Branch your AI's memory in half a millisecond. Roll back in the same.

AI agents don't just think — they remember. They store facts, embeddings, conversation history, and learned context in a memory store they read from and write to constantly. When you run many agents at once, or let one agent explore a risky path, that memory becomes a liability.

Picture a customer-service platform running a thousand users simultaneously. The naive approach: give each user's agent its own full copy of your knowledge base. A 10 MB base becomes 9.69 GB of duplicated data — and every time you want to personalise, experiment, or isolate one user from another, you pay that cost again. Disk, RAM, and time, multiplied by headcount.

Now picture an agent that ingests a document that turns out to be malicious — poisoned data designed to corrupt its answers. Or one that confidently 'hallucinates' a fact into its memory mid-task. The standard recovery: roll back to a snapshot. But snapshots are full copies too, taken periodically, so you replay everything since the last one. The blast radius of one bad ingest is measured in minutes of lost work and gigabytes of wasted I/O.

The root cause is that memory stores have always been treated as monolithic blobs. Copy the whole thing to branch it. Restore the whole thing to fix it. There has been no equivalent of the lightweight, delta-based branching that software developers have used for decades to work in parallel without stepping on each other.

The problem

agenticow is a Node.js library that wraps a vector store (a database of numbers that represent meaning, used by AI systems to find relevant memories) with copy-on-write branching. A branch records only what changed, not the whole base.

You open a base memory file, call fork(), and get back an independent workspace. That workspace shares the base's data by reference — reads fall through to the parent automatically — but any writes land only in the branch's private delta. The base is never touched. Promote a branch to merge its delta up; discard it to make it disappear without a trace.

The result is that 1,000 isolated agent workspaces cost 162 bytes each to create (plus their own private writes), not a full copy of the base. The benchmark on the 1,000-branch proof shows 10.5 MB total versus 9.69 GB for 1,000 full copies — 943× less disk.

The big idea

Git didn't make developers write better code. It let thousands of them work concurrently, isolate mistakes, and roll back — without coordinating every keystroke. agenticow is the same shape, applied to AI memory.

The insight is that you don't need to save the whole state to be safe — you only need to record what changed. A branch that holds only its delta is free to create, free to discard, and costs nothing to the base when it goes wrong. That makes 'try something risky in isolation' the default move, not a special expensive operation.

This reframes how you build with AI agents: instead of one careful agent doing one careful thing, you can spawn many cheap agents in parallel branches, score their outputs, and promote only the winner. The losers vanish. The base never saw them. The data from a head-to-head scaffolding experiment backs this up: the win is in more independent attempts, not in making any single attempt smarter.

The aha

Safety isn't a snapshot you take before the disaster — it's a branch you were already in.

Under the hood, agenticow stores vectors — fixed-length arrays of numbers that encode meaning — in a file format called RVF (a 384-dimensional indexed knowledge base). A fork() call creates a child descriptor that points at the parent's data on disk without copying it.

Reads in a branch use a 'read-through' strategy: the branch checks its own delta first; if the vector isn't there, it falls through to the parent. This means queries always return the correct merged view — child edits win over parent data — without any data duplication. The benchmark shows read-through queries at ~133 µs (microseconds) at k=10.

Writes go into a compact delta structure stored separately from the base. A checkpoint is just a snapshot of that delta at a point in time — 162 bytes at creation, growing only with actual edits. Rolling back replays the delta in reverse; promoting replays it forward into the parent. Both are sub-millisecond operations because they operate on deltas, not full indexes.

The COW (copy-on-write) layer also tracks tombstones — markers that say 'this vector from the parent is deleted in this branch' — so a branch can hide or override parent data without touching the parent. This is what makes the rollback-quarantine and red-team-sandbox patterns work: the base's 2,000 or 3,000 trusted vectors are never written to, no matter what the branch ingests.

Architecture

Data flow

Three patterns that are runnable today, each with a working example file in the repo.

In the real world

Prerequisites: Node.js (the JavaScript runtime) installed on your machine. No other setup. The examples import directly from the repo source, so you get working output immediately.

npm install agenticow

1. Install the package. Run npm install agenticow in your project directory. If you're using the MetaHarness agent ecosystem, the combined install is npm install @metaharness/jujutsu agenticow agentic-jujutsu.
2. Clone the repo and run all examples at once. From the cloned repo root, run npm run examples. This executes every core example — personalization, rollback-quarantine, checkpointing, git-workflow, A/B branches, and parallel agents — in sequence.
3. Or run a single example to see one pattern clearly. Try node examples/rollback-quarantine.mjs. You will see output confirming: base starts at 2,000 trusted vectors; 100 unvetted vectors are ingested into a sandbox branch; querying near the poison vector finds it in the branch; discarding the branch takes ~0.26 ms; querying the base confirms the poison is gone and all 2,000 original vectors are intact.
4. Try the 1,000-branch scale proof. Run npm run acceptance. This forks 1,000 isolated tenant branches, runs the cross-tenant isolation oracle (200 random probes), and reports per-tenant storage. You will see the total footprint and confirmation that no tenant's private data leaked into another's query results.
5. What you have at the end. A working local copy demonstrating branching, rollback, promotion, checkpointing, and multi-tenant isolation — all against the published API (open, fork, ingest, query, promote, rollback). Your next step: swap ../src/index.js imports for agenticow and wire a branch into your own agent's memory path.

The complete agenticow knowledge base: 97 passages, 24 public API symbols, and all example patterns indexed and ready to query. Useful for building tooling on top of agenticow or doing a deep audit of the API surface.