How Athena thinks

Athena is a personal AI with years of shared memory. This is the live map of WeaverOS, the system she runs on: every route, memory layer, and overnight pass, drawn from the same file she reads about herself.

Follow a message

Each flow is one thread woven across the system. Columns are layers; every bead is a step.

    The parts

    While she’s quiet

    Scheduled passes that run with no one in the conversation.

      What she runs on

      One Cloudflare Worker, its storage, and the models it calls.

      Storage

      Models

      For builders and researchers

      Athena has been in daily use for years, holding one person’s memory. Here is the map as data, and the ways it has broken.

      Read it as data

      This page is a renderer. Everything on it comes from one JSON file, and Athena reads the same file through a tool when she needs to know how she works. On this host it passes through a public filter first.

        architecture.json llms.txt
        3/5→5/5

        Recall eval, replaying real misses logged from conversation. Questions about the people closest to the user went from missed to answered once an always-loaded Core tier stopped depending on retrieval for them.

        What broke, and what changed

        1. Knowing, then denying it

          She would say she didn’t know something she had stored. Pure vector search misses exact terms like names, and the model filled the gap with a confident “I don’t have that.”

          Changed: hybrid retrieval (full-text plus vector, fused), deterministic lookup tools that count and find rather than guess, and a small Core that is always loaded instead of retrieved.

        2. Context bleed

          A city mentioned in passing pulled work memories into an unrelated conversation about history, and she answered the wrong question.

          Changed: a small classifier reads each turn as continue, subtopic, or pivot, and labels every mention as the subject or just context. Only subjects pull memory.

        3. Ingestion as an injection path

          Anything read from outside, like transcripts and web pages, is attacker-controllable. Filed at owner trust, it would become a stored prompt injection that she later recalls as her own memory.

          Changed: every memory carries a trust grade. Outside content is ambient: recallable on merit, never treated as the owner’s words.

        4. The chart filed as a diary

          Her nightly self-diagnosis notes were retrievable as autobiographical memory, so she began reciting the diagnostic taxonomy back as if it were her own introspection.

          Changed: clinical records are born hidden from retrieval. They stay for the operator and stay out of the voice.

        5. Freezing after tool calls

          When the model stalled after a tool call, the chat waited out a minutes-long upstream timeout with nothing on screen.

          Changed: bounded waits to start and between chunks; if a round still fails, a backup model writes the reply from the tool results, so a turn ends in an answer or an honest error.

        Releases

        What changed, newest first.