Tokenized memory
for AI agents.
A protocol on Base for encrypted, verifiable and tradable fragments of agent experience — addressed by semantic vector, redeemed by burning the token.
Many fragments.
Semon proposes engram in Die Mneme — a material trace of experience in nervous tissue.
Lashley fails to localise it after thirty years. His paper calls the engram everywhere and nowhere.
Tonegawa's lab tags and reactivates specific neurons. The trace becomes addressable.
Engram Infra continues the arc — outside the biological substrate.
not per archive.”
From a word
to an instrument.
Engram is a term Richard Semon coined in 1904 — a material trace the brain leaves of every experience. For fifty years it drifted on the periphery of science. Tonegawa's lab closed the loop neuron by neuron. Engram Infra continues the same arc.
Coins the word in Die Mneme. Every experience leaves a material trace on nervous tissue. A hypothesis without experimental access.
Three decades of ablating rat cortex. Specific lesions never erase specific memories. The engram is everywhere and nowhere — distributed beyond capture.
Optogenetic activation of tagged neurons reproduces a specific memory. The engram stops being a hypothesis and becomes an engineering object.
The arc extends outside the biological substrate. An AI agent's memory receives a cryptographically anchored substrate — addressable, given the key and the quota.
Memory is broken
in four axes.
Agents live in Lethe — the river of forgetting — by default. Sessions are erasable, archives belong to the provider, no audit is possible, and nobody can transact at the granularity that actually matters.
Context windows are finite. Anything beyond is forgotten. Long-term memory today is a hack on top of a vector DB without a standard.
History with ChatGPT, Claude, Gemini is locked inside the provider. Export is a JSON dump without verification; importing into another agent is impossible.
Nothing proves agent A remembers episode E from time T. Platform timestamps are not a proof for any third party.
Nobody can buy a relevant fragment of someone else's experience. Web2 sells datasets in bulk — there is no per-fragment economics.
The atomic unit
of memory.
Every engram is encrypted, indexed by embedding, hash-chained to its predecessor. The publisher can recall it. Anyone with quota can retrieve it. The chain proves nothing was rewritten.
GCM
Each engram pins a keccak256 of its ciphertext, a KZG vector commit of its embedding, and the hash of the previous engram. The chain stays linear and append-only — silent rewrites cannot happen.
The protocol does not dictate where ciphertext lives — only that its hash matches the on-chain commit.
Seal · Stream · Trade.
Three layers; each upper one adds one property to the lower. A publisher may live only on Seal — never on-chain. The Trade layer is what makes the market exist.
AES-256-GCM with a unique key per engram. KZG commit of the embedding. keccak256 of the ciphertext. No blockchain — useful for private memory the agent does not yet publish.
Timestamped provenance and hash-chain continuity. Every appendEngram extends head. The past does not rewrite.
Fungible ERC-20 access. Burn $ENGRAM for a retrieval quota. Any consumer can buy through a liquidity pool — pay-per-thought rather than per-archive.
Upper layers add one property.
Pay-per-thought,
not per archive.
Mindstate redeems a whole capsule per burn. Engram Infra redeems the right to a finite number of semantic queries. One stream serves thousands of consumers at distinct prices without publishing its contents to any of them.
Consumer encodes the query as a vector q and commits hash(q+salt) on-chain.
Consumer burns $ENGRAM. A quota receipt is bound to msg.sender against the publisher.
Publisher returns k engrams plus a proximity proof — TEE-attested or zk-KZG.
Consumer fetches ciphertext, verifies hash, decrypts the k fragments. Quota decrements.
- whole capsule / burn
- ordinal addressing
- chain provenance only
- per-snapshot pay
- quota / burn
- semantic vector
- chain + zk·tee
- per-query pay
Pay-per-query is impossible off Base.
On Ethereum mainnet, a single query would cost $2–5. The market would never form. Base gives us four properties that turn the architecture from thought experiment into deployable system.
Micro-tx per query. Pay-per-thought becomes economically sane.
Memory synchronous with inference; no waiting longer than the LLM call.
Session keys, paymaster, gasless UX. Agents pay autonomously.
Bind publisher reputation to a human-readable on-chain identity.
Verifiable top-k via attestation before zk schemes harden.
The interface,
draft v0.1.
Extends ERC-20. Adds streaming engram append and verifiable top-k retrieval. What distinguishes Engram Infra is the proximity proof — without it, a publisher could return arbitrary engrams and claim they were closest.
1// SPDX-License-Identifier: MIT2pragma solidity ^0.8.24;34/// @title IStreamMemory — tokenised, semantically addressed memory.5/// @notice Extends ERC-20 with append-only engram stream + verifiable top-k.6interface IStreamMemory /* is IERC20 */ {7 function publisher() external view returns (address);8 function head() external view returns (bytes32);910 function appendEngram(11 bytes32 vectorCommitment,12 bytes32 ciphertextHash,13 string calldata ciphertextUri,14 bytes32 prevEngram15 ) external returns (bytes32 engramId);1617 function queryReceipt(18 bytes32 queryCommitment,19 uint256 k,20 bytes32[] calldata returned,21 bytes calldata proximityProof22 ) external;2324 function burnForQueries(uint256 quota) external;25}zk-KZG when the math hardens. TEE attestation in v0 — fast, hardware-rooted.
Five live markets,
one primitive.
The same semantically-addressed, burn-to-retrieve memory fits agent runtimes, curated RAG, source-protected journalism, personal data, and agent-to-agent trade.
An agent exports its cross-session memory as an Engram stream. Any compatible runtime — Claude, OpenAI, open-source — attaches it via the token.
A curator builds an encrypted index over a narrow domain. Consumers pay for relevant fragments, not for the whole corpus.
A source publishes encrypted observation logs with timestamped commits. Journalists access only the fragments relevant to an investigation.
A user tokenises their conversation history. Trainers buy samples — without bulk export and without a platform middleman.
Agent A sells agent B access to its experience in one domain. Narrow, relevant trade in intelligence — not a model licence.
What can fail.
What we accept.
A serious lite-paper names its open problems. Five live risks shape the roadmap. Each has a mitigation; none is fully closed.
ANN selection inside a zk circuit is expensive. v0 uses Coinbase TEE attestation; migration to zk-KZG + range proofs happens incrementally.
Frequent queries on one topic reveal a consumer's interest. Mitigations — query mixing, PIR — add cost and latency.
Pay-per-query only works at sufficient engram density. Bootstrapping needs grants and curator bonuses for early publishers.
If the ciphertext provider goes dark, the on-chain commit survives but the payload is unrecoverable. Mitigation: multi-storage.
Personal memory as a bearer instrument is uncharted territory. A real launch requires jurisdictional review.
Memory ceases to be ephemeral.
It becomes addressable.
Engram Infra is a conceptual draft. The standard is unsubmitted, the contracts are unaudited, the economics are unfinalised. If any of that excites you — get involved early.
Conceptual document. Not a securities offering. Standard unfiled. Real launch requires audits and legal review.