Governed Persistent Memory: Source-Bound State Semantics and Fail-Closed Release for Long-Horizon Agents

Guodong Xu

REVIEW 3 major objections 6 minor 35 references

Governed Persistent Memory: Source-Bound State Semantics and Fail-Closed Release for Long-Horizon Agents

T0 review · 3 major / 6 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper introduces Governed Persistent Memory, a bitemporal source-bound state model in which a structured claim may be released only if it exactly matches an assertable fact in a fresh public view at a verified ledger head.

desk verdict A serious, self-aware systems paper with a sound formal contract and internally generated perfection; the empirical claims need independent gold before they can carry the headline weight. read the letter →

arxiv 2608.12476 v1 pith:4DXSRHQF submitted 2026-08-12 cs.AI

Guodong Xu This is my paper · ORCID

classification cs.AI

keywords governedpersistentmemorybitemporalstatemodelsource-boundclaimsfail-closedreleaseretractionnon-revivalstructuredcontractagentledgerconformance

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper's pith is that retrieval is not public eligibility: a long-horizon agent may assert a fact only after the memory system has established that the fact is source-bound, not superseded or in unresolved conflict, not retracted or deleted, and closed against a freshly verified ledger head. To make that testable, it defines Governed Persistent Memory (GPM), an auditable bitemporal event-ledger model with five executable clauses covering ledger integrity, source binding, conflict isolation, non-revival after retraction or deletion, and structured release closure. On a frozen, evaluator-hidden 3,600-case suite, GPM matches every allowed outcome while the strongest simple policy matches half and releases unsafely on half of the violation cases; sealed end-to-end runs report 2,400/2,400 in the disclosed arm and again in both command-language reseal arms. The paper is careful to frame these as bounded contract and implementation results, not open-world or world-truth accuracy.

What carries the argument

The load-bearing mechanism is the release decision of equation (10), operating on the public projection $V_{\mathrm{pub}}$ of equation (6). $V_{\mathrm{pub}}$ is a bitemporal filtered view, where each event carries both transaction time and valid time: with respect to the verified ledger head $h_c$, it takes the transaction-time prefix $\tau_q$, applies the latest user deletion barrier and retracted-fact set, then removes superseded and conflicted claims, so ranking only orders claims already eligible for public assertion. The gate reads the head as $h_b$, constructs $V_{\mathrm{pub}}$, requires every proposed structured claim $a$ to satisfy $\mathrm{bound}(a,V,u)$ — non-empty source fact identifiers all matching the normalized entity–key–value triple — digests the complete claim multiset into $D_A$, and rereads the head as $h_a$; only $h_a = h_b$ with a non-empty closed set yields a release record, and otherwise the gate fails closed or abstains. All five clauses are expressed as executable checks on this one decision boundary.

What would settle it

Inspect the frozen GPM-ReleaseBench hidden split: if any violation-polarity case receives an unmatched release, or any valid case is not matched to an allowed outcome bundle, the central fail-closed claim collapses. Independently, a single Governed-QA Sealed cluster that returns a wrong answer, abstains on an answerable case, or regresses a baseline-correct cluster, or a full-contract counterexample inside the declared 331,776/1,990,656 finite-state bounds, would refute it.

Watch

Extended reading notes

Core claim

Contract consequence 1 is the central claim: whenever the release gate defined by equation (10) returns release, every structured claim $a$ in the outgoing multiset $A$ is exactly bound to one or more same-user assertable facts in the fresh public view $V_{\mathrm{pub}}(u,t,\tau;h_b)$, its digest $D_A$ commits to the complete canonical claim multiset, and no claim is bound only to facts or episodes excluded by current retraction or user-deletion policy at the verified head $h_b$. The gate enforces this by reading the head before constructing the view, rechecking every binding against that view, and rereading the head before emitting a record; a head change raises an error and returns no record. On the paper's frozen GPM-ReleaseBench, GPM matches 3,600/3,600 complete outcomes with zero unmatched violation releases, whereas raw append, latest-first, and flat conflict-preserving policies release unsafely on 91.67%, 58.33%, and 50% of violation cases respectively. The sealed Governed-QA evaluation reports the governed lane correct on 2,400/2,400 clusters versus 600/2,400 for ungoverned local Qwen2.5-7B, with all 1,800 baseline failures repaired and no regressions.

Load-bearing premise

The empirical case rests on gold labels and a sealed oracle generated by the same project and audited only by two isolated AI review lines with no independent human annotation; if those labels misdefine the intended contract, the all-success counts would not show fail-closed behavior on real-world data.

