Model policy and autonomous memory

For the current route/menu map, see the desktop guide.

Status: active

The normal setup now uses Enable autonomous memory in Ask or Settings; new browser-created Brains include the preset. Detailed overrides below are under Advanced model controls. See the desktop guide.

Prerequisites

Start ./scripts/dev.sh and sign in at http://127.0.0.1:8787. The installed adapters read OPENAI_API_KEY and OPENROUTER_API_KEY from the environment. Model selection belongs to the Brain policy catalogue. The environment supplies only the embedding pair text-embedding-3-large at 3,072 dimensions (RECOLLECT_EMBEDDING_MODEL, RECOLLECT_EMBEDDING_DIMENSIONS) and an optional RECOLLECT_TEXT_MODEL. There is no built-in text model: when that variable is unset the installation reports none and each Brain's administrator chooses one (below); the installer's --text-model writes it only when given. The ignored .env is preserved by setup.

Key presence does not prove a successful call. Each Brain's policy independently grants model, purpose and content-class access. New policy forms select autonomous maintenance. Existing saved policies preserve their previous mode until an admin changes them. No fallback model/provider is selected automatically.

Choose a text model

A Brain with no selected text model captures evidence but sends nothing to a provider. Ask, Settings → AI permissions and the Brain's AI card show Choose a model, and the gateway reports model_not_selected ("Choose a text model for this Brain"). New browser-created Brains start in this state when the installation names no model, with capture on, the managed limits saved and transmission off.

1. As a Brain admin, open Choose a model (Ask or Settings → AI). The list loads from the installation's provider account; this is the explicit action that refreshes it. The provider key must be set in the ignored .env.
2. Pick a listed text model and choose Use this model. This re-applies the managed autonomous preset (see the desktop guide) with the chosen model and turns it on. A model the account does not list, or an unrefreshed list, is refused with its own message.
3. To pick a model without turning the preset on, use Edit AI permissions: choose the text model first, then allow AI processing and save.

Existing saved policies, including ones that already name gpt-5.6-luna, are never changed by this and keep working. An operator who wants one model for every Brain sets RECOLLECT_TEXT_MODEL (or ./scripts/install.py init … --text-model <id>).

Select OpenRouter per Brain

1. Set OPENROUTER_API_KEY in the installation's ignored .env and restart the API and worker with the current build. The key stays on the server.
2. As a Brain admin, open Settings → AI permissions → Edit AI permissions. Under Selected models, choose AI provider → OpenRouter. This selects GLM 5.3 Flash and Qwen3 Embedding 8B at 1,024 dimensions initially, and refreshes the reviewed model list. Existing saved Brain policies stay unchanged until saved; Cancel discards the draft.
3. Choose Save and rebuild. Changing provider or embedding dimensions queues a new semantic generation. Wait for its indexing state before comparing recall.
4. Optionally choose Check selected models. This makes actual text and embedding calls using fixed synthetic inputs and records their usage.

GLM 4.7 Flash, Meta Muse Spark 1.3 Contributor and GPT-6 Luna through OpenRouter are also selectable. Luna disables reasoning. GLM 5.3 uses low reasoning effort; GLM 4.7 disables optional reasoning. Muse's Contributor tier may use prompts and outputs to improve Meta products and can require account age confirmation. See the measured quality and cost limits before choosing a model for automatic support assessments. GLM 5.3 calls are restricted to the reviewed DeepInfra endpoint after the measured throughput-route failures; GLM 4.7 still prefers throughput. Both keep USD 0.15 input/0.50 output per-million price ceilings, strict parameter support and disabled fallbacks. Recovery results remain separate from first-pass results. These ceilings preserve cheap routing; they do not guarantee availability. Known rate-limit failures remain visible and uncertain calls require reconciliation. The per-model reasoning and provider-preference overrides live in a built-in table that RECOLLECT_MODEL_ROUTES (a JSON array, documented in .env.example) replaces; an invalid value is logged and the built-in table is used.

Model prices are dated references. OpenRouter route prices can differ; request history shows the billed cost when returned, or explicitly marks it unavailable. The adapter uses normal synchronous requests; local serving and asynchronous Batch are separate work.

