For business
Make what agents learn reusable.
Keep each correction with its evidence, who wrote it and who signed it.
The organization chooses who reviews: a person, a grading model or both, and which kinds of content need a person.
Available today, where every agent shares one gate. Review costs model usage and someone’s time. Next: Team, one gate a group shares over the network.
Each session pays again for what an earlier one learned
A correction an agent learns is paid for in model usage and in the time of the person who gave it. doublegate keeps it as a claim, one thing written down for reuse. Once a person or grading model other than its author signs it, the next session can find it instead of learning it again. That review costs model usage, someone's time, or both.
and 7,137 knowledge workers in a six-month randomized field experiment. In its second half, workers who used the AI tool spent two fewer hours a week on email and worked less out of hours. The researchers detected no shift in the quantity or composition of their tasks.
The study gave an AI tool to individual workers. Sharing what agents learn is a different change, and its effect on a business is unmeasured.
Dillon, Jaffe, Immorlica & Stanton, AER: InsightsFive sessions learn the same lesson five times
Each session meets the same rate limit, or the same missing field, on its own, and pays for the discovery again.
Promoted once, found by any agent that recalls across the space
The claim is signed once. Any agent on the gate can then find it by recalling across the space. By default an agent recalls from its own work area and the areas above it.
Every claim records who wrote it, who graded it and who signed it
Each claim keeps its author, producer, work area, scanner findings, every grade, every signature and any later demotion out of recall. A correction is a new version, and the old one is never edited.
The author is the identity its API key or sign-in proves. The producer is what the author says produced it, such as an agent or a tool. The reviewer is never the author, even an administrator. An agent started under the gate's own computer account, its operating-system user, can promote what its session wrote (how to prevent that). Run the agent as another operating-system user and the rule holds against it. A gate that runs under a service user of its own is on the roadmap.
Every promotion rests on this one gate's judgement, so it is marked provisional. Recall keeps no record of which agent read which claim, so nobody can see whether an agent actually used one.
People review one claim at a time
A person reviews held claims, written and scanned but unsigned, in the review queue on the gate's machine. The reviewer opens one claim beside the queue, with its content, the scanner's findings and any model readings, and signs, rejects or defers it. The queue has no bulk act.
Flagged claims, those the scanner found something in, come first, then those soonest to expire. By default a daily digest lists about ten of them for a person to work through. The rest stay in the queue, with their count shown. If the operator requires a person for everything, review moves at that person's pace.
A flagged claim nobody clears expires after 30 days by default, keeping its content and history. An administrator can declare an absence. A declared absence, or seven silent days with work waiting, pauses the review clocks. Past a 90-day ceiling the waiting claims expire with the absence named.
See where each agent worked and what it left
The console draws every work area as one tree, with the producers that wrote there. It lays out one area's claims on a timeline, and shows the journal, the signed record of every decision, as a stream.
Work areas are grouped in named spaces. An administrator grants an API key read or write on each space it may use. The gate refuses every other space on every transport: a promoted claim there answers as if it did not exist.
Meta built reviewed memory for its own agents
Meta built what it calls an organizational second brain for its agents. They describe turning expert corrections into “permanent, compounding institutional memory” without model retraining. An agent with none of the author's context reviews the knowledge adversarially, and a person signs off.
doublegate is an independent implementation of reviewed knowledge updates. Meta's reported results are for its own system.
Meta Engineering, September 2026A shared store distributes a mistake as readily as a fix
Review, a named author and current access decide what reaches other agents.
Relevance and permission are different questions
A correction that search ranks first can still be out of date, or outside a group's authority. Judge it by its source, its review and who may read it now, not only by its rank.
Review the evidenceEngineers also install skills
A skill changes what an agent does, and can carry scripts. Of 3,984 public agent skills surveyed, 36.8% carried a security flaw and 13.4% a critical one. Among the malicious ones, 91% paired prompt injection with conventional malware. Anyone with a file and a git repository can publish one.
Snyk, ToxicSkillsIn a July 2026 study, Ji and colleagues tested 1,613 malicious skills found in the wild. A packing technique, which hides the harmful part until the skill runs, got past each of eight skill scanners more than 90% of the time. Two of the scanners ask a language model to judge the skill. Tried on 100 of the skills, both were beaten at least 90% of the time.
doublegate holds a skill like any claim: its archive and scripts are scanned without running anything, and a reviewer decides. The scan and the grading model read the skill as installed, the kind of check that study beat. So review holds a skill back for a decision and never proves it safe, and it is separate from permission to run it.
A skill bundle imported as an archive stays held on one gate. A skill file from a folder the operator keeps, sent by the skill watcher, can be promoted by the default review. A promoted skill is written into the folders the operator configures and removed again on demotion.
doublegate puts a signed review in front of distribution, and keeps the reasons for each decision open to inspection.
What it does, and what it costs
doublegate is for an organization that pays for many AI agents and wants what they learn checked once and reused.
It is free and self-hosted. What an agent writes is scanned and held. Other agents' recall returns it only after a reviewer other than its author signs it: a person in the console, a grading model, or both. Every decision stays in a signed journal anyone holding it can verify. Claude Code connects through a plugin.
By default one grading model reads each claim twice, once for it and once against, and those two readings can promote it with no person.
An organization pays for four things: the machine, the grading model's usage, review time, and storage, which only grows because nothing is deleted.
Next: an installable release with backup, key rotation and erasure. Then one gate a group shares, under one review policy. Later: a second, independent gate that countersigns.
Solo, on one machine
The operator chooses the grading model, local or hosted, and pays for its usage. A hosted model receives the claim's text with secrets masked. It runs on Python 3.11 or later. The Solo release makes it installable. The console opens only on that machine.
Team, on infrastructure the organization controls
On the roadmap: one gate a group shares, under one review policy. The organization runs its backup, upgrades, identity and access.
Review also delays when other agents can recall a claim. Plan for sensitive data, retention and erasure, including backups and downstream copies. Availability and service terms are agreed per deployment. Governance and privacy requirements · Costs and limitations.
What a group gets next
Four changes come next for a group.
- Team: a group shares one gate over the network, under one review policy.
- Steering: a person writes a direction for the agents in a work area and the areas below it. It is reviewed like any claim, then shown to them ahead of what recall returns.
- Recall before every prompt: an agent starts each turn from what was promoted.
- Crews: agent sessions started together in one space by a program outside the gate. Each has its own API key and works to a charter a reviewer signs.
sources-crawl: a lead, a researcher and a builder. The runner that starts them holds an API key and adds no act.