open source · MIT · in development

The agent harness
where powers are law.

Mnemorph runs a team of coding agents in six races. Each race has one job, and the harness makes it impossible to do anyone else’s: who may write which file, who may touch the network, who answers to whom — compiled into a Rust core, not written in a prompt.

git clone https://github.com/Kaginari/mnemorph && cd mnemorph && cargo install --path crates/mnemorph-tui

No release yet — build from source; the one-line installer comes with 1.0. What you need →

Meet the races Read the book
mnemorph — ~/shop
  1. playeradd rate limiting to the login endpoint
  2. summonercommission → elf-api · lane “limit /login”
  3. elf-apidomains: auth → orc-auth
  4. orc-authverify first: cargo test login_limit red
  5. orc-authcommission → slime-login
  6. slime-loginwrites src/login.rs + its test + its zone doc
  7. gateauthor ✓ traits ✓ duties ✓ doc ✓ tests ✓ seal ✓
  8. @S/login: 5 tries a minute per IP · test green
  9. @Ulogin tests use the in-memory store when REDIS_URL is unset
  10. summonerDone. Want a pull request? A Kijin will ask you before it pushes.
Illustrative session. Every agent’s line is one it is allowed to say.

Why another harness

Most harnesses give one agent every tool and ask it nicely to behave. Mnemorph gives each agent only the tools of its job — and checks every write.

Races are code

What each race may do, whom it answers to, how it is scored and how it ascends is compiled into the binary. Creatures, models and budgets are yours to configure; the law is not.

Sessions forget, the world remembers

What the world knows is written to .mnemorph/ in your repository: creature documents, the journal, notes — plain files, reviewable in a diff. What the harness must trust (gate verdicts, spend) is hash-chained outside it, beyond any agent’s reach.

Nothing leaves without you

Pushing, releasing, deploying: only one race can reach outside, and every outward act asks you first — unless you have signed a standing permission for exactly that.

the races

One job each.

You are the Player. You talk to the Summoner; it never touches code. Work flows down a fixed chain, and two races stand beside it. Select a race to see its ascended form.

Small asks run solo: one body with the Summoner’s voice and a Slime’s hands, under the same law, sandbox and gate. It escalates into the chain on signals the code reads — never on the model’s say-so.

The Player — you

You state what you want and answer questions. You confirm every ascension and every act that leaves your machine. The Summoner is the only one who talks to you.

  • Understands you, plans, hands the work down, answers. Never writes code.

    code
    no
    outside
    no
    commands
    Elves, Kijin, Dark Elves

  • Plans one lane of work and decides which domains it touches.

    code
    no
    outside
    no
    commands
    its Orcs

  • Owns a domain. Writes the verify line that will judge the change before the change exists, then judges the landing.

    code
    verify lines
    outside
    no
    commands
    its Slimes · Orcs sideways

  • The only one allowed to change the code of its small zone — and it must update the zone’s doc in the same change.

    code
    its zone
    outside
    no
    commands
    nobody

  • Everything that leaves the machine: pull requests, CI, releases, deploys, intel. Nobody else can.

    code
    its post
    outside
    via the gate
    commands
    nobody

  • Attacks the code the others wrote. A finding counts only with proof: a failing test or a scanner output.

    code
    proofs only
    outside
    no
    commands
    nobody
A Slime ascends into a Named Slime

Trust is earned, measured and revocable

A creature that keeps doing its job well ascends: the harness promotes it, with your confirmation, and the promotion grants a concrete power — usually less friction. A promoted creature that slips falls back. Five races ascend: High Elf, High Orc, Named Slime, Oni, Arch Dark Elf.

communication

Down one rank at a time.

An order travels down, and each rank passes on only what the next one needs. The Summoner never talks to a Slime. The answer climbs back the same way, each rank compressing what it heard.

Between agents, messages are short tagged lines, not prose — long things are written to a file and only the path is sent. That is how a deep chain stays affordable.

  • @S opens an answer
  • @F one finding, with a file:line
  • @U something learned that is written nowhere on disk — it survives the agent
  • @E closes
The Player talks to the Summoner. The Summoner commissions Elves, Kijin and Dark Elves. Elves commission Orcs, Orcs commission Slimes. Kijin reach the outside world through the gate. Player · you Summoner Elf Orc Slime Kijin Dark Elf outside world humangate witnessed findings

the loop

Six beats, every turn, every agent.

The Summoner, an Elf, a Slime — every body runs the same loop until it has an answer.

  1. 1

    Perceive

    Read the fuel gauge: budget, time and context left. Running out means saving what matters and stopping cleanly — never crashing.

  2. 2

    Recall

    Pull in the few memories and tools that fit, as pointers, not pasted text — always with one that disagrees, if any does.

  3. 3

    Plan

    Ask the model what to do next.

  4. 4

    Act

    Run one tool — after checking this race may use it and, for anything outward or destructive, after asking you.

  5. 5

    Verify

    Did the tool work? A failure counts against the body.

  6. 6

    Record

    Write what happened to the journal and the ledger.

the gate

Every write is judged.

When a body answers, the gate judges every file it changed — found by snapshotting the tree, so a shell redirect counts the same as the write tool. A failure gets one chance to fix it.

  1. Right authorevery path lies in the writer’s own soil — and a refusal names the owner to ask
  2. Traits holdthe verify lines that stood before the turn still run green, sandboxed
  3. Duties donea commissioned body actually answered
  4. Doc truthfulthe owner’s doc moved in the same change
  5. Tests intactno test deleted or skipped
  6. No sealthe territory is not sealed — or this landing is the fix

Under the gate, a sandbox

landlock read the system and the world, write only the world

seccomp no socket() unless an approved outward act

seccomp no ptrace, mount, unshare, bpf, io_uring

env secrets passed by name, outputs redacted

A kernel guard, not a jail: the command runs as you, in your real files, with the kernel enforcing its permission list. On Linux every command starts through mnemorph-guard — no guard, no command. macOS uses Seatbelt.

memory

A memory that doesn’t believe its own mistakes.

