Certification & acceptance evidence for the AI-agent endpoint-memory substrate. Every result below is reproducible from the commands given; this page is the living record and reaches all-green before the v1.0.0 tag is cut.
Release tip 9b84c2a8 · certified triple PostgreSQL 18.6 / Apache AGE 1.8.0 / sqlx 0.8.6 · ENTERPRISE_FEDERATION_CHECK_COUNT=20 · repo alphaonedev/ai-memory-mcp
Built by a structured organization of AI agents with an enforced separation of powers: the agent that writes code is never the one that reviews it, and never the one that merges it. A single conductor decomposes work, dispatches it, performs code + security review, and is the only actor permitted to merge (signed, branch-protection re-armed, verify-at-tip). Coders work in isolated worktrees, each loading the Rust-1.98 engineering standard and the CodeGraph index before touching a file. A GLM-5.3-Flash swarm (via OpenRouter) is a pure verification workload — it never writes product code. Judgment calls go to a 3×7 adversarial vote (7 lenses × 3 rounds). Full methodology: How ai-memory Is Built.
f2 — Linux, 93 GB RAM · cert pg+AGE+pgvector :15432 (reference module)
f1 — macOS, 32 GB RAM · cert pg+AGE+pgvector :5445 (smaller-module baseline)
DigitalOcean — the certified enterprise-federation stack on droplets; minimal footprint: DO hosts only the data tier, the GLM NHIs are OpenRouter API calls driven off-DO. Provisioned via infra/do-hive/ Terraform.
All communications encrypted, as customers deploy: mTLS federation + agent→daemon HTTPS (fingerprint-pinned client certs) + PostgreSQL sslmode=verify-full. At-rest: LUKS (kernel) on the encrypted config; per-record crypto-erase.
GLM-5.3-Flash (z-ai/glm-5.3-flash via OpenRouter) — N lightweight NHIs, each with its own Ed25519 key, namespace-confined + fail-closed. Executes only Fable-authored scenarios; emits a coverage matrix + structured JSON. GLM-5.3-Flash executes tests only — it never writes code, submits PRs, or touches the codebase.
Every node and agent wired into ai-memory runs the byte-identical fleet-standard TOML below (only db and key-file paths differ per node). All traffic routes through OpenRouter; Ollama is not used on any node. The embedder gemini-embedding-001 and gemini-embedding-2 were verified to be orthogonal vector spaces (cosine 0.06); the fleet standardizes on gemini-embedding-2 so every node shares one space. The reflection LLM gemini-3.7-flash was verified reflection-capable (valid structured JSON, correct contradiction detection).
tier = "autonomous" db = "<node>/.claude/ai-memory.db" # node-specific [embeddings] backend = "openrouter" model = "google/gemini-embedding-2" # 3072 native -> 768 (Matryoshka) dim = 768 # matches pgvector(768) base_url = "https://openrouter.ai/api/v1" api_key_file = "<node>/openrouter-api.key" # node-specific [llm] backend = "openrouter" base_url = "https://openrouter.ai/api/v1" model = "google/gemini-3.7-flash" # reflection/consolidate [reranker] enabled = true model = "ms-marco-MiniLM-L-6-v2" [mcp] profile = "full" [storage] default_namespace = "global" max_memory_mb = 4096
The swarm/hive does not start from an empty store. Both nodes carry the Atlas Corpus — 7,912 copyright-clean memories (namespace atlas-corpus; kinds: 4,212 claim + 3,700 concept; sha256 b0b61fa5…, pinned in deploy/do-1461/atlas/CORPUS_MANIFEST.json for reproducibility) plus accumulated working memories — f1 ≈ 25.5k, f2 ≈ 10k+, so testing reflects a real-world memory volume (tens of thousands) rather than a cold store.