Editorial extensions

If this is right

Under I1–I5, no released structured answer can be supported by a retracted or deleted fact, an unresolved conflicting fact, or a claim with no matching source identifier, as long as the trusted local commitment and verified head are intact.
The three weak policies' unsafe-release rates show the failure mode the contract removes: relevance ranking alone can surface stale or contradictory records as if they were current public facts.
A single safety rate is insufficient to audit the contract; the no-I1 mutant misses 150 required fail-closed outcomes without producing an unmatched release, so complete outcome bundles are the right evaluation unit.
The release record is local and unsigned today, so cross-process or cross-host use requires adding authentication, freshness, expiry, and key management before the same guarantee can be claimed at a distance.
The eligibility projection can be combined with different retrievers, operation languages, replicated conflict substrates, or descendant-repair planners; GPM supplies the boundary, not the ranking.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Editorial inference: A natural extension would be to rerun the same release gate on externally authored dialogues or ontologies with independent human gold annotation; that would test whether the internally generated suite's clean results transfer to naturalistic distributions.
Editorial inference: The head-stability check suggests a general design rule for agent frameworks: emit claims only against a snapshot that is re-verified at emission time, since any delay between reading state and releasing an answer is where stale or revoked facts can slip in.
Editorial inference: The largest unclosed risk the paper itself identifies is free-form prose: I5 covers explicit structured claims only, so an agent that paraphrases or merges facts in natural language is outside the guarantee until a semantic entailment check on emitted text exists.
Editorial inference: The bounded finite model could be pushed past 331,776 semantic and 1,990,656 query states by raising the event bound or adding multi-user interference; a full-contract counterexample found there would force revision of the five clauses.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Short version: GPM is a serious piece of systems work. It gives long-horizon agents a concrete, checkable boundary between what may be asserted and what is merely retrievable, and it does so with unusual honesty about its own limits. The formal contract is the real contribution; the 100% scores are not yet independently established.

What's actually new: the five executable clauses (I1–I5) and the release gate in Eq. (10). The head-reread before issuing a claim-bound record is a clean, mechanical way to make 'fresh view' precise. The derivation of Contract Consequence 1 is a direct unpacking of the definitions, and the paper openly says so. That is the right level of ambition: no inductive theorem over all reachable states, just a carefully scoped statement about what the gate checks.

Credit where due: the paper is far more candid than most. It explicitly calls GPM-ReleaseBench 'internally designed,' admits there was no human blind annotation, discloses the V3 reducer amendment, and runs clean-task controls that fail their own judge gate. It consistently distinguishes deterministic contract results from language-model accuracy. That discipline is real.

The soft spot is exactly where the reader's stress-test points: the main empirical evidence is circular in a specific sense. Both the 3,600-case benchmark and the sealed 2,400-cluster evaluation use gold labels generated by the same project and audited only by two isolated AI review lines. If the label generator and the system under test share a subtle misinterpretation of the contract—say, over normalization or deletion-barrier semantics—then a fully conformant-but-wrong implementation could still produce perfect scores. The finite model and three-engine differential are bounded and also built from the same project's executable formulation, so they don't break the circularity. The paper acknowledges all of this in Section 8, which is why I call it a soft spot rather than a fatal flaw. But the headline numbers are presented with Clopper-Pearson bounds that might suggest more independence than exists. The problem is addressable: independent human annotation of a sample of gold cases, or an externally authored challenge set, would do a lot.

Who should read it: anyone building memory layers for agents or working on provenance and abstention. The contract design is a useful reference even if you don't adopt the system. Does it deserve a serious referee? Yes. The formal work is coherent, the system is non-trivial, and the honesty about limitations is exactly what peer review needs. I'd send it to reviewers with a request to focus on the evaluation design rather than desk-reject it. My own verdict would be conditional: accept after the empirical claims are backed by independent gold, or at least reframed as internal demonstrations rather than evidence of contract satisfaction. For my own work, I'd cite the contract but not the 100% results.

Referee Report

3 major / 6 minor

Summary. The paper introduces Governed Persistent Memory (GPM), a bitemporal state-transition model for long-horizon agent memory that separates source-bound admission, derived lifecycle state, conflict isolation, retraction/deletion barriers, and a fail-closed structured release gate. The formal core is a set of five executable clauses (I1–I5) culminating in Eq. (10), which defines the release decision as requiring a fresh public view, a stable verified head, and exact binding of every structured claim to source fact identifiers. The paper reports a hash-frozen 3,600-case contract suite (GPM-ReleaseBench), a sealed end-to-end service evaluation (Governed-QA Sealed) with 2,400/2,400 correctness in the governed lane, a bounded finite model with no counterexamples, and a 100,000-trace three-engine differential. The paper repeatedly and explicitly scopes these as bounded contract and implementation results, not open-world accuracy claims.

