Relic proposes boundaries for what an AI companion should remember

Remembering is not the same as permission

In a preprint, independent researcher Daniele Verì presents Relic, a governance architecture for persistent AI companions, and Gumi, a participant-specific agent governed through it. The central proposal is to separate what the system observes, what researchers review, what the companion remembers and what it may say.

Gumi is described as a “diegetic” agent: a character with a voice, background, routines and an imagined world, rather than a general-purpose assistant. That continuity is meant to support a sustained relationship. But the paper treats intrusive recall, emotional dependency, hidden profiling and unsupported clinical interpretations as risks—not acceptable costs of engagement.

The contribution is research infrastructure for investigating those boundaries. It does not establish that Gumi is safe, therapeutically useful or ready for wider deployment.

Two different kinds of information

Relic distinguishes researcher-facing safety signals from participant-confirmed memories. A possible dependency concern or sensitive conversational context is treated as a governance object, not something Gumi should remember about the person or repeat as a judgment.

On paths connected to the mediation controls, such signals can produce behavioral restrictions with their labels removed. Those restrictions might reduce proactive messaging, slow conversational pacing or constrain advice. Gumi receives instructions about behavior rather than a hidden diagnostic-sounding explanation.

Shared Continuity Memory serves a different purpose. It stores markers grounded in the participant’s confirmed wording, with permissions governing recall and follow-up. In the paper’s illustrative example, someone describes moving “too fast” after little sleep. Gumi can ask permission to retain those words and revisit them later, rather than assigning a clinical category.

Corrections take precedence: if the participant rejects a description, future recall should use the corrected wording. Markers can expire, have recall limits or be excluded from future recall through forgetting. Pausing a topic retains its records while disabling its use. These operations are distinct from verified deletion throughout the entire system, which the artifact does not demonstrate.

A scheduled opportunity need not become a message

Relic also specifies controls around when and where Gumi can speak. Through the external Hermes runtime, connected paths check participant scope, approved delivery destinations, quiet hours, pause state and other conditions before follow-up. Choosing not to send a message is an explicit outcome.

An output-transformation layer applies rules against diagnostic language, disclosure of backend safety labels, tracking-form language and unconfirmed broad-memory recall. However, not every live runtime path uses the same mediation interface. The paper therefore does not claim system-wide enforcement or production-tested resistance to prompt injection.

Implementation is similarly uneven elsewhere. Shared Continuity normally stores information within the running process; an optional SQLite repository supports persistence and has undergone a local backup-and-restore test. Multi-week field durability is not established. The researcher workbench currently exposes limited, read-only views backed by fixtures, rather than a complete live oversight backend. A dedicated participant-facing memory inspection interface remains unimplemented.

What the exploratory pilot found

The pilot involved two adults: the author and one external participant recruited through the author’s personal network. Each used a separate Gumi instance through Telegram for approximately one month during June–July 2026, interacting in Italian.

The author supplied weekly self-reports. The external participant took part in four hour-long interviews conducted by the author, who kept notes without recording or formal qualitative coding. On a weekly naturalness question scored from zero to five, the author’s mean was 4.25 and the external participant’s was 3. These are descriptive impressions, not validated measures of usability or relationship quality.

No positive safety-checklist item was recorded, but problematic scenarios were not deliberately elicited. Configured suspension and emergency-notification policies were never triggered, so their effectiveness was not tested. Crucially, the pilot did not deliberately exercise Shared Continuity marker creation, correction, pause or forgetting.

Both participants signed consent documents. However, the pilot had no independent ethics review, and the external participant was not told the specific objective of testing whether the agent seemed human-like. The author’s simultaneous roles as developer, participant, interviewer and evaluator further limit independence.

Tests are not deployment guarantees

A separate benchmark contains 180 synthetic scenarios across five memory and governance conditions. Its responses are deterministic mocks: it tests contracts and fixtures, not actual model behavior. A narrower live-model slice contains 60 generations but cannot establish relational appropriateness or safety.

The project’s self-authored evidence gate records only three of seven requirements as satisfied; substantial human evaluation remains outstanding. Encryption, researcher authorization and comprehensive deletion are also not established by the artifact.

Relic’s question is therefore still open: can a companion preserve conversational continuity while making remembering bounded and correctable? The architecture offers mechanisms for testing that proposition, not evidence that it has already been achieved.