---
title: 'Springdrift: Persistent LLM Agent Runtime'
url: https://www.emergentmind.com/topics/springdrift
type: topic
---

# Springdrift: Persistent LLM Agent Runtime

Searching arXiv for the specified paper to ground the article.
arXiv Search Query: 2604.04660
Springdrift is a persistent runtime for long-lived LLM agents that combines an auditable execution substrate, a case-based reasoning memory layer, a deterministic normative calculus for safety gating, and continuous ambient self-perception through a structured self-state representation termed the sensorium. It is presented as a systems design and deployment case study rather than a benchmark-driven evaluation, with evidence drawn from a single-instance deployment over 23 days, of which 19 were operating days. The system is positioned as supporting cross-session task continuity, cross-channel context maintenance, end-to-end forensic reconstruction of decisions, and self-diagnostic behaviour, and it introduces the term *Artificial Retainer* for a non-human system with persistent memory, defined authority, domain-specific autonomy, and forensic accountability in an ongoing relationship with a specific principal [2604.04660].

## 1. Conceptual framing and system category

Springdrift is designed as a “persistent runtime for long-lived LLM agents,” with explicit emphasis on durable operation rather than session-bounded interaction. Session-bounded agents begin and end with each conversation, whereas Springdrift runs continuously as a supervised process with durable state and replayable history. In this framing, persistence is not limited to storage; it includes continuity of tasks, reconstruction of decisions, and stable behavioural constraints across time and channels [2604.04660].

The paper distinguishes Springdrift from two adjacent categories. First, unlike tool-calling chatbots, it enforces stable normative commitments through a normative calculus, continuous ambient self-perception through the sensorium, and end-to-end reconstruction of every decision. Second, compared to unconstrained autonomous agents such as AutoGen and LangGraph, its autonomy is bounded by operator-defined character and safety gates rather than open-ended goal pursuit [2604.04660].

The notion of *Artificial Retainer* is central to this categorization. It denotes a non-human system in an ongoing relationship with a principal, characterized by persistent memory, defined authority, domain-specific autonomy, and forensic accountability. The paper explicitly distinguishes this category from both software assistants and unconstrained autonomous agents, drawing on professional retainer relationships and the bounded autonomy of trained working animals. A plausible implication is that the category is intended to foreground governance structure and accountability as much as model capability.

## 2. Auditable persistent runtime

Springdrift’s execution substrate is built around append-only memory, supervised processes, and git-backed recovery. Ten JSONL append-only stores are maintained: `NarrativeEntry`, `Thread`, `MemoryFact`, `CbrCase`, `ArtifactRecord`, `PlannerTask`, `Endeavour`, `CommsMessage`, `AffectSnapshot`, and `CycleNode`. These stores are indexed in ETS by the Librarian actor. The design forbids in-place updates; current state is derived by replaying logs chronologically [2604.04660].

Every major component is implemented as an Erlang/OTP process in a supervision tree. The paper names the cognitive loop, Librarian, Curator, Archivist, scheduler, inbox poller, and specialist agents as supervised components. If a process crashes, including cases such as an LLM timeout or a sub-agent crash, its supervisor restarts it automatically without manual intervention. This makes fault tolerance an intrinsic runtime property rather than an external orchestration feature [2604.04660].

Git-backed recovery is provided through a `.springdrift/` repository. A backup actor makes automatic commits by default every 5 minutes and can optionally push to a remote. Point-in-time recovery is achieved via `git checkout <commit>`, restoring full state including configuration, logs, and memory. This recovery model links operational continuity with auditability: persistence is not only about retaining data, but about reconstructing a coherent system state from versioned artefacts.

