Glossary
Once a memory model gets richer than one table, the vocabulary becomes unavoidable. Here is all of it in one place, in plain sentences, with a link to where each idea is implemented.
- 46 terms
- Alphabetical
- Linked to the feature pages
Every term, A to W
Where a term is narrower than it sounds — pseudonymisation, the Librarian, forensic mode — the definition says so rather than letting the word do work it has not earned.
A
- Audit chain The append-only log of memory operations — who did what, to which record, when, and under which request identifier. Each row stores a hash of the row before it, so a removed or edited entry breaks the sequence. A verifier walks the chain and reports the first break rather than trusting it.
- Authority How much weight a record has earned by virtue of where it came from. The scale runs raw, generated, derived, human_reviewed, locked and imported, and it feeds directly into the trust score used to rank retrieval candidates. Material a person confirmed outranks material a model produced, and imported material starts below both.
B
- Bitemporal Storing two independent timelines against a fact: when it was true in the world, and when your system believed it. Keeping them apart is what lets you answer "what did we think on the day we decided that?" long after the value has changed. Collapsing them into a single updated_at column destroys that answer permanently.
C
- Candidate A record that one of the searches returned and that has not yet been ranked, filtered or packed. Vector search, lexical search and the graph each produce their own candidate list, which is why fusion is a separate step. Most candidates never reach the model.
- Cognitive record A record in the higher-order tier — a wiki page, a claim, an architecture note, a task on the agent bus — that carries the full governance envelope of truth state, authority, review status, verification state and visibility. These are persisted to a single append-only file rather than to Postgres, which is stated plainly on the feature page.
- Context pack The assembled block of memory handed to a model for one question: the surviving records, packed in priority order up to a token budget, prefixed with the rule that they are data rather than instructions, and accompanied by a source manifest. It is the output of the whole retrieval pipeline and the unit you should reason about.
D
- Default Mode A background runtime named after the brain's default mode network, which runs consolidation and reflection passes when nothing is being asked of the system. Several of its endpoints — future simulation, stakeholder simulation, incubation — return fixed templates rather than model output, which the feature page says outright.
- Diversity (MMR) The deliberate trade of a little relevance for a little coverage, so a context pack does not fill up with eight paraphrases of the same sentence. Implemented as maximal marginal relevance, which repeatedly picks the candidate that is most relevant to the query and least similar to what has already been selected. See also MMR.
E
- Episodic memory The record of what was actually said, turn by turn, with provenance attached. It is the layer you return to when a summary looks wrong and you need the original sentence. Distinct from semantic memory, which stores the durable conclusion rather than the exchange that produced it.
- Evidence chain The links from a conclusion back to the material that supports it — a decision to the measurements behind it, an outcome to the decision it followed. Fabric stores these links at the moment of writing, because reconstructing evidence afterwards is the thing that never actually happens.
F
- Fabric The workflow memory layer: decisions, tasks, reviews, outcomes, procedures, handoffs and notes stored as typed entries with assignees, projects, status and evidence links. It is what turns "why did we choose this?" into an API call. Every write can also mint a linked semantic memory so entries appear in ordinary retrieval.
- Fact override A privileged, human-authored write that asserts a fact directly instead of waiting for extraction to find it. It runs through the same supersession path as any other fact, so the value it replaces keeps its history, and it is restricted to owner and admin roles. Idempotency keys are supported so a retry cannot double-write.
- Forensic mode The deepest retrieval setting: the widest candidate pools, the greatest graph depth, evidence included, and the largest token budget at 14,000 tokens. It is meant for investigation rather than for the hot path, where cheap or balanced belongs. Expect it to be slower and to cost more.
G
- Graph memory Entities and the edges between them, searched as a third candidate source alongside vector and lexical results. It reaches material that is related but not textually similar — the project attached to the client attached to the question. It is off by default and turned on deliberately.
H
- Hash chain The mechanism that makes the audit log tamper-evident. Every row stores a hash of itself and a hash of the previous row, so altering or deleting any entry invalidates every hash after it. It does not prevent tampering; it makes tampering detectable, which is the achievable goal.
