ElephantBroker: Cognitive Runtime for LLM Agents

• ElephantBroker is a knowledge-grounded cognitive runtime that integrates a Neo4j property graph with a Qdrant vector store to deliver verifiable memory for LLM agents.
• It implements a full cognitive loop—including storage, hybrid retrieval, eleven-dimension scoring, and layered safety measures—to ensure factual provenance and secure operations.
• Its modular, multi-tenant architecture with fine-grained authority control and comprehensive validation enables robust, enterprise-grade deployments in safety-critical environments.

ElephantBroker is a knowledge-grounded cognitive runtime for LLM agents that integrates a Neo4j property graph with a Qdrant vector store via the Cognee SDK to deliver provably grounded, durable, and verifiable memory. It supports a full cognitive loop—comprising storage, hybrid retrieval, multidimensional scoring, context assembly, safety enforcement, and continuous learning—enabling LLM-based agents to operate in safety-critical and multi-turn settings where factual provenance and trustworthiness are paramount. The runtime implements multi-source retrieval, eleven-dimension competitive scoring, a layered safety architecture, dynamic context lifecycles, and fine-grained authority control, with a modular, multi-tenant design suitable for enterprise-grade deployments (Lupascu et al., 26 Mar 2026).

1. Architecture and Data Flow

ElephantBroker’s architecture is partitioned into four logical layers optimized for clarity of control, separation of concerns, and operational auditability:

• Layer A (Agent Integration): Lightweight TypeScript plugins for OpenClaw expose 24 tools for agent memory operations, goal and procedure management, guard inspection, and lifecycle hooks.
• Layer B (Cognitive Runtime): A Python/FastAPI service encapsulating 17 core modules, including actor registry, goal management, retrieval orchestration, working-set/context assembly, guard and consolidation engines, and trace ledgers.
• Layer C (Knowledge Plane): Cognee SDK’s DataPoint abstraction enables atomic dual-writes into Neo4j (property graph) and Qdrant (vector store), with automated graph–vector enrichment for bidirectional enhancement.
• Layer D (Infra Services): Infrastructure support via Neo4j, Qdrant, Redis (cache, goal management), and observability through OpenTelemetry and Prometheus.

Data flow ensures transactional consistency between knowledge modalities: the Store operation on a fact $f$ effects simultaneous creation/merge in the graph $\mathcal{G}$ and indexing in the vector space $\mathcal{V}$, such that for all $f$, $(\mathcal{G}, \mathcal{V}) \models f$. Distributed trace propagation supports debugging and auditing across the complete data path.

2. Cognitive Loop Components

The cognitive loop in ElephantBroker comprises six canonical stages, each supporting auditable operations and durable memory with tracked provenance:

1. Store: Persists typed fact assertions (text, category, actors, goals, confidence), deduplicates with cosine similarity, merges by ID in Neo4j, indexes in Qdrant, maintains provenance edges, and triggers Cognee-based enrichment.
2. Retrieve: Recalls candidate facts from a five-source hybrid pipeline (structural, keyword, semantic, graph-expansion, artifact) using concurrent querying and configurable weighting.
3. Score: Ranks and selects a context working set under strict token budgets, using an eleven-dimension competitive scoring engine and a greedy (submodular) selection algorithm.
4. Compose: Assembles LLM prompt surfaces partitioned into four contextually structured blocks (constraints/proofs, goals, working-memory facts, and evidence references), with compaction hooks for memory optimization.
5. Protect: Enforces safety before/during agent actions by means of a six-layer guard pipeline and a multi-stage AI firewall that physically intercepts tool calls and scans all agent inputs/outputs.
6. Learn: Consolidates memory through a nine-stage process of clustering, canonicalization, strengthening, decay, pruning, episodic–semantic promotion, procedure refinement, verification gap detection, and salience adjustment.

3. Retrieval, Scoring, and Context Assembly

The hybrid five-source retrieval pipeline operationalizes $f(\alpha) = \sigma(\rho(\phi(\alpha)))$, where $\phi$ is the concurrent multi-source search, $\rho$ is a four-stage rerank, and $\sigma$ handles scoring and budgeted context selection. The component sources and their associated weights include:

Source	Mechanism/theme	Weight ($w$)
Structural	Neo4j Cypher	0.4
Keyword	BM25 lexical chunk	0.3
Semantic	Qdrant embeddings	0.5
Graph-Expansion	Ego-net traversal	0.2
Artifact	Tool-output summary	0.5

Candidates are merged per $\mathcal{G}$0 via $\mathcal{G}$1, de-duplicated by ID, sorted, and capped at $\mathcal{G}$2.

