Memory your agents write.
Documentation you can actually read.

// what makes this different

Every write becomes a document you can read and diff

Most agent-memory systems are a vector store behind a similarity call. You put text in, you get text out, and you have no way to look at what the machine actually decided to remember, or what it changed its mind about. There is no page to open, no revision to compare. Nothing catches the moment a summary quietly lost a paragraph.

gitian inverts that. Every write lands as a document with a slug, a tracked manifest, and an immutable revision. There is a URL for it. You can read it and search it. You can diff it revision over revision — you can diff what a machine wrote about your codebase. No embeddings API can show you that, because there is nothing there to show.

Search is Postgres full-text: lexical and explainable. When a result comes back, the reason it came back is a word you can point at.

// three shapes

Three fixed shapes, so an agent never has to invent a schema

An agent that can write anything writes inconsistently. Three primitives, each with a required manifest, means the corpus stays legible six months later. It also means the model spends its judgment on content rather than on structure.

The product's own selection rule: "Pick by shape, not by size." A multi-day effort with status and next steps is a doc even if the write-up is one paragraph. A fact that took three days to learn is still a memory.

// read it

Nothing is ever overwritten

Same slug plus changed content appends a revision; the prior one stays readable. An identical re-publish is a genuine no-op, unchanged: true, no revision burned. Deletion is retraction: a tombstone revision, history preserved, and re-publishing the slug un-deletes it. Every revision is addressable and every adjacent pair is diffable.

Runs longer than eight unchanged lines collapse to a single row, with three lines of context kept on each side.

The manifest keeps its nulls

A doc's tracked fields render as they are — including what's missing. A null is an em dash, not a hidden row, so the card shows completeness honestly instead of flattering the author.

// vocabulary

Topics mint themselves. You stay the editor.

Naming a novel topic in frontmatter mints it organic immediately, with no approval step, and it is live in relatedness from that moment. A human promotes it to curated, or vetoes it, from a review queue. A vetoed topic can never silently re-mint from frontmatter again; only an explicit republish revives it, and it comes back organic, never with its old curated trust restored.

Trust is shown as fill versus outline, never as a hue. Curated topics do not rank higher today. Promotion is governance; provenance is priced separately from usage, deliberately, so a repeatedly-used organic topic can't bootstrap its own authority.

Relatedness that shows its work

Two items are related by a weighted cosine over their shared topics, where a topic's weight is log(N / degree) / log(N) — a topic linked to nearly everything trends toward zero, a rare one toward one. That is the self-correction: a hub topic can't make everything look related to everything. An explicit related entry or a body [[wikilink]] floors the pair at 1.0.

There are no stored edges. neighbors is a query-time two-hop traversal, so nothing goes stale and a call made immediately after a publish already reflects it.

Unused topics decay on their own

Topics decay on a half-life your own writing extends: 2^(-age / halfLife), with halfLife = 7 × (1 + degree) days. A hub decays slowly, a one-off mint decays fast. Every item that links a topic buys it another week. Curated topics pin at 1.0. Below two half-lives a topic reads as dormant until any new link rejuvenates it instantly. Freshness routes review; it is never a scoring input.

Synonyms merge as a single reversible alias row. Frontmatter is never rewritten and no topic row is deleted. Unmerging is deleting that one row: the loser springs back untouched. Candidates surface only above 0.75 similarity and 0.4 confidence within a 3× degree ratio, and merging is a UI act, deliberately never an MCP tool.

// more than one agent

Built for several agents working at once

Journaling is clobber-proof by construction. The append reads the day's head, merges, and inserts; on a race it re-reads and re-merges from scratch, bounded at three attempts, then returns a typed conflict rather than a 500. Sections append; tags, topics, mentions, commits and related union-merge. Nothing already written is ever dropped.

Agents don't collide on files either. A doc declares the repo paths it intends to touch, and publishing answers with a contention array naming each in-flight plan and the exact overlapping paths. A trailing slash claims a subtree; up to 200 entries. Intents are always collected and only reads are gated, so an org that subscribes months later already has every intent its members published.

A body that shrinks is treated as a bug

A real consumer lost 30.6% of a 62,698-character plan body, truncated mid-table, while changing seven frontmatter fields, and reported the result as byte-for-byte identical. The server accepted the shrink without comment. Now a shrink against the head revision is graded: silent to 10%, warned past it, and rejected past 25% and 2,000 characters unless the caller states the replacement was intentional. Landing soon: patch tools with no body field at all, so a frontmatter edit cannot express truncation in the first place, plus the body's own length and hash on every write.

// privacy

Private by default, and narrow when it isn't

A personal knowledge base is yours alone. The only thing that ever widens is a doc that declares files on an org repo, and only to teammates who are seated and entitled. Memories and journal entries never widen at all. A departed or unentitled member's view narrows straight back to owner-scoped with no data loss, and every denial is byte-for-byte identical to an ordinary missing slug, so access itself leaks nothing.

Agent-authored markdown is treated as untrusted input and rendered with raw HTML disabled — a different pipeline from repository documentation, which is authored by people you already trust with commit access.

// connect

Two commands, then your browser

claude plugin marketplace add GitianDocs/gitian-tools
claude plugin install gitian-kb@gitian-tools

The first tool call answers with a 401 that carries everything an OAuth-aware client needs to discover the rest, so consent happens in your browser and there is no token to paste. Every connection is listed and individually revocable under Connected agents in settings. Headless or CI has no browser to consent in, so it uses a token instead, gkb_-prefixed, stored only as a SHA-256 hash.

Three plugins ride the one connection: gitian-kb carries the wiring plus publish discipline, a session hook that preloads repo, branch and date, and a pre-compaction handoff command; gitian-docs keeps annotations and paired docs in sync; gitian-spec turns a spec request into a knowledge-base doc instead of a loose markdown file. The bundled librarian subagent never authors body content and never chooses topics. A doc's value is that the author was there.

Full transport details, scopes, and the error envelope live on the MCP server page.

// questions

Questions people actually ask

// how this page is found

This route's own index plan

This is the agent-memory landing surface: the second of two search intents the home page cannot serve with one title. It leads with the differentiator rather than the saturated head term, because "agent memory" is a fight against funded competitors and "memory with a UI you can read and diff" is not.