Remember only what earns reuse
Add reusable memory when workflow evidence shows that it helps. ContextOS specifies promotion, consent, provenance, freshness, and contradiction checks before recall. Durable session progress and reusable knowledge serve different purposes; retaining a transcript does not make its contents approved facts or instructions. Current owner, namespace, purpose and reader scope apply before capture and again at recall; confidence or tier cannot grant permission.
Eligible evidence becomes scoped candidates, exact reviewed memory and currently authorized recall, with bounded retention and copy tracking.
- 01Capture
Admit eligible, classified sources under current purpose, access and retention limits.
- 02Extract candidate
Create typed memory proposals with evidence refs.
- 03Review gate
Check consent, contradictions, and review policy.
- 04Promote tier
Route approved memory to working, episodic, semantic, or durable stores.
- 05Compile
Recheck current readers, provenance, expiry and conflicts before supplying promoted memory.
Capture → Promoted
Capture only eligible necessary content with bounded retention. Review the exact candidate scope and provenance before promotion; immutable audit metadata does not justify permanent raw-content storage.
Failure to test
PII leakage and contradiction drift: check actual readers/processors across all nine data stages, keep unresolved conflicts visible and verify correction/deletion receipts for every known derived copy.
Metrics that matter
Recall precision, PII write-back violation rate, contradiction resolution time, correction adoption rate, review-queue throughput.
Memory write proposal
Promotion is governed by class. Each candidate emits a typed write proposal that lands in the review queue with current access, consent and contradiction checks. This constructed legacy MemoryProposal is a candidate, not permission to store or recall. The additive MemoryLifecycleRecord and trusted context bind owned scope, exact review, finite retention and copy-specific propagation. Pending, failed or external unknown deletion is not confirmed erasure.
Your deployment supplies authenticated access, protected atomic stores, actual transformations and copy propagation. Children, reviewers and repair share original spent/reserved capacity; resumed workers need current authority and enforced generation fences. The execution guide assigns these owners; exact profiles require current useful, denial and fault conformance evidence. The reference validates supplied records rather than operating a memory backend.
{
"proposal_id": "mwp_2026_05_04_0931_a17",
"candidate": {
"entity_ceid": "customer:cus_77",
"predicate": "prefers_communication_channel",
"value": "email",
"evidence_refs": ["tool:crm.lookup:tc_212", "session:sess_42f1"],
"confidence": 0.93
},
"class": "preference",
"tier_target": "semantic",
"consent_check": "passed",
"contradiction_check": { "existing": null, "verdict": "no_conflict" },
"auto_promote_eligible": false
}