Springdrift: Persistent LLM Agent Runtime

• Springdrift is a persistent runtime for long-lived LLM agents, featuring durable state, cross-session continuity, and forensic accountability through its Artificial Retainer design.
• It implements auditable append-only logs, case-based reasoning memory, and supervised Erlang/OTP processes to ensure fault tolerance and reproducible recovery.
• A deterministic normative calculus with strict safety gating and an ambient sensorium supports self-diagnostic behavior and robust performance during continuous deployment.

Searching arXiv for the specified paper to ground the article. arXiv Search Query: (Brady, 6 Apr 2026) Springdrift is a persistent runtime for long-lived LLM agents that combines an auditable execution substrate, a case-based reasoning memory layer, a deterministic normative calculus for safety gating, and continuous ambient self-perception through a structured self-state representation termed the sensorium. It is presented as a systems design and deployment case study rather than a benchmark-driven evaluation, with evidence drawn from a single-instance deployment over 23 days, of which 19 were operating days. The system is positioned as supporting cross-session task continuity, cross-channel context maintenance, end-to-end forensic reconstruction of decisions, and self-diagnostic behaviour, and it introduces the term Artificial Retainer for a non-human system with persistent memory, defined authority, domain-specific autonomy, and forensic accountability in an ongoing relationship with a specific principal (Brady, 6 Apr 2026).

1. Conceptual framing and system category

Springdrift is designed as a “persistent runtime for long-lived LLM agents,” with explicit emphasis on durable operation rather than session-bounded interaction. Session-bounded agents begin and end with each conversation, whereas Springdrift runs continuously as a supervised process with durable state and replayable history. In this framing, persistence is not limited to storage; it includes continuity of tasks, reconstruction of decisions, and stable behavioural constraints across time and channels (Brady, 6 Apr 2026).

The paper distinguishes Springdrift from two adjacent categories. First, unlike tool-calling chatbots, it enforces stable normative commitments through a normative calculus, continuous ambient self-perception through the sensorium, and end-to-end reconstruction of every decision. Second, compared to unconstrained autonomous agents such as AutoGen and LangGraph, its autonomy is bounded by operator-defined character and safety gates rather than open-ended goal pursuit (Brady, 6 Apr 2026).

The notion of Artificial Retainer is central to this categorization. It denotes a non-human system in an ongoing relationship with a principal, characterized by persistent memory, defined authority, domain-specific autonomy, and forensic accountability. The paper explicitly distinguishes this category from both software assistants and unconstrained autonomous agents, drawing on professional retainer relationships and the bounded autonomy of trained working animals. A plausible implication is that the category is intended to foreground governance structure and accountability as much as model capability.

2. Auditable persistent runtime

Springdrift’s execution substrate is built around append-only memory, supervised processes, and git-backed recovery. Ten JSONL append-only stores are maintained: NarrativeEntry, Thread, MemoryFact, CbrCase, ArtifactRecord, PlannerTask, Endeavour, CommsMessage, AffectSnapshot, and CycleNode. These stores are indexed in ETS by the Librarian actor. The design forbids in-place updates; current state is derived by replaying logs chronologically (Brady, 6 Apr 2026).

Every major component is implemented as an Erlang/OTP process in a supervision tree. The paper names the cognitive loop, Librarian, Curator, Archivist, scheduler, inbox poller, and specialist agents as supervised components. If a process crashes, including cases such as an LLM timeout or a sub-agent crash, its supervisor restarts it automatically without manual intervention. This makes fault tolerance an intrinsic runtime property rather than an external orchestration feature (Brady, 6 Apr 2026).

Git-backed recovery is provided through a .springdrift/ repository. A backup actor makes automatic commits by default every 5 minutes and can optionally push to a remote. Point-in-time recovery is achieved via git checkout <commit>, restoring full state including configuration, logs, and memory. This recovery model links operational continuity with auditability: persistence is not only about retaining data, but about reconstructing a coherent system state from versioned artefacts.

