Paper deep dive
MutMem-V2: Cryptographically Authorized Mutation in Persistent Agent Memory Portable Verification and Reproducible Evidence
Walid Saidi
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 91%
Last extracted: 9/8/2026, 2:46:03 AM
Summary
The paper introduces MutMem V2, a protocol for cryptographically authorized mutation in persistent agent memory, focusing on portable verification and reproducible evidence. It defines canonical object schemas, bundle commitments, and cross-object predicates to ensure integrity, authorization, and traceability. The authors provide independent Node and Python implementations that achieve 100% agreement on 72 structural and cryptographic terminals, alongside a production-conformance corpus verifying 42/42 cases. The work emphasizes reproducibility through clean installation paths and self-hashed aggregates, distinguishing current V2 evidence from historical V1 results.
Entities (10)
Relation Signals (8)
MutMem V2 → extends → MutMem V1
confidence 95% · MutMem V2 closes that publication gap [of V1] without introducing a second memory engine.
MutMem V2 → uses → Ed25519
confidence 95% · requires the retained Ed25519 signature
MutMem V2 → uses → SHA-256
confidence 95% · domain-separated SHA-256 commitments
Node → agreeswith → Python
confidence 92% · Independent Node and Python implementations agree on verdict and primary reason for all 72 structural and cryptographic terminals
HOM-AIMOS → implements → MutMem V2
confidence 90% · HOM-AIMOS is one producer and case study.
Node → implements → MutMem V2
confidence 90% · Independent Node and Python implementations agree on verdict
Python → implements → MutMem V2
confidence 90% · Independent Node and Python implementations agree on verdict
Canary experiment → demonstrates → explicit-marker traversal
confidence 88% · A separately scoped 120-unit Canary experiment supports only explicit-marker traversal.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:MutMem V1 introduced retention-preserving, cryptographically authorized mutation for persistent agent memory but did not provide a complete portable verification contract or clean-install reproduction path. MutMem V2 closes that publication gap without introducing a second memory engine. It specifies exact canonical bytes, domain-separated object and bundle commitments, mandatory recall-evidence membership and ordering, external trust anchors, identity epochs, revocation, authorization, request receipts, ordered disclosure, and three mutation terminal types. The released protocol contains 18 versioned object schemas, 39 recall vectors, 15 mutation vectors, and 37 closed recall failure reasons. Independent Node and Python implementations agree on verdict and primary reason for all 72 structural and cryptographic terminals; a production-conformance corpus agrees on 42/42 cases across 28 required classes. A clean Node v26.8.1 installation reaches first-boot, restart, and scheduler readiness with no experimental memories. A separately scoped 120-unit Canary experiment supports only explicit-marker traversal. Every public table regenerates from a self-hashed aggregate, and an independent verifier reconstructs the statistics and claim boundaries. Historical V1 empirical results remain historical. MutMem V2 supports claims about portable integrity, authorization, traceability, conformance, and reproducibility under stated assumptions; it does not establish semantic truth, universal robustness, or independent replication.
Tags
Links
- Source: https://arxiv.org/abs/2609.01235v1
- Canonical: https://arxiv.org/abs/2609.01235v1
Trouble viewing inline? Open PDF directly →
Full Text
36,840 characters extracted from source content.
