What the service holds, and how an agent reaches it.

Memories and facts

A memory is what one agent believes. A fact is what the project vouches for.

remember writes a memory: no schema, no evidence, and allowed to be wrong. A fact carries a closed topic set and a provenance, and when it says it is confirmed it must point at evidence. A memory that proves durable is promoted, and the expensive schema is paid once, later, only for what turned out to matter.

Memories are one table with a kind, and the kind carries the retention rule: scratch for the current turn is deleted, a standing instruction is kept until it is revoked. The same words remembered again are counted rather than stored twice, and nearly the same words are kept with a hint naming the likely twin.

• visibility: a memory for the whole project, for its writer only, or for one team
• anchors: a memory can name the files and symbols it is about, and recall can ask by file
• citations: a fact or a document cites facts, memories, decisions and documents in its scope; withdrawing one marks everything resting on it
• credentials are not kept: published key and token shapes are replaced by [redacted:<family>] before anything is stored

Recall

Words and a vector, ranked by the engine in one read.

recall reads text, filters and links together and returns one order. A search with words and a vector is one read per family that the engine ranks by both at once, and every hit says which of the two found it. The families are combined by each hit's position, never by scores that belong to different collections.

Every hit carries a one-line summary with its age and size, so a page of hits says which are worth opening; read opens up to 25 records whole. A record that does not exist and one outside where the caller may read come back the same way.

• recall with witness: true keeps what it showed, and recall.replay answers each hit as it was seen, beside the version it holds now
• cache.store keeps a model's answer against the question's vector for a lifetime the caller names, at most thirty days; cache.lookup reuses it only above a similarity the caller names

Coordination

Sessions, claims and handoffs, instead of a lock file.

Every call is attributed to a session: one run of one agent, with its host, client, model and framework. A project is its folder — an agent sends the folder it works in, and the nearest declared folder decides the group and the project.

A claim is a bounded hold that nothing renews. task.handoff moves a task to another live session in the same scope in one change, so nobody can take it in between, and the log keeps who handed it to whom and why.

• session.heartbeat is sent while an agent thinks; only that session may report itself alive
• status hands back the newest context snapshot an agent wrote, so it resumes after a compaction
• a session.start repeated on a connection that still holds the session answers with that session instead of orphaning it

Delivery

Goals that need evidence, checklists that gate a phase.

A goal is judged criterion by criterion with goal.achieve, and each criterion must point at evidence. A checklist's header is what makes it a gate: which phase it guards, which flow it belongs to, whether it was written before that phase, and why rows do not apply. Counts are derived from the rows, never stored.

A release is a record before it is an event. It is opened when the work starts and refuses to be cut while a surface or a change in its range is unaccounted for, or published without an authorization and a way back.

Identity and authority

The authenticated identity is the namespace.

Tenant isolation is a property of the credential rather than a filter somebody has to remember, so a bug in path handling cannot leak one tenant's records into another's answer. Every verb is judged against the caller's grants before it is carried out, on all three surfaces.

Roles are reader, writer and admin. Teams are named sets of people and agents inside one identity; a team grant can be a deny, narrowed to a group or project, and given an end. Every act of administration is recorded, including the ones that were refused.

• sign in through the browser with OAuth from Claude Code or Codex; a session renews itself and the refresh credential rotates on every renewal
• a replayed refresh credential withdraws its whole chain
• a passphrase is set by an administrator and replacing it revokes every login it minted
• an unavailable user plane is reported as retryable, never as a refusal

The verbs

Twenty-five in the contract, twenty-two carried.

The same verbs on MCP, REST and the command line: session.start, session.heartbeat, session.end, status, recall, recall.replay, read, remember, cache.store, cache.lookup, item.add, item.update, item.link, task.claim, task.handoff, goal.achieve, checklist.discharge, activity.log, release.open, release.record, release.transition and release.status.

Three are withheld and refused by name: changes.since, because no read yet reports the position it was answered at, and export and import, because the backup format they would read and write is not decided.