andrewbrooks.fyi
Product sheet / 3.5 Personal project, 2026
Field notes

Mimir: one memory for every agent

Kind
Personal project, 2026
Designed
In one day, October 31, 2026
Writers
One
Store
Plain text in git
  1. 1.0The problemp. 02
  2. 2.0The designp. 03
  3. 3.0Try, fail, improvep. 04
  4. 4.0Tradeoffsp. 05
  5. 5.0What worked from day onep. 06
  6. 6.0Principles I’d bring to a teamp. 07
1.0

The problem

1.1 Context

My context was trapped in separate chats, and every agent tool kept its own copy of my rules. Change a preference and I had to change it in five places. Agents couldn’t learn from each other, and nothing remembered why a decision was made.

2.0

The design

2.0 DecidedIn one dayOctober 31, 2026

Five decisions, made in one day.

2.1 Thin harness, thick memory

Each agent’s own instructions hold three things: who it is, its jobs, and where the memory is. Everything else lives in the memory, so a change is made once and any model can be swapped in.

2.2 Three layers

Small guidepost files on top, one dense summary card per source in the middle, whole raw sources at the bottom. Agents read the top and drill down only when they need to. The layering comes from Tyler Fisk’s CAIRNS idea, presented at the AiEdge Summit.

2.3 One writer

Mimir is the only agent that writes to the memory. Every other agent submits what it learned. The core files change only through a pull request I merge.

2.4 Plain text in git

Not a database. Any agent can read it with no server, every change is audited and reversible, and the search indexes are disposable: rebuilt from the text.

2.5 Guarantees in code

How much to trust a card is written by code, from how the item arrived, never by the model. Content from outside is marked untrusted by code at the door, and untrusted runs can’t touch the core files.

3.0

Try, fail, improve

3.0 LogSeven entriesNovember 1 to 9, 2026

What I tried, what failed, and what I changed, in order.

3.1 to 3.7 EntriesDated record
  1. 3.1

    Smarter search

    Tried
    Adding meaning-based (vector) search.
    Result
    Top-5 hits on a blind test went from 7 of 32 to 22 of 32.
    Failed
    Searches stalled for 23 seconds while the index rebuilt, because queries and the rebuild shared one server.
    Changed
    Rolled back only the search path, measured four fixes, gave queries their own server (30 ms median), reinstalled the same night.
  2. 3.2

    Budgets that choked the work

    Tried
    Caps on items, then a daily dollar budget.
    Failed
    Every run stopped at the dollar cap while only 8% of the week’s plan was used.
    My words
    API usage in $ is a useless metric for me.
    Changed
    Pacing by share of the plan; dollar and item caps kept only as runaway guards.
  3. 3.3

    Proposals that collided

    Failed
    One run opened seven pull requests, six on the same file; each merge broke the others.
    Changed
    One pull request per file per run, rebuilt after each merge, and never overwrite an edit I made.
  4. 3.4

    A safety rule that couldn’t fire

    Failed
    Content from outside was supposed to be flagged by a title convention, which was never enforced and couldn’t trigger.
    Changed
    Code marks untrusted content at the point it arrives.
    Since Nov 8
    Injection tests run on every pull request: text in an image telling the AI to email the memory away, shell commands hidden in file names. The tests check what code guarantees, not what a model decides.
  5. 3.5

    Facts going stale

    Failed
    Six of ten project files had notes newer than their status lines, and the roster of agents lived in four places that disagreed.
    Changed
    Mimir keeps a current status section, and model-free drift checks run every 15 minutes, with a nightly recount so a checker that goes quiet gets caught.
  6. 3.6

    Controls I wouldn’t use

    Failed
    38 of 40 items held for my review showed only an ID.
    My words
    I can’t check these through the brief so I’m not going to ever do it.
    Changed
    Safe defaults instead of asking. When unsure, keep it private, delete nothing, and show me a count.
  7. 3.7

    A filter that blocked too much

    Failed
    One flagged word held back a whole entry, including my own agents’ requests.
    Changed
    Mask the word or cut only the flagged part. The next design treats privacy as labeling and substitution, never a gate.

Table 3Every entry is from the dated decision and change records. Quotes are mine, as written at the time.

4.0

Tradeoffs

4.1 SpecificationSix decisions
Tradeoffs: each decision, what I chose, what I chose it over, and why
DecisionChoseOverWhy
4.1.1StorePlain text in gitA databaseReadable by any agent, audited, reversible.
4.1.2WritersOneManyA bad edit to a core file misleads every agent that reads it.
4.1.3GuaranteesCodeThe modelA model can be talked into things; code can’t.
4.1.4Where models runLocal for transcription and search, cloud for judgmentAll local or all cloudCost and privacy where it’s safe, quality where it matters.
4.1.5Safety vs useRestrictions only on content known to come from outsideRestrict everythingMy words: I cannot make the system so inconvenient to use that I don’t use it.
4.1.6Whole sources or only decisionsKeep whole sources, protected by redaction, a secret scan, and privacy levelsDecisions onlyThe summary can be wrong; the source can’t.
5.0

What worked from day one

5.1 Held

Plain text in git and the one-writer rule have never been reversed.

The lookup tool answered from the memory, with a citation, on its first test. When the smarter search failed, plain keyword search took over, as designed.

6.0

Principles I’d bring to a team

6.1 to 6.3From the log
  1. 6.1

    Guarantees belong in code. Models suggest; code checks.

  2. 6.2

    If I won’t actually use a control, it isn’t a control. Replace it with a safe default.

  3. 6.3

    Make a change once. Knowledge lives in one place, and every tool points to it.

See alsoThe agent engine, which runs on this memory.