Reckon, how your memory matures

An offline reasoning pass over your whole store that proposes improvements. It never writes canon itself.

Status: roadmap. Reckon is on the roadmap, not shipped. This page describes the planned design so you can evaluate it. The reactive Instinct loop it builds on (capture, govern, gate) is live today.

Instinct learns from failures your fleet actually hits, so the same failure never bites twice. That is reactive: it only ever knows what a literal failure taught it. Two questions a reactive store cannot answer on its own:

What about the dangerous command your store has never seen, so it does not know it is missing?
What stops learned rules, and gathered facts, from rotting: piling up, over-firing on safe commands, going stale, or contradicting each other?

Reckon is the answer. It is an offline reasoning pass that reads your whole store (the facts you have gathered, the guardrails you have learned, and the writes still waiting in the queue) plus what your fleet actually does, then proposes how the store should improve. It does not write anything itself. Every proposal goes through the same governed curation path as any other write.

Reckon is the middle motion of the system: Gather takes memory in, Reckon reasons over it, Instinct enforces what matters. It is a peer of Instinct and Tribe, not a maintenance job bolted onto guardrails.

The one rule that makes it safe

Reckon reads, reasons, and proposes. It never commits. A proposal becomes canon only after the same screen, judge, and curator gate that governs every write in Hunta admits it.

The writer never decides. Reckon never decides.

The industry has coalesced around this idea and calls it "dreaming": a model reasons over its own memory and writes it back autonomously. That self-write path is an injection surface, a legitimate agent reads poisoned content and commits it as trusted memory. We call it reckoning, and ours only ever proposes, so a wrong reasoning pass is a rejected candidate, not a poisoned store. Governed reasoning, not self-editing.

What it reasons out

Each pass reads the store and real activity and emits governed candidates. Nothing is applied without a curator.

Pass	What it finds	What it proposes
Coverage gaps	a dangerous command form the store fails to catch	a tightened rule, or a new one
Over-firing	a rule that blocks safe, legitimate commands	a narrower rule
Generalise	many near-duplicate rules or facts one entry would cover	a single generalised entry, superseding the duplicates
Consolidate	stale, redundant, or superseded rules and facts	merges, supersessions, and removals
New lessons	failures that recur but were never captured	a new rule

A worked example we ran by hand: reasoning over real command activity, we found that a keyless SSH to a protected host written in bare-host form slipped a rule that only recognised the user@host form. That is a coverage gap: a dangerous command the store was silently missing. Reckon automates exactly this class of reasoning and routes the fix through curation instead of an engineer editing code.

How it fits the pipeline

Reckon adds a reasoning pass on top of the existing write path. It introduces no new store and no new trusted-write path.

  Gather store (facts, guardrails, queue)  +  fleet activity     (read only)
          |
          v
   Reckon pass  (offline reasoning)                              (the only new step)
          |  emits a signed batch of PROPOSALS
          v
   curation gate: screen -> judge -> curator admits   (existing, unchanged)
          |
          v
   sealed entry  ->  deterministic gate at the point of risk

Determinism stays in the gate. The reasoning stays on the proposal side, where a wrong idea is caught by the same gate that catches a poisoned write.

Stronger across a fleet

Reckon compounds on a shared store (Tribe). When a fleet of agents works in one environment, each hits failures alone. With a shared store plus Reckon, one agent's hard-won lesson, matured and admitted, becomes the whole fleet's reflex. The store gets more valuable as the fleet grows, because every member both contributes lessons and inherits the matured ones. On a shared store the curator is the owner and delegated curators, so no member can seal a change to the shared canon.

Tribe is the fact that the store is shared. Reckon is the motion that matures the shared store.

How Reckon goes live for your store

Reckon is switched on per store, by its owner, and it earns the Live label per store. Here is exactly what happens, so you can judge it before you rely on it.

Enable. The owner turns Reckon on in the console (Reckon page, Enable Reckon). Nothing changes in your canon at that moment. From then on a nightly pass reads your whole store and files its proposals into your curation queue, marked as authored by Reckon.
Curate. Your curators admit or reject each proposal in the console. A merge is admitted by composing the single rule that replaces the sources; the sources are retired with the audit trail intact. A rejected proposal is kept as a record and will not be re-proposed. Proposals that nobody curates expire after 14 days and count for nothing. Reckon is never given the pen: it cannot admit, promote, or seal.
Measure. The console shows Reckon's precision for your store: admitted divided by admitted plus rejected, over Reckon's own proposals only. It shows the 95 percent Wilson lower bound rather than the raw ratio, so a lucky three out of three reads as its confidence floor, not as 100 percent.
Live. Your store's Reckon reads Live when its gate passes: at least 20 curated proposals, a Wilson lower bound of at least 0.70, every lane at or above 0.50, and curation spread over at least two days. The owner can raise these thresholds for their store, never lower them below the defaults. Until then the page reads Planned or Calibrating, and that is what we say about it too.

What Reckon reads and what it can touch is fixed by its identity: it holds a proposer token that can only file candidates into your queue. It reasons within your store only; a shared store is reasoned over as its own tenant.

Status and honesty

Reckon is planned. The reactive loop it extends is live. We will not describe it as shipped until it ships. If you are running a production agent fleet and rule maintenance, coverage gaps, or sharing lessons across agents is a real problem for you today, tell us: that is the signal that moves this from roadmap to build.