Security and data handling
Enforced in this implementation
Explicit write operations; scoped SQL; tenant immutable in HTTP requests; parameterized queries; current-clock TTL; explicit revision lineage; conflict scan before truncation; bounded request bodies; secret-required API; no shell/network/tool calls from the memory core; no remote code execution when loading a checkpoint; size/format/checksum validation; atomic snapshot replacement; strict snapshot scope and policy identity.
Not a security guarantee
Text-level instruction heuristics miss adversarial paraphrases. JSON quoting cannot stop every model prompt injection. The supplied reliability value is not a verified source reputation. An API key grants that instance's write/read/delete ability. There is no user-role system, encryption-at-rest, TLS listener, full audit service, external signing, automatic rate limiter, guaranteed secure erasure, or independent penetration audit.
forget deletes logical content and postings. Content-free tombstones remain to prevent resurrection of superseded facts. forget_all removes scope metadata too. Old backups and snapshots may still contain deleted text. SQLite secure_delete does not make physical erasure claims safe across WAL, filesystem snapshots and underlying storage. Manage these layers explicitly.
Only synthetic fixtures are shipped in reports/. Never upload your live memory database to a public model repository. The publication script is private-by-default and manifest-allowlisted. Credentials must remain local to your secret manager or environment. A checksum verifies consistency against a chosen manifest, not the trustworthiness of that manifest's author.
Deployment review checklist
Bind loopback until an authenticated TLS ingress is configured. Assign one namespace from trusted application identity. Use least-privilege file permissions and backed-up durable storage. Set host CPU, RAM and total disk limits. Quotas cover accounted payload, not every audit/tombstone/index byte. Test eviction/expiry/correction and backup restoration with your actual workload. Keep execution/action authorization separate from generated language.
Do not use this release as the sole safeguard for medical, financial, legal, safety-critical, or other consequential decisions. Independent evaluation and application-level review are required.
Evidence-path release additions
Certificates contain private evidence references and fingerprints. They are not signatures, access grants or proofs of real-world truth. Verification rereads the scoped store. Deleting a supporting record or reaching its current retention deadline invalidates its certificate; historical verification does not bypass retention. Cached views are cleared by local writes and invalidated on external updates before the next read. Copies retained by callers, in-flight snapshot readers, operating-system pages and backups are outside logical deletion guarantees.
Topic rules do not grant trust. Explicit metadata can itself be wrong or malicious; the application owns admission and provenance. A single-tenant bearer API is not a multi-user identity service. Full prompt-injection resistance, host-model obedience, distributed transactions, encryption-at-rest, audit hardening and independent penetration testing have not been established.
Unknown predicates and literal values preserve punctuation distinctions. Invalid Unicode surrogate input is rejected before storage. Limits stop work with explicit statuses; a partial graph is not silently presented as complete evidence.