The eleven-dimension scoring framework considers independent and interaction effects:

• Pass 1: Turn relevance, (session/global) goal alignment, recency (exponential decay), successful-use prior, confidence (adjusted by evidence state $\mathcal{G}$3), evidence strength, novelty, and cost penalty.
• Pass 2: Redundancy and contradiction penalties engaged during greedy context working-set assembly, targeting budget-constrained maximal relevance with a $\mathcal{G}$4 approximation guarantee.

Mandatory items (constraints, proof steps) bypass budget limits.

4. Evidence Verification, Safety Controls, and Guard Pipelines

Fact confidence is dynamically regulated through a four-state evidence verification model with associated $\mathcal{G}$5 multipliers: Unverified (0.5), Self-Supported (0.7), Tool-Supported (0.9), and Supervisor-Verified (1.0), with explicit rejection transitions. These states inform scoring and access controls.

A six-layer “cheap first” guard pipeline mediates action execution safety:

• Layer 0: Domain classification mapping actions to policy escalation requirements (AUTONOMOUS→INFORM→APPROVE_FIRST→HARD_STOP).
• Layer 1: Static rule matching by keyword/regex/tool.
• Layer 2: Semantic match (BM25 + cosine) against bad exemplars.
• Layer 3: Structural validation with graph queries for approvals/evidence.
• Layer 4: Constraint reinjection into prompt context.
• Layer 5: LLM escalation for ambiguous edge cases.

The AI Firewall implements a physically enforced dual guardrail: agent hooks intercept tool calls for hold/block (<5 ms verdict), proxy APIs pre/post scan LLM IO, and SDK in-process enforcement. Six-tier IO scanning (regex, heuristics, fine-tuned classifiers, declarative validators, dialog rails, canary tokens) supports defense-in-depth.

5. Context Lifecycle and Memory Consolidation

The five-stage per-turn lifecycle ensures dynamic adaptation of agent context:

1. Bootstrap: Resolves profile, registers actors, loads goals, initializes context.
2. Ingest: Extracts turn facts via LLM, summarizes artifacts, suggests goals, manages supersession/contradiction edges.
3. Assemble: Full retrieve-rerank-score pipeline, guard preflight, four-block context injection, placeholder compaction.
4. Compact: Tag-based (DROP/COMPRESS/PRESERVE) and LLM-based (summary COMPRESS) context reduction.
5. After-Turn: Detects successful-use signals (DirectQuote, ToolCorrelation, GoalMention), updates statistics.

Idle-time nine-stage consolidation clusters near-duplicates, canonicalizes facts, strengthens through use statistics, decays unused facts, blacklists low-signal auto-recalls, promotes recurring facts from episodic to semantic, refines procedures via repeated step detection and SOP proposal, checks verification gaps, and adjusts salience exponential moving averages (±5% cap).

6. Authority Model, Access Control, and Multi-Tenancy

Identity and authority are structured by a three-level model: Gateway ID (isolation), Agent UUID (v5), and Session UUID, with optional org/team IDs. Authority is numerically stratified:

Level	Description
0–49	Regular actors
50–69	Team leads
70–89	Org admins
≥90	System admins

Authority rules (action, min_level, exempt_level) are persisted in SQLite, enforcing action-specific minima with Unix-style exemptions (e.g., org-admin can bypass team check). Supervisor approvals are recorded as Supervisor-Verified evidence, tightening provenance and oversight. Multi-gateway isolation and org/team overrides (graph-stored) facilitate robust separation in multi-tenant environments.

7. Validation, Deployment, Profiles, and Oversight

Extensive validation (>2,200 unit, integration, and end-to-end tests) attests to correctness in retrieval, scoring, evidence management, guard/firewall logic, and integration across TypeScript/Python, including trace propagation. Deployment supports three tiers (memory-only, context-only, full cognitive runtime), and five profile presets (coding, research, managerial, worker, personal) parameterize retrieval/scoring weights, half-lives, budgets, and policies for tailored operation.

A management dashboard provides actionable oversight (memory explorer, guard event review, approval queues, Prometheus metrics, queryable traces), supporting human-in-the-loop governance and forensic auditing. Gateway isolation mechanisms, coupled with strict config inheritance and override protocols, ensure security and operational hygiene at scale.

---

ElephantBroker thus establishes a verification-aware cognitive substrate for LLM-based agent architectures, delivering hybrid retrieval, multi-dimensional scoring, evidence tracking, layered safety, dynamic contextualization, continuous consolidation, and numeric authority—enabling robust, trustworthy, and auditable operation in high-stakes, multi-organization contexts (Lupascu et al., 26 Mar 2026). Key applications encompass memory-durable customer support agents, research assistants requiring verifiable citations, compliance-driven automation, and any multi-agent workflow where provenance, context, and safety are operationally critical.