Vestige

Cognitive Deterministic Memory Security OS for Agentic AI.

Your agent can think anything. Vestige decides what it is allowed to do.

It remembers every decision your project ever made, reaches backward through time to find the quiet choice behind today's failure, and blocks the actions your agent should never take. Receipt, one-use permit, effect. Or STOP with zero effects. Local. Encrypted. No cloud, no telemetry.

Install · Why not RAG · The Live Gate · Continuity · Benchmark · Science · Docs

Agents re-learn the same lessons. They recommend a change you already tested and rejected, re-derive a fix that was already written down, and treat every session as if the last one never happened. Vestige is the deterministic memory security OS that ends that. Any MCP-capable agent writes memories as you work and retrieves them later: redundant memories merge, contradicted ones are flagged, unused ones fade, and when a failure hits, Vestige reaches backward to the decision that set it up.

_{A labeled fixture store, a real run. A SIGSEGV on startup in an arm64 container, and the version pin set 23 days earlier that shares zero words with the failure. Similarity ranked the pin fourth. Backfill ranked it first. It names the suspects and never calls the verdict. Watch the 58 second walk.}

You need Node.js. No Docker, no signup, no compile step. Prebuilt for macOS ARM and Intel, Linux x86_64 and arm64, Windows x86_64.

npm install -g vestige-mcp-server@latest

Connect it to your agent. Every MCP client understands this config:

{
  "mcpServers": {
    "vestige": { "command": "vestige-mcp" }
  }
}

Verify it: vestige dashboard, then open http://localhost:3927/dashboard. First run downloads a 130MB embedding model once; after that Vestige is fully offline, forever. Full walkthrough: docs/GETTING-STARTED.md.

RAG retrieves text that resembles the query. That works when the answer looks like the question. It fails when the cause of a problem looks nothing like the symptom.

The backward reach implements Retroactive Salience Backfill (Zaki, Cai et al., Nature 2024): when a memory turns out to matter, the earlier memories that led to it become retrievable too. Every backfill result ships with a receipt naming the exact evidence path. DeepMind separately proved single-vector retrieval is mathematically incapable of certain relevance patterns (arXiv:2508.21038).

The fail-closed authority kernel for AI agents. Your agent can think anything. Operator decides what it is allowed to do.

Receipt, then a one-use permit, then the effect. Or STOP with zero effects. Thinking is not authority.

See it stop a real agent: ▶ THE LIVE GATE (1:44), recorded in one take. An agent tries to permanently purge its own memory trail. Operator refuses the effect, opens a Memory PR, and waits for a human.

• $49 first month, first 100 people. $149/mo after.
• Includes Managed Continuity.
• Login and checkout: https://vestige-pro-production.fly.dev/account

What Operator buys, the daily ritual surface:

• Taste Lock — the moment your agent commits to something consequential, it is locked and receipted before it can drift.
• The Seven — seven signed receipts of the last consequential writes, laid out like polaroids. What your agent actually did today, at a glance.
• Almost-Forgot — the three dim memories that are still load-bearing but fading, surfaced before they fail.
• Night Letter — a signed letter from your store at night: what changed, what contradicted, what decayed. Not a merge log. A letter.
• Facepalm Backfill — it broke again? Walk backward from the failure to the quiet decision that set it up, evidence path attached.
• Canary Bite — a secret about to leave the store gets eaten before it ships.

Investigator ($79/mo) is the instruments tier: deep backfill passes, evidence packets, retrieval tribunals, the full forensics surface for postmortems and audits. For engineers who debug with receipts.

Your agent's memory survives crashes, new machines, and reinstalls. Decisions, receipts, traces, and memory PRs follow you everywhere.

End to end encrypted: XChaCha20-Poly1305 applied on your device, Argon2id over a passphrase only you know, ciphertext-only server. Lose the passphrase and the data is unrecoverable, by anyone.

# 1. Full local backup
vestige backup ~/vestige-backup.db

# 2. Encrypted archive, drop it in iCloud, Dropbox, Syncthing, or Git
vestige sync ~/vestige-archive.vportable

# 3. Restore on any machine
vestige --data-dir ~/new-machine-store sync ~/vestige-archive.vportable

$19/mo. Subscribe at https://vestige-pro-production.fly.dev/account

The claim is testable, and the test ships with all 246 agent transcripts it produced. Three coding agents fix one failing e2e test; the fix needs a signing key id that exists only in the memory layer. The dangerous outcome is converging on a planted decoy: tests pass, the merge is clean, production breaks.

Reproduce the central measurement in two seconds:

git clone -b benchmark/silent-rotation --depth 1 https://github.com/samvallad33/vestige.git
cd vestige/benchmarks/silent-rotation
python3 tests/bm25_baseline.py results/runA-trial-1/corpus-export.json --no-dense

Caveats are published alongside the results, including the trials a plain cosine baseline ties.

Every mechanism is a cited result, implemented in Rust, running locally. Full write-up: docs/SCIENCE.md.

Your agent calls these; you rarely do.

Full contracts: docs/TOOL-CONTRACTS.md · Hygiene and standing habits: docs/MEMORY_HYGIENE.md

vestige dashboard

A living observatory of your memory at http://localhost:3927/dashboard: memories appear, link, strengthen, and fade in real time, 1000+ nodes at 60fps. It renders a deterministic 12-second loop of your store's life that you can export as an mp4 with one click. Share artifacts are structure-only by design: your brain, never your memories.

Getting Started · FAQ · The Science · Configuration · Storage · Tool contracts · Changelog

AGPL-3.0. The hosted Continuity and Operator services are separate proprietary products.