Instinctual Memory synthesis
Type: agentic-system-analyses/types/agentic-system-synthesis.md
Bounded synthesis
From recorded work to standing memory
Instinctual Memory is a Rust memory product, not the agent runtime that performs a user's coding task. Its mem executable, library, transports, installed skill and hooks form a shipped loop: acquire past work, derive standing facts, publish them, and supply selected material to later agents. The analysis covers that whole shipped loop at Git revision 6acb13dc35765bf5ccfc87e445dd09c480f1c28a, with an applicability cutoff of 2026-10-12. SRC-1 supplies inspected implementation, design instructions and bounded reported-operation fixtures. It supplies no complete execution trace, successful test result or causal experiment. External hosts, live stores, provider implementations and exact model weights are not frozen. This synthesis uses accepted member records; no target source was reread (boundary and evidence, Source register).
The strongest supported learning-related contribution is an automatic experience-to-memory-to-later-consumer chain. Recorded user turns, and calendar or timestamped voice material, can feed extraction into durable statements. Subsequent extraction and host-facing routes consume those statements. This is wired trace-fed updating, not merely retention of logs. Whether it improves future action remains unresolved: there is no linked later-use or outcome comparison. Static project instructions also feed extraction, but their import is not itself experience learning (MEM-OBJ-journal-event, MEM-OBJ-fact, RT-RTE-journal-consolidation).
Acquisition retains adapted text in framed JSONL day files. It does not retain every original transcript unchanged: adapters filter roles, channels and injected environment material. Bulk ingestion deduplicates event IDs; public library append has a different sequencing and deduplication contract. Local backfill also differs from the other shipped bulk commands: its final drop flush logs failure rather than propagating it, so its completion message does not guarantee final flushing. Detached hook sync inherits this limitation and ignores child outcomes (MEM-RTE-adapter-ingestion, RT-RTE-host-hooks, runtime account).
Consolidation reloads a Git snapshot, journal progress checkpoint, current facts and suppression controls. Rules or a configured chat model propose standing statements. Model extraction receives selected user/Note text and bounded existing-fact summaries, not the whole store. User text is clipped to 2,000 characters; Note chunks to 8,000; existing context has entity, fact and statement-byte caps. Every Note receives memory-file framing, including calendar, voice and generic Markdown, so the prompt's curated-instruction premise is not source authentication. The global checkpoint advances over its window even when scope filtering excludes events; those events are not automatically reconsidered by a later scope run (RT-RTE-journal-consolidation, memory annotations, MEM-OBJ-checkpoint).
Admission gives operational status, not verified truth
The LLM route asks for lasting usefulness and consumes the model's lasting flag. Software checks statement bounds, usable routing and source occurrence. The occurrence test normalizes text, discards evidence fragments shorter than eight characters, rejects an empty qualifying set and checks the remaining fragments in source order. It does not check every submitted fragment, exact bytes, source truth or whether the statement follows from its quote. Rules offer deterministic extraction but can drop directive polarity: always and never can yield the same preference statement. Actual linked model outputs are unavailable, so their semantic relation to inputs remains indeterminate rather than established entailment or conjecture (EPI-RTE-llm-proposal, EPI-RTE-candidate-gate, EPI-RTE-rules-extraction).
Placement suppresses blocked IDs and near duplicates, retires older file-only facts, and publishes entity content, index, checkpoint and dispositions together. Duplicate heuristics can ignore negation and modality; changed-file retirement can occur without a successful replacement fact. An accepted event disposition need not mean a fact was added. Published statements and source quotes remain separate parts: a fact's Active or ExplicitAssertion label is operational metadata, not evidence-consuming truth acceptance. Exact re-extraction can replace the source vector instead of accumulating corroboration (MEM-OBJ-fact, MEM-OBJ-source-ref, MEM-OBJ-dispositions, memory annotations).
Direct remembering and correction acquire caller assertions without the extraction quote gate. Shipped publication uses structural validation followed by Git compare-and-swap; that prevents stale-base overwrite by cooperating publishers. It does not cover external file/ref mutation, every durable effect or custom library validation. The validator does not implement its comments' broader checkpoint and parent-only-supersession invariants. Core receipt digests check request reuse, but the shared MCP/HTTP/shell operation can return early on receipt existence without comparing the incoming content. Durable intent recovery belongs to shipped immediate-change callers, not every update route (RT-RTE-immediate-change, RT-CLM-validated-publication, runtime account).
Later context has several independent channels
The CLI and public library expose direct operations; MCP, loopback HTTP and the memory shell dispatch shared operations. HTTP loopback binding is not authentication, and neither shell parsing nor hardened Git commands establish an OS sandbox. The host owns the final answer, command sequence and permission policy. The product's model calls propose facts or judge cleanup/relevance, rather than running a general agent tool loop (runtime account, RT-OBJ-mem-skill).
