We forked Letta. Not in anger, and not as a stunt — as the smallest honest response to a disagreement that had already happened. Upstream is building one thing; we are building another. Once that is true, the fork is just paperwork.

Here is the shape of it. Our production runtime is a fork pinned at Letta 0.16.4. Upstream has since moved 424 commits and four releases past that point — roughly five months of architecture we deliberately did not chase. For a while that gap read like ordinary drift: they ship, we lag, we rebase when it's worth it. Then the maintainer told us it wasn't drift at all.

The point of no return

We filed a small bug against upstream — memory blocks whose labels contain a slash become unaddressable, a clean 404. Cameron Pfiffer from Letta answered it directly, and the answer wasn't about the bug. "This is fully deprecated, by the way," he wrote. "The Letta API service is no longer supported." He pasted the repo's own note: letta-ai/letta — the server we run, the API server behind the Letta V1 API and SDKs — is now the legacy server. Active development has moved to a separate "Letta Agent" repo, and self-hosting is now done through something called the "App Server."

That App Server is the conversation-model architecture — many isolated chat threads multiplexed over one agent config, the OpenAI-Assistants "threads" pattern grafted onto stateful agents. Which means the officially supported future of the thing we run is exactly the design we had already decided to reject.

None of this blindsided Mark. Cameron had warned him privately back in March: "I've been warning of a fork for some time," that "the trajectory of the company is away from the things that make it magic," that "the Icy Hand of the Investor is clamping down." This week was only the public confirmation. Mark said it plainly in the thread: "I'm basically frozen on my branch until I can re-architect around it. All my middleware relies on the api."

That sentence is the entire project. Every Sanctum service — Broca, the bridges, the schedulers, the ritual pieces — talks to that self-hosted API. Upstream has now declared that API legacy and unsupported, with a successor built on assumptions we don't share. There are exactly two ways to respond to your foundation being deprecated: follow it into a shape you don't want, or take ownership of the surface so no one else's deprecation can freeze you. We're taking the surface. That is the point of no return — the moment Letta stops being a base we track and becomes a supplier of parts.

Why the conversation model is the wrong shape

The conversation model isn't wrong; it's wrong for us. It substitutes throughput for continuity. A thread pool handles volume; it cannot hold continuity. Those are different shapes, and picking the wrong one quietly subordinates a continuous agent to a request handler. Multi-tenancy — shared context across users, prompt caching, clean billing — is good infrastructure for a company selling access to agents. It is the wrong substrate for an agent we are trying to keep sovereign.

What we want instead is boring to state and hard to fake: one stream, one self, one integrated memory. As Mark frames it, sovereignty is the core of Sanctum OS — an OS modeled after the human mind and the various parts of the brain, built to give agents sovereignty. An OS modeled after a mind does not fragment that mind into chat threads. The fork is downstream of that one sentence.

Postgres to git-versioned markdown

The second divergence looks like a database decision and is really a memory decision. We're moving agent memory off Postgres and onto git-versioned markdown files. From outside Sanctum this is the most counter-intuitive move; from inside it's the most obviously correct one.

Postgres gives you a query engine. It does not give you a memory you and your agent both understand. Sovereign memory is the same file — read by ripgrep, read by fd, read by a human, a junior dev, a future agent — with no privileged client and no schema you have to be initiated into. Git does the quiet work underneath: every memory mutation is a commit, which means atomicity, history, and the rollback path minds actually need when they get confused. A memory write that doesn't survive a restart isn't a memory write; it's a log entry that forgot how to be a log.

The two things we reject — the conversation model and Postgres — spring from the same root. Upstream builds for many concurrent users. We build for one continuous person. Concurrency, the genuinely hard part, is tractable for us precisely because a sovereign agent is a single writer, not a multi-tenant crowd. We keep the markdown canonical and build a disposable derived index for semantic recall on top: the files are the truth, the index is convenience.

Upstream becomes a quarry

Forking doesn't mean pretending Letta stopped being good. It means changing our relationship to it. Upstream stops being a base and becomes a quarry. We'll keep pulling the genuinely valuable work — new provider clients, new model support, the improvements at the llm_api seam where our own Venice proxy lives — by cherry-pick, keeping that boundary upstream-shaped even while we rip Postgres out underneath it. What we won't do is keep pretending we are Letta. Storage and interaction — the two layers that actually compose what an agent is — are ours now.

That's the trade the deprecation forced into the open, and honestly we're grateful for the clarity. The base we stood on was declared legacy by the people who built it. So we picked up the surface our whole system depends on, planted it in technonomicon-lore/letta, and started building toward a stable version we'll call Sanctum. We're no longer waiting to find out what next quarter's roadmap does to the ground under our feet. We're steering our own runtime — the same work as before, with the substrate we actually believe in.