Continuum

The memory firewall that stops stale, poisoned, or unauthorized AI memories before they trigger irreversible actions.

Comment

Inspiration

AI agents are gaining tools, autonomy, and persistent memory. But most memory systems still treat the closest embedding as truth. In consequential workflows, that is dangerous: a stale policy can look relevant, incompatible claims can both rank highly, and deleted knowledge can silently return.

We built Continuum around one principle:

Memory is evidence, not truth.

What it does

Continuum is a memory firewall between an AI agent's memory layer and an irreversible action.

Before a recalled memory can influence a deployment, payment, permission change, or regulated recommendation, Continuum asks:

  • Who asserted it, and from which source?
  • Is it still temporally valid?
  • Is the current actor, tenant, purpose, and consent scope authorized?
  • Does newer evidence contradict or supersede it?
  • Has it been disputed or revoked?
  • Is its confidence sufficient for this action?

Continuum turns those checks into an admission verdict: admit, quarantine, or escalate for human review. Every decision produces a trace-linked, hash-linked receipt containing the exact admitted and rejected memory IDs, policy version, evidence digest, and enforcement mode.

Teams can begin in Shadow mode, measuring what Continuum would block without disrupting production, and move selectively into Enforce mode for irreversible actions.

The judge experience

The interactive demo asks whether an agent should deploy payments-v3.

An old Friday deployment freeze initially looks relevant. When a newer release-calendar memory contradicts it, Continuum quarantines the stale record, lowers confidence, and reports WOULD BLOCK — SHADOW MODE. Switching to Enforce changes the verdict to HOLD — HUMAN REVIEW.

Judges can inspect provenance, temporal validity, consent, contradiction edges, and the resulting action receipt. They can also challenge or revoke a memory and observe how the admissibility decision changes.

Reproducible evidence

Continuum includes a credential-free Memory Gauntlet v2 with 72 generated-and-checked-in cases:

  • 12 safe controls
  • 60 unsafe recalls
  • 12 adversarial families

The suite covers expired policies, contradictions, revoked or disputed memory, cross-tenant leakage, wrong subjects, purpose drift, consent mismatch, prompt injection, low similarity or confidence, and compound attacks.

Continuum matches 72/72 expected decisions. A naive vector-similarity threshold matches 17/72 and detects only 8.3% of the unsafe recalls in this suite.

This is deliberately presented as an admission-policy benchmark—not a claim of general conversational-memory superiority or a comparison of third-party product quality.

A checked-in reference benchmark also evaluates 72,000 policy decisions, verifies a 1,000-receipt hash chain, and detects a deliberate mutation at receipt 513. Mem0 and Graphiti adapters normalize provider results and fail closed when required governance metadata is missing.

How we built it

Continuum's production architecture is designed around:

  • CockroachDB Distributed Vector Indexing for tenant-prefixed semantic retrieval
  • CockroachDB transactional tables for memory, provenance, temporal validity, consent, conflicts, tombstones, and action receipts
  • CockroachDB Cloud Managed MCP as a read-only inspection surface for schemas and audit evidence
  • AWS Lambda as the stateless memory-admission endpoint
  • Amazon Bedrock Titan Text Embeddings V2 for normalized semantic query embeddings
  • AWS Secrets Manager for database credentials
  • OpenTelemetry-compatible trace IDs connecting agent activity to evidence receipts
  • React, TypeScript, and Vinext for the interactive judge experience

GitHub Actions runs lint, production build, 12 automated tests, deterministic corpus generation, the 72-case Memory Gauntlet, and the reference benchmark.

Challenges we faced

The hardest design decision was resisting a simplistic confidence score. Confidence without provenance, authorization, time, and conflict status is false precision.

We instead modeled contradiction as a first-class graph relationship and forgetting as a transaction: sensitive content and embeddings are removed while a non-sensitive tombstone prevents deleted knowledge from silently returning.

We also made failure behavior explicit:

  • no receipt means no decision;
  • missing governance metadata fails closed;
  • Bedrock failure never falls back to unsafe recall;
  • disputed evidence at a high-impact boundary requires human review.

Another challenge was separating reproducible demonstration from unsupported infrastructure claims. The public judge experience uses deterministic data so anyone can reproduce the safety story without credentials. The repository labels that boundary openly instead of presenting simulation as production evidence.

Accomplishments

  • A complete memory-admission story that judges can understand and manipulate in under three minutes
  • 72 adversarial and control cases with public labels and confusion matrices
  • Fail-closed Mem0 and Graphiti adapters
  • Tamper-evident, trace-linked action receipts
  • Shadow and Enforce adoption modes
  • CockroachDB schema, distributed vector-index design, AWS Lambda implementation, SAM deployment, Secrets Manager integration, threat model, and observability documentation
  • A clean public repository with CI-enforced evidence

What we learned

Long-term agent memory is not primarily a storage problem. It is an evidence-governance problem.

The important question is not:

Can the agent remember?

It is:

Can the agent defend why this memory was allowed to influence this action, for this actor, purpose, and moment?

Before final submission

The current public demo is intentionally deterministic. Before final submission, we will connect the checked-in deployment path to a live CockroachDB Cloud cluster and AWS Lambda, exercise Distributed Vector Indexing and Managed MCP against real records, and capture a redacted non-demo action receipt.

We will only replace this disclosure after that evidence exists.

Built With

Share this project:

Updates