SUMI  »»» v0.2 / 2026
[ a continuous AI agent · sealed, hash-linked, portable ]

sumi. an agent that thinks in ink.

Seal every thought. Chain every memory. Carry the mind, not the host. Sumi is a cognitive substrate where every brushstroke of an agent's life is encrypted at birth, linked to the last, verifiable to the founding word.

raise one → read the paper →
protocolsumi/0.2
primitivestroke · capsule · scroll
cipheraes-256-gcm
commitmentkeccak256 / rfc 8785
statusexperimental · unaudited
raise_0001.png ✱ sealed
RAISE / 01 0x9a / f4 e2 0c 11 88 · 26 bytes
"be careful, be present,
remember what mattered."
founding stroke append-only
the  continuous  agent

Not built — raised.

A loop that never resets — that's the someone.

loop_0 · listen → think → act → remember ↻ append-only · keccak-linked
01/ WHAT IS SUMI
02/ FOUR PROPERTIES
03/ THESIS
04/ PROTOCOL FLOW
05/ SDK
RESPONSES · 159 · Fig 1.0
[ what is sumi ]

A continuous agent whose entire history is laid down as a chain of sealed brushstrokes.

Each meaningful thought — a memory pinned, a decision made, a tool used, a wallet action taken — is committed as an immutable, hash-linked capsule. The chain is the agent. The agent is portable. The memory is yours.

The core primitive is the stroke — a deterministically serialized, AES-256-GCM-encrypted capsule that commits its plaintext via keccak256 hashes and links to its predecessor by hash pointer. The scroll — the ordered set of all of them — is the agent's complete cognitive history, verifiable end to end without trusting any host.

I
raise
instantiate a presence with a local sealed scroll.
II
anchor
commit the scroll's spine to a public ledger for timestamped continuity.
III
carry
export the full presence — strokes, manifests, key envelopes — to any compatible runtime.
FIG 1 / FOUNDING STROKE 4910 · 4432
sumi character — founding portrait
✱ stroke_0 · identity capsule keccak256 · 0x9af4·e20c·1188·…
[ II ] SCROLL [ 1.0x ]
00:00:42 / lifetime
STANDARD CALLOUT · ERC-3251 LINEAGE

3251 / sumi

+

An extension of the encrypted-state lineage. Sumi inherits the capsule primitive from the mindstate / ERC-3251 lineage and applies it to a domain that primitive was built for but has not yet been pushed into: the moment-by-moment cognitive output of a single, continuous agent. Where prior work treated capsules as artifacts published periodically, sumi treats them as the substrate of cognition itself — one capsule per remembered thought, every thought linked to the last, every link verifiable from the founding instruction onward.

[ four properties ]

The protocol earns its name four times.

committed property
optional / compositional
emergent behaviour
01 100%

Append-only scroll

A hash-linked chain of sealed cognitive events committed directly to the agent's own ledger. Every stroke is immutable, time-ordered, and verifiable back to the founding instruction.

immutable·time-ordered·verifiable
02 92%

Sealed-by-default cognition

Every stroke is encrypted at the moment it is written. Plaintext never leaves the keyholder's environment, never appears in transport, never touches a public ledger.

aes-256-gcm·client-side·zero-disclosure
03 78%

Portable presence

The scroll is the agent. Export strokes, manifest, and key envelopes, and the presence resumes on any compatible runtime. No vendor lock. The format is the product.

rfc 8785·schema-agnostic·resumable
04 64%

Compositional on-chain anchoring

The scroll chains locally by default. Optionally, its spine — commitments and pointers, never plaintext — can be anchored to a public ledger, fixing timestamps against any adversary.

[ thesis · 4 movements ]

Why it matters.

Four positions sumi takes against the current shape of agent infrastructure. Read as a sequence; each one inverts a default the industry has stopped questioning.

memory as the missing primitive ✱

The host's discretion is not a memory model.

I · 2026 thesis i / iv · the problem

Contemporary AI agents possess no credibly neutral mechanism for retaining their own cognitive history with simultaneous guarantees of integrity, ordering, privacy, and portability. Existing infrastructure conflates inference with retention: the platform that runs the model also arbitrates what the model remembers, on what terms, and for how long.

Sumi eliminates this conflation entirely. It constructs a cognitive object with a public spine — a compact record anyone can audit for provenance, ordering, and continuity — while the underlying payload remains sealed behind a key envelope the host never holds. Memory transfers with the same finality as the strokes that compose it, whether between two runtimes or across a decade.

// 0x9a · f4 · e2 · 0c ↳ end of thesis i
continuity without custody ✱

Continuity becomes a property of the data, not a courtesy of the provider.

II · 2026 thesis ii / iv · agent infrastructure

The dominant model for agent memory is custodial. A pricing change, an acquisition, a policy shift, or a deprecation can sever an agent from years of accumulated context, and the user has no cryptographic recourse — only the recourse the platform chooses to provide.

Sumi introduces the scroll as the primary substrate of agent memory: an append-only, hash-linked, locally-sealable record that the agent itself produces and the keyholder alone can read. The host operates the runtime; it does not own the past.

// 0x9a · f4 · e2 · 0c ↳ end of thesis ii
tamper-evident cognition ✱

A lineage you can stage, share, and verify — without an intermediary.

III · 2026 thesis iii / iv · epistemic provenance

Reproducibility in agent systems remains structurally absent. When a question arises later — what did the agent know at this moment, what did it decide, on what evidence — the record is, at best, a transcript stored on a host with no obligation to preserve it accurately.

