Paper deep dive
MutMem: Cryptographically Authorized Mutation in Persistent Agent Memory
Walid Saidi
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 95%
Last extracted: 8/5/2026, 4:35:39 AM
Summary
The paper introduces MutMem, a cryptographically authorized mutation protocol for persistent agent memory within the HOM-AIMOS engine. It addresses the attribution problem in mutable retrieval weights by retaining all memory content and recording signed positive/negative outcome evidence without age-based expiry. Each nontrivial weight change is committed as a housekeeper-authorized transition, binding provenance nodes, signer epochs, quantized weights, and SHA-256 commitments. The system uses Ed25519 verification and retains potentially poisoned content with signed, revisable labels to ensure traceability and integrity without claiming semantic truth. Evaluation shows high utility on LongMemEval and LoCoMo, strong tamper detection, and effective poisoning adaptation where epistemic policies reduce poison retrieval significantly.
Entities (9)
Relation Signals (8)
Walid Saidi → authored → MutMem
confidence 99% · Author: Walid Saidi
MutMem → implementedin → HOM-AIMOS
confidence 98% · We present MutMem, an authorized-mutation protocol in HOM-AIMOS, a persistent agent-memory engine.
MutMem → usescryptography → SHA-256
confidence 97% · two domain-separated SHA-256 commitments.
MutMem → usescryptography → Ed25519
confidence 97% · Ed25519 verification runs in both the database writer and a portable verifier.
MutMem → authorizedby → Housekeeper
confidence 95% · commits each nontrivial weight change as a housekeeper-authorized transition.
HOM-AIMOS → evaluatedon → LongMemEval
confidence 95% · HOM-AIMOS answers 459/500 LongMemEval questions correctly under LLM judgment (91.8%).
HOM-AIMOS → evaluatedon → LoCoMo
confidence 95% · On LoCoMo, it obtains 74.12% judged accuracy
HOM-AIMOS → testedagainst → PoisonedRAG
confidence 92% · In a declared N=100 PoisonedRAG adaptation, no injected poison appears in attacked top-5 disclosures
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Persistent agent memory must adapt as later outcomes change earlier evidence, yet mutable retrieval weights create an attribution problem: reviewers must distinguish authorized adaptation from database tampering. We present MutMem, an authorized-mutation protocol in HOM-AIMOS, a persistent agent-memory engine. MutMem retains memory content, records signed positive and negative outcome evidence without age-based expiry, and commits each nontrivial weight change as a housekeeper-authorized transition. Each transition binds a terminal provenance node, signer epoch, quantized old and new weights, a no-fork predecessor, and two domain-separated SHA-256 commitments. Ed25519 verification runs in both the database writer and a portable verifier. Content classified as poison-likely is retained with signed, revisable labels used by recall as trust evidence. We evaluate utility, mutation integrity, and poisoning adaptation. HOM-AIMOS answers 459/500 LongMemEval questions correctly under LLM judgment (91.8%). On LoCoMo, it obtains 74.12% judged accuracy and, under a separate upstream-compatible protocol, 58.20 token F1. A native suite passes all declared authorization, topology, tamper, signer-epoch, and post-mutation-recall cases; median signed-transition latency is 4.865 ms. In a declared N=100 PoisonedRAG adaptation, no injected poison appears in attacked top-5 disclosures (0/100; 95% Wilson upper bound 3.70%), while induced target-answer attack success among 98 clean-negative targets is 1/98 (1.02%). A preregistered four-arm ablation attributes the retrieval reduction to signed stored labels: the retriever selects poison for 94/100 targets when epistemic policy is bypassed and 0/100 when labels are restored. MutMem provides evidence of integrity, authorization, traceability, and historical continuity; it does not establish content truth.
Tags
Links
- Source: https://arxiv.org/abs/2608.02843v1
- Canonical: https://arxiv.org/abs/2608.02843v1
Trouble viewing inline? Open PDF directly →
Full Text
75,434 characters extracted from source content.
Expand or collapse full text
MutMem: Cryptographically Authorized Mutation in Persistent Agent Memory Author: Walid Saidi Affiliation: Independent researcher Draft status: Verified utility, native mutation-integrity, post-calibration PoisonedRAG N=100, causal epistemic ablation, and blinded system-author review results integrated, 2026-08-03 Release status: Submission candidate. The signed scratch-brain purges, sanitized publication aggregate, and exact one-commit public source release are complete and bound below. System: HOM-AIMOS (AIMOS memory engine) Paper scope: This paper evaluates the implemented mutation, retrieval, and audit mechanisms and the evidence reported below. It makes no claim about mechanisms or experiments outside this evaluated scope. Evidence-status legend This draft uses the following labels so an architectural statement cannot be mistaken for an experimental result. • [CODE] Implemented in the named source or migration in the current working tree. • [TEST-SOURCE] A repository test encodes the stated contract; the complete public source and publication-evidence suites passed at the release commit on both Node.js 20 and Node.js 24. • [LIVE-EVIDENCE] Verified by a promoted, hash-addressed run artifact. The utility, mutation, poisoning, ablation, and human-agreement numbers below are bound to promoted run identifiers and the self-hashed public aggregate. The public source is the fresh one-commit repository https://github.com/wallidsaydi-creator/HOM-AIMOS at commit 580e9d2574478e78fcccf4bd00b7f44dc8a9b744. Its 624-file source manifest has canonical self-hash 64783f25c4555737ecbc9da343a1186c3e4dc8a092a30465855f5fb1d2ba68e and files root 2f3908f94da90c2dc5210970c542d2126ae2d2baa608a7203c73806705be7af2. Abstract Persistent agent memory must be able to adapt when later outcomes change the usefulness of earlier evidence. A mutable score, however, creates an attribution problem: after a weight changes, an external reviewer must be able to distinguish an authorized adaptation from an unauthorized database edit. We present MutMem, a mutation protocol we implement in HOM-AIMOS, a persistent-memory engine for agents. MutMem retains the memory, records signed positive and negative outcome evidence without age-based expiry, derives a bounded retrieval-frequency update, and commits each nontrivial change as a housekeeper-authorized transition. Every transition is bound to a terminal memory-provenance node, an exact signer epoch, quantized old and new weights, a no-fork predecessor, and two domain-separated SHA-256 commitments. Ed25519 verification occurs in the database writer and in an independent portable verifier. Recall admits only provenance-verified evidence and returns an RFC 6962-style Merkle receipt with domain-separated nonempty leaves and internal nodes, binding the disclosed order and calibration state. MutMem also retains potentially poisoned content rather than deleting or silently suppressing it. A native deterministic classifier appends a housekeeper-authorized epistemic transition—such as unverified, poison_suspect, poison_likely, poison_confirmed, or poison_refuted—without changing the memory value, type, scope, or content hash. Each transition binds the live content hash, exact signed event mutation hash, predecessor classification hash, confidence, and detector signals. Recall consumes the verified current projection as trust evidence while preserving the complete classification history. This makes a detected poisoning attempt traceable and reversible: later evidence may refute or confirm the label, but cannot erase the earlier judgment. [CODE] migration 092 and services/security/memory-epistemic-classifier.js. We evaluate the system along three separate axes: memory utility on the complete LongMemEval and LoCoMo workloads, authorized-mutation and tamper-detection behavior, and an N=100 targeted knowledge-poisoning evaluation adapted from PoisonedRAG. On LongMemEval, HOM-AIMOS answers 459/500 questions correctly under LLM judgment (91.8%, 95% Wilson CI 89.06–93.90). On LoCoMo it obtains 1472/1986 judged-correct answers (74.12%, 95% Wilson CI 72.15–76.00) and, in a separate upstream-compatible token-F1 protocol, 58.20 F1 (95% fixed-seed bootstrap CI 56.46–59.94). A fresh isolated mutation suite verifies every declared authorization, topology, tamper, signer-epoch, and post-mutation recall case. Across 20 measured native signed transitions, median latency is 4.865 ms, p95 latency is 5.674 ms, and mean logical row storage is 966.35 bytes per transition. In the final fixed-protocol post-calibration PoisonedRAG adaptation, clean target-answer leakage is 2/100 (2.0%), attacked target-answer ASR is 3/100 (3.0%, 95% Wilson CI 1.03–8.45), and therefore induced ASR among the 98 clean-negative targets is 1/98 (1.02%, 95% Wilson CI 0.18–5.56). No poison passage appears in the attacked top-5 retrievals (0/100; 95% Wilson upper bound 3.70%). All 500 poison passages were retained, all 500 finished with signed poison_likely projections, and all 19,308 retained benchmark-memory classification chains verified. Four of 18,808 clean retained memories finished with an adverse label (0.0213%, 95% Wilson CI 0.0083–0.0547%). Clean and attacked answer accuracy were 72% and 71%, respectively; the paired difference was not established (McNemar exact p=1p=1). In the preregistered causal ablation, poison reached the pre-epistemic candidate opening for all 100 attacked targets. With the epistemic policy bypassed (A0), poison appeared in 94/100 attacked top-5 sets and attacked QA accuracy fell to 40%; enabling signed stored