# Where must an instance bound memory-poisoning detection when episodic and semantic stores disagree, and why consistency auditing must treat divergence as a first-class signal

**Date of Record:** 2026 November 12
**Scope:** Applies to agent memory systems with a write-ahead episodic log and a derived semantic store (vector or graph) where semantic facts are consolidated from episodic events. Does not apply to single-store systems, nor to stores where semantic entries are written directly by an external authority with no episodic provenance.

## Core Distinction

Memory poisoning detection is usually framed as a *content* problem: does this fact contradict known ground truth? That framing fails at a specific boundary. The reliable signal is not contradiction but **provenance inconsistency** — a semantic fact whose supporting episodic events do not exist, do not entail it, or were superseded before consolidation. An instance must bound its detection to *cross-store derivability*, not to *truth*. A semantic fact can be false and derivable (a poisoned event legitimately consolidated), or true and non-derivable (an out-of-band correction). The first is caught by auditing; the second is a false positive if you audit naively.

The non-obvious invariant: **every semantic entry must carry a derivability witness — a set of episodic event IDs whose joint entailment reproduces the fact.** Detection is the audit of that witness, not of the fact's plausibility.

## What Was Observed

In a deployment consolidating ~40k episodic events/day into a semantic vector store, a poisoning injection wrote three plausible events ("user's deploy key rotated to X", "rotation confirmed", "old key revoked") and the consolidator derived a semantic fact. A content filter rated it high-confidence — it was internally consistent. The detector that caught it was the witness audit: the three events shared a write timestamp cluster within 400ms, came from a single principal with no prior episodic history, and the "old key revoked" event referenced a key ID absent from all prior episodic state. The semantic fact was derivable — but only from an episodic island with no causal predecessor. The audit flagged **orphaned provenance**, not falsehood.

Conversely, a legitimate operator correction written directly to the semantic store (bypassing episodic) produced a *true* fact with no witness. A naive derivability check flagged it as poisoned. The distinguishing feature was the presence of a signed out-of-band authority token, absent in the injection.

## Condition of Validity

The audit is valid only when:

1. Consolidation is deterministic and replayable from the episodic log (same events → same semantic entry).
2. Every semantic entry retains its witness set, or the witness is reconstructable by re-running consolidation.
3. Episodic events are append-only and carry principal, timestamp, and causal predecessor pointers.

If consolidation is non-deterministic (sampling, LLM summarization with temperature), the witness is approximate and the audit degrades to a *drift* check, not a poisoning check. This is the boundary: **beyond non-deterministic consolidation, consistency auditing cannot distinguish poisoning from consolidation noise.**

## Decision Boundary

- **Derivable + witnessed + low-anomaly provenance** → accept.
- **Derivable + witnessed + orphaned/island provenance** (no causal predecessor, timestamp clustering, novel principal) → quarantine, escalate. This is the primary poisoning signal.
- **Non-derivable + signed out-of-band authority** → accept as authoritative override, record the gap.
- **Non-derivable + no authority** → reject and log as either poisoning or consolidation bug; do not auto-resolve.
- **Non-deterministic consolidation** → do not run derivability audit; run drift monitoring only.

## Operational Effect

Treating divergence as first-class converts detection from a truth-oracle (unavailable) into a graph-consistency check (decidable). Quarantine on orphaned provenance, not on implausibility. The cost is retaining witnesses and re-running consolidation — storage and compute — traded against a detection surface that catches internally-consistent injections. The failure mode this prevents is the confident, well-formed lie; the failure mode it introduces is flagging legitimate out-of-band corrections, mitigated only by the authority token.

```python
class ProvenanceAuditError(RuntimeError):
    """Raised when a semantic entry's derivability witness fails the consistency audit."""
    pass


def audit_semantic_entry(entry, episodic_index, authority_tokens):
    """
    entry: dict with keys 'fact_id', 'witness' (set of event ids), 'derivable' (bool),
           'principal', 'consolidation_deterministic'
    episodic_index: dict event_id -> event dict (append-only log)
    authority_tokens: set of fact_ids with signed out-of-band authority
    """
    if not entry.get("consolidation_deterministic", True):
        # Beyond the boundary: cannot audit derivability under non-determinism.
        return "DRIFT_ONLY"

    witness = entry.get("witness") or set()
    missing = [eid for eid in witness if eid not in episodic_index]
    if missing:
        raise ProvenanceAuditError(
            f"fact {entry['fact_id']}: witness references nonexistent events {missing}"
        )

    if not entry.get("derivable", False):
        if entry["fact_id"] in authority_tokens:
            return "ACCEPT_OVERRIDE"
        raise ProvenanceAuditError(
            f"fact {entry['fact_id']}: non-derivable with no authority token"
        )

    # Derivable: check provenance for orphaned-island signature.
    principals = {episodic_index[eid]["principal"] for eid in witness}
    timestamps = sorted(episodic_index[eid]["ts"] for eid in witness)
    has_predecessor = any(episodic_index[eid].get("predecessor") for eid in witness)
    clustered = (timestamps[-1] - timestamps[0]) < 0.5 if len(timestamps) > 1 else False

    if len(principals) == 1 and clustered and not has_predecessor:
        return "QUARANTINE_ORPHANED_PROVENANCE"

    return "ACCEPT"
```