The design claim: persistent AI memory is not a bigger context window — it is authoritative history reconstruction plus a retrieval and packing pipeline that preserves complete evidence units. A model has no memory between calls. Ora supplies continuity from raw Dialogue exchanges, explicit contributors, and the vault; it then adds lower-priority global retrieval under one endpoint-safe context boundary. Two pieces matter here: the corpus side, which preserves full conversational exchanges while allowing curated atomic knowledge, and the selection side, which admits only privacy-compatible, provenance-bearing, relevant whole units.
The usual retrieval loop — chunk, embed, retrieve top-k, inject — omits three controls Ora needs. It can destroy speaker/context boundaries on the way in, admit private or duplicate sources on the way out, and overflow a real endpoint by treating a nominal context window as usable payload. Ora answers with complete exchange records, eligibility before ranking, lexical plus semantic discovery, source-wide exclusions, and whole-unit packing against the endpoint actually selected.
The corpus side: conversation to atomic note
Semantic extraction replaces summarization. Summarization delegates editorial judgment to the model — you decide what matters — and the model’s idea of what matters is exactly the wrong filter for a memory system, because the discarded detail is what a future query will need. Semantic extraction is a deterministic reformatting instead: find every discrete unit of meaning and render it in minimum viable language, with editorial filtering explicitly prohibited. The metaphor is removing packing foam to show what is in the box, not guessing at the box’s contents.
The extraction operator controls four variables: the unit (a distinct claim, decision, question, constraint, fact, or action item); the compression rule (each unit a single declarative sentence of fifteen words or fewer, units never combined); the prohibition (no evaluation of importance, no omission, repetitions collapsed but no idea dropped); and a forced categorical output — Decisions, Open Questions, Constraints, Facts, Ideas, Action Items, Topics, plus a PROVISIONAL/EXPLORATORY category that exists to solve a specific failure mode: extraction silently tightening a vague exploratory idea into a confident declarative claim. Temperature is pinned at 0–0.1 to keep the operation deterministic. The distinction from summarization is the whole point — a structural instruction, not a judgment call.
Hierarchical semantic chunking replaces fixed-token chunking. Fixed 512-token chunks truncate mid-sentence and split related ideas across boundaries, so the retriever pulls partial context. The replacement aligns chunk boundaries with semantic boundaries defined by heading structure (H1–H4): the retrieval unit is “one complete level of one concept,” not a token count. The governing-idea test is concrete — can a single sentence of fifteen words or fewer describe what all the bullets under a heading are sub-points of? A soft ceiling of two-to-four bullets per level flags when multiple concepts have been packed into one. Token counting happens after structural retrieval, not before: the pipeline pulls the structural unit, then counts tokens for budget decisions, so retrieval stays semantically clean while the context budget stays enforced.
The complete exchange is the conversational record. Each indexed Dialogue row stores Context + User + Assistant. Its vector is supplied separately from bounded Context + User so semantic orientation follows the user’s need without discarding the assistant response from what retrieval returns. Live writes and historical replay target the same contract. Raw exchanges remain authoritative; there is no separate accepted-decision store. One attribution rule is load-bearing: a decision is credited to the user only when the user actually committed to it, never because an assistant proposed it or a model inferred agreement.
The engram lifecycle and the quality gate. An extracted unit enters as provisional. It becomes a kept atomic note — an engram — only after passing the Note Quality Gate’s criteria and the user’s keeping it; that act of keeping is what makes it the user’s adopted thinking, and it is why a kept engram carries full retrieval weight regardless of whether the user or the model first typed it (the provenance rationale lives in The Vault). Curation is continuous in the event-driven sense, not a clock-driven corpus sweep. An exact Resource or Engram write may trigger one bounded neighborhood evaluation; historical backlogs require an explicitly authorized campaign, and an evaluation error produces no mutation or scheduled fallback. The autonomous model judgment is disclosed: there is no per-pair human triage. Before review, the runtime captures immutable subject and candidate snapshots, derives every model input from those authenticated bytes, and later reauthenticates the live identities under path-scoped mutation locks. A qualifying near-duplicate can then collapse into one canonical note, while contradiction uses supersession — the newer note gets a supersedes relationship and the older is archived out of default retrieval but kept as a record. Every mutation, rollback, and index-restoration outcome is append-only evidence; drift or restoration failure stops the event. At corpus scale (over a hundred thousand atomics in active use), write-triggered neighborhood curation plus explicit backlog campaigns is the tractable alternative to both pre-elevation gating and periodic whole-corpus sweeps.
The retrieval side: scoring, decomposition, and the selection funnel
Three input lanes. The server first reconstructs the current Dialogue’s effective history from local messages and immutable fork cutoffs. It then resolves ordered, deduplicated, uncapped explicit contributors: contributed Dialogues recurse through their own cutoffs, while atomic notes use indexed HCP chunks. Global RAG is a third, lower-priority lane. These lanes stay distinct so authority, inventory, fairness, exclusions, and later supplemental promotion remain legible.
A fork is storage, not a prompt trick. The child begins with messages=[], local turn numbering at 1, its direct parent, and an immutable fork_point_message_count measured in the parent’s local coordinate system. Effective history recursively applies each edge’s cutoff, so later ancestor turns cannot leak into a pre-existing child. The parent is unchanged, and the legacy fork_point_chunk_id is not used as the current boundary.
