Memory is a claim.

In April, Andrej Karpathy described a small markdown wiki his AI writes for him while he reads — drop in sources, ask questions, let the model keep the notes. The post drew about 21 million views, and within weeks the internet was covered in second brains: starter kits, constitution files, Obsidian vaults with an LLM as the librarian. Two weeks later, Khoj — a Y-Combinator-backed “AI second brain” with 36,000 GitHub stars — quietly shut down its cloud service. Its post-mortem was honest: the integrations were endless, the clients were many, and the big labs were shipping memory as a feature.

Both things are true at once. The demand is enormous, and the personal version of this product does not survive contact with a business model. That paradox has an explanation, and it is not that memory doesn’t matter.

It’s that for an organization, remembering was never the hard part. The hard part is proving what you remembered — to someone who does not trust you.

Where every current answer stops

Ask any AI memory product a simple question: what did this system know on March 3rd, and can you prove it to my auditor?The personal wave can’t answer at all — a markdown vault has no isolation, no access control, and its history is whatever the last edit left behind. The enterprise cohort answers with logs: permission inheritance, retention policies, an audit trail that lives inside the vendor’s own console. That answer amounts to trust us. A log you can only read in the vendor’s UI, produced by the same system it describes, is testimony — not evidence.

Meanwhile the deadline side of the ledger is filling in. The EU AI Act’s logging obligations reach full enforcement in August 2026. U.S. payers are under CMS interoperability rules with statutory dates, while litigation over AI-touched coverage decisions has already put “what did the model know when it decided” in front of judges. In one industry survey, only 22% of hospital leaders were highly confident they could produce a 30-day AI audit trail. Regulation asks for logs; litigation asks for portable proof. Almost nobody can produce either on demand.

The definition

Definition · Attestable memory

Attestable memory is organizational AI memory in which every fact carries verifiable provenance: each ingestion, answer, and computation is sealed in a signed, hash-chained receipt recording what was known, when it became known, what it superseded, and what was cited — so that a third party can verify the record offline, without trusting the system that produced it.

Four properties do the work. Bi-temporal facts: the memory records both when something became true and when the organization learned it, so stale claims are superseded with provenance instead of silently overwritten — and “show me what we believed on March 3rd” is a query, not an archaeology project. Signed receipts: every ingestion and every answer emits a cryptographically signed record, chained to the one before it, so the past cannot be quietly rewritten. Hard isolation: each organization’s memory is fail-closed — enforced at the database layer, not by a filter a prompt can talk its way around. External verifiability: receipts verify offline, against a public verifier, by parties who do not trust the vendor. That last property is the dividing line. Everything short of it is a nicer log.

The same standard applies to numbers. A language model asked to total a budget column is guessing fluently — on complex spreadsheet aggregation, pooled model accuracy sits around 20%. Attestable memory refuses the guess: quantitative answers are computed by executed SQL over real tables, and the receipt seals the question, the query, and the result hash together. The answer isn’t “probably right.” It’s reproducible.

The half that acts

A brain that only remembers is a library. The reason organizations fund this at all is the layer that acts on the memory — the routines, skills, and agents the creator wave calls an AI operating system. They are right about the shape. Every popular starter kit converges on the same anatomy: context, connections to tools, capabilities, and a cadence of autonomous runs. What none of them can offer an organization is the property that makes autonomy tolerable: a proof trail for the actions themselves.

Definition · Governed action chain

A governed action chain is a single sealed receipt spanning an AI action end to end — the trigger that fired, the retrieval set it read, the policy gate it passed, the action it took, and the outcome — so that what the organization knew and what its AI did about it verify together, as one artifact.

Autonomy then stops being a vibe and becomes a policy object. An agent operates at one of four levels — watch (observe and brief), draft (propose, a human sends), approve (act after sign-off), autopilot(act within sealed policy bounds) — and the level itself is an administrator-set, receipted setting, with an audit trail for every escalation. When the compliance officer asks “how much does it act?”, the answer is a record, not a shrug.

The obvious objection

No regulation requires cryptographic signatures, and incumbents will say their logs are auditable. Both points are correct and neither survives the exam. Regulations set the floor — logs. Disputes set the bar — proof that travels. When an AI-touched decision is challenged, a retained log inside a vendor console requires the examiner to trust the vendor at exactly the moment trust is the question. A signed receipt travels — to an auditor, an appeal, opposing counsel — and verifies on a laptop with no account. And while any competitor can add a signature in a quarter, no one can retroactively sign the past: an organization that has been minting receipts for two years holds an evidence base a fast follower cannot manufacture.

Where this goes

The pattern of the next few years is already legible: every organization builds a second brain, then builds its AI operating system around it. The wave taught the market the vocabulary. The labs will give every individual a personal memory for free. What remains — what was always the actual enterprise problem — is memory that stands up when someone hostile asks how you know. The organizations that get this right won’t just answer faster. They’ll be the ones still standing after audit season, holding receipts.

Memory is a claim. A receipt makes it evidence.