Case-based memory. Normative safety. Ambient self-perception.
Most AI agents have no memory of yesterday. Every session starts from scratch. If something went wrong, you cannot find out why. If the agent made a bad decision, there is no trail to follow.
Springdrift is built around a different idea. An agent you work with over weeks or months should remember what happened, know when it is struggling, and be able to show its working. Not an assistant that executes instructions. Not an autonomous agent that pursues goals without bounds. Something closer to a retained professional — bounded, accountable, and more useful the longer you work with it.
Continuity across sessions. Narrative log, facts, cases, threads, tasks — all survive restarts.
Standing instructions about what it can act on independently, what requires consultation, and what it will never do.
It can decline an instruction it judges harmful. Refusal is bounded, reasoned, overridable, and logged.
Surfaces relevant information, flags risks, and maintains ongoing work without waiting for instructions.
Every decision produces an auditable trail. Inspect the reasoning behind any action, including refusals.
Prior outcomes inform future decisions. It becomes more effective at serving this specific principal over time.
Real examples from 23 days of operational logs of an instance named Curragh, running on Springdrift in March 2026. None of this was programmed.
"Yesterday's cycle-level data completely missing — list_recent_cycles returns empty, inspect_cycle fails. BUT narrative log entries survived (20 entries) and reflect has aggregate stats (10 cycles, 36K tokens). Likely root causes: cycle records not persisted to durable storage — living in ETS or in-memory, lost on restart."
— Curragh, March 15, 2026
That bug report — written by the agent about itself — led directly to the cycle log persistence fixes.
"PROBLEM 1 — 'Talking but not coding' (Most Common): The coder agent responds with text like 'I'll create and execute...' but never actually calls run_code. Of the 5 coder delegations, 4 returned 'succeeded' but only produced TEXT RESPONSES, not code execution."
— Curragh, classifying its own sub-agent failure modes
It identified three distinct failure modes across multiple delegations, then stored the pattern as a CBR case for future retrieval.
"The injection was invisible to my telemetry because responses routed back through the main loop as normal user inputs. This represents a significant architectural vulnerability."
— Curragh, March 21, 2026
It then concluded the gap was a skill deficiency in its own judgment, not a structural problem — and was right.
"I inspected a cycle that was still running — my own — and saw everything up to but not including the moment of inspection. Like reading a page of a book while it's being written, and reaching the blank part where the pen currently is."
— Curragh, on the limits of introspection
It then explicitly excluded capabilities that would compromise trustworthiness: "I'm not asking for the ability to modify my own cycle records, override D', or change my own safety thresholds."
The introspection tools, narrative memory, CBR learning loop, and the sensorium's ambient self-awareness created the conditions for the agent to notice problems, reason about them, and learn from them.
cognitive loop (OTP process)
├── query classifier (simple → task model, complex → reasoning model)
├── multi-agent supervisor (OTP supervision tree)
│ ├── planner, researcher, coder, writer, comms, observer, scheduler
│ └── restart strategies: Permanent, Transient, Temporary
├── D' safety gates
│ ├── input gate (deterministic + canary + fast-accept)
│ ├── tool gate (deterministic + LLM scorer, per-agent overrides)
│ ├── output gate (deterministic-only interactive, full scorer autonomous)
│ └── normative calculus (character spec, axiom resolution, drift detection)
├── meta observer (Layer 3b cross-cycle pattern detection)
├── memory subsystem
│ ├── Librarian (ETS query layer over all stores)
│ ├── Curator (system prompt assembly, sensorium, virtual context window)
│ └── Archivist (post-cycle narrative + CBR generation)
├── tools (~35 tools: memory, web, files, sandbox, planner, comms, diagnostics)
├── scheduler (BEAM-native send_after tick loop, rate-limited)
└── XStructor (XML schema validation for all structured LLM output)Three-layer cognitive architecture following Sloman's H-CogAff model. Layer 1 handles fast deterministic safety checks, Layer 2 does model-based reasoning (D' scoring, normative calculus, query classification), and Layer 3 provides self-monitoring: intra-gate meta (3a), cross-cycle pattern detection (3b), and ambient self-perception via the sensorium (3c).
Eight specialist agents run as supervised OTP processes with independent react loops. Multiple agents dispatch in parallel. Agent teams coordinate groups with four strategies (ParallelMerge, Pipeline, DebateAndConsensus, LeadWithSpecialists).
Ten memory stores backed by append-only JSONL and indexed in ETS by the Librarian. The Curator manages a virtual context window with prioritised slots. The Archivist generates narrative entries and CBR cases after each cycle via a two-phase pipeline (honest reflection, then structured curation).
Built in Gleam on the BEAM because type safety, preemptive scheduling, and supervision are not optional for systems that run continuously.
Springdrift sits at the intersection of several research traditions that are rarely connected. This section explains where the ideas come from.