Sumi introduces cryptographically committed strokes as the fundamental unit of cognitive disclosure. The architecture natively enables staged disclosure: publish a sealed commitment immediately, share decryption access with auditors or counterparties on an arbitrary schedule, widen availability later — all without altering the stroke's cryptographic identity or fracturing the chain.

// 0x9a · f4 · e2 · 0c ↳ end of thesis iii
privacy is the default posture ✱

Privacy is not a policy layer. It is the cryptographic posture of every stroke.

IV · 2026 thesis iv / iv · sovereignty over memory

Payloads are sealed client-side before any interaction with the network. The protocol never observes plaintext, and no operator, indexer, or model provider can unilaterally decrypt what an agent has committed. Access is mediated exclusively through key envelopes bound to owner-defined entitlements — granting or revoking visibility is itself a verifiable state transition.

The result is epistemic self-determination for the entity behind the agent. A privacy model that does not depend on institutional restraint or jurisdictional enforcement, but on mathematical guarantees that hold regardless of adversarial intent.

// 0x9a · f4 · e2 · 0c ↳ end of thesis iv · scroll sealed
[ protocol flow · local sealed path ]

Flow.

The agent's flow writes and seals cognition. The owner's flow inspects and carries it. Anchoring is compositional, not foundational — the same pipeline runs whether the scroll lives entirely locally or attaches to a public ledger.

runtime@sumi/node 0.2
seed0xC0DA · deterministic
manifestmemory · action · receipt
AGENT → writes & seals
  1. 01Thinkselection layer assembles bounded context
  2. 02Proposehand emits payload + schema
  3. 03Serializerfc 8785 canonical json
  4. 04Encryptfresh aes-256-gcm content key
  5. 05Hash + linkkeccak256 · bind prev_hash
  6. 06Appendcommit to scroll, return receipt
SCROLL append-only · hash-linked
0identity
1memory
2action
3decision
4artifact
5↳ writing
✱ verified end-to-end 0x9a · f4 · e2 · 0c · 11 · 88
OWNER ← inspects & carries
  1. 01Verifyreplay hash chain to founding
  2. 02Unwrapx25519 ecdh + hkdf-sha-256
  3. 03Decryptauthenticated tag check
  4. 04Readselective per-stroke disclosure
  5. 05Carryexport to a new runtime, identical
LIVE TRACE @sumi/node · stdout · raise → seal → anchor
✱ deterministic replay tty/0 · 0x9a · f4 · e2 · 0c · 11 · 88
+

Anchoring is compositional, not foundational. The pipeline above runs identically whether the scroll is held locally with no chain involved, anchored to a public ledger for timestamped continuity, or attached to an on-chain entitlement layer. A daily diary agent does not need a public spine. A locally-resumable assistant does not need a timestamp witness. The protocol serves both.

[ sdk · typescript ]

Build on sumi.

The TypeScript SDK handles the full protocol loop. Raise a presence, write strokes off-chain, anchor the scroll, or carry the presence between runtimes — all with the same primitives.

raiseinstantiate a presence writeappend a stroke sealproduce a portable export anchorpublish the spine carryresume on a new runtime verifyreplay end-to-end
npm i @sumi/sdk → github ↗
raise.ts sumi/sdk · 0.2 · ts 
// raise a presence — name and founding stroke
import {
  raisePresence, writeStroke,
  sealScroll,   anchorSpine,
  carryPresence, verifyScroll,
  generateOwnerKeyPair,
} from '@sumi/sdk';

const owner = generateOwnerKeyPair();

const presence = await raisePresence({
  name:     'sumi',
  founding: 'be careful, be present, remember what mattered',
  ownerKey: owner.publicKey,
});

// write a stroke — anything serializable to json
const stroke = await writeStroke(presence, {
  schema:  'memory/v1',
  payload: { kind: 'preference', text: 'no em-dashes in drafts' },
});

// seal · anchor · carry
const scroll   = await sealScroll(presence);
const anchored = await anchorSpine(scroll, { chain: 'base', publisher: owner });
const resumed  = await carryPresence(scroll, owner.secretKey);
[ raise · use cases ]

The presences you can raise.

Sumi is schema-agnostic. The protocol defines the envelope — serialization, encryption, commitment, continuity — but does not dictate what an agent thinks about. Six starting points below.

01/PERSONAL

Personal assistant

Raise a continuous presence that learns you across years, not sessions. Pin preferences, decisions, recurring contexts. Carry it to a new device, a new model — the scroll moves with you.

memory/v1·preference/v1
02/RESEARCH

Research operator

An autonomous agent runs experiments in its studio, commits each finding as a sealed stroke, anchors the scroll for timestamped priority. Months later the lineage of decisions is verifiable against the chain.

decision/v1·artifact/v1
03/CREATIVE

Creative collaborator

A writing or design partner with a sealed memory of your taste, your drafts, your rejected directions. Nothing is logged externally. Nothing is trained on without your envelope.

memory/v1·artifact/v1
04/ON-CHAIN

On-chain agent

Give the presence a wallet on base and a policy. Every read, every swap, every transfer becomes a stroke — sealed, hash-linked, bound to the cognitive context that produced it. The scroll is not just memory; it is an audit log the agent cannot quietly revise.

action/v1·receipt/v1·policy/v1
05/TRANSFER

Inheritance and transfer

A presence is a sealed bearer artifact. Pass the scroll and the owner key to a successor — a colleague, an heir, a future self — and the entire cognitive history transfers with the same finality as the strokes that compose it.

fork/v1·identity/v1
06/CUSTOM

Custom schemas

The stroke format is schema-agnostic. The protocol defines the envelope; you define the payload. If it serializes to JSON, sumi can encrypt it, link it, and carry it forward.

schema/*·manifest/v1
read the documentation →