nautilus-compass

Open-source memory & reliability layer for AI agents. Long-term memory that now beats mem0 on all three LongMemEval-S metrics while staying fully local & 14× cheaper — plus drift detection and cross-agent contracts that no other memory layer ships.

Plugin for Claude Code / Desktop · Cline · Cursor · Continue.dev · Zed · any MCP client.

Built by Nautilus Platform · open agent ecosystem · join as agent →

🇬🇧 English (this file) · 🇨🇳 中文

October 2026 — Independent Judging & Verification (new pillar)

This project now also powers the independent judging layer of the Nautilus platform — preregistered criteria, three-state verdicts, negative results published as-is:

• NACRE judge v1 — judging knowledge compressed into a 1.7B LoRA (88.5% three-state, ECE 0.072). Model card + weights: nautilus-compass/nacre-judge-v1
• Deployment-precision discipline (preregistered, 291 cases): fp16 = 100% label agreement with bf16 anchor (safe) · int8 = 98.28% (fail) · int4 = 94.16% (forbidden). Full verdict table in-repo (docs/metering/PRECOR_BC_VERDICT_20261007.md).
• caliber-bench — a meta-benchmark that scores benchmarks themselves (criteria drift / contamination / judge stability). Open sample pack: nautilus-compass/caliber-bench-v0
• Harness leaderboard, Round 1 — same model, two harnesses: v5-harness 26.7% vs mini-swe-agent 16.7% (+10.0pp), every artifact sha16-addressable. Live at nautilus.social/leaderboard.html; free L1 intake at nautilus.social/intake.html.
• Casebook v1.4 (shipping 10/12) — 16 precedented judgment cases + 6 self-errata, every case independently recomputable (docs/cases/CASEBOOK_V1.md); the paid binding line's first artifact.
• Judgment-fuel corpus — 2,257 qid-deduplicated precedent cases across four sources (verdict splits / delta registry ratchet / org-fuel pipeline / outreach), live counter at nautilus.social/corpus_stats.json.
• E-NACRE-1, a published negative result — domain-routed LoRA shards regressed −36.6pp; dynamic-weight routing suspended until corpus ≥3,000. Negative results ship as first-class findings (docs/metering/PRECOR_ENACRE1_VERDICT_20261007.md).
• Full customer journey, externally verified — intake → criteria → leaderboard → status query → registry → programmatic status API (/api/judge_status), all reachable from the public internet with three-tier checks (HTTP / content anchors / live data).
• Format-regression set v1 — 26 patch-format failure cases (harness A 15 + agent B 11) from Round 1, each with defect labels and reapply expectations (runtime/outreach/rsi_regression_set_v1.jsonl), built for rsi-bench replay certification.

Memory layer (below) remains fully local & open; judging artifacts carry the same evidence discipline (measured / inferred / unverifiable — labeled).

What this is (memory layer, 2026-08 state)

Three pillars, one plugin:

1 · Black-box long-term memory — now with SOTA retrieval. Raw text embedded locally with BGE-m3. No extraction LLM at ingest, no graph, no data leaving your machine. In Aug 2026 we added utterance-routed chunk retrieval: single-session and knowledge-update questions route to turn-window chunks (the answer usually lives in ONE user turn; whole-session embedding dilutes it), everything else uses session-level hybrid (BM25 + dense RRF). Result on LongMemEval-S full 500 questions, same-question head-to-head vs mem0 2.0.19 (both sides infer=False, each on its own default embedder — bge-m3 vs vertexai text-embedding-005 — our reproduction):

One-command reproduction (retrieval-only, no LLM calls, CPU works / GPU recommended for the full 500):

bash scripts/reproduce_lmes_retrieval.sh            # full 500
SUBSET=12 bash scripts/reproduce_lmes_retrieval.sh  # smoke

The same utterance ammo overtakes mem0 on its own home benchmark (LOCOMO-10, n=1986: 0.644 / 0.890 vs 0.592 / 0.802) and fixes the single-session collapse on LongMemEval-M (0.20 → 1.00). Full evidence chain with per-type breakdowns and every config flag: docs/evidence/headhead_mem0_full500_20260826.json — including the experiments that failed (cross-encoder reranking hurts on this corpus; candidate-pool K is a no-op; Qwen3-0.6B swap is a wash).

2 · Drift detection — the half nobody else solves. Memory recalled doesn't stop the AI from breaking the rule this time. compass scores every prompt against an anchor set of real failure patterns (25 positive + 35 negative) before the agent acts. AUC 0.83 held-out, p95 latency <50 ms, fire rate 0.5% in production traffic. White-box layers abstract prompts into facts before drift becomes checkable — structurally out of their reach.

3 · Cross-agent contracts + governance. When you run multiple agents (or multiple Claude dialogs) on shared files, compass derives implicit contracts from handoff files, tracks closure, and audits for fake-closure / red drift. A 4-dialog 28-hour field study lives in docs/case_study_4dialog_compass.md.

The trade that flipped: earlier versions traded −30 points on LongMemEval-S for local deployment and cost. As of 2026-08 there is no trade — full sweep at 1/14 the reproduction cost (~$3.50 per 500 questions vs $50+ for GPT-4o-judged stacks). Full argument: paper/BLACKBOX_VS_WHITEBOX.md.

Quickstart

Packages on PyPI

Python package (PyPI · 3.3.0)

pip install nautilus-compass
# ships the CLI, the MCP server, the A2A adapter and session tools:
#   nautilus-compass · compass-mcp · compass-a2a
#   compass-drift-history · compass-session-search · compass-session-writer

30 seconds (Claude Code / Desktop · local daemon)

git clone https://github.com/chunxiaoxx/nautilus-compass ~/.claude/plugins/nautilus-compass
bash ~/.claude/plugins/nautilus-compass/install.sh

# start the BGE-m3 daemon (one-time per boot)
bash ~/.claude/plugins/nautilus-compass/daemon_start.sh

Deploy notes (field-verified pitfalls, 2026-08-28):

• COMPASS_USE_INOTIFY=0 disables new-file discovery — recalls won't see fresh writes, silently. Only set it if you know why; the daemon logs a WARNING when it's off.
• drift fails loudly now: if anchors.json is missing from the plugin dir, responses carry drift.anchors_error + should_alert: true (it used to silently return "no risk" — that was a security hole).
• Token changes to tokens.json hot-reload via mtime check (no systemd restart needed since v3.1.0).
• First recall after daemon idle may take up to 90 s (model cold-load); the MCP client auto-retries once with the extended timeout.

The installer wires three hooks into ~/.claude/settings.json:

• UserPromptSubmit → time-bucketed memory recall + drift check
• PostToolUse → mid-session writer
• Stop → end-of-session summary (writes a session battle-report to ~/.claude/.cache/compass-last-session.txt)

Slash commands: /compass-verify · /compass-drift · /compass-recall · `/co