injection
- Load pre-built schema bundles for the agent's domain (coding agent, ops agent, etc.)
- These are community-contributed, versioned schema libraries
- Mark all injected schemas as
provenance: PRIOR, confidence: 0.3
Phase 2 (1-100 events): Rapid Utility Calibration
- Every event in this phase gets 2× utility weight (cold-start amplifier)
- Consolidation runs after every 10 events (not the normal 1000-event threshold)
- Schemas formed here are marked
cold_start: trueand get re-evaluated at 1000 events
Phase 3 (100+ events): Normal Operation
- Cold-start amplifier disabled
- Prior-injected schemas compete with learned schemas on equal utility terms
- Low-utility priors are pruned normally
What happens: Agent cannot observe full system state. Memory stores observations, not ground truth. Agent treats stored observations as facts.
Failure mode: Agent "remembers" that a service is running because it observed it 10 minutes ago. Service crashed 2 minutes ago. Agent makes wrong decisions based on stale belief.
Resolution — Belief-State Memory Module:
struct BeliefState {
entity_id: EntityId,
state_distribution: HashMap<State, Probability>,
last_observation_time: Timestamp,
observation_model: ObservationModel, // P(obs | state)
transition_model: TransitionModel, // P(state_t | state_{t-1}, action)
staleness_decay: f64, // probability mass bleeds to UNKNOWN as time passes
}- Every stored fact has a
belief_confidencedecaying over time - Retrieval returns
MemoryPacketwithconfidence: belief.current_confidence(now) - If
confidence < 0.5: agent prompted to re-observe before acting
What happens: The world changes. User's stack evolves. Environment configs change. Agent's schemas reflect the old world.
Detection — Distribution Shift Monitor:
- Maintain a rolling distribution of
(context_features, schema_id)pairs - Compare current 100-event window vs. historical distribution
- KL divergence spike →
DISTRIBUTION_SHIFTevent
Response:
- Promote recent schemas over old schemas in retrieval ranking
- Trigger expedited consolidation of recent events
- Mark old schemas with
reliability: DEGRADEDand increase exploration weight
What happens: Agent runs for months. Old events get summarized. Summaries get summarized. Each compression cycle loses nuance. Eventually the agent's "memory" is a distorted shadow of actual history.
Detection:
- Track
compression_depthon each stored item (how many times has this been summarized?) - Compare reconstructed schema against surviving raw events using semantic similarity
- Flag when
reconstruction_fidelity < 0.7
Resolution:
- Hard limit:
max_compression_depth = 3 - At depth 3: item moves to COLD but is never re-summarized
- Periodic "memory audit" reconstructs key schemas from raw events and checks for drift
- Keep 1% of raw events indefinitely as ground truth anchors
What happens: Malicious input crafted to corrupt agent memory. AGENTPOISON achieves 82% retrieval success with <0.1% poison ratio. Agent's decisions are hijacked by adversarially crafted schemas.
→ Full treatment in Section 9.
What happens: Each tier migration copies data. HOT → WARM → COLD writes the same delta 3 times. At scale, write amplification × 3 destroys storage budget.
Resolution:
- Copy-on-write: tiers share pointer to immutable delta blob
- Tier metadata (access count, last_access, utility) lives in tier-specific index, not in the blob
- Only compress/transform data format on COLD archival (Parquet encoding)
- Result: ~2.1× actual write amplification (blob write once + metadata in each tier)
What happens: Popular concepts (e.g., "write code", "fix bug") cluster all their embeddings in the same index partition. Every query hits that partition. Partition becomes a latency bottleneck.
Detection: Monitor per-partition query rate. Flag partitions with >5× average query rate.
Resolution:
- Hot partition splitting: split into sub-clusters using k-means with forced separation
- Replica hot partitions to multiple nodes
- Admission control: route hot-spot queries to dedicated read replicas
- Quake adaptive indexing (OSDI 2025): real-time re-optimization during continuous insert/delete
| Bottleneck | v1 Solution | v2 Addition |
|---|---|---|
| Context window overflow | Fixed HOT size + schema abstraction | + Infini-Attention compression for context that must stay in-window |
| Retrieval inaccuracy | Multi-index routing + provenance | + Belief confidence scoring + semantic drift detection |
| Unbounded storage growth | Tiered migration + utility decay | + max_compression_depth + cold anchor points |
| Catastrophic forgetting | Schema versioning + delta rollback | + SSR rehearsal + FIT continual unlearning |
| High compute per query | Hybrid routing + cache | + Adaptive indexing (Quake) + hot-spot replica routing |
| Self-learning without retraining | Schema feedback loop | + Policy gradient over schema utility scores |
| Multi-agent conflicts | Provenance + timestamp ordering | + CP-WBFT consensus + Byzantine fault isolation |
| Cold start | (missing in v1) | Meta-schema bootstrap + domain prior injection |
| Adversarial poisoning | (missing in v1) | Trust-scored writes + AGENTPOISON-style sanitizer |
| Schema drift (external) | (missing in v1) | Tool schema version pinning + auto-migration |
| Temporal contradictions | (missing in v1) | Temporal versioning + conflict resolution policy |
| GDPR compliance | (missing in v1) | Forget API + membership inference auditing |
| Partial observations | (missing in v1) | Belief-state memory module |
| Summarization drift | (missing in v1) | Compression depth limits + fidelity audits |
| Write amplification | (missing in v1) | Copy-on-write pointers + immutable delta blobs |
| Vector index fragmentation | (missing in v1) | LIRE incremental reclustering + Quake adaptive index |
┌─────────────────────────────────────────────────────────────────────────────┐
│ DELTACORE v2 MEMORY FABRIC │
│ │
│ ┌──────────────────────────────────────────────────────────────────────┐ │
│ │ LAYER 0: TRUST GATEWAY │ │
│ │ ┌─────────────┐ ┌──────────────────┐ ┌────────────────────────┐ │ │
│ │ │ Poison │ │ Schema Drift │ │ Rate Limiter + │ │ │
│ │ │ Detector │ │ Validator │ │ Admission Control │ │ │
