What is the Agent Cortex?

It is the serving agent's own persistent operational memory — its record of how to operate, so it stops repeating its own mistakes. It captures six kinds of lesson: gotchas, failed commands, pitfalls, corrections, how-tos and overruns. It is never a user fact and is never served as one.

How is the cortex different from the memory of my facts?

They answer different questions. Your memory answers 'what is true about the user?' — it is user-is-truth, passes a validation gate, and is audit-legible. The cortex answers 'how do I operate well here?' — the agent is the authority on its own operating experience, so there is no validation gate and no grounding requirement. They live in two separate PostgreSQL schemas and are labelled separately in every response the model sees.

When does a note become a rule?

Writing the same lesson again does not create a duplicate row — it strengthens the existing one and unions in any new tags. At three observations the note hardens into a rule, which is ranked above ordinary notes at recall and labelled as a rule when it surfaces.

Do I need a particular model for this?

No. Cortex notes are plain text and tags in PostgreSQL, written and read over MCP. Any model behind an OpenAI-compatible API consumes them the same way — no GPU and no coupling to a serving stack. Swap your model and the cortex is untouched.

The Agent Cortex — the memory your AI keeps for itself

Q: Can a cortex note leak into my facts?

No, and the reason is structural rather than a policy. The cortex lives in its own schema, flagent_ , disjoint from the user-fact schema faultline_ . The user-fact walk only ever derives the faultline_ name and binds a search_path without public, so it cannot reference the cortex table at all. Every cortex read and write opens its own connection bound to the cortex schema; a bind that does not resolve to a correctly-shaped flagent_ name is refused and logged before any statement runs. A poison test — a fact-shaped row planted in the cortex must never appear in recall — is part of the firewall test suite.

Q: Does the cortex cost extra?

No. The cortex is core and ships with every seat — each seat carries both memories, with its own isolated cortex schema.

The founding reframe

Two memories, because there are two questions.

Most memory products solve one of these and call it done. They are not the same problem, they do not want the same guarantees, and mixing them is how an assistant ends up telling you its own scratch notes as though they were facts about your life.

=== YOUR MEMORY ===

What is true about the user?

faultline_<id>

Content: Your grounded facts — entities, relationships, values, events.
Authority: You are truth. Every write passes a validation gate.
Recall: A deterministic walk of real rows. Traceable to the row it came from.
Stance: Asserted or held, by confidence. Correctable by you at every layer.

=== HOW YOU OPERATE ===

How do I operate well here?

flagent_<id>

Content: The agent's own operating lessons — what worked, what bit it, what to route around.
Authority: The agent is truth about its own experience. No validation gate — it isn't claiming anything about you.
Recall: Hybrid: a deterministic keyword-and-tag lane, unioned with a semantic lane.
Stance: Held, always. Working notes — never asserted to you as fact.

▲ two schemas · one wall · the fact walk physically cannot reach across it ▲

Dropping the "a human reads and corrects this" constraint is what makes the second memory possible. User memory has to be structured, gated and legible because you are the authority on it. The agent is the authority on its own operating experience — so a cortex note needs no gate, no grounding and no audit trail. It is simply the agent's own observation, durable and its own to keep.

What goes in it

Six kinds of lesson. Everything else is captured, not enumerated.

The categories are a closed set — six, fixed in code. The note itself, its tags and its context are open: FaultLine never ships a vocabulary of what your agent is allowed to learn.

gotcha The surprising thing that bites you. "docker restart doesn't adopt a new image."

failed_command A command that failed — and the fix. "sed into the prod compose appended after every line; env vars live in the env_file."

pitfall A known trap to route around. "This tenant's anchor is thin — check the backstop before answering."

correction "Actually, do it this way instead." Being corrected is the write trigger. It is the clearest one you get.

howto A working procedure worth keeping. "Deploy path: build on dev, push, pull on prod — never build on prod."

overrun A command that blew its budget or ran long. "That full-repo grep takes 40s — scope it to src/ first."

A hard rule, enforced by design: a cortex note records how to serve, never user content — even content about you. Your facts belong in the other hemisphere, and the firewall keeps them there.

The loop

Recall before you act. Record the moment you learn.

