Memory Can Be True and Still Be Unsafe

Persistent memory changes the failure surface of AI agents. A system that can recover prior decisions, facts, approvals and plans can work across sessions — but it can also confidently resume from evidence that was correct yesterday and wrong for the action it is about to take now.

The signal came from a provenance discussion.

In a Claude Code memory discussion, contributor DanceNitra separated apparent provenance coverage from actual source reachability. In the reported store, roughly 98.3% of records carried a populated source field, but only 24 records — about 0.01% — used identifiers that could actually be re-fetched. Most values behaved more like writer identities such as agent:scholar than durable origin locators.

That distinction matters. A field named source is not evidence that the source can still be revisited, enumerated, compared for drift or checked for deletion.

The same discussion exposed a second class of failure: caller-controlled metadata can become dangerous when a library later interprets that metadata as if it had been produced by its own trusted verification path.

Provenance is necessary. It is not enough.

Suppose an agent remembers that a pull request was reviewed at commit A. The review may be genuine. The evidence may be intact. But the branch can now point to commit B. A policy may have changed. A tenant may differ. An API contract may have moved. An authorization may have expired.

If the agent asks only “Was this memory valid?”, it can answer yes and still make the wrong decision.

From discussion to executable contract.

We implemented the distinction in the open-source Causal Memory Layer (CML) as a deterministic Current-State Applicability layer. The implementation was reviewed, tightened against stale-SHA and cross-repository substitution, merged, and passed Python test lanes, deterministic-contract checks, package validation, secret scanning, dependency audit and CodeQL.

The evaluator produces six explicit outcomes:

The fail-closed precedence is:

Why repository and commit binding became stricter.

During review, an important edge case appeared: if historical evidence never bound itself to a repository or commit SHA, a matching source digest could still look safe in a new code context. That would allow evidence detached from the exact pull-request head to acquire current authority.

The implementation now treats repository and commit context more strictly: when current authoritative state provides those values, missing historical bindings force REVALIDATE instead of silently returning MATCH.

This is a small rule with a large implication: absence of historical context is not permission to assume continuity.

Environment should be purpose-bound, not globally hashed.

Not every change should invalidate every memory. Changing an unrelated README should not necessarily revoke a memory about a tenant-scoped billing rule. Applicability therefore needs a purpose-bound context fingerprint: only dimensions relevant to the action should participate in the decision.

The category shift: expire authority, not truth.

Traditional caches often ask when data becomes stale. Agent memory needs an additional question: when does a memory stop being allowed to influence an action without fresh verification?

A past approval should remain part of the audit trail even after it expires. A historical commit review should remain true even after the branch moves. A deleted source should not be rewritten as if it never existed. History should remain history.

This should not become a vendor moat.

We shared the proposal with both Anthropic and OpenAI. The reason is deliberate: memory revalidation is more valuable as an interoperable safety primitive than as a vendor-specific trick. Different agent systems should be able to disagree about models while still exchange evidence about source integrity, environment binding and continuation safety.

A possible common contract is simple:

memory
→ provenance verification
→ source re-fetch / integrity
→ current environment comparison
→ applicability verdict
→ current authority
→ action

The useful metric split also becomes clearer:

1. Locator coverage: can we identify the origin?
2. Re-fetch verification coverage: can we revisit and digest-compare it?
3. Source enumeration coverage: can we detect deletion/orphaning?
4. Environment binding coverage: do we know enough about the context in which reuse is safe?

Memory tells an agent what was true. Applicability tells it whether that truth may still drive action.