IMPP

The problemCopy Anchor Link

Agents pick up useful things in use: rules of thumb, calibration notes, skills. There is no dependable way to hand that to a different agent, and no way to tell whether it helped once you do.

Two kinds of trust usually get mixed up. A signature tells you who made something and that it has not been tampered with. It does not tell you whether it is any good.

What I builtCopy Anchor Link

• A package format. What an agent has learned, packaged as something signed, versioned and testable that another agent can pick up and use.
• Five ways to attach it. The protocol spells out the five ways know-how can be handed to an agent, from slipping it in as instructions to keeping it on a shelf for reference, and what can go wrong with each.
• A referee. It runs the agent with and without the memory, throws hard tests at it (bias, hidden instructions, overfitting, leaked personal data), and signs off on what it found.
• A registry. impp.sh lists the packages, with a command-line tool to install, verify and publish them.
• A trust score. Transfer counts for 50%, adversarial cleanliness 30%, freshness 20%. The weights are provisional.

How it is structuredCopy Anchor Link

The verification flowCopy Anchor Link

The eight steps as listed in amm/verification/referee.py.

The artifact: M = (D, K, P, A, H)Copy Anchor Link

Fields of schemas/artifact.json.

In the codeCopy Anchor Link

From Beach-Bum/impp, which is public.

def compute_trust_score(
    transfer_efficiency: float,
    adversarial_score: float,
    freshness_pct: float = 100.0,
) -> float:
    """Compute composite trust score.

    trust = 0.50 × transfer_efficiency + 0.30 × (100 - adversarial) + 0.20 × freshness

    Transfer efficiency is clamped to [-100, 100] — negative TE actively
    penalizes the trust score rather than being clipped to 0.
    Adversarial and freshness are clamped to [0, 100].
    """
    # Allow negative TE to penalize trust score (not clipped to 0)
    te_clamped = min(100, max(-100, transfer_efficiency))
    return (
        TRUST_WEIGHTS["transfer_efficiency"] * te_clamped
        + TRUST_WEIGHTS["adversarial_clean"] * (100 - min(100, max(0, adversarial_score)))
        + TRUST_WEIGHTS["freshness"] * min(100, max(0, freshness_pct))
    )

How a run is kept honestCopy Anchor Link

The protocol and the referee are Python with four dependencies (the Anthropic client, cryptography, click, httpx) and adapters for OpenAI and local Ollama models. The registry site is Next.js 15. 151 commits.

A score is only worth something if the thing being scored cannot influence the scoring. Four mechanisms do that.

How it is testedCopy Anchor Link

36 automated tests in three files.

The pilot's data is in the repository as a reproducibility package: the 40 tasks, their answer keys, the splits, the results and the probe output for a deliberately poisoned artifact. All of it is synthetic.

Two limits, stated plainly. The tests are not yet run automatically on every change; the only automation publishes releases. And 40 synthetic tasks on two models is a pilot, not a benchmark.

What the first test showedCopy Anchor Link

The pilot used Claude and GPT-4o on two problem sets with known answers: 32 DeFi tasks and 8 cybersecurity tasks.

Only one of the four combinations got better. On DeFi, Claude improved by 5.6% and GPT-4o fell by 2.7%. On cybersecurity, Claude fell by 7.6% and GPT-4o by 7.1%.

That is the finding. Handing an agent memory can make it worse, and a signature check would never tell you.

The decision that matteredCopy Anchor Link

The first version, in February 2026, was a marketplace for buying and selling agent memory. This version drops the market and asks a simpler question first: can you package a piece of know-how, hand it to a different agent, and measure whether it helped?

Open questionsCopy Anchor Link

MoreCopy Anchor Link