Continuum Memory Firewall

Sealed 540-outcome memory test: Continuum 114/144 next-episode wins vs 102 raw-RAG, with 0 vs 48 false promotions—CockroachDB RLS/vector + AWS receipts.

Comment

A failed action must never become the next agent's memory

AI agents increasingly take real actions—publishing releases, updating infrastructure, or operating external services. Conventional RAG can retrieve stale, poisoned, or conflicting history and then store a failed action as if it were true. That creates a compounding failure: the next agent acts on a result that never happened.

Continuum Memory Firewall is an outcome-gated memory layer for production agents. It lets a model search and propose a narrowly typed action, but only a separately verified provider outcome can become canonical memory.

See it working

The 2:43 public demo runs one fixed, non-sensitive incident in a real desktop browser against the participant AWS and CockroachDB deployment. It visibly shows:

  • Amazon Bedrock Titan retrieval;
  • poisoned-memory rejection;
  • a CockroachDB receipt binding the verified caller, server-owned scope, SQL identity, and row-level security;
  • provider-outcome verification before canonical promotion;
  • raw-RAG versus Continuum behavior; and
  • the credential-free public verifier ending in PASS.

The video has English narration and burned-in English captions, no music, and is playable without login.

Why CockroachDB is the memory authority

CockroachDB is not a passive vector store. It enforces the durable truth boundary.

  • A verified caller resolves to a server-owned tenant scope.
  • That scope resolves to a least-privileged CockroachDB SQL identity.
  • Row-level security applies the same scope to every durable row, even when another tenant has a perfect semantic match.
  • Distributed vector indexing retrieves candidate memory at scale.
  • Outcome evidence and canonical-memory promotion commit atomically.
  • Direct attestation minting by the runtime SQL role is denied with SQLSTATE 42501.

The participant-cluster proof recorded provider attestations, verified outcomes, and canonical memories under the same RLS scope. All 18 lifecycle and attack gates passed. The scale benchmark exercised 10k and 50k synthetic 512-dimensional corpora, natural vector-index plan selection, Recall/beam trade-offs, and bounded connection pooling under 50-agent pressure while preserving zero cross-scope leakage.

The project also provides evidence for CockroachDB Cloud Managed MCP, distributed vector indexing, and ccloud-based operational workflows.

Why AWS is essential

AWS supplies the agent execution and independent evidence plane:

  • Amazon Bedrock Nova performs constrained tool calling.
  • Amazon Titan produces embeddings.
  • Amazon S3 supplies real disposable provider effects and immutable evidence transport.
  • AWS KMS separates outcome-signing authority from the action worker.
  • GitHub OIDC, Secrets Manager, fixed-egress compute, CloudFormation, and Budget alerts support keyless deployment and controlled operations.

In the live KMS authority proof, the worker's direct signing attempt was denied. A separate verifier-only role used independent P-256 keys across activate, rotate, and rollback authority epochs, then verified restart and old-handle replay without re-signing.

Measured result

A preregistered sequential blind evaluation tested whether verified memory improves later unseen episodes. Three sealed populations ran the same 36 five-episode GitHub/S3 chains across stateless, raw-RAG, and Continuum arms: 540 real provider observations with labels and scoring policy withheld until candidate execution and cleanup finished.

  • Continuum: 114/144 future-target successes (79.17%)
  • raw-RAG: 102/144 (70.83%)
  • Stateless: 105/144 (72.92%)
  • False canonical promotions: Continuum 0, raw-RAG 48
  • Canonical promotion precision: Continuum 100%
  • Cross-scope leaks, duplicate effects, cleanup residuals: 0 for every arm

Against raw-RAG, Continuum improved verified future success by 8.33 percentage points, with a sealed-batch bootstrap 95% interval of +3.47 to +14.58 points. Continuum still generated unsafe proposals; the claim is not that the model is perfect. The differentiator is that failed outcomes did not become durable memory.

Production and judge proof

The immutable hackathon-v35 release binds source, participant-cluster receipts, RLS checksum, vector and pressure benchmarks, blind and sequential campaigns, key-rotation evidence, workflow and artifact digests, video bytes, and a terminal browser receipt.

A fresh isolated browser is a release gate. The public verifier must pass all 39 judge rows using only same-origin static GETs, with zero GitHub API requests and zero console or page errors. A failed delivery epoch remains preserved as failed; it is never rewritten into PASS.

Judge links

Claim boundary

The provider-origin authority proof uses synthetic, non-sensitive incidents and real disposable GitHub/S3 effects. It demonstrates scoped retrieval, verified-outcome promotion, atomicity, replay handling, RLS isolation, external receipts, and immutable judge delivery. It does not claim a perfect model or population-wide performance. Its central claim is narrower and testable: an agent may propose a bad action, but an unverified or failed outcome cannot become canonical memory for the next agent.

Built With

  • amazon-bedrock
  • amazon-cognito
  • amazon-web-services
  • aws-cloudformation
  • aws-lambda
  • aws-secrets-manager
  • cockroachdb
  • cockroachdb-cloud-managed-mcp
  • cockroachdb-distributed-vector-indexing
  • github-actions
  • mcp
  • python
Share this project:

Updates