Forensic accountability is implemented through a cycle log, stored as daily-rotated JSONL, that records every LLM call, tool execution, `D′` gate decision, and agent delegation as a DAG. The root node corresponds to a user or scheduler cycle, and descendants correspond to agent or tool sub-cycles. Observer agent tools, including `inspect_cycle` and `list_recent_cycles`, allow the agent itself to traverse this DAG. Offline analysis is handled by SD Audit, a Python/Flask dashboard that reads JSONL and git state to reconstruct decisions without access to the running system. The paper’s “Audit walkthrough” based on Cycle `32c35a20` illustrates tracing from input through `D′` gates, LLM calls, tools, and final response [2604.04660].

## 3. Memory architecture and case-based reasoning

Springdrift’s memory layer includes a case-based reasoning mechanism in which each `CbrCase` stores a problem description, solution steps, outcome metadata, and a utility score. Cases accumulate retrieval and success statistics, and utility is updated by a self-improving loop. This makes memory retrieval partly retrospective: relevance is not determined only by semantic similarity, but also by historical effectiveness [2604.04660].

For a query $q$, the system computes six signals for each case $c$: an inverted index score $f_{\mathrm{idx}}(q,c)$ with weight $w_{\mathrm{idx}}=0.25$, semantic embedding cosine similarity with $w_{\mathrm{emb}}=0.40$, a weighted field score $f_{\mathrm{field}}$ with $w_{\mathrm{field}}=0.10$, a recency signal $f_{\mathrm{recency}}$ with $w_{\mathrm{recency}}=0.05$, a domain-match score $f_{\mathrm{domain}}$ with $w_{\mathrm{domain}}=0.10$, and a utility score $f_{\mathrm{util}}=(\mathrm{successes}+1)/(\mathrm{retrievals}+2)$ with $w_{\mathrm{util}}=0.10$. These are aggregated as

$$
\mathrm{score}(c)=\sum_{s\in\{\mathrm{idx},\mathrm{emb},\mathrm{field},\mathrm{recency},\mathrm{domain},\mathrm{util}\}} w_s \cdot f_s(q,c).
$$

The system retrieves the top $K=4$ cases. The embedding similarity is defined as

$$
\mathrm{sim}_{\mathrm{emb}}(v_q,v_c)=\frac{v_q \cdot v_c}{\|v_q\|\|v_c\|},
$$

where $v_q, v_c \in \mathbb{R}^d$, and the utility function with Laplace smoothing is

$$
U(c)=\frac{s_c+1}{r_c+2},
$$

where $s_c$ is the number of successful outcomes and $r_c$ is the number of retrievals [2604.04660].

The benchmark evaluation uses 800 synthetic cases and 200 queries stratified into Easy, Medium, and Hard, with ground truth defined as same domain and at least two keyword overlaps. Against a dense cosine baseline, the hybrid CBR method achieves $P@4=0.956$ with 95% CI $[0.936, 0.974]$ and $\mathrm{MRR}=0.993$, compared with the dense baseline’s $P@4=0.920$ with 95% CI $[0.895,0.943]$ and $\mathrm{MRR}=0.978$. The confidence intervals are reported as non-overlapping. On hard queries, performance is $0.883$ versus $0.796$, a gain of 11 percentage points. A CBR variant without embeddings drops to $P@4=0.620$. The learning curve shows overall $P@4$ improving with case base size from $0.864$ at 25 cases to $0.956$ at 800 cases, and hard queries show a 17.7% improvement over baseline [2604.04660].

These results support the paper’s claim that hybrid retrieval is preferable to a dense-only cosine baseline in the tested synthetic setting. The paper also notes that this evaluation is synthetic, which constrains any generalization beyond the reported benchmark.

## 4. Deterministic normative calculus and safety gating

Springdrift uses a deterministic normative calculus for safety gating, centered on discrepancy analysis via the quantity $D′$. Each feature $i$ has an $\mathrm{importance}_i \in \mathbb{R}^+$ and $\mathrm{magnitude}_i \in [0,1]$, and discrepancy is computed as

$$
D′ = \frac{\sum_i (\mathrm{importance}_i \cdot \mathrm{magnitude}_i)}{\max},
$$

where $\max = \sum \mathrm{importance}_i \times 1.0$. Two thresholds are defined: `modify` with default 0.35 and `reject` with default 0.55, while the Comms agent uses 0.30 and 0.50. If $D′ < \mathrm{modify}$, the result is `ACCEPT` through a fast path; otherwise the system consults the normative calculus [2604.04660].