Policy and connectivity

1. Open Settings → AI permissions → Edit AI permissions as a browser Brain admin.
2. Make sure a text model is selected (see Choose a text model), enable transmission and keep Autonomous memory selected for normal operation. Permit extraction, synthesis and claim content, plus the actual source classes to learn, such as document. Query permission supports handover titles. The fixed connectivity check additionally needs embedding permission.
3. Set the daily token allowance, concurrent calls and input/output limits. A reservation is the estimated input (request bytes divided by three), fixed headroom and the output limit. Known usage replaces it. A failed or uncertain call with no reported usage is charged its estimated input only; a succeeded call without usage keeps the full reservation.
4. Save once. The native worker catches up eligible retained current sources and responds to later evidence changes. It checks every ten seconds and resumes queued work after restart. Existing unscoped sources use Brain scope; the system does not guess a task or environment. Source contributor provenance is retained.
5. Optionally use Check selected models. Success confirms the actual model pair and vector shape through the shared gateway using only fixed synthetic text.

Policy history records immutable application revisions. If deployment model choices change, use Use installed models and save an explicit new policy; old permissions do not silently switch models. Activity → Model usage separates provider completion, discarded output, failure and uncertainty.

Automatic learning, revision and forgetting

Supported claims, explicitly evidenced decisions and procedures become accepted by policy without a human reviewer. Changed evidence can revise the same canonical memory, retain alternatives as uncertain, or retire an obsolete assertion. Revisions keep evidence and model provenance. A changed contributor automatically refreshes its existing machine-maintained handover; see procedures and handovers.

The worker freezes at most twelve compatible current machine-maintained targets from the same source lineage or a sole exact assertion family found after extraction across sessions. Selection, nullable manifest, fact-time meaning, support and current human rules must match. This is bounded exact discovery, not universal semantic matching. Unsupported replacement/retirement preserves the old head; faithful same-value reuse creates no duplicate revision. Human corrections, rejection rules and withdrawal survive later extraction. Ambiguity records omitted coverage without a mandatory user task or stopping other work.

Model output starts with unknown fact time and declared operational status. Procedures have no test observations until actual evidence is recorded; a model cannot verify deployment or authorize execution. Logical forgetting excludes or qualifies obsolete evidence. Class deadlines and the deletion journal perform physical removal automatically; see retention and erasure. Durable knowledge is not erased merely because it has not been retrieved recently.

Automatic support, session digests and later context

The ordinary flow is capture → extract → check evidence → publish supported memory → consolidate a settled session → recall in later work. All steps use standing permissions and the same gateway budget. A matching citation alone cannot establish support: the independent assessment checks the complete assertion and must quote its exact admitted evidence. Direct unreviewed contributions and older unchecked memory receive automatic audits before use. Withheld outcomes remain inspectable; routine operation needs no approval queue.

A closed task or five quiet receipt minutes schedules a digest after learning settles. Late uploads/corrections refresh its current coverage; unchanged useful inputs need no repeated synthesis. Each digest stays within its exact binding/task/session/child, environment and nullable manifest. Missing capture remains missing. A digest describes supported knowledge, not proof of deployment.

With both retained-content and support-excerpt permission, the worker keeps only minimum exact verified spans. Original class/speaker/scope still govern model transmission. These copies can support memory after raw expiry under their own retention; original erasure removes copies and descendants. They cannot start another automatic extraction loop.

Normal plugin recall includes a compact supported project brief and, when unambiguous, a current digest for the authenticated session/predecessor. It adds no brief model call and retains the existing 8 KiB/eight-second hook limit. Several applicable episodes omit continuation instead of guessing which is meant. See current local implementation and proof for deployment and model-quality boundaries.

Optional explicit learning and human controls

Open retained Sources → Source evidence → More source actions → Learn from this source. Select repositories, areas, environment and an exact manifest when applicable, then Queue learning. Source text is bounded; retain an explicit smaller excerpt if necessary. Learning runs in the model worker lane and does not block evidence capture.

Results link to Inspect learned claim and the optional review/correction controls. Explicit source requests still use the Brain's current acceptance policy.

With autonomous memory disabled, legacy learning produces proposals by default. A named literal configuration rule can accept exact lines such as Amber.port = 8080 when the source class, collection and property are permitted. The accepted claim records the rule/policy ID and has no reviewer. Interpretations, conflicts and rejected values remain qualified. The separate legacy automatic-source switch learns only newly processed sources; it does not backfill existing evidence. Neither mode can override rejection rules or modify an existing human decision.

