Kevin Brain System

Kevin Wiki is an evidence-driven operating graph. It preserves source revisions, extracts every useful signal, challenges a small set of stable knowledge and operating objects, routes work through named loops, proves the result, and writes learning back. The website, API, CLI, and skills are projections of that system rather than separate sources of truth.

The whole system

The five authored object registries are brain/goals.json, brain/loops.json, brain/objects.json, brain/sources.json, and brain/workflows.json. brain/source-connectors.json is the smaller runtime/readiness registry that binds a desired source to its cadence, command, and setup dependencies. These registries are deliberately small. Thousands of pages and source revisions can connect to them without becoming thousands of competing routers.

Read it as an operator

The system has five visible levels. Each answers a different question and each has one owner:

This is why the system is not flat. Articles are readable projections and stable owners, not the navigation model for everything. Skills are reusable procedures called by workflows. Tools are bounded capabilities. Workflows are versioned jobs. Loops maintain goals. Sources can challenge all of them, but do not gain write authority merely by being captured.

The compact /system information architecture mirrors those levels:

The public surface shows structure, readiness, counts, and sanitized proof. The global-password-gated /system/sessions operator surface adds task discovery, project/date/provider filters, evidence-state inspection, exact replay commands, and export/cohort prompts without publishing conversation titles, prompts, filesystem paths, or task IDs through the public projection. Daily Brief owns proposal decisions separately; the task library never grants canonical write authority merely because a transcript was found.

Ontology, knowledge base, and brain are different layers

An ontology defines allowed concepts, entities, attributes, relationships, and rules. A knowledge base holds actual source or compiled content and its indexes. A brain is the operating system that puts those stores to work through retrieval, goals, workflows, tools, memory, authority, proof, and user interfaces. Kevin-Wiki contains all three functions, but they do not collapse into one database or graph.

Cerebras Knowledge is strong production evidence for a retrieval-focused knowledge base: source-native ingestion, full semantic-unit refresh, distilled Slack threads, code-aware incremental indexing, lexical + embedding + IDF + age signals, RRF, reranking, project scope, and parallel tools. GBrain demonstrates a different hybrid: Markdown remains the source of record while Postgres/PGLite, BM25/vector/RRF/reranking, typed edges, synthesis, memory verbs, skills, and durable jobs serve it. Neither implies that a retrieval index should own Kevin's source archive, object registry, workflow authority, or proof graph. Source: Cerebras, “How We Built Our Knowledge Base,” 2026-07-15; garrytan/gbrain@fc310db, reviewed 2026-08-12; X 2078212601230872816

Retrieval promotion needs an owned relevance set, not a slogan about vectors or keywords. Freeze exact-name, identifier/error-code, paraphrase, filtered, cross-source, fresh-update, and permission-scoped queries; compare lexical, semantic, fused, and reranked routes on recall, nDCG/MRR, unsupported results, ACL leakage, p50/p95 latency, memory, index/update cost, and failure recovery. BM25 remains the precision baseline, semantic retrieval the paraphrase lane, and fusion/reranking a measured improvement rather than a mandatory tax. Atuin's 500k-entry shell-history optimization is useful implementation evidence for latency engineering, not a relevance result for this corpus. Source: Elastic ES|QL/ranking documentation, reviewed 2026-08-12; atuinsh/atuin@b095912f

Three graphs, one loop

The shared spine is:

capture -> expand -> correlate -> extract -> bind -> interrogate -> decide -> write back -> prove

A bookmark, message, article, or feed item never reaches a terminal discard bucket. If current evidence cannot be incorporated, it remains held or blocked with its source identity and reopening condition. Repeated evidence strengthens an edge; it is not removed as a duplicate.

held and blocked are intentionally different. A held receipt is a final review decision for the exact evidence revision: the material was inspected but is unavailable, system-only, private logistics, or not suitable for an owner change. A blocked receipt still has unresolved acquisition or verification work and remains pending. Either state reopens automatically when its exact evidence digest changes.

Four memory planes

The compiled wiki is one memory plane, not a synonym for all memory. The system keeps four planes separate so convenience never erases source truth or personal history:

The wiki reduces repeated rediscovery, but raw retrieval remains necessary when a compiled page may have lost detail. At modest scale, direct file traversal can be enough; at this corpus size, qmd's lexical + vector + reranking layer is a retrieval aid over compiled Markdown, not a replacement source of truth. User memory and wiki knowledge can inform one another, but neither may silently impersonate the other. Source: X/@hwchase17, “Wiki Memory,” 2026-06-30; Source: X/@mem0ai, “The State of Agent Wikis,” 2026-07-21

External knowledge systems are adapters, not the brain

Nia Vault is retained because it demonstrates a strong adjacent product shape: many integrations become filesystem-like sources, an agent compiles them into interlinked Markdown, schema.md governs the generated structure, and scheduled ingest/sync/lint/dream loops improve it. Kevin-Wiki adopts those observable jobs, not Nia as canonical custody. Any external knowledge product remains a source or retrieval adapter behind the same four planes: preserve its source identity and revision, record connector permissions and processors, materialize immutable evidence locally, compile into stable owners, and keep replay/export/deletion possible without the provider. Cloud encryption, a generated wiki, or a filesystem metaphor cannot replace local provenance, audience policy, approval, or proof. Source: X 2043765452959109603; current Nia Vault docs and nia-wizard@0.1.34, reviewed 2026-08-12

Memory-to-capability promotion

Past runs do not become skills merely because they are retrievable or ended in success. The promotion path is staged:

run traces + outcome proof
  -> candidate procedure
  -> evidence-backed policy
  -> probationary skill
  -> active skill
  -> revise, narrow, archive, or retire

A promoted skill retains its trigger, applicability and exclusion boundaries, procedure, evidence anchors, decision guidance, verification/fallback rule, and an empirical reliability history. Active retrieval requires both trigger fit and proven reliability; failure falls back to trace/wiki retrieval and reopens the candidate instead of forcing a stale procedure. Negative outcomes can narrow a boundary or revise a verifier. Low-reliability or inactive skills leave the active runtime without erasing their evidence.

This adopts the useful governance shape from MSCE while keeping a harder epistemic boundary: its value and reliability estimates are heuristic ranking signals, not causal proof that the skill produced success. Kevin-Wiki therefore requires held-out or task-specific evals and direct run receipts before activation. Source: From Memory to Skills: Evidence-Grounded Co-Evolution Governance for Long-Horizon LLM Agents, 2026-07-21; X/@dair_ai, 2026-07-21

Goals and loops

Goals state durable outcomes. Loops state how those outcomes are maintained. The initial six goals cover knowledge compounding, system truth, proof-carrying work, encoded taste, product realization, and self-improvement. Seven loops own source capture, source interrogation, corpus replay, frontier research, workflow execution, project advancement, and system maintenance.

