Teaching a support bot who should fix it: closed tickets Walrus Memory one routing hint

neweraXX — Thu, 29 Oct 2026 10:47:32 +0000

Built for Tatum × Walrus "Total Recall" — Smart Agents track.
Demo: https://total-recall-demo.vercel.app · Code: https://github.com/neweraXX/walrus-l1-assistant (branch total-recall) · Video: https://youtu.be/Q26YG0UkKdE

The question L1 asks every day

I work on an L1 application-support team for a beverage distributor's sales-force apps. Field sales reps call or message us all day: an order won't sync, a device can't sign in, a promotion price looks wrong.

"How do I fix this?" is often not the hard part. The hard part is "Should I handle this, send it to L2, or contact the vendor?" Get it wrong and the ticket goes back and forth for a day while a sales rep can't take orders.

That routing knowledge already exists in our closed tickets: who actually fixed the root cause, and for which kind of error. But nobody reads hundreds of closed tickets, and new teammates have to learn it all by trial and error.

Since September our team has used a Zalo chatbot built on Walrus Memory (my Walrus Sessions 8 entry). It answers from runbooks and remembers fixes teammates teach it. For Total Recall, I gave it a second job: learn escalation routes from closed tickets, keep them in Walrus Memory, and prove they are stored, using Tatum.

What changes for L1 (before → after)

	Without memory	With memory
"Replacement phone can't approve MFA sign-in, who handles it?"	Bot says L1 should try resetting it	Bot routes it to the vendor (Northwind Systems in the demo), plus one line: "↪️ Similar past issues: usually routed to VENDOR Northwind Systems (4/4 tickets)."
A new error type shows up 3 times in a week	Nobody notices the pattern	The nightly learner creates a rule for that error type once it has enough evidence
A learned rule is wrong	Wrong forever	An admin sends `#sai C7` and the rule is vetoed

L1 never sees blockchain. They see one practical hint. Blobs, epochs and proofs are only visible to the admin.

How it works

Closed tickets (read-only, ≤14 days, ≤30 per run)
   → scrub (phones, emails, internal codes removed)
   → LLM extracts: system, error type, root cause, who fixed it
   → learner groups by (system + error type), counts routes
   → rule written to Walrus Memory (namespace escalation:v2)
   → Tatum Sui gRPC confirms the blob is certified on Walrus
   → L1 asks a question → relevant rules recalled → routing hint

1. Learning, every evening at 18:00. The bot reads recently closed tickets (read-only), strips personal data before anything goes to the LLM, and extracts a structured record. Routes are counted per error type: L1, L2:<team>, or VENDOR:<vendor>.

2. Rules have to earn trust. A rule is only used when it has at least 2 tickets and at least 60% agreement. One ticket is evidence, not a rule. Each error type is written to Walrus Memory only when something meaningful happens: it is new, its route changes, or it reaches 3/10/30/100 tickets. That keeps memory small and every write meaningful.

3. Admins veto, they don't approve. My first version asked me to approve every proposed rule: 15 questions after one run. Nobody would keep up with that. Routes are already clear in closed tickets, so now the bot learns automatically and an admin only steps in when something is wrong: #sai C3 (veto), #mo C3 (re-open), #C3 note (add context).

4. Answering. When L1 asks something, the bot recalls rules from Walrus Memory. It keeps only rules from the same system and within a relevance distance of 0.5. I measured this on the demo rules: correct rules sit at 0.37–0.41, wrong ones at ≥0.57. The hint has a 3-second budget, so the hint never slows down the answer.

Where Tatum fits

Walrus stores the memory; Tatum lets me check it from the outside, through a Sui endpoint I don't have to run myself.

