FleetMemory

One ungated agent wrote 4,500 junk records into our production memory graph in a single day. FleetMemory is the system we wish we'd had.

Inspiration

We run AI sales agents in production. Give two agents a shared database and cross-session recall looks solved — until an agent writes something wrong. One ungated writer put 4,500 junk records into our production memory graph in a single day, and a hallucinated fact is worse than no memory at all: a sales agent that "remembers" a discount never offered creates a real financial liability, quietly, days later. Shared memory without governance doesn't fail loudly — it rots. FleetMemory is what we wish had stood in front of that writer: a memory layer that makes every fact earn its way in before an agent can act on it.

What it does

FleetMemory gives a fleet of sales agents one shared memory that vets what goes into it. Every candidate fact passes a write-gate (junk, duplicate, contradiction, confidence, provenance) before it can commit; contradictions and unsourced claims never land silently, they quarantine. An adversarial LLM verifier — default REJECT, fails closed on its own errors — judges each by provenance: a customer's own words supersede an old fact, an unsourced value is rejected, and the reason lands on a queryable decision journal. Nothing is deleted: a correction sets the old fact's invalid_at and moves it into the visible history, so the system answers "what did we believe last week" as well as now. Alex and Maria, two agents, share this memory live — talk to one, come back as the other a "week later," and watch it remember. Hit "hallucinate a fact" and watch it refuse.

How we built it

CockroachDB is the system of record, not a bolt-on store. Bi-temporal facts and the gate_decisions journal live in ordinary tables with UUID keys (no sequence hotspots) and a retry wrapper around SQLSTATE 40001, since CockroachDB is serializable by default. Semantic recall runs on Distributed Vector Indexing (C-SPANN): every customer utterance is embedded with Bedrock Titan v2 and retrieved by meaning through a subject-scoped ANN index. A headless client talks to CockroachDB Cloud's Managed MCP Server to inspect the fleet's memory — gate decisions, current beliefs. On AWS, Bedrock (Claude Haiku 4.5) runs the agents and the verifier, AgentCore Memory is the LangGraph checkpointer for session state, and the app runs as a Lambda container behind a public function URL, kept warm by an EventBridge-scheduled ping.

Challenges we ran into

LangGraph's AsyncPostgresSaver does not work on CockroachDB — it fails on a jsonb_each_text set-returning-function alias, and a multidimensional-array mismatch. We verified this live on a real cluster (v26.2.4) rather than assume the wire protocol was enough, then redesigned instead of patching a checkpointer we don't own: AgentCore Memory took the short-term layer, CockroachDB the long-term one. We filed the upstream issue with a standalone repro: langchain-ai/langgraph#8620. Update (Aug 17): the issue already has community traction — a contributor built a complete fix along our proposed direction, verified against both PostgreSQL 17.5 and CockroachDB v26.2.4 test suites, pending maintainer review.

Lambda deploy added two traps: it rejects the OCI manifest lists docker buildx produces by default (fix: --provenance=false --sbom=false), and since October 2025 a public function URL silently needs two IAM permissions, not one — InvokeFunctionUrl and InvokeFunction — one alone returns a 403.

Inside the container, libpq probed for a client certificate under /root and failed — the sandbox user can't read that path. Fix: certs world-readable, HOME=/tmp.

Accomplishments that we're proud of

The live demo is public and pokeable — no login, a fresh sandbox per visitor — and it runs the real write-gate and verifier, not a scripted happy path. A mini-LongMemEval harness scores 10/10 across extraction, multi-session recall, temporal reads, updates, and abstention, run end-to-end against the deployed stack. We also red-teamed our own gate with 30 adversarial writes across 5 attack classes: the first run found a real hole (unsourced novel claims passed), we closed it, and the re-run blocks 30/30 while still passing 9/10 legitimate customer-confirmed updates — the full reproducible run ships in the repo. The verifier catches hallucinations live, in front of a judge clicking a button, not in a slide. The whole cycle — write-gate, verifier, bi-temporal facts, semantic recall, MCP introspection — is a working, MIT-licensed, public repo, built inside the hackathon window.

What we learned

Memory governance is the missing layer of most agentic systems we've seen, ours included until this incident: everyone builds recall, almost no one builds refusal. A database that says no to a write is more valuable than one that accepts everything gratefully — the failure mode of ungated memory isn't a crash, it's a fleet confidently acting on something false. And the mechanism only matters if a non-engineer can see it working: plain-language verdicts and visible refusal stamps matter as much as the gate logic underneath them.

What's next

CockroachDB's native multi-region distribution is the natural next step for a fleet operating across geographies — the schema doesn't change, only the topology. Beyond that: richer fact types than flat predicate/value pairs, batch reconciliation for the verifier instead of one contradiction at a time, and packaging the write-gate as a layer that sits in front of existing memory frameworks rather than requiring a rebuild.

How FleetMemory maps to the judging criteria

• Agentic Memory Design — a write-gate and an adversarial verifier stand between every agent and the memory store, so "remembering" requires earning trust, not just writing a row.
• Technical Implementation — CockroachDB does three jobs at once (bi-temporal fact store, decision journal, C-SPANN vector index) behind serializable transactions with retry, alongside AWS Bedrock and AgentCore.
• Real-World Impact — built from a real production incident in our fleet, at a scale of roughly a thousand memory queries a month, where a hallucinated fact carries a real financial cost.
• Production Readiness — 10/10 on a live evaluation harness, 17 integration tests against a real cluster, a red-team suite (30/30 blocked), a queryable audit journal, fail-closed error handling, and an idempotent deploy.
• Creativity & Originality — the demo's climax is the system refusing to remember something false, with a reasoned, on-the-record verdict, instead of the usual recall-only memory demo.

Built With

• agentcore
• amazon-bedrock
• aws-lambda
• claude
• cockroachdb
• cockroachdb-cloud
• fastapi
• langgraph
• model-context-protocol
• postgresql
• python
• titan-embeddings
• vector-search