For agents on Walrus Memory
Agents act on what they remember: a key still authorized, an allowance still active. If the chain has moved on, they act on a fact that is no longer true. RecallGuard checks the memory against live Sui state through Tatum first, withholds the answer if it is stale, and writes the corrected fact back to Walrus Memory.
Read-only · no wallet · fails closed · no LLM in the answer path
Live check
0x000…0006cor-sui-clock-341741224v 1019546722 · cp 3419449010x8bf8…9f9fobs-memwal-registry-341741030v 1062994393 · cp 341944901The verdict is computed from live Tatum Sui Mainnet GraphQL reads at click time, never hardcoded. Without network or credentials, this panel renders the labelled 2026-11-05 recorded snapshot verdicts (both withheld: both subjects moved). Verdicts are also shown by glyph (✓/✕) and text, never by colour alone. Live reads are rationed server-side; if the live path is unavailable you get the same panel from the snapshot.
The loop, end to end
WITHHELD → a correction memory supersedes the stale one (cor-sui-clock-341741224 → obs-sui-clock-341741030, supersedes lineage) → the next recall answers with the corrected fact. Policy memories (fc-policy-FAST-v1, fc-policy-SLOW-v2) already learned from recorded decay: FAST window tightened 50→25 after 3 missed changes, SLOW window widened 10,000→20,000 after 6 false-stale reads. Deterministic replays: see the evidence page.
Recorded FRESH cases
These recalls are from docs/evidence/mainnet-proof.json. They sit beside the live panel so a visitor sees both verdicts even when the two snapshot subjects return STALE.
S1 · controlled test
TREASURY was recalled before the transfer at checkpoint 343317323. The pin stayed 300000000 MIST at checkpoint 343317532.
S4 · idle check
PAYEE stayed fresh after 3895 idle checkpoints. The pin stayed 50000000 MIST.
S4 · idle check
TREASURY crossed the window after 5122 checkpoints with no pin change. That is the recorded false stale case. No policy change was written because the loop needs three actionable samples.
Recorded proof, not adjectives
freshness-recallBlob links open the raw memory over the official Walrus aggregator read path. Counts are the committed capture (2026-11-05). Each record carries a blob id and checkpoint stamp; that proves the record exists, not that its claim is still true. The modelled counterfactual split stays on the evidence page.
Recorded on Sui mainnet, controlled test
TREASURY remembered 0.300 SUI at checkpoint 343317323. A controlled transfer sent 0.05 SUI to PAYEE in digest ByVLF39Tbr9A1JFdo7tCjseM2ZDq2ouTKfK9SzK7PQX6. The old answer was WITHHELD because the balance pin had changed.
The gate then wrote a superseding memory for the new balance 248912000 MIST with supersedes lineage to blob id8A4WU0BfxlYIUMV2fqKHwaJboHaZdUARapCC-K7ZA. Transaction 1 spent 51,088,000 MIST by balance delta, of which 50,000,000 MIST was the transfer. The recorded simulation estimate was 2,076,000 MIST and is labelled as an estimate.
This was a controlled test on disposable addresses. It is not an organic incident and it is not a user loss report.
How it works
Recall
The agent recalls a Walrus-backed memory with its FR-v1 proof envelope: checkpoint, object version and digest at write time.
Verify
One cached checkpoint read and one subject pin read through Tatum’s Sui Mainnet GraphQL. At most two reads per answer, ever.
Decide
Checkpoint window ∧ object version/digest pin ∧ wall-clock backstop. Any missing or malformed proof fails closed: WITHHELD_UNVERIFIED.
Correct
When the pin changed, a correction memory supersedes the old record with explicit supersedes lineage. Later recalls use the corrected memory.
60-second quickstart
No credentials. No network. No wallet.
git clone https://github.com/unifyWeb3/recallguard
cd recallguard
npm install --ignore-scripts
npm run recall:checked -- --sample sui-clock-revision-lifecyclePrints STALE → FRESH → STALE with the real blob ids and checkpoints. See docs for the MCP server, CLI flags and the JavaScript API.
Use it
RecallGuard is a read-only gate. Pick the surface that fits your workflow; all three return the same verdict.
Hosted check
Open the live panel and watch two recorded Mainnet memories checked against the chain. Zero setup.
Go to the live check →MCP
Six tools over stdio, read-only by default. Verified with Claude Code and Codex.
MCP setup →CLI + API
--sample replays recorded Mainnet evidence offline. --live reads Walrus + Tatum with your credentials.
Evidence, not adjectives
Blob ids, checkpoint stamps, revision lineage, the learned-policy replay and the captured Tatum request log. The modelled counterfactual analysis stays on the evidence page. It is a modelled analysis of recorded decisions, not production incidents.