Newest first. Plain language, real dates, and the honest boundary of each thing.
15 July 2026
Browse the audit chain yourself — the Timechain Explorer
You can now open Mnemosyne's audit chain the way you'd open a public blockchain explorer: browse recent sealed blocks, the queue of records waiting to be sealed, and the full detail of any block or transaction. It is read-only and needs no key. Every "anchored" link in the live activity feed now takes you straight to the proof behind it.
New
- A block explorer over the live chain — recent blocks, the pending-seal queue, per-chain statistics, and detail pages for any block or transaction●Shipped
- A search box that resolves any hash to the right page, and feed links that deep-link to their proof●Shipped
- A per-block view of the sealing flow and the payload each block carries, styled after a public mempool explorer●Shipped
Fixed
- The explorer never decrypts anything. Sealed payloads read as empty for everyone, so browsing the chain cannot expose a document — the keyless, read-only invariant is enforced, not just intended.
15 July 2026
Anchored outside the box, and verifiable by anyone
Mnemosyne's audit record is now anchored beyond the machine that holds it: the daemon submits each batch's fingerprint to the public Bitcoin timestamp calendar, so a root once published there cannot be quietly un-published — not even by the person who owns the box and its keys. Alongside it, an append-only transparency log (the same design web browsers use for certificates) lets an outside party prove a given record is included and that the log has only ever been appended to. The block-signing key can now also be rotated without invalidating any past history.
New
- External anchoring: each audit-chain root is timestamped into the public Bitcoin calendar via OpenTimestamps, with a visible freshness warning if anchoring falls behind. Bitcoin confirmation is inherently slow, so a fresh anchor reads as "pending" for a while by design — anchoring is an optional switch, not the default◐In progress
- A transparency log (RFC 6962): inclusion proofs that show a record is in the log, and consistency proofs that show the log was only appended to, never rewritten●Shipped
- Sealer-key rotation: a time-resolved key history plus a signed handover, so the whole chain still verifies after the signing key changes and no key can be spliced in without the outgoing key's signed consent●Shipped
- A downloadable offline audit bundle and a standalone verifier, so a third party can check the chain with no Mnemosyne code, plus a "Verify us yourself" panel in the interface●Shipped
15 July 2026
The system audits itself, continuously and for free
Mnemosyne now re-checks its own tamper-evident record during idle time, at no token cost, so a quiet system is never an unaudited one. A companion hardening pass made the anchored chain itself the single authority on who is allowed to change an access policy, rather than trusting the request that asked for the change.
New
- A continuous integrity routine (the "Sentinel") runs in every idle window and is never blocked by workload or budget — verified firing in production●Shipped
- Access and clearance decisions are settled by replaying the anchored chain as the single authority, so a back-door write cannot grant itself the encryption gate; a signed high-water mark now detects if the pending-seal queue was truncated●Shipped
Fixed
- Every block and transaction is now decoded using the exact format version it was written with, never a newer one.
- The live chain is held to the height the notary actually anchored, closing a window where the two could briefly disagree.
15 July 2026
Knowledge that measurably compounds with use
Mnemosyne is a learning archive, not a fresh search on every question. As a fact is confirmed at the human review desk, its standing in retrieval rises over time while an unconfirmed decoy fades — and this is measured on the real corpus, not a fixture that cannot fail. On the 22-document corpus, a confirmed concept's lead over the rest of the field rose steadily (a +0.41 lead-over-field margin against a never-confirmed decoy), and the effect disappears if the reinforcement step is sabotaged. We also fixed demo search from hanging to well under a second.
New
- Retrieval compounds with confirmation: a confirmed concept pulls monotonically ahead of the field on the real corpus, and the gain dies when the reinforcement step is removed — the number is a lead-over-field margin on a 22-document sample, not a universal accuracy figure●Shipped
- The learning loop runs end-to-end in the live demo, with the activity feed narrating real "consolidated" and "audited" events as the concept count grows◐In progress
Fixed
- The "Try to break it" demo search used to re-run a heavy password hash on every request and could hang on a small box. It now uses a cached, serialised key unwrap and a per-box tuning profile — a warm search is about 0.15s, where before it could hang.