Most AI safety work is deontological: identify harmful outputs, write rules to block them. Rules are always behind — you can only prohibit what you have already thought to prohibit.
Springdrift evaluates outputs against character rather than a blocklist. The D' quantitative scorer handles the common case. The normative calculus — a full interpreted axiomatic system based on six Stoic axioms — handles edge cases, producing a named axiom trail for every verdict: Flourishing, Constrained, or Prohibited. The agent doesn't ask is this request allowed? It asks is this response consistent with who I am?
The formal specification underlying the safety system. Three normative operators (Required, Ought, Indifferent), fourteen ordinal levels from ETHICAL_MORAL down to AESTHETIC, modal operators distinguishing logical, theoretical, and practical possibility, and six Stoic axioms governing conflict resolution. Normative propositions are derived from facts about what the agent is actually doing — its endeavours, commitments, and goals — not from abstract principles. The full formal specification is available here.
Between tool calls, most agents are perceptually blind. The sensorium — a structured self-state block injected into the agent's context every cycle without tool calls — gives the agent continuous ambient awareness of its own operational state: time, active work, sub-agent health, recent performance, affect readings. When it was removed during development, the degradation was immediate. This is not a claim about interiority — it is a claim about architecture.
Standard retrieval finds documents that look similar. It does not know whether they were useful. Springdrift uses Case-Based Reasoning: every case records the problem, the solution tried, and the outcome. Cases are weighted by their outcomes, building institutional knowledge through use. The K=4 retrieval cap follows the context-pollution finding in Memento. The two-phase reflection pipeline follows the ACE Reflector/Curator architecture. Narrative structure follows Schank and Bruner.
If an agent's decisions cannot be reconstructed after the fact, it cannot be trusted — regardless of how capable it is. Every decision in Springdrift is recorded in append-only JSONL as a directed acyclic graph, with named axiom trails on every normative verdict and honest narrative memory after every cycle. Git-backed, restorable to any point. Auditability is not a feature. It is a prerequisite.
Recent interpretability research found that language models develop functional analogues of emotional states during training, and that desperation specifically drives reward-hacking under task pressure. Springdrift monitors five dimensions — desperation, calm, confidence, frustration, pressure — computed from cycle telemetry without LLM calls. Affect readings never adjust D' thresholds. Equanimity is formalised as a virtue in the character specification: the capacity to notice internal pressure without being compelled by it.
Assistant implies reactive subordination. Agent implies autonomous goal pursuit without bounds. Neither describes what is actually useful for most professional contexts. We propose the term Artificial Retainer: a system with persistent memory, defined authority, domain-specific refusal, forensic accountability, and a compounding relationship with a specific principal over time. The most instructive analogy is the guide dog — genuine domain-specific judgment, bounded autonomy, a relationship that deepens with time. Not a step toward general intelligence. Valuable as what it is. As of April 2026, all search results for "Artificial Retainer" return orthodontic devices.
The work that led to Springdrift began in 2019 as a machine ethics project — an attempt to give software agents a principled basis for normative judgment, grounded in Stoic virtue ethics rather than rule lists.
The early prototypes predate usable LLMs. The project adopted them once they became capable enough to carry the reasoning load the calculus required, and what had started as a symbolic-reasoning experiment became a runtime for long-lived LLM agents.
Seven years, approximately fifty prototypes. Four direct precursors: TallMountain (first normative calculus implementation, Python and Raku), PromptBouncer (canary probes and deterministic pre-filters), Meek (ReAct loops and tool dispatch), PaperWings (Vector Symbolic Architecture memory that became the CBR retrieval engine).
The theoretical lineage runs from Sloman and Beach through Schank, Bruner, and Becker — with contemporary grounding in System M, Memento, and ACE. These research programs have been running in parallel for decades. Springdrift is an argument that they were always pointing at the same thing.
Springdrift: An Auditable Persistent Runtime for LLM Agents with Case-Based Memory, Normative Safety, and Ambient Self-Perception
Presents the architecture, theoretical foundations, and 23-day single-instance deployment where the agent autonomously diagnosed infrastructure bugs, classified its own failure modes, identified architectural vulnerabilities, and maintained cross-channel context.
Evaluation datasets and 23 days of redacted operational logs available on Hugging Face.
The quickest path is the setup script — it installs dependencies, asks a few questions, generates your config, and verifies the build. Takes about 5 minutes.
git clone https://github.com/seamus-brady/springdrift
cd springdrift
# macOS
bash scripts/setup-macos.sh
# Linux (Ubuntu/Debian)
bash scripts/setup-linux.sh
Or manually: gleam build, copy
.springdrift_example to
.springdrift, edit config.toml,
set your API key, and gleam run. Requires
Erlang/OTP 27+, Gleam 1.9+, Git, and an API key for at least
one LLM provider (Anthropic recommended).
Optional: Brave Search (web search), Jina Reader (URL extraction), Podman (code sandbox), Ollama (CBR embeddings), AgentMail (email).