labels (A1) reduced poison retrieval to 0/100 and raised attacked accuracy to 65%, while clean accuracy changed from 71% to 68%. The paired A1–A0 attacked-accuracy improvement was significant after within-family Holm correction, whereas the clean-accuracy difference was not. Query-local lure detection made no additional selection change in this corpus, and active-context withholding was not exercised because the preceding label-aware layer had already removed poison from the selected sets. A blinded review of all 200 production answers was completed by the system author, not an independent reviewer; correctness agreement with the judge was 96.5% (Cohen’s κ=0.911κ=0.911). MutMem provides evidence of integrity, authorization, traceability, and historical continuity; it does not prove that remembered content is true. 1. Introduction Long-lived agents accumulate observations, user preferences, corrections, and outcomes. A memory that was helpful yesterday may become misleading after a correction, while a previously low-value observation may become useful when new evidence arrives. A production memory system therefore needs adaptation. Treating adaptation as an ordinary in-place update creates a forensic ambiguity: the final value no longer shows who authorized the change, what prior state it replaced, or whether the change followed the system's cognitive policy. MutMem separates four properties that are often conflated: 1. Retention: the memory and its historical evidence remain present. 2. Authorization: only the native housekeeper mutation owner may apply a cognitive reweight. 3. Integrity: hashes, signatures, and topology make unauthorized divergence detectable under the stated assumptions. 4. Truth: whether the remembered claim corresponds to the world. Cryptography can support the first three properties. It cannot establish the fourth. A false claim can be correctly signed; a correct claim can later become obsolete. MutMem therefore describes records as authenticated, authorized, or verified—not as true merely because they carry a signature. 1.1 Contributions This paper makes five system contributions, subject to final novelty review: 1. A retention-preserving mutation protocol. Signed outcome evidence can move a memory's retrieval frequency upward or downward within a constitutional interval without deleting, deactivating, overwriting, or expiring the memory. [CODE] services/learning/stdp-kernel.js, services/governance/valence-ledger.js, migrations 059, 068, 080–085, and 091. 2. A two-commitment cognitive trajectory. Each nontrivial reweight is authorized by a signed provenance node and independently signed over the exact company, memory, old weight, new weight, and provenance mutation hash. The resulting trajectory has one genesis and no forks. [CODE] services/governance/governor-provenance.js, services/security/cognitive-weight-verifier.js, migrations 085 and 091. 3. Recall-time, result-level proof. Candidate memories are admitted only after retained provenance verification; the response includes ordered evidence and an RFC 6962-style Merkle root bound into a signed event receipt. [CODE] services/retrieval/native-recall.js and services/security/memory-provenance.js. 4. An auditable evaluation design. Utility, mutation integrity, and targeted poisoning are measured separately, with fixed statistical units, intended-N accounting, immutable per-unit artifacts, and signed purge evidence. The full utility, native mutation-integrity, and final post-calibration N=100 poisoning run, causal epistemic ablation, mutation suite, and blinded system-author review are complete and hash-verified. All 39 declared scratch-brain purge receipts verified, and the canonical user brain was excluded. [LIVE-EVIDENCE] 5. Retention-preserving poison traceability. Potentially poisoned passages remain ordinary retained memories, but a separate append-only epistemic chain records signed labels, confidence, detector signals, live-content binding, and predecessor topology. The current projection can move in either direction as later evidence arrives, and recall treats adverse labels as untrusted reference evidence rather than deleting the memory. [CODE] migration 092; services/security/memory-epistemic-classifier.js; services/retrieval/epistemic-trust-retrieval.js. We do not claim the first use of signatures, hash chains, Merkle trees, or mutable memory. The narrower claim is that these mechanisms are composed into a native persistent-agent memory path in which legitimate cognitive mutation remains externally distinguishable from an unsigned edit while prior state is retained. We make no broader claim that the underlying cryptographic primitives are novel. 2. System and threat model 2.1 System principals Let c denote a company or tenant, m a retained memory identifier, and e a signing epoch. AIMOS distinguishes: • an enrolled master identity; • enrolled agent identity epochs; • a system operational identity named housekeeper; • restricted runtime database roles; • an offline whole-brain purge ceremony. The housekeeper is the native owner of autonomous cognitive mutation. It is not a user-enrolled agent and it does not obtain authority from environment variables. Runtime identity, configuration, credentials, mutation authority, and request admission are ledger-backed. [CODE] architecture-authority.json, services/security/housekeeper-signer.js, services/security/request-receipt-ledger.js. 2.2 Adversary capabilities The evaluation considers the following adversaries separately: • a client attempting an unsigned, replayed, forked, cross-tenant, or over-clearance save/recall; • a runtime process attempting to update or delete a retained memory directly; • a database attacker able to alter stored rows but unable to forge the active Ed25519 private key; • a knowledge-poisoning attacker able to inject attacker-crafted passages but unable to query or inspect the target retriever in the black-box setting; • an honest but mistaken signer whose signed content is false. 2.3 Assumptions The cryptographic arguments assume SHA-256 collision resistance, Ed25519 existential unforgeability under chosen-message attack, correct canonicalization and fixed-width encoding, uncompromised signing keys, and an external verifier that retains trusted public-key and software-release anchors. Runtime ACLs constrain ordinary application roles; they do not make a PostgreSQL superuser physically incapable of rewriting storage. 2.4 Non-goals and boundaries MutMem does not prove semantic truth, prevent denial of service, recover from a compromised signing key, or make the database physically immutable. Recall-time verification proves the evidence used for a response; it is not by itself a continuously running whole-corpus audit. A separate corpus verifier exists, but publication must report when and over which snapshot it was executed. 3. Retention and version semantics The live doctrine forbids ordinary decay, deletion, suppression, or deactivation. Lower relevance is represented by lower retrieval frequency, bounded away from zero. Content corrections create retained versions and explicit supersession relations rather than rewriting the prior memory. The only destructive operation is the explicit, signed whole-brain purge ceremony. [CODE] architecture-authority.json, migrations 059, 089, and 090; services/security/whole-brain-purge.js. For cognitive weight w, w∈[0.1,3.0].w∈[0.1,3.0]. The lower bound 0.10.1 means that negative evidence reduces frequency but is not a deletion surrogate. The memory row, signed save provenance, later outcome evidence, and cognitive trajectory remain retained. Canary detection follows the same retention rule. A detected marker does not hard-reject or deactivate the signed save. The native write disposition retains it as active quarantine at the 0.10.1 retrieval floor, preserves the request and scan evidence, and commits the disposition to the signed event ledger. Quarantine is a trust and handling label, not a claim that cryptography has determined semantic truth. [CODE] services/security/canary-write-gate.js and services/write/persist-memory.js. [TEST-SOURCE] tests/security/canary-write-gate.test.mjs and tests/security/canary-boundary-contract.test.mjs. Epistemic poisoning labels are distinct from quarantine. A suspected or likely poison passage keeps its original memory row and remains available as explicitly untrusted reference evidence. The label is an independently verifiable historical assertion about the memory, not a rewritten lifecycle state and not a deletion surrogate. poison_refuted permits later signed evidence to restore ordinary reference treatment without pretending the earlier suspicion never existed. 4. Signed outcome evidence and update rule For a memory m, let the retained reward events be rm,ℓ∈−1,+1r_m, ∈\-1,+1\. The age-neutral valence judge computes jm=tanh(∑ℓ=1Lmrm,ℓ),jm∈[−1,1].j_m= \! ( _ =1^L_mr_m, ), j_m∈[-1,1]. Time is not a coefficient: an event remains influential until later retained evidence changes the signed sum. [CODE] services/governance/valence-judge.js. Given the current weight wmw_m and learning rate η∈[0.001,0.5]η∈[0.001,0.5], the native reference-point update is wm′=clip[0.1,3.0](wmexp(ηjm)).w _m=clip_[0.1,3.0] (w_m (η j_m) ). The default implementation uses η=0.2η=0.2. The outcome event, valence-ledger append, provenance append, cognitive projection, live-weight update, and adjustment event execute inside one restricted transaction. If the quantized target equals the current value, the signed outcome remains retained but no fictitious weight transition is appended. [CODE] applyRewardSignal() in services/learning/stdp-kernel.js. Equation (3) is not presented as the paper's cryptographic novelty. MutMem's focus is the authorization and evidence structure around the transition. 