Silica
log.md append-only
  • arXiv:2509.04664 Hallucination has a statistical floor on facts the model never saw.
  • arXiv:2604.15597 Frontier models corrupt a quarter of a document when left editing.

Silica gives any LLM the documents you actually keep.

Answers grounded in your own notes, and connections between them you would not have found by reading. And when the model writes back, a parser and a finite-state machine verify and execute, and every write is re-read after it lands, reverted if it broke something. Notes or a codebase, one vault holds both. Local-first, readable with or without it.

uv tool install silica-agent
then silica init 
- 2026-08-04 · nucleate `atkinson-shiffrin.md` → 3 new, 1 patch, 0 deferred · run 4f2a91c0
- 2026-08-04 · nucleate `working-memory.md` → 2 new, 0 patch, 1 deferred · run 4f2a91c0
- 2026-08-04 · curate → 10 item (2 dedup, 1 refine, 3 orphan, 4 autolink) · run 9d7e33ab

This is log.md, at the root of your own vault. Not a dashboard: a file you can open, diff, and commit. Every run appends its line, and the run id is what /revert takes back.

the rot why it is structural

Three failures, and neither of the two ways out is a way out.

  1. Errors enter by construction.

    A personal vault is the limiting case of the hallucination floor. Your decisions, your meetings, your half-finished ideas are not rare in the training data, they are absent from it, and the bound is on facts the model never saw. This is not a bug the next release fixes.

  2. Errors compound.

    What Microsoft's 25% is made of matters more than the number: sparse, severe errors that land silently, growing with document size, interaction length, and the count of distractor files in the folder. A vault is large, long-lived, and made almost entirely of distractors.

  3. Errors propagate.

    A vault is not a pile of independent files, it is a linked graph that gets retrieved from. Corruption does not stay where it landed: the model links to the bad note, derives notes from it, and answers out of it.

And the two obvious outs are not outs.

Keep the assistant read-only and the vault rots on its own: the same idea captured five times, notes nothing points at any more, links to a file that moved, a subsystem documented against a commit from three months ago. Read-only also leaves the answering problem intact, because the model still answers from its own memory or a stale note and the answer reads the same either way. Or take the usual remedy, a tool that copies your notes into a store of its own, and now the corpus being corrupted is one you cannot even open to check.

The vault is the product, not the transcript. Your folder is the database, Silica is answerable for the state it is in, and every write it makes passes a gate that re-reads what it just wrote.

the gate verify or revert

Code already survived this exact failure mode.

Software absorbs model-written changes because nothing lands unparsed. Compilers, type checkers, and test gates mechanically check what the model writes, and you let them reject your work every day. Vaults had no equivalent.

You already let a tool to guard against Silica does the same by
a compiler reject source that will not build syntax and type errors an FSM refusing to commit a note that fails its structural checks
a test suite block a merge that breaks behavior regressions a post-write verify gate that reverts any edit which breaks vault coherence
git roll back a bad commit losing history /undo and /revert rolling back per note or per run
a formatter rewrite your code without asking drift and inconsistency graph-safe refactors that redirect links so a merge never orphans a note

The invariants the FSM enforces

Single entry point
All nucleation flows through the Injector FSM. There is no side channel that writes to the vault.
Verify or revert
A post-write mismatch raises VerifyMismatchError and rolls the write back.
Graph-safe moves
Renames, merges, and splits redirect incoming links atomically.
Zero-trust ingress
External content such as web search results can only land in Inbox/, and reaches the vault only through explicit staging and FSM review.
Memory only by promotion
What Silica learns from its own sessions becomes episodic facts outside the vault, never notes. It enters only when you promote it, through the same gate as everything else.
Layered rollback
/undo per note, /revert per run, and optional SILICA_GIT_COMMIT=auto stack as independent safety nets.
scope of the claim

The guardrail is enforced today on the normal write path. It is not yet crash-verified: a harness that kills the process mid-write to prove the invariants survive failure is in progress. Read it as enforced control flow, not as a proof under adversarial faults. Back your vault up before letting any tool rewrite it, and keep git as the byte-level backstop.

the run 710 notes, unedited

A real vault, adopted as it was.

No import, no migration, no second copy. The notes are in Italian and the conversation is in English, because that is how the folder actually was. Recorded end to end, played at 3x.

  1. find . -name '*.md' | wc -l710 notes that were already there.
  2. what do my notes say about the Atkinson and Shiffrin memory model?The answer names the note it came from.
  3. /reportHubs, bridges, orphans. Answerable for the state of the folder, not just a reader of it.
  4. /curate Giurisprudenza --applyIt writes to real files.
  5. /revertThe writes come back out.
measured re-runnable

Every number here comes out of evals/, on the product path.