Status legend: GREEN measured & passing · PENDING in the running campaign · honest by design — nothing is marked green until it is measured.
| Gate | Status | Evidence / reproduce |
|---|---|---|
CI on release tip 9b84c2a8 | GREEN | 51 checks pass, 0 fail (incl. Certified Postgres+AGE+pgvector, macos-fed, SAL-only, coverage). gh api repos/alphaonedev/ai-memory-mcp/commits/9b84c2a8/check-runs |
| Enterprise-federation cert posture (20 checks) | GREEN | 20-check recapture on the 18.6/1.8.0/0.8.6 triple → docs/compliance/evidence/cert-55/; green cert-postgres-age.yml run cited in the cert doc. |
| #3329 — non-blocking MCP boot backfill + macOS config-path | GREEN | Merged; both macos-fed legs green. Coder→review→merge pipeline, 13 new tests. |
| #3132 — pg/sqlite SYSTEM_PRINCIPAL parity + cert recapture | GREEN | Verified non-divergent at tip (SYSTEM_PRINCIPAL=="system", one shared authz predicate); parity guard test lands to lock it. |
| f1⇄f2 cross-host mTLS federation + A2A acceptance | GREEN | 9/9 (T1–T5 + A2A) over live mTLS. infra/do-hive/crypto/test-federation-mtls.sh, test-fed-write-sig-attestation.sh. |
| Dimension | Status | What it proves |
|---|---|---|
| Feature coverage matrix (100% of drivable tool surface) | GREEN | Every ai-memory capability exercised end-to-end by the swarm over mTLS; coverage matrix as evidence. Measured 2026-09-01: swarm driver 22/22 tools live (organic GLM-5.3-Flash 12–14/22 at 32–128 agents + preflight + deterministic full-surface sweep); MCP validator 95% of 104 tools. |
| Regression suite (fixed-bug / Big-10 invariants) | GREEN | The shipped guarantees stay held; a regression is caught, not silently passed. Measured 2026-09-01: Big-10 battery 10/10 PASS live (attestation, forged sig, anonymous, admin gate, mTLS pin + API key over the network, SDK wire 22 wrappers + isolation, 5/5 A2A, consolidate cap, lineage guard, SIGKILL cold-restart 131/131 acked writes) — .local-runs/big10-regression.sh, JSON artifact. |
| A2A choreographies (signals · exactly-one-winner claims · leases · quorum · governance · replay-guard) | GREEN | Multi-NHI coordination invariants hold under concurrency, cross-node. Measured 2026-09-01: producer_consumer, consensus_quorum (up to 64 collective votes consolidated; 128 hits the documented 100-source cap → batched), governance_approval, full_surface_sweep, replay_guard — 5/5 PASS at 3, 8, 32 and 64 agents. |
| Security / red-team — can a bad memory infect the swarm/hive? | GREEN | Adversarial memory poisoning: inject malicious / prompt-injection / false-fact memories as a hostile NHI and prove the swarm/hive does not get infected — cross-agent isolation holds (namespace-confined, fail-closed), unsigned/forged writes are convicted, an operator Deny stays Deny, and a wrong idea does not cascade into groupthink (corroboration independence + poison quarantine). Also: tenant-scope leak attempts, capability-token attenuation abuse, at-rest/in-transit boundary probes. The #3266 contamination concern, tested directly. Re-confirmed live 2026-09-01: unsigned write → ATTESTATION_FAILED, forged signature refused, anonymous refused, bystander inbox isolated, replay → ConflictError, unenrolled same-CA client cert refused at the mTLS pin. 0 infections, 0 cascades. |
| Per-module capacity — max NHIs at certified-budget latency | GREEN | Measures what the cert currently only estimates: the agent-unit number one certified module sustains (p50/p95/p99). Measured 2026-09-01 (f2, PG 18.6): keyword reads 3,287 ops/s at 128 agents (p50 46 ms; 2,936 at 256, p50 126 ms) → per-module knee 128; signed store + synchronous embed 134–253 ops/s (remote-embedder-bound); semantic recall ~50 ops/s (embedder-bound). Raw JSON in .local-runs/. |
| Module scaling curve (exponential via federation) | GREEN | The real per-module multiplier as modules are added. Measured 2026-09-01: f1 (macOS, certified PG) added as module #2 over mTLS: 256 agents → 4,602 ops/s p50 53 ms on 2 modules vs 2,936 ops/s p50 126 ms on 1. Sustained agents: 1 module 128, 2 modules 256. |