The loop registry is smaller than the workflow library. A loop is a system-level feedback cycle. A workflow is a named user job routed inside a loop. A skill is a reusable procedure called by a workflow. A tool is a capability with readiness and authority state.

The workflow registry makes that hierarchy executable. Each manifest freezes a semantic version, user-only or agent-or-user invocation boundary, owner, loop, goals, deterministic routing terms, knowledge/skill/capability bindings, authority, ordered stages, proof, and writeback targets. The router scores exact IDs and aliases before required and optional terms, applies explicit exclusions, and resolves ties lexically. Terms are token/phrase-bound, so a short route such as pr cannot match inside surprise, prepare, or improve; exact-route collisions are rejected by the registry doctor. Only the highest semantic version enters free-text routing while an exact id@version remains replayable. It cannot route or directly plan an agent into a user-only workflow. workflow plan then produces an immutable pending-only contract whose run ID derives from the full plan digest. Separate manifest and registry digests bind selection, route reasons, invoker, authority, inputs, knowledge, skills, capabilities, ordered stages, proof, and writebacks; changing one field invalidates the plan. A prompt may specialize execution only inside that frozen contract. workflow begin crosses from selection into execution by appending the verified plan to a private hash-chained JSONL ledger. Ordered stage events, every proof attempt, and one honest terminal outcome replay into a deterministic receipt. Completion is rejected until every stage and required proof passes and the receipt names sources read, changes made, deferred work, state movement, and validation. A restart replays the same state; a changed or reordered event breaks the chain; and a retry creates a new run instead of mutating terminal history.

Goal-shaped learning

Capture stays broad because an apparently minor save can later become decisive. Attention does not stay broad: active goals, projects, standing questions, contradictions, and upcoming outputs determine review order and retrieval context. A source that is not useful right now remains replayable and held; it is not deleted or mislabeled as irrelevant.

Every important output closes a cybernetic loop:

goal -> sensed evidence/current state -> gap -> action -> independently checked result -> learning/writeback

This is why the graph includes goals, projects, proof, and feedback rather than only notes. The test of the brain is whether saved evidence improves a decision, artifact, workflow, or product and whether the result updates future behavior. Passive capture and unused summaries are backlog, not learning. Source: X/@thedankoe, “How to remember everything you read (stop trying),” 2026-07-26

The compounding asset is therefore not the source pile or even the generated code by itself. It is the inspectable production system around them: institutional knowledge bound to stable objects, custom workflows, integrated capabilities, authority rules, and proof that improve the next run. Open Agents' “software factory” thesis is useful precisely because its implementation makes the claim concrete as a durable agent workflow outside a sandbox; Kevin-Wiki generalizes that factory beyond coding and keeps its evidence and operating objects portable across harnesses. Source: X/@rauchg, 2026-04-14; Source: vercel-labs/open-agents at cf865e94, reviewed 2026-08-11

Agent-native product and harness requirements

The brain cannot be useful only while one laptop process and one chat window remain open. An agent-facing product should separate its durable service from its operator surfaces: resumable sessions, queues, schedules, evidence, memory, and authority live behind a stable runtime; desktop, web, mobile, messaging, and embedded UI are replaceable clients. Remote access does not automatically grant remote approval or shell authority. Every client binds a user, device, runtime, workspace, session, capability set, revocation path, and audit trail. Source: X 2086500543782883701, 2082613200441524514; current T3 Connect repository and T3 Code, reviewed 2026-08-12

Agent-native applications also invert the usual chat-bolted-onto-a-database shape. The agent may maintain a durable work queue, schedule its own evidenced follow-ups, continue after the browser closes, and treat the product database as its notebook. It still cannot guess facts or make its own confidence score the authority. Tools report observations; an evidence ledger prices them; strong evidence updates the record; weak evidence becomes a human-settled proposal. Leases, budgets, reason-bearing follow-ups, sandbox egress, and human escalation are product primitives rather than prompt conventions. Source: X 2083610805069611230, 2083610808005652571; trycompai/crm, reviewed 2026-08-12

Agent-readable resources can eventually be metered without turning the whole wiki into a paywall. A machine client can discover a typed resource, receive a price or 402 Payment Required, pay within an explicit delegated budget, retry with proof, and retain a charge/result receipt. Any such surface still needs a free discovery contract, stable resource identity, freshness and provenance, price/currency disclosure, spend and rate caps, idempotency, replay/refund and failure semantics, abuse controls, wallet revocation, privacy boundaries, and a human-visible ledger. The useful product signal is request-as-transaction; the social claim is not payment-system proof. Source: X 2086881493641568698; Cloudflare pay-per-crawl/monetization evidence; X 2084648084131242402 and Cloudflare Wallets, reviewed 2026-08-12

Portable extension packaging now has a concrete interoperability floor. Agent Plugins v1 is a working-draft specification for one inspectable directory with plugin.json, immediate-child Agent Skills under skills/, and an optional version-matched mcp.json. Kevin-Wiki should export or consume that shape only through a validator that enforces schema version, plugin-root path containment, per-component failure isolation, explicit environment placeholders, and the existing skill/MCP authority gates. The format makes distribution portable; it does not make an installed skill or server trusted. Source: X 2085398373511918022; Agent Plugins 1.0 specification, reviewed 2026-08-12

The harness itself must remain observable and improvable. Static maps such as evlog map can inventory entry points, score expected event/context/error/audit shapes, expose why a route is considered sensitive, emit JSON, and ratchet a baseline in CI. They do not prove that runtime events are correct. Skill tuning and production-harness post-training are similarly downstream experiments: run them against frozen held-out tasks and the real tool/sandbox/control-flow boundary, compare the incumbent, preserve rejected candidates, and promote only the exact passing policy or model-plus-harness tuple. A claimed percentage or a self-authored judge is never the proof. Source: X 2082568538397802671, 2084644880958066733, 2085495826638672109; evlog map, SkillTune and Applied Compute AC2 product evidence, reviewed 2026-08-12

Self-improvement is a governed state transition

The ordinary Kevin-Wiki loop improves the scaffold, not the model weights. For a run at iteration t, treat the operating agent as A_t = (θ, Σ_t), where θ is the selected foundation model and Σ_t is the inspectable scaffold: instructions, memory, tools, routing, control logic, permissions, and proof rules. A longer context, a better one-off answer, or an uncommitted plan changes session state; it is not durable improvement. A source review, accepted skill revision, workflow patch, routing update, or new verifier changes Σ_t only after it survives the run boundary as a digest-bound writeback.