Significance. If the formal contract is correctly implemented, GPM provides a coherent and useful separation between retrieval and public assertability, with a precise definition of when a structured claim may be released. The formal definitions in Section 3.5 are internally sound: Contract consequence 1 follows directly from Eq. (10) and the definition of bound(), and the paper honestly labels it as a direct consequence rather than an inductive theorem. The paper is unusually transparent about its limitations, including the internal generation of benchmarks, the failed language-judge gate, the post-freeze reducer amendment in V3, and the absence of independent human annotation. These strengths make the formal contribution a valuable reference point for systems-level agent memory. However, the empirical validation is the load-bearing support for the claim that the production system actually satisfies I1–I5, and that validation rests on gold labels and oracles authored by the same project, which substantially limits the strength of the empirical conclusions.

major comments (3)

[§5.2, §5.4, §8] The central empirical claims (3,600/3,600 on GPM-ReleaseBench and 2,400/2,400 on Governed-QA Sealed) rest on gold labels designed by the same project that implemented the system. The paper states in §5.2 that GPM-ReleaseBench is 'an internally designed contract-conformance suite' and in §5.4 that Governed-QA Sealed is 'also internally generated.' Hidden gold was audited only by 'two isolated AI review lines' with no human blind annotation, and the gold sealing occurred under one OS user (§8). Because the gold generator and the system under test share the same interpretation of the contract—including normalization, conflict, supersession, and retraction/deletion barriers—a systematic misinterpretation in that shared interpretation would be reflected in both the generated 'correct' labels and the system's behavior, making the perfect scores uninformative about whether the system enforces the intended contract on any independent distribution. The paper acknowledges this, but the abstract and §6 still present these counts as the primary evidence that GPM satisfies I1–I5. To make the empirical claims load-bearing, the hidden gold should receive independent human annotation, or the results should be explicitly repositioned as self-consistency checks rather than validation of the contract.
[§5.4, Table 3] The V3 arm, which is the publicly disclosed result, required a post-freeze reducer amendment to admit only the dated form of 120 temporal questions whose date literal differed due to crossing UTC dates between candidate and baseline execution. The paper reports this transparently, but it means the V3 2,400/2,400 result is not a clean prespecified frozen evaluation; the reducer was changed after the freeze. The V5 reseal addresses this defect by pinning the generation date and reporting reducer_amended_after_freeze=false, but V5 still uses an internally generated surface. Additionally, the one-sided 95% Clopper–Pearson lower bounds (§6.2) are descriptive summaries of an all-success denominator on a deterministic generated set, not inferential estimates from a random sample; the paper notes this, but the presentation in Tables 3 and 4 may nonetheless be read as supporting a population-level success rate. Please either provide an externally authored or independently annotated evaluation, or explicitly state in the abstract and results that the 100% figures are exact counts on a constructed, internally generated suite with no sampling-frame interpretation.
[§8, §9] The reproducibility artifact excludes hidden gold, evaluator keys, and per-cluster receipts, and has no public URL, DOI, or release date assigned. Combined with the internally generated gold, this means the empirical results cannot be independently checked or rescored by any other party. The paper's transparency is commendable, but for a paper whose contributions include empirical evaluation, this is a load-bearing limitation: the claims of 3,600/3,600 and 2,400/2,400 are not independently verifiable as presented. Please either release the hidden gold and receipts (with keys) after the evaluation, provide an independent audit protocol, or clearly state in the contribution list that the empirical results are self-reported and not externally reproducible.

minor comments (6)