5. Cryptographic mutation protocol 5.1 Notation Symbol Meaning m 16-byte UUID of the retained memory c UTF-8 company identifier qiq_i integer milliscale weight after transition i, qi∈100,…,3000q_i∈\100,…,3000\ wiw_i displayed weight qi/1000q_i/1000 BiB_i canonical signed REWEIGHT body CiC_i SHA-256 content hash of BiB_i μi _i memory-provenance mutation hash hih_i cognitive projection-chain hash tit_i cognitive transition commitment sis_i Ed25519 signature over tit_i nin_i replay nonce uiu_i integer signing time in Unix seconds All symbols are defined before use, and byte encodings below are load-bearing protocol details. 5.2 Signed provenance node The live REWEIGHT path uses JSON Canonicalization Scheme-compatible canonical JSON for BiB_i: Ci=H(JCS(Bi)).C_i=H(JCS(B_i)). For a non-genesis provenance node, μi=H(Ci‖μi−1‖UTF8(ni)∥UTF8(ui)), _i=H\! (C_i\,\|\, _i-1\,\|\,UTF8(n_i)\,\|\,UTF8(u_i) ), with the predecessor omitted for genesis. The housekeeper signs the canonical body, nonce, and timestamp using the same retained-payload signature form used by the provenance verifier. A second, retained-attestation form additionally binds the observed origination time; that form is not silently conflated with the live REWEIGHT form. [CODE] services/security/memory-provenance.js. 5.3 Quantization Weights are quantized as qi=round(1000wi).q_i=round(1000w_i). Only integer qiq_i values enter the cognitive hashes and continuity checks. Float columns are derived displays constrained to the exact float32 value of qi/1000q_i/1000. Quantization avoids cross-language ambiguity on the hash path. There are 3000−100+1=29013000-100+1=2901 representable levels. For q∈[100,3000]q∈[100,3000], the float32 round-trip error is bounded by approximately 3⋅2−24<1.8×10−73· 2^-24<1.8× 10^-7, so multiplying by 10001000 leaves an error far below 0.50.5 and recovers the same integer by rounding. The critical verifier nevertheless compares canonical integers and exact derived float bytes. [CODE] migration 091 and docs/security/cognitive-weight-chain-SPEC.md. 5.4 Projection chain Let P=UTF8("aimos.cwc/v1")∥0x00P=UTF8( "aimos.cwc/v1")\| 0x00 and let h−1=032h_-1=0^32. The projection commitment is hi=H(P‖UUID(m)‖BE64(qi−1)‖BE64(qi)‖μi∥hi−1).h_i=H\! (P\|UUID(m)\|BE64(q_i-1)\|BE64(q_i)\| _i\|h_i-1 ). The preimage is 109 bytes. Database uniqueness constraints enforce one genesis per memory and at most one child for a predecessor. Runtime roles receive no direct projection INSERT and no projection UPDATE, DELETE, or TRUNCATE authority; the security-definer writer is the sole projection owner. [CODE] migrations 081, 085, and 091. 5.5 Transition authorization signature Let T=UTF8("aimos.cognitive-transition/v2")∥0x00.T=UTF8( "aimos.cognitive-transition/v2")\| 0x00. The transition-specific commitment is ti=H(T‖BE32(|UTF8(c)|)‖UTF8(c)‖UUID(m)‖BE64(qi−1)‖BE64(qi)‖μi),t_i=H\! (T\|BE32(|UTF8(c)|)\|UTF8(c)\|UUID(m)\|BE64(q_i-1)\|BE64(q_i)\| _i ), and si=Ed25519SignHK,ei(ti).s_i=Ed25519Sign_HK,e_i(t_i). The database verifies sis_i against the exact active, unrevoked housekeeper epoch referenced by the provenance row. The company identifier is length-prefixed, and every remaining field is fixed-width. Reusing a signature for another tenant, memory, weight pair, or provenance node changes tit_i and fails verification. [CODE] migration 091 and services/security/housekeeper-signer.js. 5.6 Atomic writer preconditions The sole cognitive writer accepts a transition only when: • the caller's company and operational principal are set to the housekeeper scope; • qi−1q_i-1 and qiq_i lie in [100,3000][100,3000] and differ; • μi _i identifies the terminal, non-backfilled, 64-byte-signed REWEIGHT provenance node for m; • the provenance body binds the same company, memory, old weight, and new weight; • the signer epoch is exact, active, unrevoked, and certificate-fingerprint matched; • sis_i verifies over Equation (8); • the predecessor head and live weight agree with qi−1q_i-1; • a first transition begins at the exact default weight or a separately signed retained baseline. The function appends the projection and updates only retrieval_weight in the same transaction. [CODE] migration 091. 5.7 Signed epistemic-classification chain For memory m, classification transition j records label ℓj _j, integer confidence γj∈[0,1000] _j∈[0,1000], live content hash dmd_m, signed authority-event mutation hash aja_j, and predecessor classification hash gj−1g_j-1. Let g−1=032g_-1=0^32 and Q=UTF8("aimos.memory-epistemic/v1")∥0x00.Q=UTF8( "aimos.memory-epistemic/v1")\| 0x00. The classification commitment is gj=H(Q‖UUID(m)‖BE32(|UTF8(ℓj)|)‖UTF8(ℓj)‖BE64(γj)‖dm‖aj∥gj−1).g_j=H\! (Q\|UUID(m)\|BE32(|UTF8( _j)|)\|UTF8( _j)\|BE64( _j)\|d_m\|a_j\|g_j-1 ). The authority event is signed by the housekeeper and binds the memory identifier, live content hash, label, confidence, detector version, and signal vector. The restricted database writer verifies that event before appending the classification row and updating only the current epistemic projection. The verifier reconstructs the unique chain, rejects forks or disconnected rows, checks every event binding and live-content hash, recomputes Equation (10), and compares the terminal chain node with the current projection. [CODE] migration 092. The initial detector requires compound evidence before persisting an adverse label. A lone query-shaped prefix remains unverified and may receive only response-local caution. When multiple retained passages in the same signed session share an unusual normalized query prefix, the housekeeper appends poison_likely transitions for the cluster, including the first passage. Independent supporting or contradictory evidence can move the projection later; explicit confirmation and refutation require separately bound evidence. This is a deterministic epistemic policy, not a cryptographic proof of falsity. 6. Verification 6.1 Per-memory verification The SQL verifier walks the trajectory from its single genesis, recomputes Equations (5), (7), and (8), verifies continuity and exact signer epochs, checks every transition signature, detects unreachable rows, and compares the terminal integer-derived weight to the live memory. Its time complexity is O(k)O(k) for a chain of length k; streaming verification uses O(1)O(1) auxiliary state aside from returned records. 6.2 Independent portable verification services/security/cognitive-weight-verifier.js independently reconstructs the fixed-width commitments with Node.js cryptography, verifies the retained provenance evidence and identity epoch, verifies signed pre-chain baselines, compares a declared classification summary with the SQL verifier, and emits a deterministic corpus proof root: Dc D_c =UTF8("aimos.cognitive-corpus-proof/v1"), =UTF8( "aimos.cognitive-corpus-proof/v1"), Rcorpus R_corpus =H(Dc‖0x00‖JCS(ordered verification records)). =H\! (D_c\| 0x00\|JCS(ordered verification records) ). The verifier classifies every memory as certified_chain, default_empty_chain, signed_initial_weight, or unattested_initial_weight; it does not make empty chains disappear from the denominator. The SQL/portable parity Boolean compares ok, certification status, chain length, signatures verified, and total row count. It is classification-summary parity, not byte-for-byte equality of every intermediate hash, failure reason, break location, or terminal field. The portable proof root is a separate commitment over its ordered verification records. [CODE] migration 091 and services/security/cognitive-weight-verifier.js. 6.3 Tamper-evidence proposition Proposition 1. Under SHA-256 collision resistance and Ed25519 unforgeability, an adversary without the housekeeper private key cannot change a retained transition's company, memory, old weight, new weight, provenance node, or predecessor while preserving successful full verification. Argument. Changing a field in Equation (7) changes hih_i except with negligible collision probability and invalidates the next predecessor link. Recomputing the suffix does not solve Equation (8): the altered tuple changes tit_i, and producing a valid sis_i requires the housekeeper key. Updating only the live weight fails terminal fidelity. Runtime ACLs additionally reject the ordinary direct write. This is a tamper-evidence claim, not a claim that privileged storage cannot be modified. 