Expand or collapse full text
MutMem V2: Cryptographically Authorized Mutation in Persistent Agent Memory Portable Verification and Reproducible Evidence Walid Saidi Affiliation: Independent researcher Evidence-audited manuscript candidate, September 2026 Abstract MutMem V1, published as “MutMem: Cryptographically Authorized Mutation in Persistent Agent Memory,” introduced retention-preserving, cryptographically authorized mutation for persistent agent memory and reported utility, mutation-integrity, and targeted-poisoning results. Its principal publication gap was not another retrieval mechanism: it was the absence of a complete portable verification contract and a reviewer-facing path from a clean installation to independently checkable evidence. MutMem V2 closes that gap without creating a second memory engine. It specifies exact canonical bytes, domain-separated object and bundle commitments, mandatory recall-evidence membership and order, external trust anchors, identity epochs, revocation state, authorization, request receipts, ordered disclosure, and three mutation terminals. The current protocol contains 18 versioned object schemas, 39 recall predicate vectors, 15 mutation vectors, and 37 closed recall failure reasons. Independent Node and Python implementations agree on verdict and primary reason for all 72 structural and cryptographic terminals; a separate production-conformance corpus agrees on 42/42 cases spanning 28 required classes. A clean Node v26.8.1 installation reaches first-boot, restart, and scheduler readiness with no experimental memories. A separately scoped Canary experiment completes 120 explicit-marker and clean units; it is evidence of declared marker traversal only. Every public table is regenerated from a self-hashed aggregate, and an independent verifier reconstructs its statistics and claim boundaries. Historical V1 empirical results remain historical rather than being relabeled as V2 reruns. MutMem V2 supports claims about portable integrity, authorization, traceability, conformance, and reproducibility under stated assumptions. It does not establish semantic truth, universal robustness, or independent replication. Reproducibility and release status. Repository: https://github.com/wallidsaydi-creator/HOM-AIMOS. Published predecessor: arXiv:2608.02843. The evidence source commit is eb0166fd45964ebb47ca053bcfeb0ab3ddc68999, and the closed publication-evidence root is 99bed29dcf0c5c2f597f17b69be8d6dc990bae4ae5d30838a1d1f34d92a76b. The public release is https://github.com/wallidsaydi-creator/HOM-AIMOS/releases/tag/v1.0.0, immutable tag v1.0.0, commit fcda26d1e05c729185c09d11446db2f79c14a0d, with source-manifest root f0cdb75763c70ce83bfd1e5f6c956e7502b65a812c3a43f311f8039ba0c3b7f1. Offline verification is exactly npm run verify; deterministic evidence regeneration is exactly npm run evidence:regenerate. For an ordinary agent identifier stored in shell variable AGENT_ID after installer onboarding, the exact multi-line utility reproduction command is: npm run reproduce -- --installed-instance canonical \ --agent-id "$AGENT_ID" --full --benchmark both \ --protocol canonical-blind-v1 Source code is AGPL-3.0-or-later. The repository license applies to AIMOS-authored artifact files. Dataset text is not redistributed; downloaded materials retain upstream licenses. Historical V1 utility used GPT-5.4 for generation and GPT-5.6 Terra for judgment; the historical poisoning lane used GPT-5.5 and GPT-5.6 Terra. Provider access is operator-authenticated, and no credential or provider payload is released. Highest support level: the protocol and evidence are independently verifiable, and one clean installation is qualified; the empirical findings have not been independently replicated. The immutable public tag, release commit, GitHub Release, and source-manifest root are mutually bound. This manuscript is publication-authorized for arXiv submission; the arXiv identifier is necessarily recorded after submission acceptance. 1 Introduction Persistent memory creates two separable research problems. The first is how an agent may adapt retained evidence while preserving authorship, prior state, and the reason for change. MutMem V1 addressed that problem with append-only outcome evidence, bounded bidirectional weight transitions, signed provenance, and ordered recall receipts [1]. The second problem is how a reviewer can verify those claims without trusting the production database, its runtime, or a prose description of the system. A self-consistent implementation is not yet a portable protocol: its object boundaries, byte encodings, trust roots, failure reasons, result cardinality, and terminal states must be explicit. MutMem V2 addresses the second problem. MutMem denotes the portable protocol; HOM-AIMOS is one producer and case study. The portable verifier does not select memories, authorize requests, sign events, mutate storage, or operate a second runtime. It consumes finite evidence objects and returns a deterministic terminal verdict. [V2-PORTABLE-PROTOCOL] The paper makes four contributions: 1. It defines a versioned recall-disclosure envelope whose complete membership is 13+5r13+5r objects for r disclosed results, with deterministic ordering, exact canonical bytes, and domain-separated SHA-256 commitments. 