Proof per write. After each memory write, the bot finds the matching Walrus blob object on Sui through Tatum and checks that it is certified. The admin sees the object ID, transaction and end epoch. If the chain is slow, the status is pending and it re-checks twice, two minutes apart.
Morning health report (07:30). Wallet balance, number of memory blobs, uncertified blobs, and when memory expires. Our memory is safe until about April 2027 (end epoch 55–57; Walrus is at epoch 42). The report keeps 5 blobs that are not bot memory separate, so they don't skew the date.
gRPC, not JSON-RPC. Midway through the build, Tatum's Sui JSON-RPC endpoint started returning 404: JSON-RPC was retired. I moved every chain call to Sui gRPC through Tatum using node:http2 and the protobuf definitions in @mysten/sui. The browser grpc-web transport didn't work with the gateway, but native HTTP/2 did. Finding a fresh blob means scanning the wallet's owned objects (about 31 pages), so results are cached for 60 seconds and requests are spaced to stay within the free plan's limits.

To be clear about what this proves: a storage proof confirms the rule is stored, not that it is correct. Correctness is measured separately, below.

Does memory actually help? Honest numbers

Our team lead labeled 38 real tickets (16 L2, 10 vendor, 12 L1). They were closed 15–45 days ago, outside the learner's 14-day window, and excluded by ticket key as well. Every run uses the same model and prompt; only the recalled rules change.

Version	Memory OFF	Memory ON	What happened
v1	50.0%	36.8%	Memory made it worse. Every recalled rule was used, regardless of relevance, and most rules said "L1", so 14 of 16 L2 tickets got pulled to L1.
v2	52.6%	52.6%	Added a system + distance filter. My first threshold (0.35) was a guess, and it blocked every rule. Measuring real distances gave 0.5.
now	50.0%	55.3%	First positive result after fixing how incidents are counted (below).

The lesson: learn who fixed the root cause, not who closed the ticket. After one learning run, a single error type had grabbed 25 of 30 tickets, all routed to L1. My first guess was that the LLM was over-merging categories. My team lead corrected me: it was a real outage. A vendor-side 504 hit every user, the vendor fixed the root cause, and L1 closed 25 tickets one by one.

So the learner was making two mistakes:

It learned the route from who closed each ticket (L1), not from where the root cause was fixed (vendor).
One incident cast 25 votes and produced a confident but wrong rule.

Now each ticket records a rootRoute, and tickets from the same incident closed within 3 days count as one vote.

With that change, memory went from 50.0% to 55.3% accuracy: 2 more correct tickets out of 38. For tickets that should be escalated, precision rose from 70.4% to 76.0% with the same recall. That is an early signal on a small set, not a broad claim, and LLM results vary between runs.

The demo's "Measure" button runs the same OFF/ON comparison live on 10 new fictional tickets. My last run: OFF 6/10, ON 10/10. Those tickets are synthetic and nothing is prefilled, so treat it as a demonstration, not as the real-team number.

Privacy

The public demo, repo and video use fictional data only: Sunrise Beverages, FieldGo, Northwind Systems.
Real tickets, the labeled holdout and the production config never leave our server.
Personal data is scrubbed before any LLM call.
The ticket source is read-only.
On-chain details are admin-only. The L1 group chat never shows blobs or wallets.

Try it

Online: https://total-recall-demo.vercel.app

Learned rules: the six seeded rules (C1–C6) and their evidence.
Ask L1: ask the MFA question with Memory OFF, then ON.
Teach: learn from one more closed demo ticket.
Admin proof: see each rule's Walrus blob, verified via Tatum Sui gRPC, plus storage health.
Measure OFF vs ON on 10 new fictional tickets.

Locally:

git clone -b total-recall https://github.com/neweraXX/walrus-l1-assistant
cd walrus-l1-assistant && npm install
cp demo/.env.example demo/.env.local   # add your Gemini, MemWal and Tatum keys
npm run demo:seed && npm run demo:web   # http://localhost:3010

What's next

Re-measure on a larger, fresh holdout as more tickets close.
Use the expiry date from the health report to renew memory blobs automatically, before they expire.
Let the team see why a hint was given: the 4 past tickets behind "4/4".

Closed tickets were always full of knowledge. Walrus Memory lets the bot keep it, Tatum lets me prove it's still there, and L1 just gets one better sentence when it matters.

Built with Walrus Memory (MemWal) on mainnet, Tatum Sui gRPC, and Google Gemini.

#TotalRecall @tatum_io @WalrusFoundation

DEV Community: neweraXX