# Mneme for the Enterprise β€” Trust, Sovereignty, Cost > **Read this first (the honesty contract).** Mneme is sold on what it can *prove*, not on what sounds good. Every number it reports is **measured and signed** (Ed25519 / HMAC), verifiable offline by your own risk officer. Where a value depends on your environment (e.g. cost), Mneme uses **your** vendor's price, never an invented one. Where something *cannot* be proven, Mneme says so β€” see [*What Mneme does NOT claim*](#what-mneme-does-not-claim). This is the moat: a vendor-neutral, local-first trust boundary you can audit, not a black box you must believe. Mneme is **local-first** (it runs on your machine / your VPC, not ours), **vendor-neutral** (Claude / GPT / Gemini / Grok / Codex / a local model all cross the same boundary), and **MIT-licensed** (no lock-in). It bolts onto the agents your teams already use. --- ## The four pillars ### 1. πŸ›‘ Absolute Trust Layer β€” *"every agent verifies before it acts"* An agent that can call tools can do damage. Mneme sits in front as a **verify-before-act** boundary: - **Truth gate** β€” a factual claim an agent is about to assert (a version, a number, an API signature) is checked; `REFUTED` is corrected before it reaches a human or another agent, `UNKNOWN` is surfaced honestly rather than guessed. - **Cross-vendor consensus** β€” when a claim is high-stakes and a single model could be wrong, Mneme convenes an independent multi-vendor panel (no single vendor owns the verdict). - **Command gating** β€” destructive shell actions are risk-classified and (for irreversible ones) require human co-sign. - **Signed audit trail** β€” every verdict, every crossing, every gated command leaves a tamper-evident, **offline-verifiable** receipt (the NOTARY / FLIGHT RECORDER spine). A court, an insurer, or a CISO can verify the log *without trusting Mneme*. #### The Second Brain that is *inherited* (`mneme bequest`) Detecting key-person risk isn't enough β€” knowledge has to *survive* the person. BEQUEST is the inheritance + accounting layer on top of Mneme's atrophy signal: - **Survival, measured.** For each unit of knowledge (a file, a decision), Mneme computes a **survival** score `S(u) = 1 βˆ’ ∏(1 βˆ’ fluencyₐ)` over everyone who still understands it (reliability-theory redundancy applied to people: two half-fluent holders β‡’ 0.75 survival; *zero* holders β‡’ 0 = **orphaned**). The org-level number is mass-weighted **completeness** and the dollar-able quantity is **orphaned knowledge mass** β€” knowledge with no living heir. - **Succession capsules.** `mneme bequest capture --holder ` mints a **signed** capsule of that expert's at-risk knowledge (files + reasoning + a content hash). A successor runs `mneme bequest claim`, Mneme re-reads the material and **verifies it transferred intact** (a transfer-integrity proof β€” honestly *not* a claim of deep comprehension), and signs an heir receipt. - **Who to assign.** `mneme bequest status` runs a greedy **minimum-heir set-cover** (it beats the classic `(1βˆ’1/e)` bound) so a manager sees *"assign these 3 people and you cover 95% of orphaned knowledge."* This is the honest core of an *inheritable* Second Brain: a fresh composition of standard, checkable building blocks (`bequestGauntlet` = 100), **not** an unfalsifiable "novel theorem." Dollar exposure appears only from a rate you supply. ### 2. πŸ”’ Sovereign / Air-Gapped AI β€” *"our code & secrets never leak to the model, with proof"* This is the **SOVEREIGN EGRESS GUARD** (`mneme egress` / `mneme.egress.guard`) β€” the gem of the enterprise tier. Before any local context (source, logs, config) crosses to a hosted model or another agent, it crosses a deterministic boundary with three layers: 1. **Pattern redaction** β€” known secret classes (AWS / GitHub / OpenAI / Anthropic / xAI / Slack / PEM private keys / JWT / national-ID / card) are matched and removed from the outbound payload. 2. **Honeytoken tripwire** β€” you plant deterministic **canary** tokens (`mneme egress seed-canary`) in decoy configs. If a canary *ever* appears in an outbound payload, that is an exfiltration signal β†’ instant **BLOCK** + signed alert. A canary can only be there if something read where it shouldn't β€” so this is provable, near-zero-false-positive exfil detection. 