14 July 2026
Need-to-know access as a cryptographic lattice
Access control moved from a flat allow-list to a true lattice: seniority inherits downward, but sensitive compartments and caveats never leak sideways. The check runs when the encryption key is wrapped, not when the screen is drawn — so the boundary is cryptographic, not a display filter. In practice, the CFO can read and search his own financials, while the CEO is still correctly refused personal data he has no need to see.
New
- A clearance lattice: a reader must out-rank the level, hold every compartment, and clear every caveat. Levels inherit by seniority; compartments and caveats never do. The check happens at key-wrap time●Shipped
- The org structure is a signed, anchored governance contract read back off the chain; every change, including moving a person between departments, is a signed, quorum-gated amendment●Shipped
- A document's department comes from where it was filed, not from scanning its text — migrated live across the corpus●Shipped
Fixed
- Search now consults the signed clearance contract on every path. An audit found that two of six access paths had silently used a flat fallback, meaning search could bypass clearance — that fallback is gone.
- Re-sealing a document now moves every derived copy — search index and vectors — along with the fact, closing a bug where the CFO's key opened his P&L but search returned nothing.
14 July 2026
The demo maintains itself on its own rhythm
Mnemosyne now does its own upkeep during quiet windows. An idle-time governor runs the real consolidation and grounding passes when the box is idle — a live search preempts it, a busy box defers it — so the demo you see is the product at its current feature state, running its own cognition, rather than a bespoke script pretending to be one.
New
- An idle-routine governor runs the real consolidation and grounding sweeps when the box is idle, and steps aside for live work — no separate demo-only machinery◐In progress
Fixed
- A repository-wide wiring check now fails the build if a capability has no real caller, so a feature can no longer appear finished while sitting disconnected from the running product.
13 July 2026
The master key comes off disk
A byte-level sweep of what actually sits on disk found the "no clearance, no plaintext" promise was not yet true everywhere — most seriously, the master key was stored in the clear beside the data it protects. That is now fixed: the master key is wrapped behind an operator secret held only in memory, and the full-text search index and provenance quotes are sealed at rest. Some human-readable identifiers that spelled out the very facts they pointed to were also removed. Full sealing of every remaining derived store is still landing before any real customer data is ingested — we name the remaining gaps rather than imply they are closed.
New
- Master key off disk: private seeds are wrapped under an operator secret held in memory only; a sealed keystore refuses to open without the right secret and cannot be silently downgraded to a development mode. A stolen disk yields wrapped keys with nothing to unwrap them●Shipped
- The full-text search index and provenance quotes are now sealed at rest, and a standing check greps the bytes on disk so this cannot silently regress. Two derived stores — the graph's label fields and the vector indexes — are not yet sealed; both are named openly and are closed before real data is ingested◐In progress
13 July 2026
An over-classification is no longer permanent
The classification vocabulary can now evolve, and the seals follow it. If a document was sealed too narrowly and locked out the very people who should read it, an authorized reviewer can declassify it through a signed, anchored ruling — and no one can lift their own wall. A department can be added or dissolved, and the knowledge base re-partitions itself on the chain.
New
- Label schemes are signed, anchored, and versioned — retired, never deleted — and a re-tag sweep moves documents onto the new vocabulary, adding labels only and always anchored to a real span◐In progress
- Declassification: a signed, anchored human ruling can lift an over-tag, gated by capability, with no self-escalation and no stripping of a document's floor labels●Shipped
Fixed
- Ingesting a revised document no longer crashes on a primary-key collision — previously no revision had ever landed.
- A human review-desk ruling now actually turns the document into sealed knowledge; before, the ruling was signed but nothing ingested it.
13 July 2026
The same fact, corroborated across documents
Mnemosyne stopped treating the same fact stated in two documents as two unrelated notes. A curation layer recognises the same fact across documents, so confidence rises with independent corroboration and contradictions are caught on the same pass — and a contested fact stays marked as contested in the answer rather than being quietly resolved. This is the mechanism behind "we are not retrieval."