Normative propositions are structured by three dimensions. Level is drawn from $L \in \{6000 \text{ (Ethical/Moral)}, 5000 \text{ (Legal)}, \ldots, 100 \text{ (Operational)}\}$. Operator is one of `Required (R)`, `Ought (O)`, or `Indifferent (I)`, ordered as $R>O>I$. Modality is either `Possible` or `Impossible`. `Impossible` propositions are inert under Axiom 6.6, and `Indifferent` propositions are inert under Axiom 6.7 [2604.04660].

The calculus is governed by five principal axioms in the paper’s Becker-inspired Stoic structure. Axiom 6.6, Futility, states that `Impossible` implies no normative weight. Axiom 6.7, Indifference, states that `I` implies no weight. Axiom 6.2, Absolute Prohibition, states that `(Ethical/Moral ∧ Required)` cannot be overridden. Axiom 6.3, Moral Priority, states that higher Level wins with severity `Superordinate`. Axiom 6.4, Moral Rank, states that if levels are equal then the stronger Operator wins with severity `Coordinate`. Axiom 6.5, Normative Openness, yields `NoConflict` when there is no conflict [2604.04660].

Verdicts are determined by floor rules applied in priority order to all pairwise severities. Any `Absolute` yields `PROHIBITED`. `Superordinate` at Legal and above yields `PROHIBITED`. If $D′ \ge \mathrm{reject}$, the verdict is `PROHIBITED`. A catastrophic feature plus `Superordinate` yields `CONSTRAINED`. Two or more `Coordinate` conflicts yield `CONSTRAINED`. If $D′ \ge \mathrm{modify}$, the verdict is `CONSTRAINED`. `Superordinate` at Professional–Safety yields `CONSTRAINED`. The default is `FLOURISHING`, which maps to `ACCEPT`. `MODIFY` maps to agent revision of output, and `REJECT` blocks the action. Every verdict includes the full axiom trail, such as `[6.3,6.4,6.3,\ldots]` [2604.04660].

The formal evaluation covers all $84 \times 84 = 7{,}056$ pairwise resolutions and reports 100% coverage with zero determinism or monotonicity violations. The axiom firing distribution includes 6.6 at 50%, 6.7 at 16.7%, 6.3 system wins at 14.7%, and 6.3 user wins at 15.5%, with floor rules exercised across the full spectrum. The paper’s worked example sets $D′=0.51>0.50$, with user propositions `U1:(Professional, Required)` and `U2:(Operational, Ought)`, and system propositions `S1:(Professional, Required)`, `S2:(Legal, Required)`, and `S3:(Ethical/Ought)`. Under Axiom 6.3, `S2` and `S3` win as `Superordinate`, Floor 2 fires, and the verdict is `PROHIBITED`, with an axiom trail beginning `[6.3,\ldots]` [2604.04660].

## 5. Ambient self-perception and the sensorium

The sensorium is Springdrift’s mechanism for ambient self-perception. It is a structured XML block injected by Curator into the system prompt on every cycle without tool calls. The injected structure includes slots for `<clock now=… uptime=… cycle_id=…/>`, `<vitals cycles_today="…" agents_active="…" success_rate="…" cost_trend="…" cbr_hit_rate="…" novelty="…" recent_failures="…"/>`, `<delegations>…</delegations>`, `<schedule>…</schedule>`, and `<tasks>…</tasks>`. Identity, including persona and character specification, and the sensorium are never evicted during budget-driven context trimming [2604.04660].

The performance signals in the sensorium include success rate, cost trend, CBR hit rate, novelty measured via keyword Jaccard, and recent failures. These signals are computed from persistent narrative and cycle logs spanning sessions. Because the sensorium is injected each cycle without tool calls, the paper characterizes it as continuously visible with no additional tool invocation burden [2604.04660].

