---
title: 'ElephantBroker: Cognitive Runtime for LLM Agents'
url: https://www.emergentmind.com/topics/elephantbroker
type: topic
---

# ElephantBroker: Cognitive Runtime for LLM Agents

ElephantBroker is a knowledge-grounded cognitive runtime for large language model (LLM) agents that integrates a Neo4j property graph with a Qdrant vector store via the Cognee SDK to deliver provably grounded, durable, and verifiable memory. It supports a full cognitive loop—comprising storage, hybrid retrieval, multidimensional scoring, context assembly, safety enforcement, and continuous learning—enabling LLM-based agents to operate in safety-critical and multi-turn settings where factual provenance and trustworthiness are paramount. The runtime implements multi-source retrieval, eleven-dimension competitive scoring, a layered safety architecture, dynamic context lifecycles, and fine-grained authority control, with a modular, multi-tenant design suitable for enterprise-grade deployments [2603.25097].

## 1. Architecture and Data Flow

ElephantBroker’s architecture is partitioned into four logical layers optimized for clarity of control, separation of concerns, and operational auditability:

- **Layer A (Agent Integration):** Lightweight TypeScript plugins for OpenClaw expose 24 tools for agent memory operations, goal and procedure management, guard inspection, and lifecycle hooks.
- **Layer B (Cognitive Runtime):** A Python/FastAPI service encapsulating 17 core modules, including actor registry, goal management, retrieval orchestration, working-set/context assembly, guard and consolidation engines, and trace ledgers.
- **Layer C (Knowledge Plane):** Cognee SDK’s DataPoint abstraction enables atomic dual-writes into Neo4j (property graph) and Qdrant (vector store), with automated graph–vector enrichment for bidirectional enhancement.
- **Layer D (Infra Services):** Infrastructure support via Neo4j, Qdrant, Redis (cache, goal management), and observability through OpenTelemetry and Prometheus.

Data flow ensures transactional consistency between knowledge modalities: the Store operation on a fact $f$ effects simultaneous creation/merge in the graph $\mathcal{G}$ and indexing in the vector space $\mathcal{V}$, such that for all $f$, $(\mathcal{G}, \mathcal{V}) \models f$. Distributed trace propagation supports debugging and auditing across the complete data path.

## 2. Cognitive Loop Components

The cognitive loop in ElephantBroker comprises six canonical stages, each supporting auditable operations and durable memory with tracked provenance:

1. **Store:** Persists typed fact assertions (text, category, actors, goals, confidence), deduplicates with cosine similarity, merges by ID in Neo4j, indexes in Qdrant, maintains provenance edges, and triggers Cognee-based enrichment.
2. **Retrieve:** Recalls candidate facts from a five-source hybrid pipeline (structural, keyword, semantic, graph-expansion, artifact) using concurrent querying and configurable weighting.
3. **Score:** Ranks and selects a context working set under strict token budgets, using an eleven-dimension competitive scoring engine and a greedy (submodular) selection algorithm.
4. **Compose:** Assembles LLM prompt surfaces partitioned into four contextually structured blocks (constraints/proofs, goals, working-memory facts, and evidence references), with compaction hooks for memory optimization.
5. **Protect:** Enforces safety before/during agent actions by means of a six-layer guard pipeline and a multi-stage AI firewall that physically intercepts tool calls and scans all agent inputs/outputs.
6. **Learn:** Consolidates memory through a nine-stage process of clustering, canonicalization, strengthening, decay, pruning, episodic–semantic promotion, procedure refinement, verification gap detection, and salience adjustment.

## 3. Retrieval, Scoring, and Context Assembly

The hybrid five-source retrieval pipeline operationalizes $f(\alpha) = \sigma(\rho(\phi(\alpha)))$, where $\phi$ is the concurrent multi-source search, $\rho$ is a four-stage rerank, and $\sigma$ handles scoring and budgeted context selection. The component sources and their associated weights include:

| Source                   | Mechanism/theme     | Weight ($w$)  |
|--------------------------|--------------------|---------------|
| Structural               | Neo4j Cypher       | 0.4           |
| Keyword                  | BM25 lexical chunk | 0.3           |
| Semantic                 | Qdrant embeddings  | 0.5           |
| Graph-Expansion          | Ego-net traversal  | 0.2           |
| Artifact                 | Tool-output summary| 0.5           |

Candidates are merged per $i$ via $s_i = \max_s (w_s \cdot \text{raw\_score}_s(i))$, de-duplicated by ID, sorted, and capped at $top_K$.

The eleven-dimension scoring framework considers independent and interaction effects:

- Pass 1: Turn relevance, (session/global) goal alignment, recency (exponential decay), successful-use prior, confidence (adjusted by evidence state $m_v$), evidence strength, novelty, and cost penalty.
- Pass 2: Redundancy and contradiction penalties engaged during greedy context working-set assembly, targeting budget-constrained maximal relevance with a $(1-1/e)$ approximation guarantee.