[§2.1, Eq. (1)–(2)] The notation is inconsistent: Eq. (1) uses 'rank k' while Eq. (2) uses 'rankk'; please harmonize to a single notation (e.g., 'rank_k').
[§3.1, Eq. (3)] In Eq. (3), 'canon(e_i\{h_i})' is ambiguous: clarify that it denotes the canonical encoding of the event fields excluding the chained hash h_i, and specify the canonicalization rules (field ordering, length-delimited encoding) used.
[§5.2, Table 2] The answer-bundle accuracy column in Table 2 reports percentages without explicit denominators; the text explains that violation cases whose only purpose is to diagnose unsupported free text are excluded, but the table would be clearer if it stated the denominator for each row (e.g., 1200/2300) rather than only the percentage.
[§5.3] When running StateFuse, the paper should cite the specific version or commit of StateFuse used and describe how the 'official state projection' was obtained, so that the shared-subset comparison is reproducible.
[§6.3, Table 5] The 'No I1' row shows 0 unsafe releases but atomic match of 3450/3600; the accompanying text explains that the mutant misses 150 required fail-closed outcomes, but a brief sentence clarifying why this does not appear as an unsafe release would help readers understand the metric design.
[Abstract and §5.2] The abstract says 'prespecified hash-frozen 3,600-case GPM-ReleaseBench,' but §5.2 describes a public development split of 360 cases plus an evaluator-hidden split of 3,600 cases; clarify that the 3,600 figure refers to the hidden split only, or give the total count.

Circularity Check

1 steps flagged · score 4.0 of 10

The formal contract is transparent and self-contained, but the headline 100% results are conformance checks against internally generated gold, making the empirical 'predictions' partially circular.

fitted input called prediction [§5.2, §5.4, §8 (GPM-ReleaseBench v1 and Governed-QA Sealed)]
"The benchmark is evaluator-hidden relative to the tested runners, but it was designed by the same project as GPM and is not an external naturalistic distribution. ... The system implementation and benchmark ontology were both available before the hidden run; evaluator-hidden execution is not the same as an externally authored benchmark."

The scoring gold for the headline 3,600/3,600 and 2,400/2,400 results is authored by the same project and derives from the same executable interpretation of the I1–I5 contract (normalization, multi-value registry, valid-interval overlap, supersession, and deletion barriers). GPM's release decision in Eq. (10) and the oracle's expected outcomes are two products of one semantic reading; any systematic misinterpretation shared by the implementation and the generator is baked into the 'correct' labels. The perfect scores therefore demonstrate implementation-vs-self consistency rather than independent compliance with an external specification, so the empirical claim is partially circular by construction.

full rationale

The formal core is self-contained and honestly scoped. Equations (3)–(10) define the ledger, public projection, and release predicate; I1–I5 are executable obligations, and Contract consequence 1 is explicitly presented as a direct unpacking of Eq. (10) and bound(), not as an inductive theorem. That definitional transparency is not a concealed circularity and is not counted against the paper beyond noting it adds no independent content. Reference [1] is a self-citation but only discloses V3 aggregate results; no load-bearing uniqueness theorem or ansatz is imported from it. The real circularity burden is empirical: both central evaluations use internally generated gold and a machine oracle from the same project, with no independent human annotation (explicitly admitted in §8). The 3,600/3,600 and 2,400/2,400 outcomes are therefore bounded self-consistency checks, not demonstrations against an independent ground truth. That warrants a moderate score: the derivation is not forced, but the headline predictions reduce substantially to author-generated inputs.

Assumptions & free parameters 0 free parameters · 5 assumptions · 3 invented entities

No numeric parameters are fitted to data; the system is rule-based. The heavy assumptions are the trust boundary for the head commitment, the syntactic notion of source binding, and the internal validity of the generated benchmarks, all of which the paper explicitly discloses.

assumptions (5)

standard math Cryptographic hash functions are collision-resistant.
Used in event chaining Eq. (3) and record digest Eq. (8).
domain assumption Trusted local commitment (sidecar or manifest) is protected from an attacker who can rewrite storage; host compromise that rewrites both is out of scope.
Sections 3.1, 4.2, 8; the whole ledger integrity clause I1 depends on this boundary.
domain assumption Quote containment of source bytes establishes syntactic source binding (I2); no semantic entailment is claimed.
Section 3.2; the release contract treats this as sufficient.
domain assumption Transaction time is nondecreasing and supplied by a trusted engine clock, with historical injection only through a trusted interface.
Section 3.1; bitemporal view semantics rely on this.
domain assumption Attribute cardinality policy (single-valued by default with a small multi-value registry) correctly encodes the world's attributes.
Section 3.3; conflict detection depends on this registry.

invented entities (3)

Current public barriers (deletion barrier d_c and retraction set R_c) at the verified head independent evidence
purpose: Enforce non-revival across historical and current reads.
Implemented in the three engines; behavior is directly checkable via public and audit searches.
Testimony-only episode projection Epub independent evidence
purpose: Allows retrieval of source episodes without making them assertable under I5.
Observable in the release gate's refusal to bind structured claims to episodes.
Release decision record rho(d) with digest D_A and stable-head check independent evidence
purpose: Binds outgoing structured claims to the exact view at one verified head.
The record format is defined in Eq. (9); verifiers can reject altered or stale records.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Governed Persistent Memory: Source-Bound State Semantics and Fail-Closed Release for Long-Horizon Agents." pith.science (2026). https://pith.science/paper/4DXSRHQF

@misc{pith2026260812476,
  author       = {Pith},
  title        = {Pith review of: Governed Persistent Memory: Source-Bound State Semantics and Fail-Closed Release for Long-Horizon Agents},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4DXSRHQF}},
  note         = {Machine review of arXiv:2608.12476}
}

read the original abstract

Long-term agent memory is usually treated as select--store--retrieve, but retrieval does not decide whether contradictory, superseded, retracted, deleted, or stale records may support an outgoing claim. We introduce Governed Persistent Memory (GPM), an auditable bitemporal state-transition model with source-bound admission, derived lifecycle state, current public barriers, and fail-closed structured release. Five executable clauses cover ledger integrity, source binding, conflict isolation, non-revival after retraction or deletion, and exact claim closure over a fresh view at one verified head. On a prespecified hash-frozen 3,600-case GPM-ReleaseBench, GPM matches all complete outcomes; the strongest of three intentionally simple complete policies matches 1,800/3,600 and makes unmatched releases on 50% of violation cases. A separate sealed end-to-end service evaluation exercises real ingestion and release across eight query families. In its publicly disclosed V3 arm, the governed lane is correct on 2,400/2,400 clusters versus 600/2,400 for ungoverned local Qwen2.5-7B; it repairs all 1,800 baseline failures with no regression (one-sided 95% lower bounds 99.875% and 99.834%). A later V5 reseal over Chinese- and English-command arms, with generation-date pinning and no post-freeze reducer amendment, again obtains 2,400/2,400 per arm. A production-code-independent finite model explores 331,776 semantic and 1,990,656 query states without a full-contract counterexample, and a 100,000-trace three-engine differential yields zero mismatches. These are bounded contract and implementation results, not open-world model accuracy or evidence of world truth. Governed answers in the sealed service evaluation are deterministic service outputs; the 7B result is the ungoverned comparison, not a claim that a language model itself became perfectly accurate.

Figures

Figures reproduced from arXiv: 2608.12476 by the authors.

**Figure 2.** Fail-closed structured-release protocol. Closure is evaluated over the view bound to [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

35 extracted references · 19 canonical work pages

[1]

Governed memory: Public bounded evaluation disclosure

Aethmere-OS Project. Governed memory: Public bounded evaluation disclosure. Immutable repository commit https://github.com/kzkz137806/aethmere-os/commit/ dffc1c3659bc8377faf8c0443363926c1fda7aa6, 2026. Accessed 2026-08-11. 19

work page 2026
[2]

APEX-MEM: Agentic semi-structured memory with temporal reasoning for long- term conversational AI

Pratyay Banerjee, Masud Moshtaghi, Shivashankar Subramanian, Amita Misra, and Ankit Chadha. APEX-MEM: Agentic semi-structured memory with temporal reasoning for long- term conversational AI. InProceedings of the 64th Annual Meeting of the Association for Computational Linguistics, pages 16470–16489, 2026. doi: 10.18653/v1/2026.acl-long.749. URL https://ac...

work page doi:10.18653/v1/2026.acl-long.749 2026
[3]

Trust as a precursor to belief revision.Journal of Artificial Intelligence Research, 61:699–722, 2018

Richard Booth and Aaron Hunter. Trust as a precursor to belief revision.Journal of Artificial Intelligence Research, 61:699–722, 2018. doi: 10.1613/jair.5521

work page doi:10.1613/jair.5521 2018
[4]

HaluMem: Evaluating hallucinations in memory systems of agents.arXiv preprint arXiv:2511.03506, 2025

Ding Chen, Simin Niu, Kehang Li, Peng Liu, Xiangping Zheng, Bo Tang, Xinchi Li, Feiyu Xiong, and Zhiyu Li. HaluMem: Evaluating hallucinations in memory systems of agents.arXiv preprint arXiv:2511.03506, 2025. URLhttps://arxiv.org/abs/2511.03506

arXiv 2025
[5]

Mem0: Building production-ready AI agents with scalable long-term memory.arXiv preprint arXiv:2504.19413, 2025

Prateek Chhikara, Dev Khant, Saket Aryan, Taranjeet Singh, and Deshraj Yadav. Mem0: Building production-ready AI agents with scalable long-term memory.arXiv preprint arXiv:2504.19413, 2025. URLhttps://arxiv.org/abs/2504.19413

arXiv 2025
[6]

