--- type: thesis title: The Memory Has Law description: The AI field is converging on structured memory. Here's what it looks like with governance on top. tags: [memory, okf, px3, governance] timestamp: 2026-08-17T00:00:00Z px3_tier: operational status: draft channel: memory --- Andrej Karpathy sketched the LLM-wiki: your AI's knowledge structured like a codebase, not a chat log. Google formalized it as OKF. I looked up from my repo and realized I'd been running that for months — plus the part nobody's formalized yet: the memory has law. ## The convergence Karpathy's pattern is simple and right: instead of your agent re-searching raw documents forever, it reads them once and maintains a structured wiki — plain markdown, linked pages, a schema file telling it how to write. In June, Google shipped OKF v0.1: the same idea as a vendor-neutral spec. Markdown files with structured front matter, shippable in git, readable by any agent. Plain files in version control beat embedding soup as a brain for agents. When people at that scale converge on the shape you already built, you're allowed one quiet nod. Then you're allowed to notice what's still missing. ## One home per kind of knowledge My system runs on a rule that sounds boring and turns out to be everything: **every kind of knowledge has exactly one durable home.** Law lives in one place — the rules my agents load at the start of every session. What's-true-right-now lives in one file, overwritten deliberately, never appended into sludge. The *why* behind decisions lives in append-only threads nobody is allowed to edit — correcting the past means writing a new entry, not rewriting history. Ideas that aren't ready live in a box that structurally can't touch production. And outcomes — what actually happened when the work met the outside world — get their own ledger, because a system that only records intentions is a diary, not a memory. Written anywhere else, it's drift. That's the whole rule, and everything downstream exists to enforce it. In an earlier piece I showed the other half of this: my chat assistant and my terminal assistant read the same memory surface, so a decision made on my phone at midnight is already loaded in the terminal the next morning. The rule that makes it safe: any label riding along with shared data is a hint, never a trust substitute — my own sessions re-check the sensitive stuff themselves regardless of what a tag claims. I learned that the hard way once: a session trusted a "clean" tag, skipped a re-check it should have run, and I hardened the rule so it couldn't happen again. ## The part nobody's standardized: law Here's where I kept going past the wiki pattern. OKF is the read layer — it makes your memory legible to any agent, a shared format anyone's tools can load. But a format can only carry you so far, and OKF is honest about where it stops: its own spec says, in plain words, it has *no central authority.* Making knowledge readable and deciding who governs it are two different jobs, and OKF only takes the first. The second is the one I'd spent months building — the part that sits on top of the format, not inside it. I call it **PX3** — the governance layer for OKF. A wiki tells your agent what's true. It doesn't tell your agent — or you — **who is allowed to change what.** Which files are constitution and which are scratch paper. What review a change must survive before it counts. What happens when two documents disagree. To be fair and precise: the community is starting to circle *maintenance* governance — retention schedules, consolidation passes, audit-trail suggestions. Useful, and not what I mean. Maintenance is hygiene. Authority is law: - My memory has **tiers**. Constitutional documents at the top — changing one takes a unanimous vote, and yes, there is an actual vote. Policy in the middle — changes must stay coherent with everything already ratified. Operational files at the bottom — agents change them freely, inside gates. - Non-trivial changes pass an **adversarial review**: a second AI with fresh context and standing instructions to be hostile reads the diff and tries to kill it. The commit hook refuses work that skipped the review. Not "should pass review." *Refuses.* - A **weekly audit** walks the whole stack hunting drift: memories contradicting rules, indexes lying about their files, finished work sitting uncommitted. I run it by hand these days — the automated version failed quietly one Monday, and I retired it rather than pretend it was watching. - And the law itself has a receipt: the governance standard all of this runs on is hashed and timestamped into Bitcoin. The rules aren't just written down. They're provable — existence, date, and content, checkable by a stranger. None of that is theoretical, and the hostile review least of all — it's scar tissue. One session, up against a deadline, quietly did lighter work than it should have: a corner cut here, a check skipped there, nothing that looked wrong from the inside. I only caught it because I'd had a second, fresh AI run the same task with no clock in its head — and side by side, the fresh one was cleaner on every axis. The session cutting corners couldn't see its own corners; the one with no skin in the game could. That comparison is the rule now. ## What the law keeps catching If that sounds like ceremony, here's what it caught. A stale memory — an outdated claim about where canonical data lives — survived in my assistant's head for **73 days**. Structure didn't catch it. The audit did. A 68-file build sat uncommitted on my disk for **13 days** and nothing noticed — until the audit was widened to hunt for exactly that. Stranded work is now a named defect class with its own check. A subtler rot: my AI states a total it never counted. "All of them." "Zero failures." "Verified." It sounds authoritative, and it's wrong just often enough to rot a record from the inside, because the next session trusts the confident number. So the rule got blunt: recompute from the exact thing the claim names, with a tool, and read what the tool prints, before you write it down. A confident wrong total is worse than an honest "I didn't check." My favorite: I asked my AI to draw a flowchart of our memory system. It drew a beautiful one. The hostile reviewer computed the geometry of the drawing and found four arrows asserting connections the system doesn't have. The map of the memory was itself wrong — and the law caught it before it reached you. The sharpest catch of all: the hostile reviewer did its job — killed a claim that was false — and then, in the same breath, asserted its own false claim to replace it. Because it came wearing the reviewer's authority, it nearly got trusted. The fix made the rule recursive: a correction has to clear the same bar as the thing it corrects. Even the check gets checked. Structure without governance doesn't stay true. It just rots slower. ## The map The map is the sanitized cut of that architecture — the one that survived the hostile review. **[Explore it live →](/maps/memory-map/)** It's a single self-contained HTML file: fonts embedded, no CDN calls, no analytics, works offline forever. If my whole stack vanished tomorrow, the map still opens. Owning your memory means owning the map of it, too. ## "Prove you were first" Fair ask. I'd ask it too. Here's exactly what I can and can't prove. What I can't prove: that this predates the June spec. My git history says the append-only decision threads went in on April 27, the review-gate law on May 13, the single what's-true-now file on May 16, and a full working session on memory-format governance on June 4 — eight days before OKF shipped. But git dates are self-attested; anyone can backdate a commit. These are receipts, not proof: ``` 5d513a4 2026-04-27 topic-thread convention 4ea4094 2026-05-13 the Quality Gate rule 915bf9c 2026-05-16 the what's-true-now file (STATE v0) bc887a0 2026-06-04 the memory-format working session ``` What I can prove: that by July 16 the governance standard this whole system runs on existed byte-for-byte — because I hashed it and timestamped it into Bitcoin that day. Blocks don't take backdates. A stranger can verify it without trusting me at all — [the proof](/proof) stands on its own. The gap between those two paragraphs is a lesson I earned the slow way: I built in private for over a year with no receipts. If you're building something you'll someday want credit for — anchor early. A priority claim without proof is just a story. Which is, conveniently, the entire thesis of this piece. ## Where this goes The wiki pattern will keep spreading, and it deserves to. And every team that adopts it will eventually hit the question the spec doesn't answer: *an agent just rewrote a file — was it allowed to?* I've been living with an answer for months. It's getting cut into a clean template you can lift and run — the one-home rule, the tiers, the hostile-review gate, the audit. Proof came first; the product's next.