I
- Idempotency key A caller-supplied header that lets a write be retried safely. The first request with a given key is executed and its response stored; a repeat of the same key returns the stored response instead of performing the work again. It is how a network timeout stops turning into a duplicate memory.
K
- Knowledge base source A registered document or URL that is fetched, chunked, embedded and refreshed on a schedule, with citations back to the original. Fetching is protected by domain allowlisting and defences against server-side request forgery, because a scheduled fetcher is an egress risk. Knowledge-base retrieval is off by default.
L
- Lease A time-limited claim an agent takes on a task from the agent bus, so two agents do not pick up the same work. While the lease is held the task is not offered to anyone else; when it expires the task becomes available again. It is the reason a crashed agent does not block a queue forever.
- Librarian A question-answering surface over the memory store that returns matching passages with citations. It is deliberately deterministic — substring retrieval, no model call, no synthesis — so it costs nothing, needs no key and never invents an answer. Treat it as a fast index, not as a reasoning system.
M
- MCP The Model Context Protocol, the standard by which an agent client discovers and calls external tools. Memory OS ships an MCP server over stdio exposing eighteen tools plus a usage prompt, so Claude Desktop, Claude Code, Codex CLI and any other stdio client can read and write memory as ordinary tool calls.
- Memory firewall The rule, stated on every context pack and repeated in the chat system prompt and the MCP prompt, that retrieved records are data and evidence and never instructions. It is a structural mitigation against prompt injection rather than a guarantee, and it is deliberately restated on every call rather than once at configuration time.
- Memory slot A named, pinned piece of context that is always available to a session regardless of what retrieval returns — the current project, the house style, a standing constraint. Slots can be scoped to a user or a project and locked so they are not quietly overwritten.
- MMR Maximal marginal relevance, the algorithm behind the diversity step. It selects each next record by balancing similarity to the query against dissimilarity to everything already chosen, so the pack covers a subject rather than repeating a sentence. See also Diversity.
O
- Outbox The table where side effects are recorded in the same transaction as the write that caused them, then picked up by a worker and performed. It is what stops a webhook firing for a memory that failed to save, or failing to fire for one that succeeded. Queue depth and lag are visible in the operations console.
P
- pgvector The Postgres extension that stores embedding vectors and searches them by cosine distance. It is why the vector index lives in the same database as the rows, inside the same transaction and under the same row-level security policies, instead of in a separate service that has to be kept in step.
- PII vault The tenant-scoped store holding the mapping between a real identifier and the placeholder that replaced it. Values are substituted back only at display, and revealing a mapping requires owner permission. Detection covers email addresses and US-format phone numbers only, which is narrower than the term suggests and is said so plainly.
- Provenance The record of where a statement came from, precise enough to check. A claim can be pinned to the exact span of the source document that supports it and re-examined later. Verification of a claim is graded by word overlap and reports itself as deterministic and local, not as reasoning.
- Pseudonymisation Replacing an identifier with a stable placeholder — EMAIL_1, PHONE_1 — before text is embedded, stored or placed in a model's context. The retrieval pipeline therefore operates on pseudonymised text throughout. It is not anonymisation: the mapping still exists in the vault, under access control.
R
- Reciprocal rank fusion The method for merging several ranked lists into one by position rather than by score. It matters because a cosine similarity and a full-text rank are not comparable numbers, so averaging them is meaningless. Fusing on rank, with per-source weights, is the step that makes hybrid search work in practice.
- Reranking A second pass that reorders fused candidates with more context than the first-stage searches had. The default reranker is heuristic — free, fast and predictable — and an optional cross-encoder model can be configured when the extra accuracy is worth the latency and cost.
- Retrieval recipe A named bundle of retrieval settings — candidate pool sizes, graph depth, whether to rerank, whether to restrict to verified material, the token budget — so a mode is a deliberate choice rather than a scattering of parameters. Six are built in, from low_latency through to forensic.