Every persistent update therefore records six things:

1. the update target inside Σ;
2. the evidence or execution signal that proposed the change;
3. the candidate patch and its previous digest;
4. an acceptor independent of the proposer;
5. executable, retrieval, authority, regression, and rollback proof; and
6. the accepted next digest—or an explicit rejection that preserves Σ_t.

The critic is governed infrastructure. The worker that proposes a patch cannot silently weaken the checks that accept it. Evaluator evolution is additive or stricter by default; removing or relaxing a gate requires a separately reviewable rationale and human-visible audit trail. Improvement claims report a trajectory under a declared resource budget, including regressions, held-out transfer, cost, and repeated-run reliability where relevant. A best final score or one passing fixture is not proof that the mechanism improved.

The paper linked as a “self-improvement loop” tip does not specify such a loop. It argues, inside a formal model of generalization and a uniform-task assumption, that maximizing hypothesis weakness can generalize better than minimizing description length; its reported experiments concern binary arithmetic. The bounded harness hypothesis is to prefer a candidate rule that commits to no more than the evidence requires, then compare it with simpler and incumbent rules on held-out tasks. Do not ask a model to “incorporate the paper,” present its 1.1–5× result as agent evidence, or convert “weakest” into a vague prompt adjective. Source: X 2084414685701632406; Michael Timothy Bennett, “The Optimal Choice of Hypothesis Is the Weakest, Not the Shortest”, v4, reviewed 2026-08-12

Friction is first-class evidence. A run may emit a small structured papercut when it encounters a dead-end tool call, broken link, misleading instruction, unnecessary manual step or missing capability. The report binds the run, attempted action, expected/actual state, evidence and suggested owner; it does not interrupt unrelated work or silently rewrite instructions. Recurrence and impact promote papercuts into the same source-interrogation and proof loop as other signals. Source: X 2075303919664734295, reviewed 2026-08-12

Model-weight consolidation is a separate, slower program. If the system later fine-tunes or distills θ, it needs its own data, consent, version, attribution, adversarial regression, and rollback contract; an ordinary wiki or skill writeback must never imply that model parameters changed. Source: Self- Improvements in Modern Agentic Systems: A Survey, sections 3, 6, 8, and 9; reviewed 2026-08-11

Execution semantics: graph, state, and actors

A filesystem-shaped interface is useful but cannot be the only execution substrate. Skills and context files should also load through a versioned virtual filesystem or object interface so an in-memory, remote, browser or sandboxed agent can use the same paths without inheriting the host filesystem. Every mount declares provenance, mutability, lifetime, isolation and writeback; a virtual path is not permission to access the host. Source: X 2086946190914896228, reviewed 2026-08-12

Cross-session messaging carries a bounded handoff, not ambient transcript access. A message names the sending and receiving task, objective, relevant state, evidence/artifacts, unresolved decisions, requested action, authority and expiry; the recipient independently opens permitted artifacts and reports a receipt. This keeps parallel work composable without treating a summary as canonical memory or leaking an entire private history. Source: X 2085817074816070014; Claude Code cross-session messaging, reviewed 2026-08-12

The graph is executable topology, not a decorative mind map. Each node declares an input and output shape; each edge is either a deterministic transition or an explicit decision. Branches, joins, loops, and parallel regions are visible in the run plan. Agents may choose the next edge only at declared decision nodes, and the choice must be recorded as structured state. This retains the useful property of agentic graphs—agents can decide what happens next—without making control flow implicit. The reviewed graph artifact demonstrates implementation and QA running in parallel, joining, and then entering a decision gate with a rejection edge. Source: X/@Nek__12, 2026-07-18

State-machine and actor semantics make the graph durable:

• each run has explicit states such as planned, running, waiting, blocked, verified, and complete;
• transitions require events and guards, so a generated template or assertion cannot advance freshness by itself;
• connectors, object owners, workflow runners, and critics act as bounded owners of their state and accept typed events rather than mutating a shared global context;
• parallel branches are reserved for independent concerns and rejoin through a declared merge or decision node;
• loops have stop conditions, attempt receipts, and an honest residual gap.

This is the practical use of state machines and the actor model here: explicit ownership, event history, recoverable transitions, and inspectable choices—not framework ceremony. Source: X/@DavidKPiano, 2026-07-18

Trust topology: the brain survives its workers

The operating and proof graphs belong to a trusted control plane outside every replaceable execution environment. A worker may contain a checkout, shell, browser, dev server, local indexes, and transient run artifacts. It must not be the sole owner of the agent loop, canonical event history, source archive, approvals, credentials, policy, schedules, audit log, or writeback decision.

This corrects a tempting but unsafe shortcut: a persistent filesystem is useful execution state, not canonical brain memory. If the worker corrupts itself, the system that observes, retries, audits, or rejects that work must remain intact. Actors are one good way to give each long-lived agent serialized ownership, hibernation, schedules, and realtime connections; a database plus queues, durable objects, or a managed control plane can satisfy the same contract. The architecture requires observable ownership and recovery behavior, not a specific framework. Source: X/@NathanFlurry X Article, 2026-07-27; Source: Rivet Actors and Flue documentation, reviewed 2026-08-10

Execution ladder: capabilities -> virtual OS -> full worker

The harness and the execution environment are different choices. After choosing the harness, route each operation through the narrowest execution contract that preserves correctness, isolation, and recoverability:

Code Mode and OS interop must not be collapsed. Moving a database call or file lookup behind a named binding can shrink context and authority; it does not remove the need for a shell when npm, git, build tools, or existing coding-agent behavior depends on one. Conversely, a familiar shell does not entitle the guest to the host filesystem, raw credentials, or unrestricted network access. Bindings execute under host policy and expose only their validated inputs and outputs. Source: X/@NathanFlurry article and self-thread, 2026-06-29; Source: Secure Exec Code Mode, reviewed 2026-08-11

Escalation is a recorded state transition, not an invisible fallback. The run receipt names the selected tier, implementation and version, required capabilities, trust/isolation boundary, mounts, secret path, resource limits, unsupported operation that triggered escalation, workspace/state transfer, provider cost, and resulting proof. The logical workspace may survive across tiers, but canonical history, approvals, policy, audit, and writeback stay in the trusted control plane. Start small only when the declared threat model allows it; do not trade away correctness or isolation for a vendor benchmark. Source: agentOS versus Sandbox, Security Model, and Limitations, reviewed 2026-08-11

Enterprise cloud-agent scale is a control-plane problem

DoorDash's Flux announcement is strong scale evidence for moving agent work off individual laptops: the company reports 130,000 engineering tasks in one month and more than 25,000 code reviews per week while retaining enterprise execution and access guardrails. Those numbers remain announcement claims until the promised technical article is publicly inspectable, but the architecture signal is already useful. A cloud worker fleet needs one identity/policy plane, task-scoped environments and credentials, queueing and concurrency budgets, repository/context preparation, artifact and log custody, idempotent retries, quality feedback, and revocation. “Run it remotely” is not the product.

