Lifelong-Memory Research — Expansion, Gaps, Futuristic Roadmap & Hardening (2026-06-11)

Lifelong-Memory Research — Expansion, Gaps, Futuristic Roadmap & Hardening (2026-06-11)

Expands docs/Memory_1.zip (the 700-paper lifelong-memory report lifelong_memory_for_ai_agents_report.md,
13 systems, mapped to cortex) into an actionable roadmap to improve our memory. Produced by a 5-dimension
swarm + adversarial review + synthesis, then the load-bearing code claims were independently verified.

FINALIZED 2026-06-11. Reconciled against origin/main (HEAD 871a9412) after GPT/Codex review (§7)

and a 3-agent adjudication swarm. ~half the original gaps have since LANDED in code (#909/#913/#914/#919/#899)

— see the authoritative §8 Reconciliation ledger, which supersedes the status columns in §1–§4 where they

conflict. ⚠️ Verify code claims against origin/main blobs, not the local worktree (the docs/… branch

holds reverted cortex code).

Two-axis legend. Code-claim verification: ✅ verified vs origin/main file:line · ◐ flagged, unverified —

grep before acting · ✗ stale/overtaken-by-code. Research-evidence strength (per GPT §7.4.8): [PR]

peer-reviewed / gold benchmark · [AC] arXiv-with-code / reproducible · [AO] arXiv-only / preprint /

self-reported · [UN] unverified named claim — pin a primary source first. The two axes are orthogonal.

0. First, a correction the review caught (why we verify)

The swarm's synthesis confidently claimed my prior lifecycle analysis (MEMORY-LIFECYCLE-ANALYSIS-2026-06-10.md,
merged #906) was "outdated" because *main.py:1378 _periodic_consolidation_cycle is a live background
scheduler (config.py:112 consolidation_enabled=True, 4h interval). This is a HALLUCINATION.* ✅
Verified: _periodic_consolidation_cycle exists in zero cortex-memory copies; main.py is 448 lines
(line 1378 doesn't exist); every other worktree copy is 352–362 lines; broad grep returns nothing. The
fabricated line numbers looked authoritative.

UPDATE (✗ overtaken — #919, origin/main): the dormancy gap is now CLOSED. A real consolidation scheduler
has since landed — main.py:248 async def _consolidation_loop(), started in the FastAPI lifespan at
main.py:335 asyncio.create_task(_consolidation_loop()), gated on _CONSOLIDATION_INTERVAL_S > 0 and
settings.memory_enabled (default 1h), pin-aware, with a fail-loud "L3 grows unbounded" warning when disabled and a
cortex_last_consolidation_timestamp_seconds staleness gauge. Both facts hold: the swarm hallucinated a
specific symbol (main.py:1378) that never existed — kept here as the why-we-verify exemplar; the real
scheduler was added later by #919. (The 448-vs-362 line-count debate is moot — origin/main main.py is 605 lines.)

1. The most valuable research additions (beyond the report)

The report is a strong menu of techniques but under-specifies the control plane and the frozen-base
constraints. The highest-value expansions:

1. Consolidation is a CONTROL LOOP, not a function. 📚 The report draws the pipeline (segment→extract→
resolve→promote→archive) as a one-shot DAG and never names the trigger/scheduler/budget — the exact
primitive our cortex is missing (§0). Triggers in the literature: time-cron (MemoryBank Ebbinghaus clock
[20]), volume ("N new episodes"), surprise (HiMem's surprise channel [3] is implicitly a consolidation
trigger, not just segmentation), idle/session-end (Amory offline [2]). Add a consolidation budget
(LLM-calls/cycle) as a first-class resource — no system in the report formalizes it, decisive at scale.

2. Retrieval is two-stage: retrieve-then-RERANK — the report never frames it. A *zero-shot listwise LLM
reranker (RankGPT [AC] shape) over our unioned candidate set keeps the base frozen (no fine-tuning) and is
the cheapest single mover on ranking quality (nDCG@10 / MRR / precision@k) — it moves recall@10 only when
reranking a candidate pool wider than k (retrieve@N → reranked top-10). RRF optimizes consensus, not
precision, so a reranker is complementary. (Correction: RankZephyr [AC] is a trained/distilled Zephyr-7B
reranker — cited as evidence a small specialist matches large supervised systems, admissible only as a
swappable side-module the base reads, not "base-as-reranker.")* The #1 "next" retrieval lever.

