Hardware

Memory infrastructure that spans devices and years

Companion pendants, smart glasses, home robots and in-car assistants are arriving all at once, and they are all stuck in the same place: the model is easy to swap, the memory is hard to build up. Change the device, skip six months, and it no longer knows the person. Memory is the layer you can buy instead of build. What you save is a year.

Talk to us See benchmarks

The device never holds an API key

设备身份与短期令牌

An API key can read and write on behalf of anyone, so it must not sit on a device you cannot trust. Devices take a different path: your server registers the device and gets a secret, the device trades that secret for a 15-minute token, and the subject is pinned inside the token. A request that tries to override it gets a 403, not a quiet ignore.

Device onboarding

Four calls to integrate — the device never holds an API key

POST /v1/devices                  your server registers a device with its API key
                                  -> { "device_id": "…", "device_secret": "mds_…" }
                                  the secret is returned once; only its hash is stored

POST /v1/devices/token            the device trades the secret for a short-lived token
                                  -> { "access_token": "mdt_…", "expires_in": 900 }
                                  subject is pinned inside the token; params cannot override it

POST /v1/remember                 report. Idempotency-Key makes offline retries safe
    Authorization: Bearer mdt_…
    Idempotency-Key: 018f2c1a-…   same key writes once; a replay returns the first receipt

GET  /v1/changes?since=<cursor>   another device pulls the delta. Invalidations are in
                                  the feed too, so a client expires them instead of
                                  watching a memory silently disappear

Revoking cuts off the path to a new token; one already issued has to expire, which is why the TTL is 15 minutes. That is the inherent trade-off of stateless signing, written down rather than glossed over.

Save locally first, retry safely, lose nothing, duplicate nothing

本地队列与幂等键

In a car, outdoors, in a basement garage: hardware networks are just unreliable. Three things have to be in place together; drop any one and the guarantee is gone:

Queue before ack

A report goes into the local queue before the caller is told it succeeded. When the queue is full the oldest is dropped and counted, not silently discarded.

Idempotency key

A network timeout cannot tell "never arrived" from "arrived, but the receipt got lost". Not retrying loses data; retrying duplicates it. The same Idempotency-Key writes exactly once, which covers both.

Cursor resume

Sync lands the page first, then saves the cursor. Reverse that order and you lose data. It pulls rather than pushes, so going to the background or losing the connection just means picking up where it left off.

One brain per person: change the device, keep the memory

按人隔离与会话统一

Isolation is by person, not by device. A speaker, a watch and an app under the same subject write into one brain, and who wrote what, and when, can always be looked up. Swap the hardware and the memory follows the person.

Two layers of isolation

Three application-level filters (tenant + project + subject) plus row-level security in the database, with policies on all 18 tables. Two people sharing one device at home do not bleed into each other.

Unified sessions

What one person says across several devices, close enough in time, joins the same session; an advisory lock guards it under concurrency, so it does not shatter into unrelated fragments.

Scene anchoring

Facts carry a scene label from a controlled vocabulary (home / transit / driving / outdoors …), with aliases so everyday phrasings land in the right slot.

Row-level security, first live check 2026-08-30: 8 passed / 0 failed. The verification scripts ship with the repo and can be re-run against your own database.

Numbers

Latency and cost

Median latency and cost estimates

332ms

End-to-end recall latency (median)

Basis · Facts and the dialogue they came from, in one call · concurrency 3 · 200 LoCoMo questions · zero errors · p95 427ms · includes one remote embedding call · 2026-09-28

~8CNY/user/mo

Memory cost, always-on voice

Basis · Wearable always-on basis · 8h worn per day · 15% effective speech · 36 audio-hours/month after VAD gating · self-hosted ASR + off-peak batched LLM · 50k DAU · derived from public list prices, not a measured bill

0.5–1.5CNY/user/mo

Memory cost, conversational

Basis · Excludes ASR · end-of-day batched LLM + storage and retrieval · a methodological estimate, to be recalibrated against real traffic after launch

Both cost figures are methodological estimates from public list prices, not invoices. Before anything is signed we recompute them against your real volume.

Hardware

Bring your own questions and we will run them

Before you integrate, run a head-to-head on your own conversation data: our system against whatever you use today, same questions. Beyond the score, every retrieved memory opens up to show why it was picked.

Talk to us