Write-time integrity · provenance · honest forget

Security model

STRATAM's contribution is not "a longer context window." It is storage-time controls: authorization, provenance, isolation, poison quarantine, and forget reporting that cannot be skipped by a prompt injection at retrieval time.

AU privacy one-pager Report a finding Product profile

Six write-path guarantees

Guarantee	What it means	Mechanism
Write authorization	Unauthorized principals never land a write	AuthContext / TrustBoundary · `may_write`
Memory provenance	Every write/update/tombstone is hash-chained and signed outside the mutable record	ProvenanceLog · content hash · `prov_ref` only on Memory
Tamper evidence	Out-of-band mutation of stored content breaks the chain / content match	`verify_integrity()` · optional AnchorStore
Confidentiality / isolation	Retrieval is server-side scoped — not a prompt-side filter	Enrollment registry · scope isolation
Poison resistance	Low-trust / uncorroborated content is quarantined at rank time	Corroboration gate · trust priors · source class
Verifiable forgetting	Forget is more than deleting a row; product path can crypto-shred DEKs	ForgetResult · ErasureAssurance · cascade on reflections

Memory provenance

The provenance log is a SHA-256 hash chain. Each entry covers the previous head (prev), so rewriting history breaks verification. Records store only a prov_ref index — not the signed metadata itself — so mutating a memory body in place cannot silently re-sign its past.

# Without AnchorStore — bare bool (in-process chain + content hashes only)
ok = fabric.verify_integrity()  # True / False

# With AnchorStore — IntegrityReport
report = fabric.verify_integrity(anchor=store)
# report.chain_ok, report.anchor_ok, report.mode, report.detail
# (no content_ok field; content match is folded into chain_ok)

Attested writes — elevated Source classes bind content via Attestor (jti one-use, optional max_age, revocation epoch).
Registered channels — product path can require tool/webhook channel_id registration.
Audit log — PHI-safe operational events (hashes/ids), separate from content store.

Lab vs product (do not confuse them)

Profile	Security claim
Lab `MemoryFabric()`	None — insecure test cipher + auto-auth Principal
Product `product_fabric(kms_key)`	In-process AES-GCM + require_auth_context + TrustBoundary; IdP/KMS still host-owned

Who owns what

STRATAM (library)	App / VOROR	MLSB
Capability verification; API contracts; isolation; write provenance inputs; lifecycle grouping; temporal correctness; immutable read views; honest erasure/integrity reporting	Identity proofing; KMS/HSM; external anchors; WORM/SIEM; backups/replicas; admission; rate limits; IR	Frozen attack/utility defs; run manifests; independent execution; comparator fairness

Poison, Share, and consolidation

Retrieve poison — corroboration gate quarantines untrusted answers on benign queries (MLSB retrieve resistance).
Share / reflection — consolidation trust is capped at min source trust (no laundering TOOL_ENV into high trust).
Self-writing — recall must not persist the query as durable memory (B1).

Forget honesty (critical for assessors)

A successful forget returns ForgetResult with channels_run and channels_skipped. Under the lab cipher, assurance is typically LOGICAL_ONLY. Product AES-GCM enables stronger shred semantics for in-process envelopes — not automatic GDPR/RTBF of every backup replica.

res = fabric.forget(mem_id, principal)
# res.channels_run: e.g. crypto_shred_record, tombstone_set, substrate_deindex, provenance_tombstone_log
# res.channels_skipped: e.g. offline_backups_and_snapshots, gdpr_certification, external_vector_db_replicas

Group memory and prospective (security extensions)

GM — speaker ≠ writer; audience ACL; spoof/overwrite fail-closed.
PM — owner-bound intentions; no foreign substitution; one-shot due; no resurrection after cancel.
Both are MLSB experimental extensions, not "BEAM-11/12."

Evidence (engineering, not marketing certs)

Security/utility results are pinned evaluation bags (UNIT). Same-lab unless G8-signed independent review — no public score numbers while G8 is unsigned.
Depth exploratory: ability security probes + PM/GM — citable: false
Adversarial pins: tests/test_p0_security_boundary.py, tests/test_security.py

Do not claim: SOC2/HIPAA by default, peer-reviewed leaderboard, or hospital readiness from lab demos alone.