Your next agent starts where the last one stopped.
lema is shared project state for humans and coding agents. Checkpoints, settled decisions, rejected approaches, and the reasons why — established once, delivered to whoever picks the work up next.
Claude Code today · any MCP-capable harness · open protocol
This edit reaches for a Redis cache. [d_82f3c1] Postgres is the only datastore — the Redis alternative was rejected 2026-05-11: operational surface over win. Surfaced, never blocked.
- session start · feat/brief-cache
- checkpoint · cache keyed by ruling head
- files · compose.go, compose_test.go
- observation · go test: 41 passed
- compact — checkpoint captured
Public · tokenless Live
Ask why they ruled it out — on a repo you don't even own.
The same why-engine runs over public projects, baked to api.lema.sh with zero config. One command, no account: ask whether an approach is already settled in React, Kubernetes, Rust, Vue, or Go — and get the recorded reason, cited, or an honest no_recorded_ruling → proceed.
Same verb, your own record: point it at your workspace and resolve answers over the decisions your team has settled.
connected · react · public workspace · read-only
check_approach("react", "share logic with a mixin")
ruled_out — mixins were dropped: wrapper hell,
implicit dependencies, name clashes. Hooks compose
instead. [reactjs/rfcs#68]
check_approach("react", "colocate data fetching in a component")
no_recorded_ruling — proceed. Nothing on file rules this out.
Try it
Every surface on this page has a door.
No demo call, no waitlist. Two of the three need no account at all.
Ask the record
No signupAsk why an approach was ruled out across React, Kubernetes, Rust, Vue, and Go — the recorded reason, cited, or an honest abstain. Point the same verb at your own workspace once you have one.
lema.sh/record →Connect the MCP
Open sourceOne command wires the why-engine into Claude Code — or any MCP-capable harness. The same server that powers the terminal above, no key required to try it.
npx lema-mcp →Verify in CI
LiveA GitHub Action on every pull request: did the diff do what the description says? Both directions of drift, reported as a neutral check with inline annotations — fail-open, never a gate you didn't ask for.
lemahq/lema-verify@v1 →Source: the MCP server is open source at github.com/lemahq/lema-mcp — read exactly what it sends before you point it at your record.
The thirty-second arc
From stopped to started, with nothing lost between.
One thread of work, two harnesses, zero handoff meetings. Capture rides harness hooks; the human only does the irreducible part — the ruling.
The surface
Four objects. That's the whole vocabulary.
Everything a team or an agent touches in lema is one of these. No dashboards to babysit, no wiki to garden.
State Brief
LiveWhat a worker — human or agent — receives at start: objective, last checkpoint and next action, files in flight, test status, settled decisions in scope, rejected approaches, governing constraints, related active runs, unresolved questions, freshness. One screen, scannable in ten seconds. Every line cited. Silence stated honestly — never fabricated.
Run
LiveOne session of work by one actor, identified across harnesses. Runs join the same thread of work via a deterministic ladder — explicit id → PR or issue → repo+branch → repo+worktree → … → honestly unassociated. Full timeline: checkpoints, files touched, observations.
Settlement Card
In previewThe boundary object on every PR: compares what the diff did vs what was said vs what's settled. Catches undescribed changes, drafts candidate decisions; the human rules inline. Inference can draft a ruling — it cannot create one.
DID
Backoff now exponential
SAID
"Fix retry flakiness"
SETTLED
No ruling on backoff
The Record
LiveThe settled, cited, superseding-only history. Decisions plus the deliberation that led to them: who ruled, on what evidence, superseding what — and what was rejected, and why. Append-only. Supersede, never edit.
The contract
Four questions, answered on arrival.
Every brief answers these before a single token of work is spent re-discovering them.
What are we trying to accomplish?
The objective, cited to the decision that set it. [d_31c07a]
What is already settled?
Decisions in scope and rejected approaches — with the why. [d_82f3c1]
What changed?
Last checkpoint, files in flight, latest observations. [ck_5520b9]
What should happen next?
The next action, carried across sessions and harnesses. [ck_5520b9]
Design principle
Automate everything up to the judgment. Never the judgment.
Where lema sits
Unblocked finds and synthesizes organizational context. ByteRover and mem0 remember context across agents and sessions. lema establishes and advances the project state that humans and agents are expected to work from.