Mandatory items (constraints, proof steps) bypass budget limits.

## 4. Evidence Verification, Safety Controls, and Guard Pipelines

Fact confidence is dynamically regulated through a four-state evidence verification model with associated $m_v$ multipliers: Unverified (0.5), Self-Supported (0.7), Tool-Supported (0.9), and Supervisor-Verified (1.0), with explicit rejection transitions. These states inform scoring and access controls.

A six-layer “cheap first” guard pipeline mediates action execution safety:

- **Layer 0:** Domain classification mapping actions to policy escalation requirements (AUTONOMOUS→INFORM→APPROVE_FIRST→HARD_STOP).
- **Layer 1:** Static rule matching by keyword/regex/tool.
- **Layer 2:** Semantic match (BM25 + cosine) against bad exemplars.
- **Layer 3:** Structural validation with graph queries for approvals/evidence.
- **Layer 4:** Constraint reinjection into prompt context.
- **Layer 5:** LLM escalation for ambiguous edge cases.

The AI Firewall implements a physically enforced dual guardrail: agent hooks intercept tool calls for hold/block (<5 ms verdict), proxy APIs pre/post scan LLM IO, and SDK in-process enforcement. Six-tier IO scanning (regex, heuristics, fine-tuned classifiers, declarative validators, dialog rails, canary tokens) supports defense-in-depth.

## 5. Context Lifecycle and Memory Consolidation

The five-stage per-turn lifecycle ensures dynamic adaptation of agent context:

1. **Bootstrap:** Resolves profile, registers actors, loads goals, initializes context.
2. **Ingest:** Extracts turn facts via LLM, summarizes artifacts, suggests goals, manages supersession/contradiction edges.
3. **Assemble:** Full retrieve-rerank-score pipeline, guard preflight, four-block context injection, placeholder compaction.
4. **Compact:** Tag-based (DROP/COMPRESS/PRESERVE) and LLM-based (summary COMPRESS) context reduction.
5. **After-Turn:** Detects successful-use signals (DirectQuote, ToolCorrelation, GoalMention), updates statistics.

Idle-time nine-stage consolidation clusters near-duplicates, canonicalizes facts, strengthens through use statistics, decays unused facts, blacklists low-signal auto-recalls, promotes recurring facts from episodic to semantic, refines procedures via repeated step detection and SOP proposal, checks verification gaps, and adjusts salience exponential moving averages (±5% cap).

## 6. Authority Model, Access Control, and Multi-Tenancy

Identity and authority are structured by a three-level model: Gateway ID (isolation), Agent UUID (v5), and Session UUID, with optional org/team IDs. Authority is numerically stratified:

| Level       | Description                |
|-------------|---------------------------|
| 0–49        | Regular actors            |
| 50–69       | Team leads                |
| 70–89       | Org admins                |
| ≥90         | System admins             |

Authority rules (action, min_level, exempt_level) are persisted in SQLite, enforcing action-specific minima with Unix-style exemptions (e.g., org-admin can bypass team check). Supervisor approvals are recorded as Supervisor-Verified evidence, tightening provenance and oversight. Multi-gateway isolation and org/team overrides (graph-stored) facilitate robust separation in multi-tenant environments.

## 7. Validation, Deployment, Profiles, and Oversight

Extensive validation (>2,200 unit, integration, and end-to-end tests) attests to correctness in retrieval, scoring, evidence management, guard/firewall logic, and integration across TypeScript/Python, including trace propagation. Deployment supports three tiers (memory-only, context-only, full cognitive runtime), and five profile presets (coding, research, managerial, worker, personal) parameterize retrieval/scoring weights, half-lives, budgets, and policies for tailored operation.

A management dashboard provides actionable oversight (memory explorer, guard event review, approval queues, Prometheus metrics, queryable traces), supporting human-in-the-loop governance and forensic auditing. Gateway isolation mechanisms, coupled with strict config inheritance and override protocols, ensure security and operational hygiene at scale.

---

ElephantBroker thus establishes a verification-aware cognitive substrate for LLM-based agent architectures, delivering hybrid retrieval, multi-dimensional scoring, evidence tracking, layered safety, dynamic contextualization, continuous consolidation, and numeric authority—enabling robust, trustworthy, and auditable operation in high-stakes, multi-organization contexts [2603.25097]. Key applications encompass memory-durable customer support agents, research assistants requiring verifiable citations, compliance-driven automation, and any multi-agent workflow where provenance, context, and safety are operationally critical.

Source: https://www.emergentmind.com/topics/elephantbroker