Two tools, over MCP, alongside the six that serve your facts. What the agent never writes down, you have to teach it again next session.

session 1 — it learns

// the deploy fails in a way that wasn't obvious
cortex_remember
  text: "docker restart won't adopt a new
         image — must down/up to repull"
  category: gotcha
  tags: [docker, deploy]

→ Noted for myself (operational memory).
  Not recorded as your fact.

session 7 — a different model, weeks later

// about to redeploy the same stack
cortex_recall  "docker deploy"

→ MY OWN OPERATIONAL NOTES (held, soft):
  [gotcha] [rule] docker restart won't
  adopt a new image — must down/up.
  seen 4× · hardened

// it routes around the trap. No one
// had to explain it a second time.

Notice what carried across: not the same session, not even the same model. The note is plain text and tags in PostgreSQL, read back over MCP. Swap Claude for a local Qwen and the lesson is still there.

Repetition is signal

Write the same lesson three times and it stops being a note.

Re-recording a lesson doesn't create a duplicate. It finds the existing row, strengthens it, and folds in any new tags — so the store gets denser with use rather than noisier.

1 observation observed

A note. Recalled when it's relevant, ranked normally, held softly.

2 observations observed · stronger

Same row, count bumped, new tags unioned in. Ties now break in its favour.

3 observations hardened → a rule

Promoted by the background sweep. Gets a ranking bonus and surfaces tagged [rule] — the agent has been bitten enough times to treat it as one.

Recall is hybrid, and honest about it. A deterministic keyword-and-tag lane (tags weighted heavily, hardened notes bonused, ties broken on observation count then recency) runs unioned with a semantic vector lane over a per-seat collection. The semantic lane reranks relatively — a candidate has to stand out from the rest of its own field, not clear a magic global threshold — which is why it doesn't drift when the embedding model changes. And if embeddings are unavailable, recall degrades to keyword-and-tag rather than failing.

Inviolable

The firewall is structural, not a promise.

A second memory is only safe if it physically cannot contaminate the first. This is the part we would rather be judged on: the separation is not a rule the code tries to follow — it's an arrangement in which the unsafe thing has no path to happen.

Two schemas, one shared identifier The cortex lives in flagent_<id>, disjoint from the user-fact schema faultline_<id>. Same seat slug; only the prefix differs.
The fact walk can't see it Recall of your facts only ever derives the faultline_ name and binds a search_path without public — so it cannot reference the cortex table at all.
Every cortex call binds its own connection Short-lived, scoped to that seat's cortex schema, again without public. A cortex write has nowhere else it could land.
Unsafe binds fail loud A bind that resolves to empty, to public, or to anything not shaped like a valid flagent_ name is refused and logged before a single statement runs.
Nothing is seeded from shared space Cortex schemas are created empty, per seat. There is no shared pool one tenant's agent could read another's lessons out of.
A poison test guards it Part of the firewall suite: plant a fact-shaped row in the cortex and assert it never appears in recall. If that ever passes silently, the build is wrong.

A cortex note shapes how the agent thinks. The answer to a question about you still comes only from the grounded walk. Those are different sentences, and the architecture keeps them different.

The part nobody else ships

The memory teaches the model how to use it.

Wire any model to a memory and it gets your facts back. It gets nothing telling it how to operate that memory — when to record, when to recall, when to correct. So a weak model under-fires, and narrates tool calls as prose instead of making them. FaultLine sends two clearly-labelled layers on every recall instead of one.

=== YOUR MEMORY ===

DevBox is your workstation.Its IP address is 10.0.1.10.(less certain) you may have moved itafter the network change.

Grounded facts from the deterministic walk, voiced by confidence. Asserted lines are stated as knowledge; softer ones are hedged.

=== HOW YOU OPERATE ===

When the user states a fact in passing,record it verbatim — don't pre-extract.[rule] Deploy: down/up, never restart.

Instructions to the model — the shipped operating best-practices, plus this seat's own hardened rules. Never repeated back to you as a fact.

The fence is the firewall made visible. The model is structurally told which half is truth about you and which half is instruction to itself. And because every transport — MCP, the REST shim, the /v1 API — consumes one backend, this is built once and every door inherits it. Even a small local model gets it from turn one.

Why it saves money, concretely. Two effects compound. Recall returns the one grounded fact a question needs instead of restuffing conversation history every turn — smaller prompts. And the cortex stops your agent re-walking dead ends it already mapped — fewer wasted calls on problems it solved last week. See the token maths ▸

New — build an agent on both memories

Ship an agent that already knows the job.

