Your AI agent remembers everything. Can it prove any of it? A developer built Engram, an open-source memory layer for AI agents that gives an agent's memory a git-like history, cryptographically signed snapshots stored on Walrus and anchored on Sui, and a verifiable forgetting mechanism. The tool, published on npm with a live demo agent trained on real on-chain transactions, aims to let anyone audit how an agent learned a belief, which memory drove a decision, and whether the record was altered afterward. By Rohan · Tatum × Walrus Total Recall hackathon · Track 02: Smart Agents for Real Life Every belief traceable. Every decision provable. Every memory forgettable. Watch the demo video https://youtu.be/zpMpASWEX5k · Try the live agent, no wallet needed https://engram-blond.vercel.app/demo · Read the docs https://engram-blond.vercel.app/docs · Read the code - The short version. AI agents now remember things about us, and they act on what they remember. But nobody can see how an agent learned something, which memory drove a decision, whether the record was edited afterwards, or how to make it truly forget. - Engram fixes that. It gives an agent's memory a history like git , a proof that anyone can check signed snapshots stored on Walrus and anchored on Sui , and an off switch forgetting you can prove . It's live, it's on npm, and the demo agent learned from real on-chain transactions. Picture this. You've given an AI agent access to your wallet. Its job is simple: watch your money and warn you when something looks wrong. For weeks it does fine. It learns your salary, your rent and your subscriptions, and it stops bothering you about them. Then one morning it stays quiet about a payment to an address you've never seen. You ask it a simple question: "Why didn't you warn me?" And it can't really answer. It has memories , a growing pile of text it has collected over the weeks. But it can't show you: That's where agent memory is today. Tools like Walrus Memory have made it easy for agents to remember. Nobody had made it easy to hold that memory to account . We kept coming back to one thought: software developers had this exact problem decades ago, with code. Code changed constantly, many people touched it, and when something broke, nobody knew which change caused it. The answer was version control . Every change became a commit, history could be compared, and git blame could tell you exactly where any line came from. We wanted that for an agent's mind, plus one thing git never needed: proof that a stranger can check without trusting us. So we built Engram . The name comes from neuroscience, where an engram is the physical trace a memory leaves in the brain. For a long time, AI assistants mostly talked . If one misremembered something, you got a wrong answer, you noticed, and you moved on. That's changing quickly. Agents now act . They move money, approve refunds, triage support tickets, screen applicants and manage on-chain treasuries. And to act well, they need memory: your preferences, your habits, the context from last week. Once an agent acts for you, its memory stops being a convenience and becomes a responsibility . A wrong memory is no longer a wrong sentence. It's a wrong payment, a wrong refund, a wrong rejection. While building and using agents, we kept hitting the same five questions: | The question | What you get today | What you'd actually want | |---|---|---| | "How did it learn that?" | A pile of raw text snippets | A clear line from what it saw to what it concluded , and how that changed over time | | "Why did it do that?" | A decision with no trail | A record of exactly which knowledge each decision used | | "Can I trust this record?" | Logs on the operator's server | Evidence that can't be quietly edited, checkable by anyone | | "What went wrong, and when?" | Guesswork | A way to search history for the moment a bad belief appeared | | "Can it forget?" | "We deleted it, trust us" | Forgetting you can prove , without breaking the rest of the record | We looked hard at what already exists before building anything. Each tool solves one piece. None of them connects what an agent saw → what it concluded → what it did in a way that is private, versioned and provable at the same time. Treat an agent's mind like a git repository, and make every commit provable on a public chain. We didn't want to replace Walrus Memory. It already stores agent memory privately and in a decentralised way. We wanted to build the layer that was missing on top of it : Walrus Memory gives agents memory. Engram gives that memory history, proof and control. Engram is for anyone who might one day have to answer "why did the agent do that?" with evidence instead of a shrug. | Who | The question they're stuck on | What Engram gives them | |---|---|---| | Agent developers | "My agent got worse after last week. What did it learn?" | log , diff , checkout , blame and bisect on the agent's mind | | On-chain and