Kevin's execution ladder therefore stays intact: scale full workers only after the workflow manifest, authority, inputs, proof, and writeback are frozen. The code.pr-review workflow is the first relevant load shape, but DoorDash's volume does not justify copying its private platform or turning a scale metric into a local requirement. It sets a benchmark for the future Agent Machines control plane and reinforces enterprise security as a first-class product surface. Source: X/@AIatDoorDash, 2026-08-11; DoorDash's adjacent production code-review account and agent-platform architecture

Source adapters

Every adapter emits the same source-analysis shape:

• immutable source revisions and content hashes;
• links, attachments, thread/reply relations, and platform metadata;
• atomic signals for every available message or item;
• candidate stable-object bindings;
• cross-source correlations;
• completeness state and explicit blockers.

Source identity and connector readiness are separate. A source can remain a desired, queryable part of the graph while its collector is setup-gated. npm run status labels runnable overdue work NEEDS ATTENTION; it labels a missing token, browser session, runtime, or adapter CONNECTOR SETUP and names the exact dependency. Neither state permits a false freshness advance.

The agent-session adapter indexes Codex, Cursor, and Claude JSONL stores in place. It records provider, stable session identity, workspace hint, byte size, modification time, and fingerprint without copying the source corpus. Selected tasks stream into private message revisions and candidate signals; indexing is discoverability, replay is extraction, and neither is accepted learning until a review receipt names the owner and the owner changes. Tool traffic and hidden reasoning are not silently promoted as facts.

Analysis contract v4 makes the message—not merely the transcript file—the smallest identity-bearing evidence unit. Every available message receives a stable provider/session/trace/message source ID, while one synthetic snapshot retains the content-bound session anchor. A lineage review receipt binds the sorted source IDs, source-revision IDs, and extracted signal IDs into one exact digest. Identical repeated messages keep separate identities; retries may deduplicate one stable event ID but may never collapse two distinct messages by matching text. A changed, inserted, or removed message changes the digest and reopens only that review lineage.

The Discord adapter accepts JSON, JSONL-shaped objects, and existing Markdown capture tables. Markdown summaries remain partial because they cannot prove original message bodies, attachment bytes, or edit/delete history. The Hacker News adapter reads official feeds and bounded first-level comments. X and URL adapters retain their richer platform-specific enrichment while entering the same interrogation contract.

Agent interfaces

Agents can use the system without understanding repository internals:

npm run brain -- status
npm run brain -- sessions index
npm run brain -- sessions list --limit 50
npm run brain -- replay sessions --id <agent_session_id>
npm run brain -- workflow route "mine this agent conversation"
npm run brain -- workflow plan source.absorb agent_session:<id>
npm run brain -- workflow begin source.absorb agent_session:<id>
npm run brain -- workflow receipt <run-id>
npm run brain -- workflow doctor
npm run brain -- loop plan source.interrogate
npm run brain -- analyze discord --input capture.json
npm run brain -- hn fetch --feed best --limit 12
npm run brain -- doctor

Public read interfaces:

GET /api/system
GET /api/system?view=goals
GET /api/system?view=loops
GET /api/system?view=objects
GET /api/system?view=sources
GET /api/system?view=workflows
GET /api/system?view=sessions
GET /api/system/workflows/route?q=<request>&invoker=user|agent
POST /api/system/workflows/plan
GET /api/system/sessions?provider=codex&workspace=Kevin-Wiki&since=2026-07-01&until=2026-08-12
GET /api/system/agent
GET /api/system/hacker-news?feed=best&limit=12

GET /api/system?view=sessions is the public aggregate projection. The nested GET /api/system/sessions route is a private, no-store catalog that requires the global wiki unlock and omits transcript paths and storage references from every response.

What Kevin can do now

These are projections over the same IDs. The website does not own a second copy of the architecture, and the agent APIs do not bypass the review or authority contracts shown to Kevin.

Point an old agent task at the wiki

The fastest local operator path is now visible:

1. Globally unlock the wiki on the local device.
2. Open /system/sessions.
3. Filter by provider, project/workspace, date range, first-prompt text, task ID, or current learning state.
4. Copy the exact replay command for one task, or copy the bounded cohort prompt for a missing month or whole project.
5. Review the resulting candidate changes in Daily Brief; accepted evidence still passes source review, owner writeback, and affected proof.

The page displays four deliberately non-equivalent states:

The private API returns this same catalog with Cache-Control: private, no-store. The public System API continues to expose only totals, coverage, and replay counts. This split makes conversation history navigable without making private prompts or filesystem topology part of the deployed knowledge graph.

The conversational path remains portable across agents:

1. Finish the old task, or make clear that only its completed turns may be reviewed.

2. Copy its Codex URL or native task ID.

3. Open a Kevin-Wiki task and paste:

   Use /learn-from-projects to absorb completed task <task-url-or-id>.
   Read every completed turn and the tool outputs, artifacts, repository diff,
   and tests that support a learning. Correlate it with its project and current
   wiki owners. Show the proposed owner changes in Daily Brief; do not create a
   page for the conversation and do not call it learned before review and proof.
   

4. The wiki task resolves the task in the app catalog, matches its local or exported evidence, replays it privately, and shows the candidate owner diffs.

5. An accepted proposal patches the existing project, instruction, workflow, skill, design rule, tool route, decision, concept, or postmortem. The source receipt, owner diff, affected tests, index rebuild, and retrieval check prove the change.

For a Codex task, copy the whole task URL or its native task ID, or ask an agent to find the task by title/project with the Codex task catalog. The CLI extracts the final task identifier from a pasted URL; that native ID and the generated agent_session_* ID are both valid replay selectors. For ordinary local history, refresh the in-place index and narrow the task catalog by provider, date, workspace, or first-prompt text:

npm run brain -- sessions index
npm run brain -- sessions list --provider codex --since 2026-07-01T00:00:00Z --until 2026-08-01T00:00:00Z --workspace Kevin-Wiki --query "wiki rebuild" --limit 50
npm run brain -- sessions list --query "Fieldwork" --json
npm run brain -- sessions list --query "Fieldwork" --include-traces --limit 100
npm run brain -- replay sessions --id <codex-task-url-or-id-or-agent-session-id>
npm run brain -- replay sessions --since 2026-07-01T00:00:00Z --until 2026-08-01T00:00:00Z --workspace Agent-Machines --limit 25
npm run brief -- compile-analysis .brain/analyses/<analysis_id>.json

For an exported or separately stored authorized task, add it without replacing the standard stores:

npm run brain -- sessions index --path /absolute/path/to/export --provider codex
npm run brain -- replay sessions --path /absolute/path/to/export/task.jsonl

Use --provider cursor or --provider claude for those transcript shapes. A single indexed file can also be replayed with --path /absolute/path/file.jsonl. The current machine inventory is 546 top-level conversations—507 Codex, one Cursor, and 38 Claude—represented by 2,799 evidence trace files referencing 105.3 GB in place. The additional 750 subagent traces and 1,503 workflow traces retain their parent lineage and separate provenance; they are auditable delegated work, not 2,253 extra human conversations.