3. Iterative / agentic recall ("probe and probe more") — the only structural fix for multi-hop questions
a one-shot top-k cannot assemble. IRCoT [PR] / FLARE [PR] / EverMemOS Reconstructive Recollection [AO] (its
LoCoMo + LongMemEval SOTA — paper-reported, unreproduced on our stack — comes from agentic recall).
Frozen-base (a retrieve→reason→re-query loop, not weight updates). (Now overtaken: a bounded iterative-recall
loop LANDED #894 — tiered_memory.py:2525 iterative_recall, endpoint memory_api.py:691; the remaining
lever is cross-tier multi-hop + a reranker.)

4. The frozen-base reframe of "replay" — the report mis-maps generative replay [21][22], which protects
parametric weights (irrelevant when weights never update). 📚 The legitimate analogue is *memory→memory
re-abstraction replay (re-derive higher-order facts from episodes — Amory momentum [2] minus the
parametric write). MemVerse distillation-into-the-base-model (report §4.5/§8.2) is INADMISSIBLE for us
(frozen base); allowed only as a swappable side-module the base reads* (soft-prompt/prefix/learned retriever).

5. Conflict resolution ≠ "newer wins." 📚 The report flattens three distinct cases: UPDATE (user moved —
recency wins), CONTRADICTION (two sources disagree now — needs provenance/authority, not recency),
REFINEMENT (new narrows old — merge, not replace). The real mechanism is *bitemporal validity
intervals (valid_from/valid_to) so "lived in NYC 2020–23" and "lives in SF 2023–" coexist* — which
is what GraphMem "temporal validity" [9] / MemoriesDB temporal axis [14] actually imply. Plain "newer-wins"
is trivially poisonable (attacker writes last) — directly conflicts with our verified ~50%-FP lesson.

6. Authority / pinning is genuine white-space in the corpus. 📚 No system in the report's table
guarantees always-inject; importance is only ever a soft decay weight (Ebbinghaus [20] / ACT-R [28] /
PageRank [9]). A pinned guidance tier (operator principles, closure rule, safety invariants injected
regardless of similarity) is uniquely ours (WIP track R6) — low effort, high governance value.

7. Decay: ACT-R power-law ≠ Ebbinghaus exponential. 📚 The report treats them as interchangeable. ACT-R
base-level activation (power-law, the empirically human curve) preserves the long tail; single
exponential over-forgets it — and the long tail is the lifelong regime. Add the spacing effect
(FSRS/SM-2): each successful recall grows per-item stability S. None of the 13 systems implement adaptive S.

8. The retrieval substrate the report omits. 📚 Dense ANN (pgvector) is the report's whole spine, but on
short conversational atomic facts lexical dominates (BM25, per BEIR/MTEB) — which is why our dense path
is net-negative. The right frontier isn't "re-enable dense equally" but late-interaction (ColBERTv2) /
learned-sparse (SPLADE) — paraphrase-gap families the report never mentions.

9. Utility-closed consolidation turns "log" into "compounding." 📚 Tag each consolidated/crystallized fact
with retrieval_count × downstream answer-correctness from our merged QA-eval harness (#898) — a
ground-truth utility signal the literature systems (ReMe [26], MCMA [27]) lack. A learned (bandit)
survival policy on a frozen base. (Keep it out of any usage-precision optimizer loop to avoid a
popularity feedback spiral.)

10. Crypto-shredding resolves the report's own contradiction. 📚 The report demands BOTH append-only
audit tiers [9][14] AND right-to-be-forgotten cascading deletion (§8.5) — impossible over an immutable
hashchain. The reconciliation it never names: destroy the per-user encryption key, not the record.

2. Key gaps (ranked; report-internal vs report-vs-reality)

⚠️ Status column below is as-authored (2026-06-11 AM) and mis-cites "#906" (a vendor resync) as the source.

The §8 Reconciliation ledger is authoritative: rows 3, 6, 8 are now CLOSED (#899/#894/#909), rows 1, 5

are PARTIAL (RTBF reset + authority axis landed), rows 2, 4, 7, 9, 10 remain OPEN.

3. Futuristic roadmap (grounded, frozen-base honest)

4. Hardening actions (concrete)

Now (live exposure / correctness):

• Consent-age retention enforcement + a real cascading DELETE /{user_id} RTBF using crypto-shredding for the immutable L4 — today retention is dead and a "reset" leaves episodic/graph/GraFOSa/L4 live; encrypt each (agent,user) partition under a per-user key, destroy the key on RTBF (+ a GONE tombstone so retrieval skips it). Reuse assert_caller_matches_user_id. ✅/◐
• Extend poison-scanning to the core memory write path (unified_memory_chain/tiered_memory), not just the conductor-observation path; quarantine on CRITICAL. ◐
• Convert write-chain fail-open → fail-CLOSED-with-alert for destructive ops; fix the two L2/L4 signature-mismatch bugs (per #906) before anything builds on the chain. ✅
• GraFOSa: persist to disk + replace reject-newest with composite-score eviction (reuse the L1 Pulse scorer) — in-memory-only = L2.5 amnesia on restart; reject-newest = denial-of-memory flood vector. ◐
• Build the consolidation scheduler (the #906 P0) with pagination + a per-cycle LLM/fact budget + circuit-breaker + a last_consolidation_ts gauge. ✅ (the swarm's "it already exists" was the §0 hallucination — it does not.)
• Ground the eval: wire real snap-stanford/locomo + LongMemEval into #898; provenance-tag any recall@k figure; track recall@10 and nDCG@10 (reranker/RRF gains are ordering gains recall@10 hides); regression-pin dense/HyDE/procedural/L5 so no "just turn it on" PR silently regresses.

Next (integrity / trust):

• Replace poisonable "newer-wins" with authority arbitration + audit — require corroboration/source-authority before a long-held fact is superseded; refuse unverified-agent override of operator-verified; log every supersession/RTBF/quarantine to a tamper-evident mutation log (separate from the L4 data chain).

5. Report-vs-reality corrections (for whoever builds on the report)

1. Substrate is inverted: report says Postgres+pgvector/NATS/:48016; reality is *SQLite per-(agent,user)
on :48084, no NATS scheduler, an 8-channel learned-weight RRF ensemble with dense default-OFF*
(net-negative). Both "pgvector dense substrate" and "recall is keyword-only" are incomplete — it's a
sparse-dominant RRF ensemble with an exact-match override channel. ✅
2. "Cascade (complexity-aware)" is aspirational — the code is an early-termination tier-walk whose cheap
tiers bypass the smart L3 RRF (max_tier=4 so L5 is never read), not TiMem TMT abstraction-level selection [5]. ◐
3. MemVerse periodic distillation into the parametric model (§4.5/§8.2) is INADMISSIBLE on our frozen base —
memory→memory only, never memory→weights. 📚
4. Privacy chapter leans on ContextDB [18] (weakest-evidenced, most load-bearing citation) and treats
append-only audit + cascading RTBF as co-achievable without noting they contradict over an immutable L4. 📚
5. Single-source benchmark numbers (TiMem 75.3%, ReMe 8B>14B, TeleMem −43% tok, EverMemOS SOTA) are
claimed/short-horizon/unreproduced; named cross-agent "protocols" (SAMEP/SEDM/MIRIX/A-MEM/G-Memory) are
recent preprints = inspiration, not blueprints. 📚
6. "Don't migrate to Postgres" is a near-term default, not absolute — per-silo SQLite is correctly sized
for the siloed access pattern; the real ceiling is fleet-wide file count + cross-silo queries. Migrate
when cross-agent memory lands, not for per-silo throughput. 📚

6. The single thread

For a swarm, the thesis is collective compound-learning, and the corpus's #1 under-covered capability —
cross-agent shared memory — is exactly the leap that serves it. But it is hard-gated: a shared plane
inherits every now-tier bug (dormant consolidation, dead RTBF, fail-open writes, GraFOSa amnesia, poisonable
conflict resolution) and multiplies the blast radius across tenants. So the order is forced: (now) make a
single agent's memory bounded, forgettable-on-request, poison-resistant, and durable → (next) make it
compound (L5-read + utility survival + reranker + authority/pinning) → (frontier) make it shared. Every
step gated on real-LoCoMo in #898 so "improvement" is measured, not asserted.

7. Codex multi-agent + online review notes (2026-06-11)

Scope: three-agent review of this roadmap against current local code, repo architecture authority, and online
primary-source spot checks. These notes are intentionally additive: they preserve the roadmap's provenance while
marking claims that should be tightened before implementation, funding, or roadmap commitments.

7.1 Overall verdict

The strategic spine is sound: build the missing consolidation control loop, make memory delete/retention/audit
semantics explicit, fix fail-open and poison paths before sharing memory, then evaluate reranking, iterative
recall, L5 crystallization, and cross-agent memory behind real benchmarks. The main correction is evidentiary:
several code and research claims are directionally useful but stated too strongly for the current branch.

7.2 Implementation corrections to apply before acting

1. Scheduler absence is verified, but the line count is stale. _periodic_consolidation_cycle is absent in
the local services/cortex-memory copy and in ../maestro-platform; consolidation is exposed as explicit
POST /v1/memory/{user_id}/consolidate. Current main.py is 362 lines locally and 352 lines in the
execution reference, not 448. The conclusion stands; the supporting number should be corrected.
2. Port/substrate reality needs branch-specific wording. Local config.py defaults the service port to
8084; ../maestro-platform defaults to 48016. 48084 appears in verification/drift docs, not as the
current service default. Keep :48084 only when citing a specific deployment mapping.
3. Dense retrieval is not simply default-off. The hybrid path has TF-IDF, BM25, keyword, dense, graph,
fact-key, and HyDE-style channels; SYMPOSIUM_DENSE_RETRIEVAL defaults to auto, while base dependencies
omit FAISS/sentence-transformers, making dense inert in a clean install. Replace "dense net-negative" with
"dense must remain gated until local regression data proves lift on real LoCoMo/LongMemEval."
4. L5 is not pure write-only, but it is outside the default cascade. L5 crystallizer helpers exist
(crystal_lookup, crystal_context, crystallize), yet cascade_retrieve(... max_tier=4) and the public
cascade API do not consult L5. The right claim is "not integrated into default read path/API."
5. Retention is not entirely nonexistent, but enforcement is incomplete. A retention resolver exists, and
consolidation has pruning hooks, but there is no automatic scheduler and no verified whole-user RTBF cascade.
The reset/delete route found in the current API clears preferences only.
6. Poison scanning is built but not universal. The defense pipeline exists and the symposium conductor path
uses it, but direct cortex-memory write/read paths do not appear to call it. Treat this as a wiring gap, not a
missing component.
7. Fail-open bugs are concrete. unified_memory_chain succeeds if any tier writes, while L2 and L4 calls have
signature mismatches against the current local targets. Fix these before scheduler, L5, or shared-memory work.
8. GraFOSa wording should be "capacity rejects new writes." The fallback is in-memory and clear() only clears
process memory. Capacity checks reject new nodes/edges when full; "reject-newest" is directionally right but
should be phrased as capacity rejection unless an eviction policy is present.

7.3 Architecture and governance constraints

1. Separate current service reality from target architecture. The current cortex-memory implementation is
SQLite/per-agent and no NATS scheduler; master architecture targets Postgres/vector/NATS-style product
substrate. Phrase SQLite claims as current-state evidence, not a contradiction of the target architecture.
2. Cross-agent memory must be gated by CAP-2/CAP-7 and privacy scope. Read-share/write-share cannot include
user-twin data unless consent, tenant boundary, provenance, and row-level authorization semantics are explicit.
3. RTBF must preserve the SOL-12 audit posture. Crypto-shredding is the right direction only for encrypted
payload material and derived indexes/caches/backups covered by the same key policy. Audit/mutation records may
need tombstones rather than physical deletion.
4. R6 pinning belongs in governance, not a parallel memory policy. Operator guidance, closure rules, identity,
and audit invariants should align with SOL-9/SOL-0 and the Golden Rules; the memory layer should inject and
enforce references, not silently mutate governance truth.
5. Budget iterative recall and reranking. ENGINEERING-VIEW.md budgets memory/RAG recall at roughly 500 ms P99
with a 2 s hard ceiling. Rerankers and multi-hop loops need stop rules, pool limits, and cost telemetry before
becoming default behavior.
6. Keep marketing claims internal until reproduced. "Category-defining" and "8B+memory beats 14B" are useful
hypotheses, not external claims, until measured on this stack with pinned datasets and reproducible reports.

7.4 Research-source corrections and evidence tiers

1. RankGPT/RankZephyr support reranking, not automatic recall@10 gains. Reranking a fixed candidate set mostly
improves ordering metrics such as nDCG@10, MRR, and precision@k. It improves recall@10 only if the first stage
retrieves a larger pool and the reranker selects better top-k. Also, RankZephyr is trained/open reranking work,
not just "the frozen base LLM as reranker."
2. GraphMem-specific quantitative claims are unverified. I could not verify "43.3% conflict-res" or Turso
support from a primary GraphMem source. Use temporal-KG and bitemporal grounding from Zep/Graphiti, MemoriesDB,
or TOKI unless the original GraphMem paper/artifact is pinned.
3. MemoryBank/Ebbinghaus supports forgetting/reinforcement, not a scheduler by itself. It is valid grounding
for elapsed-time and importance decay, but the consolidation cron/control-loop design remains our engineering
responsibility.
4. EverMemOS uses LoCoMo and LongMemEval; "LoCoMo+" should be corrected unless a distinct dataset is cited.
Treat SOTA claims as paper-reported/preprint results until reproduced.
5. Sparse-vs-dense should be softened. BEIR/MTEB support BM25 as a strong baseline and "no embedding dominates
every task," not a universal lexical-over-dense law for conversational memory. Dense, ColBERTv2, and SPLADE
should compete in the local harness.
6. FSRS and SM-2 should not be blended. FSRS is the D/S/R-style adaptive stability model; SM-2 is the older
interval/ease/repetition lineage. Use FSRS-style stability if adding per-item S.
7. Recent memory-system preprints are not equal evidence. SAMEP, MIRIX, A-MEM, G-Memory, EverMemOS,
MemVerse, MemoriesDB, and TOKI can inspire design, but mark paper-reported claims separately from
peer-reviewed or locally reproduced results. I did not find a primary SEDM source matching the described
memory-agent protocol; do not treat SEDM as a dependency until pinned.
8. Use an evidence tier in future roadmap tables. Suggested labels: established/peer-reviewed, arXiv with
code, arXiv-only or single-author, and unverified named claim. This prevents RankGPT, BEIR, EverMemOS,
SAMEP, and unverified GraphMem/SEDM claims from carrying the same weight.

7.5 Online sources spot-checked

• RankGPT / "Is ChatGPT Good at Search?": <https://arxiv.org/abs/2304.09542>
• RankZephyr: <https://arxiv.org/abs/2312.02724>
• MemoryBank: <https://arxiv.org/abs/2305.10250>
• Ebbinghaus classic text: <https://psychclassics.yorku.ca/Ebbinghaus/index.htm>
• IRCoT: <https://arxiv.org/abs/2212.10509>
• FLARE: <https://arxiv.org/abs/2305.06983>
• Zep/Graphiti temporal KG memory: <https://arxiv.org/abs/2501.13956>
• EverMemOS: <https://arxiv.org/abs/2601.02163>
• MemVerse: <https://arxiv.org/abs/2512.03627>
• BEIR: <https://arxiv.org/abs/2104.08663>
• MTEB: <https://arxiv.org/abs/2210.07316>
• ColBERTv2: <https://arxiv.org/abs/2112.01488>
• SPLADE: <https://arxiv.org/abs/2107.05720>
• SAMEP: <https://arxiv.org/abs/2507.10562>
• MIRIX: <https://arxiv.org/abs/2507.07957>
• A-MEM: <https://arxiv.org/abs/2502.12110>
• G-Memory: <https://arxiv.org/abs/2506.07398>
• GDPR Article 17: <https://gdpr-info.eu/art-17-gdpr/>
• NIST SP 800-88 Rev. 2: <https://csrc.nist.gov/pubs/sp/800/88/r2/final>

7.6 Recommended execution order after this review

1. Reconcile branch-specific facts in this doc against delivery/CORTEX-MEMORY-HARDENING-ROADMAP-2026-06-10.md,
delivery/CORTEX-MEMORY-NEXT-ROADMAP-2026-06-10.md, and the current services/cortex-memory code.
2. Fix fail-open tier writes and signature mismatches, then wire poison scanning into direct memory writes.
3. Implement whole-user RTBF semantics, including key management, tombstones, derived-index treatment, and audit
preservation rules.
4. Add the observable consolidation scheduler with pagination, budgets, circuit breakers, and gauges.
5. Land a real evaluation gate with LoCoMo/LongMemEval, recall@k, nDCG@k, latency, cost, and provenance-tagged
reports.
6. Only then compare reranker, dense/late-interaction, HyDE, iterative recall, L5, and adaptive decay variants.
7. Start cross-agent memory as permissioned read-share only; defer write-share until provenance, consent, and
authority arbitration are proven.

8. Reconciliation ledger & finalization (2026-06-11) — AUTHORITATIVE

Produced by a 3-agent adjudication swarm (GPT impl-corrections / GPT research-corrections / current-state
reconciliation), all claims verified against origin/main (HEAD 871a9412). *GPT's §7 review and §0–§6 of this
doc both predate the #909/#913/#914/#919/#899 landings* — so several "gaps" and several of GPT's own corrections
(§7.2(1) line count, §7.2(5) "no scheduler / preferences-only reset") are themselves now stale. This ledger is the
single source of truth for code status.

8.1 Gap status vs origin/main

8.2 GPT corrections — all ACCEPTED (with two GPT self-corrections)

Applied: port 8084-local / 48016-retired / 48084-deployment-mapping (§7.2.2 ✓); dense "auto-gated, inert in base
install" not "default-off" (§7.2.3 ✓); L5 "not in default cascade" not "write-only" (§7.2.4 ✓); poison-scan zero
call-sites (§7.2.6 ✓); GraFOSa "capacity rejects incoming writes" (§7.2.8 ✓); strike GraphMem "43.3%/Turso" as
[UN] fabrication and re-anchor bitemporal on Zep/Graphiti [PR, 2501.13956] + MemoriesDB (§7.4.2 ✓ — the most
serious); RankGPT improves ordering, RankZephyr is trained (§7.4.1 ✓); MemoryBank = decay clock not a scheduler
(§7.4.3 ✓); "LoCoMo + LongMemEval" typo (§7.4.4 ✓); soften BEIR/MTEB to "BM25 strong baseline + no embedding
dominates all" while preserving the local bravo-bench dense-net-negative result (§7.4.5 ✓-nuanced); FSRS ≠ SM-2
(§7.4.6 ✓); SEDM = [UN], drop as a dependency; anchor cross-agent on MIRIX/SAMEP/A-MEM/G-Memory [AO] (§7.4.7 ✓);
two-axis evidence tiers adopted (§7.4.8 ✓ — see legend). GPT self-stale: §7.2(1) line count (362) and §7.2(5)
"no scheduler / preferences-only reset" predate #919/#913 — corrected above.

8.3 The genuinely-open roadmap (post-landings)

• NOW (correctness): wire poison-scan into core write paths (zero call-sites today); **consent-age retention

scheduler (ride the #919 loop); complete RTBF** (purge L5 crystal + true L4 crypto-shred with per-user key
destruction + GONE tombstone, audit rows tombstoned not byte-deleted to preserve SOL-12); GraFOSa persist +
composite-score eviction.

• NEXT (compounding): wire L5 into cascade_retrieve as a read-first O(1) tier (the cleanest lever, directly

serves "compounding not a log"); zero-shot listwise reranker over the unioned pool (budget < 500ms-P99/2s,
stop-rules + cost telemetry; measure nDCG@10 and recall@10-with-pool>k); bitemporal + active arbitration on
the landed #913 authority axis (anchored on Graphiti/Zep); utility-driven L5/procedural survival (retrieval_count
× answer-correctness from #898, kept out of the usage-precision optimizer loop); *ACT-R power-law + FSRS adaptive
stability in the #919 cycle; real-LoCoMo/LongMemEval* held-out gate (extend #907).

• FRONTIER (shared): the cross-agent / shared / distributed memory plane — hard-gated on every now/next

substrate fix and CAP-2/CAP-7 consent + tenant + RLS authorization; anchor MIRIX/SAMEP/A-MEM/G-Memory [AO]
(SEDM [UN] dropped). Plus DREAM re-abstraction replay (after L5-read), disk-native cold tier.

8.4 Governance constraints (GPT §7.3, accepted)

Cross-agent memory gated by CAP-2/CAP-7 + consent/tenant/RLS; RTBF preserves the SOL-12 audit posture
(crypto-shred encrypted payload + derived indexes/caches/backups; hash-chain audit rows tombstoned, not
byte-deleted); R6 pinning aligns to SOL-9/SOL-0 governance + Golden Rules (the memory layer injects/enforces
governance, never silently mutates it); reranker + iterative recall budgeted under the ENGINEERING-VIEW.md
500ms-P99 / 2s-hard ceiling.

8.5 Bottom line

The strategic spine survives intact; the action queue shrank. The substrate / now-tier fixes the doc demanded —
consolidation scheduler (#919), authority/pinning (#913), superseded-leak (#914), write-chain (#909), cascade
(#899), iterative-recall base loop (#894) — have largely landed. Research focus now shifts to the genuinely-open
frontier: cross-agent memory, L5-read wiring, the reranker, poison-scan wiring, and consent-age RTBF — exactly
where GPT's evidence-discipline corrections bite hardest. Next consequential follow-up tracked as a CON ticket.

Provenance: docs/Memory_1.zip report → 5-dimension swarm expansion + adversarial review + synthesis (2026-06-11) →
GPT/Codex multi-agent review (§7) → 3-agent finalization swarm + code reconciliation vs origin/main (§8). Two
fabrications caught & struck (swarm main.py:1378 scheduler §0; GraphMem "43.3%" §7.4.2). Companions:
services/cortex-memory/MEMORY-LIFECYCLE-ANALYSIS-2026-06-10.md (verified internals, #906),
MEMORY-INJECTION-AUTHORITY-GAP-2026-06-10.md (R6 pinning), BENCHMARK-RESULTS + #898 (eval harness), and the
landed cortex PRs #899/#902/#907/#909/#913/#914/#919.

9. Addendum — ground-truth verification + shared-identity correction (2026-07-20)

This is a LATER addendum, appended 2026-07-20; it does not alter the finalized §0–§8 ledger. It

records (a) a claim-by-claim verification of an engineer's live statements about cortex, checked against

the running conduir-cortex-memory container (image con4605-merged-20260711, local-service,

host ip-172-31-36-45 "genesis") and code on origin/main; (b) a correction to how §2 gap #4

("no cross-agent / shared memory") should be framed; and (c) the industry mapping our own zips already

hold. Produced by two independent verification agents (code-claim + docs/industry) + synthesis; findings

are review inputs, not a gate (delivery/OPERATING-IDEOLOGY.md). Re-verify before acting — line

numbers drift.

9.1 Verified claims (against the live container + origin/main)

Net: all four statements are substantively accurate. The MCP server's *token-derived scope is the
structural fix* for the agent_id=default bug — but only for MCP callers; the direct HTTP /episodes and
/iterative-recall defaults remain wrong for any other caller.

9.2 Correction to §2 gap #4 — split "shared memory" into (a) near-term and (b) frontier

The finalized ledger tags gap #4 "no cross-agent / shared memory" as one HIGH/frontier item. Ground
truth says it is two distinct problems, and only one is hard:

• (a) Shared memory for same-owner, co-located sessions (twins/clones) — solvable today. The store is

keyed and cached on the identity tuple tenant::agent::user::team (get_tiered_memory,
tiered_memory.py:638), backed by one cortex instance. Three sessions passing the *same explicit ID
tuple resolve to the same cached TieredMemorySystem → the same SQLite + FAISS files → shared
memory — no distributed plane required. SQLite is already WAL + busy_timeout=10000
(agent_memory_store.py:269/271); cortex even already has a per-tenant shared skill store
(_skill_db_filename(tenant_id), "rows cross ALL of a tenant's agents"). This is the "owner-scoped"
model and it is the industry-standard way to do shared memory (see §9.3). Remaining hardening:
- Concurrent-write safety: the FAISS dense index is the sharp edge — the code carries an explicit
lock, "two workers serving the same (tenant, agent) must not write this index file concurrently
(corruption)" (tiered_memory.py, CON-3995 G101). Same-ID writers serialize on it (throughput ceiling).
- Conflict arbitration: shared ID means writers share provenance and hit the still-passive
"newer-wins" path (§2 gap #5, only partial authority axis #913) — concurrent twins can clobber each
other's facts with no arbitration. This is a correctness risk, not just contention.
- Deliberate design constraint (keep): CON-3995 made empty/"default" scope loud-fail, so sharing
must be an explicit* agreed ID — accidental pooling is prevented by design.

• (b) Shared memory across genuinely distributed / independent instances — the real frontier. Same ID

across different cortex deployments each own a separate {agent_id}_cognitive.db → not shared;
this needs replication / CRDT / consensus and stays hard-gated on CAP-2/CAP-7 consent + tenant + RLS
(§8.3/§8.4). The twin/clone product need does not have to wait on (b) — it waits on (a)'s two hardening
items plus the CAP-2 tenant-id validation fix below.

