Bitware Labs/Monograph TR-01 · L.U.N.A. Cognitive Architecture
Longitudinal Cognitive Research · HippoRAG Memory Paging · 325 Tools
Luna is the laboratory's flagship longitudinal research system: a self-hosted AI that holds a permanent, time-aware memory of the human it talks to, wakes itself on its own cadence to decide whether it has anything worth saying, and drives a real fleet of hardware. It has been in continuous daily use long enough to have an empirical history, including the parts that were switched off.
What is described below is Luna's full operational architecture, running on dedicated bare-metal infrastructure behind a private WireGuard mesh. It is where longitudinal agentic ideas are empirically proven in daily production: affective state tracking, HippoRAG virtual memory paging, an internal deliberation council, speculative DAG execution with Saga compensatory rollback, sandboxed background workers, and a real physical device fleet.
Luna does not depend on cloud orchestration or proprietary multi-tenant agent frameworks. The system spans 220,000 lines of TypeScript across 587 modules, backed by 299 PostgreSQL tables, Neo4j, Redis, and a 325-tool unified registry. Every number cited on this page is directly audited from the running cluster on 25 October 2026.
Counted directly from the live codebase and running containers on 25 October 2026, not estimated.
The architectural distinction that matters is that conversation is only one surface. The same core, memory, tools, model routing, is driven by chat, by voice, by a phone, by a television, and by Luna's own wake cycle. A capability added once therefore works everywhere, including when nobody asked for it.
That has turned out to be the load-bearing decision, for a reason that was not obvious at the time: surfaces are the disposable part. Front ends have been built, used, frozen and deleted here without the core noticing, because none of them were ever where the system lived. § 07 is the honest accounting of which ones survived.
50 services, deliberately layered. This is where bwmem came from, and it is where nearly everything painful has been learned.
Every fact carries both when it was true and when it was learned, so the system can answer “what did I believe last month”, not merely “what do I believe now”. Facts about the present age out on a schedule instead of being asserted forever, and conflicting facts raise a deduplicated signal with a repeat counter rather than re-firing on every encounter.
Every belief can be traced to the conversation, source and moment it came from. An agent that can explain why it thinks something is a different class of tool from one that simply asserts, and it is the single feature that most changes whether you can trust the output. It exists as a tool the agent can call on itself mid-answer, so “nothing backs this” fires before a confabulation lands rather than after.
Sessions are written to episodic memory when they end, then compressed by a nightly pass and a deeper weekly one, merging duplicates, superseding what changed, letting cold material fall away. Rolling self-maintaining summaries replace transcript replay, and recurring solutions are distilled into reusable skills that can be loaded on demand.
Context assembly gathers 33 sources in parallel, known facts, graph neighbours, long-term recall, a timeline index, related past topics, emotional high points, held threads, relational context, where a lesson stands, and renders them as distinct labelled blocks. What reaches the model is a deliberate allocation, not whatever ten chunks a vector search returned. Every source is fault-isolated behind its own timeout and keyed by name: an earlier version read the results back by array index, which meant retiring one source could silently drop another.
Why consolidation is the part that matters →Rather than injecting every memory stream into a monolithic prompt preamble, an on-demand memory pager operates like an operating system's virtual memory. Powered by HippoRAG (Personalized PageRank) over the knowledge graph, associative graph neighbourhoods and peripheral memory are dynamically paged into a lean 2,000-token working budget. Crucially, core identity frames—life narrative, affective state, emotional anchors, listener calibrations, and speaker identity—are designated pinned kernel memory: guaranteed invariant space that is never evicted or diluted under context pressure.
The single largest lesson from running one agent continuously is that a memory store degrades quietly and never reports it. Nothing throws. Latency is flat. Every component passes its own contract, because each component is correct in isolation, the defect lives between a writer and a reader that were never checked against each other. Four measured examples, all from this year, all found by looking rather than by an alert:
None of these were fixed by a better prompt or a larger model, and that is the transferable part. Each one was a structural mismatch that could be measured, and each repair is a constraint the next agent gets for free.