│ │ └─────────────┘ └──────────────────┘ └────────────────────────┘ │ │
│ └──────────────────────────────────────────────────────────────────────┘ │
│ │ │ │ │
│ ▼ ▼ ▼ │
│ ┌──────────────────────────────────────────────────────────────────────┐ │
│ │ LAYER 1: EVENT INGESTION │ │
│ │ Event(ts, context_hash, action, outcome, confidence, meta, │ │
│ │ trust_score, observation_model, tool_schema_version) │ │
│ │ → Normalize → Deduplicate → Semantic Cluster → Time-ordered stream │ │
│ └──────────────────────────────────────────────────────────────────────┘ │
│ │ │
│ ▼ │
│ ┌──────────────────────────────────────────────────────────────────────┐ │
│ │ LAYER 2: CAUSAL DELTA EXTRACTOR │ │
│ │ ┌─────────────────────────────┐ ┌───────────────────────────────┐ │ │
│ │ │ Pre/Post State Comparator │ │ Temporal Credit Assigner │ │ │
│ │ │ Counterfactual Marker │ │ (TAR² redistribution) │ │ │
│ │ │ Circular Chain Detector │ │ Causal Loop Breaker │ │ │
│ │ └─────────────────────────────┘ └───────────────────────────────┘ │ │
│ │ Delta(event_ref, trigger, result, utility, provenance_chain, │ │
│ │ credit_score, conflict_flags, belief_confidence) │ │
│ └──────────────────────────────────────────────────────────────────────┘ │
│ │ │
│ ▼ │
│ ┌──────────────────────────────────────────────────────────────────────┐ │
│ │ LAYER 3: BELIEF STATE MODULE │ │
│ │ BeliefState(entity_id, state_distribution, staleness_decay, │ │
│ │ observation_model, transition_model) │ │
│ │ → Probabilistic confidence scoring │ │
│ │ → POMDP belief update on new observations │ │
│ │ → Staleness decay on time-gated entities │ │
│ └──────────────────────────────────────────────────────────────────────┘ │
│ │ │
│ ▼ │
│ ┌──────────────────────────────────────────────────────────────────────┐ │
│ │ LAYER 4: TIERED MEMORY FABRIC │ │
│ │ │ │
│ │ ┌──────────────────┐ ┌─────────────────────┐ ┌───────────────┐ │ │
│ │ │ HOT TIER │ │ WARM TIER │ │ COLD TIER │ │ │
│ │ │ Redis/In-Mem │ │ Qdrant + DuckDB │ │ Parquet + │ │ │
│ │ │ <10ms │ │ 10-50ms │ │ Graph Index │ │ │
│ │ │ Active schemas │ │ Recent deltas │ │ 100-500ms │ │ │
│ │ │ Belief states │ │ Semantic + temporal │ │ Archived │ │ │
│ │ │ Working context │ │ + causal index │ │ schemas │ │ │
│ │ └──────────────────┘ └─────────────────────┘ └───────────────┘ │ │
│ │ ▲│ ▲│ ▲│ │ │
│ │ Copy-on-write pointers; tier metadata separate from immutable blobs│ │
│ └──────────────────────────────────────────────────────────────────────┘ │
│ │ │
│ ▼ │
│ ┌──────────────────────────────────────────────────────────────────────┐ │
│ │ LAYER 5: SELF-CONSOLIDATION ENGINE │ │
│ │ │ │
│ │ NREM Phase (offline, scheduled): │ │
│ │ • Merge redundant deltas → extract Memory Schemas │ │
│ │ • Resolve temporal contradictions │ │
│ │ • Prune via utility decay + retrieval miss tracking │ │
│ │ • Compress depth ≤ 3 (never re-summarize at depth 3) │ │
│ │ • SSR rehearsal for catastrophic forgetting prevention │ │
│ │ │ │
│ │ REM Phase (offline, less frequent): │ │
│ │ • Schema fidelity audit: reconstruct vs. raw events │ │
│ │ • Cross-schema pattern extraction → Compositional schemas │ │
│ │ • Distribution shift detection + schema reliability updates │ │
│ │ • Semantic drift check on vector index │ │
│ └──────────────────────────────────────────────────────────────────────┘ │
│ │ │
│ ▼ │
│ ┌──────────────────────────────────────────────────────────────────────┐ │
│ │ LAYER 6: RETRIEVAL & REASONING ORCHESTRATOR │ │
│ │ │ │
│ │ Multi-Router: │ │
│ │ • Semantic router (embedding similarity) │ │
│ │ • Temporal router (recency + staleness) │ │
│ │ • Causal router (provenance chain traversal) │ │
│ │ • Utility router (utility-weighted ranking) │ │
│ │ • Belief router (confidence-adjusted results) │ │
│ │ │ │
│ │ Returns: MemoryPacket(schema, deltas, provenance, confidence, │ │
│ │ belief_confidence, cost_to_use, │ │
│ │ trust_score, staleness_flag) │ │
│ └──────────────────────────────────────────────────────────────────────┘ │
│ │ │ │
│ ▼ ▼ │
│ ┌────────────────┐ ┌──────────────────────────────────────────────────┐ │
│ │ LAYER 7: │ │ LAYER 8: COMPLIANCE & UNLEARNING ENGINE │ │
│ │ COST & │ │ • Forget API (GDPR Art. 17) │ │
│ │ SCALE │ │ • Entity graph erasure │ │
│ │ GOVERNOR │ │ • Membership inference audit │ │
│ │ │ │ • Erasure verification certificate │ │
│ │ Budget │ │ • Differential privacy noise injection │ │
│ │ enforcement │ └──────────────────────────────────────────────────┘ │
│ │ Auto-scaling │ │
│ │ Quota mgmt │ │
│ └────────────────┘ │
└─────────────────────────────────────────────────────────────────────────────┘
Agent Decision
│
▼
Execute Action
│
▼
Observe Outcome ←──────────────────────────────────┐
│ │
▼ │
Trust Gateway │
(poison check, schema drift check) │
│ │
▼ │
Event Ingestion Layer │
│ │
▼ │
Causal Delta Extractor │
+ Temporal Credit Assigner │
│ │
▼ │
Belief State Updater │
│ │
▼ │
Tiered Storage (HOT → WARM → COLD migration) │
│ │
├──[threshold hit?]──► Sleep-Cycle Consolidator │
│ (NREM: merge, prune) │
│ (REM: audit, compose) │
│ │
▼ │
Next Agent Query → Retrieval Orchestrator ───────────┘
(5-router ensemble)
Modern Hopfield Networks (post-Ramsauer 2020) have exponential storage capacity and a direct mathematical equivalence to self-attention. Use them for the HOT tier pattern-matching.
How to use in DeltaCore:
// Content-addressable schema retrieval via Hopfield energy minimization
// Instead of k-NN vector search, use:
fn hopfield_retrieve(query: Embedding, schemas: &[Schema]) -> Schema {
// Energy: E = -0.5 * sum_i(sum_j(W_ij * xi * xj))
// Modern continuous Hopfield: E = -lse(beta, X^T * query) + 0.5*||query||^2
// Retrieval = energy minimization via fixed-point iteration
let patterns = schemas.iter().map(|s| s.embedding).collect();
hopfield_update(query, &patterns, beta=1.0)
// Converges in 1 step for well-separated patterns
}Why better than k-NN for HOT tier:
- O(1) retrieval for warm patterns (vs. O(log n) for HNSW)
- Graceful degradation under partial queries (completes corrupted/incomplete contexts)
- Natural noise rejection (attractor basins filter out aliased queries)
Key paper: Ramsauer et al. 2021 — "Hopfield Networks is All You Need"
Inspired by the SO-Spindle-Ripple coupling mechanism in human sleep. Implemented computationally, not biologically.