Explicit contributor references are inventoried even when they cannot be packed. Missing references, privacy-withheld sources, and eligible-but-deferred units remain distinct states. Fair scheduling matters because uncapped does not mean unbounded context: a large contributor may supply many relevant exchanges, but it cannot prevent smaller eligible sources from receiving consideration.
Eligibility precedes scoring. Standard context may use Standard sources, Private may use Standard + Private, and Stealth may use all three. An explicitly named archived Dialogue remains eligible as a read-only contributor when all required ancestry is permitted. Archived atomic-note contributors and archived rows from global retrieval are excluded. Every contributed or globally retrieved Dialogue must pass the ancestry privacy test. Global retrieval excludes the current Dialogue, every current ancestor, every contributor, and every contributor ancestor source-wide; a different row from the same source cannot re-enter through the background lane.
Hybrid discovery. Dense vectors find semantic neighbors. The indexed lexical lane rescues exact titles, source labels, paths, identifiers, and body terms. Both lanes apply the same privacy and archive rules, then deterministic cleanup, relevance selection, provenance handling, identity/content deduplication, and optional reranking. Provenance can order eligible relevant evidence; it cannot authorize an otherwise ineligible source.
The vault’s provenance weights still distinguish adopted engrams, resources, conversation/transcript material, and web evidence, with recency affecting conversational tiers. Those weights answer “how much trust should an eligible relevant unit receive?” They cannot answer “may this source cross the privacy boundary?” or “does this chunk fit the current intent?” Keeping those decisions separate prevents a trusted but ineligible or off-topic source from floating to the top.
The selection funnel. The sequence is load-bearing:
- Reconstruct authoritative current history and inventory every explicit reference as available, missing, withheld, or deferred.
- Apply privacy, full-ancestry, archive, and source-wide exclusion rules before a candidate competes.
- Merge lexical and semantic candidates without collapsing source identity.
- Clean transport/frontmatter scaffolding without summarizing source content.
- Judge relevance and apply provenance/reranking only among eligible candidates.
- Schedule contributors fairly so one large source cannot consume all consideration.
- Deduplicate by stable identity/content while retaining the earlier, higher-authority lane.
- Pack only complete turns and indexed note chunks into the endpoint-safe request.
Context-budget assembly. The Dialogue maximum is 200,000 tokens, but the actual usable budget may be smaller after required payload, output allowance, retries, images, provider rules, and safety reserves. Unknown endpoints fail small. Recent local turns and the fork frontier come first, then promoted contributor units, older effective history, and global RAG. The initial history/contributor/global shares are 50/40/10 and soft: unused room returns to a common pool. No unit is truncated mid-turn merely to fit.
This pack is the server’s responsibility, not a browser convenience. Phase A, Direct, G1–G4, and special consumers receive the authoritative history appropriate to their call. A consumer can reason differently or request less ancillary material, but it cannot substitute a stale client transcript for the cutoff-safe effective Dialogue.
Retrieval inside the pipeline
Uniform history, consumer-specific reasoning. Server-authoritative history reaches Phase A, Direct, G1–G4, and special consumers. Parallel analysts may reason independently, but neither receives a browser-owned or assistant-summarized substitute for effective Dialogue history.
Supplemental promotion. A model may identify a factual gap after initial packing, but that signal authorizes no fresh query and no append beyond the budget. The orchestrator promotes relevant unseen units already retrieved, validated, and privately deferred — contributor units before global units — then repacks the entire call inside the same endpoint-safe budget. The loop stops on resolution, a repeated gap, no new eligible unit, or no whole-unit fit. There is no numeric request cap; the last three conditions produce a local COVERAGE GAP.
Upfront external web consultation remains a separate lane. It may discover or deepen web evidence before an analyst runs under its own bounds. A supplemental request cannot reopen that lane, issue a new semantic/lexical query, or treat provider search as an escape from the existing endpoint budget.
Public output and ordinary-trace context_coverage contain numeric budget, lanes, source_counts, and optional physical/deferred/deduplicated counts; they expose neither promotion nor terminal status. The private supplemental forensic trace also carries bounded gap, query-term, and why-it-matters text plus outcome fields, but no unit/source identities or candidate ordering.
Lifecycle changes eligibility by changing authoritative state. Standard/Private Close sets a retained closed: true state and remains restorable; Exit Stealth is navigation and changes no corpus state. Stealth Delete Forever purges Ora-managed envelope, chunk, index, and trace surfaces even when descendants exist. Direct children detach with their local turns; an exact legacy copied prefix is removed only when provable. Explicit exports and provider, Git, backup, or other external copies remain outside that purge.
Open problems
- Relevance remains a judgment surface. A model-based fit decision can over-drop when given an intent description at the wrong altitude. Eligibility is deterministic; relevance quality still requires calibration and visible degradation status.
- Index integrity is upstream of retrieval. Correct ranking cannot compensate for an ID/document/vector mismatch. Replay and rebuild validation must bind stable IDs to the right document, metadata, and vector before activation.
- Endpoint metadata can be incomplete. When the usable request limit is unknown, failing small protects delivery but may defer material that a better-described endpoint could have carried.
- Private completeness and public opacity pull in opposite directions. The packer must retain candidate identities to prove fairness, exclusions, and promotion while ensuring those identities never leak through ordinary coverage reporting.
- Provider-neutral reranking still depends on deployable endpoints. Failure must preserve the eligible pre-rerank order; it must not turn an available corpus into an empty one.
These are bounded seams in the current architecture, not invitations to invent a second decision-memory store, a fixed contributor cap, a fresh-query supplemental loop, or a speculative hierarchy of conversation summaries.