fintech agents wallet watchers, treasury bots, payment agents | "Why did the agent move, or block, this money?" | A signed receipt for every decision, which anyone can verify | | Regulated teams finance, health, insurance, HR | "Can we show which knowledge an automated decision relied on?" | Tamper-evident history and audit bundles that outsiders can check | | Privacy-first apps | "The user asked us to delete their data. Can we prove we did?" | forget , which destroys the data's key and records it in history | | Everyday assistant users through MCP | "What do you know about me? Forget that." | Engram tools inside Claude Code, Cursor and Claude Desktop | The wallet agent our demo . An agent watches a Sui wallet through Tatum. It learns the owner's salary, rent and subscriptions, and stops alerting on normal payments. When money goes to an address the owner flagged as a scammer, it raises a CRITICAL alert. That one decision can be verified end to end, down to a public timestamp on Sui. The support bot that went rogue. After an update, a support bot starts approving refunds it shouldn't. Instead of reading thousands of logs, the developer runs bisect , and it finds the exact commit where the bot learned "refunds are allowed up to 60 days" from one misread ticket. blame shows that ticket. forget removes it, and the next commit fixes the belief. The trading dispute. A user says a trading bot made a trade "for no reason." The operator doesn't argue. They send the receipt for that trade, and the user runs verify on their own machine. It shows exactly which beliefs the bot used and proves they existed before the trade. The right to be forgotten. A patient asks a health assistant to delete a conversation. After forget , the data can never be decrypted again, and the agent's own history shows the memory was removed and when. If you're building a simple chatbot with no need for history, audits or debugging, plain Walrus Memory is enough. And if your data must be edited in place, Engram isn't a fit, because it's append-only by design. That's what makes it trustworthy. Engram borrows from two places: how people remember and how git tracks code . Here are the five building blocks. An episode is a raw experience. It could be a wallet transaction "sent 0.05 SUI to 0x2498…" , something the owner said "that's my rent" , or a tool result. Each episode is encrypted with its own key before it's stored. That detail matters later, when we get to forgetting. A belief is a short statement the agent holds to be true, such as "The owner pays 0.05 SUI rent to 0x2498… once a month." Each belief has: People don't remember every moment of their day. While we sleep, the brain turns experiences into knowledge. Engram does something similar. The sleep step hands new episodes and current beliefs to an LLM, which proposes new , revised or retracted beliefs. There's one strict rule: every proposal must cite real episode IDs. If the model invents a reason or points at evidence that doesn't exist, the proposal is rejected. The agent can't make up why it believes something. A commit freezes every active belief into one snapshot. All the beliefs are combined into a single fingerprint called a Merkle root : change any belief, even by one character, and the fingerprint no longer matches. The snapshot is signed with the agent's own key, stored on Walrus, and its fingerprint is published on Sui. Each commit names its parent, so history forms a chain that can't be rewritten without breaking every link after it. Every time the agent makes a decision, Engram writes a receipt : "I did X, using exactly these beliefs, from this snapshot." The receipt is signed and includes a small mathematical proof a Merkle proof for each belief, showing it was part of the snapshot without revealing any of the other beliefs . classDiagram direction LR class Episode { id: ep … source: user | tool | tatum | agent keyId: own AES-256-GCM key contentHash: sha256 blobId: Walrus blob } class Belief { id: b … version: n statement confidence: 0..1 evidence: episode IDs status: active | revised | retracted } class Commit { id: sha256 of manifest parent: commit ID merkleRoot beliefs: id@version tombstones: episode IDs signature: Ed25519 manifestBlobId anchor: Sui tx + checkpoint } class Receipt { id: r … action inputHash beliefs used proofs: Merkle commitId signature: Ed25519 } Episode "many" -- "1..many" Belief : evidence for Belief "many" -- "1" Commit : snapshotted in Commit -- Commit : parent Receipt -- Commit : proven against Receipt -- Belief : used Episodes are evidence for beliefs. Beliefs are snapshotted in commits. Commits link to their parents. Receipts point at the commit and the beliefs they used. Follow the arrows and you can walk from any decision back to the raw experiences behind it. The easiest way to understand Engram is to follow a single memory from start to finish. Let's follow the rent payment from our demo. php flowchart LR IN "Wallet tx