Free · the method

Two brains, one truth: what we learned building a federated world model for a real business

Somewhere in your stack there is a fact that used to be true. It lives in a CLAUDE.md file, and in a wiki page, and in a code comment, and in the retrieval index built from all three. A fortnight ago someone corrected one of the four. The other three are still being loaded into context windows and quoted with complete confidence.

We know because we ran that stack. We build and operate agent systems for a property business: one operator, a portfolio of development projects, a mailbox that never sleeps, and decisions with real money on the far side of them. The agents read correspondence, track deals from acquisition through planning to settlement, draft replies, and answer the operator's questions at speed. None of that is safe unless the system's model of the world is actually true.

What we had at the start is what most teams have. Context scattered across a document catalogue, a wiki, code comments, prompt files and people's heads. A RAG pipeline that re-derived every answer from raw sources on every query and accumulated nothing: the hundredth question about a project cost as much as the first and taught the system exactly as little. And underneath both, the quiet failure that does the real damage: every correction made in one place silently missed its copies. Nobody decides to let knowledge rot. It rots because nothing owns keeping it true.

Then the wider field named the cure's shape. In April 2026, Karpathy's LLM-wiki gist sketched it: immutable raw sources underneath, an LLM-owned markdown wiki above them, a schema ruling the conventions, and the stance that matters most, a wiki "compiled once and kept current, not re-derived on every query". In June, Google published the Open Knowledge Format v0.1: one concept per markdown file, YAML frontmatter with type as the only mandatory field, plain links forming the graph, index files, a lint pass. Just markdown, just files.

We read both with the odd feeling of finding our own floor plan in someone else's building. We had converged on the same primitives independently: markdown atoms with frontmatter, one concept per file, a link graph, an index that doubles as a decision surface, an append-only log, lint for contradictions and orphans, a schema layer over the lot. That convergence is the good news. When separate teams arrive at the same shape, the shape is probably load-bearing rather than idiosyncratic; the lineage arguably runs back through wikis to Bush's memex.

The rest of this piece is the part the standards don't cover yet: four scars we picked up running the pattern against a real business, and the rule each one left behind.

Scar one: freshness needs an owner, not a timestamp

OKF stamps a fact with when it was last touched. We did the same for a while, and learned what every wiki operator eventually learns: timestamps rot. A timestamp records that someone once cared. It says nothing about whether anyone still does, and a stamp with nobody behind it is a promise with nobody behind it. Our early tree filled with facts that were stamped, plausible and quietly false.

The rule that fixed it is the operator's own phrasing, now enforced by lint: "never store a fact without naming its freshness owner." Not when this was true. Who keeps it true. Every fact carries a freshness owner drawn from a closed set of five:

Two details carry most of the weight. First, shelf life means stop trusting without a recheck, never delete; expiry mints work rather than silently dropping knowledge. Second, the amendment that has done the most work in practice: most facts don't age by clock at all. They die by event. "The vendor has not signed" dies at exchange. A fiscal figure dies at year end. An arrangement dies when the deal it hangs off settles, or when a newer instrument supersedes it. So facts declare invalidators, the specific happening that kills them, and the watchers use those to re-true surgically instead of sweeping everything on a timer. Invalidators beat shelf lives the way event-driven beats polling.

A later addition closed the remaining gap: conclusions declare their premises. A judgment derived from three facts records the three, and when any premise is corrected or invalidated, every dependent conclusion gets flagged for recheck. Conclusions inherit the mortality of their premises. Without that edge, you fix a premise and leave its conclusions confidently orphaned.

The most useful page all of this produces is the least flattering one: the list of unowned facts. It is the map of what the brain cannot keep true. Being able to read that map honestly turned out to be worth more than any dashboard we've built.

Scar two: the brain is a mirror, not the world

Store enough facts and you start treating the store as the territory. It isn't. It's a mirror, and every stored fact is evidence of a moment that has already passed. Two failure classes follow, and freshness machinery only catches one of them.