The exact compilation state captured on 2026-08-12 is 2,789 replayed evidence traces and 10 pending traces across 55 workspace hints. Pending here means a recently modified or active trace, not an unread historical corpus. Contract-v4 migration assigned 155,761 message identities across 5,369 agent traces and added 5,369 content-bound session snapshots. The subsequent exact admission audit bound 80,589 currently pending agent-session source identities and 77,894 signals into 538 lineage receipts; newly changing traces reopen by digest. The local evidence span is 2026-07-20 through 2026-08-12. Workspace hints make project cohorts selectable, but they are discovery metadata rather than proof that every project decision was captured. The /system?view=sources#sources panel publishes these aggregate coverage and replay counts without exposing private titles, prompts, or filesystem paths.

Replay writes private, content-bound analysis under .brain/; it does not add thousands of transcript pages. brief compile-analysis filters session scaffolding and opens a private, explicitly partial candidate-review proposal. It preserves the original transcript and tool/attachment expansion blocker and does not call the candidate learned truth. The source.absorb@1.0.0 workflow binds durable learnings to stable IDs in brain/objects.json, compares them with current owners, and requires a validated reviews/source-signals/*.json decision before an accepted change updates the existing project, instruction, concept, skill, workflow, design rule, or postmortem. brain doctor, affected subsystem doctors, the wiki index, and retrieval checks prove the writeback. Thus Kevin can point at one important conversation immediately, replay a date/provider/project cohort, or let an automation drain the backlog without flattening chat logs into the public wiki. A safe prompt from any Codex task is: Absorb Codex task <task-id> into Kevin Wiki. Expand completed turns and tool evidence, show candidate owner changes in Daily Brief, and do not write canonical pages without the source-review and proof gates.

For a whole project, use the private library or list its parent conversations by workspace and date, save the selection, and then replay the completed task IDs in bounded batches. sessions list defaults to parent conversations. Use --include-traces only when the learning depends on delegation, or use --kind to inspect one trace class. A native Claude task ID expands every matching parent/delegated trace; a generated agent_session_* ID selects one exact file. Each task must be correlated with its actual repository diff, artifacts, tests, and current project owner; similar prompts, forks, and delegated traces are separate evidence revisions rather than automatic duplicates. The durable result normally updates an existing project, instruction, workflow, skill, design rule, or postmortem. It does not create one wiki article per conversation.

For the absent-month recovery, Kevin can issue one cohort instruction instead of opening every task manually:

Use /learn-from-projects to inventory every completed Codex, Cursor, and Claude
task for every project from 2026-07-01 through 2026-08-12. Reconcile the Codex
app catalog, local provider stores, project repositories, commits, PRs,
artifacts, and tests. Produce a coverage ledger with acquired, active,
remote-only, exported, replayed, reviewed, integrated, held, and blocked state;
then absorb completed tasks in bounded project batches with per-task provenance.

That cohort is complete only when every discovered task has a source identity and coverage state, every retained signal is bound to a stable owner or a named blocker, and every accepted learning has a validated review, writeback, and proof. A file count or catalog title is not completion.

An operator can also initiate the route conversationally. In a dedicated Kevin-Wiki task, say: Find my completed Codex task about <title or project>, show me the matching task IDs, and absorb the one I select through source.absorb. In an old completed task, copy its native task ID from the task URL and give that ID to the wiki task. Do not replay the currently active task as complete; finish it first, or inspect its completed turns explicitly while keeping the active turn and unexpanded tool evidence blocked.

Current coverage is explicit rather than implied. The local index reaches active and archived Codex transcripts plus the Cursor and Claude provider files present on this Mac from 2026-07-20 onward. It does not prove coverage of remote-only or deleted tasks, earlier provider history, ChatGPT conversations, attachments, or full Cursor chat databases. Those need an authorized provider export or connector and remain a named acquisition gap until indexed. The Codex task catalog is useful discovery metadata, while the local transcript or task-reader output remains the evidence source.

A 2026-08-12 reconciliation of the 50 most recent app-catalog Codex tasks found local JSONL evidence for all 50 native task IDs. This proves the normal recent paste-a-task-link path, not exhaustive historical coverage; older catalog queries and the July 1–19 gap remain separate acquisition work.

Public agent sequencing and current boundary

The on-domain agent is a projection over the same public contracts available to other harnesses; it is never the only or strongest route to a capability. The release sequence is typed primitives -> shared context -> on-domain agent -> governed proactivity:

The shipped producer meets the admissibility contract for proposal-only work: one receipt binds the principal, trigger revision, objective, source/object scope, capability set, time/cost/attempt budget, idempotency key, read-only default, null mutation digest, approver, validation set, emitted suggestion IDs, audit identity, retry/dead-letter path, and revocation/rollback. Runtime attestation exposes scheduler readiness and a sanitized last-run receipt. On 2026-08-12 the daily schedule was active and ready, while the latest completed run was manual; the first scheduler-triggered receipt remains open proof. The same package is callable from supported external harnesses, so the built-in surface does not create a weaker proprietary fork.

Machine-readable delivery is tested route by route. A live 2026-08-11 replay found that Vercel documentation and changelog routes honor Accept: text/markdown, while the homepage and Plugin page still returned HTML. Kevin-Wiki therefore publishes explicit JSON/OKF/Markdown routes and must not infer content negotiation from an origin-wide claim. Source: X/@rauchg, 2026-07-16; Vercel Agent documentation; live route replay]

Portable memory interface boundary

Any Codex, Claude Code, Cursor, Hermes, or future adapter should eventually be able to perform five job classes without learning repository internals: bounded recall, provenance-bearing remember, owner/entity resolution, evidence synthesis with visible cost and gaps, and idempotent retirement. The house contract must also expose authority/source scope, visibility, degraded retrieval, evidence, budget use, and self-correcting errors.