Failure, retention and recovery

• Policy/role/model/content denial occurs before transmission. Adjust the actual Brain policy or scope; capture permission alone is insufficient.
• Provider failures have safe codes; no response body is logged. Autonomous work can create at most two separately recorded retries for known rate-limit or availability failures, rejected incomplete/malformed results and transient local conflicts (changed reconciliation input, expired input, claim or review capacity, a policy denial), after five and thirty minutes. A daily budget denial makes no provider call and waits until the next UTC reset within the same replacement limit. A source whose automatic chain failed for any reason other than removed content may start one new chain after a day, at most three chains per source and policy. A timeout or other uncertain outcome is charged its estimated input and does not automatically spend again. After diagnosing the service, Start new learning attempt records an explicit new attempt. This is service recovery, not approval of individual memories.
• A repeated interrupted command uses its original request key. Gateway calls are not implicitly repeated when a response was lost or a process restarted.
• Permission, policy, lease or input changes during a call discard output. Already transmitted data cannot be recalled from the provider.
• Erasure cancels dependent work. Erasing a source-supported claim also fences its exact supporting source versions from further model transmission, while retained source evidence remains manually inspectable. The preview reports this effect. The erasure journal carries those opaque source IDs so restoring a database from before the claim existed cannot regenerate it.
• Request detail follows audit retention; minimal accounting/fence identities remain. Claim-owned derivation provenance follows claim retention.

Verification

The core suite includes controlled local HTTP fixtures and actual older-database restore/replay, without sending customer data:

./scripts/test-platform.sh
cargo clippy --workspace --all-targets -- -D warnings
./scripts/validate.sh

Opt in to three small real OpenAI calls through a disposable browser-test Brain:

RECOLLECT_TEST_OPENAI=1 RECOLLECT_TEST_MODEL_WORKER=1 \
  ./scripts/test-ui.sh tests/models.spec.ts

This starts a native model worker during the UI test, verifies the selected pair, learns the fixed synthetic literal and checks policy acceptance, provenance, token limits and mobile layout. Without opt-in, the real-provider browser test is skipped. Its database and artifacts are removed by the owned test fixture. See the provider proof.

The autonomous closed-loop browser proof uses four synthetic Luna calls:

RECOLLECT_TEST_OPENAI=1 RECOLLECT_TEST_MODEL_WORKER=1 \
  ./scripts/test-ui.sh tests/autonomous.spec.ts

It checks learning, same-identity revision and handover refresh without individual review. Controlled HTTP/database tests cover retirement, bounded retries, expiry, in-flight erasure and older-database replay. The maintenance proof also records the persistent synthetic demo and its visible provider timeout. Persistent semantic indexes, graph inference and host capture remain later consumers. A successful embedding call does not establish semantic retrieval or approximate index support for the chosen dimensions.

Processing limits and native document workflow

Settings → AI permissions → Processing limits exposes maximum output tokens, maximum input bytes, daily token allowance and concurrent calls in the main form below Automatic processing. Choose Edit AI permissions, adjust values, then Save AI permissions. Output tokens default to 4,096 for new policies; existing policies retain their value until saved. Output exhaustion rejects a response rather than publishing partial memory. Known invalid/incomplete results receive at most two automatic replacements with 5/30-minute backoff; failed history stays visible. The daily allowance resets at midnight UTC. Budget rejection does not charge a provider call; eligible automatic learning resumes after the reset within its two-replacement limit. Raising output tokens can require a larger per-call reservation even when recent actual responses were smaller.

The complete primary source and provenance must fit the input byte limit. Reconciliation adds only whole compatible memory revisions that fit the remaining space, up to twelve. It does not truncate source evidence. model_input_too_large means the primary input itself needs a larger approved limit or a deliberately smaller retained excerpt.

The native plugin now provides source.import, source.list and source.inspect for authorized documents, exact IDs and retained citation spans. Use immutable write/read operations on the supplied task. Recollect derives the import scope and keeps it during automatic learning and recall. The bundled memory skill describes the workflow; no Rust repository path or private credential lookup is part of normal memory use.

Processing limit and protected input reasons

The dashboard distinguishes source processing from learning. Daily limit reached means a request cannot fit the remaining conservatively reserved allowance; it does not mean capture failed. Automatic learning can resume after midnight UTC within its bounded retries. Semantic indexing waits for that reset or a changed policy rather than rescheduling every minute.

Sensitive input means the existing credential/private-key detector blocked model transmission (model_input_sensitive). Code excerpts containing private-key markers can trigger this guard too. Keep the original evidence; import a separate sanitized excerpt if model learning is wanted. Historical invalid_input outcomes retain their original code and need individual inspection.

Settings → AI permissions → Processing limits keeps its explanatory text behind the info icon next to the heading, accessible by pointer and keyboard.

The first-batch Novita diagnostic failed and is not an accepted product route.