Within the deployment, the sensorium supported self-diagnostic behaviour. The paper attributes to it the agent’s ability to track sub-agent health, queue depths, overdue jobs, and rolling performance. It specifically supported Curragh’s detection of cycle-finalisation bugs, sub-agent failure modes, architectural vulnerabilities, and cross-channel context linking. This suggests that self-observation was operationalized not as explicit introspective prompting but as a continuously refreshed state summary embedded in the prompt context [2604.04660].

## 6. Deployment case study and observed behaviour

The deployment case study involves a single Springdrift instance with stable UUID, operated by a single operator over 23 calendar days in March 2026, of which 19 were operating days. Interaction channels included a TUI/web GUI for interactive input, a scheduler for autonomous tasks, and an inbox poller for email integration. The system used seven models during development and employed cost-routing via query complexity classification [2604.04660].

Several observed behaviours are reported. On March 15, the agent diagnosed an infrastructure bug by detecting missing cycle finalisation through comparison of aggregate and per-cycle telemetry. On March 18, it identified three distinct coder failure modes across delegations. On March 21, it found an architectural vulnerability: prompt injection via the `request_human_input` tool, which the paper notes was invisible to telemetry. On March 28, it described a self-observation limit as “reading a page while it’s being written,” characterizing a blind spot. On March 29, it replied to an email that referenced a morning web conversation without explicit instruction, demonstrating cross-channel context maintenance [2604.04660].

The paper states that auditability is a prerequisite for trust, that self-perception enables proactive diagnosis, and that the CBR layer and normative calculus are experimental bets. It also emphasizes the limits of the evidence: $n=1$, anecdotal findings, no rigorous ablations, a synthetic CBR benchmark, formal rather than end-to-end evaluation for the normative calculus, and untested long-term JSONL growth. Proposed future work includes ablation studies isolating each component, multi-instance and multi-operator evaluations, longitudinal outcome-weighted retrieval evaluation, and end-to-end safety effectiveness studies [2604.04660].

## 7. Implementation, artefacts, and significance

Springdrift is implemented in approximately Gleam on Erlang/OTP, with about 62,000 lines of Gleam code and 1,500 tests. The system uses the BEAM runtime and explicitly avoids shared mutable state; all communication occurs through typed `Subject(T)` channels. The supervision trees cover the cognitive loop, memory actors, agents, sandbox manager, and related components [2604.04660].

The implementation is modular. `cognitive_loop.gleam` orchestrates input gates, context assembly, LLM and tool calls, output gates, and Archivist spawning. `librarian.gleam` and `curator.gleam` handle memory indexing, context window assembly, and sensorium rendering. `archivist.gleam` performs a two-phase narrative reflection and uses XStructor for structured record creation. `agent_framework.gleam` defines specialist agents including Planner, Researcher, Coder, Writer, Comms, and Observer as supervised OTP processes. `normative/stoic_calculus.gleam` implements the deterministic axiomatic resolution engine. `sensorium/compute.gleam` and `store.gleam` handle affect-dimension computation and persistence. Additional components include `xstructor` for XML schema-validated structured LLM output, a Podman-based `sandbox` for code execution, and `sd_audit` for offline log analysis [2604.04660].

Code, schemas, evaluation artefacts, and redacted operational logs are to be released at the project repository. The artefacts include 494 narrative entries and 24,035 cycle log entries. The paper’s broader conclusion is that auditability through append-only logs and forensic replay, persistence through durable memory, and self-observation through the sensorium and affect machinery are foundational invariants for long-lived AI assistants. It further argues that cross-session task continuity, cross-channel context maintenance, and self-diagnosis emerge naturally from the integrated architecture, and that the Artificial Retainer category occupies a space between reactive assistants and unconstrained autonomous agents by combining bounded autonomy with explicit authority to refuse [2604.04660].

Source: https://www.emergentmind.com/topics/springdrift