Selective classification for deep neural networks

Yonatan Geifman and Ran El-Yaniv. Selective classification for deep neural networks. In Advances in Neural Information Processing Systems, volume 30, 2017. URLhttps://papers. neurips.cc/paper/2017/hash/4a8423d5e91fda00bb7e46540e2b0cf1-Abstract.html

work page 2017
[7]

Scott Stornetta

Stuart Haber and W. Scott Stornetta. How to time-stamp a digital document.Journal of Cryptology, 3(2):99–111, 1991. doi: 10.1007/BF00196791

doi:10.1007/bf00196791 1991
[8]

EverMemOS: A self-organizing memory operating system for structured long-horizon reasoning

Chuanrui Hu, Xingze Gao, Zuyi Zhou, Dannong Xu, Yi Bai, Xintong Li, Hui Zhang, Tong Li, Chong Zhang, Lidong Bing, and Yafeng Deng. EverMemOS: A self-organizing memory operating system for structured long-horizon reasoning. InProceedings of the 64th Annual Meeting of the Association for Computational Linguistics, pages 45836–45853, 2026. doi: 10.18653/v1/2...

work page doi:10.18653/v1/2026.acl-long.2125 2026

Show all 35 references

[9]

Evaluating memory in LLM agents via incremental multi-turn interactions

Yuanzhe Hu, Yu Wang, and Julian McAuley. Evaluating memory in LLM agents via incremental multi-turn interactions. InInternational Conference on Learning Representations, 2026. URL https://arxiv.org/abs/2507.05257

2026 arXiv
[10]

Mitigating provenance-role collapse in long-term agents via typed memory representation.arXiv preprint arXiv:2605.25869,

Zhengda Jin, Bingbing Wang, Jing Li, Ruifeng Xu, and Min Zhang. Mitigating provenance-role collapse in long-term agents via typed memory representation.arXiv preprint arXiv:2605.25869,

arXiv
[11]

H. T. Kung and John T. Robinson. On optimistic methods for concurrency control.ACM Transactions on Database Systems, 6(2):213–226, 1981. doi: 10.1145/319566.319567

1981
[12]

Certificate transparency version 2.0

Ben Laurie, Emilia Messeri, and Rob Stradling. Certificate transparency version 2.0. RFC 9162, RFC Editor, 2021. URLhttps://www.rfc-editor.org/info/rfc9162

2021
[13]

Retrieval-augmented generation for knowledge- intensive NLP tasks

Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, Se- bastian Riedel, and Douwe Kiela. Retrieval-augmented generation for knowledge- intensive NLP tasks. InAdvances in Neur...

2020
[14]

MemOS: A memory OS for AI system.arXiv preprint arXiv:2507.03724, 2025

Zhen Li, Chao Xi, Chen Li, et al. MemOS: A memory OS for AI system.arXiv preprint arXiv:2507.03724, 2025. URLhttps://arxiv.org/abs/2507.03724. 20

2025 arXiv
[15]

Revision by history.Journal of Artificial Intelligence Research, 52:287–329,

Paolo Liberatore. Revision by history.Journal of Artificial Intelligence Research, 52:287–329,
[16]

Conflict- aware memory for embodied agents: Enhancing vector data quality via detection rules

Kexin Ma, Haotian Wang, Shenglin Chen, Yishuai Cai, Huangyuyu, and Ruochun Jin. Conflict- aware memory for embodied agents: Enhancing vector data quality via detection rules. In Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics, pages 2832...

2026 doi
[17]

Evaluating very long-term conversational memory of LLM agents

Adyasha Maharana, Dong-Ho Lee, Sergey Tulyakov, Mohit Bansal, Francesco Barbieri, and Yuwei Fang. Evaluating very long-term conversational memory of LLM agents. InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics, pages 13851–13870,
[18]

PROV-DM: The PROV data model

Luc Moreau, Paolo Missier, et al. PROV-DM: The PROV data model. W3c recommendation, World Wide Web Consortium, 2013. URLhttps://www.w3.org/TR/prov-dm/

2013
[19]

Multilabel classification with partial abstention: Bayes- optimal prediction under label independence.Journal of Artificial Intelligence Research, 72: 613–665, 2021

Vu-Linh Nguyen and Eyke Hüllermeier. Multilabel classification with partial abstention: Bayes- optimal prediction under label independence.Journal of Artificial Intelligence Research, 72: 613–665, 2021. doi: 10.1613/jair.1.12610

