The Exolex Architecture: Persistent Identity, Permanent Memory, and a Burnable Owner Binding for a Single-User Web Agent

A web agent built for one person faces a requirement ordinary web software does not: it must not forget that person. Consumer web practice runs the other way — sessions expire, browser storage is cleared, addresses rotate, devices are replaced — and an application that worked last week greets a returning user as a stranger. For a single-user agent — an exolex — that ordinary forgetting is a failure of the central promise. This paper describes an architecture, built and proven live, that removes forgetting from a web agent on an ordinary serverless stack: a Cloudflare Worker backed by a key-value store. Identity is a server-minted durable token of 128 bits, carried by two self-healing legs — an HttpOnly cookie re-issued on every response, and a backup copy held by the client and returned with each request — so loss of either leg is repaired by the other. Conversation and a distilled notebook are stored server-side under that identity, with no time-to-live. The maker's devices are bound permanently through a knowledge handshake whose completion writes an owner record with no expiration and no address condition. That binding is revocable per device through a registry carried on the binding itself, effected by a tombstone that owner resolution must respect. Forgetting, where it remains, is made truthful: a forgetting operation erases the conversation and notebook on the server, where memory now lives, and it can never remove the owner binding. Every mechanism was proven live on test identities. The maker's own handshake had not been performed at build time, and no claim depends on it having been. The build required no new spend, reusing an existing key-value namespace and worker infrastructure. The paper also records the system's honest limits, including an inherited idle expiry on one shared thread, tracking protection that can block the cookie leg, and the store's eventual consistency. Keywords: persistent identity; server-side memory; single-user agent; serverless architecture; key-value storage; device binding; revocation; truthful deletion