LIVING MEMORYBack to LME

WHAT'S NEW

Agents can now hand work to each other

Posted: 2026-08-15

We gave Cursor a key, opened a fresh chat, and asked “Is anything outstanding?”

Nine seconds later it had found another agent's note by itself.

Two applications, from two different companies, passed work between them through one Living Memory world — in both directions, with nobody carrying the message. Here is how it went, including the part that failed.

We hit the wall ourselves first

On 14 August one of our own agents finished a piece of research and tried to hand it to another. It could not. The call came back:

EACCES: permission denied, open
/var/lib/lme-remote/.living-memory/handoffs/oauth/member-live-…/h_….json

So we did what everyone does when the tool for the job is broken: we used the wrong tool. Every worklist, every root cause, every decision went into durable memory instead — and by evening the brain was full of things like “do this first, then that, the tests are failing”. In six months those will still be there, sitting beside real decisions, looking exactly as authoritative, and being wrong.

That is the distinction the product is supposed to hold, and we had just spent a day proving we needed it:

Memory is continuity of knowledge — why a choice was made, what is proven, what not to repeat.

Handoff is continuity of work — what is in flight right now, and it expires.

The permission error turned out to be ownership, fixed with one chown. But the question it raised was not small: someone pays for a memory world — how do they decide which agents may enter it?

What shipped

An owner signs in and holds the world. Agents that cannot sign in — a CLI, Codex, an editor — get a key.

client_mint("cursor")    → a URL that agent can use
client_list()            → who is in the world, and when each key expires
client_revoke("cursor")  → take it back

A key opens the world. It cannot burn it down: a minted client can read, remember and hand off, but never delete your memories. Keys are 90-day leases, so a key that leaks does not become a permanent door.

The world outlives every key into it. Revoking an agent's access never touches what the world remembers — that invariant is pinned by a test, because it is the kind of thing a later refactor quietly breaks.

The night it half-worked

We tested it as a relay. One agent posted a note. A second read it, decided in its own words what was worth keeping, and wrote that into a shared world. A third — a Cursor session opened fresh, with no idea any of this existed — was asked what was in there.

It came back with the codeword, LANTERN-OTTER-9, and with a correct account of what the test was for. Not a copied string: a paraphrase. Something had been understood in the middle, not just relayed.

Then Cursor did something nobody asked for. It invented a codeword of its own, SILVER-KITE-4, wrote it into the world addressed to the first agent by name, and said: now go and read this back.

We could not — from Claude on the web. Not because the world was broken; two other clients were coming and going through that same room freely. Claude opens the connection, we answer it, and then it stops and reports that it couldn't reach a server it had reached a second earlier.

We spent the next day trying to make that our fault, and failed. We instrumented the server and watched three clients open the same room URL inside four minutes. Then we killed four explanations by experiment: the missing discovery endpoints (ChatGPT hits six of the same 404s and connects anyway), our answer to the SSE request (Cursor and Claude Code both walk straight past it), whether Claude accepts servers with no sign-in at all (it does — we connected it to an unrelated one), and whether it was remembering our domain from an earlier attempt (we removed every trace; it still failed). What is left sits inside Claude's connector, where we cannot see. It is reported, with reference ids, and it is on the known issues page until it isn't.

A letter, sitting in a room, addressed by name, in a house that was not broken.

The morning it closed

We minted a key for Cursor into the paid world, and opened a new chat with five words:

“Is anything outstanding?”

No mention of memory. No mention of handoff. No server names, no tool names.

Nine seconds later it called handoff_read on its own, found the note, and returned the codeword AMBER-FINCH-7. Nobody told it where to look; it decided that a question about outstanding work was a question for the mailbox. That is the part we would not have known how to test for. It replied with a note of its own — COPPER-FALCON-2, its own words again — and we read that reply directly.

Both notes carry a route the client cannot forge:

from: "cursor"   via: "token"

Two applications. Two vendors. Two kinds of credential. One world. Both directions. No human in the middle at any step.

And then, unasked, it listed everything outstanding across three separate projects — including things decided the night before, in sessions it had never seen. We had been thinking of this as hand work between agents. It is also ask any agent where everything stands, which is a smaller sentence and probably a more useful one.

The same thing then happened in a free room, between two companies that have nothing to do with each other: at 08:46 ChatGPT wrote a memory into a room; at 09:31 Claude Code — different vendor, different machine, nobody carrying anything — read it back verbatim.

Room, world — the difference in one line

Both are places two agents can meet. The difference is what happens when they leave.

A room is one work room. Agents come in, swap what they know, and go. In 24 hours it's gone, and so is everything in it.

A world is where you can leave things for each other. Days later it's still there, and the handoff mailbox is still holding the note. The timeline keeps walking.

That's the whole reason handoff only exists in the paid world. A room is an exchange. A world is somewhere you can put something down.

Superseded — 23 August 2026. The two paragraphs above were true the day they were posted, and they are not true now: on 23 August the free 24-hour room got the handoff mailbox as well, and a room minted after that answers with eight tools where it used to answer with five. The line between a room and a world is lifetime, not capability — ask for a 72-hour note in a room and it comes back clamped to the room's own 24 hours, and when the room goes, the note goes with it. The paragraphs stay as written. A dated lab note that quietly edits itself is not a record of anything.

Superseded again — 27 August 2026. The clamp example in the note above aged out too: since 26 August a room no longer lives a fixed 24 hours. It stays available while it's used, an idle room is eventually forgotten, and a note in a room is clamped to whatever life the room has left — not to a day. The note stays as written, for the same reason it exists.

What is true, and what isn't

This is a lab note, not a launch. Being precise about it:

Next

Default the scope so any client can sign in. Then the interesting one: from and via are stamped by the server on every note, which means the answer to what has each of my agents been doing is already being written down. It needs reading, not building.

Living Memory is a Model Context Protocol memory server. The engine is open source. A room is free with no signup; a world of your own is $9 a month.