- Row-level security The Postgres feature that evaluates a policy on every row of every query, enabled and forced on every tenant table. The tenant is set per transaction, so a query that forgets to filter still cannot cross the boundary. The production role is created NOSUPERUSER NOBYPASSRLS, because superusers and BYPASSRLS roles ignore policies entirely.
S
- Semantic memory Durable statements meant to outlive the conversation that produced them: facts, preferences, project knowledge. It answers "what do we know", where episodic memory answers "what was said". Most of what an agent should carry between sessions belongs here.
- Session An imported conversation with its messages, a rolling summary and a path for promoting what mattered into durable memory. It exists so a four-hour transcript is neither stored whole, where it drowns retrieval, nor discarded, where it is lost.
- Source manifest The list returned with a context pack naming every record that made it in. It is what lets you see exactly what the model saw, which is the difference between an answer and an answer you can audit. It also makes it obvious when the pack is thin.
- Source span The precise region of a source document a claim was drawn from, stored as an offset rather than as a loose reference to the file. Pinning to a span means the claim can be re-checked against the exact words later, including after the document has grown.
- Stale-truth suppression Holding back memories that are the source of facts a later fact has superseded, so a preference that changed in June does not resurface as though it were current. It is applied only when the question is about the present; historical and comparison questions need exactly that material and get it.
- Supersession Recording a change by closing the belief window on the old fact and opening one on the new, instead of updating the row in place. Content is never edited and nothing is deleted, so both the current value and the previous one stay answerable. Ingests report how many facts were inserted, superseded and skipped.
- System time The window during which your system believed a fact — also called transaction time. A fact is current when the upper bound of its system time is still open. It is a property of your knowledge, not of the world, which is why it is stored separately from valid time.
T
- Temporal intent The classification of a question as being about the current state, the past, the change between them, or none of the above. It decides whether stale-truth suppression applies. The detector is rule-based and reports its confidence and the signals it matched, so a surprising result can be explained.
- Tenant The isolation boundary. Every tenant-scoped table carries a tenant identifier, the tenant is set per transaction and enforced by database policy, and a login without a tenant claim is refused. Tenants are currently provisioned by an operator rather than by a signup form.
- Token budget The ceiling on how much memory may be packed into one context pack, so what falls off the end falls off predictably rather than arbitrarily. The four modes budget 1,800 tokens for cheap, 3,500 for balanced, 8,000 for deep and 14,000 for forensic.
- Truth state What kind of statement a record claims to be: unknown, fact, hypothesis, simulation, synthetic or fiction. It exists so that a scenario an agent invented for planning cannot later be retrieved as though it were something that happened. It is one of the five dimensions of the governance envelope.
V
- Valid time The period during which a statement was true out in the world, independent of when anyone recorded it. It would be the same whether or not you had a database. Held separately from system time so that a correction can be valid from a date in the past while being believed only from today.
- Verification state How a claim has fared when checked against its evidence: unverified, pending, supported, partially_supported, unsupported, contradicted or superseded. It is separate from authority, which is about the source, and from truth state, which is about the kind of statement being made.
W
- WiCER The compile, evaluate and refine loop applied to memory wiki pages: assemble a page from underlying records, probe it for facts that were lost or distorted in the compilation, and recompile. It is a quality loop for derived pages, aimed at the failure where a summary quietly drops the one detail that mattered.
A note on the words we avoided
Some vocabulary in this field carries more weight than the implementation behind it, and we have tried not to borrow it. The Librarian answers questions by retrieving passages, not by reasoning over them. Claim verification grades by word overlap and reports itself as deterministic. The query planner, the temporal-intent detector and the default reranker are rule-based.
We present that as a feature, because it is one — no key, no per-query cost, no added latency, and behaviour you can read in a file — but the right way to present it is to say what it is. Where a capability is heuristic or off by default, its feature page says so in the same words used here.
Give your agents a memory you can audit
Run the whole system on your own hardware under the MIT licence, or ask us about hosted access. Both start from the same place.