Isolation-by-identity is the same axis as sharing-by-identity. The independent CAP-2-C2 review
(delivery/reviews/2026-07-20-cap2-c2-ingestion/INDEPENDENT-REVIEW-FINDINGS-2026-07-20.md, PR #2267) found a
CRITICAL: producer-controlled actor.tenant_id/agent_id reach filesystem paths in _consolidate
(outcome_event_subscriber.py:474) before the access gate (:585) — a forge-the-tuple path lets an
attacker read/write into any twin's or tenant's store. The token-scoping the MCP server and
research_area_2 prescribe (derive scope from a verified JWT/mTLS cert, never a client value) is the guard
that makes shared-identity safe.

9.3 How industry manages these gaps (from our own zips + labelled external knowledge)

• Scoping / identity — mem0 ships the exact 3-axis model (user_id persists across all sessions =

the twins case; agent_id; run_id/session), and its best practice is the direct antidote to the
agent_id=default bug: "USER_ID is derived from the authenticated user's identity" — never a client
default (Memory_9/…mem0_zep…csv, Memory_7/web_agent_memory_systems.csv). Letta/MemGPT = per-agent
memory blocks + shared memory blocks attached to multiple agents (their cross-agent primitive).
Cloudflare Agent Memory = a named profile (own Durable Object + Vectorize index, hard-isolated),
deliberately shareable across agents/people. Our Memory_8/research_area_2_identity_tenant_isolation.md
already prescribes: verified-identity-derived scope, per-tenant vector namespaces (shared ANN indices
leak via nearest-neighbour overlap), signed scope tokens, never trust a forwarded X-Tenant-ID.

• MCP binding — industry has converged on a small recall/remember/forget/list/ingest tool contract

over both a native binding and MCP/REST: mem0 OpenMemory MCP, Cloudflare 5-tool surface,
Letta memory-as-tools; the survey's conclusion is "memory is increasingly delivered through MCP or
agent-native tools" (Memory_7/report_agents_that_remember.md, cloudflare_agent_memory_blog.md). Our
docs only name MCP as a P7 line item — the shipped services/cortex-mcp server is now ahead of the
doc; Cloudflare's 5-tool contract + mem0 OpenMemory are ready blueprints for Codex's MCP work.

• Consolidation at scale — our roadmap's "consolidation is a control loop" + first-class

LLM-budget-per-cycle primitive is ahead of the field (no surveyed system formalizes the budget).
Rollup mechanisms to borrow for 10k/day: MemGPT recursive summarization, mem0 extract→consolidate (90%+
token savings), Zep/Graphiti bounded-edge-growth guarantee (active edges ∝ decay-rate × horizon),
Cloudflare concurrent 4-chunk map at compaction. Our open items: map-reduce pagination + per-cycle
budget + circuit-breaker on the loop.

• NL query skin — industry treats it as table stakes and we are behind: Cloudflare recall("…")

= retrieve-then-synthesize NL answer (date math done deterministically, not in the LLM); *mem0
search + OpenMemory dashboard; Zep* dashboard + zepctl; ChatGPT/Claude memory settings UI. The
host-local mem tool (§9.1) is exactly this pattern and reuses the existing RRF substrate.

• Cross-cutting disagreement — Cloudflare/GraphMem use "newer-wins" supersession, which §1.5

rejects as "trivially poisonable (attacker writes last)" in favour of *bitemporal validity + authority
arbitration* (Zep/Graphiti-aligned). We are ahead on paper; §8 marks it still OPEN in code — and §9.2(a)
shows the shared-ID case makes closing it more urgent.

9.4 Recommended follow-ups (advisory)

1. File a CON ticket for the agent_id=default wrong-partition read bug (15,413 real episodes behind a
broken default) — fix = auth-derived agent_id + fail-loud on missing/"default" scope, per
research_area_2. High-value, low-effort.
2. MCP lane owned by Codex — do not collide; but confirm the deploy fixes only the MCP (token-scoped)
path, not the direct HTTP /episodes / /iterative-recall defaults (§9.1).
3. Adopt the (a)/(b) split (§9.2) as the working framing of gap #4; the twin/clone need rides (a).
4. Rollup + mem NL skin — independent, low-risk, high-visibility; borrow the Cloudflare shapes.

Provenance (§9): running-container inspection + origin/main code (code-claim verification agent) + docs/industry
mining across docs/Memory_{1,5,7,8,9,A,Vision}.zip + this roadmap (industry agent), synthesized 2026-07-20.
Companion: delivery/reviews/2026-07-20-cap2-c2-ingestion/INDEPENDENT-REVIEW-FINDINGS-2026-07-20.md (#2267).