Launch of MAPL — verifiable memory for AI agents

AI agents have memory. They mostly do not have audit. The pattern is consistent across every production agent system we have looked at: a vector store sits between the agent and its history, the agent retrieves a few chunks per request, the chunks influence the answer, and nobody — not the user, not the operator, not the regulator — can prove which chunks the agent actually saw, in what order, or whether anything was suppressed.

Osyra Labs is publishing MAPL — Memory Architecture and Provenance Layer — to close that gap. MAPL is a tamper-evident write-ahead log for agent memory, paired with a wire protocol (OAP-MEM) for cross-tenant verification and a portable bundle format (.osymem) for taking memory with you when you switch providers. This post is the public launch.

The integrity gap in agent memory

A retrieval-augmented agent is a closed loop: the agent reads memory, drafts an answer influenced by what it read, and writes the new exchange back to memory. The loop is opaque by default. Three failure modes follow:

Adversarial omission. A privileged operator drops the top-K most relevant memories from a tenant's retrieval window. The agent's answer changes, the user has no recourse, and there is no record that anything was dropped. We have already seen this pattern in financial-services agents under load — operators silently truncate memory to control cost, with no commitment to a specific retrieval policy.

Cross-tenant bleed. A misrouted retrieve attaches one tenant's history to another tenant's prompt. Without a tamper-evident log, the affected tenant cannot prove the bleed happened — only that their answers got weird for a window. Compliance teams hate this for the obvious reasons.

Provenance loss on migration. A customer wants to leave Provider A for Provider B. They have two years of agent interactions in A's proprietary memory store. There is no portable bundle, no signed manifest, no way to prove the migrated memory is the same as the source. Most customers stay locked in.

What MAPL is

MAPL is three pieces. The substrate (the write-ahead log + the integrity primitives), the protocol (OAP-MEM, the wire format that lets two systems exchange and verify memory claims), and the bundle (.osymem, the on-disk format that makes memory portable).

Every claim — every time the agent reads or writes — produces a signed log entry. Each entry chains to the previous via a hash, so a single deletion is detectable. Read claims commit to which memories were considered, not just which were returned, so a top-K omission is provable. Bundle exports are signed by the workspace's key, so a portable export from Provider A is verifiable when imported into Provider B.

The architecture is content-addressed and append-only. We deliberately avoided a clever B-tree or LSM design — agent-memory throughput is small relative to OLTP throughput, and the audit guarantee is the primary feature. Simple beats clever when the goal is "every researcher who reads the spec immediately understands the integrity argument."

What is open today

The protocol RFC is at OAP-MEM-0.1.md in the Osyra spec repo. The Go prototype passes 57 tests and produces verifiable bundles round-trip. The whitepaper draft — Memory Architecture and Provenance Layer v0.1 — is in CEO review and ships externally next week. We are inviting external review now from anyone working on agent memory at scale.

The license posture is intentionally open. The protocol is published under CC-BY for free reuse; the reference implementation is Apache 2. We want OAP-MEM to become the lingua franca of agent memory, not a proprietary moat — and we are happy to accept upstream contributions from competing memory vendors. The competitive layer for Osyra is the control plane, not the wire format.

Why we built it inside Osyra

The simple answer is that we needed it for our own product. Every Osyra agent customer eventually asks the same question: "can I prove what the agent was given on this specific request, six months from now, in front of a regulator?" The answer needs to be yes — and not "yes, modulo some logs that may have rotated." MAPL is what makes the yes hold.

The deeper answer is that agent memory is the next infrastructure layer where the audit story will be written. Inference itself is increasingly commoditized — the providers fight on cost and latency. Memory is where the differentiated trust story lives. If MAPL becomes the open standard, every memory store can plug into Osyra's audit pipeline and our customers get one consistent answer regardless of which vendor's vector store sits underneath.

What is next

The V1 ship target is July 2026 — the full substrate plus protocol plus bundle format under an SLA. The research track continues in parallel: completeness witnesses (proofs that no top-K item was suppressed), tombstone-salt rotation, Biscuit attenuation for delegated reads. If you want the early-access list, email the lab — we are onboarding the first cohort of design partners now.

There is a longer architectural piece queued for the lab journal — MAPL Completeness-Witness v0.1, the formal argument for why top-K omission detection works under adversarial operators. We will link it from this post when it ships.