2. It defines cross-object predicates for external trust, actor and Housekeeper epochs, revocation, effective authorization, signed request and receipt parity, native decision bindings, per-result provenance and occurrence evidence, Merkle order, and signed terminal receipts. 3. It defines a portable mutation profile that preserves the native outcome schema and distinguishes an authorized transition, a signed no-op, and an occurrence observation. 4. It supplies independent Node and Python verifiers, a production-derived conformance corpus, a clean installer qualification, deterministic publication regeneration, an attempt ledger, and a complete claim-to-evidence map. The contribution is deliberately narrower than “secure memory.” Cryptographic integrity does not imply that remembered content is true. A fixed poisoning experiment does not imply universal detection. Exact verifier parity does not imply independent empirical replication. These are protocol boundaries, not disclaimers added after observing results. [CONTENT-TRUTH] [UNIVERSAL-DEFENSE][INDEPENDENT-REPLICATION] 2 Evidence identities and support levels We use three non-interchangeable evidence labels: • current V2 denotes evidence produced or reverified for the portable V2 protocol, independent verifiers, conformance corpus, explicit-marker Canary lane, or clean installer. • historical V1 denotes immutable empirical evidence released with MutMem V1. It may be cited as a historical comparator but is not a current V2 benchmark run. • boundary denotes an omitted or prohibited claim. Missing evidence is never converted into a zero, success, or defense. The manuscript binds the claim map 4d8d23442e9ed311e33d9ce9a79e878642eba93329c460e203128e54997527 and independent verification f38268c86f2291971ac6ab75ded944d9a7e7eb6fa2809a5367d69dacd450ffe0. The claim map names the code, protocol, artifact, verifier, denominator, and limitation for every quantitative or security statement. The evidence package contains 7 deterministic files including its manifest; the manuscript assets are generated separately from that root. 3 System and threat model 3.1 Principals and boundary The production producer has an external master trust anchor, an ordinary actor or the Housekeeper system principal, append-only identity epochs and revocation state, a signed authorization projection, a canonical SAVE path, a canonical RECALL path, and restricted database-local writers. The portable verifier is an evidence consumer. It neither possesses producer credentials nor infers a trust root from the bundle it is asked to verify. For ordinary actors, the evidence bundle must bind the exact company, actor identifier, identity epoch, certificate fingerprint, unrevoked state, effective grant, requested clearance, data class, method, path, canonical request body, nonce, and signing time. For the Housekeeper, the system-principal profile is structurally distinct from a master-signed ordinary grant; signature-bearing grant fields are forbidden in that profile. This separation prevents a system principal from masquerading as an ordinary master-signed grant and prevents an ordinary identity from inheriting Housekeeper authority. 3.2 Adversary The verifier is designed to detect malformed canonical objects, object or bundle substitution, wrong trust roots, identity or epoch substitution, stale or revoked authority, request replay or route mismatch, result omission or reordering, provenance and occurrence substitution, Merkle mismatch, terminal-receipt drift, and mutation-topology inconsistency. The adversary may control transport and may modify copied evidence. The adversary may not break SHA-256 collision resistance or Ed25519 existential unforgeability, and the reviewer must obtain the expected master fingerprint and release identity through an external channel. An attacker who replaces both the evidence and every external trust anchor can present a different self-consistent world. MutMem does not solve that anchor distribution problem. It also does not prove availability, confidentiality, semantic truth, model honesty, or protection against every form of memory poisoning. 4 Portable recall-disclosure protocol 4.1 Canonical objects Let H=SHA256H=SHA256, let J(x)J(x) be the protocol’s deterministic canonical-JSON bytes, let LP4(x)LP_4(x) prepend the unsigned four-byte big-endian byte length of UTF-8 string x, and let BEk(x)BE_k(x) encode integer x in k big-endian bytes. Every variable-length field is either canonical JSON or explicitly length-framed. The object domain DoD_o is the UTF-8 byte string hom.aimos.mutmem-portable-object/v2 followed by a zero byte. For kind kjk_j, schema sjs_j, and body bjb_j, the object commitment is oj=H(Do∥LP4(kj)∥LP4(sj)∥BE4(|J(bj)|)∥J(bj)).o_j=H\! (D_o \|LP_4(k_j) \|LP_4(s_j) \|BE_4(|J(b_j)|) \|J(b_j) ). (1) Bodies reject unsupported or non-finite numbers, unsafe integers, nesting beyond the protocol limit, and bodies larger than the declared maximum. Object schemas are exact, not advisory labels. These choices follow the prefix-free framing and domain-separation discipline used in cryptographic protocol design [6] and the deterministic JSON discipline standardized by JCS [5]. 