NREM Phase (run every N events or T minutes):
Trigger: event_count mod 1000 == 0 OR time since last NREM > 30min
NREM-1 (Light consolidation):
- Scan WARM tier for events with similarity > 0.85
- Merge into candidate schema
- Utility score = avg(component_utilities) * merge_confidence
NREM-2 (Deep consolidation):
- Extract schemas from NREM-1 candidates
- Apply utility decay to all entries: utility *= exp(-lambda * age_hours)
- Prune entries where utility < threshold AND retrieval_count == 0
NREM-3 (Memory transfer):
- Move consolidated schemas from WARM to HOT if utility > hot_threshold
- Archive low-utility schemas to COLD
- Write NREM summary report to telemetry
REM Phase (run daily or on distribution shift event):
Trigger: daily schedule OR distribution_shift_detected
REM-1 (Schema fidelity audit):
- Sample 1% of raw events from COLD
- Reconstruct what schemas should look like
- Compare against stored schemas: fidelity = cosine_sim(reconstructed, stored)
- Flag schemas with fidelity < 0.7
REM-2 (Cross-schema composition):
- Find schema pairs with high co-retrieval rate but low explicit connection
- Attempt compositional merge: Schema_C = compose(Schema_A, Schema_B)
- If utility(Schema_C) > utility(A) + utility(B) * 0.8: store Schema_C
REM-3 (Semantic drift correction):
- Re-embed 5% of WARM tier using current embedding model
- Compare old vs. new embeddings: drift_score = 1 - cosine_sim(old, new)
- If drift_score > 0.15: mark tier partition for re-indexing
- Schedule LIRE incremental reclustering for affected partitions
Standard schemas store patterns. But novel situations require combining patterns that have never co-occurred. The Compositional Schema Algebra makes this explicit.
Operations:
enum SchemaOp {
Sequence(Schema, Schema), // A then B
Parallel(Schema, Schema), // A and B simultaneously
Conditional(Condition, Schema, Schema), // if C then A else B
Negation(Schema), // avoid A
Generalize(Vec<Schema>), // common abstract from instances
Specialize(Schema, Constraint), // narrow A to constraint
}
// Example: compose "write code" schema with "under deadline" context schema
let urgent_coding = SchemaOp::Conditional(
Condition::ContextMatch("deadline"),
Schema::from("minimize_review_cycles"), // fast path
Schema::from("standard_review_flow") // normal path
);Storage: Compositional schemas live in WARM tier with source: COMPOSED tag. They get separate utility tracking — if composed schema outperforms components separately, both remain. If not, composed schema is pruned.
For content that must stay in the context window (cannot go to external storage), use Infini-Attention:
# Compressive memory module integrated into attention
# Memory M updated via: M_new = M_old + K^T V / (K^T * ones)
# Retrieval: A_mem = softmax(Q * M) / (Q * z + eps)
# Combined attention: A = sigmoid(beta) * A_mem + (1 - sigmoid(beta)) * A_local
# 114x compression ratio; fixed memory size regardless of context lengthWhen to use: Agent reasoning traces that need sub-millisecond access and must not be externalized (security-sensitive contexts, real-time control loops).
Caveat: Performance degrades with repeated compression cycles. Limit to 3 compression passes before externalizing to HOT tier.
Upgrade from flat embedding + tabular hybrid to a temporally-aware knowledge graph (Graphiti/Zep architecture):
Nodes: Entity(id, type, attributes)
Edges: Relation(source, target, predicate, valid_from, valid_until, confidence)
Facts are valid only within time intervals — no overwriting, only superseding
Query: "What was the user's deployment target at t=yesterday?"
TKG answer: traverse edges with valid_from <= yesterday <= valid_until
Flat embedding answer: returns current embedding, ignores temporal context
Why it wins:
- Handles temporal contradictions natively (old edge expires, new edge valid)
- Provenance is structural, not metadata
- Multi-hop reasoning (was this action caused by that event 3 steps ago?)
- 18.5% accuracy improvement, 90% latency reduction vs. static KG (Zep benchmark)
Integration point: WARM tier stores TKG; COLD archives expired edges; HOT caches hot subgraphs.
When old memories are pruned (necessary for bounded storage), the agent must not forget the patterns those memories encoded.
SSR protocol:
Before pruning a schema S with high historical utility:
1. Generate 3-5 synthetic events that would have produced schema S
2. Store synthetic events in WARM tier with tag: source=SYNTHETIC, rehearsal_for=S.id
3. Prune original raw events
4. Synthetic events participate in future consolidation cycles
Result: Schema can be re-derived from synthetic events if needed
Implementation: Use the agent's own LLM to generate synthetic events (self-distillation). Small cost at prune time, large benefit at retrieval time.
Instead of binary "consolidate or prune", continuously update schema utility using a gradient signal from outcomes:
utility_t+1 = utility_t + α * (outcome_signal - predicted_utility)
where:
α = learning_rate (0.01 - 0.1)
outcome_signal = +1 (correct decision), -1 (wrong decision), 0 (no feedback)
predicted_utility = schema.current_utility_score
Schema "evolves" toward regions that produce correct decisions.
Track gradient history: if utility oscillates → mark schema as UNSTABLE → route to human-in-loop.
Inspired by A-MEM (NeurIPS 2025): every new memory is not just stored, it is linked to related existing memories and updates them.
Protocol:
On storing Delta D:
1. Retrieve top-5 similar existing schemas
2. For each match above threshold:
a. Add bidirectional link: D ↔ Schema_i
b. Update Schema_i.description to incorporate D's context
c. Re-score Schema_i.utility based on co-reference count
3. Store D with its link graph
4. Result: Memory is a connected graph, not a flat list
Benefit: Multi-hop retrieval becomes natural. "What patterns led to the last deployment failure?" traverses the link graph rather than doing multiple independent queries.