Stale is the obvious one: the fact was true and the world moved. Owners, shelf lives and invalidators exist for exactly this. Partial is the dangerous one: the fact is accurate and still misleading, because the corpus never saw the rest of the picture. No stamp catches partial. The fact reads clean.

We keep a calibration ledger for this. Every time the system's beliefs meet ground truth (an answer checked against the world, a prediction resolved, an operator correction) it gets logged, belief against reality. Both of our worst misses in that ledger are the same class, and it isn't staleness. It's absence read as fact. The sharpest example: the tree showed six months of silence on a utility approval, and the system read the silence as the process having died. Accurate about the corpus. False about the world. The approval outcome, the cost estimate and the client's instruction to keep going were all sitting in the mailbox; a filing gap had simply kept them out of the tree. One runtime check dissolved a conclusion the mirror had been quietly confident about.

The rule that came out of it: absence in the tree is never evidence of absence in the world. It is evidence about coverage. Before concluding anything from a gap, the system now walks the neighbours (siblings on the same deal, the counterparty's other threads, the corpus windows that could plausibly hold more). And before a fact is quoted to a person or money moves on it, two questions in order: can I verify this right now, and is this the whole picture? To make the first question cheap, recheck routes travel with the fact itself: an executable instruction plus the access needed to follow it, discoverable at runtime by whoever is holding the fact. Re-verification costs seconds. Being confidently wrong in front of a client costs considerably more.

Then the inverse failure bit us, and it's the one we've never seen written up anywhere. Presence read as relevance. The system held an entire cluster of facts about a rural land syndicate: parties, parcels, process, all properly filed, all internally consistent, all treated as if it mattered to the operator. When the operator was finally asked about it, they had no idea what it was. It was a colleague's world, swept in through a shared mailbox and ingested along with everything else. Every fact in the cluster was true. None of it was ours. Corpus presence proves the world holds a thing. It never proves the thing is yours, and a world model that can't tell the difference will spend attention, context and eventually money on someone else's life.

Scar three: copies are the disease, custody is the cure

The business could not stay one brain. The operator's personal world (private holdings, personal matters, things staff must never load) and the business's world (staff-visible, process-heavy) sit behind different privacy walls, so they became two trees with two different audiences. Federation arrived for boring governance reasons, not architectural ambition. Roughly 1,200 facts refer to things both brains care about.

They drifted immediately. Not over months; immediately. The emblem was a morning when a joint-venture term sheet got corrected in one brain and the fix travelled to the other by a human remembering to carry it across. That worked, that day. It is not a mechanism. It's luck with a good reputation, and we had just built freshness machinery whose entire point was retiring luck.

The rule: one referent, one custodian. When two brains hold the same referent, exactly one holds the full-fidelity version and does the re-truing. Every other copy is a projection, and it says so: a custody field in its frontmatter, and a one-character mark against its line in the index. The mark means the full truth lives next door; go there before trusting depth here. A projection is never re-trued locally against evidence. Corrections flow from the custodian outward, so the mirrors cannot silently diverge, and a reader (human or agent) sees the mark before spending a single token of trust. Assignment follows use: a fact homes with the personal hub by default, and homes with the business when staff need it or when the business's watched feeds are what keep it true.

This is where we part ways with OKF v0.1 most sharply. OKF interchange ships bundles: tarball copies of knowledge passed between systems. Photocopies. A copy without custody starts rotting the moment it arrives, because nothing upstream owes it corrections and nothing downstream knows to distrust it. Interchange without custody isn't sharing knowledge; it's spreading the disease with better tooling. (An OKF-shaped export as a deliberately lossy projection for outside consumers is fine, provided everyone knows they're holding a photocopy.)

Scar four: law drifts too

We assumed the rule layer would be the stable part. Facts churn, norms hold still. Wrong. With two brains, the rules themselves forked four times in two days, each fork caught by hand, each a rule amended on one side and not the other. The fourth fork, in a detail we would find funnier if it hadn't happened to us, was the custody rule itself. The law that exists to stop copies drifting had drifted.