Silica does not claim state of the art, and these rows say why: the samples are small, the judge is a local-grade model, and LoCoMo here is 2 of its 10 conversations. They are not comparable to what vendors report. They are something vendor numbers usually are not, which is re-runnable on your machine.

What was measured Result Sample
LoCoMo, questions the memory can answer 82.1% / 83.2% accuracy conv-26 (152 q), conv-47 (150 q)
LoCoMo, questions it should refuse 94.4% / 89.7% correct abstention 47 q and 40 q
MuSiQue multi-hop retrieval 61.3% recall@10, 0.83 MRR 50 questions, 11,654-note vault
Link recall: wikilinks stripped, then recovered 68.8% of the human's own links 1,196 links across 393 notes
Fused retrieval on the same vault, masked pairs 77.6% recall@10 522 pairs
Write integrity on the same vault 100% 758 of 758 notes no write transform introduced a new structural violation
and the ones that do not flatter

The same frozen baseline reports 0.33 agreement between /organize and the folders the human had already chosen, and 0.11 recall for concept-expanded correlation. They ship unedited, next to the good ones.

$ uv run python -m evals.golden --vault ~/path/to/vault
$ uv run python -m evals.musique --vault BENCH_DIR --corpus musique_corpus.json \
    --questions musique.json --load --index
$ uv run python -m evals.locomo --data locomo10.json --run-root RUN_DIR \
    --conversations conv-26,conv-47 --ingest fsm-extractive --answer agent
four ways in one gate

Four front doors. Switching driver changes the interface, never the rules a write has to pass.

silica --gui
Web GUI. A chat-first interface at localhost:8765. Query and curate from the browser, watch answers stream in, open the graph. Start here if you are new.
silica
Terminal. The interactive REPL. Every command lives here, and it is the fastest driver once you know the verbs.
silica connect
Obsidian plugin. A live bridge into the desktop app: Silica reads and writes the vault you already have open, with rollback and cache behind every change, and a changes panel with a per-file diff.
silica mcp
Agent memory. Your vault served over stdio to any MCP client, so an assistant recalls your real notes before it answers. No model and no API key on the read path.
The Silica web GUI: a chat panel answering from the vault, with the note sources listed beside it
The web GUI, running against a real vault at localhost:8765.

Reading a vault needs no model and no API key, so one line hands your notes to an agent you already run. Nothing is asked, nothing else is configured, and nothing is written.

$ silica setup claude     # or: setup codex, setup opencode
code same vault

Point it at a repository and the map stays honest against git.

Launch Silica in a repo instead of a note folder and it keeps a human-readable map of the code under docs/silica/. One artifact, two readers: you read it as a current map, and a coding agent reads it over MCP to ground its work in the real structure instead of re-deriving it every session.

/nucleate
Extracts a shallow AST skeleton with tree-sitter (signatures, structure, imports) into a markdown note, stamped with the commit it was verified against.
/wiki
Grows that into a behavioral wiki: an ARCHITECTURE.md plus one note per subsystem.
/stale
Flags notes whose source changed in shape since you documented it, a signature or control-flow change rather than a reformat. A reformat is not a documentation debt.
/impact
Cuts the same question the other way: from a diff to the notes that document those files, plus their 1-hop neighbors.
install python 3.11+

Point it at the folder you already have.

Silica curates the folder you launch it in, adopted as-is. Reads cover the whole folder; writes are confined by write_dir in vault.yaml. Your settings live in ~/.silica/.env and follow you between folders.

$ uv tool install silica-agent    # or: pipx install silica-agent
$ silica init                     # vault, model, embeddings
$ silica                          # start the session
read the source on PyPI

Make a read-only audit your first move. /report writes nothing, and it shows you the hubs, bridges, and orphans already sitting in your vault.

Sili, the Silica mascot: a low-poly crystalline creature with a single lit hexagonal eye
credit where it is owed

What Silica did not invent.

  • The wiki pattern is Karpathy's and the format that carries it is Google's Open Knowledge Format. What Silica adds is the gate in front of both, and it is the only part of this list it claims.
  • Plain markdown, local-first, AGPL is the entry ticket to this category, and Basic Memory got there too. Silica pays it in full, with no tier above the local one.
  • A graph with community detection ships in Graphify, GitNexus, LLM Wiki, and GraphRAG. Silica's part is that the same co-occurrence structure is also a retrieval leg.
  • Self-linking atomic notes are A-MEM's thesis, and old news in Obsidian plugins. Silica's part is that those links survive a merge, a split, and a rename.
  • An MCP server and local models are table stakes: four drivers, one gate, no privileged client.
not shipping yet

Upkeep runs when you ask for it. Being answerable for a folder means noticing without being asked, so the next work is scheduled upkeep: a folder watch, an audit that starts on its own, and a queue of changes waiting for your yes. Until it ships, Silica keeps the vault from rotting on demand, not on its own.