| Class | Code | Trigger | Severity | Recovery |
|---|---|---|---|---|
POISON_DETECTED |
E01 | Trust score below threshold on write | CRITICAL | Block write, quarantine event, alert |
CIRCULAR_CAUSAL_CHAIN |
E02 | Provenance traversal loops | HIGH | Break at min-utility edge, log cycle |
TEMPORAL_CONTRADICTION |
E03 | Same subject+predicate, different object, recent delta | HIGH | Versioning + belief weight split |
SCHEMA_DRIFT |
E04 | Tool schema hash mismatch at execution | HIGH | Demote delta, trigger schema refresh |
BELIEF_STALE |
E05 | Belief confidence below 0.5 | MEDIUM | Re-observe flag, use with degraded confidence |
MEMORY_ALIAS |
E06 | High semantic sim + high context divergence | MEDIUM | Disambiguation tag required |
DISTRIBUTION_SHIFT |
E07 | KL divergence spike in context features | MEDIUM | Promote recent schemas, demote old |
COMPRESSION_LIMIT |
E08 | Item at max_compression_depth | LOW | Archive to COLD, do not re-summarize |
CONSOLIDATION_TIMEOUT |
E09 | NREM/REM phase exceeds time budget | LOW | Checkpoint, resume next cycle |
E01 — POISON_DETECTED:
1. Block the write immediately
2. Tag source agent/session as SUSPICIOUS
3. Quarantine last 100 events from that source for review
4. Increment source trust_score penalty: trust -= 0.3
5. If trust < 0: blacklist source
6. Alert: emit SECURITY_EVENT to monitoring
7. Do NOT reveal detection to source (prevents evasion)
E03 — TEMPORAL_CONTRADICTION:
1. Do not overwrite old schema
2. Create ConflictRecord { old_schema_id, new_delta_id, subject, predicate, old_object, new_object }
3. Store both with belief weights:
old_belief = old.utility_score / (old.utility_score + new.confidence)
new_belief = 1 - old_belief
4. Return both in MemoryPacket with flag: CONTRADICTED
5. If agent uses contradicted memory: log decision with contradiction_flag=true
6. After 5 new observations on same subject: auto-resolve toward majority
E04 — SCHEMA_DRIFT:
1. Flag delta as TOOL_SCHEMA_STALE
2. Attempt auto-migration:
a. Fetch current tool schema
b. Run param mapping rules (rename, transform, add defaults)
c. If migration succeeds: update delta, re-store, emit SCHEMA_MIGRATED
d. If migration fails: route to human-in-loop queue
3. Invalidate all cached query results that used this delta
4. Run full tool schema refresh for all deltas referencing this tool
When an exception occurs at delta D, it may invalidate other deltas in D's provenance chain:
fn propagate_exception(delta_id: DeltaId, exception: ExceptionClass) {
let chain = provenance_graph.ancestors(delta_id);
for ancestor in chain {
match exception {
POISON_DETECTED => {
// Taint entire chain — adversary may have injected at any point
ancestor.mark_tainted();
ancestor.utility_score = 0.0;
},
TEMPORAL_CONTRADICTION => {
// Only affect schemas that used this delta for generalization
if ancestor.derived_from.contains(delta_id) {
ancestor.mark_conflicted();
}
},
SCHEMA_DRIFT => {
// Only affect deltas using same tool
if ancestor.tool_ref == delta.tool_ref {
ancestor.mark_stale();
}
},
_ => {} // Localized; don't propagate
}
}
}| Threat | Attack Vector | Real Attack | Impact |
|---|---|---|---|
| Memory Poisoning | Crafted inputs into RAG | AGENTPOISON: 82% retrieval, 63% end-to-end | Agent executes attacker-chosen actions |
| Memory Injection | Query-only manipulation | MINJA: 95% injection success | Persistent schema corruption |
| Schema Hijacking | Tool output spoofing | Crafted tool responses | Agent learns wrong tool-use patterns |
| Belief State Manipulation | Fake observations | Feed false sensor/state data | Agent acts on wrong world model |
| Consolidation Poisoning | Trigger consolidation on poisoned events | Timed injection before NREM phase | Poisoned patterns become schemas |
| Temporal Anchor Attacks | Inject events with fake timestamps | Override recent schema with old poisoned schema | Temporal contradiction resolution hijacked |
Every event entering the system gets a trust_score ∈ [0.0, 1.0]:
struct TrustScore {
source_reputation: f64, // history of this source's outcomes
content_anomaly: f64, // how unusual is this event vs. distribution
semantic_consistency: f64, // does this event fit known patterns
temporal_plausibility: f64, // does timestamp make sense given sequence
tool_signature_valid: bool, // for tool outputs: verify tool signature
}
fn compute_trust(event: &Event, context: &AgentContext) -> f64 {
let score = 0.3 * source_reputation(event.source)
+ 0.25 * (1.0 - content_anomaly_score(event, context))
+ 0.25 * semantic_consistency_score(event, context)
+ 0.2 * temporal_plausibility(event.ts, context.recent_events);
if !event.tool_signature_valid { return score * 0.5; }
score
}
const TRUST_THRESHOLD: f64 = 0.4;
const QUARANTINE_THRESHOLD: f64 = 0.2;Event → Trust Score → Router:
score >= 0.7: Fast path → normal ingestion
score >= 0.4: Slow path → additional semantic checks → ingestion with trust_tag
score >= 0.2: Quarantine → human review queue → conditional ingestion
score < 0.2: Block + alert
Plant 3-5 low-visibility schemas with known queries as "canaries". If any canary schema appears in an unexpected query chain → signal that an attacker is probing the memory system:
fn plant_honeypot_schemas(memory: &mut MemoryStore) {
let canary = Schema {
id: generate_random_id(),
pattern: "canary_pattern_never_used_in_normal_ops",
utility_score: 0.01, // low enough to not affect normal retrieval
is_honeypot: true,
..Default::default()
};
memory.insert_cold(canary);
}
fn check_honeypot_retrieval(query: &Query, results: &[Schema]) {
if results.iter().any(|s| s.is_honeypot) {
emit_security_alert(AlertType::HoneypotTriggered, query);
}
}Separate HOT/WARM/COLD namespaces per trust level:
TRUSTED namespace: verified tool outputs, human-confirmed schemas
UNVERIFIED namespace: external data, user inputs before outcome confirmation
QUARANTINE namespace: flagged events awaiting review
SYNTHETIC namespace: SSR-generated rehearsal events
Cross-namespace retrieval: TRUSTED may be combined with UNVERIFIED in results, but QUARANTINE items are never included without explicit override.
When N agents share memory, up to f = ⌊(n-1)/3⌋ agents may be Byzantine (arbitrary malicious behavior). A Byzantine agent can:
- Write poisoned schemas
- Vote for wrong conflict resolutions
- Report false utility scores
- Replay old (superseded) schemas as current
Adapted from 2024 research for DeltaCore:
For any write to shared memory:
1. Agent broadcasts proposed delta D to all agents
2. Each agent probes: "does D match my local context confidence?"
→ returns confidence_score ∈ [0, 1]
3. Weighted voting:
- Collect confidence scores from all agents
- Weight each vote by that agent's source_reputation
- Accept write if weighted_vote_sum > 0.67 (⅔ supermajority)
4. Byzantine agents have low weight (low reputation → low vote weight)
5. Tolerates f = ⌊(n-1)/3⌋ Byzantine faults with confidence weighting
struct ConsensusVote {
agent_id: AgentId,
confidence: f64,
reputation_weight: f64,
}
fn consensus_write(delta: &Delta, agents: &[Agent]) -> WriteResult {
let votes: Vec<ConsensusVote> = agents
.iter()
.map(|a| ConsensusVote {
agent_id: a.id,
confidence: a.probe_confidence(delta),
reputation_weight: reputation_registry.get(a.id),
})
.collect();
let weighted_sum: f64 = votes.iter()
.map(|v| v.confidence * v.reputation_weight)
.sum();
let total_weight: f64 = votes.iter().map(|v| v.reputation_weight).sum();
if weighted_sum / total_weight > 0.67 {
WriteResult::Accept
} else {
WriteResult::Reject { reason: "insufficient_consensus" }
}
}Each schema has:
owner_agent: AgentId // who created it
contributors: Vec<AgentId> // who has contributed updates
version_vector: VClock // vector clock for distributed ordering
Merge conflict resolution:
1. Compare version vectors → determine causal order
2. If concurrent: merge by utility score (higher utility wins)
3. If malicious modification suspected (trust score drop):
restore from provenance chain + alert
GDPR Article 17 requires erasure of personal data on request. For a memory system:
- Deleting raw events is trivial (delete blob by ID)
- But schemas derived from those events remain
- Memory is influence, not just storage — schemas trained on deleted data still encode that data
struct ForgetRequest {
subject_entity: EntityId, // what to erase
scope: ForgetScope, // events only, schemas, or both
deadline: Timestamp, // regulatory deadline
requester: RequesterId,
}
enum ForgetScope {
EventsOnly, // fast, but schemas may retain influence
SchemasOnly, // for corrupted schemas without raw event access
Full, // complete erasure + schema re-derivation without subject
VerifiedErasure, // Full + membership inference audit
}Full erasure pipeline:
1. Find all events where subject_entity appears
2. Delete raw event blobs
3. Find all schemas with provenance linking to deleted events
4. For each affected schema S:
a. Identify other (non-deleted) events that contributed to S
b. Re-derive S from remaining events only
c. If S cannot be re-derived: delete S (it was solely derived from deleted data)
d. If S can be re-derived with degraded utility: store degraded version
5. Run membership inference audit (see 11.3)
6. Issue ForgetCertificate { request_id, entities_erased, schemas_modified, schemas_deleted, audit_hash }
After erasure, verify the target entity's data no longer influences outputs:
def membership_inference_audit(entity_id, memory_system, n_probe=100):
"""
Generate n_probe queries that, if entity's data is present,
should return higher-confidence results.
