Severian

Long-term memory for AI agents that runs on your own machine, remembers where every fact came from, and keeps every user's memories apart.

Severian gives an agent a memory it can trust. It saves what was said exactly as it was said, derives short searchable memories from it, and hands the answering model a compact, cited context block for each question. It runs on SQLite out of the box (PostgreSQL + pgvector when you need it), works fully offline, and plugs into Hermes Agent, any MCP client, a CLI, an HTTP API or plain Python.

Results

Severian on the OmniMemEval long-term-memory leaderboard (October 2026). Every other row is OmniMemEval's own published record, copied verbatim; Severian's row (†) is our run through the same public harness, answer model (gpt-4.1-mini), judge (gpt-4o-mini), prompts and metrics, not an official board entry. 🥇 marks the best score in each column; - means not run.

• 1st on LongMemEval, 2nd on LoCoMo, 2nd on BEAM 100K (0.22 behind LCM-X). The board has no error ranges, and on 400 questions a gap that small is noise; Severian has not been run on BEAM 10M, PersonaMem v2 or HaluMem yet.
• We checked the board before building on it. Re-running LCM-X through the same pipeline gave its published scores back within 0.65 points. Compared question by question, Severian is ahead of it on LoCoMo (+7.9, 95% range +6.0 to +9.7) and LongMemEval (+4.0, +1.2 to +6.6) and level on BEAM, and a stricter second marker (Claude Opus) agrees.
• Trade-offs, stated plainly. Severian hands the answering model more text than most systems and makes model calls when it saves memories. Hermes ships it with a cheap 8,000-character context cap, which costs little on LoCoMo but about 8 points on BEAM and LongMemEval; raising it to 16,000 characters wins back about 5 points on each (settings).
• We found a marking flaw in BEAM that rewards made-up answers to "the chat never said" questions. It inflates every system's BEAM score, ours included (details).
• Zero leaks, zero stale facts. On Severian's own adversarial quality gate, a corrected fact never comes back in search (0.000 stale-fact rate) and no query ever returns another scope's memory (0.000 leakage).

Per-benchmark tables for every system (LoCoMo, LongMemEval, BEAM, PersonaMem v2, HaluMem), the LCM-X validation, the plan and its changes, and the limitations are in docs/benchmarks/omnimemeval-2026-10.md. Our earlier internal round against Mem0, Mnemosyne, Hindsight and Honcho (different harness and marker) is in docs/benchmarks/competitor-round-2026-10.md.

Why Severian

• Nothing is lost, nothing is made up. Raw observations are append-only and hashed. Every memory and every search hit cites the observation it came from, and corrections create a new revision instead of overwriting history, so any earlier version can be restored.
• Scope is the security boundary. Every read and write names five levels: tenant, profile, collection, agent and session. There is no default scope, and another scope's memories are never returned or even hinted at. Agents can opt in to reading an explicit list of teammates' scopes.
• Built for real conversations. Short facts per turn, real dates for relative times, newer facts that close older ones, and a note when two memories disagree, so the agent answers with the current truth.
• Hybrid search that holds up. BM25 and vector search fused with reciprocal rank fusion, an optional cross-encoder re-ranker, an entity graph for multi-hop lookups, and a context assembler that keeps the most useful items inside a character budget.
• Local-first. No network call from the engine; cloud derivation needs an explicit per-collection opt-in. Qwen3 0.6B embeddings run locally or in a shared sidecar; a deterministic hash embedding needs nothing at all.
• Looks after itself. Background "dreaming" merges near-duplicates and flags contradictions, curation scores salience, and retention policies archive instead of deleting.
• Operable. Crash-safe leased worker jobs, dead-letter recovery, export/import, side-by-side vector rebuilds, an integrity audit, per-profile fact rollback and an optional Rust acceleration module.
• Harness-agnostic. The same engine serves any agent framework through the CLI, the Python SDK, the HTTP API or MCP, and runs unchanged on SQLite or PostgreSQL; the Hermes plugin is one adapter on top.