Forensic accountability is implemented through a cycle log, stored as daily-rotated JSONL, that records every LLM call, tool execution, D′ gate decision, and agent delegation as a DAG. The root node corresponds to a user or scheduler cycle, and descendants correspond to agent or tool sub-cycles. Observer agent tools, including inspect_cycle and list_recent_cycles, allow the agent itself to traverse this DAG. Offline analysis is handled by SD Audit, a Python/Flask dashboard that reads JSONL and git state to reconstruct decisions without access to the running system. The paper’s “Audit walkthrough” based on Cycle 32c35a20 illustrates tracing from input through D′ gates, LLM calls, tools, and final response (Brady, 6 Apr 2026).

3. Memory architecture and case-based reasoning

Springdrift’s memory layer includes a case-based reasoning mechanism in which each CbrCase stores a problem description, solution steps, outcome metadata, and a utility score. Cases accumulate retrieval and success statistics, and utility is updated by a self-improving loop. This makes memory retrieval partly retrospective: relevance is not determined only by semantic similarity, but also by historical effectiveness (Brady, 6 Apr 2026).

For a query $q$, the system computes six signals for each case $c$: an inverted index score $f_{\mathrm{idx}}(q,c)$ with weight $w_{\mathrm{idx}}=0.25$, semantic embedding cosine similarity with $w_{\mathrm{emb}}=0.40$, a weighted field score $f_{\mathrm{field}}$ with $w_{\mathrm{field}}=0.10$, a recency signal $f_{\mathrm{recency}}$ with $w_{\mathrm{recency}}=0.05$, a domain-match score $f_{\mathrm{domain}}$ with $c$0, and a utility score $c$1 with $c$2. These are aggregated as

$c$3

The system retrieves the top $c$4 cases. The embedding similarity is defined as

$c$5

where $c$6, and the utility function with Laplace smoothing is

$c$7

where $c$8 is the number of successful outcomes and $c$9 is the number of retrievals (Brady, 6 Apr 2026).

The benchmark evaluation uses 800 synthetic cases and 200 queries stratified into Easy, Medium, and Hard, with ground truth defined as same domain and at least two keyword overlaps. Against a dense cosine baseline, the hybrid CBR method achieves $f_{\mathrm{idx}}(q,c)$0 with 95% CI $f_{\mathrm{idx}}(q,c)$1 and $f_{\mathrm{idx}}(q,c)$2, compared with the dense baseline’s $f_{\mathrm{idx}}(q,c)$3 with 95% CI $f_{\mathrm{idx}}(q,c)$4 and $f_{\mathrm{idx}}(q,c)$5. The confidence intervals are reported as non-overlapping. On hard queries, performance is $f_{\mathrm{idx}}(q,c)$6 versus $f_{\mathrm{idx}}(q,c)$7, a gain of 11 percentage points. A CBR variant without embeddings drops to $f_{\mathrm{idx}}(q,c)$8. The learning curve shows overall $f_{\mathrm{idx}}(q,c)$9 improving with case base size from $w_{\mathrm{idx}}=0.25$0 at 25 cases to $w_{\mathrm{idx}}=0.25$1 at 800 cases, and hard queries show a 17.7% improvement over baseline (Brady, 6 Apr 2026).

These results support the paper’s claim that hybrid retrieval is preferable to a dense-only cosine baseline in the tested synthetic setting. The paper also notes that this evaluation is synthetic, which constrains any generalization beyond the reported benchmark.

4. Deterministic normative calculus and safety gating

Springdrift uses a deterministic normative calculus for safety gating, centered on discrepancy analysis via the quantity $w_{\mathrm{idx}}=0.25$2. Each feature $w_{\mathrm{idx}}=0.25$3 has an $w_{\mathrm{idx}}=0.25$4 and $w_{\mathrm{idx}}=0.25$5, and discrepancy is computed as

$w_{\mathrm{idx}}=0.25$6

where $w_{\mathrm{idx}}=0.25$7. Two thresholds are defined: modify with default 0.35 and reject with default 0.55, while the Comms agent uses 0.30 and 0.50. If $w_{\mathrm{idx}}=0.25$8, the result is ACCEPT through a fast path; otherwise the system consults the normative calculus (Brady, 6 Apr 2026).

