Inspiration
Six hundred years ago the Incas ran an empire across the Andes without a writing system. Their record was the khipu: a main cord, cords hanging from it, and knots whose type and position carried the meaning. An official called the khipukamayuq kept them, read them, and answered for what they said. It was not a pile of strings. It was an institution's memory, with a structure and a custodian.
We kept coming back to that image because it names a problem nobody had solved for us. Agent memory today is a flat list per user. It remembers that you prefer short meetings, and that is genuinely useful, but a company is not a person. A company knows things at several levels at once: a policy that binds everyone, a practice a team agreed on last quarter, a habit that belongs to one salesperson and to nobody else. Those levels disagree constantly, and someone has to be accountable for which one wins.
The khipu already had the answer in its shape. Cords for levels. Knots for facts. Position for meaning. A keeper for authority. We took that structure literally, and Khipu is what came out.
What it does
Khipu is an institutional memory layer that sits between an organization and whatever agents it runs. Every memory lives on three axes at once, and that is the whole idea.
Scope is where it belongs. A fact is personal, or it belongs to a team, or it belongs to the company. When two levels contradict each other the most specific one wins, unless a company policy has been locked, in which case the lock wins and the reason travels with the answer. A salesperson asking about a discount gets the company cap, her team's exception for strategic accounts, and her own note about that client, resolved into one answer instead of three competing snippets.
Tier is where it is in time. A new fact is working. If it proves stable it is consolidated. If nobody uses it, it cools until it is dormant, which is a cold archive and not a delete. Strength follows a forgetting curve, every recall extends the half life, and time bound facts expire on their own date. A scheduler ages the store without anyone asking: decay every hour, consolidation every night. Nothing is appended forever, and nothing is thrown away either.
Visibility is who may read it. Shared is the default, personal is visible to the owner and to an administrator for oversight, and private is owner only. Private is not hidden in the interface. The server strips it before it answers, so an administrator asking the same question as the owner simply gets a shorter answer, and only ever sees an anonymous count. Oversight without exposure.
Writing happens by talking. A model reads the conversation, extracts the facts worth keeping, and decides which level they concern. Preferences are a first class type rather than loose text, so an agent can adapt to an individual without confusing a habit with a rule. New facts are deduplicated against their nearest neighbours before they land, and an update supersedes its predecessor instead of piling up beside it.
And nothing important is silently overwritten. If an agent states something that collides with a locked policy, it refuses to apply it, cites the policy, and still records what was said. Recording is not obeying. If the fact belongs to a level the speaker does not govern, it becomes a proposal waiting for a human, and every decision lands in an audit trail with a name and a timestamp.
There is also a three dimensional view of the whole thing, because a khipu is easier to read than a table. Cords are levels, knots are memories, colour is tier, and a timeline slider projects the forgetting curve forward so you can watch which knowledge is about to go cold.
How we built it
The core is a hexagonal FastAPI application whose domain layer does not know that any vendor exists. Scope precedence, the decay curve, the policy guards and the visibility rules are pure logic, which is why the whole model is testable without a network.
Every model call goes through one generic REST provider and is served by Qwen Cloud. We use qwen3.7-plus where judgement matters, answering and deciding whether two facts genuinely contradict, and qwen3.6-flash for the mechanical work: extraction, filtering and reranking. Embeddings are text-embedding-v3.
Retrieval is hybrid rather than purely semantic. A query is embedded and also matched lexically with BM25, the two rankings are fused with reciprocal rank fusion, and a reranker trims the result to a handful. An adaptive router decides whether the cold archive needs to be touched at all, and a small core of locked policies and pinned facts is always in context regardless of the question, so a company rule can never be crowded out by recent chatter.
Vectors live in Qdrant, and audit, history, promotions and conversations in Postgres. Restarting the process loses nothing, so recall across sessions is the default rather than a feature bolted on top.
The same memory is reachable two ways: a React front end with the three dimensional khipu, the chat and the governance console, and an MCP server that exposes search, write, govern and stats as tools, so any external agent can use the organization's memory without touching our interface. It ships as four containers and one compose file, and runs on Alibaba Cloud.
Challenges we ran into
The hardest problem was not storing memories, it was ranking them when they come from different levels of a company. A single question pulls candidates from a person's own notes, from their team's practices, and from company policy, and those three populations are not comparable. A chatty personal note written this morning will out-score a policy that has not been touched in months on almost any similarity metric, and the policy is the one that must never be missed.