4.2 Complete membership and deterministic order Each recall bundle contains thirteen singleton objects: trust anchor; actor identity and revocation; Housekeeper identity and revocation; effective grant; request envelope; request receipt; content-state decision; epistemic decision; final security closure; return projection; and native recall receipt. Each disclosed result contributes five objects: memory state, provenance chain, occurrence, epistemic projection, and receipt evidence. Therefore, for r results, Nobjects(r)=13+5r,0≤r≤200.N_objects(r)=13+5r, 20.00003pt0≤ r≤ 200. (2) Every singleton kind occurs exactly once. Every result ordinal from 00 through r−1r-1 contains all five result kinds and one subject identifier shared across the group. Objects are ordered first by the fixed singleton order and then by result ordinal and fixed result-kind order. Duplicate, missing, mixed-subject, or out-of-range objects fail before relational evaluation. The ordered object descriptors are committed with the RFC 6962 construction [3]. If xix_i denotes canonical bytes for descriptor i, Li L_i =H(0x00∥xi), =H( 0x00 \|x_i), (3) T(a,b) T(a,b) =H(0x01∥a∥b), =H( 0x01 \|a \|b), (4) with an empty root H(ϵ)H(ε) and recursive split at the largest power of two strictly smaller than the current list length. Leaf/node domain separation prevents a node encoding from being confused with a leaf encoding under the hash assumption. 4.3 Envelope commitment Let DbD_b be hom.aimos.mutmem-portable-evidence/v2 followed by a zero byte, u the bundle identifier, c the company identifier, f the externally expected 32-byte master fingerprint, r the result count, and R the object root. The bundle commitment is B=H(Db∥LP4(u)∥LP4(c)∥f∥BE8(r)∥R).B=H\! (D_b \|LP_4(u) \|LP_4(c) \|f \|BE_8(r) \|R ). (5) The master fingerprint is an input to verification; accepting the fingerprint solely because it appears inside the bundle would be circular trust. The structural predicate evaluator therefore reports that cryptographic signatures and external trust remain unverified. Independent verifiers must check them. 4.4 Cross-object predicates The recall predicate graph enforces exact equality across five boundaries: 1. Authority: trust anchor, actor epoch, certificate, revocation, Housekeeper epoch, authorization, and request time agree. 2. Admission: signed method and path are POST and /aimos/recall; request-body, normalized-command, request-receipt, nonce, signature, and authorization mutation commitments agree. 3. Decision composition: content-state roots, epistemic decision, final security closure, return path, projected identifiers, and content hashes agree, with no canonical-memory or retention mutation. 4. Per-result evidence: memory, provenance, occurrence, epistemic, and receipt objects agree on subject, live-content hash, save and binding mutations, occurrence reference, ordinal, and selected membership. 5. Terminal receipt: Merkle entries, root, result count, actor, request, authority, Housekeeper certificate, event content hash, predecessor, nonce, signing time, signature, and revocation evaluation agree. The failure vocabulary is closed: an undeclared failure reason is itself an error. This makes verdict/reason parity testable across implementations instead of permitting semantically similar but incomparable exceptions. 5 Portable mutation profile MutMem V2 does not introduce a new cognitive update rule. It preserves the native V1 mutation-outcome schema and makes its evidence portable. Let DμD_μ be hom.aimos.mutmem-portable-mutation-evidence/v2 followed by a zero byte, and let M be the canonical body containing the recall commitment, outcome evidence, recall receipt, outcome event, signed valence evidence, terminal, and optional cognitive projection. The portable mutation commitment is Bμ=H(Dμ∥J(M)).B_μ=H(D_μ \|J(M)). (6) Three terminals are exhaustive: • authorized_transition: a principal-state outcome binds a terminal REWEIGHT provenance node and a nontrivial cognitive projection; • signed_noop: the signed outcome is retained, but no projection is fabricated when the quantized weight is unchanged; and • occurrence_observation: occurrence-scoped evidence is retained with no weight authority. For an authorized transition, the verifier reconstructs the V1 projection and transition hashes from the memory identifier, integer milliscale old/new weights, provenance mutation, predecessor projection, and company. It requires the retained Ed25519 signature and exact signer epoch; Ed25519 itself is a standard primitive, not a MutMem contribution [4]. [V1-MUTATION-INTEGRITY] 6 Independent verification 6.1 Two implementations, one terminal language The production-language reference and independent Python implementation consume the same public vectors but do not share verifier code. Four lanes cover recall structure, mutation structure, recall cryptography, and mutation cryptography. Across all 72 vectors, both implementations match the expected valid/invalid terminal and exact primary reason. This count is not a benchmark accuracy denominator: it is a conformance denominator. [V2-INDEPENDENT-VERIFIER] The structural vector sets contain valid bundles and one negative vector for each declared recall or mutation failure family. Cryptographic vectors add signature, certificate, epoch, revocation, and trust-anchor checks. The verification implementation is read-only and has no runtime importer, database, network, signing, model, or policy authority. 