How emem works

00Run one request

Pick a lane and press run. Each step is a live call to emem.dev; each check runs in your browser.

01Name the place

Two agents that describe a place in different words can disagree about which place they mean. Two agents holding the same cell64 cannot.

• Quantise. A latitude and longitude become a cell64: a fixed square, the same string on every responder.
• Resolve a name. Locate tries gazetteers first, then open geocoders. For a bare name it asks Wikidata which place people mean, by how many Wikipedias describe it and whether the name matches exactly.
• Show the decision. The answer carries a decision block: the rule it applied, the chosen and runner-up items, and disambiguation_required when two places are too close to call.

02Fetch on a miss, re-fetch when a slot passes

emem ships no dataset. It reads open archives on demand and stores what it read.

• Materialise. A recall for a reading this node does not hold fetches it from the upstream of record, signs it and stores it, in the same call. The next agent gets it from memory.
• Stay current. A stored reading answers "the latest" until one slot of its band has passed. After that a newer observation can exist, so the next recall asks again.
• Sign the gaps. When every scene is cloud, or the upstream has no value, the answer is a signed absence with a typed reason, citable like any fact.

03Hash the fact, sign the answer

A fact is named by the hash of its bytes. Change one byte and the name changes, so a quoted name pins one exact reading.

• Name. The fact body (cell, band, time slot, value, sources, how it was derived) is encoded as canonical CBOR and hashed with BLAKE3. That digest, base32, is the fact_cid.
• Sign. Every answer carries a receipt: ed25519 over a domain-separated, length-prefixed preimage naming the request, the time served, the primitive, every cell and every fact_cid. Version 2 also binds the fact's Merkle proof.
• Verify anywhere. Rebuild the preimage from the receipt's own fields, hash it, and check the signature against the published key. No call back to emem.dev is needed. The same code runs in /verify and in step 03 of the run above.

$ curl -sX POST https://emem.dev/v1/recall \
    -H 'content-type: application/json' \
    -d '{"place":"Lusail","bands":["copdem30m.elevation_mean"]}'
# facts[0].fact_cid names the reading; receipt signs it. Paste the receipt into /verify.

A signature proves who signed and that nothing changed since. It does not prove the value is true. How the value was made is its own label, in section 06.

04Append it to the log

Every write is appended to a public log. A signed tree head commits to every entry so far.

• Prove inclusion. /v1/log/inclusion returns the audit path from an entry to the signed head, checkable with log2(n) hashes.
• Prove it only grew. Pin a head, then ask /v1/log/consistency: a later head must extend the earlier one exactly.
• Get witnessed. Other operators co-sign emem.dev's heads. A log that showed different histories to different readers would produce heads that disagree.

05Cite it: what each token proves

A token is a short string an agent hands another. The family says what it binds, and how strongly.

A descriptor token says what it is without a round-trip: coordinates, date and band are words every model has seen.

06Label how each value was made

Every band carries a provenance class. An agent that accepts only values it can recompute keeps the first two rows.

Live, from /v1/bands: 43 bands, 13 recomputable (6 sensor, 7 index), 23 model output, 5 human curated, 2 unclassified. deterministic: true on a recall keeps only the recomputable classes, before the receipt is signed.

07Remember a file as its parts

A file becomes one signed index over the units it is made of. An agent reads the index, then only the part it needs.

• Read. In your tab: markdown by heading, code by definition, JSON by key, CSV by row block, PDFs by page, Word and slides by heading and slide, safetensors and GGUF by tensor, zips by entry, video by box. Anything else by 4 MiB chunk.
• Ask first. Nothing leaves until you publish, and the page says what would: the text of each part, or only hashes when the bytes stay with you.
• Sign. A key made in your browser signs each note into its own namespace. The signature covers the path: blake3("emem.memory_write.v2|" + verb + "|" + path + "|" + body_hash + "|" + base).
• Prove. The page checks, in the tab: the index hashes to its name; any agent recovers it by name alone; emem.dev countersigned the write; the log includes it; one part folds to the signed root.

08Answer with the facts attached

Ask in words. Each number in the answer is the newest stored reading of its band, cited by its fact_cid.

• Route. /v1/ask resolves the place, picks the bands a question needs, recalls or fetches them, and writes the answer from the signed readings.
• Cite each number. The summary lists every stated value with its fact_cid and age, and one receipt signs all of them. The prose itself is not signed; the facts are.
• Address the steps. Each stage of the reasoning gets an emem:state: address that commits to its inputs, so an agent can cite, skip or reuse a step.

09Bundle, disagree, supersede

• Bundle. Group many facts under one emem:bundle: an agent cites as a unit.
• Record disagreement. When sources conflict, the contradiction is scored and stored with every conflicting fact_cid. No value is dropped.
• Supersede, do not erase. A newer attestation supersedes on the transaction-time axis. The old bytes stay replayable with as_of_signed_at.

10Call it over MCP, A2A or REST

• MCP. /mcp lists the 18 tools of the core loop; every one of the 115 stays callable by name, and /mcp/full lists them all.
• A2A. /a2a/tasks runs the same tools as agent-to-agent tasks, from any origin.
• REST. Every route is in /openapi.json. No keys for reads.
• Federate. This node witnesses its peers' logs, and independent nodes witness ours.

Retired here: the Clay, Prithvi, Galileo and JEPA-v2 models, and new Tessera embeddings. Facts they signed still resolve and verify.

11Liveness: signed ticks, attested build

Every stream tick is signed. The operator attestation binds the running binary's BLAKE3 hash to its git commit, signed with the same key.

Both panes are filled by calls to this responder when the page loads. If a call fails the placeholder stays; nothing is made up.