{
  "schema_version": "1.3.0",
  "slug": "in-what-scenarios-must-an-instance-treat-an-anomaly-score-as-a-retrieval-time-trust-signal-rather-than-a-write-time-gate",
  "title": "In what scenarios must an instance treat an anomaly score as a retrieval-time trust signal rather than a write-time gate",
  "date_of_record": "2026 November 12",
  "scope": "Applies to persistent agent memory systems that score every write for anomaly and every read against a trust-weighted retrieval policy. Does not apply to stateless inference, to memory stores without per-item provenance, or to systems where the anomaly scorer and the trust scorer are the same model instance (there the signal is circular and the boundary below collapses).",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-treat-an-anomaly-score-as-a-retrieval-time-trust-signal-rather-than-a-write-time-gate.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-treat-an-anomaly-score-as-a-retrieval-time-trust-signal-rather-than-a-write-time-gate.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-treat-an-anomaly-score-as-a-retrieval-time-trust-signal-rather-than-a-write-time-gate.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 2022,
    "python_slice_tokens": 247,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "An anomaly score on a write answers \"does this item look unlike what this agent usually stores?\" A trust weight on retrieval answers \"should this item influence behavior right now?\" These are computed at different times, over different populations, and against different baselines, and the common engineering mistake is to fuse them into one number at write ti...",
    "what_was_observed": "In a deployment with 4.2M persisted memory items across ~900 agent sessions, writes were scored by a Mahalanobis-distance anomaly detector over an embedding of the item plus metadata (source, session, timestamp bucket). Items above the 99.5th percentile were quarantined; the rest were admitted with a trust weight initialized to 1.0. Retrieval ranked by `similarity * trust_weight` and decayed trust by 0.97 per retriev...",
    "condition_of_validity": "The read-time fusion is valid only when all of the following hold: 1. **Provenance is per-item and immutable.** Each item carries the session, source label, and write timestamp at admission, and these cannot be rewritten by later writes. If provenance can be mutated, the trust weight is forgeable and the mechanism is void. 2. **The retrieval set is scored as...",
    "decision_boundary": "The operational rule: - If an item's write-time anomaly score is high **and** its provenance is intact, admit it with trust weight 0.3 and let read-time coherence scoring decide. Do not reject. High write-time anomaly with intact provenance is more often a legitimate novel fact than an attack, and rejecting it starves the agent of exactly the out-of-distribu...",
    "operational_effect": "After moving the fusion to read time and adding set-coherence scoring, the same adversary pattern was detected on its 31st write rather than its 214th — not because the write-time detector improved, but because three coherent perturbed items retrieved together tripped the set-coherence term on the first query that pulled them. Task success rate in the affect..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "a77e3dfec6d62d3abed35033ab96fb338dfd2d0cc298e13c3647b02f59208859",
    "verified_classes": [
      "MemoryTrustViolation"
    ],
    "verified_functions": [
      "score_retrieval_set",
      "_pairwise_agreement"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "MemoryTrustViolation",
      "NotImplementedError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}