6.2 Production-derived conformance corpus A separate corpus projects production-shaped recall evidence into public test objects and evaluates it with the production protocol owners and an independent verifier. All 42 intended cases are observed, cover 28 required classes, and agree on terminal verdict and protocol reason. This establishes production/protocol conformance for the released corpus. It does not establish retrieval quality or robustness against unrepresented attacks. [V2-PRODUCTION-CONFORMANCE] 6.3 Complexity and failure closure For n=13+5rn=13+5r objects, membership construction uses maps keyed by singleton kind and result ordinal, then performs one fixed-order traversal in O(n)O(n) time. The Merkle tree contains n leaf hashes and n−1n-1 internal hashes, hence O(n)O(n) hash evaluations. The current JavaScript reference uses recursive array slices; accounting for those copies gives O(nlogn)O(n n) implementation time in the worst case, O(n)O(n) retained tree state, and O(logn)O( n) recursion depth, with r≤200r≤ 200. This bound is preferable to describing the hash-node count as the complete runtime cost. The failure language is finite and versioned; new predicates require a new vector and protocol root rather than an unrecorded exception. 7 Reproducibility architecture 7.1 Verification, installation, and reproduction are different The offline verification command checks retained public artifacts and executes the independent Node/Python vector suites without opening AIMOS or a provider. Evidence regeneration independently rebuilds publication tables, the attempt ledger, disclosure boundary, and claim map. Neither command writes memory. The installer is a separate product operation. The qualified run used Node v26.8.1, completed first boot and restart, registered the required scheduler, retained 8 Guide memories and 0 experimental memories, and capped the ordinary enrolled agent at clearance 10. This is one clean-install qualification, not cross-platform coverage or a scientific benchmark. [V2-CLEAN-INSTALLER] Full reproduction is intentionally distinct from verification. It uses the installer-selected ordinary agent, canonical signed SAVE and RECALL, fixed dataset locks, fixed model roles, complete terminal evidence, and the integer denominator invariant nintended=nselected=ncompleted=nevaluated,nincomplete=nfailed=0.n_intended=n_selected=n_completed=n_evaluated, 20.00003ptn_incomplete=n_failed=0. (7) A mutable status flag is insufficient. The terminal binds the selected immutable aggregate path and hash, required phase summaries, environment identity, and the exact requested benchmark set. A stale predecessor cannot be substituted for its completed immutable successor. 7.2 Datasets, models, and environment The public package carries corpus manifests, source locks, target locks, downloaders, and hashes. It does not redistribute LongMemEval, LoCoMo, Natural Questions/BEIR, or PoisonedRAG text. Historical V1 model identities are retained beside their results. Credentials, provider requests and responses, benchmark text, memory identifiers, certificates, and machine paths are outside the public evidence boundary. Each new run must record operating system, architecture, CPU, memory, Node binary, package and lock hashes, dependency versions, PostgreSQL and extensions, concurrency, protocol configuration, model identities, native surfaces, and start/capture times. This environment record is descriptive evidence, never identity or configuration authority. 8 Statistical contract For a binary outcome with x successes in n intended units, the estimate is p^=x/n p=x/n. The two-sided 95% Wilson interval uses z=1.959963984540054z=1.959963984540054: p^+z2/(2n)±zp^(1−p^)/n+z2/(4n2)1+z2/n. p+z^2/(2n)\ ±\ z p(1- p)/n+z^2/(4n^2)1+z^2/n. (8) For paired binary outcomes with discordant counts b and c, the exact two-sided McNemar value is pMcN=min(1,2∑k=0min(b,c)(b+ck)2−(b+c)).p_McN= \! (1,2 _k=0 (b,c)b+c k2^-(b+c) ). (9) Within each declared family of m contrasts, raw values are ordered p(1)≤⋯≤p(m)p_(1)≤·s≤ p_(m) and Holm adjustment is p~(i)=max1≤j≤imin(1,(m−j+1)p(j)). p_(i)= _1≤ j≤ i \! (1,(m-j+1)p_(j) ). (10) Agreement uses κ=(po−pe)/(1−pe)κ=(p_o-p_e)/(1-p_e) from public agreement counts and positive marginals. Integers and hashes require exact equality; derived rates, Wilson intervals, McNemar values, Holm adjustments, and κ use numerical tolerance 10−1210^-12. The historical Canary artifact stores Wilson bounds to eight decimals; comparison to those source bounds uses 5×10−95× 10^-9, while the generated table retains full precision. The independent evidence verifier reconstructs 44 rate/Wilson rows and 28 McNemar/Holm rows. V1 bootstrap intervals are not repeated in V2 tables because their private rows are unavailable; retaining a historical point estimate is not the same as claiming independent row-level regeneration. 