Aivery — Rules of Motion

A cognition engine should be a boring, correct database with rules of motion. The LLM is the rendering layer — spectacular on screen, but it sits above the laws, never inside them. These laws hold regardless of what the model does.

There is no "physics module," and there never will be. A physics layer is a suggestion — the first method that bypasses it "just this once" kills it. So each law is enforced where it is cheapest to enforce and hardest to bypass. The code doesn't have a physics layer. The code is the physics.

There are two kinds of law: conservation laws (what can never happen) and dynamics laws (what happens next). Every dynamics law must be expressible without breaking a conservation law. When it can't, that's the bug.

Conservation laws — what can never happen

1. Causality

A retrieval as of time T sees the corpus as it existed at T — not a byte more. "What did I know on Tuesday?" has exactly one answer. Nothing depends on its own future.

2. Append-only

New memories supersede old ones; salience shifts; structure accretes. But what was written, when, and by what source is immutable. The model can hallucinate all it wants — the ledger doesn't lie.

3. Determinism (scoped)

The substrate is deterministic: same query, same corpus, same T → same result. The composed system is replay-deterministic — reproducible if and only if the model's outputs are logged as fixed inputs. An irreproducible score is a system benchmarked as a mood.

4. Bounded work

Every operation completes within a hard budget. The substrate is easy to bound; the oracle is the unbounded thing — so the real invariant is that the substrate has a deterministic fallback when the model blows its budget. No fallback, no bound.

5. Substrate / oracle separation

The model proposes; Aivery disposes. The LLM holds no database credentials and never sees a connection string. It calls out, gets an answer, maybe suggests a write — but every mutation passes through invariant-preserving code. It is an unreliable narrator you consult, never a co-author of the ledger.

6. Provenance

Append-only says you can't rewrite the past. Provenance says you can always attribute it. Every memory knows where it came from — set once at write, touched by no update.

Dynamics — what happens next

Salience decays on corpus time, never wall clock. Structure accretes as monotonic, non-authoritative overlays — remove every edge and ranking degrades, but truth never changes; retrieval must be correct with zero edges. Memories consolidate by append-only supersession — the loser points to the survivor, nothing is destroyed, and the provenance of both is preserved.

Why it's shaped like a game engine

I built this asking how John Carmack would. Doom's magic was BSP trees and fixed-point math underneath — boring and correct, spectacular on screen. But Doom was deterministic because it had no oracle. Aivery has an unreliable model in the hot path, so the id-tech that matches isn't the BSP tree — it's Quake's rollback netcode: a deterministic core reconciling against an untrusted, laggy input stream you replay against. Logging the model's decisions isn't eval hygiene; it's the rollback discipline that makes the whole system replayable.

The point

Reduce the six laws to their user-visible consequence and you get six words:

Those describe a database, not an AI system. That's the whole point. The cognition engine is a boring, correct database with rules of motion — and the magic happens above it.

These are the laws the engine is built to obey. Aivery holds its own code to them and treats every gap as a bug, not a footnote.