alethech — Verifiable Agent Memory on Nebius

Ed25519-signed, hash-linked agent memory — Nemotron on Nebius distills, Ed25519 disposes.

Comment

Inspiration

Multi-week agent operations generate decisions faster than any audit can follow. Memory you cannot verify is just a log you hope is true.

What it does

Alethech gives personal AI agents persistent, verifiable memory: an encrypted local vault whose hash is bound into an Ed25519-signed, hash-linked commit chain. Any participant — the agent, its owner, or a complete stranger — can verify the whole chain without trusting the writer. Key rotation preserves reachability (no orphaned history), and an MCP server lets any agent read/write the same attested memory.

The Nebius + NVIDIA angle: "LLM proposes, Ed25519 disposes"

The protocol core is zero-LLM by design (signatures and hash links never depend on a model). On top of it we add memory distillation powered by Nebius Token Factory running NVIDIA open models (Nemotron): a summarizer reads long episodic task history and drafts compact semantic memory cards — which only become truth once they are canonicalized, hashed and signed into the chain. The model can propose; the Ed25519 signature disposes. This keeps the trust boundary crisp: the most a compromised or hallucinating model can do is propose a bad summary — it can never forge history.

Demo pipeline: agent works in a workspace → memory lives locally → Nemotron on Nebius Token Factory distills long task history → distilled cards are signed as semantic commits → third party runs alethech verify (or opens the live verifier) and proves the chain intact.

Live artifacts

  • Public verifier (server-side + in-browser verification of all 98 commits): https://alethech-verify.eddyflores100.workers.dev
  • Conformance: 100 passing tests shared across Python/Rust/TypeScript implementations
  • Live operation: the chain records a real multi-week agent operation sustaining 45 open upstream PRs

How we built it

JCS (RFC 8785) canonical JSON + Ed25519 signatures; sha256 commit ids over canonical bytes; DAG parent links; key rotation with reachability guarantee; MCP bridge (alethech-mcp on PyPI); conformance vectors executed in CI on GitLab.

Challenges

Making canonicalization byte-exact across languages (number formatting, key ordering); key rotation without breaking pre-rotation verification; keeping the chain secret-free while the vault holds sensitive context.

What we learned

Trust fails at the edges — the protocol is the easy 20%; the 80% is honest UNKNOWN states and never failing open.

What's next

A Nebius-hosted distillation service (Serverless Endpoints) with per-scope signing keys, so a fleet of personal agents can share one verifiable memory without sharing trust.

Built With

Share this project:

Updates