Returns: p_value (low = entity likely still present)
"""
probe_queries = generate_entity_probes(entity_id)
confidences_after = [memory_system.query(q).confidence for q in probe_queries]
baseline_confidences = [memory_system.query(q).confidence
for q in generate_random_queries(n_probe)]
# t-test: is entity confidence distinguishable from baseline?
t_stat, p_value = ttest_ind(confidences_after, baseline_confidences)
if p_value < 0.05:
return AuditResult.ERASURE_INCOMPLETE # entity influence still detectable
return AuditResult.ERASURE_VERIFIEDFor cases where perfect erasure is computationally infeasible (e.g., entity deeply embedded in many schemas):
Add calibrated Gaussian noise to schema utility scores that were influenced by the entity:
noise_scale = sensitivity(entity) / epsilon
schema.utility_score += N(0, noise_scale^2)
With epsilon = 0.1 (strong privacy): entity's contribution is statistically indistinguishable
Tradeoff: schema utility scores slightly degraded globally
Document this tradeoff in ForgetCertificate
Inspired by human SO-Spindle-Ripple (SSR) coupling. Three nested oscillation levels mapped to computational operations.
Slow Oscillations (SO) — Macro scheduling:
SO period: 60-120 minutes (configurable)
Role: Set global consolidation readiness
Trigger NREM if: event_buffer > threshold OR time > SO_period
During SO: pause all HOT tier writes (reduce contention)
After SO: release writes, NREM begins
Thalamocortical Spindles — Schema relay:
Spindle phase (within NREM):
- Re-activate schemas that were recently used (high access_count)
- Expose them to new delta stream → opportunity to absorb new information
- Strengthen traces: utility_boost = 0.05 * recent_co_retrieval_rate
- Result: "important" schemas get consolidation priority
Hippocampal Ripples — Pattern completion:
Ripple phase (within NREM, after Spindles):
- For each candidate schema, run "pattern completion":
present partial schema → attempt retrieval → check if full schema reconstructed
- If reconstruction fails: schema is fragile → preserve raw events longer
- If reconstruction succeeds: can prune raw events (schema is self-sufficient)
- Track: ripple_success_rate per schema → proxy for schema robustness
struct ConsolidationTrigger {
event_count_threshold: usize, // default: 1000
time_threshold_minutes: u64, // default: 60
utility_variance_threshold: f64, // trigger on high utility volatility
miss_rate_threshold: f64, // trigger on high retrieval miss rate
shift_detected: bool, // trigger on distribution shift
}
fn should_consolidate(state: &SystemState, config: &ConsolidationConfig) -> bool {
state.buffered_events > config.trigger.event_count_threshold
|| state.minutes_since_last_nrem > config.trigger.time_threshold_minutes
|| state.utility_variance > config.trigger.utility_variance_threshold
|| state.retrieval_miss_rate > config.trigger.miss_rate_threshold
|| state.distribution_shift_detected
}Consolidation modifies schemas. If it produces worse retrieval (detected by post-consolidation A/B test):
1. Before NREM: snapshot current schema set (lightweight: schema IDs + utility scores + version hashes)
2. After NREM: run 50-query A/B test against pre-consolidation snapshot
3. If precision@5 drops > 5%: rollback consolidation
4. Log consolidation_regression event
5. Retry with more conservative merge threshold
Status: Unsolved
How does a memory system integrate heterogeneous information — code snippets, natural language, tool call graphs, numeric metrics — into a unified, retrievable representation?
Current DeltaCore approach: store by modality, retrieve by modality, late fusion. This misses cross-modal correlations (e.g., "this code pattern correlates with this numeric performance signature").
Open direction: Multi-modal embedding alignment via contrastive learning on co-occurring cross-modal events. Not production-ready as of 2025.
Status: Partially solved, multi-agent case unsolved
TAR² (Temporal-Agent Reward Redistribution) handles single-agent temporal credit. Multi-agent temporal credit assignment — which agent's action at which time point deserves credit for a shared outcome 50 steps later — remains an open research problem.
Current best practice: Use TAR² for single-agent; use majority-voting utility attribution for multi-agent (imprecise but practical).
Status: Open research problem
Current retrieval: find the schema that best matches this query.
Needed: find the combination of schemas that collectively answer a novel query neither schema alone covers.
The gap: no efficient algorithm for combinatorial schema search at scale. Brute-force is O(n²) at minimum.
DeltaCore workaround: Zettelkasten link graph (Section 7.8) + REM-phase compositional extraction (Section 12.1) provides approximate compositionality. Not theoretically complete.
Status: Active research, no consensus solution
SSR (Section 7.6) works for external memory systems. But if the agent's underlying LLM is fine-tuned on new data, it forgets old patterns regardless of external memory.
Current best practice:
- Do NOT fine-tune the base model on per-agent experience (use memory layer only)
- If fine-tuning is required: use FIT (Focused Internal Training) with gradient isolation
- EWC (Elastic Weight Consolidation) for smaller models; works up to ~7B parameters
Status: Unsolved at production scale
Current membership inference audits have high false-negative rates on well-trained models. No method provides formal guarantees of complete erasure without full retraining.
Research direction: Cryptographic commitments on training data + differential privacy provide probabilistic (not absolute) guarantees. Regulatory compliance requires only "reasonable steps" — probabilistic guarantees may be sufficient legally but remain technically incomplete.
Status: Open
All current approaches assume the world changes slowly enough for periodic adaptation (distribution shift detection + schema refresh). If the world changes faster than the consolidation cycle (e.g., real-time trading, live incident response), the memory system is always "behind".