The portable write interface is implemented for the declared persistent single-writer boundary. /api/system remains public and read-only. The separate bearer-authenticated /api/memory endpoint implements remember, bounded scoped recall, and evidence-preserving retirement over the same @kevin-wiki/brain-runtime contract. Authority is derived from server configuration, source scope is explicit, every claim binds provenance and a known object, repeated idempotency keys replay, and stored claims remain proposed. They enter canonical owners only through $absorb-sources and a validated review receipt.

The installed briefd LaunchAgent is that persistent single writer. It binds to loopback, reads a mode-0600 token that is absent from its plist, restricts source scope to repo:kevin-wiki, denies public writes by default, fsyncs every ledger event, and opens a proposal-only Daily Brief card for every remember or retire operation. MemoryHttpClient gives Codex, Claude Code, Cursor, Hermes, and other TypeScript adapters one contract. npm run memory:conformance proves the installed service after restart. Multi-instance storage, pushed context, portable synthesis, and the shared usefulness benchmark remain future memory capabilities, not hidden claims about the shipped write boundary.

curl -X POST https://<host>/api/memory \
  -H "Authorization: Bearer $KEVIN_WIKI_MEMORY_TOKEN" \
  -H "Idempotency-Key: <stable-operation-key>" \
  -H "Content-Type: application/json" \
  --data '{"operation":"remember","sourceScope":"repo:example","claim":"...","objectIds":["architecture:brain-system"],"visibility":"private","provenance":{"sourceId":"agent.sessions","revisionId":"...","storageRef":"...","contentHash":"<sha256>"}}'

Protocol conformance and usefulness remain separate release gates. Shape, privacy, source isolation, idempotency, write→read→retire, restart durability, and human-review projection now pass the installed conformance gate. The next sealed synthetic corpus measures know-to-ask, false fires, push precision/recall, provenance writeback, Codex/Claude/Hermes continuity, and injected-token volume. Source-isolation violations gate at zero. Source: GBrain MEMORY_VERBS v1 and BrainBench at 75fae742, reviewed 2026-08-11

The portable $absorb-sources skill tells Codex, Claude Code, Cursor, and other skill-aware agents how to run capture, correlation, object interrogation, writeback, and proof. The package @kevin-wiki/brain-runtime exposes the same contracts to TypeScript callers.

Harness adapters, not harness lock-in

The brain owns stable evidence, object, workflow, state, authority, and proof contracts. Codex, Claude Code, Cursor, OpenCode, Hermes, or a future runtime is an adapter and execution surface—not the owner of Kevin's memory.

Choose or change an execution harness by harness-task fit and actual operator fluency. A harness profile must inspect:

1. context and interruption/continuation behavior;
2. memory across tasks and its retrieval rules;
3. tool, CLI, MCP, and application-action fidelity;
4. open-standard adherence and migration cost;
5. model selection, routing, cache, and endpoint flexibility;
6. remote session access and long-running survivability;
7. observability, debugging, rollback, and self-recovery;
8. hackability versus guardrails and failure blast radius.

Buy a guarded turnkey harness for sensitive work when its built-in fit is strong. Customize an extensible harness when repeated, measured gaps justify it. Build a harness layer only when the behavior is the product, the data/authority boundary requires ownership, or evaluated performance warrants the operating burden. A multi-model planner or verifier is an optional capability selected by the job; it is not a permanent tax on every run. Source: X/@thealexker, “The architect's guide to harness engineering,” 2026-07-13; Source: X/@EXM7777, “How to Build a Frontier Agent OS,” 2026-07-01

Case-conditioned harness assembly

One global harness is too blunt for every case, but unrestricted adaptation would make the system impossible to inspect. Kevin-Wiki therefore models a run as a stable default scaffold Σ* plus an explicit, temporary case delta δ(x). The delta may alter only six named surfaces:

The router may derive δ(x) from information visible before execution, the goal and authority envelope, and replayable successes, failures, and global patterns from prior runs. It may not condition on the current case's hidden label, verifier result, or post-outcome feedback. If retrieval supplies no relevant evidence, the safe result is the unchanged default—not an invented specialization.

Every delta is recorded in the run receipt with the base digest and evidence IDs. It expires with the run. A successful specialization can later propose a change to Σ*, but it reaches the durable owner only through the persistent improvement gate; usage is not writeback. Selection stays correctness-first: cost can enforce a declared feasibility ceiling or break an accuracy tie, but a cheaper failing route does not outrank a correct one. This adopts MemoHarness's useful six-surface and case-adaptation model while retaining Kevin-Wiki's harder provenance, leakage, acceptance, and rollback boundaries. Source: MemoHarness, sections 2–4 and Limitations; reference implementation at e7da7728b6a8020f7e13c890d50df32ad6f2710c, reviewed 2026-08-11

Dynamic workflows are therefore compiled case deltas, not self-authorizing new systems. A Claude Code workflow, Hermes skill, Raft room, Buzz workspace, Horizon program, Replit company agent, or other shared agent surface may propose topology, roles, state, and learning rules. The trusted control plane must still freeze identity and access, source and object provenance, tool authority, budgets, checkpoints, approvals, join/stop semantics, correction, audit, portability, and recovery. Shared rooms can improve coordination and context; they do not become the canonical source archive or gain durable writeback from participation alone. Learning from outcomes proposes a digest-bound owner change and passes the same independent acceptance gate as any other system mutation. Source: recovered X Articles “A harness for every task,” “Hermes Agent Masterclass,” “The Next Horizon in Agents,” “The Self-Driving Company,” “How to build your first team of agents,” and “why we're buzzing,” reviewed 2026-08-12

Durability and redundancy

Generated surfaces carry a digest of their authored inputs. Doctors verify cross-references, owner paths, projection freshness, and review validity. Private source bytes are never required for the public website to render an honest summary of source readiness and known gaps.

Portable knowledge projection

Interoperability is an outward projection, not the canonical storage model. The evidence graph needs revisions, correlations, stable-object bindings, review decisions, authority, and receipts that OKF v0.2 does not attempt to standardize. Canonical Markdown and the four authored registries therefore remain the write authority. A deterministic projector emits only public owners as an OKF v0.2 tree with ordinary Markdown links, progressive indexes, source resources, producer metadata, and a sanitized log.

