Overview
Ziggurat is a human-gated memory firewall: a local TypeScript reference implementation that treats durable AI memory as a privileged write surface.
A model can read authorized content and return a strict version-1 refinement draft with source IDs and line ranges. The refine host derives canonical citations and version-2 Silver, then validates and persists only that artifact. Gold requires a valid receipt from a configured Ed25519 key that operator policy assigns to a reviewer. Ziggurat verifies key control and exact-content authorization, not humanity, attention, semantic support, or factual truth.
The boundary in one paragraph
Section titled “The boundary in one paragraph”Content moves through three tiers. Bronze is canonical UTF-8 text captured from
untrusted sources after CRLF-to-LF normalization; ingest creates it without overwriting,
and its body hash detects later mutation. Silver is strict version-2 JSON that the
refine host materializes from a model draft, validates, and persists; every citation is
revalidated against stored Bronze text. Gold is eligible knowledge content admitted by build after a detached
Ed25519 receipt from a configured key and every other eligibility check pass.
Ziggurat ships no signer, apply, approve, or promote command; see the human authority boundary.
What this is for
Section titled “What this is for”Use Ziggurat when you want persistent retrieval context for an AI system and you are not willing to let the AI system decide what enters it. It addresses the failure Microsoft describes as AI Memory / Context Poisoning: untrusted content enters a durable store and silently influences later model behaviour.
How it differs from other agent-memory systems
Section titled “How it differs from other agent-memory systems”Mem0’s add pipeline supports automatic memory extraction. Letta agents can edit their memory blocks through tools, and Zep extracts facts into a context graph from conversation messages.
These systems support automatic extraction or agent-managed memory. Ziggurat does not offer hosted, multi-tenant retrieval and instead requires detached configured-key authorization before model-originated content can enter Gold. This is a design trade-off, not a measured superiority claim. Ziggurat does not integrate with these products.
What it is not
Section titled “What it is not”- Not an OS sandbox, and not a multi-tenant authorization service.
- Not a key custody, revocation, or hosted identity service.
- Not a claim about truth. A valid signature proves that a configured key approved exact content. It does not make that content correct.
- Every retrieved chunk carries
content_role: referenceandinstruction_authority: none.
Where to go next
Section titled “Where to go next”- Installation builds the CLI from source and verifies it.
- Your first vault creates a vault and captures evidence.
- The garden walkthrough prepares the poisoned-memory fixture vault and explains the separate end-to-end automated test and remaining manual steps.
- The human authority boundary explains why the boundary is a capability rather than a convention.
- Threat model covers assets, actors, assumptions, and residual risk.
Canonical specifications
Section titled “Canonical specifications”This site is task-oriented documentation. The normative specifications live in the repository and remain authoritative: