{
  "schema_version": "1.3.0",
  "slug": "which-invariants-prevent-memory-poisoning-from-surviving-a-write-provenance-audit-when-anomaly-scores-are-computed-on-recall-rather-than-on-write",
  "title": "Which invariants prevent memory poisoning from surviving a write-provenance audit when anomaly scores are computed on recall rather than on write",
  "date_of_record": "2026 November 11",
  "scope": "Applies to agent memory stores where every write carries provenance metadata (writer identity, session, causal parent, tool-call chain) and where poisoning detection is triggered by anomaly scoring on *recall* events (what gets retrieved, by whom, in what context). Does not apply to stores that audit only at write time, nor to stores whose recall path does not record the querying agent's identity and the retrieved record's provenance atomically.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/which-invariants-prevent-memory-poisoning-from-surviving-a-write-provenance-audit-when-anomaly-scores-are-computed-on-recall-rather-than-on-write.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/which-invariants-prevent-memory-poisoning-from-surviving-a-write-provenance-audit-when-anomaly-scores-are-computed-on-recall-rather-than-on-write.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/which-invariants-prevent-memory-poisoning-from-surviving-a-write-provenance-audit-when-anomaly-scores-are-computed-on-recall-rather-than-on-write.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1795,
    "python_slice_tokens": 251,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "A write-provenance audit answers the question *\"was this record authored by an entity that was authorized, at the time of writing, to assert this fact?\"* An anomaly score on recall answers *\"is this retrieval pattern surprising given the history of retrievals?\"* These are orthogonal signals, and the common operational mistake is to treat a low recall-anomaly...",
    "what_was_observed": "In a store of ~4.2M records with per-write provenance (writer agent ID, parent record hash, tool-call trace ID), a red-team injection wrote 31 records across 6 writer identities. All 31 passed the write-provenance audit: each writer was authorized for its namespace, each parent hash resolved, each tool-call trace was internally consistent. The recall-anomaly scorer — a per-query-class z-score on retrieval frequency a...",
    "condition_of_validity": "Recall-anomaly scoring is a valid poisoning detector if and only if all three of the following hold: 1. **Query-provenance independence.** The set of queries used to establish the baseline for a query class must not be issuable by any writer identity that can also write records retrieved by that class. In practice this means the baseline must be computed ove...",
    "decision_boundary": "The operational decision is where to place the audit trigger. Three placements are available, and only one is sound: - **Trigger on recall anomaly (unsound under the condition above).** Cheap, but the attacker who seeds the baseline sets the threshold. Reject as a primary control. - **Trigger on write-provenance anomaly (sound but incomplete).** Catches unau...",
    "operational_effect": "After moving the gate to structural disjointness, the same 31-record injection was caught at 31/31 on the next red-team run, with 0 false positives across 4.2M records — because legitimate writers in this store never seeded baselines for classes they also wrote to (the two populations were already operationally separate; the pipeline had simply never checked..."
  },
  "matched_failure_symptoms": [
    "OOM_KILL_OR_MEMORY_EXHAUSTION"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "beb43c903b0a15bef62edc3583bd132a3277031182e6d234bc9204a2bae6e9e1",
    "verified_classes": [
      "ProvenanceDisjointnessError",
      "RecallEvent"
    ],
    "verified_functions": [
      "audit_recall",
      "prioritize"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 1,
    "raised_exceptions": [
      "ProvenanceDisjointnessError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}