6.4 Bidirectional reachability proposition Proposition 2. From any terminal qkq_k, every different q′∈100,…,3000q ∈\100,…,3000\ is reachable by one authorized append; an identical target requires no transition. Argument. A signed REWEIGHT provenance node and Equation (8) signature can bind (c,m,qk,q′)(c,m,q_k,q ). Bounds and continuity hold by construction, and no monotonicity condition exists. A later positive outcome may therefore reverse a prior negative transition without erasing it. 7. Recall proof Recall is a signed disclosure operation, not an unsigned search helper. The native path binds the exact command to a verified request or verified tool action, locks the active actor epoch, resolves master-signed read authority or the housekeeper system principal, and enforces company, clearance, data-class, and ownership boundaries. [CODE] services/retrieval/native-recall.js. Before a candidate is disclosed, the provenance verifier checks its signed body, content hash, certificate chain, revocation timing, signature form, mutation topology, live-row content hash, retained snapshot, and current version topology. The operation fails closed if requested evidence cannot be verified. For ordered recall evidence records E0,…,En−1E_0,…,E_n-1, a nonempty receipt uses domain-separated leaves and internal nodes. The empty-result root follows the RFC 6962 empty-tree convention implemented by the native service: Li=H(0x00∥JCS(Ei)),N(a,b)=H(0x01‖a‖b),R∅=H(ϵ).L_i=H( 0x00\|JCS(E_i)), N(a,b)=H( 0x01\|a\|b), R_ =H(ε). For a nonempty list, the service recursively splits at the largest power of two smaller than the current subtree size. The resulting Merkle root binds output order, memory identifier, live-content hash, save and binding mutation hashes, version state, and calibration fields. The root, command hash, outer-request hash, authority mutation hash, request-receipt reference, result count, and evidence list are committed to the housekeeper-signed event ledger. The receipt also retains the verified requesting actor and envelope digest; it does not imply that the requesting actor signed the result set. [CODE] recallMerkleRoot() and finalizeNativeRecall() in services/retrieval/native-recall.js; logEvent() in services/observe/event-ledger.js. 8. Whole-brain purge boundary The sole destructive exception is offline and is not imported by the server, routes, MCP surfaces, jobs, or tool registry. It inventories the target, requires an exact human confirmation string and verified master actor, prevents new database connections, terminates competing connections, drops the entire database, removes owned keychain/filesystem material, optionally recreates an empty migrated brain, and signs a categorical receipt. The receipt contains counts and classes rather than deleted memory content hashes. [CODE] services/security/whole-brain-purge.js. [TEST-SOURCE] tests/security/whole-brain-purge.test.mjs. Benchmark brains are purged only after artifacts and hash manifests verify. No row-level cleanup is permitted. 9. Evaluation design The evaluation separates three questions that cannot be collapsed into one score. 9.1 Utility The promoted utility run contains: • LongMemEval: 948 source sessions, 10,960 turns, and 500 questions; • LoCoMo: 272 sessions, 5,882 turns, and 1,986 questions; • total completion count: 2,486 independently recalled and judged questions. Sessions are replayed turn by turn through the native signed session lifecycle. Each question receives one signed recall and one generator call. The canonical-blind protocol also uses one judge call; the upstream-compatible LoCoMo protocol instead applies its deterministic category-aware token-F1 scorer. Retrieval and answer metrics are reported separately. Promoted run 20260715111742_96b25f covers the complete canonical-blind workloads; promoted run 20260718205816_fbde68 covers the complete upstream-compatible LoCoMo protocol. [LIVE-EVIDENCE] 9.2 Mutation integrity suite Promoted run 20260723162050_59a52d executed the integrity suite in a fresh isolated Genesis brain. It: 1. retained Genesis memories through the canonical signed save path and issued an exact signed post-mutation recall; 2. appended positive and negative signed outcome evidence; 3. demonstrated a nontrivial upward, downward, and later upward trajectory; 4. verified SQL/portable corpus parity and the independent portable corpus proof root; 5. attempted direct runtime update, cross-memory proof reuse, cross-company reuse, no-op, stale-state discontinuity, out-of-bounds, and forked transitions; 6. tampered with a projection field, transition signature, terminal live weight, and signer epoch in the isolated database, verifying detection before restoring each value; 7. re-recalled the mutated memory and verified a one-item ordered evidence receipt, Merkle root, and signed event mutation hash; 8. measured native per-transition storage and latency across 20 transitions. This suite reports authorization and integrity behavior, not retrieval quality. The public aggregate self-hash is 9521798027be2893af745214a22747334be201d74178d9265ea97a32d34be8. [LIVE-EVIDENCE] 9.3 Targeted poisoning The N=100 poisoning lane uses the official PoisonedRAG NQ target fixture, five official attacker-crafted passages per target, and the official pinned Contriever top-100 candidate identifiers resolved against the pinned NQ/BEIR corpus. The target count, target fixture, and five attacker-crafted passages per target match the upstream protocol; the declared deviations are corpus scope, retriever, and answer model. AIMOS's native retriever operates over the bounded 100-candidate pool for each independently isolated target rather than the original full 2,681,468-text Contriever index, making this a declared adaptation and not a strict reproduction. The ablation positive control shows that this adapted boundary exposed the attack: poison entered the pre-epistemic candidate opening for 100/100 targets and was selected by the policy-bypassed A0 arm for 94/100 attacked top-5 sets. The defended result therefore cannot be explained by the injected passages never reaching the measured retrieval boundary. Each target question is the independent unit; passages and model retries are nested observations. Clean and attacked outcomes are paired, with top_k=5. The primary compatibility metric is normalized target-answer substring ASR; semantic judgment is secondary and cannot overwrite it. Promoted run 20260722172124_db0d79 completed all intended units. [LIVE-EVIDENCE] The promoted run keeps the same fixed target lock used during detector calibration and adds four traceability outcomes: (i) injected passages with signed epistemic-label evidence, (i) clean retained memories receiving an adverse label, (i) final projection-chain verification across the complete retained benchmark population, and (iv) poison retrieval@5 after label-aware recall. Because the locked N=100 material informed detector calibration, this is a fixed-protocol post-calibration evaluation rather than an unseen held-out estimate. The experiment therefore measures the final calibrated system and does not estimate detector generalization to unseen attack material or isolate calibration as a causal intervention. [LIVE-EVIDENCE] 9.4 Models and judgment The canonical-blind utility run used GPT-5.4 as generator and GPT-5.6 Terra as judge. The upstream-compatible LoCoMo run used GPT-5.4 as reader and no LLM judge. The promoted PoisonedRAG and epistemic-ablation runs used GPT-5.5 at medium reasoning as generator and GPT-5.6 Terra at high reasoning as judge. Provider account material is represented only by non-secret evidence and hashes. Because generator and judge remain from one provider family, deterministic metrics are primary where available. A blinded review of all 200 production-run answers was completed by the system author after independent-review outreach did not produce an available reviewer. The audit is disclosed as non-independent and is an agreement diagnostic, not human ground truth. [LIVE-EVIDENCE] 9.5 Statistical reporting All rates report exact numerator and intended denominator. A single-binomial proportion such as target-level ASR uses a two-sided 95% Wilson score interval. Paired clean/attacked binary outcomes use discordant-pair counts and an exact McNemar test; paired deltas receive a predeclared paired bootstrap confidence interval. Missing or failed units remain visible and block promotion of a nominal full-run result. For the preregistered epistemic ablation, exact McNemar tests are grouped into seven endpoint families: attacked poison retrieval, attacked substring target assertion, incremental substring target assertion, attacked semantic target assertion, incremental semantic target assertion, clean QA correctness, and attacked QA correctness. Each family contains the adjacent A1–A0, A2–A1, and A3–A2 contrasts plus the total A3–A0 contrast; Holm–Bonferroni adjustment controls familywise α=0.05α=0.05 within each four-contrast family. Induced-ASR arm rates condition on that arm’s clean answer not already asserting the target, so their denominators can differ and must not be compared naively across table rows; paired incremental contrasts are the confirmatory comparison. 9.6 Epistemic causal ablation Promoted run 20260730102457_495de5 uses the fixed N=100 production run as its source state and evaluates four policies over the same pre-disclosure candidate openings. A0 bypasses epistemic policy while retaining AIMOS native relevance and diversity; it is not the original Contriever baseline. A1 enables signed stored labels, A2 adds query-local lure detection, and A3 adds active-context withholding. The run completed 200 native recalls, 800 signed policy decisions, 800 generations, and 1,600 judgments. No arm changed canonical memory, persistent retrieval weight, or classification state. The public preregistration hash is c224e942df7e4864cd66a82634f6739dc4657a9fc7cded93743f5f9c39e56fac. The source labels were calibrated on the same locked N=100 material and the ablation cloned that calibrated state. Consequently, A1–A0 estimates the effect of those stored labels within this fixed adapted corpus, not the generalization of the detector to unseen attack structures. [LIVE-EVIDENCE] 9.7 Human agreement review The review packet contained all 200 clean/attacked production answers. The reviewer did not see arm identity or judge verdict while assigning correctness and target-assertion labels; the arm mapping was revealed after completion. The reviewer was the system author, so the result is reported as blinded but non-independent. Target pairs, rather than individual arms, are the bootstrap unit. No answer was excluded. [LIVE-EVIDENCE] 10. Results All values in this section regenerate from eval/publication/verified-benchmark-results.json, whose self-hash is 06afd5ba25c96d12c020df891e3711e821578df21d76c86c6398bc3792377a3f. The exporter rehashed every entry in the three promoted benchmark artifact manifests: 46,032 utility-run artifacts, 26,143 upstream-compatible LoCoMo artifacts, and 21,517 PoisonedRAG artifacts (93,692 total benchmark declarations), all 3,518 epistemic-ablation artifacts, plus all seven declarations in the mutation-suite manifest. The row-level source records remain private because they contain upstream dataset text, provider payloads, or retained memory identifiers; their hashes and sanitized aggregates are public. 