Governed memory

Governed memory is the working set of durable knowledge an agent may be given at launch. It is the knowledge counterpart to the skill registry: where a skill freezes a reusable behavior, a memory item captures a durable fact, lesson, convention, or preference — and, like everything on the knowledge plane, nothing enters an agent's context without provenance and human review.

Core concepts

• MemoryItem — a workspace-scoped unit of knowledge with a kind (FACT | LESSON | CONVENTION | PREFERENCE | GLOSSARY | PROCEDURE), a bounded title/body, a scope (WORKSPACE | PROJECT | BOARD | AGENT | USER), an optional TTL, and — mandatory — provenance: the sourceKind (DECISION | ARTIFACT | INCIDENT | TASK | COMMENT | PLAYBOOK | DOCUMENT | MESSAGE | MANUAL) and loose sourceId of the entity it came from.
• Provenance is an identity. At most one live item may exist per (workspace, sourceKind, sourceId). Re-nominating the same source converges on that one item instead of duplicating it — enforced at the database by the partial unique index memory_item_live_provenance over the live statuses.
• Selectable ≠ live. Only ACCEPTED_TO_MEMORY items are ever injected into a launch. Candidate and quarantined items are visible (over MCP and in the review UI) but clearly statused and never selected.

The closed lifecycle

A memory item moves only along the edges of a closed state machine. Every transition is named; anything outside the map is unrepresentable in the ops layer — an illegal transition throws before any row is written.

REJECTED, SUPERSEDED, and EXPIRED are terminal — they have no outgoing edge. NOMINATED, ACCEPTED_TO_MEMORY, and QUARANTINED are the live statuses.

Automatic only in the safe direction. No sweep edge ever targets ACCEPTED_TO_MEMORY: the sweep can only ever remove influence (quarantine, supersede, expire), never grant it. Granting influence — promotion and re-acceptance — is always a human action. Agents may propose; only humans promote.

Intake

The first intake path is decisions. Nominating a decision to memory mints (or converges on) a NOMINATED item whose provenance names the decision and flips Decision.memoryStatus to NOMINATED. That status becomes ACCEPTED_TO_MEMORY only in the same transaction that promotes the item — never while it is merely a candidate — so ACCEPTED_TO_MEMORY finally has a real referent, observable only after a human promotes.

Quarantine

When a memory's source is superseded or retracted (for a decision: its status becomes SUPERSEDED or REJECTED), the sweep moves the item ACCEPTED_TO_MEMORY → QUARANTINED, writes an audit row, and drops the decision's memoryStatus back to NOMINATED so it no longer claims acceptance. The item leaves selection immediately and waits for a human to re-accept it. This mirrors the treatment of ingested content, which is quarantined by default until a human accepts it.

Review

The Memory page (/[workspace]/memory) is the review queue: nominated candidates awaiting a promote/reject decision, quarantined items awaiting re-review, and the accepted working set. Promote, re-accept, and reject are ADMIN-only.

Audit

Every transition writes exactly one workspace-scoped activity row (MEMORY_ITEM_NOMINATED / PROMOTED / REACCEPTED / REJECTED / QUARANTINED / SUPERSEDED / EXPIRED), so the closed machine leaves a durable, once-only trail — the same discipline the quality & release plane applies to release and experiment transitions.

MCP surface

Governed memory is read-only over MCP — proposing is separate from influence, and influence is human-gated:

• list_memory — a workspace's memory items (filterable by status and sourceKind, cursor-paginated, newest first). Each row carries its provenance and a selectable flag (true only for ACCEPTED_TO_MEMORY).
• get_memory — one item in full: kind/scope, status + selectable, title/body, provenance, the nominating/promoting actors, review note, supersession lineage, and TTL.