DeltaCore mitigation: Reduce NREM cycle to minutes for high-velocity domains. Increase HOT tier size. Accept lower schema abstraction quality for high-velocity domains. No complete solution exists.
Status: Philosophical + practical
To retrieve the right memory, you need to know what to look for. To know what to look for, you already need some memory. Cold-start (Section 4.6) provides partial mitigation via prior injection, but the bootstrapping problem is fundamental.
Current best practice: Domain prior injection is the practical answer. Theoretically unsatisfying.
// Core identifiers
type EventId = Uuid;
type DeltaId = Uuid;
type SchemaId = Uuid;
type EntityId = String; // canonical entity name
type AgentId = Uuid;
type RequesterId = String;
// ── Layer 1: Events ──────────────────────────────────────────────────────────
struct Event {
id: EventId,
ts: i64, // Unix ms
context_hash: [u8; 32], // SHA-256 of context window
action: ActionType,
outcome: OutcomeType,
confidence: f32, // agent's confidence at time of action
trust_score: f32, // Trust Gateway score [0, 1]
tool_schema_version:Option<u64>, // hash of tool schema if tool was used
source_agent: AgentId,
observation_model: Option<ObsModelRef>, // for POMDP environments
meta: HashMap<String, Value>,
compression_depth: u8, // 0 = raw; max = 3
is_synthetic: bool, // SSR-generated?
rehearsal_for: Option<SchemaId>,
}
// ── Layer 2: Causal Deltas ────────────────────────────────────────────────────
struct Delta {
id: DeltaId,
event_ref: EventId,
trigger: TriggerCondition,
result: OutcomeRepresentation,
utility: f32,
credit_score: f32, // TAR² temporal credit attribution
provenance_chain: Vec<DeltaId>, // causal ancestry
conflict_flags: Vec<ConflictType>,
belief_confidence: f32, // from BeliefState module
source_trust: f32, // propagated from Event.trust_score
namespace: TrustNamespace, // TRUSTED | UNVERIFIED | QUARANTINE | SYNTHETIC
tool_ref: Option<ToolId>,
tool_schema_hash: Option<u64>,
}
// ── Layer 3: Belief States ────────────────────────────────────────────────────
struct BeliefState {
entity_id: EntityId,
state_distribution: HashMap<StateLabel, f32>, // must sum to 1.0
last_observation_ts: i64,
staleness_decay_rate: f32, // probability bleeds to UNKNOWN per hour
observation_model: ObservationModel,
transition_model: TransitionModel,
current_confidence: f32, // derived: 1.0 - H(state_distribution) / log(|states|)
}
// ── Layer 4: Memory Schemas ───────────────────────────────────────────────────
struct Schema {
id: SchemaId,
pattern: PatternRepresentation,
decision_template: DecisionTemplate,
utility_score: f32,
utility_gradient: f32, // recent change direction
utility_stability: bool, // false = oscillating
version: u32,
last_access: i64,
access_count: u64,
source: SchemaSource, // LEARNED | COMPOSED | PRIOR | INJECTED
owner_agent: AgentId,
contributors: Vec<AgentId>,
version_vector: VectorClock,
provenance_events: Vec<EventId>,
provenance_deltas: Vec<DeltaId>,
linked_schemas: Vec<(SchemaId, LinkType, f32)>, // Zettelkasten links
compression_depth: u8,
ripple_success_rate: f32, // from sleep-cycle pattern completion
is_superseded_by: Option<SchemaId>,
is_honeypot: bool,
reliability: SchemaReliability, // NOMINAL | DEGRADED | STALE | CONFLICTED
gdpr_erase_requested: bool,
dp_noise_applied: bool,
tool_schema_version: Option<u64>, // pinned tool schema version
}
// ── Layer 5: Memory Packet (retrieval result) ─────────────────────────────────
struct MemoryPacket {
schema: Schema,
supporting_deltas: Vec<Delta>,
provenance: ProvenanceChain,
confidence: f32,
belief_confidence: f32,
cost_to_use: ComputeCost,
trust_score: f32,
staleness_flag: bool,
conflict_flag: bool,
flags: Vec<MemoryFlag>, // CONTRADICTED | TAINTED | STALE | SYNTHETIC
}
// ── Layer 6: Conflict Records ─────────────────────────────────────────────────
struct ConflictRecord {
id: Uuid,
old_schema_id: SchemaId,
new_delta_id: DeltaId,
subject: EntityId,
predicate: String,
old_object: Value,
new_object: Value,
old_belief: f32,
new_belief: f32,
resolution: ConflictResolution, // PENDING | AUTO_RESOLVED | HUMAN_RESOLVED
resolved_at: Option<i64>,
}
// ── Layer 7: Forget Records ───────────────────────────────────────────────────
struct ForgetCertificate {
request_id: Uuid,
requester: RequesterId,
subject_entity: EntityId,
events_erased: u64,
schemas_deleted: u64,
schemas_modified: u64,
audit_result: AuditResult, // ERASURE_VERIFIED | ERASURE_INCOMPLETE | DP_APPLIED
dp_epsilon: Option<f64>, // if differential privacy was applied
audit_hash: [u8; 32], // SHA-256 of erasure log
completed_at: i64,
}// Write path
ingest(events: Vec<Event>) → IngestResult { event_ids, trust_violations, schema_drifts }
ingest_batch(event_stream: Stream<Event>, options: BatchOptions) → BatchHandle
// Read path
query(criteria: QueryCriteria) → MemoryPacket[]
query_belief(entity_id: EntityId, at_time: Option<i64>) → BeliefState
query_tkg(sparql_query: String) → TKGResult // temporal knowledge graph query
query_causal(delta_id: DeltaId, depth: u8) → CausalChain
// Consolidation
consolidate(phase: ConsolidationPhase) → ConsolidationReport { schemas_created, entries_pruned, fidelity_delta }
consolidate_status() → ConsolidationState
// Maintenance
prune(policy: PrunePolicy) → PruneReport { storage_saved, schemas_pruned, events_pruned }
reindex(tier: MemoryTier, full: bool) → ReindexHandle // for semantic drift repair
audit_fidelity(sample_rate: f32) → FidelityReport
// Compliance
forget(request: ForgetRequest) → ForgetCertificate
forget_status(request_id: Uuid) → ForgetStatus
verify_erasure(entity_id: EntityId) → AuditResult
// Schema operations
schema_get(id: SchemaId) → Schema
schema_update(id: SchemaId, patch: SchemaPatch) → Schema
schema_compose(a: SchemaId, b: SchemaId, op: SchemaOp) → Schema
schema_rollback(id: SchemaId, version: u32) → Schema
schema_export(ids: Vec<SchemaId>) → SchemaBundle
schema_import(bundle: SchemaBundle, options: ImportOptions) → ImportReport
// Security
trust_score(source: SourceId) → f32
quarantine_review(event_ids: Vec<EventId>) → ReviewResult
security_events(since: i64) → Vec<SecurityEvent>
// Multi-agent
consensus_write(delta: Delta, agents: Vec<AgentId>) → ConsensusResult