The same fail-closed privacy policy used by search, graph, sitemap, and assets runs before serialization. private: true wins over a public object entry. The operational log and private evidence never enter the bundle. Production serves only the generated tree at /api/okf; llms.txt advertises the root. Bundle conformance is tested independently of claim quality, and missing claim-level source normalization remains visible rather than being mislabeled as verification. Source: OKF v0.2 SPEC at 3fcbb9f; Kevin Wiki OKF exporter and first full replay, 2026-08-11

Product program

Discord instructions identify five active product owners rather than dozens of orphan notes:

1. Fieldwork: installable design IDE, design-system absorption, agent chat, selectable DOM/version states, DialKit-style controls, and inspectable motion.
2. Agent Machines: persistent workers with tools, memory, schedules, API, web UI, secure provisioning, streaming, artifacts, and observability.
3. Daily Brief: review and exact approval for non-urgent source and automation proposals.
4. Local Search CLI: structured local-browser research without a hosted search dependency, packaged for agents and self-cleaning.
5. Agent Broom: standalone agent-callable process, browser, port, and workspace cleanup with dry-run and proof.

Each project advances through project.advance; source saves update its owner through source.interrogate. A project page without a current acceptance slice is visible debt, not evidence that the application exists.

Public system surface

/system is the control-room projection. It shows the graph, goals, loops, sources, stable objects, implementation status, and agent interfaces without a password. Its language distinguishes ready, partial, blocked, specified, implemented, verified, and shipped. It never equates page count with learning. Every panel also has a server-readable ?view= URL such as /system?view=workflows#workflows or /system?view=sources#sources; this keeps the hierarchy shareable and usable when client-side hydration is unavailable.

The compact interaction model is selection-first rather than chat-first. The top-level hierarchy stays visible as goal -> loop -> workflow -> owner; the selected workflow then assembles its declared knowledge, skills, capabilities, sources, proof, and writeback targets in one detail surface. List, graph, timeline, and review modes are alternate projections of the same IDs, not separate navigation ontologies. URL-backed filters, peek/detail panels, contextual commands, hidden-item counts, and viewport-preserving timeline zoom keep dense cohorts understandable. Every command still routes through the workflow registry and its authority contract, and every reviewed state binds to an exact source or proposal hash. This adopts Circle's compact interface grammar without inheriting its mock agent, generated diffs, seeded checks, or in-memory state. Source: X/@ln_dev7 2084328572160704943; ln-dev7/circle@778598503e680b4c658d694dd9f65351ee48b3d3, reviewed 2026-08-12

/system/sessions is the private operator extension of that control room. It keeps the same visual language and shows captured, extracted, reviewed, and integrated conversation cohorts with project/date/provider filters. The parent /system page stays public and links to the gated task library without serializing its titles, previews, native IDs, or local paths.

Timeline mode is explicit. Operational mode is the default for goals, runs, workflows, sessions, sources, reviews, and proof: it preserves filters, exact events, status, selection, and list/detail actions. Narrative mode is an optional projection for one selected project, person, product, or company and may use a sparse media-rich rail to explain how that owner evolved. Both modes consume the same event/source IDs and link back to literal owner history; narrative motion never becomes the only retrieval path. An embedded rail must release host scrolling at its boundaries, scope keyboard capture to focus, provide a mobile/list equivalent, and settle without choreography under reduced motion. Lifeline is the pinned reference for this presentation grammar, not a control-plane or registry dependency. Source: X 2085118669609472397; evilrabbit/lifeline@8ddbb3d, local video and source review, 2026-08-12

---

Timeline

• 2026-08-12 | Added proof-bound receipts for real source-compile and cross-project-learning runs and a connector-readiness registry that distinguishes runnable stale work from credentials, sessions, runtimes, or adapters that still need setup. Active research jobs are current and remain proposal-only. Source: .brain/automation-runs/; brain/source-connectors.json; npm run status

• 2026-08-12 | Shipped the global-password-gated Agent Conversation Library at /system/sessions plus a private no-store JSON API. It filters 546 local parent conversations without exposing source paths, distinguishes captured/extracted/reviewed/integrated state, retains delegated-trace counts, and provides exact replay, export, and missing-month cohort prompts. The UI type check, state-contract tests, authenticated/unauthenticated HTTP checks, and a live WCAG A/AA browser audit pass. Source: local agent-session index, replay checkpoint, source-review records, and browser proof .brain/artifacts/ui/private-agent-session-library.png

• 2026-08-12 | Migrated agent-session analysis to message identity contract v4 and exact lineage receipts. The migration preserved 155,761 distinct message identities across 5,369 traces; the admission audit bound 538 pending lineages without publishing transcript bodies or creating conversation pages. Identical text now correlates but never erases message identity. Source: local agent-session corpus; message-corpus-20260812.json

• 2026-08-12 | Split control-room time into operational and optional narrative projections over the same object/source IDs. Lifeline supplied the continuous-rail, responsive, gesture-ownership, and reduced-motion reference; its live registry/source drift, absent tests/CI, and failing lint keep it a pinned presentation reference rather than system authority. Source: X 2085118669609472397; evilrabbit/lifeline@8ddbb3d

• 2026-08-12 | Refined the public control-room contract with a selection-first compact hierarchy and one-ID/many-projections rule. Circle supplied source-proven list/filter/timeline/peek/command/review interaction patterns; its mock data and proof surfaces were explicitly rejected as architecture. Source: X 2084328572160704943; ln-dev7/circle@778598503e680b4c658d694dd9f65351ee48b3d3

• 2026-08-12 | Added provider-aware in-place indexing and private replay for Codex, Cursor, and Claude agent conversations; separated 535 top-level conversations from 2,767 evidence traces referencing 103.0 GB without copying; documented the review-gated path from a selected task into stable owners. Parent conversations, subagent traces, and workflow traces now retain distinct source identity and lineage. Added versioned workflow manifests, deterministic routing, invocation boundaries, run plans, workflow/session APIs, and the compact workflow registry UI. Source: local agent-session stores; brain/workflows.json; @kevin-wiki/brain-runtime

• 2026-08-12 | Added DoorDash Flux as held enterprise-scale evidence for the execution ladder: reported 130k monthly engineering tasks and 25k weekly code reviews strengthen the need for remote worker identity, access, concurrency, retry, evidence, and revocation controls, but do not supersede workflow manifests or prove the announcement's numbers independently. Source: X/@AIatDoorDash 2087285008906240193; adjacent DoorDash engineering articles

• 2026-08-12 | Hardened the workflow kernel after an adversarial routing audit found that substring matching let the short term pr fire inside surprise, prepare, and improve. Routing now uses token/phrase boundaries, rejects exact-handle collisions, selects semantic versions deterministically, and enforces user-only invocation during direct planning as well as routing. Plans bind route reason, invoker, authority, inputs, progressive bindings, stages, proof, writebacks, manifest digest, registry digest, and a run-ID-bound full-plan digest. The same read-only router and planner are now public HTTP contracts. Source: packages/brain-runtime/src/workflow-registry.ts; ui/src/app/api/system/workflows/