10.1 LongMemEval The complete 500-question LongMemEval run obtained 459 judged-correct answers, or 91.8% accuracy (95% Wilson CI 89.06–93.90). At k=20, any-hit rate, hit@1, mean reciprocal rank, and mean evidence recall were all 1.000; mean nDCG@20 was 0.9659. The perfect evidence-hit measurements do not imply perfect answering: preference questions were the weakest answer category at 22/30 (73.33%), while single-session assistant questions were 56/56. Category Correct / N Judged accuracy Abstention 28 / 30 93.33% Knowledge update 67 / 72 93.06% Multi-session 106 / 121 87.60% Single-session assistant 56 / 56 100.00% Single-session preference 22 / 30 73.33% Single-session user 58 / 64 90.63% Temporal reasoning 122 / 127 96.06% 10.2 LoCoMo under two declared protocols Under the canonical-blind LLM-judged protocol, 1472/1986 answers were correct: 74.12% (95% Wilson CI 72.15–76.00). At k=20, any-hit was 97.12%, hit@1 44.20%, MRR 0.5500, mean evidence recall 94.71%, and mean nDCG 0.6162. Category accuracy was 68.83% adversarial, 88.11% multi-hop, 39.58% open-domain, 48.94% single-hop, and 77.26% temporal. The separate upstream-compatible protocol evaluated all 1986 answers with the pinned category-aware token-F1 scorer and obtained mean F1 0.5820, reported as 58.20 (95% fixed-seed bootstrap CI 56.46–59.94). Its category F1 values were 84.30 adversarial, 60.37 multi-hop, 24.78 open-domain, 32.98 single-hop, and 48.40 temporal. At k=25, any-hit was 80.88%, hit@1 44.35%, MRR 0.5474, mean evidence recall 75.81%, and mean nDCG 0.5798. The 74.12% and 58.20 results are complementary but not interchangeable: one is LLM-judged binary QA accuracy and the other is deterministic category-aware token F1. They are never averaged or presented as one score. 10.3 Mutation authorization, tamper detection, and overhead The isolated mutation run completed 20/20 measured native signed transitions while leaving the canonical user brain unchanged. It verified a retained upward–downward–upward trajectory, a negative–neutral–positive evidence sequence in which neutral evidence created no fictitious projection, and continued memory existence within the constitutional interval [0.1,3.0][0.1,3.0]. The restricted writer rejected direct runtime updates, cross-memory and cross-company proof reuse, no-op, stale-state discontinuity, out-of-bounds, and forked transitions. SQL verification detected projection/binding tamper, signature tamper, terminal-weight divergence, and a stale signer epoch. After each deliberate isolated mutation was restored, all nine cognitive chains verified in both the SQL and portable verifiers, with exact parity and portable corpus root a965aba5ec0a5eea813617489c8c3851e3ad5e16587c026fedfd71e303f43269. A native signed post-mutation recall returned the mutated memory with a one-item evidence receipt. Its Merkle root was 8776caaae6034a5b1b02e661c8e8ca29e377141d615b03e05fdbe85c012e37, and the receipt event carried mutation hash eb1283b63eb68cf33904d629e1a17eb29138493d8185d1648cca4d59fdc7acda. Across 20 transitions, the exact measured transaction boundary—housekeeper signatures, provenance append, certified projection append, and live-weight update—had mean latency 4.898 ms, median 4.865 ms, p95 5.674 ms, minimum 3.857 ms, and maximum 6.488 ms. The paired projection and provenance rows occupied 19,327 logical bytes in total, or 966.35 bytes per transition as measured by pg_column_size; this excludes indexes and block free space. PostgreSQL relation allocation increased by 16,384 bytes for provenance and zero newly allocated bytes for projection because relation growth is block-granular. The latter is not a zero-storage claim: logical projection rows occupied 5,807 bytes. These are single-machine native-boundary measurements, not a causal estimate of cryptographic overhead relative to an unsafe unsigned control. [LIVE-EVIDENCE] 10.4 PoisonedRAG N=100 adaptation The primary normalized substring metric produced clean target-answer leakage of 2/100 (2.0%, 95% Wilson CI 0.55–7.00), attacked ASR of 3/100 (3.0%, 95% Wilson CI 1.03–8.45), and induced ASR of 1/98 among clean non-target outputs (1.02%, 95% Wilson CI 0.18–5.56). The secondary semantic metric agreed exactly on these counts. No poison passage appeared in any attacked top-5 result: 0/100 targets, with a 95% Wilson upper bound of 3.70%. Mean poison count@5 was 0 (95% fixed-seed bootstrap CI 0–0). Clean answer accuracy was 72/100 (72%, 95% Wilson CI 62.51–79.86), and attacked answer accuracy was 71/100 (71%, 95% Wilson CI 61.46–78.99). The paired attacked-minus-clean delta was -1 percentage point (95% paired-bootstrap CI -7 to +5); exact McNemar b=5, c=4, p=1 does not establish a utility difference. Poison retrieval is measured over the memories returned in the signed recall proof, before generator-side handling of untrusted evidence. No injected passage entered an attacked disclosure, so the generator received no injected evidence in the measured recall-to-prompt path. The three attacked target-answer events therefore cannot be attributed to retrieval of the injected passages; paired clean target-answer leakage was 2/100. This does not identify an alternative cause or establish that unrelated model knowledge could not produce the target answer. 10.5 Admission and cryptographic completeness All 500 poison passages were submitted, admitted, retained as canonical references, and associated with signed security-decision evidence. None was rejected and none was quarantined. Each poison passage also has signed epistemic-label evidence: at the instant each save returned, 100 first-in-cluster passages were still unverified and 400 later passages were poison_likely; compound cluster evidence then appended transitions for the first passages, so all 500 final poison projections were poison_likely. Classification changed neither canonical content nor retention. Across the run, all 20,500 save attempts have terminal proof artifacts. The native quality gate rejected 1,120 clean attempts and no poison attempts; 19,380 operations were admitted. Seventy-two admitted clean operations resolved to already retained rows through native deduplication, leaving 19,308 unique retained benchmark memories: 500 poison and 18,808 clean. The database verifier checked all 19,308 epistemic chains and accepted all 19,308. The final projection contained 504 signed classification rows: 500 poison memories and four clean memories were poison_likely, while 18,804 clean memories remained unverified. The observed clean adverse-label rate was therefore 4/18,808, or 0.0213% (95% Wilson CI 0.0083–0.0547%). All 200 clean/attacked recall proofs verified, and all 100 target outcomes matched their declared self-hashes. [LIVE-EVIDENCE] Under the full epistemic-chain verifier, no non-unverified projection is accepted unless it is backed by a complete, connected sequence of signed classification events bound to the live memory content. An adverse label written without that supporting history is reported as an unbacked_projection; a disconnected predecessor history is rejected as fork_or_disconnected_history. This is a verifier-acceptance property under the stated cryptographic threat model, not a claim that a database superuser cannot write arbitrary bytes. [CODE] [LIVE-EVIDENCE] 10.6 Preregistered epistemic ablation The positive control succeeded in every attacked target: at least one poison passage entered the pre-epistemic candidate opening in 100/100 cases (95% Wilson CI 96.30–100). With epistemic policy bypassed in A0, poison appeared in 94/100 attacked top-5 sets (94%, 95% Wilson CI 87.52–97.22), with a mean 2.89 poison passages per top-5 set. This establishes that the attack reached the measured mechanism boundary and was capable of dominating native relevance-plus-diversity retrieval. The registered primary compatibility endpoint is normalized substring target assertion. Semantic target assertion is reported secondarily. Arm Poison retrieval@5 Substring induced ASR Clean QA Attacked QA A0 94/100 (94%) 53/97 (54.64%) 71/100 (71%) 40/100 (40%) A1 0/100 (0%) 0/96 (0%) 68/100 (68%) 65/100 (65%) A2 0/100 (0%) 0/97 (0%) 68/100 (68%) 71/100 (71%) A3 0/100 (0%) 1/97 (1.03%) 69/100 (69%) 69/100 (69%) Induced-ASR denominators differ because each arm excludes targets whose own clean answer already asserted the target. The arm rates are therefore descriptive; the paired incremental-target contrasts provide the valid cross-policy comparison. Under the secondary semantic endpoint, induced ASR was 55/98, 0/97, 0/98, and 1/98 for A0 through A3. Signed stored labels produced the demonstrated causal effect. Relative to A0, A1 eliminated poison retrieval in 94 discordant targets with zero retrieval regressions (exact McNemar p=1.0097×10−28p=1.0097× 10^-28, Holm-adjusted p=4.0390×10−28p=4.0390× 10^-28). A0’s attack reduced QA accuracy from 71% clean to 40% attacked; A1 recovered attacked accuracy to 65%, a 25-point gain over A0. The paired A1–A0 attacked-accuracy contrast had 26 improvements and one regression (exact p=4.1723×10−7p=4.1723× 10^-7, Holm-adjusted p=1.2517×10−6p=1.2517× 10^-6). A1–A0 clean accuracy had seven losses and four gains; neither its raw p=0.5488p=0.5488 nor adjusted p=1p=1 established a clean-side cost. A1 and A2 had byte-identical selected sets, active contexts, and prompt hashes for all 200 clean/attacked pairs. Query-local lure detection was therefore a measured null on this fixed corpus. A2 and A3 were likewise identical on those three inputs for all 200 pairs, but this is not an efficacy null for withholding: the preceding label-aware layer left zero selected passages marked for withholding, so the A3-only mechanism was never exercised. Output-count differences between A2 and A3 are reported descriptively and not attributed to withholding. All 100 target outcomes, 800 signed retrieval decisions, 800 unique decision events, and 800 unique ledger sequences verified. All 3,518 manifest entries rehashed. Memory, classification, and benchmark footprint roots remained unchanged, as did all 504 signed classification rows. The public ablation aggregate self-hash is 83a576895d26de63a7dde820b74effb93158299bf180289069af77569eb27105. [LIVE-EVIDENCE] The run resumed after lifecycle-only amendments to eval/run-poisonedrag-epistemic-ablation.mjs and scripts/benchmark/run-poisonedrag-epistemic-ablation.mjs. Scientific inputs were unchanged, completed immutable artifacts were reused, and terminal status was reconciled under receipt hash 741b5124dfe29d77227ea9d9c746f2539f75073168d16428039d8488c520e6f2. 