Hand-catching is not a plan, so law got the same treatment as facts: a daily automated diff between the two brains' rule layers. The first run taught us to normalise before comparing; of the differences it surfaced, 26 files were byte noise from porting and 22 were real forks.

The diff is mechanical. What happens next deliberately is not. We split law into two classes with different disciplines. System law is the machinery-keeping layer: freshness ownership, custody, naming, schema. It targets 100% convergence between brains, because the machinery is portable even where the worlds are not; a divergence is either pending adoption or a named structural exception, recorded in a ledger with a reason and a review trigger. An unexplained system-law divergence is a defect, and the tooling says so. World law is the rules of the mapped worlds themselves (filing standards, house practice), and gets no convergence target at all: different worlds legitimately run different rules, and where both brains carry the same world rule, it follows custody like any other fact.

Three disciplines govern the sync. Law never auto-copies: detection is mechanical, adoption is a deliberate act by the adopting side, every time. Proposals carry the scar, not just the diff: whoever adopts a rule change judges it with the lesson that produced it, not a bare textual delta. And adoption records lineage: the adopted rule notes where and when it came from, so each brain's history stays its own, and declining with reasons is a legitimate outcome that gets recorded rather than treated as a sync failure.

What this buys, concretely

An index that prices trust before you pay for it. One character against each line tells a reader what a fact costs to trust (a projection mark, a money mark, a staleness flag) before it is loaded into a context window. Agents budget their scepticism from the index instead of discovering problems mid-answer.

Agents that verify instead of confidently lying. A stale fact carrying a recheck route triggers the check at the moment of use. The failure mode shifts from wrong answer delivered smoothly to right answer delivered slightly slower, which is a trade every operator we've met will take.

Corrections that propagate instead of stranding. Fix the custodian and the projections follow. The hand-carried term sheet class of error is now structural rather than dependent on someone remembering what they fixed where.

A system that audits its own steward. The calibration ledger doesn't only log the agents' misses. It logged us, the stewards, reading a slow background job as a dead one and nearly killing work that was quietly finishing, and the miss became a rule, and the rule became tooling. A memory system that cannot record its operators being wrong will flatter everyone and sharpen no one.

Background work under the same discipline. Nothing runs merely because it is time to run. Workers draw from pools of actual waiting work, every run logs an outcome including its own death, and a worker that finds nothing for long enough proposes its own retirement. The hygiene rules for the world model turned out to generalise to the automation around it.

The honest costs

The gates feel like bureaucracy until the first silent clobber; after that they feel cheap. But they are a real tax. Naming a freshness owner on every write slows writing. Lint blocks commits people wanted to make. The fair comparison is not against a world without the tax. It's against paying at read time instead, at the worst possible moment, in front of a counterparty.

Two brains cost genuine coordination. The daily law diff, the custody calls, the divergence ledger, the doorway conventions between trees: none of it is free and none of it is glamorous. Federate only when a hard wall (privacy, staff visibility, a client boundary) forces you to, and treat every additional brain as a standing liability you chose on purpose.

The debt is visible, which is better than invisible, and still debt. At one point more than a thousand facts sat with owners declared but no watchers built yet; through that window, runtime verification was the only thing standing between a clean-looking fact and a wrong act. The unowned list never reads well. It isn't supposed to.

And none of this is a product you can download. The tooling is genuinely small: a linter, an index builder, a diff job, a couple of append-only ledgers. A competent team could build the lot in weeks. The hard part is the discipline the tooling enforces: naming the owner at write time, refusing to copy what you can reference, walking the neighbours before concluding from silence, letting a ledger record that you were wrong. A discipline with tooling. Not a tool.

If this sounds like your stack

We now run this as a practice, on a live system answering to a real operator with real money in motion, and it has been the difference between agents that sound right and agents that are right. If your team's agent memory is rotting (CLAUDE.md sprawl, a wiki nobody trusts, a RAG index that re-derives and never learns), we run an automated audit of your agent-knowledge estate against this playbook: findings, failure classes, and a restructure plan. Details: offer.html.

See the audit offer