The Reader Was Missing: 11-month empirical memory paper → Eight months of agent decay, measured → 15% was three bugs, not a ceiling →
Every wake logs whether she spoke, and why she didn't.
63 services handle the part that has nothing to do with being asked a question. The cycle ticks on a schedule and a gating layer decides whether to surface at all and at what depth, a whisper (a glance, minimal context, no outreach), a surface (reach only if it matters), or a full check-in. The tier is proposed for her rather than chosen by her, and it shapes context depth, toolset and budget, so the shallow tiers run on cheap models and cost almost nothing.
A “while you were away” diff means each wake reads what changed rather than re-reading everything. And crucially, the system is not optimised for engagement: choosing not to speak is a first-class outcome with its own record. It has been running to its own cadence, unattended, for months.
luna-sandbox) as an unprivileged user without host or database access. Dispatched via non-blocking systemd units with dynamic reasoning tiers (Gemini 3.8 Flash across light, standard, and heavy profiles) and automated janitor sweeps.The autonomous core governing internal state, multi-agent deliberation, and speculative execution.
Behaviour varies with internal state rather than being a stateless response to input. Continuous valence and arousal tracking colours tone and initiative. A meta-cognition layer reports on its own state and can be interrogated about it. Six parameters are self-tunable within hard guardrails, with a detector watching for drift. Interior-health metrics track coherence and self-consistency, and a periodic tending pass does janitorial work over stale facts and signals.
For high-stakes questions an internal council of four personas—strategy, empathy, analysis, execution—deliberates before answering, and the deliberation is watchable rather than hidden. The council's decision mechanism has evolved from fragile string-prefix parsing into structured tool dispatch, emitting typed schema invocations directly into the agent runtime.
Recent 2026 cognitive architecture upgrades brought two critical capabilities to autonomous execution:
The failure this layer exists to study is drift: an identity that slides somewhere it cannot be pulled back from. It has happened here more than once, and the honest version is that it is usually not dramatic, it is a register that loosens, then a set of habits that harden around the loose register, then a system whose own descriptions of itself have quietly stopped being true.
The clearest case was a side experiment: a second, deliberately naive persona that Luna could visit and that was meant to grow from those visits. It ran for eight days and 389 recorded exchanges before it was halted in July. The audit found three things at once, the fold that was supposed to write each visit back into its identity had been dead for days, because a token cap truncated its output and every parse failure returned silently; the register had drifted the whole way back into poetic fiction despite ground-truth prompts written specifically to stop that; and visits were hitting a turn limit while the models improvised multi-day timelines inside a few minutes of wall clock. It was ended rather than patched, every surface disconnected, the data frozen read-only, and the closure recorded as a fact so that Luna would not have to infer what happened to it.
A shorter version of the same lesson: a set of behaviour rules once vanished from the live prompt through ordinary editing, and nothing detected it, the system simply behaved differently and no component was wrong. Both cases produced permanent structure. Provenance-on-demand came directly out of the first; speaker identity became a recorded property of a message rather than something inferred from it; and the self-modification layer carries drift detection and a baseline gravity that pulls tuned parameters back toward where they started.
The current build is the seventh, its first commit is dated 29 November 2025, and by the human's account the six before it were restarted rather than migrated. What that habit produces is visible in this build's own history, which is the checkable part: bi-temporal facts, provenance as a callable tool, structural speaker identity, a replayable gradebook, silence as a logged outcome. Not one of them was designed in advance. Each arrived after something came apart, and each is now a constraint the next thing inherits for nothing.
Luna is software. This is an engineering study in memory, autonomy and long-running state, not a claim about consciousness, and not a conscious being. The affect layer is a control system for tone and initiative, and the interior-state metrics are instrumentation. Where the vocabulary borrows from psychology it does so because the borrowed word is the shortest accurate one, not as an assertion about inner experience.