Requested search reloads facts and independently searches raw journal text. It shortlists lexical candidates, optionally uses remote JEV or cached local cross-encoder ranking, and falls back toward lexical results on ranker failure. Project/source filtering after fact shortlisting can discard useful slots. Ranking supplies relative relevance, not endorsement. The verified inventory is partial: same-event siblings and the bounded JEV pool affect selection, and unjudged baseline tails can appear in a JEV-labelled result. The label does not establish that each hit was individually judged (RT-RTE-memory-retrieval, report-verification limits).
Hooks also supply memory without an explicit agent query. SessionStart selects pref_user and caps delivery at 20 statements. UserPromptSubmit uses up to 600 prompt characters, lexical matching and meaningful-word overlap, then supplies at most six facts. These selectors have distinct eligibility and budgets. Ordinary search/read, hooks and writeback omit the retained evidence quote; optional CLI source excerpts and full entity-YAML inspection offer other evidence access. External inspection affords using a quote as reference even though no automatic reason-reading route is established (RT-RTE-host-hooks, MEM-OBJ-source-ref, profile-verification limits).
Writeback persists selected statements in a managed project-instruction block. Later host loading is afforded, not observed. Normal splicing preserves outside text, while force replaces the entire file. Writeback does not share lexical temporal/control gates, and ID/entity reads, displays and current-head history also differ in eligibility. memory_history is not Git commit traversal. Markdown backfill retains generated blocks, leaving a derived-text feedback path into extraction. Delivery therefore has channel-specific validity, evidence visibility and withdrawal limits (RT-RTE-instruction-writeback, RT-BAP-instruction-file, MEM-OBJ-entity-display, memory annotations).
Cleanup reaches a new snapshot, not a bound approval
The representative multi-step workflow is /mem tidy, selected because the skill explicitly joins host delegation, preview, user review and durable delivery. The host requests a preview, shows findings, receives keep choices, invokes apply and communicates the result. Cleanup proposes lexical duplicates and, when configured, model-judged session-only statements in batches of 60, without original evidence. Keep IDs veto named removals. Apply rereads and recomputes instead of consuming an approved immutable preview, so even a compliant review interaction does not bind the eventual removal set. Direct execution needs no confirmation exchange (workflow account, RT-RTE-tidy-maintenance).
Successful application publishes retracted facts, suppression controls and index in one snapshot, then returns its revision. No findings or keeping all candidates yields no change; no model configuration yields disclosed duplicate-only assessment. Model errors precede publication. The host owns failure communication and a fresh retry; cleanup has no established immediate-change-style intent recovery or automatic rollback. Soft forgetting excludes curated facts but leaves raw sources, history, prior instruction files and delivered context on separate lifetimes. Erasure attempts broader removal through sequential current-tree, journal, history and intent stages; its Completed marker precedes later stages, and partial-failure recovery is not guaranteed (RT-RTE-tidy-maintenance, RT-RTE-erasure-maintenance, MEM-OBJ-controls).
Assessment depends on the intended use
For continuity across agent sessions, the implemented contribution is sourced candidate retention, experience-fed updating and several later-context channels. For independently warranted knowledge, the inspected routes do not establish acceptance and lifecycle integration of produced ampliative claims. Source links, quote occurrence, structural validation and retrieval rank have narrower licenses. For user-reviewed cleanup, the procedure supports named vetoes but not immutable per-content approval. For deletion, soft withdrawal and sequential destructive removal must remain distinct (EPI-CLM-sourced-facts, EPI-CLM-lasting-facts, epistemic conclusion, workflow account).
Criticism of consumed guidance improving future capacity is not demonstrated. Retained cleanup reasons and quarantine dispositions have no established later criterion-revision consumer. The accepted runtime does not supply separate theory-builder conditions 1–4 assessments; this synthesis does not infer them from persistence or curation. Automatic extraction and callbacks establish computational ownership of those operations, not autonomy of the host-mediated workflow. Reflective operation is not established by the supplied account. Experience-fed changes to later extraction inputs are supported, but exercised self-improvement remains unestablished: there is no subsequent operation trace causally depending on an objective-responsive change, and no outcome comparison demonstrates improvement (MEM-OBJ-controls, MEM-OBJ-dispositions, epistemic conclusion, RT-RTE-journal-consolidation).