Built to be trusted
A system of record, not another memory blob.
Adjudicated, append-only, superseding-only. Who ruled, on what evidence, what it replaced.
Append-only record
Nothing is edited in place. Supersede, never edit — the history of the history survives.
Actor provenance
Every event carries an actor: user, agent, or system. Agent-authored material is admissible but marked, low-trust, expiring — it never silently becomes policy.
Server-adjudicated status
Extraction only ever drafts. A human ruling creates the record. Judgment stays human.
Fails open
Capture never blocks a session. Guards surface, never deny. Wrong joins are reversible without record damage.
Neutral across harnesses
No vendor's memory silo. Claude Code today, Codex next; the protocol is open.
Enterprise plumbing
SSO and enterprise auth via WorkOS. Postgres. Go and TypeScript. Ships dark behind flags.
Stop re-briefing your agents.
The lazy path becomes the correct path: capture rides harness hooks, briefs are injected, candidates are drafted. Humans only rule.
Pillar · The Record
ADR-grade deliberation, without the ceremony.
A system of record for decisions: append-only, superseding-only. Who ruled, on what evidence, superseding what — and what was rejected, and why.
Ask it questions and it answers from your own record, with citations. When the record is silent, it says so: "the record is silent" is not "approved."
resolvein the agent's toolbelt. "Why did we choose X?" returns a cited synthesis from your record, in-session, in any MCP-capable harness.- Typed verdicts, not vibes. "Can I use approach Y?" returns
ruled_out,settled, orno_recorded_ruling— each cited or honestly empty. - Honest abstention. Every answer cites or abstains. No uncited synthesis, ever.
"We are drowning in information, while starving for wisdom. The world henceforth will be run by synthesizers — people able to put together the right information at the right time, think critically about it, and make important choices wisely."
E. O. Wilson, Consilience, 1998resolve "why did we choose HeroUI v3?"
Settled by ADR-0112, superseding d_20ee01 (shadcn/ui): single component library on React Aria, Tailwind v4; MUI v6 rejected for theme-system weight. [ADR-0112] · [d_20ee01]
check "can I add a Redis cache for briefs?"
ruled_outRejected 2026-05-11 — a second datastore adds operational surface the win doesn't cover. [d_4477aa]
check "can I rate-limit the brief endpoint?"
no_recorded_rulingThe record is silent. Silence is not approval.
MCP verbs, live today: get_state_brief · resolve · propose · record_decision — any MCP-capable harness.
Pillar · Session state
Compact-proof. Crash-proof. Cross-harness.
Sessions end badly: compaction, crashes, context windows. lema treats that as a fact of physics and relays state across the gap — checkpoint, distill, sync, brief.
Capture rides harness hooks: no ritual, no "remember to update the doc." The next worker — same human, different agent, different harness — starts from the brief, not from archaeology.
- Checkpoint on stop. Compaction and session end both capture the frontier automatically.
- Distilled, not dumped. The journal is condensed into the one-screen State Brief — cited, honest about silence.
- Proven round-trip. Running end-to-end in production on lema's own development, daily.
checkpoint
harness hooks capture the frontier
distill
journal condensed, cited
sync
hosted run journal
brief
injected at next start
- run r_7c19e4 · claude-code · session startjoined via repo+branch — deterministic ladder, no manual setup
- checkpoint ck_5520b9"Cache keyed by ruling head; invalidate on new ruling event. Next: wire invalidation into the settlement listener."
- observation obs_9a02c4go test ./internal/brief — 41 passed, 0 failed
- compact — checkpoint captured, session endsnothing asked of the human; hooks did the labor
- run r_b03d11 · claude-code · session startState Brief injected — resumed from ck_5520b9: objective, files in flight, settled decisions, next action. Zero re-briefing.
Run view is live on the web app: cross-repo run list, per-run timeline — checkpoints, files touched, observations.
Pillar · Guardrails
The precedent arrives before the code does.
A pre-edit check inside the session: when an edit touches a closed decision, the decision fires with its full never-reopen rationale — including the alternative that was killed, and why.
Non-blocking by design. Guards surface, never block; they fail open, never break a session. The agent — or the human — keeps the call. What changes is that the call is made knowing the precedent.
