代理基礎設施
Quipu Changes Agent Writes to Knowledge Graphs from Accept-Then-Clean to Validate-Before-Commit, with Rejected Records Replayable Across Versions
Quipu places data, trust labels, rules, and decisions on dual timelines, and checks candidate state before committing agent writes. In the authors’ injected-defect test, all six defects persisted without a gate, compared with zero under Quipu, though the evidence still comes mainly from a single deterministic evaluation designed by the system’s authors.
Quipu, a new open-source knowledge graph storage layer, reverses the traditional “accept first, clean up later” design for scenarios in which language models and software agents write knowledge automatically at scale. Each write is first placed in a SQLite savepoint, after which governance rules run against the resulting candidate state. If the rules reject the transaction, the data delta is rolled back, but an Ed25519-signed decision containing identity, time, and an evidence hash is still preserved. This allows the system not only to answer which facts currently exist, but also to trace which versions of the data and rules supported a particular rejection at the time it occurred.
Under the hood, Quipu uses an append-only EAVT fact log that stores both transaction time and valid time. This bitemporal design also applies to trust labels, policies, and decisions rather than only to business data. Different sources reside in named graphs, and combined results are narrowed through a lattice of trust, freshness, durability, and policy obligations. This prevents query results from retaining a high-trust classification after certified data has been combined with quarantined or undeclared sources. Rules are themselves represented as facts in the graph, so the `T ⊨ Σ` compliance check can be performed with deterministic queries without calling the model again.
The authors built a multi-writer Census lifecycle and used the same seeded workflow with six injected defects. The ungated version retained 6/6 defects, while Quipu retained 0/6. All seven composition probes preserved the invariant that “trust must not expand,” and 50/50 historical decisions could be reconstructed using the rules in effect at the time. Another evaluation, DEMM-Bench, included eight evidence-degradation conditions and 512 governance questions. Content-based evaluation made no unsupported claims, while a baseline that checked only whether a container existed made false claims in as many as 87.5% of cases.
From an engineering perspective, the notable shift is moving agent errors out of a cleanup queue and into a structured, retryable rejection loop. The project also provides a Rust library, CLI, REST, SPARQL, SHACL, and MCP tools. However, the paper explicitly describes engineering properties rather than offering a performance comparison with similar databases, and its headline figures come from deterministic tests co-designed by the authors. The next questions are the transaction and signature costs under high concurrency, whether rule evolution and cross-graph composition remain replayable, and whether independent teams can validate the results using real-world RAG or long-running agent workloads.