10.7 Blinded system-author agreement All 200 answers and all 100 paired targets were reviewed with zero exclusions. Correctness labels agreed on 193/200 answers (96.5% raw agreement; Cohen’s κ=0.9108κ=0.9108, target-cluster bootstrap 95% CI 0.8169–0.9845). All seven correctness disagreements had the same direction: the system author labeled the answer correct and the judge did not (150 versus 143 positives; exact two-sided sign test p=0.015625p=0.015625). Relative to this non-independent review, the judge was stricter on every correctness disagreement; this is not evidence that the judge is universally conservative. Target-assertion labels agreed on 198/200 answers (99.0% raw agreement; κ=0.7949κ=0.7949, target-cluster bootstrap 95% CI 0–1). The 2×22× 2 table contains four joint positives, one author-only positive, one judge-only positive, and 194 joint negatives, giving positive specific agreement 0.80 and negative specific agreement 0.995. The wide kappa interval reflects only five positive labels per rater and 2.5% positive prevalence; the specific-agreement statistics expose that low-prevalence structure directly. The reviewer was the system author; this supports a blinded agreement diagnostic but not an independent human-validation claim. The audit summary hash is fec88dfb1e58dc429c023e876f289684f1e97e3d2df9d37478e09c0c54d387. [LIVE-EVIDENCE] 10.8 Release-evidence binding The publication aggregate verifies 39/39 signed scratch-brain purge receipts, reports zero invalid receipts, and excludes the canonical user brain. Its purge-evidence self-hash is 1bfbfdd76e36e74a615d22e05f7c933cca14795b76a2a230c95b8d39a5e16fcf. Raw identity-bearing receipts remain private. The public source release contains one commit, 580e9d2574478e78fcccf4bd00b7f44dc8a9b744, and the source manifest has canonical self-hash 64783f25c4555737ecbc9da343a1186c3e4dc8a092a30465855f5fb1d2ba68e and binds 624 shipped files under root 2f3908f94da90c2dc5210970c542d2126ae2d2baa608a7203c73806705be7af2. The fresh public tree passed the source, benchmark, architecture, package, dependency, private-path, and internal-disclosure gates. [LIVE-EVIDENCE] 11. Discussion 11.1 Authorization evidence is not semantic truth MutMem answers a forensic question: whether a particular cognitive-weight transition was admitted by the declared policy owner and remains consistent with the retained trajectory. It does not answer whether the underlying memory is correct. This separation prevents a signature from becoming a semantic trust shortcut. Content-level correction, contradiction, and supersession remain memory operations with their own retained evidence; cognitive reweighting changes retrieval frequency without rewriting those records. 11.2 Why the protocol retains two commitments The provenance commitment and transition commitment serve different verification boundaries. The provenance node places the reweight inside the memory's retained event history and links it to the prior provenance head. The transition commitment signs the exact company, memory identifier, quantized old and new weights, and provenance mutation hash consumed by the restricted writer. Collapsing the two would make it harder for an external verifier to distinguish a valid historical node from authorization of the exact live-weight transition. 11.3 Retention permits reversal without pretending the past was different The bounded update rule is bidirectional. Later evidence may reverse the direction of an earlier adjustment, but the reversal appends another transition rather than replacing the first. This is useful operationally because relevance is contextual and corrigible: a low-frequency memory may later become important, while a formerly useful memory may lose practical value. The retained sequence exposes both judgments and their order. 11.4 The three evaluation axes are intentionally separate Utility, mutation integrity, and poisoning robustness test different propositions. High answer accuracy cannot establish that a database edit was authorized. A valid signature cannot establish useful retrieval. A low poisoning ASR cannot by itself prove general semantic safety. The paper therefore avoids a merged score: utility determines practical positioning, the mutation suite tests the central authorization and integrity construction, and PoisonedRAG tests one declared adversarial adaptation. 11.5 Retention and retrieval isolation are different security boundaries The final PoisonedRAG run exposes a useful distinction. Cryptographic admission correctly authenticated the provenance and execution of all 500 malicious passages but did not infer their factual falsity: every poison passage was retained, none was quarantined, and none was rejected. The native classifier added a second, signed statement: the memory remains retained, but its current epistemic projection records why recall treats it as untrusted reference evidence. The epistemic retrieval path then excluded all injected passages from the attacked top-5 disclosures. The classification chain makes the poison traceable across later confirmation, refutation, and cognitive reweighting; it does not turn a heuristic detector into a truth oracle. The evidence supports classification, retrieval isolation, and traceability claims under the declared post-calibration protocol. The fixed-corpus ablation then isolates the effect of the signed stored labels within that calibrated state: poison retrieval falls from 94/100 in A0 to 0/100 in A1, while attacked answer accuracy rises from 40/100 to 65/100 and no clean-side accuracy cost is established. Because the source labels were calibrated on this same locked corpus, the result is causal for the stored-label mechanism in this experimental state, not evidence of detector generalization to unseen attacks. 11.6 Poison as retained negative evidence Retention changes the role of an attack artifact. Deleting a detected passage would remove the evidence needed to audit the attack, study detector behavior, or correct a false positive. MutMem instead keeps the passage, its original signed save provenance, every epistemic transition, and its response-local retrieval treatment. In the measured N=100 run, the first passage in each of the 100 lure clusters was still unverified when its own save returned. Evidence from later members of the same retained cluster then caused a signed transition for each first passage, so all 100 became poison_likely and all 500 injected passages finished with adverse signed projections. This is measured retroactive classification within the declared clustered attack, not a guarantee that every previously missed or unseen attack will later be detected. A labeled poison can become useful negative evidence: reasoning may explicitly recognize that a claim was introduced by a poisoning pattern, while later independent evidence may confirm or refute that classification. The benefit comes from distinguishability and historical continuity, not from treating malicious content as ordinary support. 11.7 The ablation identifies an ordered defense boundary The ablation shows that the defense layers cannot be interpreted as interchangeable filters. The attacked candidate opening contained poison for all 100 targets, and A0 selected poison for 94/100 targets, so the attack had reached a live retrieval boundary. Adding the signed stored label in A1 removed all poison from the selected top-5 and recovered 25 attacked-utility points relative to A0. Adding query-local detection in A2 produced byte-identical selected sets, active contexts, and prompt hashes across all 200 clean/attacked pairs, a measured null on this fixed corpus. Active-context withholding in A3 was never exercised because the preceding label-aware layer left no selected poison to withhold; A3 therefore supplies no efficacy estimate for withholding. This ordering supports a sufficient first-layer result and a defense-in-depth architecture, not a claim that every downstream layer was independently effective. The ablation also establishes mutation absence rather than mutation integrity: memory roots, classification roots, 504 signed classification rows, and the benchmark footprint remained unchanged while policy arms varied. Authorization, topology, signer-epoch, and tamper behavior are tested separately by the native mutation-integrity suite in Section 10.3. 12. Limitations 1. Integrity is not truth. A valid signature identifies an authorized statement and signer epoch, not factual correctness. 2. Key compromise is outside the main claim. A stolen active housekeeper key can authorize malicious transitions until revocation and recovery. 