ai-memory is the endpoint memory substrate for AI agent clusters, swarms, and hives. It is built to a single standard: that a Fortune 500 or a Federal, State, County, or Municipal government would stake mission-critical processes on it. This is how that standard is enforced — the AI-agent graph-engineering pipeline, the adversarial review, and the testing gauntlet that stand between a proposed change and the release branch.
No silent loss, no partial or unsigned commit, no permanently-broken row.
Operator permission rules never bypassed; no fail-open, no privilege or tenant leak.
Write-plane liveness under contention; bounded, non-DoS-able paths.
Cross-backend parity, recoverability, no fleet kill-switch, no silent-wrong-result.
ai-memory is built by a structured organization of AI agents with an enforced separation of powers. The agent that writes code is never the agent that reviews it, and never the agent that merges it. No single agent can push an unreviewed change to the release branch.
A single conductor decomposes the epic, dispatches work, performs security & code review, and is the only actor permitted to merge. It holds the release protocol: signed merges, branch-protection lifts that are always re-armed, and the verify-at-tip discipline. Its job is judgment, not authorship.
Implementation is dispatched to strong coding agents, each in its own isolated git worktree so parallel work never collides. Difficult, security-critical, cross-cutting problems go to the top tier; mechanical work to a lighter tier. Every coder loads the Rust engineering standard and the code graph before writing a line.
A swarm of lightweight agents (GLM-5.3-Flash via OpenRouter) is a pure verification workload — never coding. Because they are inexpensive, they scale to dozens or hundreds of concurrent non-human identities (NHIs) to stress agent-to-agent flows, clusters, and hives against the real running system.
This is the core anti-vibe-code control. A change is authored by one agent, adversarially reviewed by others, and admitted by a gatekeeper that re-runs the gates itself. Convenient self-approval — the failure mode of most AI-assisted codebases — is structurally impossible.
Every coding agent reasons over a real knowledge graph of the codebase before it touches a file — not a guess, not a grep, a graph.
CodeGraph is a queryable graph of the codebase's symbols, edges, and files. One call returns the verbatim, line-numbered source of the relevant symbols plus the call paths between them — including dynamic-dispatch hops that a text search can never follow — and a blast-radius summary of what a change touches.
It is pinned to the live release-development index, mechanically enforced, so an agent can never reason against a stale or wrong-branch view of the code.
Every coding agent works to a prioritized, versioned rulebook — hundreds of rules with stable IDs, each cited by number in review. Correctness and safety are gated before anything else.
&T XOR one &mut T; never return a dangling reference.Result; no unwrap in production; make illegal states unrepresentable and fail closed..await.# Safety contract documented; no UB reachable from safe callers.TryFrom for narrowing; never float-compare for logic.A reviewer writes "per ERRORS-09" or "flag OWNERSHIP-10." The standard also encodes the Edition-2024 migration hazards that silently change drop and lock behaviour — the traps that quietly corrupt a less rigorous codebase.
The result: the fail-closed, make-illegal-states-unrepresentable posture that the North Star demands is not a hope. It is a checklist an agent must satisfy and a reviewer verifies by rule number.
When a judgment call matters — does this defect block the release, or can it wait? — it is not made by one opinion. It is put to a panel of 21 independent jurors: 7 distinct adversarial lenses, 3 rounds each, every one judging on the merits under the North Star.
Hunts silent loss, partial or unsigned commits, permanently-broken rows.
Protects the certified pg + AGE + pgvector attestation chain.
Fail-open gates, privilege bypass, "rules never bypassed by AI."
SQLite vs PostgreSQL divergence and silent-wrong-result.
Write-plane liveness, fleet kill-switches, recoverability.
Argues ruthlessly for defer — resists scope creep, concedes only to the mandate.
Real blast radius on deployed NHIs, migration & fresh-install safety.
An issue's own author calling it "deferrable" does not settle it — the panel overruled self-assessments in both directions. A defect that lands on the certified-federation config freezes the release even when it looked minor; a defect that is strictly fail-closed with the North Star intact defers even when it was labeled a blocker.
A change earns the release branch by surviving a cascade that widens at every step — from a source-scanning invariant check, to real dual-OS certified database tiers, to a cloud swarm of hundreds of agents on the running system.
Self-hosted CI on every push: compile, clippy at pedantic denial, format, and per-module coverage floors that are never lowered — a floor is a ratchet, not a suggestion.
Source-scanning gates that fail the build on architectural drift: every write-path SQL is record-stop-gated or reviewed-allowlisted; the append-only spine is guarded; module-size and error-funnel ceilings are pinned; MCP parameter names and attestation strings are invariant.
The real enterprise data tier — PostgreSQL + Apache AGE + pgvector — exercised natively on both Linux and macOS hosts. Cross-backend parity between SQLite and PostgreSQL is asserted test-by-test, so the two backends can never silently diverge.
Five deployment configurations — from a single SQLite node to encrypted certified federation — each run across five architecture tiers (single agent → many agents → multi-node swarm → data-center swarm → global hive), plus full agent-to-agent multi-NHI testing against the live daemon.
The whole matrix re-run on cloud infrastructure, with a GLM-5.3-Flash agent swarm scaled to dozens–hundreds of concurrent NHIs to stress the data-center and global-hive tiers. Nothing ships until the entire cloud matrix is green.
The last mile — admitting a verified change to the release branch — is itself a hardened protocol, because "the tests passed on the branch" is not the same as "the fix is present and correct at the tip."
A fix that "merged" once was later silently dropped in a rebase. So no issue closes on the claim that a PR merged. The gate is stricter: the fix must be present in the tip's code and demonstrated by a live regression test run against the merged tree — the full structural suite, the affected backend tests, and pedantic lint, re-run at the tip before the merge is admitted.
Commits are cryptographically signed. Merges use a controlled admin-lift that is always re-armed and confirmed — branch protection can never be left open. At runtime, the product writes to an append-only, signed event chain; the certified tier machine-verifies its at-rest encryption and signs that proof into the chain. Attestation is proven, not asserted.
Triaged against the four pillars.
→CodeGraph + Rust rulebook loaded.
→Isolated worktree, one problem.
→Independent lenses; vote if contested.
→Live regression at the merged tree.
→Gatekeeper only; protection re-armed.
Most open-source AI code is written to look right. This is written to be proven right.
The difference is not effort — it is structure. Separation of powers so no agent grades its own work. A written standard so correctness is cited, not felt. An adversarial panel so hard calls are earned. A cascade of tests that ends on real certified databases and a cloud swarm of hundreds of agents. And a merge gate that trusts the tip's code, never the story of how it got there.
That is the machinery behind a memory substrate an enterprise or a government can stake a mission-critical process on.
Append-only signed chain; fail-closed writes; cross-backend parity asserted per test. No silent loss.
Operator Deny is terminal; authz funnels proven to cover all callers; pedantic lint denies the footguns.
Recursive and bulk paths are budgeted and non-DoS-able; write-plane liveness tested under contention.
No fleet kill-switch, recoverable state, at-rest encryption machine-verified and attested on the certified tier.
ai-memory v1.0.0 is not a demo and not a vibe. It is an endpoint memory substrate engineered — pillar by pillar, gate by gate, vote by vote — to be trusted with the work that cannot fail.