• 2026-08-12 | Added the private agent-analysis-to-Daily-Brief bridge and the public read-only proactive brief. Replayed one July Codex task into 20 private candidate signals, opened an explicitly partial review proposal, and kept tool/attachment expansion and owner review mandatory. /api/system/agent now derives visible suggestions from the same public projection with mayAct: false. Source: .brain replay receipt; apps/briefd/src/analysis-brief.ts; ui/src/lib/public-agent.ts

• 2026-08-12 | Replaced the UI-only proactive brief with a portable v2 governed-agent contract shared by the public API, System UI, and active daily system-health producer. The machine-readable receipt now binds identity, trigger, objective, scope, capabilities, budgets, idempotency, exact approval, validation, audit, recovery, and revocation while preserving an empty mutation scope. Scheduler readiness and the latest sanitized run are visible without exposing private output paths. Source: packages/brain-runtime/src/public-agent.ts; ui/src/lib/public-agent-runtime.ts; apps/briefd/src/system-brief.ts

• 2026-08-12 | Implemented, installed, and restart-verified bearer-authenticated portable memory proposals: server-derived authority, provenance and stable-owner binding, idempotent remember/replay, scoped recall, evidence-preserving retirement, and a hash-chained private ledger. The persistent single-writer now runs inside the Daily Brief LaunchAgent, source isolation and public-write denial are server policy, each event is fsync'd, and every write appears as a proposal-only review card. The portable client and installed conformance command pass across write, replay, recall, denial, retirement, restart, and retained history. Multi-instance coordination, pushed context, synthesis, and cross-harness usefulness evals remain separate future capabilities. Source: packages/brain-runtime/src/memory.ts; packages/brain-runtime/src/memory-client.ts; apps/briefd/src/server.ts; npm run memory:conformance

• 2026-08-12 | Reconciled six recovered dynamic-workflow, persistent-agent, and shared-workspace articles: they may compile case-specific run topology, but identity, authority, provenance, canonical custody, learning acceptance, portability, and recovery stay in the trusted brain control plane. Source: compiled from X bookmarks 2054564519280804028, 2061907337154367865, 2077767352431882355, 2077802290304684404, 2078476892127318295, 2080056638820450400

• 2026-08-12 | Added the owned retrieval promotion gate: exact, semantic, filtered, cross-source, freshness, and ACL cases; lexical/semantic/fused/ reranked comparisons; relevance, leakage, latency, memory, update-cost, and recovery receipts. Source: Elastic current docs and source; Atuin current source; saved BM25, ES|QL, and Atuin signals

• 2026-08-12 | Separated ontology, knowledge-base, and operating-brain semantics and reconciled Cerebras Knowledge plus current GBrain with the evidence/object/workflow/proof architecture. Retrieval databases remain projections, not canonical authority. Source: Cerebras Knowledge; garrytan/gbrain@fc310db; X 2078212601230872816

• 2026-08-12 | Re-audited Nia Vault as an external source/retrieval adapter rather than canonical brain custody. Kept its filesystem-source, generated-Markdown, schema, ingest/sync/lint/dream, and scheduled-improvement signals while requiring local immutable evidence, permissions/processors, replay, export, deletion, and owner-level compilation. Source: X 2043765452959109603; Nia docs; nia-wizard@0.1.34

• 2026-08-11 | Defined the public-agent release sequence. The later read-only proactive brief satisfies visible suggestion/discovery only; proactive action remains unshipped until identity, authority, approval, idempotency, validation, audit, recovery, and revocation are proven. Source: X/@rauchg; current Vercel Agent, Plugin, MCP, and live Markdown-route replay

• 2026-08-11 | Defined the portable five-job memory interface boundary and recorded the honest gap: public reads exist, while authenticated remember/retire, pushed context, and shared Codex/Claude/Hermes memory benchmarks remain unbuilt. Source: GBrain MEMORY_VERBS v1 and BrainBench at 75fae742

• 2026-08-11 | Added the deterministic public OKF v0.2 projection boundary: richer evidence, object, review, and receipt state stays canonical, while privacy-filtered concepts and indexes are portable through /api/okf. Source: X/@GoogleCloudTech; GoogleCloudPlatform/knowledge-catalog@374e0bc4; local conformance replay

• 2026-08-11 | Defined the compounding asset as the inspectable production system—stable institutional knowledge, workflows, capabilities, authority, and proof—rather than the raw source pile or generated code. Source: X/@rauchg; Open Agents repository audit

• 2026-08-11 | Added bounded case-conditioned harness assembly: a stable default plus an inspectable D1–D6 run delta, frozen pre-outcome evidence, explicit leakage boundaries, correctness-first selection, expiring run state, and digest-gated promotion. Source: X/@omarsar0; arXiv:2607.14159v1; HowieHwong/MemoHarness

• 2026-08-11 | Classified Kevin-Wiki's ordinary learning loop as governed scaffold improvement, separated persistent updates from transient session state, and required proposer/acceptor separation, monotone evaluator changes, digest/rollback proof, and trajectory-under-budget evaluation. Source: X/@omarsar0; arXiv:2607.13104v1

• 2026-08-11 | Added the execution ladder beneath the harness: named capabilities/Code Mode, virtual OS, and full Linux worker, with explicit escalation and a tier-bound run receipt. Preserved the security, cost, and fault-tolerance claims as held where current sources do not prove them. Source: X/@NathanFlurry article/thread; current agentOS and Secure Exec primary sources

• 2026-08-10 | Restarted from main after proving that the prior X review measured accounting rather than knowledge integration. Established the four authored registries, shared Discord/Hacker News analysis contract, portable skill, CLI/API/UI projection model, and evidence-to-writeback completion rule. Source: User request and local audit, 2026-08-10

• 2026-08-10 | Made the graph execution model explicit: typed transitions, agent-owned decision nodes, state-machine guards, actor-like ownership, visible joins, and bounded loops. Source: X/@Nek__12; X/@DavidKPiano

• 2026-08-10 | Split memory into source archive, compiled wiki, user/interaction memory, and session/run state; made learning goal-shaped and output-closed; and added an agent-neutral harness selection profile. Source: X/@hwchase17; X/@mem0ai; X/@thedankoe; X/@thealexker; X/@EXM7777

• 2026-08-10 | Added an evidence-to-capability promotion path from run traces through probationary and active skills, with triggers, boundaries, verification, reliability history, fallbacks, and explicit heuristic-not-causal limits. Source: X/@dair_ai; arXiv:2607.16621

• 2026-08-10 | Added the trust topology: the control plane and durable brain own loop state, history, authority, credentials, audit, schedules, and writeback while replaceable workers expose scoped execution and return events/artifacts. Source: X/@NathanFlurry X Article; Rivet Actors/Flue documentation