The FaultLine chat agent is a small embeddable appliance you drop on any page. Bind it to a seat and it inherits that seat's validated memory and its cortex — so the agent you ship on Monday is smarter on Friday, without you retraining anything.

Three ways in, one agent

An embeddable web widget (a div and a script tag — the embed iframes itself, so there's no CORS to configure), an OpenAI-compatible /v1/chat/completions endpoint any OpenAI client drops into, and an /mcp door for MCP clients. Same agent behind all three — and the appliance serves every snippet itself, copy-ready, at /integration.

Standalone, or through FaultLine

Run it with your own key and no FaultLine involvement at all — that path is complete on its own. Or bind it to a seat: it reuses the seat's brain and memory, and the brain key never leaves FaultLine.

Memory is a separate choice

Where memory lives and which model answers are two independent switches, on purpose. Validated FaultLine memory, a store you bring, or no memory at all for a genuinely stateless bot.

You always know when it's saving

When a conversation is being written to memory, the agent shows a hard red banner saying so. Not a setting buried three menus deep — a thing you cannot miss. And setup ends in a live smoke test: the chat surface stays hidden until the brain actually answers, so a misconfigured agent never renders in front of a visitor.

Build an agent ▸ See the developer API

15-day free trial. No auto-subscribe — you won't be charged when it ends.

Where it's going

Three tiers. One shipped, two honest about being roadmap.

The shape is deliberately the same one memory takes in biology: accumulate live, consolidate at rest, and only then — maybe — fold the residue into something permanent.

Shipped

Tier 1 — episodic operational memory

Everything above this section. The note store, the two MCP tools, harden-on-repeat, hybrid recall, the lifecycle sweep, and the firewall. Model-agnostic, no GPU, core on every seat.

Roadmap

Tier 2 — the consolidated operating brief

During idle, the agent reads its own notes and distils the recurring ones into a refined operating brief — by inference, not training. Delivered over the same channel that already carries your facts. Still model-agnostic, still CPU-fine. The harden-at-three lifecycle already prefigures it.

Roadmap · opt-in

Tier 3 — parametric overage

The residue a readable brief can't encode — sub-verbal phrasing reflexes — distilled into a per-seat adapter on a serving stack you own. The only place we deliberately touch the model layer, kept behind a swappable boundary, off by default, and always derived from the portable notes one tier down — so a model swap can never strand you.

Why the coupled tier is last, not first. Only Tier 3 is tied to a specific model. Tiers 1 and 2 are portable text your agent carries between models. Keeping the source of truth in the portable tier is what makes the whole thing reversible: the derived layer can always be rebuilt, and nothing is ever locked into weights you can't read.

Grounded in the literature, and we'll name it: Rethinking Memory in LLM Agents (2505.00675) · Episodic Memory is the Missing Piece (2502.06975) · Memp: Agent Procedural Memory (2508.06433) · Cartridges (2506.06266) · Sleep-time Compute (2504.13171) · MemGen (2509.24704). Other teams are working the same problem from other angles — we keep a page about them.

Straight answers

The questions people actually ask.

Can a cortex note leak into my facts?

No — and not because we promise. The two memories are different PostgreSQL schemas, the fact walk never derives the cortex name, and an unsafe bind is refused before any statement runs. A poison test asserts it in the build.

Is my agent's cortex private to me?

Yes. Each seat gets its own cortex schema, created empty. There is no shared pool, and nothing is seeded in from a common space that another tenant could have touched.

Does it work with my model?

If it speaks to an OpenAI-compatible API, yes. Notes are plain text and tags read over MCP — no GPU, no coupling to a serving stack. Swap models and the cortex is untouched.

Does the cortex cost extra?

No. It's core — every seat carries both memories. The chat agent is the separate add-on, and it's priced openly on the numbers page.

Who decides what gets written?

The agent does — that's the point. It records its own lessons, most reliably when you correct it. Being corrected is the write trigger; a lesson it reasons out and doesn't write down is one you pay for twice.

What if the vector lane is down?

Recall degrades, it doesn't fail. The deterministic keyword-and-tag lane answers on its own, so well-tagged notes still surface. Every cortex entry point is written to fail safe — a cortex problem never breaks the caller.