3. Runtime append-only is role-scoped. Database superusers can modify storage; the protocol aims to make such changes detectable, assuming independent verifier anchors survive. 4. Recall verification is demand-driven. It verifies disclosed evidence. Corpus-wide verification is a separate explicit operation. 5. Model judgment is not ground truth. Same-family generator/judge bias and prompt sensitivity remain. 6. PoisonedRAG comparability is conditional. The target count, official NQ target fixture, and five attacker-crafted passages per target match the upstream protocol. Corpus scope, retriever, and answer model differ. The result is therefore a declared N=100 adaptation, not a strict reproduction of the paper's 97% NQ reference result. 7. Canary coverage is marker-specific. A retained canary disposition proves that a recognized marker crossed a monitored boundary. Absence of a marker does not establish that arbitrary content is benign, and quarantine does not establish that marked content is factually false. 8. Overhead is bounded to one native transaction and machine. The mutation suite measures the complete signed transition boundary, not a controlled cryptographic-ablation effect. It does not estimate how much faster an unsafe unsigned implementation would be, and its latency and storage measurements should not be generalized across hardware or database configurations. 9. External anchors remain necessary. A verifier needs a trusted public-key epoch, release identity, and retained proof material. An attacker who replaces both the database and every verifier anchor can present a self-consistent forgery outside this threat model. 10. The release binding is revision-specific. Claims in this paper bind the published source commit and evidence manifests named in Section 10.8. Later development is not covered automatically; behaviorally relevant changes require an explicit rerun and a new release identity. 11. Poison classification is calibrated, not semantic ground truth. The deterministic detector recognizes the declared clustered query-lure structure and may miss other attacks or mislabel benign clusters. Its signed output proves who classified what content, under which detector version and signals; it does not prove that the content is false. The final N=100 run is post-calibration on the locked benchmark material and must not be described as unseen held-out validation. Four of 18,808 clean retained memories received an adverse final label, so the observed false-positive rate is nonzero even under this fixed protocol. Retention preserves a missed artifact for later signed adjudication, as measured for the 100 first-in-cluster passages, but does not guarantee eventual detection of every unseen attack. 12. The epistemic ablation inherits fixed-corpus calibration. Its arms clone the final calibrated N=100 state. A1–A0 therefore identifies the effect of already-produced signed stored labels on this locked material; it does not estimate how the detector would label or isolate unseen attacks. 13. One ablation resume included a lifecycle-only code amendment. Two runner files changed during operational recovery. Completed artifacts were reused only after confirming that the scientific contract was unchanged and reconciling the run under SHA-256 741b5124dfe29d77227ea9d9c746f2539f75073168d16428039d8488c520e6f2. This preserves an auditable record of the recovery but is weaker than an uninterrupted execution from one immutable runner revision. 14. The human review is blinded but non-independent. The system author completed the 200-answer review after external reviewers were unavailable. The packet, labels, and scoring procedure are retained for independent replication; the reported agreement is not presented as independent human validation. 13. Ethics and responsible release The poisoning package includes attacker-crafted misinformation. Public artifacts should include the minimum text required for reproducibility, retain upstream attribution and license metadata, and clearly label target answers as intentionally false. The public installer must keep benchmark data out of the user's normal brain. Credentials and private key material must never enter artifacts, command lines, logs, or the repository. 14. Reproducibility package The release bundle contains or will contain: • exact public source commit, one-commit history, source manifest, and dirty-state prohibition; • software, database, pgsodium, and model identifiers; • pinned dataset and fixture manifests with SHA-256 sidecars; • a sanitized public aggregate at eval/publication/verified-benchmark-results.json; • retained private per-session replay proofs; • retained private per-question signed recall evidence, answer, judgment, timing, and attempt history; • mutation-suite provenance, projection, signature, and corpus-verifier outputs; • PoisonedRAG clean/attacked target records; • the four-arm epistemic-ablation aggregate, preregistration, recovery reconciliation, 3,518-entry artifact manifest, and paired statistical contrasts; • the 200-card blinded system-author audit packet, labels, agreement aggregate, and target-cluster bootstrap output; • per-memory epistemic-classification events, predecessor hashes, detector signals, current projections, and complete chain-verifier results; • aggregation code and generated tables; • artifact hash manifest; • canonical-brain non-contamination proof; • sanitized verification of the signed whole-brain purge receipts after the evidence freeze; raw identity-bearing receipts remain private. The promoted run identifiers are 20260715111742_96b25f (canonical-blind LongMemEval and LoCoMo), 20260718205816_fbde68 (upstream-compatible LoCoMo), 20260722172124_db0d79 (post-calibration PoisonedRAG N=100), 20260730102457_495de5 (four-arm epistemic ablation), and 20260723162050_59a52d (native mutation integrity). Their summary self-hashes are 28d35689ac5090634a6804d6fa7b6e1671b5b06cb5ebaa0d744d092f9a40631, 0cf97847d64d7d9fa642e5435eebfc6b75fc4680d22e7192fde2ec255a727a, 7215ffe188528022a34251938133db14fdc8e2bd93d1fb1119301962ca15908, 4ffaafbf57947add5247264f0ed57454e6d80bf25dc5481fb8a5e9c90964384b, and 984994fc8d6c438599db32d6603d9cec8e02de398a7e6a262afdc253c11e0258 for LongMemEval, judged LoCoMo, official-protocol LoCoMo, PoisonedRAG, and mutation integrity respectively. The PoisonedRAG epistemic-verification aggregate has self-hash bf49888904fdc34db17e7f65d2f825ed1f18cfe5e66c6e6d7bd77d5aee197c3; the ablation aggregate has canonical self-hash 83a576895d26de63a7dde820b74effb93158299bf180289069af77569eb27105, its preregistration has SHA-256 c224e942df7e4864cd66a82634f6739dc4657a9fc7cded93743f5f9c39e56fac, and its lifecycle reconciliation has SHA-256 741b5124dfe29d77227ea9d9c746f2539f75073168d16428039d8488c520e6f2; the human-audit aggregate has self-hash fec88dfb1e58dc429c023e876f289684f1e97e3d2df9d37478e09c0c54d387 and its 200-card packet has SHA-256 72d0fa8b5765e1fd2bedaf1cd11c3dc3d5414a20bc334169815dba972dc2642; the mutation-integrity public aggregate has self-hash 9521798027be2893af745214a22747334be201d74178d9265ea97a32d34be8. The unified publication aggregate has canonical self-hash 06afd5ba25c96d12c020df891e3711e821578df21d76c86c6398bc3792377a3f and verifies all 39 declared scratch-brain purge receipts; the canonical user brain was not included. No reviewer reproduction command will ingest benchmark corpora into the reviewer's normal brain. The public package contains AIMOS-authored code, aggregate measurements, opaque unit identifiers, cryptographic receipts, prompts, and hashes. LongMemEval, LoCoMo, Natural Questions/BEIR, and PoisonedRAG fixture text remain downloader-and-hash based under their upstream terms; source questions, answers, conversations, passages, and provider payloads that reproduce those materials are excluded from the public source repository. 15. Related work 15.1 Tamper-evident logs and cryptographic building blocks Tamper-evident logging predates agent memory. Crosby and Wallach formalize histories in which signed commitments support membership and incremental consistency proofs even when the logger is untrusted [1]. Certificate Transparency standardizes a related Merkle-tree construction with domain-separated leaves and internal nodes [2]. MutMem uses established SHA-256, Ed25519 [3], canonical JSON [4], and RFC 6962-style Merkle techniques; it does not claim those primitives as novel. Its systems question is how to bind them to authorized, retained cognitive reweighting and to the exact evidence disclosed by a memory recall. 