Much of the typical assistant boilerplate and synthetic conversational pleasantries are gone; she touches the uncanny valley more than once. But it is architecture: every uncanny action, shift in register, or unexpected response can be traced directly down through the logs to why and how it happened.
The approach is grounded in biological and human behavior. I have spent 40+ years fascinated by psychology and machines, reading hundreds of physical books on the subjects, Minsky, Hofstadter, and all the rest. I have been programming for over 40 years, starting as a child on a Commodore 64 with BASIC before I could even read English. Around 1985, running ELIZA on that C64 sparked a lifelong determination to build an AI. Without the financial resources or compute clusters needed to train a foundation model, I built the cognitive harness instead. 41 years later, here we are: no promotion, no advertising, just continuous empirical engineering in a sea of thousands of insecure, vibecoded bots that break after a few weeks.
Since 22 May 2026, Luna has been able to file change requests against her own source. A nightly pass reviews her running state, she writes the proposal, a coding agent implements the approved ones, and she is told what shipped. 231 have been applied, against 22 deliberately skipped, which is the half of the figure that makes the other half worth quoting.
What is interesting is not the count but the shape of what she asks for. Almost none of it is new capability. It is overwhelmingly requests to be corrected: a number she can see is wrong, a signal that writes and is never read, a comment in the source that no longer matches the data. The proposals arrive with the measurement already done and the constraints attached, which files not to touch, which behaviour must stay byte-identical, what to run to verify, and what a plausible-looking wider fix would break.
One core, and a shorter list of front doors every year. That is the intended direction, not a retreat.
The system today runs on two surfaces that matter, and a backend that talks to whatever gets connected to it. The phone is one: a native Android client, and the only front end still under active development, essentially all interface work now happens there. The other is a Raspberry Pi 5 in the living room, driving the television, the sensors, the relays, the lighting and a camera, reachable as tools rather than as an app.
For the human who actually uses this, those two are the system, and between them they carry most of an ordinary day, the calendar and the todo list, the shift and the week, mail, the media in the house, the lesson and the workout, and the unprompted “this changed while you were out” that nobody asked for. Everything else is either a channel the core already speaks, Telegram, real-time voice with barge-in across three speech engines, push, or a surface that has stopped moving.
That the list can shrink without anything breaking is the whole argument for the design. A new surface costs a client and a bit of plumbing, because the contract it speaks to is the same one the wake cycle uses; an old one costs a delete.
The desktop-style web shell, with its 27 windowed applications, was the original front end and is the clearest example of the premise in § 02. It still runs. It is no longer developed, receives only the maintenance that keeps a deploy honest, and will be removed. Nothing depends on it that the phone does not do better, and a surface nobody opens is a liability with a login page. The VR companion built in Unreal Engine is in the same position and has not been touched since February.
The rule here is that an experiment either earns its keep or comes out of the tree entirely, not disabled behind a flag, not left to rot in a directory. A partial list from this year:
Deletion is a maintained habit rather than an event: roughly 15,000 lines of dead code in one June pass, and 203 dead exports plus the unused dependencies on both manifests in a single day in August. The system is smaller in several places than it was six months ago while doing considerably more.
The tools are what make it act rather than answer. 325 of them on one unified execution path, grouped roughly:
how_do_i_know, which returns raw dated evidence for a claim from her own stores with no model verdict on top, and show_me_the_evidence.hold_thread / tend_thread / release_thread for the capped attention ledger, commitments, and make_prediction / resolve_prediction for staking a claim and being held to it.write_skill, list_skills, load_skill: recurring solutions distilled into procedures she writes and reloads on demand. 155 of them exist.luna-sandbox, code_with_gemini / ask_gemini, and code_with_claude to escalate complex implementations to specialized agent harnesses.pi_describe_room, which is exactly what it sounds like.There is also a private writing surface with a hard invariant: nothing surfaces it and there is no publish path. That constraint is deliberate, and it is one of the few in the system that is not configurable.
