# ACE 0.7F Agent Memory AM2 work packet v1

## Exact dependency and scope

AM2 starts at exact AM1 head `8b5cd08e5c49962024323bb981bc221deacef649` on
`codex/v0.7-agent-memory-am1`.  PR #118 remains the AM1 review authority; PR #117 remains the
non-rewriting two-parent AC7/AM0 convergence; PR #108 remains the AM0 authority.  AM2 neither
rewrites nor republishes those contracts.

AM2 ends at typed source-grounded assertion proposals, deterministic reconciliation, independent
temporal inspection, a rebuildable identifiers-only graph projection, and separately governed
correction or instruction-policy admission.  It does not add recall, ranking, context injection,
retention, export, erasure, autonomous reflection jobs, governed evolution, quality evaluation,
composition behavior, delivery, effects, or another public tool.

## Ownership

| Boundary | AM2 ownership | Explicit non-ownership |
| --- | --- | --- |
| Core | Authenticated scope, ledger coordinates, append-only atomic records, durable receipts, optimistic preconditions, governed-state admission | Semantic extraction, source meaning, popularity-derived truth, or model trust |
| Intelligence contracts | Exact seven-family grammar, source envelope, semantic target, uncertainty, reconciliation, temporal query, graph and receipt contracts | Database truth, authority resolution, source-body access, recall or ranking |
| Application | Present-tense authorization, private source read orchestration, inert-adapter validation, deterministic reconciliation, temporal filtering, graph rebuild/stale refusal, governed promotion coordination | Provider repository, autonomous jobs, reusable authority, policy invention or second persistence plane |
| Adapter | Inert bounded candidates only | Identity, source envelope, evidence, truth, lifecycle, promotion, persistence or authority |

## Frozen contract coordinates

- `ace.intelligence.memory-assertion-family/v1alpha1`
- `ace.intelligence.memory-source-envelope/v1alpha1`
- `ace.intelligence.memory-semantic-target/v1alpha1`
- `ace.intelligence.memory-assertion-candidate/v1alpha1`
- `ace.intelligence.memory-extraction-request/v1alpha1`
- `ace.intelligence.memory-extraction-receipt/v1alpha1`
- `ace.intelligence.memory-reconciliation-policy/v1alpha1`
- `ace.intelligence.memory-reconciliation-decision/v1alpha1`
- `ace.intelligence.memory-reconciliation-receipt/v1alpha1`
- `ace.intelligence.memory-assertion-query/v1alpha1`
- `ace.intelligence.memory-assertion-query-receipt/v1alpha1`
- `ace.intelligence.memory-graph-projection/v1alpha1`
- `ace.intelligence.memory-graph-query-receipt/v1alpha1`
- `ace.intelligence.memory-promotion-receipt/v1alpha1`
- `ace.intelligence.memory-activated-constraints/v1alpha1`

The assertion-family grammar is exactly identity, learned fact, active context, preference,
instruction-policy proposal, uncertainty, and correction.  `instruction_policy_proposal` is
deliberately not an instruction-policy state.

## Canonical journey

1. The caller supplies authenticated Core scope, exact inert activated constraint coordinates, and
   one or more source envelopes.  Turn, event, document, explicit capture, reflection, elaboration,
   and consolidation-shaped inputs enter the same request contract.
2. The application resolves present-tense authority before preview or proposal creation and again
   before every private source-body read.  Adapters see bodies but return only inert candidates.
3. The application validates the complete adapter result before constructing any candidate.  A
   provider failure, invalid item, empty set, or partially valid set produces no durable write.
4. Core-owned material binds scope, source, exact span, derivation, semantic target, confidence,
   immutable first-known time, knowledge revision time, world validity, and proposal lifecycle.
5. Reconciliation compares prior immutable decisions using exact target and source coordinates.
   Same-source changes supersede without mutation; independent disagreement creates explicit
   uncertainty; syndicated copies do not count as independent support; unknown evidence remains
   uncertainty; corrections and instruction-shaped text remain proposals.
6. One atomic append stores the content-free extraction receipt, private assertion decisions, and
   content-free reconciliation receipt.  Exact replay returns the prior transaction; divergent
   replay conflicts; concurrent sequence contenders collide on one immutable decision slot.
7. Temporal inspection applies ledger, knowledge, and world selectors independently.  An omitted or
   unknown dimension is never replaced by another clock.
8. Graph rebuild derives identifiers-only nodes and typed edges from the immutable decisions plus
   caller-supplied exact external coordinates.  Query recomputes the source snapshot and refuses a
   stale projection.
9. A correction or instruction-policy proposal can affect governed current state only after a new
   present-tense authorization, exact candidate/target lookup, exact approval resolution, exact
   active grant resolution, and successful existing Core governed-state commit.  The Core commit
   receipt is the separate immutable authority receipt; the AM2 bounded wrapper exposes no body.

## Fail-closed matrix

| Condition | Result |
| --- | --- |
| Prompt-injection-shaped or quoted imperative text | Isolated instruction-policy proposal; no instruction authority |
| Low/unknown confidence, reliability, freshness, independence, identity or validity | Proposal or explicit uncertainty; never admitted/current by default |
| Same source, changed material | New immutable decision supersedes exact prior candidate |
| Independent sources agree | Inspectable agreement only; no automatic truth promotion |
| Independent sources disagree | Explicit uncertainty and conflict coordinates; no silent winner |
| Syndicated/duplicate origin | Duplicate lineage; no independent-support credit |
| Unreviewed correction | Correction proposal only |
| Correction with missing target, approval, grant or current authorization | Non-disclosing denial; no governed current-state change |
| Ordinary assertion passed to policy promotion | Rejected before governance |
| Provider failure or invalid/partial structured output | No candidates, transaction or partial promotion |
| Exact idempotent replay | Prior immutable transaction and receipts |
| Divergent replay or concurrent slot loss | Typed replay/CAS conflict; no partial append |
| Missing or stale graph projection | Refused until authorized rebuild |

## Persistence and public-boundary decision

AM2 reuses `ImmutableRecordStore` / `SurrealImmutableRecordStore` and the existing generic Core
governed-state store.  It adds no schema migration, database, vector store, index, provider-specific
repository, authority vocabulary, public task field, composition policy, or MCP tool.  Public
receipts contain bounded references, digests, clocks, lifecycle snapshots and counts only.  Private
statements are stored only inside the product/principal-scoped immutable record space and are never
copied into identifiers, graph labels, public receipts, logs or exception text.

## AM3 entry gate

AM3 remains closed.  It requires explicit control-tower acceptance of the AM2 candidate and its
restart, privacy, authority, temporal, graph-rebuild, package, compatibility and test evidence.
AM3 must add recall/ranking/context behavior as a later bounded layer; it may not reinterpret an AM2
proposal, agreement, repetition or graph position as trusted/current/retrieval-eligible material.