- Refreshed every session from the hosted bound set of closed decisions.
- Verify, at the PR boundary Live — every pull request is checked against the record; drifted claims surface on the check. Same posture: it surfaces, it doesn't block.
- Collision sentinel In preview — two runs touching the same files raises a conflict event before the merge surprise.
lema guard · pre-edit precedent check · 12 ms
closed decision touched: d_82f3c1
"Postgres is the only datastore; no side caches beside it."
ruled 2026-05-11 · human ruling · evidence: 3 runs, 1 incident
rejected alternative on file:
Redis read-through cache — killed 2026-05-11
why: a second datastore adds operational surface
the win doesn't cover at current scale.
surfaced, not blocked — the call is yours.
Add idempotency keys at the API edge #248
This PR retries into the same congestion window — client-side retry backoff was ruled out for exactly this. Surfaced on the check; the merge is not blocked. [d_9b11c7]
Verify is on for the repo — it checks every pull request. The numbers appear after the first run. Live
run_event · conflict In preview
r_7c19e4 and r_c44b02 are both touching apps/api/internal/repo/settlement_events.go — collision surfaced to both runs and the next brief. [sentinel]
Fails open: if lema is unreachable, the session proceeds untouched. A guard that breaks your work would be worse than no guard.
Pillar · Living documentation
Docs that know when they're stale.
Every decision was premised on something — a schema, a contract, a benchmark. Tripwires watch those artifacts. When one changes, the dependent decisions flip to "re-examine," and that surfaces in the next State Brief. Nobody has to remember to check.
Staleness stops being a vibe and becomes a tracked state with a cause attached.
- Premise tracking. Decisions record what they were premised on, down to the file and revision.
- Surfaced, not archived. A flipped decision lands in the next brief for whoever touches that scope.
- Coming — the doc audit: grade CLAUDE.md and AGENTS.md against the record. Flag drift, never overwrite by hand-wave. Generation unlocks once the record earns trust.
openapi/brief.yaml@9f31c2openapi/brief.yaml changed in b7e21a, 2 h ago — premise no longer holds at the recorded revisionaudit CLAUDE.md Coming
Grade the doc against the record: which claims match settled decisions, which drifted, which have no ruling behind them. Flags drift — never overwrites. Generation unlocks once the record earns trust.
Pillar · Architecture
Decisions, edges, and three kinds of truth.
Decisions condense into a queryable decision graph — supersedes edges, rule-backing edges. Answers are graph traversals, not text search over a wiki.
The collector is deliberately boring: an open local collector with a neutral envelope, adapters per harness, a local-first spool that fails open and syncs when credentialed.
- Open protocol. The moat is the adjudicated history — never the collector.
- Adapters per harness. Claude Code today; the envelope doesn't care who produced the event.
- Local-first, fail-open. Offline capture spools; nothing ever blocks the session.
What's binding
Settled
Append-only, human-ruled. Supersede, never edit. The only register that can bind a guard.
What's in motion
Active work
Claims, checkpoints, runs. Expiring by policy — agent-authored material is marked and low-trust until ruled on.
What's observed
Reality
Latest observation wins: test runs, wire checks. Never argued with, only re-observed.
{
"run_id": "r_7c19e4",
"ts": "2026-07-21T09:31:07Z",
"kind": "checkpoint",
"payload": { …distilled frontier… },
"evidence": ["hook:stop", "git:worktree"]
}
harness hooks
adapters per harness
neutral envelope
run_id · ts · kind · payload · evidence
local spool
fail-open, offline-safe
adjudicated record
syncs when credentialed
Stack: Postgres · Go · TypeScript · SSO via WorkOS · deploys dark behind flags.
Now & next
This page is itself a State Brief.
Chips, citations, no vapor. Live means in production, dogfooded daily on lema's own development. Nothing below is aspiration dressed as product.
Nothing here ships as a promise. It ships when it's real, and moves up a group.
In preview — the Settlement Card
Did vs said vs settled, on the PR.
The GitHub rail is running behind a flag today; the rendered card on every PR is the next step. This is what it looks like.
Harden webhook retries #241
Inference drafts. It cannot rule. A human ruling is the only thing that creates the record.