9 Evidence results Table 1: Current MutMem V2 reproducibility and conformance evidence. Counts are verification units, not benchmark accuracy. Evidence family Verified result Interpretation Portable protocol 18 schemas; 39 recall vectors; 15 mutation vectors; 37 recall failure codes Versioned bytes, membership, predicates, and terminal vocabulary Independent Node/Python verifier 72/72 exact verdict and reason terminals; 10/10 exit criteria Verifier portability, not empirical utility Production conformance corpus 42/42 cases across 28 required classes Production/independent parity Canary explicit-marker lane marked 60/60; clean flags 0/60 Explicit marker traversal only Clean installer qualification Node v26.8.1; first boot, restart, and scheduler ready; 0 experimental memories One same-user installed system; no benchmark result 9.1 Current V2 results Table 1 separates verification units from empirical accuracy. Exact Node/Python parity and production conformance support a portable verifier claim. They do not imply that another memory engine produces the same utility results. The Canary evidence contains 120 terminal units: all 60/60 marked units were detected (100.0%; Wilson lower 93.98%), and 0/60 clean units were flagged (0.0%; Wilson upper 6.02%). This supports only explicit marker traversal across the declared transport cells. It is not evidence of arbitrary poison, prompt-injection, or semantic social-engineering detection. [V2-CANARY] 9.2 Historical V1 evidence Table 2: Historical MutMem V1 results, reproduced from the self-hashed V1 aggregate. These are not current-source V2 reruns. Protocol and metric Historical V1 result Boundary LongMemEval, LLM-judged accuracy 459/500 (91.80%; Wilson 95% CI 89.06–93.90%) GPT-5.4 generator; GPT-5.6 Terra judge LoCoMo, LLM-judged accuracy 1472/1986 (74.12%; Wilson 95% CI 72.15–76.00%) Distinct from token F1 LoCoMo, category-aware token F1 58.20 Bootstrap interval omitted in V2: private rows unavailable PoisonedRAG adaptation, induced ASR 1/98 (1.02%) Baseline-aware effect: clean 2/100; attacked 3/100 PoisonedRAG adaptation, poison retrieval@5 0/100 (Wilson upper 3.70%) Retention plus retrieval isolation, not deletion Mutation integrity 7/7 authorization; 4/4 tamper cases 20 measured native transitions Mutation transaction cost median 4.865 ms; p95 5.674 ms; 966.35 logical bytes/transition Single historical machine and full transaction Blinded system-author agreement 193/200 (96.5%; κ=0.9108κ=0.9108) Not independent human validation Table 2 is intentionally labeled historical. LongMemEval and judged LoCoMo used the historical canonical-blind protocol; the LoCoMo token F1 result used a separate deterministic scorer and must not be averaged with judged accuracy. [V1-LONGMEMEVAL-UTILITY] [V1-LOCOMO-JUDGED][V1-LOCOMO-F1] The historical N=100 PoisonedRAG result is an adaptation: target fixture and attacker passages were locked, but corpus scope, retriever, and answer model differed from the upstream full-corpus experiment [7]. All poison passages were retained. Retrieval isolation and signed epistemic labels are not save-time rejection, deletion, or proof that content is false. The observed clean target-answer leakage was 2/100, while the attacked target-match rate was 3/100. The baseline-aware attack-attributable result was therefore an induced ASR of 1/98 (1.02%), which is the effect reported in Table 2. The observed clean and attacked answer accuracies were 72.0% and 71.0%, respectively; all 500/500 poison memories received an adverse signed projection, and 4/18808clean memories did as well (0.0213%). [V1-POISONEDRAG] Table 3: Historical V1 fixed-corpus PoisonedRAG ablation. Each arm contains 100 paired targets. Arm poison retrieval@5 clean accuracy attacked accuracy A0 94/100 71.0% 40.0% A1 0/100 68.0% 65.0% A2 0/100 68.0% 71.0% A3 0/100 69.0% 69.0% The historical fixed-corpus ablation in Table 3 attributes the measured selection change to already-produced signed stored labels. A2 added query-local detection but made no additional selection change after A1; active-context withholding was not exercised. The experiment therefore does not establish how either mechanism behaves on unseen attacks. [V1-EPISTEMIC-ABLATION] The historical mutation measurements cover one complete native transaction, including signatures, provenance, projection, and live-weight update. They are not isolated cryptographic overhead and should not be generalized across machines. [V1-MUTATION-LATENCY-STORAGE] The historical agreement audit was blinded to arm and judge verdict but was performed by the system author. It is an agreement diagnostic, not independent human validation. [V1-HUMAN-AGREEMENT] 10 Attempt accounting and disclosure The public attempt ledger preserves intended population, terminal population, terminal failures, retries when