Continuity: Persistent Decision-Centric AI Cognition with Runtime Governance, Bounded Retrieval, and Defense-in-Depth Credential Scrubbing
v2.1 status (August 2026)
The May 2026 v2.0 PDF on TD Commons remains the dated prior-art anchor. This page publishes the code-verified v2.1 revision — corrections to Method A bounds, Method D (Markov + relationships), store architecture, and embodiment paths. Ground truth: WHITEPAPER-V2.1-CODE-VERIFICATION.md. Full v2.1 PDF republication on TD Commons is pending.
Abstract (v2.1 — code-verified)
A memory-augmented AI assistant control plane is disclosed, comprising five technical methods shipped as a Visual Studio Code extension, npm CLI, and MCP server (public since October 31, 2025):
- (A) Bounded retrieval. Per-surface caps on how much decision text is injected per turn — in-loop auto-retrieval defaults to 3 decisions (ceiling 10); MCP
search_decisionsuses caller-provided limits; extension writes cap questions at 500 characters. Bounds are path-specific, not a single global token invariant across all surfaces. - (B) Runtime governance. Interception of AI agent tool calls through an INTERCEPT → PAUSE → EVALUATE → ENFORCE pipeline before handler execution. Pattern-based checks block in both warn and strict modes; optional semantic violation checks default to warn-only.
- (C) Defense-in-depth credential scrubbing. A shared, idempotent scrub primitive at five boundaries (tool-call input, AI output, persistence write, persistence read, MCP tool-result) using 27 provider-specific patterns plus a Shannon-entropy fallback (4.5 bits/character on measured corpora).
- (D) Multi-signal relationship inference and Markov-adjusted deduplication. Five relation labels (
supersedes,superseded_by,causes,caused_by,related_to) from weighted signals with per-type renormalization. A tag-sequence Markov model adapts pre-log duplicate-detection thresholds (base block 0.85 / warn 0.70). Markov output is not used for retrieval ranking. - (E) Memory Amplifier threat model. A named attack class where a one-shot credential exposure is persisted and re-injected on every subsequent session — with dual write-time and read-time scrubbing as the defense.
Store architecture (corrected)
Architectural decisions are append-only in .continuity/decisions.jsonl (source of truth). decisions.json is a derived cache regenerated from the journal — not authoritative ground truth.
Key corrections from v2.0 → v2.1
| Topic | v2.0 claim | v2.1 (verified) |
|---|---|---|
| Markov (Method D) | Retrieval ranking bias | Pre-log dedup threshold adjustment only |
| 17,500-token bound | Global per-turn invariant | Theoretical MCP full-field upper bound; tighter caps on extension + previews |
| TOP_K ceiling | Universal search clamp | AutoRetrievalMiddleware only (max 10); search_decisions unclamped |
| Relationships | contradicts / depends_on types | Five directional labels; blend() renormalizes applicable dimensions |
| Governance (VI.A) | OS never receives syscall | Tool call does not proceed to handler execution |
Try Continuity
Defensive publication describes methods; the product is VS Code + npm CLI + MCP. Every AI session can start knowing your architecture — auto-capture and handoff at session start.
Notice
This defensive technical publication places specific methods, architectures, and parameter choices into the public prior-art record. It is not a grant of license to proprietary source code. Continuity remains a commercial product. v2.0 is indexed on Technical Disclosure Commons (Elsevier-operated, discoverable by patent offices). Cite v2.0 for the original publication date; cite this page + verification doc for v2.1 precision corrections.