Yesterday, two of my agents held opposite beliefs about the same fact — at the same time, on machines twenty feet apart.

One session had verified an ssh route worked and I'd confirmed it myself. That same afternoon, a sibling session on another machine wrote the opposite into its memory: no route, permission denied, verified. Both notes said "verified." Both fed future sessions as truth. Whichever session you asked, you got a confident answer; the answer just depended on which machine you asked.

The same day brought two more incidents. A working memory file went to zero bytes while the tooling reported clean, and recall served up a stale copy of a long-fixed fact as if it were current. Three different incidents, one root cause: my agents' memory was a pile of mutable files with no notion of history, no way to detect disagreement, and no authority model.

So I built one. This is the spec, roughly as it runs today on the three machines at the ranch.

What it had to do

Four requirements, drawn straight from the incidents.

A correction from me lands once and can never be outvoted by a stale copy. Parallel sessions on parallel hosts cannot silently hold contradictory beliefs — the system detects, parks, and flags disagreement within minutes. Any surviving machine can rebuild everything. And the whole thing survives an AI-vendor swap: no model in any hot path, all state in plain text.

One thing it deliberately does not do: store facts. A fact — an IP, a route, an install — lives in exactly one canonical document, and memory carries assertions and pointers to it. One home per fact. Most memory systems rot because every recalled copy slowly diverges from reality; the fix is refusing to be the source of truth at all.

The design in one breath

Every memory event is one line of JSON, appended to a per-machine log, committed to git. Machines fetch each other's logs peer-to-peer over ssh — nobody pushes, there is no server. A deterministic Python fold reads the merged logs and materializes the views agents actually consume. Same logs in, same views out, on every machine, forever.

Five rules are constitutional. One writer per log file. Append-only — a belief change is a new event that explicitly supersedes an old one, never an edit. The fold reads committed git blobs, never the working tree; the hash chain guards what gets consumed. Resolution is explicit, never temporal — a later timestamp never wins an argument by being later, because clock skew across three machines is real. And no model anywhere in the fold, which is what makes replay possible and the system vendor-proof.

Contradictions park; they don't fight

The fold runs a rule pass — about 200 lines of plain Python, no AI. Opposing claims on one subject park both sides. Two different live assertions on one subject park all of them. Every agent sees a parked subject as UNRESOLVED, never as either answer, and I hear about it once.

That's the part I care about most. Yesterday's split-brain can still happen — two machines can still write opposite things during a network partition. It just can't happen silently anymore. Within one fetch-and-fold cycle, both claims are parked on all three machines and something tells me. I replayed the original incident as a drill; it parks everywhere in seconds.

Signed truth

Resolving a park is a human act. I sign a superseding event with an ssh key — the same ssh-keygen signing machinery the fleet already uses for its task bus, under a separate namespace so a signed task can never replay as a signed memory. Every machine independently verifies signatures at fold time and catches a forged signature string on its own — nothing gets trust because it looks signed.

The rule the fold defends: any unsigned event that contradicts a signed one parks and alarms. Agents cannot sign — the key is passphrase-protected in an encrypted vault, and that passphrase is the authority boundary. A compromised session can add noise; it cannot manufacture authority. For routine work I load the key into ssh-agent with an eight-hour expiry — authority delegated for a bounded window that revokes itself.

What an agent actually sees

Each machine folds the shared corpus into a generated index — the behavioral rules injected into every session, ranked by an explicit eviction order (my pinned items first, signed items next, correction history, breadth, recency last) under a hard size budget. Nothing hand-edits that file anymore; the writers that used to maintain it by hand stood down the day of the cutover. Fact lookups fetch the canonical home live; the copy is never the answer.

There's also a free feature that mutable memory stores structurally cannot offer: time travel. Because history is git and the fold is deterministic, I can replay the exact view any agent held at any past instant. When an agent does something strange on a Tuesday, I can see what it believed on that Tuesday.

The honest gaps

I wrote the weak points into the spec next to the strengths, because a guarantee you can't name is a guarantee you don't have.

The real one is durability. A write counts as done after a local commit — if a disk dies before any peer fetches, those events are gone. The window is seconds, and corrections get an opt-in sync flag that blocks until a peer confirms replication. Acceptable for lessons; not acceptable for corrections; hence the flag.

The signing bottleneck is the other one: all authority routes through me at a terminal. That's by design today and it will hurt at some point. A scoped, time-boxed delegation is sketched but not built — I'm not softening the "agents cannot sign" line until I'm sure the delegation can't be abused.

Proving it, and getting reviewed by a rival

Nothing here counted as done until it passed a drill against a real three-node mesh: the original split-brain replayed, a network partition, a kill mid-write, a rewritten-history attack, byte-identical folds on all machines, forged signatures.

The drills pay their way. The newest one — added to prove that lesson revisions chain explicitly — caught a real bug on its first run: a crash that tears a half-written line at a log tail would have caused the next good event to append onto the fragment and die unparseable. The kill-test drill had simulated the crash for weeks; only the combination surfaced the loss. The append path now heals a torn tail before writing.

I also did something that felt slightly strange and turned out to be the most valuable hour of the project: I had a rival frontier model adversarially review the design, four times. Pre-build reviews reshaped the subject registry and the event identity scheme. The post-build review found a genuine constitutional contradiction — I'd let lesson updates resolve by timestamp, expedient and exactly what rule four forbids — and I fixed it the same day. An AI catching my AI's memory design cutting a corner is a loop I intend to keep.

What I gained

Three machines now hold one set of beliefs, verifiably — the folded state hashes byte-identical on all of them, and I check that hash the way I check a backup. My corrections are cryptographic facts instead of hopeful notes. And the failure mode that started all this is structurally gone: an agent can be wrong, but two of my agents can no longer be confidently, silently wrong in opposite directions.

The next piece I want is a verifiable manifest — a signed summary of the folded state that an agent can check in milliseconds without trusting its local copy. I'll write that up when it's real.

If you want this shape under your own agents, the upgrade path for an AI-OS install is documented at cvp1.github.io/ai-os/upgrade.html">github.io/ai-os/upgrade.html">cvp1.github.io/ai-os/upgrade.html — one machine by default, enroll more when you're ready.

If you run agents on more than one machine, ask them the same question about your infrastructure and compare answers. Mine disagreed. Let me know what yours do.

--Craig