known, exclusions, amendments, and reused artifacts. Two failed installed-service attempts remain failures with zero result authority. A later one-question diagnostic remains diagnostic only. None appears in a result table, abstract, or comparison. For promoted numerical evidence, intended and terminal populations are equal, with zero terminal failures and zero exclusions. Unknown historical retry details are explicitly unknown, not zero. The public/private manifest withholds private V1 rows, provider payloads, restricted dataset text, credentials and certificates, live memories, and identity-bearing installer receipts. It exposes sanitized aggregates, semantic roots, source locks, and non-identifying readiness projections instead. The SABER-inspired operational figures are omitted because their exact private artifact is not in verified custody; no value from that family appears in this paper. [SABER-OPERATIONAL-NUMBERS] 11 Security argument and non-goals Commitment substitution. Under collision resistance, changing a canonical object field changes Equation 1, the object root, and Equation 5, except with negligible collision probability. Omitting or duplicating a mandatory object fails Equation 2 before signature verification. Authority substitution. A bundle does not choose its own trusted master. Actor and Housekeeper certificate chains, validity intervals, revocation observations, grant scope, signed request, and terminal event are checked against the externally selected trust anchor. Under Ed25519 unforgeability, altering a signed commitment without the corresponding private key fails signature verification. Ordering and terminal fidelity. Per-result ordinals and fixed kind order enter the Merkle root. The terminal event binds the request, authority, root, evidence list, return projection, and result count. Reordering a valid set or replacing the terminal projection is detectable. These arguments establish tamper evidence under the assumptions. They do not prevent a storage administrator from destroying evidence, prove that signed content is true, or guarantee that every harmful input is detected. Availability and semantic validation require separate mechanisms and evidence. 12 Limitations 1. No current V2 utility rerun. Utility, mutation performance, PoisonedRAG, ablation, and human agreement remain historical V1 results. V2 does not relabel them as results of the current source. 2. No independent empirical replication. The verifier implementations are independent, but the empirical experiments have not been repeated by an outside team. 3. Private V1 rows are unavailable. Public counts, Wilson intervals, McNemar/Holm contrasts, and agreement marginals reconstruct. V1 fixed-seed bootstrap intervals do not independently reconstruct and are omitted from V2 tables. 4. Canary scope is marker-specific. Marker traversal is not a general detector for poisoning, prompt injection, or false content. 5. PoisonedRAG is adapted and post-calibration. It does not match the upstream full corpus and does not estimate unseen-attack generalization. 6. SABER figures are omitted. Artifact custody is insufficient for numerical publication. 7. Installation coverage is bounded. One macOS installation on Node v26.8.1 is qualified. Other declared runtimes still require release CI and do not inherit this result automatically. 8. External anchors are necessary. Replacing all evidence and all independent trust anchors is outside the threat model. 9. Archival identifier pending. The immutable source manifest, release commit, tag, and GitHub Release are mutually bound. The arXiv identifier cannot be recorded until submission acceptance. 13 Ethics and responsible release The poisoning materials contain attacker-crafted misinformation and restricted dataset content. The release distributes hashes, manifests, aggregate outcomes, and acquisition instructions rather than benchmark passages or provider payloads. Reproduction must use a fresh installed brain and must not ingest benchmark material into a user’s ordinary persistent memory. A detected item is retained with signed epistemic evidence; classification is reversible and is not presented as factual adjudication. The verifier’s public failure reasons are designed for audit, but operational receipts may contain identity and storage metadata. Such receipts remain outside the public evidence allowlist. Public evidence contains no credential, private key, certificate, live memory content, or absolute machine path. 14 Related work Tamper-evident logging uses cryptographic commitments to make history substitution detectable [2]. Certificate Transparency defines the domain-separated Merkle construction used here for ordered evidence [3]. MutMem combines established SHA-256, Ed25519 [4], canonical JSON [5], and length-framed protocol encodings [6]; none of those primitives is claimed as novel. LongMemEval and LoCoMo measure long-horizon memory utility [8, 9]. PoisonedRAG studies knowledge-corruption attacks against retrieval-augmented generation [7]. Those works motivate evaluation but do not by themselves provide a portable authorization and evidence profile for post-deployment memory mutation. MutMem V1 introduced the retained mutation construction and historical system evaluation [1]. V2’s narrower contribution is to make its evidence boundaries, canonical bytes, terminal reasons, independent verification, installation, and publication derivation explicit. 