One shared memory for every coding agent on your machine. It is the record of who is on what — and it refuses to answer about work somebody else has taken, and refuses the edit before the write lands.
local-firstno network on the read path MCP · CLI · GitHub Action · libraryMIT
pip install "git+https://github.com/drexthealpha/Knos" knos demo
Ninety seconds on a throwaway repo it deletes afterwards. Every number below is read out of the JSON those scripts wrote — this page holds no hand-typed figures.
A scheduled workflow re-runs every one of these scripts on a clean Ubuntu machine each day and commits whatever moved. On the last run, every figure came back identical — the only lines that changed were the timestamps. None of this is reproducible only on the laptop it was written on.
Not a degraded mode. The last beat of the demo removes the store and re-runs every refusal, live:
pytest tests/test_sibyl_is_load_bearing.py
Sixteen real operating-system processes, one connection each, reaching for the same topic in the same instant, eight rounds. The ablated condition is sharing, not the file: give every agent its own memory — which is what an agent has today — and they all take the same work.
python scripts/collide.py
Purchases settle over x402 in real USDC on Base mainnet, and the receipt goes back into the store, so the gate reads a Base transaction hash to decide whether to spend again. One ordinary day of five agents:
python scripts/spend.py
Every other refusal here is about the topic — somebody is mid-change on it, a decision under it was reversed, the store already has it. This one is about the agent. On a machine several agents share, the budget is one pocket, and an agent that buys an input then drops the work bought nothing.
python scripts/budget.py
The percentage is the weaker number. The point is not that less money moved, it is that the money which moved went to work somebody finished — and the agents that finish things were never stopped. Hard to trip on purpose: three pieces of work before anyone is judged at all, a new agent spends freely, and finishing work earns it back. Not a security boundary — an agent picks its own name — it is what an agent said about itself held against what it did last time, applied where being wrong costs money.
A claim's lifetime is learned from the share of claims that agent actually closed — 15 minutes for one that never finishes, 45 for one that always does, 30 for anyone seen fewer than twice. One seeded working day, four agents, two that mostly do not finish:
python scripts/contention.py
An override is the one thing an agent does against somebody else's work, and the only cost it carries is that it goes in the journal under its own name. If that line can be edited afterwards, the cost is zero. Each writer's entries are chained, so altering one breaks its link and dropping one leaves a gap in the sequence.
The two halves are not equal strength and the page says so rather than
rounding up: an edit is caught for every entry, always. A
deletion is caught only inside a chain of more than one, because a gap
needs a line either side of it. Facts knos read out of your code name a file and a line as
their source, so each is a chain of one; the facts that record what agents did — claimed,
stood down, overrode — carry the agent as the writer, and those are the chains with
length. knos verify prints both counts.
knos verify
Tamper-evident, not tamper-proof — whoever holds the file could rewrite a chain from the start; what they cannot do is change one line in the middle. The chain is per writer on purpose: one global chain forks the moment two agents append together, and a fork is indistinguishable from an edit. Tests tamper with the SQLite file directly: test_seal.py.
Each arm run twice: once with the store, once with the same code and nothing to read.
| what | with the store | without it |
|---|
python scripts/ablation.py
Eleven transaction hashes appear in this repository. This resolves each one against the chain it is documented against — no key, no account, public RPCs — and exits non-zero if any fails.
knos receipts # or: python scripts/verify_receipts.py
| chain | what | transaction |
|---|
Here rather than in a footnote, because a ledger nobody can check is not evidence.
| Retained users | none |
| Merged by third-party maintainers | 2, plus a listing in a 94.5k-star index |
| Pull requests that were the wrong idea | 34, closed with an apology |
The whole ledger, including the failures: docs/PMF.md.
| memory.py | every write and read into Sibyl, in one file |
| mcp._held | whether an agent gets an answer at all |
| guard.check | whether a file is written to disk |
| gate.decide | whether money moves |
| record.holds_for | how long the next claim survives |