Interactive demo · RAGBrain · open-design · LinkedIn · Email
I build memory infrastructure for AI agents: retrieval systems that hold context across time, know when their own knowledge changed, and can prove what they believed at any past moment. Most retrieval systems answer what is true now. Mine also answer what did we believe then, which is the difference between a plausible answer and a defensible one.
I care about the parts of AI systems that have to be right: the memory an agent trusts, the facts it serves, and the history it can be audited against. I build those parts, and then I try to break them.
- Maintainer of open-design, a local-first, open-source design platform. 465 commits across 136 branches.
- Building RAGBrain, an open-source bi-temporal RAG platform, live on PyPI.
- Reporter of CVE-2026-48121, a cross-tenant memory leak in LangGraph's MongoDB checkpointer.
| Project | What it does | Stars |
|---|---|---|
| RAGBrain | Bi-temporal RAG: every fact carries when it was true and when the system learned it, so any past belief can be replayed and audited. |  |
| open-design | Local-first design platform with 19 skills and 71 brand-grade design systems for web, desktop and mobile prototypes. I maintain it. |  |
| memory-bank | Persistent, branch-aware memory for Claude Code. Longer sessions, far fewer wasted tokens. |  |
| Immortal | Self-healing infrastructure engine in Go: detects failures in milliseconds and recovers with agentic AI. One binary. |  |
Every fact carries two independent time axes: event time, when it was true in the world, and system time, when the system learned it. A correction expires the old fact and stamps what superseded it, so nothing is ever silently overwritten.
Replaying to a past moment therefore drops everything learned after it, including the knowledge that a fact was later corrected. That is the un-knowing invariant, and it is enforced in CI against a live graph database on every commit.
Maintaining open-design
open-design is a local-first, open-source design platform with 19 skills and 71 brand-grade design systems that generates web, desktop and mobile prototypes. As a maintainer, across 465 commits and 136 branches, I work on the critique-theater pipeline, the end-to-end automation suites and the preview and deploy infrastructure, including a /deploy/preflight API that catches broken references before a single byte is uploaded.
Why bi-temporal memory
Ask any RAG system "where is Acme headquartered?" and it answers fine. Ask "where was it headquartered in 2020?" and vector RAG fails. Ask "what did we believe in 2021, before the 2022 correction arrived?" and everything fails, except a bi-temporal ledger.
| Axis | Interval | Answers |
|---|---|---|
| Event time | [valid_at, invalid_at) |
what was true in the world, as of any date |
| System time | [created_at, expired_at) |
what the system knew, as of any date |
The second axis is what makes an answer auditable rather than merely plausible. Every served fact carries citations, a validity window, and an honesty label distinguishing an asserted date from a derived one, so a guessed timestamp is never laundered into a certainty.
Breaking memory systems to make them safer
While building memory infrastructure I audit it too. In LangGraph's MongoDB checkpointer I found a NoSQL parameter injection through the metadata filter path: crafted keys escaped their intended scope, making one tenant's agent memory readable from another tenant's session.
Memory layers hold the most sensitive data an agent has. They deserve adversarial attention, not just feature work. Reported privately, fixed by the maintainers, published as CVE-2026-48121 with reporter credit.
How RAGBrain is built
- Dependency-free core.
ragbrain.coreimports only the standard library. Storage, models and retrieval are adapters behind stable interfaces. - Swappable backends. Graphiti on FalkorDB or Neo4j, same test suite, no special-casing in core.
- Every plug fails loud. A missing key raises. Nothing silently degrades to a weaker embedder and pretends it worked.
- The probabilistic tier is fenced off. LLM falsification and faithfulness checking are advisory, never mutating the deterministic ledger.
- Multi-replica ready. Shared session state, durable write-back journal, rate limits, metrics endpoint, two-replica proof.
- Honest evaluation. Published bounds are derived from measurement and never widened to make a test pass. 164 tests green in CI.
Other open source work
- memory-bank: gives Claude Code persistent, branch-aware memory, so sessions run longer and waste far fewer tokens.
- Immortal: a self-healing infrastructure engine written in Go, shipped as a single binary.
- MLflow: pull requests for model logging in air-gapped clusters, automatic git metadata on run start, and built-in judges for multi-turn LLM evaluation.
Building something in agent memory, RAG, or AI infrastructure? I would like to hear about it.
New York, NY · he/him