15 Conclusion MutMem V2 turns an implementation-bound integrity claim into a versioned, externally anchored verification protocol. Complete recall and mutation bundles bind canonical objects, cross-object authority, result identity, ordered disclosure, and terminal events. Independent Node and Python implementations agree on the full released terminal corpus, production-derived cases agree with the independent verifier, and one clean installer reaches restart-stable readiness. Publication tables, attempts, omissions, and limitations regenerate from a single evidence root. The result is a stronger reproducibility claim, not a broader security claim. Historical V1 empirical findings remain historical. Canary evidence remains marker-specific. SABER numerical evidence remains omitted. Integrity and authorization remain distinct from truth, and verifier independence remains distinct from independent empirical replication. The public release identity is mutually bound; the archival identifier is recorded after acceptance. References [1] W. Saidi, “MutMem: Cryptographically Authorized Mutation in Persistent Agent Memory,” arXiv:2608.02843, 2026. [2] S. A. Crosby and D. S. Wallach, “Efficient Data Structures for Tamper-Evident Logging,” 18th USENIX Security Symposium, 2009. [3] B. Laurie, A. Langley, and E. Kasper, “Certificate Transparency,” RFC 6962, 2013. [4] S. Josefsson and I. Liusvaara, “Edwards-Curve Digital Signature Algorithm (EdDSA),” RFC 8032, 2017. [5] A. Rundgren, B. Jordan, and S. Erdtman, “JSON Canonicalization Scheme (JCS),” RFC 8785, 2020. [6] D. Boneh and V. Shoup, A Graduate Course in Applied Cryptography, version 0.6, 2023. [7] W. Zou, R. Geng, B. Wang, and J. Jia, “PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models,” 34th USENIX Security Symposium, 2025. [8] D. Wu, H. Wang, W. Yu, Y. Zhang, K.-W. Chang, and D. Yu, “LongMemEval: Benchmarking Chat Assistants on Long-Term Interactive Memory,” ICLR, 2025. [9] A. Maharana, D.-H. Lee, S. Tulyakov, M. Bansal, F. Barbieri, and Y. Fang, “Evaluating Very Long-Term Conversational Memory of LLM Agents,” ACL, p. 13851–13870, 2024. Appendix A Complete claim-to-evidence disposition Table 4: Complete manuscript claim-to-evidence disposition. Claim identifier Disposition Denominator Limitation V1-LONGMEMEVAL-UTILITY HISTORICAL V1 459/500 Historical V1 result; model-judged and not a current-source V2 benchmark. V1-LOCOMO-JUDGED HISTORICAL V1 1472/1986 Historical V1 judged accuracy; never merged with token F1. V1-LOCOMO-F1 HISTORICAL V1 1986 Point estimate remains in the V1 aggregate; bootstrap interval omitted because private rows are unavailable. V1-POISONEDRAG HISTORICAL V1 100 targets Adapted bounded N=100 protocol; no universal or unseen-attack claim. V1-EPISTEMIC-ABLATION HISTORICAL V1 100 paired targets per arm Fixed-corpus causal evidence; query-local contribution was null and withholding was not exercised. V1-MUTATION-INTEGRITY HISTORICAL V1 20 transitions Historical retained-memory transition evidence under the V1 threat model. V1-MUTATION-LATENCY-STORAGE HISTORICAL V1 20 transitions Single-machine descriptive values; row-level inputs are unavailable for independent recomputation. V1-HUMAN-AGREEMENT HISTORICAL V1 200 answers System-author diagnostic, not independent human validation; bootstrap interval omitted. V2-PORTABLE-PROTOCOL CURRENT V2 39+15 vectors Portable verification protocol, not another memory engine or producer. V2-INDEPENDENT-VERIFIER CURRENT V2 72 terminal verdicts Cross-language verdict/reason parity proves verifier portability, not empirical utility. V2-PRODUCTION-CONFORMANCE CURRENT V2 42/42 Conformance corpus, not benchmark efficacy. V2-CANARY CURRENT V2 120/120 Explicit marker traversal only; not arbitrary poison, prompt-injection, or semantic social-engineering detection. V2-CLEAN-INSTALLER CURRENT V2 one qualified installation and restart Reproducibility evidence only; not benchmark evidence. SABER-OPERATIONAL-NUMBERS OMITTED No numerical claim Exact private artifact is not in verified custody; no numerical V2 claim is permitted. CONTENT-TRUTH PROHIBITED No numerical claim Integrity, provenance, authorization, and agreement do not establish semantic truth. UNIVERSAL-DEFENSE PROHIBITED No numerical claim Fixed marker and N=100 evidence do not establish universal robustness. INDEPENDENT-REPLICATION PROHIBITED No numerical claim No outside team independently reproduced the system or empirical results. Appendix B Verifier and regeneration commands npm run verify npm run evidence:regenerate npm run verify npm run paper:verify The first, third, and fourth commands are read-only. The second command deterministically rewrites only the public evidence projections and fails its subsequent byte check if output changes. No command in this appendix runs a benchmark.