Most agent memories save what the model said and fetch the closest text back later — so a wrong answer, once saved, returns as a fact. Mnemorph splits memory in two:

The archive

The evidence: journal, ledgers, commits. Never rewritten.

The traces

Short notes, each pointing at its evidence, each marked agreeing, disagreeing or correcting.

Any belief can be walked back to the bytes behind it.

  1. Proposals stay personal. What a model says reaches shared memory only once grounded: a check passed, a finding accepted, a second creature agreeing on its own evidence, or you.
  2. Recall shows the other side. If any note disagrees, one seat is reserved for it, however low it ranks.
  3. Corrections outrank habits. A note born from a failed check starts well ahead.
  4. Summaries never swallow exceptions. Agreeing notes merge; dissent stays.
  5. Loops are seen, not felt. The same recall with nothing new learned is detected — and broken.
  6. When the ground moves, notes are looked at again. If what a note rests on is corrected, the note is marked for review and recalled lower — never deleted.

consumption

Budget flows down. Spend flows up.

Envelopes, carved

You cap a month, a day, a session. The Summoner carves a slice for each order, each Elf for its Orcs. Before every model call the core checks it fits; if not, the body stops and asks its parent — it never overspends.

A ledger line per call

Who spent it, on which model, how much was cached. The terminal and the board show it live: tokens, cost, cache hits, burn rate, what is left.

Cache-first prompts

Every prompt starts the same way between calls, so the provider’s prompt cache serves most of it at a fraction of the price. Designed in, not bolted on.

MCP without the flood

An MCP server sends every tool definition it has. Mnemorph takes them in once at its border, indexes them, and hands each agent only the few its task needs — not a hundred it will never use.

architecture

Rust decides. The clients only show.

A Rust core owns everything that must be correct: the loop, the races, the gate, the sandbox, the ledgers, the provider clients. Two binaries share it. mnemorph, the terminal app, holds the session in its own process — nothing sits between the screen and the core. mnemorphd is the core served: to the web board, and over JSON-RPC to the TypeScript SDK for programs that are not Rust.

One protocol, defined once in Rust — the TypeScript types are generated from it, so a client can never drift from the core. Small crates, arrows pointing only downward, and a check that fails on any edge the design does not draw.

speaksAnthropicOpenAI-compatible APIsMCP servers

mnemorphterminal app · Rust, Ratatuirun · resume · status
mnemorphdserver · board · adminJSON-RPC to the SDK · loopback
boardbrowser · TypeScript, Reactone-time key · loopback only
sdkTypeScript · protocol types generatedfor editors, scripts
the coreRust · 14 crates
  • wire
  • races
  • ledger
  • proving
  • provider
  • sandbox
  • tools
  • config
  • memory
  • world
  • loop
  • server
  • tui
  • mnemorphd
.mnemorph/law · creature docs · log.md · notes — files are the truth

the board

Every world, one page.

mnemorphd board shows every world on your machine, live: chats in the terminal’s grammar, approvals with the terminal’s protections, memory, ontology, bodies and spend. It listens on loopback only; a one-time key signs you in. ⌘K jumps anywhere.

The board's worlds page: each world's sessions, memory standing, gate verdict and spend The board's worlds page: each world's sessions, memory standing, gate verdict and spend
Worlds — each one’s sessions, memory, last gate verdict and spend.
The board's metrics page: spend per day by race, cache hit rate, burn rate The board's metrics page: spend per day by race, cache hit rate, burn rate
Metrics — spend per day by race, cache hits, burn, read from the usage ledger.

roadmap · November 2026

Built one rung at a time.

A rung is finished only when its tests pass against fakes of the rung below. Mnemorph works in a terminal and builds itself; the world, the Kijin and the Dark Elf are landing now.

  1. M0foundations
  2. M1wire + races
  3. M2ledger + meters
  4. M3providers
  5. M4tools · sandbox · gate
  6. M5one body loops
  7. M6protocol + terminal
  8. M7the world
  9. M8memory + toolbox
  10. M9Kijin
  11. M10Dark Elf
  12. M11value · ascension
  13. M12board
  14. M13integrations
  15. M141.0

done in progress next · live milestones →

Parts of M11–M14 have already landed — the web board among them.

get started

Build it, then run it anywhere.

You need Rust (the pin installs itself through rustup). Node 22 and pnpm build the web board; just runs the full check. cargo install puts the binaries on your PATH — on Linux, mnemorph-guard goes beside mnemorph.

Name a provider and a model once, in ~/.config/mnemorph/config.toml — a world’s own file can never loosen the gate or the sandbox. Then run a session inside any repository: that repository becomes the world. A run that stops is never lost: mnemorph resume last.

Full toolchain in the README →

# build
git clone https://github.com/Kaginari/mnemorph
cd mnemorph
cargo install --path crates/mnemorph-tui
cargo install --path crates/mnemorph-sandbox
pnpm install --frozen-lockfile
pnpm --filter @mnemorph/board build
cargo install --path crates/mnemorphd

# use
mnemorph status          # model, key, sandbox
mnemorph                 # a session here
mnemorph run "<ask>"     # one ask, no app
mnemorph resume last     # a stopped run
mnemorphd board          # the web board

Keyboard

j k
next / previous section
g G
top / bottom
t
light / dark
c
copy the clone command
r
replay the session
esc
close