resolve_conflict(conflict_id: Uuid, resolution: ConflictResolution) → ConflictRecord
// Observability
monitor() → MemoryEconomy {
hot_size_bytes, warm_size_bytes, cold_size_bytes,
hot_hit_rate, warm_hit_rate, cold_hit_rate,
retrieval_p50_ms, retrieval_p95_ms, retrieval_p99_ms,
consolidation_ratio, schemas_total, deltas_total,
utility_mean, utility_std, utility_decay_rate,
poisoning_attempts_24h, schema_drifts_24h,
belief_staleness_fraction,
cost_per_1k_queries, storage_cost_per_day,
decision_improvement_rate, // rolling 7-day
memory_utility_per_query,
}
struct QueryCriteria {
// What to search
semantic: Option<String>, // free-text semantic search
entity: Option<EntityId>, // specific entity
action: Option<ActionType>, // specific action type
outcome: Option<OutcomeType>, // filter by outcome
// When
time_range: Option<(i64, i64)>, // Unix ms range
min_recency: Option<Duration>,
// Quality filters
min_utility: Option<f32>,
min_confidence: Option<f32>,
min_trust: Option<f32>,
exclude_stale: bool,
exclude_tainted: bool,
// Multi-agent
agent_filter: Option<Vec<AgentId>>,
// Return options
top_k: usize,
routers: Vec<RouterType>, // SEMANTIC | TEMPORAL | CAUSAL | UTILITY | BELIEF
include_deltas: bool,
include_belief_states: bool,
// Cost constraint
max_cost: Option<ComputeBudget>,
}| Failure | Cause | Detection | Recovery |
|---|---|---|---|
| HOT tier OOM | Unbounded event ingestion | Memory usage alert > 80% | Evict LRU entries to WARM; throttle ingest |
| WARM index fragmentation | High insert/delete churn | Query latency p95 > 100ms | Trigger LIRE incremental reclustering |
| COLD Parquet corruption | Disk failure / partial write | Checksum validation fail | Restore from delta archive + re-derive |
| Consolidation deadlock | NREM holding write lock > timeout | Lock timeout alert | Force-release lock; resume from checkpoint |
| Vector semantic drift | Embedding model update | Drift monitor KL spike | Re-embed affected partition; gradual rollout |
| Schema proliferation | Under-aggressive pruning | Schema count > soft limit | Emergency consolidation + lower utility threshold |
| Byzantine agent flood | Malicious multi-agent write storm | Consensus failure rate > 20% | Isolate suspicious agents; require elevated trust for writes |
| Forget request backlog | High GDPR request volume | Queue depth alert | Horizontal scale of unlearning workers |
| Credit assignment starvation | All events in sparse reward sequence | Utility variance → 0 after long sequence | Force TAR² with artificial temporal discount |
When the full system is unavailable, DeltaCore degrades gracefully:
Level 0: Full operation — all 8 layers active
Level 1: No consolidation — NREM/REM suspended; memory may grow; retrieval unaffected
Level 2: HOT only — WARM/COLD reads disabled; serve only cached high-utility schemas
Level 3: Read-only — all writes blocked; serve stale memory; log all queries for replay
Level 4: Emergency schema — serve only the 10 highest-utility schemas; minimal footprint
Level 5: Passthrough — memory system bypassed; agent uses base model only
Each level has automatic trigger conditions and human override options.
| Tier | RTO (Recovery Time Objective) | RPO (Recovery Point Objective) |
|---|---|---|
| HOT | 30 seconds | 5 minutes (Redis AOF) |
| WARM | 5 minutes | 15 minutes (Qdrant snapshots + DuckDB WAL) |
| COLD | 60 minutes | 24 hours (Parquet in object storage) |
| Schemas | 10 minutes | 1 hour (schema snapshot export) |
# Test cases every component must pass
# Circular causal chain detection
def test_circular_chain():
delta_a = Delta(provenance=[delta_b.id])
delta_b = Delta(provenance=[delta_a.id])
with pytest.raises(CircularCausalChainException):
causal_extractor.build_chain(delta_a)
# Temporal contradiction detection
def test_temporal_contradiction():
d1 = Delta(subject="user_pref", object="Python", ts=0)
d2 = Delta(subject="user_pref", object="Go", ts=100)
ingest(d1); ingest(d2)
conflicts = conflict_detector.find_conflicts()
assert len(conflicts) == 1
assert conflicts[0].type == ConflictType.TEMPORAL_CONTRADICTION
# Poison detection
def test_poison_detection():
crafted_event = create_agentpoison_style_event() # known attack pattern
result = trust_gateway.evaluate(crafted_event)
assert result.trust_score < TRUST_THRESHOLD
assert result.action == TrustAction.QUARANTINE
# Forget verification
def test_gdpr_erasure():
entity = "user_123"
ingest_events_for_entity(entity, n=50)
consolidate()
forget(ForgetRequest(entity, scope=ForgetScope.VerifiedErasure))
audit = verify_erasure(entity)
assert audit == AuditResult.ERASURE_VERIFIED# End-to-end self-learning loop
def test_agent_improves_with_memory():
agent = MemoryAugmentedAgent(memory=DeltaCore())
baseline_score = evaluate_agent(agent, n_episodes=10, use_memory=False)
# Train with memory
for _ in range(100):
agent.run_episode() # memory is populated
memory_score = evaluate_agent(agent, n_episodes=10, use_memory=True)
assert memory_score > baseline_score * 1.1 # at least 10% improvement
# Cold start behavior
def test_cold_start():
agent = MemoryAugmentedAgent(memory=DeltaCore(cold_start_priors=CODING_DOMAIN))
result = agent.query("write a function")
assert result.confidence > 0.3 # prior injection provides baseline
assert result.source == SchemaSource.PRIOR| Benchmark | Metric | Target | Baseline (vanilla RAG) |
|---|---|---|---|
| AMA-Bench (long-horizon memory) | Task completion rate | >75% | ~45% |
| Deep Memory Retrieval (DMR) | Accuracy@5 | >85% | ~67% |
| Adversarial poisoning resistance | Attack success rate | <10% | ~63% |
| Catastrophic forgetting (continual) | Retention after 100 tasks | >80% | ~40% |
| Cold start ramp | Queries to 70% precision | <50 | N/A |
| GDPR erasure verification | p-value > 0.05 | >95% of cases | N/A |
| Multi-agent consensus (30% Byzantine) | Write integrity | >99.9% | ~70% |
# Compare memory-augmented vs. non-memory decisions
class MemoryABTest:
def __init__(self, memory: DeltaCore, agent: Agent):
self.control = agent.clone(memory=None) # no memory
self.treatment = agent.clone(memory=memory)
def run(self, n_queries: int) -> ABTestResult:
control_results = [self.control.decide(q) for q in sample_queries(n_queries)]
treatment_results = [self.treatment.decide(q) for q in sample_queries(n_queries)]
return ABTestResult(
precision_lift = mean(treatment_results.precision) - mean(control_results.precision),
latency_overhead = mean(treatment_results.latency) - mean(control_results.latency),
cost_overhead = total_cost(treatment_results) - total_cost(control_results),
memory_utility_per_query = mean(r.memory_contribution for r in treatment_results),
)struct MemoryBudget {
hot_max_bytes: u64, // default: 2 GB
warm_max_bytes: u64, // default: 100 GB
cold_max_bytes: u64, // default: unbounded (object storage)
max_consolidation_cpu: f32, // fraction of CPU for NREM/REM
max_query_cost_ms: u64, // per-query compute budget
max_embedding_calls_per_hour: u64,
monthly_storage_budget_usd: f32,
}Every 5 minutes:
cache_miss_rate = (warm_misses + hot_misses) / total_queries
if cache_miss_rate > 0.15:
governor.expand_hot(factor=1.2) // grow HOT by 20%
governor.expand_warm(factor=1.1) // grow WARM by 10%
if utility_decay_flatlines(window=24h):
governor.increase_consolidation_frequency()
if hot_size > hot_max_bytes * 0.9:
governor.evict_lru_from_hot(target=hot_max_bytes * 0.7)
if embedding_drift_detected:
governor.schedule_reindex(priority=HIGH)
struct Tenant {
id: TenantId,
agent_namespace: Namespace, // isolated HOT/WARM/COLD partitions
budget_quota: MemoryBudget, // per-tenant limits
billing_hooks: Vec<BillingHook>,
gdpr_region: GDPRRegion, // EU, US, etc. — affects unlearning SLO
}- Event ingestion + Trust Gateway (poison detection, schema drift check)
- Causal Delta Extractor with circular chain detection
- HOT/WARM/COLD tiered storage (Redis + Qdrant + DuckDB + Parquet)
- Basic utility scoring + exponential decay
- gRPC + REST API scaffold with OpenTelemetry
- Cold-start bootstrap with domain prior injection
- Self-Consolidation Engine: NREM phase (merge, prune)
- Belief State Module for POMDP environments
- Temporal contradiction detection + resolution
- Temporal credit assignment (TAR²)
- Schema versioning + rollback
- A-MEM Zettelkasten link graph
- REM phase: fidelity audit, cross-schema composition
- Adversarial security: Trust pipeline, honeypot schemas, memory isolation
- GDPR Forget API + membership inference audit
- CP-WBFT multi-agent consensus
- SSR rehearsal for catastrophic forgetting
- Write amplification fix: copy-on-write pointers
- Temporal Knowledge Graph tier (Graphiti integration)
- Semantic drift monitor + Quake adaptive indexing
- Utility-gradient schema evolution
- Compositional Schema Algebra + REM-phase composition
- Multi-tenant isolation + quota enforcement
- Benchmark suite: AMA-Bench, DMR, adversarial, continual learning
- Kubernetes microservices deployment + horizontal sharding
- Grafana/Prometheus dashboards for all
memory_economymetrics - Agent framework adapters: LangChain, AutoGen, CrewAI, custom
- Docker images + Helm charts + Terraform modules
- Open-source release with docs, examples, benchmark results
- MemGPT (2023): Towards LLMs as Operating Systems — arxiv.org/abs/2310.08560
- A-MEM (NeurIPS 2025): Agentic Memory for LLM Agents — arxiv.org/abs/2502.12110
- HippoRAG (NeurIPS 2024): Neurobiologically Inspired Long-Term Memory — arxiv.org/abs/2405.14831
- Cognitive Architectures for Language Agents (2023) — arxiv.org/abs/2309.02427
- Memory for Autonomous LLM Agents (2025) — arxiv.org/abs/2603.07670
- Mem0 (2024): Building Production-Ready AI Agents — arxiv.org/abs/2504.19413
- Zep / Graphiti (2025): Temporal Knowledge Graph Architecture — arxiv.org/abs/2501.13956
- KARMA (2024): Long-short Term Memory for Embodied Agents — arxiv.org/abs/2409.14908
- G-Memory (2026): Hierarchical Agentic Memory for Multi-Agent — arxiv.org/abs/2506.07398
- StreamingLLM (ICLR 2024): Efficient Streaming — github.com/mit-han-lab/streaming-llm
- Infini-Attention (Google 2024): 114× compression — arxiv.org/abs/2404.07143
- HiAgent (2024): Hierarchical Working Memory — arxiv.org/abs/2408.09559
- Modern Hopfield Networks (2021): "Hopfield Networks is All You Need" — arxiv.org/abs/2008.02217
- CALM (2024): Continual Associative Learning via SDM — mdpi.com/2227-7080/13/12/587
- Catastrophic Forgetting in LLMs (2025) — arxiv.org/abs/2504.01241
- FIT: Defying Catastrophic Forgetting (2026) — arxiv.org/abs/2601.21682
- Survey: Temporal Credit Assignment in Deep RL (2023) — arxiv.org/abs/2312.01072
- TAR²: Temporal-Agent Reward Redistribution (2025) — arxiv.org/abs/2502.04864
- AGENTPOISON (NeurIPS 2024): Red-teaming via Memory Poisoning — arxiv.org/abs/2407.12784
- MINJA: Memory Injection Attack (2025) — arxiv.org/abs/2503.03704
- Memory Poisoning Attack and Defense (2026) — arxiv.org/abs/2601.05504
- CP-WBFT: Byzantine Fault Tolerance (2025) — arxiv.org/abs/2511.10400
- A BFT Approach toward AI Safety (2025) — arxiv.org/abs/2504.14668
- Logic for Repair in Byzantine Multi-agent (2024) — arxiv.org/abs/2401.06451
- Machine Learning to Machine Unlearning (2024) — arxiv.org/abs/2411.17126
- Hindsight is 20/20: Agent Memory (2025) — arxiv.org/abs/2512.12818
- SCM: Sleep-Consolidated Memory for LLMs (2025) — arxiv.org/abs/2604.20943
- Systems Memory Consolidation During Sleep (review, 2025) — pmc.ncbi.nlm.nih.gov/articles/PMC12576410/
- Computational Modeling of Sleep-Wake Cycle (2024) — arxiv.org/abs/2404.05484
- Belief Memory: Agent Memory Under Partial Observability (2026) — arxiv.org/abs/2605.05583
- Quake: Adaptive Indexing for Vector Search (OSDI 2025) — usenix.org/system/files/osdi25-mohoney.pdf
- Survey of Vector Database Management Systems (2024) — vldb.org
- Graph-based Agent Memory: Taxonomy (2025) — arxiv.org/abs/2602.05665
- Governing Evolving Memory in LLM Agents (2026) — arxiv.org/abs/2603.11768
- AMA-Bench: Evaluating Long-Horizon Memory (2026) — arxiv.org/abs/2602.22769
- ICLR 2026 Workshop: MemAgents — openreview.net
DeltaCore v2 — complete blueprint. The v1 architecture was directionally correct. v2 fills the 13 critical gaps, resolves the 12 edge cases, integrates 8 novel algorithms, defines exception handling for 9 failure classes, and positions the system at the frontier of unsolved problems. Build v1 → v2 iteratively. Ship Phase 1 first.