# Pathrule Pattern: Agent Memory (1.0.0) # ::pathrule:package:agent-memory ### [RULE] Authorize memory writes and reads by tenant and subject (path: /src/ai/memory) Memory isolation is enforced before storage queries and again before retrieved content enters model context. A vector similarity match can cross tenants, users, projects, or consent boundaries when authorization is treated as a post-filter. Enforce this boundary in /src/ai/memory so invalid work stops before it reaches another subsystem or creates an externally visible side effect. - Partition or filter every write and query with server-derived tenant, subject, workspace, and memory-class identifiers. - Authorize the requested memory class and purpose independently from access to the current conversation. - Recheck each retrieved record before context assembly because indexes and metadata can drift. - Never let model-generated filters, namespaces, or owner IDs override the authenticated scope. Verification: Seed near-identical memories across tenants and subjects, corrupt one index label, and attempt model-supplied scope changes; confirm no unauthorized text reaches context. --- ### [MEMORY] Different memory classes have different lifecycles (path: /src/ai/memory) Working context, episodic events, distilled semantic knowledge, and explicit user preferences differ in authority, retention, update, and retrieval behavior. Give each class its own schema, write trigger, provenance requirement, expiry, correction policy, and ranking signals. Do not promote conversation summaries into user-authored preferences or verified facts. Keep ephemeral task state out of durable indexes once the task ends. Require stronger evidence and review for memory that can authorize tools or change high-impact behavior. Keep the decision explicit at /src/ai/memory; moving it into an incidental caller makes behavior depend on which route happened to execute first. See /src/ai for context assembly and /src/db for deletion and audit state. That related boundary consumes this decision and carries the evidence that proves it still holds. --- ### [MEMORY] Every memory carries source, time, and confidence (path: /src/ai/memory) A fluent statement without provenance is impossible to distinguish from inference, outdated information, or attacker-planted text. Store the source event or record, observation time, author or producer, memory class, confidence basis, and supersession links. Rank current primary evidence above repeated paraphrases of the same source. Expose provenance to the agent so it can qualify uncertain or stale claims. Do not increase confidence merely because the same generated claim appears in several derived summaries. Keep the decision explicit at /src/ai/memory; moving it into an incidental caller makes behavior depend on which route happened to execute first. See /src/db for immutable provenance and the agent memory audit skill for quality review. That related boundary consumes this decision and carries the evidence that proves it still holds. --- ### [MEMORY] Forgetting uses tombstones across derived stores (path: /src/db) Deleting the canonical row is insufficient when embeddings, summaries, caches, exports, and backups can continue returning or recreating the memory. Create a durable deletion or supersession record keyed to every derived artifact and block retrieval immediately. Remove active copies asynchronously with idempotent jobs and retain only the minimum non-content evidence needed to prevent re-import. Reapply tombstones after index rebuilds and backup restoration before serving queries. Distinguish user correction, expiry, policy deletion, and source retraction so future ingestion behaves correctly. Keep the decision explicit at /src/db; moving it into an incidental caller makes behavior depend on which route happened to execute first. See /src/ai/memory for retrieval filtering and /src/ai for context invalidation. That related boundary consumes this decision and carries the evidence that proves it still holds. --- ### [SKILL] audit-agent-memory (path: /) --- name: audit-agent-memory description: Audit agent memory for provenance, isolation, freshness, contradiction, retrieval quality, and deletion behavior. --- # Audit Agent Memory Run this procedure whenever the governed surface changes or its operational evidence becomes stale. 1. Sample each memory class and trace records to source, subject, tenant, observation time, confidence basis, retention, and supersession state. 2. Run retrieval tests with authorized, unauthorized, stale, contradictory, corrected, and adversarially similar memories across tenants. 3. Inspect context assembly for provenance visibility, token budgeting, duplicate evidence, and instructions embedded inside remembered content. 4. Delete and correct seeded memories, rebuild the index, and restore a test backup; confirm tombstones prevent every active and regenerated copy. Record the decision, failed checks, and follow-up owner with the change. A successful run leaves reproducible evidence that another reviewer can inspect without repeating the investigation from memory.