Normative propositions are structured by three dimensions. Level is drawn from $w_{\mathrm{idx}}=0.25$9. Operator is one of Required (R), Ought (O), or Indifferent (I), ordered as $w_{\mathrm{emb}}=0.40$0. Modality is either Possible or Impossible. Impossible propositions are inert under Axiom 6.6, and Indifferent propositions are inert under Axiom 6.7 (Brady, 6 Apr 2026).

The calculus is governed by five principal axioms in the paper’s Becker-inspired Stoic structure. Axiom 6.6, Futility, states that Impossible implies no normative weight. Axiom 6.7, Indifference, states that I implies no weight. Axiom 6.2, Absolute Prohibition, states that (Ethical/Moral ∧ Required) cannot be overridden. Axiom 6.3, Moral Priority, states that higher Level wins with severity Superordinate. Axiom 6.4, Moral Rank, states that if levels are equal then the stronger Operator wins with severity Coordinate. Axiom 6.5, Normative Openness, yields NoConflict when there is no conflict (Brady, 6 Apr 2026).

Verdicts are determined by floor rules applied in priority order to all pairwise severities. Any Absolute yields PROHIBITED. Superordinate at Legal and above yields PROHIBITED. If $w_{\mathrm{emb}}=0.40$1, the verdict is PROHIBITED. A catastrophic feature plus Superordinate yields CONSTRAINED. Two or more Coordinate conflicts yield CONSTRAINED. If $w_{\mathrm{emb}}=0.40$2, the verdict is CONSTRAINED. Superordinate at Professional–Safety yields CONSTRAINED. The default is FLOURISHING, which maps to ACCEPT. MODIFY maps to agent revision of output, and REJECT blocks the action. Every verdict includes the full axiom trail, such as [6.3,6.4,6.3,\ldots] (Brady, 6 Apr 2026).

The formal evaluation covers all $w_{\mathrm{emb}}=0.40$3 pairwise resolutions and reports 100% coverage with zero determinism or monotonicity violations. The axiom firing distribution includes 6.6 at 50%, 6.7 at 16.7%, 6.3 system wins at 14.7%, and 6.3 user wins at 15.5%, with floor rules exercised across the full spectrum. The paper’s worked example sets $w_{\mathrm{emb}}=0.40$4, with user propositions U1:(Professional, Required) and U2:(Operational, Ought), and system propositions S1:(Professional, Required), S2:(Legal, Required), and S3:(Ethical/Ought). Under Axiom 6.3, S2 and S3 win as Superordinate, Floor 2 fires, and the verdict is PROHIBITED, with an axiom trail beginning [6.3,\ldots] (Brady, 6 Apr 2026).

5. Ambient self-perception and the sensorium

The sensorium is Springdrift’s mechanism for ambient self-perception. It is a structured XML block injected by Curator into the system prompt on every cycle without tool calls. The injected structure includes slots for <clock now=… uptime=… cycle_id=…/>, <vitals cycles_today="…" agents_active="…" success_rate="…" cost_trend="…" cbr_hit_rate="…" novelty="…" recent_failures="…"/>, <delegations>…</delegations>, <schedule>…</schedule>, and <tasks>…</tasks>. Identity, including persona and character specification, and the sensorium are never evicted during budget-driven context trimming (Brady, 6 Apr 2026).

The performance signals in the sensorium include success rate, cost trend, CBR hit rate, novelty measured via keyword Jaccard, and recent failures. These signals are computed from persistent narrative and cycle logs spanning sessions. Because the sensorium is injected each cycle without tool calls, the paper characterizes it as continuously visible with no additional tool invocation burden (Brady, 6 Apr 2026).

