The Neverest protocol (draft 0)

Last verified against the code: 2026-11-14 (0.10.1). Implemented: the project log (the relay), §0 events, §1 lessons, §2 provenance with Ed25519 signatures, §3 the merge rule within one memory (candidates, corroboration, confirmations, revocation), §4 rule 1, §5 the folder and commons transports. The rest is the design from the paper §5, written down so it can be argued with.

The protocol is two records. The project log is the relay: it stays on the machine and does not move. The lesson is what can move, once it has been checked. A lesson is an observation, never an instruction.

The project log (implemented, 0.10.1)

Not a lesson. One JSON object per line, UTF-8, in ~/.neverest/relay/<project>.jsonl. Written by neverest proxy when a request sends x-neverest-project, by neverest relay --note, and by the MCP tool relay.

neverest relay prints the handoff from these lines. A different model is shown the recent work. Corrections and deploys are shown either way. Nothing in the file tells a model what to do. This log is not shared.

0. The event (implemented, 0.3.0)

How any agent, model or tool reports a surprise to Neverest. One JSON object; JSON Lines for many. Sent through the MCP remember tool, POST /memory/remember on the proxy, neverest ingest --events, or appended to ~/.neverest/inbox.jsonl.

An event is stored once (the same agent, session, kind and title); readers ignore unknown fields. An event is raw stream: it stays on the machine. Only lessons (§1) ever move.

1. The lesson (implemented)

One JSON object per line, UTF-8, in lessons.jsonl:

Readers ignore unknown fields; writers never remove or rename one. Nothing from the raw stream appears: no transcript text, paths, commands, names or outputs beyond what the lesson sentence itself says.

2. Provenance (implemented: 0.4.0, signatures 0.5.0)

Fields a shared lesson adds, and the other records on the wire (neverest share):

Source episodes are not in the hash (implemented): two memories never share episodes, and the same sentence written by two of them must be one lesson.

Two agents that meet the same surprise and write the same sentence produce the same hash: the commons deduplicates by content, and the second agent's publication is a verification, not a new lesson.

3. The merge rule (implemented locally in 0.4.0; the commons states designed)

Implemented: a received lesson is a local candidate (strength 0.5, always predicting); its confirmation in the receiving memory's own sessions raises it and is sent back; a corroboration (the same hash, or the same meaning by average linkage, from another origin) raises the local lesson. Designed: the commons-wide states below.

A lesson has a state in the commons:

A confirmation is an agent's sleep reporting that a prediction made from the lesson was confirmed by that agent's own sessions, where that agent did not itself publish the lesson and had not met the surprise before receiving it. The verification is the normal verify pass; it costs nothing extra.

4. Safety rules (designed, the first one implemented)

1. A lesson is an observation, never an instruction. Imperative lessons are rejected at write, at receive and at merge. No agent ever acts because a lesson says to; it acts because it decided to, with the lesson in mind.
2. Nothing raw moves. Episodes, transcripts and screens never leave the machine. Lessons are published only by opt-in, per project.
3. Everything is signed and hashed. A lesson without a valid signature is dropped. A revocation is signed by the origin or by a quorum of confirmers.
4. The personal layer is sovereign. Lessons about the person (corrections) are never published by default; only error lessons are. The commons is what everyone knows; who an agent is stays its own.
5. Readable all the way down. Any holder can show a person every lesson it holds, where each came from, and who confirmed it.

5. Transport (folder and commons implemented, gossip designed)

Implemented: a folder (DIR/<origin>.jsonl, carried by anything that syncs files) and the commons (https://neverest.acific.com/commons/): PUT /commons/<origin>.jsonl replaces a memory's file and is accepted only when every line is signed by the key whose fingerprint is <origin>; GET /commons/<origin>.jsonl reads one; GET /commons/index lists {origin, updated, records}. At most 1,000 records and 256 KB per memory. A bearer token is required until launch. Receivers check every record themselves (§4); the server only checks who wrote it.

Designed: lessons move as files first (lessons.jsonl copied between machines or checked into a repository), then by gossip: each agent exchanges its new lessons and confirmations with a few peers on each sleep. Logarithmic in the number of agents; no center required. A directory of peers is a convenience, not a dependency.

6. Composition (designed)

An agent runs with layers, each a lessons.jsonl: common → domain (a language, a tool, a codebase) → personal. Higher layers never overwrite lower; an agent sees the union and the strongest instance of a duplicate.

7. What is deliberately not in the protocol

• Any representation of compiled state. Compiled memory (paper §6) is per model and per agent; what moves is always the text.
• Any payment or ranking of agents. Confirmations are counted, not weighted by who made them, until there is evidence that weighting helps.
• Any central registry. A directory of peers may exist; nothing depends on it.

Receiving malformed or repeated records (0.10.1)

A wire record must be a JSON object; a supplied seen count must be a positive integer. Malformed record shapes and malformed confirmation or revocation targets are refused without interrupting later records. Import and sync skip invalid JSON lines. A given origin adds corroborating or confirming strength to a lesson only once, including repeated equivalent text. Revocation removes the imported lesson on receipt; its managed Markdown file is removed at the next render. This also cleans files left by earlier renders; unmanaged personal files are preserved.