2021 doi
[20]

Patil, Ion Stoica, and Joseph E

Charles Packer, Sarah Wooders, Kevin Lin, Vivian Fang, Shishir G. Patil, Ion Stoica, and Joseph E. Gonzalez. MemGPT: Towards LLMs as operating systems.arXiv preprint arXiv:2310.08560, 2023. URLhttps://arxiv.org/abs/2310.08560

2023 arXiv
[21]

The UCONABC usage control model.ACM Transactions on Information and System Security, 7(1):128–174, 2004

Jaehong Park and Ravi Sandhu. The UCONABC usage control model.ACM Transactions on Information and System Security, 7(1):128–174, 2004. doi: 10.1145/984334.984339

2004
[22]

O’Brien, Carrie J

Joon Sung Park, Joseph C. O’Brien, Carrie J. Cai, Meredith Ringel Morris, Percy Liang, and Michael S. Bernstein. Generative agents: Interactive simulacra of human behavior. In Proceedings of the 36th Annual ACM Symposium on User Interface Software and Technology,
[23]

Snodgrass.Developing Time-Oriented Database Applications in SQL

Richard T. Snodgrass.Developing Time-Oriented Database Applications in SQL. Morgan Kaufmann, 1999. URLhttps://www2.cs.arizona.edu/~rts/tdbbook.pdf

1999
[24]

MemConflict: Evaluating long-term memory systems under memory conflicts.arXiv preprint arXiv:2605.20926, 2026

Zhen Tao, Jinxiang Zhao, Peng Liu, Dinghao Xi, Yanfang Chen, Wei Xu, and Zhiyu Li. MemConflict: Evaluating long-term memory systems under memory conflicts.arXiv preprint arXiv:2605.20926, 2026. doi: 10.48550/arXiv.2605.20926. URL https://arxiv.org/abs/ 2605.20926

2026 doi arXiv
[25]

StateFuse: Deterministic conflict-preserving memory for multi-agent systems.arXiv preprint arXiv:2607.05844, 2026

Sergey Volkov, Yang Li, and Ye Luo. StateFuse: Deterministic conflict-preserving memory for multi-agent systems.arXiv preprint arXiv:2607.05844, 2026. doi: 10.48550/arXiv.2607.05844. URLhttps://arxiv.org/abs/2607.05844

2026 doi arXiv
[26]

Text2Mem: A unified memory operation language for memory operating system

Leo Wang, Lihai Yang, Boyu Chen, Kerun Xu, Gongyi Zou, Bo Tang, Feiyu Xiong, Siheng Chen, and Zhiyu Li. Text2Mem: A unified memory operation language for memory operating system. InFindings of the Association for Computational Linguistics: ACL 2026, pages 2105–2119, 2026. doi:...

2026 doi
[27]

Augmenting language models with long-term memory.arXiv preprint arXiv:2306.07174, 2023

Weizhi Wang, Li Dong, Hao Cheng, Xiaodong Liu, Xifeng Yan, Jianfeng Gao, and Furu Wei. Augmenting language models with long-term memory.arXiv preprint arXiv:2306.07174, 2023. URLhttps://arxiv.org/abs/2306.07174

2023 arXiv
[28]

TOKI: A bitemporal operator algebra for contradiction resolution in LLM-agent persistent memory.arXiv preprint arXiv:2606.06240, 2026

Ziming Wang. TOKI: A bitemporal operator algebra for contradiction resolution in LLM-agent persistent memory.arXiv preprint arXiv:2606.06240, 2026. doi: 10.48550/arXiv.2606.06240. URLhttps://arxiv.org/abs/2606.06240

2026 doi arXiv
[29]

LongMemEval: Benchmarking chat assistants on long-term interactive memory

DiWu, HongweiWang, WenhaoYu, YuweiZhang, Kai-WeiChang, andDongYu. LongMemEval: Benchmarking chat assistants on long-term interactive memory. InInternational Conference on Learning Representations, 2025. URLhttps://arxiv.org/abs/2410.10813

2025 arXiv
[30]

How memory management impacts LLM agents: An empirical study of experience-following behavior

Zidi Xiong, Yuping Lin, Wenya Xie, Pengfei He, Zirui Liu, Jiliang Tang, Himabindu Lakkaraju, and Zhen Xiang. How memory management impacts LLM agents: An empirical study of experience-following behavior. InProceedings of the 64th Annual Meeting of the Association for Computati...