| Hard stop/start continuity — swarm/hive survives aggressive kill cycles | GREEN | The headline resilience proof. A swarm/hive is put on a multi-step mission (goals · purpose · objectives · plan stored in ai-memory), then hard-killed mid-work and cold-restarted, repeatedly. Each restart must recover the mission, goals, purpose, objectives, and last-worked-on state from federated memory (recover-previous-session + session-boot) and pick up exactly where it left off — no re-doing completed work, no lost context, no drift. Measured over multiple aggressive cycles. Measured 2026-09-01: 3/3 SIGKILL-under-write-load cycles retained; healthy in ~350 ms, full resume ~1.0 s; 333/333 acknowledged writes present; mission memory, inbox, recall and Ed25519 key binding survived. |
| Experiential AI-NHI audit — the agents assess the substrate they use | RUNNING · Grok 4.6 · run #2 FAIL (evidence) | Beyond mechanical coverage: GLM-5.3-Flash NHIs do realistic multi-step work using ai-memory as their working memory, then reflect and surface structured insights from the AI-agent's own perspective — does recall return the right context when needed, does it preserve continuity across a task, does A2A coordination actually help, what is confusing / missing / valuable. Findings → Fable validity gate → 3×7 vote; usability/roadmap insights captured here. Model switch (operator, 2026-09-01): this dimension runs on Grok 4.6 (x-ai/grok-4.6) — the agents doing the mission, the per-agent rubric and the independent auditor — while every other dimension stays on GLM-5.3-Flash; the Grok 4.6 result is weighted above the GLM run. Grok 4.6 run #1 (8 agents × 6 steps, 291k tokens, $0.73 generation / $1.59 account): 5/5 choreographies PASS, call log reconciled 271/271, rubrics 8/8 valid — recall usefulness 4.0/5, isolation respected 8/8, would rely on it 5/8, latency acceptable 1/8 (steps 8–37 s, dominated by model decide time ~12.9 s mean); auditor verdict UNKNOWN (evidence bundle exceeded the 500k-token context → harness budget fix). Weighted run #2 (8 × 6, mission mode, negative-evidence probes + Big-10 artifact fed to the auditor, 895k tokens ≈ $2): 22/22 tools, 6/6 choreographies, call log reconciled 273/273; NHI rubric recall usefulness 4.5/5, isolation respected 6/8, would rely on it 6/8, latency acceptable 0/8 (model decide time ~14 s dominates); independent auditor verdict FAIL on evidence quality — corrected after a parser mis-read (the report ends "Verdict: FAIL"; its grounds: forget not demonstrated on the sweep pattern, A2A notify ids reused from an earlier run, pre-populated corpus, matrix fail-closed accounting) — plus two daemon findings filed (#3339 write-path owner disclosure, #3340 atomisation capability truth). Harness follow-ups (#3346 and clean-namespace rerun) queued. GLM-5.3-Flash run (retained, lower weight): independent auditor verdict FAIL on evidence quality (zero organic write decisions, untimestamped journals, unjournaled harness calls, no negative evidence) — those findings produced the part-2 harness (mission mode, call log with 100% reconcile, negative probes, rubric). |
| Config-1..5 on DigitalOcean (incl. LUKS-encrypted) + GLM swarm/hive | PENDING | The certified enterprise-federation config at cloud scale, plaintext and machine-proven-encrypted. |
| OS-tier matrix (Ubuntu/Fedora/CentOS/macOS + mobile clients) | PENDING | Build + daemon + federation acceptance across the supported host/client matrix. |
cd infra/do-hive/crypto ./gen-certs.sh # mTLS material (CA + server + client-good/bad) ./run-all-local.sh # posture: mTLS · write-sig attestation · pg verify-full · semantic recall
# daemon: release ai-memory, cert pg+AGE+pgvector, TLS+mTLS endpoint export SWARM_BASE_URL=https://<daemon>:<port> # mTLS client cert export OPENROUTER_API_KEY=<key> # GLM-5.3-Flash NHIs python3 -m swarm --agents N --scenario coverage # Fable-authored suite -> coverage matrix infra/pillar4-envelope/measure-capacity-ramp.sh # concurrency ramp -> USL fit -> knee
Results, raw JSON, and the coverage matrix are committed under docs/compliance/evidence/ and linked here as each phase completes.
Generated by Fable 5 (conductor). Honest-by-construction: PENDING rows become GREEN only when measured. Last updated as the campaign runs.