| # Security and data handling |
|
|
| ## Enforced in this implementation |
|
|
| Explicit write operations; scoped SQL; tenant immutable in HTTP requests; parameterized queries; current-clock TTL; explicit revision lineage; conflict scan before truncation; bounded request bodies; secret-required API; no shell/network/tool calls from the memory core; no remote code execution when loading a checkpoint; size/format/checksum validation; atomic snapshot replacement; strict snapshot scope and policy identity. |
|
|
| ## Not a security guarantee |
|
|
| Text-level instruction heuristics miss adversarial paraphrases. JSON quoting cannot stop every model prompt injection. The supplied reliability value is not a verified source reputation. An API key grants that instance's write/read/delete ability. There is no user-role system, encryption-at-rest, TLS listener, full audit service, external signing, automatic rate limiter, guaranteed secure erasure, or independent penetration audit. |
|
|
| `forget` deletes logical content and postings. Content-free tombstones remain to prevent resurrection of superseded facts. `forget_all` removes scope metadata too. Old backups and snapshots may still contain deleted text. SQLite secure_delete does not make physical erasure claims safe across WAL, filesystem snapshots and underlying storage. Manage these layers explicitly. |
| |
| Only synthetic fixtures are shipped in `reports/`. Never upload your live memory database to a public model repository. The publication script is private-by-default and manifest-allowlisted. Credentials must remain local to your secret manager or environment. A checksum verifies consistency against a chosen manifest, not the trustworthiness of that manifest's author. |
| |
| ## Deployment review checklist |
| |
| Bind loopback until an authenticated TLS ingress is configured. Assign one namespace from trusted application identity. Use least-privilege file permissions and backed-up durable storage. Set host CPU, RAM and total disk limits. Quotas cover accounted payload, not every audit/tombstone/index byte. Test eviction/expiry/correction and backup restoration with your actual workload. Keep execution/action authorization separate from generated language. |
| |
| Do not use this release as the sole safeguard for medical, financial, legal, safety-critical, or other consequential decisions. Independent evaluation and application-level review are required. |
| |
| |
| ## Evidence-path release additions |
| |
| Certificates contain private evidence references and fingerprints. They are not signatures, access grants or proofs of real-world truth. Verification rereads the scoped store. Deleting a supporting record or reaching its current retention deadline invalidates its certificate; historical verification does not bypass retention. Cached views are cleared by local writes and invalidated on external updates before the next read. Copies retained by callers, in-flight snapshot readers, operating-system pages and backups are outside logical deletion guarantees. |
| |
| Topic rules do not grant trust. Explicit metadata can itself be wrong or malicious; the application owns admission and provenance. A single-tenant bearer API is not a multi-user identity service. Full prompt-injection resistance, host-model obedience, distributed transactions, encryption-at-rest, audit hardening and independent penetration testing have not been established. |
| |
| Unknown predicates and literal values preserve punctuation distinctions. Invalid Unicode surrogate input is rejected before storage. Limits stop work with explicit statuses; a partial graph is not silently presented as complete evidence. |
| |