New
- Cross-document fact canonicalization: confidence rises with independent corroboration; contradictions are detected on the same scan and surfaced as contested, not silently chosen●Shipped
- Curation is partitioned by key-scope, so confidence never adds up across a wall a reader cannot see — a shared count would itself leak that something exists●Shipped
Fixed
- Two adversarial reviews caught the layer breaking its own contract — a contested fact laundered into a confident one, an interrupted pass wedging a concept, a derived link crossing an encryption wall, and answer frames shipping empty behind a swallowed error. All four are fixed with regression tests.
12 July 2026
The living demo went live
We stood up a persistent, always-running instance of a fictional company. It ingests documents, accumulates knowledge, drifts, is swept by the idle routines, and is corrected by a human at a review desk — all on a live tamper-evident chain. It is the artifact that shows the product working end to end, rather than a static screenshot.
New
- A live, persistent instance: people join, move, and leave with their access proved at the key layer; a threaded activity feed; a "try to break it" panel; and a review desk where human rulings are signed and anchored◐In progress
Fixed
- The daemon is the sole writer to the substrate, and a human ruling now threads into the live feed on the next tick — fixing a lock collision that had been crashing restarts.
12 July 2026
Ingestion with a grounding gate
Raw files — documents, spreadsheets, meeting notes, contracts — become anchored, clearance-tagged knowledge. Every proposed fact and every proposed label must point to a verifiable span in its own source, or it is rejected, so the system never authors a fact. Access labels are assigned by a deterministic, signed floor before the model is consulted, so a compromised model can only add restriction, never quietly under-classify.
New
- End-to-end ingestion: standard files are parsed and turned into clearance-tagged, anchored knowledge; a document spanning multiple compartments is quarantined, never sealed under a guessed key◐In progress
- Anchor-or-reject: every proposed fact or label must cite a verifiable span in its source — the mechanism that makes "never authors a fact" enforceable rather than merely asserted, with a re-checkable, zero-token verdict◐In progress
- A deterministic label floor consults the signed scheme before the model runs, so final labels can only tighten under a compromised model. A document-type policy floor took caveat recall from 38% to 100%◐In progress
10 July 2026
The cognitive layer — a graph of facts, not a pile of chunks
On top of the trust substrate, Mnemosyne gained its reasoning structure: typed links between facts, per-fact confidence that revises as evidence arrives, and reusable reasoning patterns. This is what lets an answer be assembled from verified, linked facts rather than from retrieved text chunks. It is the layer the cross-document corroboration (above) then builds on.
New
- Typed links between facts, atom-level confidence that revises as evidence arrives, immutable fact lineage, and anchored reusable reasoning patterns on the existing graph spine●Shipped
9 July 2026
The confidentiality layer — envelope encryption and a key log
Every compartment gets its own encryption key, wrapped only to the identities cleared for it — no clearance means no key means no plaintext for that compartment — and integrity can be checked on the ciphertext without ever decrypting it. Who holds which key is itself an append-only, signed log on the governance chain. Sealing of a couple of derived stores is still being completed (see the 2026-07-13 entry); the substrate encryption described here is in place.
New
- Per-compartment envelope encryption: source blobs are encrypted above content-addressed storage, and integrity is provable on the ciphertext without decrypting it◐In progress
- Identity and key management: per-identity keys, with enrolment, revocation, and rotation recorded as signed governance events — the governance chain doubles as a key-transparency log●Shipped
9 July 2026
The tamper-evident trust substrate
The foundation shipped: a hash-chained, cryptographically signed ledger of the company's knowledge, audit trail, and governance, so every record is accountable and any tampering is detectable. Access policies are themselves signed, anchored contracts the system reads back off the chain. Because there is a single trusted writer on the customer's own box, there are no forks or reorgs.
New
- A four-chain structure — spine, knowledge, audit, and governance — with a uniform block model, dual signatures for the record's author and the block's sealer, a tamper-evident author-signed queue, and an integrity check that halts safely if the substrate's own integrity fails●Shipped
- Access policies are signed, anchored contracts read back off the chain◐In progress