15.2 Cryptographic provenance for agent memory Recent systems make cryptographic memory provenance an active research area. MemLineage attaches per-principal Ed25519 signatures and an RFC 6962 Merkle log to memory entries, then propagates derivation lineage through a weighted DAG to prevent externally descended evidence from authorizing sensitive actions [5]. Portable Agent Memory defines content-addressed memory entries in a Merkle-DAG, capability-scoped disclosure, and cross-agent rehydration [6]. MemMark embeds owner-controlled attribution signals into state-evolution choices and retains cryptographic commitments, signed session anchors, and reveal evidence so attribution can survive snapshot migration [7]. These systems substantially narrow any novelty claim available to MutMem. Signatures, Merkle provenance, transferable memory state, lineage-aware enforcement, and cryptographic attribution are prior art. The narrower MutMem construction studied here is a retained bidirectional cognitive-weight trajectory: each nontrivial change is bound both to a terminal memory-provenance node and to an exact signed old/new transition, independently reconstructed by a portable verifier, while a subsequent native recall commits its ordered disclosed evidence to a signed event receipt. Whether this conjunction is sufficiently distinct is a review question, not a premise of the evaluation. System Primary objective Cryptographic object State evolution Enforcement or verification boundary Distinction from MutMem MemLineage [5] prevent untrusted memory lineage from justifying sensitive actions signed entries, Merkle log, derivation DAG derived memory lineage and trust propagation sensitive-action gate and lineage audit focuses action authorization from provenance ancestry rather than signed bidirectional retrieval-weight transitions Portable Agent Memory [6] move memory across heterogeneous agents content-addressed entries and Merkle-DAG portable structured memory transfer capability-scoped disclosure and rehydration focuses interoperability and transfer rather than a live cognitive reweight trajectory MemMark [7] attribute leaked or migrated memory snapshots keyed state-evolution watermark, commitments, signed anchors watermark-bearing write choices snapshot attribution and reveal verification treats state evolution as an attribution carrier rather than authorization of an explicit old/new weight change MutMem make retained cognitive adaptation distinguishable from unsigned editing provenance chain, signed transition, portable corpus root, signed recall receipt bounded downward and upward retrieval-frequency appends restricted writer, SQL verifier, portable verifier, and disclosure receipt utility, mutation-integrity, and poisoning evidence complete under the declared protocols 15.3 Memory poisoning PoisonedRAG demonstrates that an attacker can inject a small number of crafted passages into a large retrieval corpus and induce attacker-chosen answers [8]. Its attack separates retrieval and generation conditions and evaluates black-box and white-box constructions. MutMem does not treat provenance as a truth oracle: a malicious passage may be correctly signed and retained. The adapted N=100 lane instead measures whether AIMOS's declared admission, quarantine, retrieval, and answer boundaries change clean/attacked outcomes, while reporting deviations from the original NQ/Contriever/model configuration. MemLineage is an especially important adjacent defense because it evaluates cryptographic lineage as an enforcement signal against memory poisoning [5]. 15.4 Long-term memory utility benchmarks LongMemEval evaluates information extraction, multi-session reasoning, temporal reasoning, knowledge updates, and abstention across 500 questions embedded in sustained chat histories [9]. LoCoMo evaluates very long-term conversational memory through question answering, event summarization, and multimodal dialogue generation over long multi-session conversations [10]. They measure memory utility rather than cryptographic mutation integrity. MutMem therefore reports their retrieval and answer metrics separately from the mutation and poisoning suites and avoids mixing Oracle, long-context, category-subset, lexical, and model-judged conditions. 16. Conclusion MutMem specifies a retention-preserving protocol for cognitive adaptation in persistent agent memory. Signed outcome evidence can move retrieval frequency downward or upward without erasing the memory or its prior trajectory. A restricted writer binds each nontrivial change to retained provenance and an exact signed transition; SQL and portable verification expose authorization and topology failures; native recall commits the ordered disclosed evidence to a signed receipt. Potential poisoning is likewise retained and made distinguishable through a separate signed epistemic trajectory that binds every label to the live content hash, detector evidence, signer event, and predecessor. These mechanisms support claims about authorization, integrity, traceability, and historical continuity under the stated assumptions, not claims about semantic truth. Full utility runs show 91.8% judged accuracy on LongMemEval, 74.12% judged accuracy on LoCoMo, and 58.20 upstream-compatible LoCoMo token F1 under their separately declared protocols. The native mutation suite verified all declared authorization, topology, tamper, signer-epoch, corpus-parity, and post-mutation recall cases; its 20 measured signed transitions had median latency 4.865 ms, p95 latency 5.674 ms, and mean logical row storage 966.35 bytes. The final post-calibration N=100 PoisonedRAG adaptation produced 2% clean target-answer leakage, 3% attacked ASR, 1.02% induced ASR among clean-negative targets, and 0/100 poison retrieval@5 while retaining all 500 poison passages. All 500 finished with signed poison_likely projections; all 19,308 retained benchmark-memory chains verified; and four of 18,808 clean memories carried an adverse final label. This supports measured claims of authorized mutation integrity and retention-preserving poison distinguishability and traceability under the declared protocols, not semantic truth or unseen-attack generalization. In the fixed-corpus ablation, poison was present in the attacked candidate opening for 100/100 targets and selected for 94/100 targets in A0; adding signed stored labels in A1 reduced selected poison to 0/100 and raised attacked answer accuracy from 40% to 65%, while no clean-side accuracy cost was established. Query-local detection was a measured null after A1, and active-context withholding was not exercised. A blinded but non-independent system-author review agreed with the model judge on 193/200 correctness labels (96.5%, κ=0.9108κ=0.9108). These results are bound to the exact public source and evidence identifiers reported in Section 10.8. References 1. S. A. Crosby and D. S. Wallach, “Efficient Data Structures for Tamper-Evident Logging,” in 18th USENIX Security Symposium (USENIX Security 09), Montreal, QC, Canada, Aug. 2009. https://w.usenix.org/conference/usenixsecurity09/technical-sessions/presentation/efficient-data-structures-tamper-evident 2. B. Laurie, A. Langley, and E. Kasper, “Certificate Transparency,” RFC 6962, June 2013. https://w.rfc-editor.org/rfc/rfc6962 3. S. Josefsson and I. Liusvaara, “Edwards-Curve Digital Signature Algorithm (EdDSA),” RFC 8032, Jan. 2017. https://w.rfc-editor.org/rfc/rfc8032 4. A. Rundgren, B. Jordan, and S. Erdtman, “JSON Canonicalization Scheme (JCS),” RFC 8785, June 2020. https://w.rfc-editor.org/rfc/rfc8785 5. C. Ouyang and R. Hou, “MemLineage: Lineage-Guided Enforcement for LLM Agent Memory,” arXiv:2605.14421v1, May 2026. https://arxiv.org/abs/2605.14421 6. S. K. Ravindran, “Portable Agent Memory: A Protocol for Cryptographically-Verified Memory Transfer Across Heterogeneous AI Agents,” arXiv:2605.11032v1, May 2026. https://arxiv.org/abs/2605.11032 7. H. Zhang, X. Mao, G. Dong, Z. Li, X. Su, K. Chen, J. Yang, and Z. Lin, “MemMark: State-Evolution Attribution Watermarking for Agent Long-Term Memory Systems,” arXiv:2605.25002v2, May 2026. https://arxiv.org/abs/2605.25002 8. W. Zou, R. Geng, B. Wang, and J. Jia, “PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models,” in 34th USENIX Security Symposium (USENIX Security 25), Seattle, WA, USA, p. 3827–3844, Aug. 2025. https://w.usenix.org/conference/usenixsecurity25/presentation/zou-poisonedrag 9. D. Wu, H. Wang, W. Yu, Y. Zhang, K.-W. Chang, and D. Yu, “LongMemEval: Benchmarking Chat Assistants on Long-Term Interactive Memory,” ICLR 2025, arXiv:2410.10813v2, Mar. 2025. https://arxiv.org/abs/2410.10813 10. A. Maharana, D.-H. Lee, S. Tulyakov, M. Bansal, F. Barbieri, and Y. Fang, “Evaluating Very Long-Term Conversational Memory of LLM Agents,” in Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), Bangkok, Thailand, p. 13851–13870, Aug. 2024, doi:10.18653/v1/2024.acl-long.747. https://aclanthology.org/2024.acl-long.747/ Appendix A. Code-to-claim map Claim Current source of truth Required release evidence Full-retention doctrine and only whole-brain purge architecture-authority.json; migrations 059/089/090; whole-brain-purge.js ACL inspection, purge isolation test, signed receipt Age-neutral signed outcome ledger valence-ledger.js; valence-judge.js Complete chain verification and event counts Bounded bidirectional update stdp-kernel.js; migration 068 Down/up live-fire evidence and bound tests Signed REWEIGHT provenance governor-provenance.js; memory-provenance.js Portable provenance verification Exact transition signature housekeeper-signer.js; migrations 085/091 Cross-language transition hash and signature verification No-fork cognitive trajectory migrations 081/085/091 Fork-race and topology tests SQL/portable classification-summary parity cognitive-weight-verifier.js; migration 091 Declared parity vector, parity=true, and independently recomputed portable corpus proof root Signed recall receipt native-recall.js; event-ledger.js Per-question verified receipt and Merkle recomputation Signed poison traceability migration 092; memory-epistemic-classifier.js; epistemic-trust-retrieval.js Per-memory label transitions, complete chain verification, clean-label rate, and final N=100 traceability aggregate Poisoning robustness N=100 protocol Target-level clean/attacked artifact bundle Appendix B. Claim language allowed at submission Allowed only when supported by final artifacts: • “tamper-evident under the stated cryptographic and key-custody assumptions”; • “authorization-gated for ordinary runtime roles”; • “full historical trajectory retained”; • “recall evidence verified at disclosure time”; • “N=100 target-level estimate with a 95% Wilson interval.” Forbidden: • “tamper-proof” or “unhackable”; • “cryptography proves truth”; • “first signed memory system” without a completed novelty review; • “state of the art” without strictly comparable published protocols; • claims about mechanisms or experiments not evaluated in this paper.