We ended up separating relevance from authority, because they answer different questions. Retrieval decides what is related: hybrid search over dense vectors and BM25, fused with reciprocal rank fusion, then reranked. Precedence decides what governs: an authoritative lock wins outright, and otherwise the most specific level wins, with the reason attached to the citation. On top of that, a small core of locked policies and pinned facts is placed in context for every query regardless of its score, so a company rule never has to win a similarity contest to be present. That is what lets an agent converge on one correct answer instead of returning three plausible fragments and leaving the user to arbitrate.
Recognising that two facts are even about the same thing across levels was its own problem. A policy might say "maximum discount is twenty percent for new clients" while a salesperson says "our cap is thirty percent". Different wording, different level, no shared identifier, and yet they are the same topic and cannot both be true. We assign that topic at write time by embedding the new fact, scanning its nearest neighbours, and asking a judge model whether they are genuinely the same claim before merging them under one key. Our first version limited that scan to the level being written to, which meant a personal claim never met the company policy it contradicted. Widening it to every level the author can see is what made cross level conflicts surface at all.
Then there is the context budget. A real organization accumulates more than fits in any prompt, so an adaptive router decides whether the cold archive needs to be touched for a given question, the reranker caps what survives, and precedence collapses whatever still conflicts into a single winner. What reaches the model is small, current and resolved.
Performance forced one more design decision. Our first working version took about a minute to answer, because the models deliberate before responding and several of those calls were chained before the first word could appear. Rather than weaken the model, we named the role of every call. Deliberation stays on for the conflict judge, which decides whether knowledge gets archived. It is off for extraction and reranking, which transform and score rather than decide. The same question now answers in a handful of seconds with the same citations.
Accomplishments that we're proud of
We built a memory layer an organization could actually adopt, not a demo of recall. It holds a company's knowledge on three axes at once, resolves conflicts between them with a rule you can explain to a lawyer, keeps an audit trail of who decided what, and enforces privacy on the server rather than in the interface. All of it runs end to end, deployed, on Qwen Cloud.
The clearest proof is what happens under pressure. When someone with the wrong authority states a new company policy, the system records the statement, refuses to act on it, cites the policy it collides with, and files it for a human decision. Ask the same question again and the original policy still stands, and the unapproved claim does not even appear among the citations. Nobody wrote that exception. It falls out of precedence and locks, which means the guarantee holds for cases we never thought of.
We are proud that the memory is genuinely institutional rather than personal. What one person teaches the assistant becomes available to their team the moment it is shared, and stays unavailable to anyone who should not have it, including administrators. That combination is what makes a shared memory safe enough to be worth having.
And it is not locked inside our product. The same store is exposed over MCP, so any external agent can search, write, and be governed by the same rules, which is what turns this from a feature of one application into infrastructure.
Finally, the model is legible. The three axes are not an abstraction in a document, they are the shape of the data, and you can rotate them, filter them, and drag a timeline forward to watch which knowledge is cooling toward the archive while the locked policies stay exactly where they are.
What's next for Khipu: Institutional Memory for AI Agents
The most immediate work is measurement. The lifecycle rests on an explicit forgetting curve with tunable half lives per memory type, and those constants are currently reasoned rather than proven. We want to run the whole pipeline against public long term memory benchmarks so the decay rates, the deduplication threshold and the reactivation cue are chosen by evidence, and so improvements can be defended with numbers instead of intuition.
Then breadth of intake. Memory should accumulate from wherever the work already happens, so more connectors, and smarter capture from long documents rather than only from conversation.
Then depth of resolution. Today a conflict is resolved by choosing a winner or keeping both as separate rules. We want the system to propose a merged wording when two versions are compatible, and to suggest promoting a practice to policy when the same team norm keeps being cited across an organization, so the memory does not just record decisions but notices patterns worth deciding on.
And finally, the keeper. The khipukamayuq did not only store the record, he read it back to the people who depended on it. A scheduled digest for whoever governs the memory, showing what was learned, what is about to go dormant, and which contradictions are still waiting for someone to resolve, is the closest thing to bringing that role back.
Log in or sign up for Devpost to join the conversation.