Eve operator-memory governance — Task 9.4

Date: 2026-09-12

Status: complete for Task 9.4; Phase 9 and G11 remain open

Result#

Operator memory now has a server-owned lifecycle instead of an unversioned bag of notes. Each current row carries a stable memory id, original source provenance, revision and predecessor pointer, latest source reauthorization, fixed category salience, and an explicit expiry. Corrections archive the exact prior revision with a successor pointer. Canonical dedupe refuses equivalent content in another slot of the same category; confirming unchanged content reauthorizes the existing source rather than fabricating a revision.

The policy is intentionally small and inspectable:

Expiry means exclusion from recall, not hidden deletion. An expired row remains visible to its operator for correction, reauthorization, or erasure. Explicit reauthorization records a new source reference, renews the category expiry, clears last-use, and leaves the content revision and its original provenance unchanged.

Supersession and privacy#

assistant_operator_memory remains the only recall source. assistant_operator_memory_history retains exact superseded revisions solely for correction lineage; it is not queried by prompt recall. The authenticated privacy snapshot takes the same ordered per-category advisory locks as writers, then reads current and historical rows together so an in-flight correction cannot produce a split view.

The drawer now shows source refs, revision and predecessor, reauthorization, salience, expiry, and active/expired status. Its collapsed Superseded revisions section shows exact retained historical values, source provenance, successor, and supersession time, and says they are never recalled. This closes the privacy gap that would otherwise result from retaining hidden historical content.

Exact forget deletes the current row and every revision in its lineage. Forget-all and operator-subject erasure delete all current and superseded rows for that authenticated subject. The service accepts no client-supplied subject; route and PostgreSQL coverage proves an adjacent operator's current and history rows are neither disclosed nor deleted.

Bounded recall and precedence#

Recall filters expiry in PostgreSQL before updating last-use, orders eligible rows by salience then recency, and selects at most 8. Rendering independently enforces the same 8-entry limit and a 4,096-character ceiling. Current and superseded storage ceilings remain 12 preferences, 1 standing initiative, and 8 pinned contexts per operator.

The dynamic prompt block labels memory as fallible and states an explicit precedence contract: security/system policy, live authoritative tool state, and the operator's live instruction always override memory. Preferences are only presentation guidance. Pinned references must be re-grounded through authorized live tools before a current-state claim, and stale, conflicting, or inapplicable memory is ignored. Expired and superseded values are structurally absent before the model boundary.

Verification boundary#

The retained Task 9.4 manifest covers source inspection, a static contract with mutation controls, focused logic tests, real Fastify service routes, real PostgreSQL persistence/reconstruction/erasure, authorization isolation, restart recovery, the precedence adversarial pair, and the real Chromium privacy and reauthorization journey with a scoped serious-impact axe scan.

The PostgreSQL 16.14 receipt records stable identity across correction, revision 2 superseding revision 1, one visible historical row and no historical prompt input, canonical duplicate refusal, expired-source exclusion, renewal without a content revision, an 8-row/2,549-character bounded prompt, successful client reconstruction, exact/all lineage erasure, adjacent current/history preservation, and zero synthetic rows after cleanup. Eighteen lifecycle tests, five real-route tests, eight parser/component tests, focused BFF and admin typechecks, formatting and lint, and the real Chromium 148 journey pass. Eleven isolated mutation controls each fail before a clean regression. The manifest is docs/audits/eve-sota-evidence/phase-09/task-9-4.json.

This task does not claim the broader memory-poisoning matrix in Task 9.5, semantic recall in Task 9.6, or canary and rollout outcomes in Task 9.7. Task 9.3 also remains open until an actual human reviewer returns the requested relevance labels and attestation. Therefore Phase 9 and G11 remain open.