The problem nobody talks about
AI agents are getting persistent memory. mem0, Zep, Letta, Cognee — they all store what your agent "learned." But none of them answer three questions:
- Who wrote this fact? (which agent, which session)
- What did it replace? (when the agent changed its mind)
- Can someone tamper with it silently? (malicious or accidental)
If your agent makes decisions based on remembered facts, these are governance questions. And governance without evidence is just hope.
What I built
MemTether is a local-first memory hub where:
- Every write joins a SHA-256 hash chain with periodic anchors. Tamper with the database and verification turns red — reproducible in 60 seconds with
python examples/audit_chain_demo.py - Corrections supersede instead of overwrite. The old truth stays queryable —
memtether court <uid>shows the full chain - Source attribution is mandatory. A write without a registered source is rejected
- Contradictions between agents queue for human adjudication — agents propose, humans decide
- Bi-temporal timestamps separate "when it was true" from "when the system learned it"
Why not just markdown files?
| | Plain markdown | MemTether |
|---|---|---|
| Who wrote this? | ❌ | ✅ source + timestamp |
| What did it replace? | ❌ overwritten | ✅ supersession chain |
| Tamper detection | ❌ | ✅ hash chain |
| Concurrent write safety | ❌ last-write-wins | ✅ file lock + WAL |
| Query past states | ❌ | ✅ as_of("2026-10-15") |
Export to markdown anytime — but keep the governed database as the source of truth.
Honest numbers
All results from our own harness with per-question records committed to the repo. We documented a 27× score inflation from mixed denominators in memory benchmarks — which is why we report each metric under the exact scoring rule that produced it.
Try it in 30 seconds
pip install memtether
memtether demo
memtether search "投影" --list
Works with Claude Code, Codex, Cursor, and 20 other agents via file-level pointers or MCP.
Top comments (1)
Supersede instead of overwrite is the load-bearing choice here — a memory that silently rewrites its own past can't be audited, only believed. The bi-temporal split is the part I'd steal: 'when it was true' versus 'when the system learned it' is exactly where most memory stores quietly lie. One pushback: a hash chain proves tampering after the fact, but who verifies the first write — does source attribution stop a compromised agent from registering itself as a trusted source?