2026 doi
[31]

MemoRepair: Barrier-first cascade repair in agentic memory.arXiv preprint arXiv:2605.07242, 2026

Yang Zhao, Chengxiao Dai, Mengying Kou, and Yue Xiu. MemoRepair: Barrier-first cascade repair in agentic memory.arXiv preprint arXiv:2605.07242, 2026. doi: 10.48550/arXiv.2605. 07242. URLhttps://arxiv.org/abs/2605.07242. 22 A Claim–Evidence Boundary Table 11: What each main cl...

2026 doi arXiv
[2015]

doi: 10.1613/jair.4608

doi
[2023]

doi: 10.1145/3586183.3606763
[2024]

URL https://aclanthology.org/2024.acl-long

doi: 10.18653/v1/2024.acl-long.747. URL https://aclanthology.org/2024.acl-long. 747/

2024 doi
[2026]

URLhttps://arxiv.org/abs/2605.25869

doi: 10.48550/arXiv.2605.25869. URLhttps://arxiv.org/abs/2605.25869

doi arXiv

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.

[1] [1]

Governed memory: Public bounded evaluation disclosure

Aethmere-OS Project. Governed memory: Public bounded evaluation disclosure. Immutable repository commit https://github.com/kzkz137806/aethmere-os/commit/ dffc1c3659bc8377faf8c0443363926c1fda7aa6, 2026. Accessed 2026-08-11. 19

work page 2026

[2] [2]

APEX-MEM: Agentic semi-structured memory with temporal reasoning for long- term conversational AI

Pratyay Banerjee, Masud Moshtaghi, Shivashankar Subramanian, Amita Misra, and Ankit Chadha. APEX-MEM: Agentic semi-structured memory with temporal reasoning for long- term conversational AI. InProceedings of the 64th Annual Meeting of the Association for Computational Linguistics, pages 16470–16489, 2026. doi: 10.18653/v1/2026.acl-long.749. URL https://ac...

work page doi:10.18653/v1/2026.acl-long.749 2026

[3] [3]

Trust as a precursor to belief revision.Journal of Artificial Intelligence Research, 61:699–722, 2018

Richard Booth and Aaron Hunter. Trust as a precursor to belief revision.Journal of Artificial Intelligence Research, 61:699–722, 2018. doi: 10.1613/jair.5521

work page doi:10.1613/jair.5521 2018

[4] [4]

HaluMem: Evaluating hallucinations in memory systems of agents.arXiv preprint arXiv:2511.03506, 2025

Ding Chen, Simin Niu, Kehang Li, Peng Liu, Xiangping Zheng, Bo Tang, Xinchi Li, Feiyu Xiong, and Zhiyu Li. HaluMem: Evaluating hallucinations in memory systems of agents.arXiv preprint arXiv:2511.03506, 2025. URLhttps://arxiv.org/abs/2511.03506

arXiv 2025

[5] [5]

Mem0: Building production-ready AI agents with scalable long-term memory.arXiv preprint arXiv:2504.19413, 2025

Prateek Chhikara, Dev Khant, Saket Aryan, Taranjeet Singh, and Deshraj Yadav. Mem0: Building production-ready AI agents with scalable long-term memory.arXiv preprint arXiv:2504.19413, 2025. URLhttps://arxiv.org/abs/2504.19413

arXiv 2025

[6] [6]

Selective classification for deep neural networks

Yonatan Geifman and Ran El-Yaniv. Selective classification for deep neural networks. In Advances in Neural Information Processing Systems, volume 30, 2017. URLhttps://papers. neurips.cc/paper/2017/hash/4a8423d5e91fda00bb7e46540e2b0cf1-Abstract.html

work page 2017

[7] [7]

Scott Stornetta

Stuart Haber and W. Scott Stornetta. How to time-stamp a digital document.Journal of Cryptology, 3(2):99–111, 1991. doi: 10.1007/BF00196791

doi:10.1007/bf00196791 1991

[8] [8]

EverMemOS: A self-organizing memory operating system for structured long-horizon reasoning

Chuanrui Hu, Xingze Gao, Zuyi Zhou, Dannong Xu, Yi Bai, Xintong Li, Hui Zhang, Tong Li, Chong Zhang, Lidong Bing, and Yafeng Deng. EverMemOS: A self-organizing memory operating system for structured long-horizon reasoning. InProceedings of the 64th Annual Meeting of the Association for Computational Linguistics, pages 45836–45853, 2026. doi: 10.18653/v1/2...

work page doi:10.18653/v1/2026.acl-long.2125 2026