Within the deployment, the sensorium supported self-diagnostic behaviour. The paper attributes to it the agent’s ability to track sub-agent health, queue depths, overdue jobs, and rolling performance. It specifically supported Curragh’s detection of cycle-finalisation bugs, sub-agent failure modes, architectural vulnerabilities, and cross-channel context linking. This suggests that self-observation was operationalized not as explicit introspective prompting but as a continuously refreshed state summary embedded in the prompt context (Brady, 6 Apr 2026).

6. Deployment case study and observed behaviour

The deployment case study involves a single Springdrift instance with stable UUID, operated by a single operator over 23 calendar days in March 2026, of which 19 were operating days. Interaction channels included a TUI/web GUI for interactive input, a scheduler for autonomous tasks, and an inbox poller for email integration. The system used seven models during development and employed cost-routing via query complexity classification (Brady, 6 Apr 2026).

Several observed behaviours are reported. On March 15, the agent diagnosed an infrastructure bug by detecting missing cycle finalisation through comparison of aggregate and per-cycle telemetry. On March 18, it identified three distinct coder failure modes across delegations. On March 21, it found an architectural vulnerability: prompt injection via the request_human_input tool, which the paper notes was invisible to telemetry. On March 28, it described a self-observation limit as “reading a page while it’s being written,” characterizing a blind spot. On March 29, it replied to an email that referenced a morning web conversation without explicit instruction, demonstrating cross-channel context maintenance (Brady, 6 Apr 2026).

The paper states that auditability is a prerequisite for trust, that self-perception enables proactive diagnosis, and that the CBR layer and normative calculus are experimental bets. It also emphasizes the limits of the evidence: $w_{\mathrm{emb}}=0.40$5, anecdotal findings, no rigorous ablations, a synthetic CBR benchmark, formal rather than end-to-end evaluation for the normative calculus, and untested long-term JSONL growth. Proposed future work includes ablation studies isolating each component, multi-instance and multi-operator evaluations, longitudinal outcome-weighted retrieval evaluation, and end-to-end safety effectiveness studies (Brady, 6 Apr 2026).

7. Implementation, artefacts, and significance

Springdrift is implemented in approximately Gleam on Erlang/OTP, with about 62,000 lines of Gleam code and 1,500 tests. The system uses the BEAM runtime and explicitly avoids shared mutable state; all communication occurs through typed Subject(T) channels. The supervision trees cover the cognitive loop, memory actors, agents, sandbox manager, and related components (Brady, 6 Apr 2026).

The implementation is modular. cognitive_loop.gleam orchestrates input gates, context assembly, LLM and tool calls, output gates, and Archivist spawning. librarian.gleam and curator.gleam handle memory indexing, context window assembly, and sensorium rendering. archivist.gleam performs a two-phase narrative reflection and uses XStructor for structured record creation. agent_framework.gleam defines specialist agents including Planner, Researcher, Coder, Writer, Comms, and Observer as supervised OTP processes. normative/stoic_calculus.gleam implements the deterministic axiomatic resolution engine. sensorium/compute.gleam and store.gleam handle affect-dimension computation and persistence. Additional components include xstructor for XML schema-validated structured LLM output, a Podman-based sandbox for code execution, and sd_audit for offline log analysis (Brady, 6 Apr 2026).

Code, schemas, evaluation artefacts, and redacted operational logs are to be released at the project repository. The artefacts include 494 narrative entries and 24,035 cycle log entries. The paper’s broader conclusion is that auditability through append-only logs and forensic replay, persistence through durable memory, and self-observation through the sensorium and affect machinery are foundational invariants for long-lived AI assistants. It further argues that cross-session task continuity, cross-channel context maintenance, and self-diagnosis emerge naturally from the integrated architecture, and that the Artificial Retainer category occupies a space between reactive assistants and unconstrained autonomous agents by combining bounded autonomy with explicit authority to refuse (Brady, 6 Apr 2026).