Concrete evidence could change these conclusions: linked event/proposal/admission/host-use traces; independent semantic and lastingness checks; objective-specific before/after comparisons with component variation where attribution is claimed; and crash/concurrency results covering each substrate. System changes could also change the guarantees: binding tidy apply to a reviewed revision and candidate set, harmonizing intended read eligibility, propagating local-backfill flush failures, and retaining recoverable erasure stage inputs. Existing retrieval evaluation compares expected IDs and required/forbidden text from a caller rubric; its independence is unresolved and it does not promote a winner or revise memory. Timing benchmarks likewise return reports, not a closed improvement loop (RT-RTE-search-evaluation, EPI-RTE-search-benchmark).
Limitations
| Limitation | Affected SRC IDs and record citations | Inspected boundary | Conclusion prevented | Evidence that would resolve it |
|---|---|---|---|---|
| No complete run or causal comparison; external dependencies unfrozen | SRC-1; Source register, RT-RTE-journal-consolidation, RT-BAP-host-context | Frozen shipped source, not live stores, hosts or providers; referenced PRD unavailable | Successful deployment, host compliance, reliable recovery, improved answers or causally attributed learning | Registered end-to-end traces, pinned dependencies/models, missing requirements and objective-specific controlled results |
| Initial provenance and human content decisions unresolved | SRC-1; MEM-OBJ-journal-event, RT-RTE-immediate-change, RT-RTE-task-update | Adapted source labels and generic callers | Complete original-lineage, trace-origin or per-content human-approval inventory; source authenticity | Recorded origin and explicit content decision/approval linked to admitted material |
| Extraction gates do not license semantics or lastingness | SRC-1; EPI-RTE-candidate-gate, EPI-RTE-rules-extraction, EPI-RTE-llm-proposal | Normalized qualifying fragments, rule captures and bounded model requests | Exact quote identity, warranted rewritten statements, reliable durability or complete semantic-novelty classification | Linked outputs plus independent contextual entailment and temporal-usefulness assessment |
| Progress and dispositions do not show complete processing or knowledge growth | SRC-1; MEM-OBJ-checkpoint, MEM-OBJ-dispositions, RT-RTE-journal-consolidation | Scope-filtered global windows, placement and bounded existing context | All events reconsidered, complete context, accepted counts equalling added/verified facts | Event-to-placement audit and explicit reconsideration/context-coverage evidence |
| Publication and acquisition guarantees vary by path | SRC-1; MEM-RTE-adapter-ingestion, RT-RTE-immediate-change, runtime account | Bulk versus public append; local drop flush; core versus shared replay; custom validation; non-Git effects | Universal sequencing/deduplication, final-flush success, content-equal replay or cross-store atomicity | Path-specific tests/results and enforced common contracts where intended |
| Partial retrieval selection inventory, carried from report verification | SRC-1; RT-RTE-memory-retrieval, memory annotations, report-verification limits | Up to two same-event siblings; five positive leaders and zero-score rows up to an eight-row JEV pool; unjudged baseline tail | Exhaustive candidate-pool comparisons or every JEV-labelled hit individually judged | Complete canonical selector/pool records and per-hit judgment provenance |
| Partial authority inventory for external evidence inspection, carried from profile verification | SRC-1; MEM-OBJ-source-ref, profile-verification limits | Full entity-YAML inspection affords evidence use; automatic quote/reason guidance unresolved | Complete per-part authority or evidence-visibility comparison; any claim that evidence has no possible later consumer | Separate external-inspector and automatic-consumer records, with delivered parts and force |
| Eligibility and evidence delivery differ by channel | SRC-1; RT-RTE-memory-retrieval, RT-RTE-host-hooks, RT-RTE-instruction-writeback, MEM-OBJ-entity-display | Lexical, ID/entity, Start, display and writeback gates; external file loader | Uniform current-valid context, automatic rationale delivery or complete external push-selector classification | Channel-specific consumer traces and intended eligibility/evidence contracts |
| Review, withdrawal and erasure are bounded | SRC-1; RT-RTE-tidy-maintenance, workflow account, RT-RTE-erasure-maintenance, MEM-OBJ-controls | Recomputed apply; ID controls; sequential removal; whole-event redaction; external copies | Immutable approval, semantic all-channel forgetting, complete destruction or reliable partial-erasure recovery; preserving all surviving source context | Bound reviewed candidate artifact, recovery stage evidence, copy inventory and surviving-lineage checks |
| Future-capacity and independent higher-order properties remain unestablished | SRC-1; MEM-OBJ-dispositions, MEM-OBJ-controls, epistemic conclusion, RT-RTE-search-evaluation | Trace-fed updates and later consumers; report-only evaluation; no separate runtime theory-condition assessment | Criticism-driven capacity improvement, reflective or autonomous theory building, exercised self-improvement or retrieval-component benefit | Property-specific records, retained criticism with consequential next-round use, authenticated comparison cases and causal later-operation evidence |