Vestige 给 AI 代理一个可以检查的内存和一个守卫，在他们造成伤害前阻止他们。内存存在于 Strata，一个仅附加的日志，每次写入都经过一个门并留下一个收据，内存是通过其精确的 id 或标签找到的，而不是向量相似度。守卫在每次工具调用时都会跑到模型外，在命令运行前阻止它们，保留每个决策的接收，并且只有在拥有者通过自己终端批准该命令后才允许停止命令通过，所以旧的“是”永远不会被视为现在行动的许可。当某件事出现故障时，causal_walk 会沿着记录的历史追溯到真正原因。

问题所在

代理自行运行rm -rf、强制推送、丢弃表并覆盖.env，且无物能阻止他们。当某物出现故障时，相似性搜索寻找的是相似者，而非原因。

v5有什么新内容

5.0.0 PRECEDENT 于 2026 年 10 月 18 日发货。Vestige 现在可以读取自己的执法记录。

• precedent. 任何连接的代理都可以询问门禁或允许的事项，根据哪条规则，以及每个停靠的许可。

Vestige

Memory your AI can prove. A guard that stops it before it breaks things.

Vestige gives AI agents a memory that gets sharper over time, and a guard that checks your agent’s tool calls before they run. Every memory has a receipt. Every stop has a reason. Nothing is guessed.

Quick start

1. Install the binaries (macOS and Linux), or download them for your platform from Releases:

   curl -fsSL https://raw.githubusercontent.com/samvallad33/vestige/main/scripts/install.sh | sh
   

2. Run npx @vestige/init, choose Memory or Memory plus guard, and confirm.
3. Restart your AI client, then say: “Tell me something about a friend.” Ask about them later.

It remembers what matters

Save “Maya felt off after dinner at Bangkok Garden.” Later, save “Maya has a peanut allergy.”

Vestige sees that both memories are about Maya and raises the older one. When your agent plans Maya’s birthday dinner, that dinner comes up first.

This is Retroactive Salience Backfill: when something new makes an old memory matter, Vestige brings it back. It runs on every save, records every change it makes, and any change can be undone. How Backfill works.

It proves what it knows

Memory lives in Strata, an append-only log. Every write passes a gate and returns a receipt. A memory is found by its exact id or tag, never by a lookalike.

When something breaks, causal_walk follows the recorded links backward to the cause. Point gather at a GitHub issue and it walks back from there.

It stops what you never approved

Operator Lite is a free guard for your agent’s tool calls. It stops force pushes, dropped tables, recursive deletes and production deploys before they run, even when the command is disguised. 30 rules: 15 stop the call, 15 record it for you to review.