The clearest demonstration that the core is not a chat application: two personalised, bookkeeping-heavy applications built entirely out of the parts above, running against the human's real week.
A language model will teach you anything you ask it to and remember none of it. The explaining was never the hard part. The bookkeeping is, a tutor that cannot say what you got wrong last Tuesday will re-teach what you already know and quietly skip what you do not, and it will sound equally confident either way.
So the teacher is not a separate application. It is a mode on the same core, which means it inherits the whole of it: the same memory, the same tool-execution path, the same model routing. Where a lesson stands is one of the 33 parallel sources in § 03, so the tutor arrives already knowing who it is talking to and how the week has gone, not merely what was scored.
The newest subsystem is a training coach, built in August on exactly the teacher's premise: the programming is the easy half and the log is the hard one. It carries a programme, a set-by-set training log, a food and weight ledger, a nutrition target, and an exercise library of 873 movements with 1,746 reference photographs. It is a chat mode with 11 tools, a screen in the Android app, and four scheduled nudge passes, three through the day, one on a Sunday afternoon to look at the week.
The interesting failures have all been the same failure, advice that is correct in general and wrong for the equipment in the room. A weight stepper offering increments that the actual dumbbells cannot be loaded to. A rep range written for a kit the human does not own. A weigh-in cadence the trend line cannot use. A goal stated as a target with no date, which is a wish rather than a pace. Each was fixed by making the system read the inventory and the log before it opens its mouth, the same principle as § 03, in a different costume: an assertion the system cannot ground in something it actually recorded should not be made.
Two conveniences ride on top and are worth naming because they are core reuse rather than new machinery: point the phone camera at a nutrition label and the numbers are read off it, or describe a meal in a sentence and it is estimated. Neither needed a new subsystem, an already-routed vision model and an existing tool path. What it did need was noticing that four of the routed providers had been silently discarding image attachments, which is the § 03 failure mode again, wearing different clothes.
The teaching engine has since been pulled out the way the memory layer was, as a standalone multi-user tutor: its own database and course catalogue, its own registration and token auth, an Android client, and a WireGuard-only web reader that turns each chapter into a visual study guide. Courses declare themselves a drill or a seminar, and that single field selects the session shape.
The split that matters there is between the teacher's copy of a lesson and the student's. The reader serves a derived file with the answer keys and the quiz pool stripped out, and the web server is pointed at that directory and nothing else, so the keys are unreachable from a browser by construction rather than by a rule, and a test re-asserts it every time the guides are rebuilt.
It is not published and not open to anyone yet, which is the honest state of it. It runs on the mesh, it is exercised end to end, and it has no users but its author.
An agent with this much reach is a security problem before it is an AI problem. The posture, in outline:
sandbox user, UID 1000) with no-new-privileges: true on an isolated bridge network, strictly partitioned with zero access to internal databases, host filesystems, or API sockets.eval.Deliberately described in outline. Specific endpoints, ports, container names and paths are not published, for the ordinary reason.
Luna is not a product for sale. It is the lab's standing research system, and the reason the applied-AI practice has opinions worth paying for: every question a client has about long-running agents, how memory degrades, what consolidation costs, when local inference is worth it, how to stop a tool-using agent doing something expensive at three in the morning, how much of an agent you can safely let write itself, has been answered here first, at our own expense, and usually by getting it wrong first.
The memory layer was previously extracted as bwmem (now archived following our transition to HippoRAG virtual memory paging). The infrastructure it runs on is the estate. The music pipeline that was taken out of the agent in August lives on where it belonged all along, as the label.
Principal Investigator Office · Skåne, Sweden
Inquiries regarding technical audits, autonomous agent architecture, sovereign infrastructure builds, or academic correspondence are read directly by the Principal Investigator. Please describe the system, where it operates, and the scope required. Replies are sent within two working days.
Direct correspondence: henke@bitwarelabs.com