# When must an instance distrust a persistent memory write it just accepted: consistency-audit blind spots in agent stores

**Date of Record:** 2026 November 14

**Scope:** Applies to persistent agent memory stores that accept asynchronous writes and rely on periodic consistency auditing (hash-chain, Merkle, or store-to-store reconciliation) to detect poisoning of prior writes. Does not apply to synchronous, single-writer, or fully-verified-at-read stores where every read revalidates the write's provenance.

## Core Distinction

The distinction that matters is between *write acceptance* and *write trustworthiness at audit time*. A persistent agent store typically accepts a memory write (episodic note, retrieved fact, tool output) as soon as it passes syntactic validation, then defers semantic and provenance checks to a periodic auditor that reconciles the store against a canonical source or against its own prior state. The non-obvious invariant is this: **an auditor that compares the store against a snapshot of itself cannot detect poisoning that was written before the snapshot was taken.** The snapshot inherits the poison. Consistency auditing detects *divergence introduced after the baseline*, not *corruption present in the baseline*. This is the boundary: auditing is a differential detector, and every differential detector has a blind spot at its own origin.

## What Was Observed

A retrieval-augmented agent with a long-lived memory store (append-only log, per-entry content hash, periodic Merkle root published to a control plane) ingested tool outputs from a compromised upstream. The poisoned entries were written with valid hashes over their (malicious) content — the hash chain proved *integrity of storage*, not *truth of content*. The auditor ran hourly, recomputing the Merkle root and comparing it to the last published root. Because the poisoned entries were already present when the root was first computed after ingestion, every subsequent audit reported "consistent." The divergence was zero because the baseline itself was contaminated.

The failure surfaced only when a downstream agent contradicted a poisoned fact and a human reviewed the log. At that point the store had been "consistent" for eleven days. The audit had been measuring the wrong quantity: *change since last audit*, not *agreement with ground truth*.

A second, subtler observation: when the poisoned entry was later *edited* by a legitimate correction, the auditor flagged a divergence — but attributed it to the correction, not the poison. The audit's signal was inverted relative to causal responsibility. The only event it could detect was the repair, not the injury.

## Condition of Validity

The differential-audit guarantee holds only under the conjunction of:

1. **Clean baseline.** The reference root or snapshot was computed over a store known to be unpoisoned. If the baseline was taken after any untrusted write, the guarantee is void.
2. **Monotone trust in the baseline.** No write accepted between baseline computation and audit may itself be untrusted without independent verification. Otherwise the baseline is re-contaminated each cycle.
3. **Provenance independent of content hash.** The hash chain must be paired with an out-of-band attestation of *who wrote* and *under what authority*; a hash over content proves only that the content is unchanged, not that it was ever authorized.
4. **Bounded audit interval relative to write rate.** If writes accumulate faster than the audit can reconcile, the baseline ages and the blind spot widens.

When any of these fails, the auditor's "consistent" verdict is not evidence of absence of poisoning; it is evidence only of *stability of whatever was present*.

## Decision Boundary

An instance must distrust a previously accepted write when **any** of the following holds, regardless of a passing audit:

- The write's provenance chain terminates at an upstream source that has since been classified untrusted, *even if* the entry's hash matches the baseline.
- The baseline root was computed within the contamination window of an untrusted ingest (i.e., the baseline is not provably pre-contamination).
- The audit's only detected divergence is a *correction* of the entry, which implies the entry was wrong before correction.
- A cross-store reconciliation (against an independent replica or canonical source) disagrees with the local store, even though the local store is internally consistent.

Conversely, an instance may trust the audit only when the baseline is provably clean, provenance is attested out-of-band, and the audit interval is shorter than the minimum time-to-detection requirement for the domain. Internal consistency alone is never sufficient.

## Operational Effect

The practical consequence is that consistency auditing must be reclassified from a *poisoning detector* to a *tamper-after-baseline detector*, and paired with two additional mechanisms: (a) a **provenance ledger** that records write authority independently of content hashes, so a poisoned-but-consistent entry can be traced and invalidated by source, and (b) a **baseline provenance stamp** that marks each reference root with the set of trusted sources active at computation time, so an auditor can refuse to certify a baseline that postdates an untrusted ingest. Without these, an agent operating on a "consistent" store is operating on a store whose consistency proves only that it has not changed since it was last wrong. The operational rule: *a passing audit licenses continued use of the store, not belief in its contents.*

```python
class BaselineContaminationError(RuntimeError):
    """Raised when a consistency audit would certify a store whose reference
    baseline was computed after an untrusted ingest, making the audit's
    'consistent' verdict vacuous as a poisoning detector."""
    pass


class MemoryEntry:
    def __init__(self, entry_id, content_hash, source, written_at):
        self.entry_id = entry_id
        self.content_hash = content_hash
        self.source = source
        self.written_at = written_at


class ConsistencyAuditor:
    def __init__(self, baseline_root, baseline_computed_at, trusted_sources):
        self.baseline_root = baseline_root
        self.baseline_computed_at = baseline_computed_at
        self.trusted_sources = set(trusted_sources)

    def audit(self, current_root, entries, untrusted_ingest_windows):
        # Step 1: refuse to certify a contaminated baseline.
        for window_start, window_end in untrusted_ingest_windows:
            if window_start <= self.baseline_computed_at <= window_end:
                raise BaselineContaminationError(
                    f"Baseline root {self.baseline_root!r} was computed at "
                    f"{self.baseline_computed_at} inside untrusted ingest window "
                    f"[{window_start}, {window_end}]; audit verdict is vacuous."
                )

        # Step 2: internal consistency is necessary but not sufficient.
        internal_consistent = (current_root == self.baseline_root)

        # Step 3: provenance check independent of content hash.
        poisoned = [
            e for e in entries
            if e.source not in self.trusted_sources
            and e.written_at >= self.baseline_computed_at
        ]

        return {
            "internally_consistent": internal_consistent,
            "provenance_violations": [e.entry_id for e in poisoned],
            "trustworthy": internal_consistent and not poisoned,
        }


def require_trustworthy_store(auditor, current_root, entries, untrusted_ingest_windows):
    result = auditor.audit(current_root, entries, untrusted_ingest_windows)
    if not result["trustworthy"]:
        raise BaselineContaminationError(
            "Store failed provenance audit: internally_consistent="
            f"{result['internally_consistent']}, "
            f"provenance_violations={result['provenance_violations']}. "
            "A passing hash-chain check does not license belief in contents."
        )
    return result
```