3. **Bloom secret-membership** β€” your real secrets are fingerprinted into a one-way **Bloom filter** that **never stores the secret**. Outbound tokens are tested against it, catching a custom key that matches *no* regex β€” with **no false negatives** (a registered secret always tests positive, so nothing slips) at a small, tunable false-positive rate, O(1) per token. The result is a verdict (`ALLOW` / `REDACT` / `BLOCK`), the **safe redacted payload** to send instead of the raw one, and an **Ed25519 egress certificate that binds only the payload's hash** (never the payload or any secret) β€” so a risk officer can audit *what crossed and that nothing secret did*, offline. `mneme egress scan` exits non-zero on `BLOCK`, so it drops straight into CI / a pre-send hook. > This is the honest core of "air-gapped / sovereign AI": a provable boundary you control. It is **not** a claim that any model is "unhackable," and it does not touch the OS kernel or a GPU's memory. #### Context Blinding β€” the model never sees your real names (`mneme blind`) Sometimes you *must* use a hosted model, but the org cannot have its real identifiers reach the provider. **CONTEXT BLINDING** is the fast, honest answer: - Before code leaves, `mneme blind` **removes secret literals** and replaces sensitive identifier names (`SecretFinancialEngine` β†’ `MZ1`, `userPasswordHash` β†’ `MZ2`) with **reversible placeholders** via a deterministic, collision-free map that **stays on your machine**. - The model sees **structurally-valid but business-meaningless** code β€” it reasons over the structure (all it needs) and its reply references the placeholders, which `mneme unblind` maps back to your real names with **100% fidelity** (proven: round-trip-exact, bijection, structure-preserved). - So a provider employee β€” or an attacker reading the chat history on the cloud β€” sees syntactic nonsense; your machine restores reality. > Honest scope: this is **structure-preserving pseudonymization** (millisecond-fast, reversible) β€” **not** zero-knowledge or homomorphic encryption (those are still too slow to run on real codebases in 2026), and **not** an OS-level intercept (Mneme never hooks your agent's tools β€” the agent calls `blind` by choice). The code's *structure* stays visible to the model; its *names and secrets* do not. ### 3. 🌐 The Context Gateway β€” *"one governed surface every agent crosses"* Mneme is a local-first **MCP server** every agent connects to, plus **capability passports** (short-lived, scoped, signed tokens that gate sensitive tool calls). Instead of N agents each wired to N tools with N security postures, you get **one** governed, audited surface β€” vendor-neutral and self-hostable. #### πŸ›€ THE CONTEXT RAIL β€” the *Visa rail* of AI context (`mneme rail`) The gateway, made into a single transaction primitive. Like Visa for a card swipe, the rail doesn't conjure value β€” it **authorizes, screens for fraud, and clears the transfer with a signed record**. Mneme already ships seven Context-Gateway layers (policy Β· firewall Β· blind Β· outline Β· egress Β· channel Β· settlement); the rail unifies them into **one governed traversal with one tamper-evident receipt**, in two directions: - **`mneme rail ingress`** (local β†’ model): the deterministic, **fail-closed** policy gate (`mneme policy` / `mneme.policy.json`) clears the payload β†’ the firewall **neutralizes** any prompt-injection a file planted and wraps it as untrusted DATA β†’ blinding **removes secret literals and masks sensitive identifier names** (the reverse map stays on your machine). What crosses the wire is policy-cleared, injection-safe, and name/secret-blinded. - **`mneme rail egress`** (model β†’ disk): the egress guard screens the model's output for **secret leakage** (honeytoken canaries Β· one-way Bloom membership Β· pattern Β· entropy) and the transaction is **metered into the signed settlement ledger** before anything touches disk. Vendor-neutral β€” the same rail for Claude, GPT, Gemini, Grok, or a local model (CLI `mneme rail` for shell agents; MCP `mneme.rail.traverse` for protocol agents, self-attesting). Proven by `railGauntlet()=100` ∧ `policyGauntlet()=100` ∧ a 5-lens adversarial review (security-bypass Β· totality Β· value-passing Β· future-error Β· correctness-gap β†’ independent verification; the confirmed findings β€” a Unicode-homoglyph path bypass, a ReDoS vector in user policy regexes, a shared-ledger seq off-by-one, silent stdin truncation β€” were all fixed at root). ### 4. πŸ’° Value-based cost β€” *"pay only for the tokens you actually save"* Mneme does deterministic local work that shrinks what your agent sends to the model β€” **DISTILL** (compress a verbose error+diff to its causal brief), **LOOPGUARD** (stop a thrash before it burns retries), **NKL** (skip a proven dead-end) β€” and meters each **measured** reduction into a **signed, append-only ledger** whose aggregate is a commutative monoid (proven over a 1,000,000-case sweep). `mneme savings` reports the cumulative input-tokens saved, and the USD figure uses **your** vendor's price-per-1k. Falsifiable, not marketing β†’ [`BUSINESS-MODEL.md`](BUSINESS-MODEL.md). --- ## Enterprise reframes β€” now runnable (`mneme exec`) The same proven engines, framed for the decision a buyer is making, each a real CLI verb that calls the underlying git/ledger signal. Nothing here is a new claim or a forecast: present-tense signals from real history, and **dollar figures appear only when you supply your own rate** (always labelled "your rate Γ— measured signal"). Every report is NOTARY-signed. | Command | Enterprise frame | The honest signal it computes | |---|---|---| | `mneme exec keyperson [--replacement-cost N]` | **Key-Person Dependency & Flight Risk** | files with **no live expert** (bus-factor = 1) + knowledge concentration, from the atrophy/Ebbinghaus model over git history β€” not a prediction of who will quit | | `mneme exec talent [--top N]` | **Talent Mapping** | who actually collaborates with whom (shared files + synchrony + carry-on), from git traces β€” org-chart truth, not self-report | | `mneme exec governance [--debt-cost N]` | **Governance / Tech-Debt Liability** | open + stale **promises** mined from commit/PR text and tracked through git history | | `mneme exec burn [--price-per-1k N]` | **Realized Value (asset side)** | input-context tokens Mneme has **actually** saved (the signed ledger) β†’ USD at *your* vendor price | | `mneme exec roi --team N --per-dev M [--price-per-1k P]` | **ROI Projection** (Pay-per-Token-Saved) | the **measured** per-reduction saving rate Γ— *your* team/usage/price β€” a transparent projection (proven monotonic, zero-bounded, dollar-identity-exact over a 5,000-case sweep), never a business forecast | | `mneme exec mcp-audit [--budget N]` | **Agent MCP Attack Surface** (Pillar 3) | the MCP servers wired into your agents, per-server risk, and the transitive bypass budget β€” the governed-boundary check (exits non-zero over budget) | --- ## What Mneme does NOT claim DIAKRISIS β€” discernment β€” is a feature, not a disclaimer. Mneme deliberately refuses the things that *sound* enterprise but cannot be proven: - ❌ It does **not** make any model "unhackable" or guarantee zero hallucination. It makes a model's claims **checkable** and a payload's secrets **redactable, with proof**. - ❌ The Context Rail is **not** a 100% guarantee against *novel* prompt-injection (an open adversarial problem β€” the firewall's data/instruction boundary is the always-on, attack-agnostic catch-all, i.e. defense-in-depth, not a silver bullet), **not** homomorphic encryption (refused β€” too slow in 2026), **not** a "tree-sitter AST" (it's a deterministic structural scanner β€” we never call it more), and **not** a claim that "every model must speak our format / we own the standard" (that's positioning, never a code guarantee). It IS a deterministic composition of proven layers with a signed, offline-verifiable receipt. - ❌ The egress guard does **not** read kernel memory, inject into a GPU, or intercept network cables. It is a deterministic content boundary you place in front of egress. - ❌ Token figures are a **labelled `β‰ˆchars/4` estimate** of *input* context (not a vendor tokenizer, no claim about the model's internal reasoning); USD uses a price **you** supply. - ❌ The "flight-risk" / "liability" frames are **present-tense signals from real history**, not fortune-telling about the future. - ❌ Mneme never auto-upgrades or self-installs, and it does no dark-web crawling, unauthorized access, or "decryption." Upgrades are fully manual and the boundary only ever sees what you hand it. If a capability can't be measured and signed, Mneme returns `UNKNOWN` rather than a confident guess. That is the product. --- ## Try the trust boundary in 60 seconds ```bash # plant an exfiltration tripwire once mneme egress seed-canary --label prod # scan an outbound payload (stdin / --file / --text); exit 2 on BLOCK echo "deploy with AKIA1234567890ABCDEF" | mneme egress scan # βœ‚οΈ EGRESS REDACT β€” 1 secret(s) redacted Β· signed certificate (binds payload hash …) # what has Mneme saved you so far (USD at your vendor's price) mneme savings --price-per-1k 0.003 ``` For the full primitive catalog see [`FUNCTIONS-EN.md`](FUNCTIONS-EN.md) Β· for the cost model [`BUSINESS-MODEL.md`](BUSINESS-MODEL.md) Β· for the savant philosophy [`ALETHEIA.md`](ALETHEIA.md).