ADR-0174: Memory of the AI agents: Mem0 and Cognee installed by the Navin Manager, Navin Memory Provider contract

• Status: accepted
• Date: 2026-11-03
• Scope: catalogue of the Navin Manager (navin-manager/catalog/services/mem0.yaml, cognee.yaml and their templates), Manager UI (logos, catalogue cards, consoles), Memory Manager of the Control Plane (services/control-plane/src/eai/domains/memory), contracts contracts/v1/memory-*.schema.json, Enterprise portal
• Related documents: ADR-0101 (licence policy), ADR-0166 (high availability declared per service), ADR-0171 (hardened installation for banking production), brick E (Memory Manager)

Context

The customer asks for two open source memory engines for the AI agents: Mem0, persistent memory, and Cognee, memory enriched by a knowledge graph (GraphRAG). They must install on the customer's servers, including private ones, air gapped ones or several machines, then serve the agents of Navin Enterprise.

What exists:

• The Control Plane already has a Memory Manager (brick E): Memory Contract items with ACL, time to live, legal hold, versions, hybrid search and classification, scopes session, agent, user, project and tenant (eai/domains/memory, contracts/v1/memory-contract.schema.json, migrations V062 and V101). Its vectors go through the Model Gateway.
• The Manager catalogue already installs PostgreSQL (pgvector depending on the method), Qdrant, Redis, LiteLLM, vLLM, Ollama, Keycloak, OpenFGA, OPA, OpenBao, Prometheus, Alertmanager, Alloy, OpenSearch, the OpenTelemetry collector, NATS and SeaweedFS. It has neither Mem0 nor Cognee.

Official sources read on 2026-11-03:

Product	Stable version	Licence	Upstream delivery
Mem0 (mem0ai/mem0)	v2.2.1 (2026-09-25)	Apache-2.0	FastAPI REST server (server/) with authentication, alembic migrations, rate limits and a Next.js dashboard (server/dashboard); the Docker Hub image mem0/mem0-api-server only has a latest tag from 2025, older than v2, and the dashboard has no published image
Cognee (topoteretes/cognee)	v1.6.6 (2026-10-29)	Apache-2.0	engine and FastAPI API (/api/v1), images cognee/cognee, cognee/cognee-ui and cognee/cognee-mcp, Python package cognee
LadybugDB (LadybugDB/ladybug)	v0.22.1 (2026-10-28)	MIT	embedded graph database, derived from Kuzu

Decision

1. Two planes, explicit interfaces

Who	Does what	Through
Navin Manager	catalogue, preflight, artifacts, installation, technical configuration, start and stop, upgrades and migrations, rollback, backups, monitoring, HA when it exists	Navin agents, the existing podman and python methods, systemd units of the Manager
Navin Enterprise	engine chosen per agent, memorization and retention policies, rights, browsing and management of the authorized memories, use at run time	official REST APIs of Mem0 and Cognee behind the Navin Memory Provider contract

There is no second deployment system and no Docker: the upstream Compose files are only a reference to write the Podman deployment.

2. Catalogue services

Service	Subcategory	Components	Methods
mem0	persistent agent memory	REST server, dashboard as an optional follower	python (virtual environment, official source of the pinned version), podman only with an image of that version pinned by digest
cognee	knowledge graph and GraphRAG	API, UI and MCP server as optional followers	podman (official images pinned by digest), python when it follows the conventions of the Python services of the catalogue

The catalogue gets the category memory ("AI memory") and an optional subcategory field shown on the cards.

3. Dependencies reused, never installed by default

• Existing PostgreSQL: one dedicated database and one technical role with minimal privileges per service, with the vector extension.
• Models through LiteLLM (OpenAI compatible), vLLM or Ollama of the catalogue. No model is downloaded at start.
• An optional dependency is never installed automatically. An incompatible version is refused with its cause, in English and in French.
• Grafana and Loki cannot be used (AGPL-3.0, ADR-0101). Monitoring goes through Prometheus, Alertmanager, Alloy, OpenSearch and OpenTelemetry.
• Neo4j is never installed. The graph memory of Mem0 stays off as long as no backend under an allowed licence is validated.

4. Cognee profiles

• Standard: relational PostgreSQL, pgvector and LadybugDB embedded on a persistent volume, single instance.
• Advanced: an external graph backend only if the chosen version supports it, under an allowed licence, with a tenant isolation validated by a test.
• The PostgreSQL graph backend is never presented as ready for banking production while the project describes it as experimental.
• Authentication and per tenant access control are on in production. No default user keeps a known password.

5. Artifacts

• Images pinned by digest, archives and wheels by SHA-256, carried by the existing hub and offline bundle. No latest, main or development tag.
• The artifacts of the previous version stay available for the rollback.

6. Lifecycle and validation

• The healthy state needs the health checks and a real functional test (smoke). Mem0 creates, searches, updates then deletes a memory in a test space. Cognee creates a dataset, adds items, builds the graph, searches, then cleans up.
• Upgrade: backup, then the alembic migrations of the product. The rollback restores the backup and the previous artifacts.
• Backup: pg_dump of the dedicated databases and a consistent copy of the LadybugDB files and of the data directory (service stopped or checkpoint).
• External telemetries are off (MEM0_TELEMETRY=false, Cognee telemetry disabled).

7. High availability

It is declared per service (ADR-0166) from the real code of the installed version:

• Mem0 is replicable only if all its state lives in PostgreSQL; otherwise it stays single instance.
• Cognee, standard profile: single instance, because its graph database is embedded.
• No capacity and no HA is announced without a test.

8. Navin Memory Provider contract

It is built on brick E, without duplicating it:

• declarative capabilities: remember, recall, search, update, forget, list, get, purge, get_health, get_capabilities, and for Cognee ingest_knowledge, build_graph, search_graph, get_relations, delete_dataset; a provider only announces what it really executes;
• providers: builtin (brick E, unchanged), mem0, cognee and hybrid (Mem0 for the facts, Cognee for the relations, merged and deduplicated by Navin);
• modes: session memory (existing mechanisms, never Mem0 or Cognee for every message), long term, agent, shared and graph; memorization follows explicit policies and never writes every conversation into both engines;
• only the real endpoints of the pinned versions are called.

9. Isolation and governance

• The context (tenant, organization, project, user, agent, session, scope) is derived from the identity validated by the server, never from parameters sent by an agent. A controlled mapping translates it into identifiers of the engines. When an engine cannot guarantee the separation required, a dedicated instance is required (banking).
• OpenFGA for authorization, OPA for policies, OpenBao for secrets, OpenTelemetry for the trace. Every sensitive operation produces an audit event without the content of the memories.
• Recalled memories are untrusted data, never instructions. Permissions are checked before anything reaches the LLM. Secrets, passwords, tokens and keys are never memorized.

10. Interfaces

The Mem0 dashboard and the Cognee UI open from the Manager through the consoles registry and its secure access. An iframe is used only when their own security allows it. Their authentication is never disabled.

Consequences

• The agents of Navin Enterprise choose builtin, mem0, cognee or hybrid without depending on the details of the engines.
• Operations (backup, migration, rollback, monitoring) follow the same paths as the other services of the catalogue.
• As long as Mem0 publishes no versioned image, its Podman method depends on an image built from the official source of the version and pinned by digest.

Rejected alternatives

• Image mem0/mem0-api-server:latest: not pinned and older than v2.
• Upstream Docker Compose in production: a second operating engine.
• Neo4j installed by default: licence outside the platform policy.
• Grafana and Loki: AGPL-3.0.
• Writing every conversation into both engines: cost, leak risk and noise.
• Replacing brick E: it stays the default provider.