How it works

                        ┌──────────────────────────────────────────┐
                        │                SOURCE INPUT              │
                        │  text observation · attachments (multi-  │
                        │  modal metadata: image/audio/video/file) │
                        └──────────────────┬───────────────────────┘
                                           │
                                           ▼
                        ┌──────────────────────────────────────────┐
                        │          IngestionService                │
                        │  normalise · hash raw · source identity  │
                        └──────────────────┬───────────────────────┘
                                           │
                 ┌─────────────────────────┼─────────────────────────┐
                 ▼                         ▼                         ▼
   ┌───────────────────────┐   ┌───────────────────────┐   ┌───────────────────────┐
   │   CANONICAL STORE     │   │   derive job queue    │   │  Entity/Relation       │
   │  (SQLite | PostgreSQL)│──▶│  (leased, crash-safe, │──▶│  Graph (auto-populated │
   │  observations         │   │   idempotent)         │   │  by EntityExtraction)  │
   │  memories             │   └───────────────────────┘   └───────────────────────┘
   │  entities/relations   │
   │  jobs · audit events  │   append-only · scoped · hashed · supersede-aware
   └───────────────────────┘
                 │
                 ▼
   ┌──────────────────────────────────────────────────────────────┐
   │  DerivationService (worker drains derive/episode/dream jobs) │
   │  · policy-gated (cloud_allowed false by default)             │
   │  · deterministic hash OR Qwen 0.6B semantic opt-in          │
   │  · skips superseded observations (P0-5)                      │
   │  · EntityExtractionService upserts entities + typed relations│
   └──────────────────────────────────────────────────────────────┘
                 │
                 ├──────────────► ProjectionCoordinator
                 │                 ├──► FTS5 lexical projection (BM25)
                 │                 └──► vector projection (hash default;
                 │                      Qwen 0.6B semantic opt-in, 384-dim)
                 │
                 ▼
   ┌──────────────────────────────────────────────────────────────┐
   │  RetrievalService (hybrid RRF fusion)                        │
   │  · coverage abstention gate    · salience-weighted ranking   │
   │  · shared-scope read (search_shared, opt-in multi-agent)     │
   │  · temporal query orientation (active head first for present)│
   └───────────────┬──────────────────────────────────────────────┘
                   │
                   ├──────────────► ContextAssembler (bounded, source-cited)
                   │
                   ▼
   ┌──────────────────────────────────────────────────────────────┐
   │  GraphRetrievalService                                       │
   │  · BFS neighborhood over Entity/Relation (both directions)   │
   │  · temporal validity filtering (expired relations excluded)  │
   │  · related_memories by min graph distance                    │
   └──────────────────────────────────────────────────────────────┘

   OFFLINE SELF-REGULATION (dream worker jobs, non-destructive):
   ┌──────────────────────────────────────────────────────────────┐
   │  ConsolidationService  · Jaccard near-dup merge (>= 0.8)     │
   │  CurationService       · salience scoring (recency+usage+    │
   │                          confidence), review markers only    │
   │  RetentionPolicyService· max_age/min_usage/kinds policy,     │
   │                          evaluate + opt-in archive           │
   │  ContradictionScanService · report-only, never auto-resolves │
   └──────────────────────────────────────────────────────────────┘

• The canonical store is the only source of truth. Search indexes are projections that can be rebuilt from it at any time.
• Worker jobs derive memories and facts in the background, so saving stays fast. A failed job retries and then dead-letters; it never silently disappears.
• Retrieval runs inside one exact scope, fuses lexical and semantic results, and drops memories a newer fact has closed from the current view (they stay in history).

More: architecture, memory engine, threat model.

Quick start

Requires Python 3.11+ and uv.

git clone https://github.com/Sahil-SS9/Severian.git
cd severian
uv sync

# Save an observation in a scope
uv run severian ingest \
  --database data/severian.db --fts data/fts.db --vectors data/vectors.db \
  --tenant acme --profile alice --collection main --agent cli --session ses-1 \
  --content "Alice signed the Acme contract on Friday" \
  --source '{"uri": "note://contract-1"}'

# Search it (--derive processes pending jobs first; production runs `severian work`)
uv run severian search \
  --database data/severian.db --fts data/fts.db --vectors data/vectors.db \
  --tenant acme --profile alice --collection main --agent cli --session ses-1 \
  --query "contract" --derive

Or run the Python example, which saves memories for two users, searches one and builds a cited context:

uv run python examples/quickstart.py

Use it from

Configuration

Behaviour switches are environment variables, so the same code serves benchmarks, tests and production.

The recommended settings are the ones benchmarked above. PostgreSQL setup: docs/postgresql-backend.md. Day-to-day running: docs/operator-runbook.md.

Roadmap

Two moves carry the next round: per-person fact sheets to close the multi-hop gap, and a better rule for knowing when to answer "I don't know". Then a wider field (MemMachine, Graphiti/Zep, Letta, Cognee, LangMem, Memobase), a cloud-model check of the winning setup, and stricter marks: every in-house run re-marked by Opus, plus cost per memory, a 10x-size stress test, and a confident-wrong vs "I don't know" measure.

Contributing and security

See CONTRIBUTING.md for the development loop and quality gates, and SECURITY.md to report a vulnerability. Release history: CHANGELOG.md. All documentation: docs/.

License

MIT. See LICENSE.