Governed Shared Memory for Multi-Agent LLM Systems

1 Introduction

• Multi-agent shared memory must resolve access, disagreement, safe propagation, writer traceability, and stale-state invalidation.These requirements are distributed-systems and database-consistency questions, not retrieval-quality questions.Source: §1 · p. 1
• Single-agent memory systems commonly optimize relevance, conversational recall, long-context compression, and semantic similarity, leaving additional governance requirements for fleet deployments.The paper argues that fleet-scale memory requires scoped visibility, policy enforcement, temporal correctness, synchronization semantics, and provenance guarantees.Source: §1 · p. 1

1.1 Contributions

• The paper identifies unauthorized leakage, stale propagation, contradiction persistence, and provenance collapse as four fleet-memory failure modes.It frames shared memory as governed operational state with scope, provenance, and temporal supersession.Source: §1.1 · pp. 1–2
• The paper proposes scoped retrieval, temporal contradiction resolution, provenance tracking, and policy-governed propagation as core architecture primitives.MemClaw implements the architecture, while ArgusFleet probes the primitives through a live REST API.Source: §1.1 · p. 2
• Live-service measurement found complete provenance reconstruction and correct measured propagation, while exposing a remediated sub-tenant scope gap and a deduplication-versus-contradiction pipeline conflict.Figure 1 maps the four governance dimensions to ArgusFleet probes; stale propagation is assessed through both contradiction supersession and propagation latency.Source: §1.1 · p. 2, Figure 1 · p. 2

2.1 Long-Context Retrieval

• Long-context and retrieval-augmented methods improve access to relevant history [10] [9], but do not by themselves provide scoped access, temporal consistency, provenance, or synchronization.The paper distinguishes recall within an isolated interaction from governance in multi-agent deployments.Source: §2.1 · p. 2

2.2 Agent Memory Systems

• Shared-memory systems including G-Memory [23], MIRIX [20], and Collaborative Memory [15] address multi-agent memory or governance, but the paper says they do not make temporal supersession first-class or measure enforcement against a live service.The paper presents its contribution as unifying five components under one formalism, with temporal supersession explicit.Source: §2.2 · p. 3

2.3 Distributed Systems and Shared State

• The paper relates production AI memory to distributed databases, event-sourcing and weakly-connected replicated stores, synchronization layers, and governance middleware.This framing treats shared memory as operational state rather than only a retrieval index.Source: §2.3 · p. 3

2.4 Memory Governance, Security, and Privacy

• Security and privacy work frames memory as an attack surface and motivates scoped retrieval, policy enforcement, provenance, and appropriate information flow.The paper links unauthorized leakage to the confused-deputy problem: a read handler resolves a memory but ignores caller identity.Source: §2.4 · p. 3

3 The Fleet-Memory Problem

• Fleet-scale memory must address which agents may retrieve which memories, how contradictory writes are handled, how stale memories are superseded, and how facts propagate safely.These are distributed-systems questions rather than retrieval questions.Source: §3 · p. 3

3.1 Fleet-Memory Systems

• Fleet-memory systems are defined by requirements including governance, temporal correctness, synchronization, provenance, scoped visibility, and policy-aware retrieval.The central challenge is maintaining operationally correct shared state, not merely retrieving semantically relevant information.Source: §3 · p. 3, §3.1 · p. 4

3.2 Memory Operations

• Writes are state transitions that may supersede, invalidate, restrict, or contradict prior memory, so retrieval must incorporate governance and temporal semantics alongside relevance.The operations are presented as shared operational infrastructure rather than passive conversational artifacts.Source: §3.2 · p. 4
• A retrieval is scope-sound when no agent receives a memory its identity is not entitled to under that row’s scope.The authorization predicate covers nested agent, fleet, and tenant scopes.Source: §3.2 · p. 4

4 Fleet-Memory Failure Modes

• The paper identifies unauthorized leakage, stale propagation, contradiction persistence, and provenance collapse as four primary fleet-memory failure classes.They describe failures of scope, synchronization, conflict resolution, and traceability in shared memory.Source: §4 · p. 4

4.1 Unauthorized Leakage

• Unauthorized leakage occurs when an agent retrieves memory outside its authorized scope, creating privacy, tenant-isolation, compliance, and operational risks.The paper notes that semantic-similarity-driven retrieval is especially vulnerable without explicit policy enforcement.Source: §4.1 · p. 4

4.2 Stale Propagation

• Stale propagation occurs when memory updates fail to synchronize correctly across agents, producing inconsistent workflows and potentially contradictory actions.The eventual-consistency window between write and read becomes part of the system’s latency budget.Source: §4.2 · p. 5

4.3 Contradiction Persistence

• Contradiction persistence occurs when conflicting memories coexist without resolution, leaving downstream agents without a principled way to choose between them.Append-only retrieval systems may lack explicit supersession semantics, allowing outdated or contradictory memories to persist.Source: §4.3 · p. 5

4.4 Provenance Collapse

• Provenance collapse occurs when retrieved memories cannot be traced to their origin, weakening debugging, auditability, and verifiable governance.Without provenance, the system can show that a fact is present but not how it entered the store.Source: §4.4 · p. 5

5.1 Design Principles

• The listed design principles include policy-governed propagation and persistent shared state.Source: §5.1 · p. 5

5.2 Memory Scopes

• The architecture defines four memory scopes, but the supplied passage does not specify their names or operational distinctions.Source: §5.2 · p. 5

5.5 Policy-Governed Retrieval

• Retrieval eligibility requires governance-policy checks in addition to semantic similarity, unlike traditional vector retrieval based on similarity alone.Source: §5.2 · p. 5, §5.5 · p. 5

5.3 Temporal Resolution

• Contradictory writes are resolved through temporal ordering and policy-aware rules rather than silently coexisting in an append-only store.Memory objects carry creation timestamps, optional supersession references, contradiction markers, provenance metadata, and confidence state.Source: §5.3 · p. 5

5.4 Provenance Graph

• Memory objects record writer identity, source system, derivation history, and modification lineage to support auditability, debugging, traceability, and compliance verification.Source: §5.4 · p. 5

6.2 ArgusFleet

• ArgusFleet exercises the architectural primitives against MemClaw or any wire-compatible implementation through four experiments and a reproducible reporting pipeline.Its event traces, summaries, and figures derive from a canonical event stream; seeded plans use run-unique content to avoid collisions against accumulated service state.Source: §6 · p. 6, §6.2 · p. 6

6.1 MemClaw

• MemClaw stores tenant and fleet identifiers, writing agent, visibility scope, status, and supersession links, and its gateway injects authenticated agent identity while enforcing tenant boundaries.The credential record binds credential kind; client-supplied X-Agent-ID values are stripped before handlers execute.Source: §6.1 · p. 6

6.2 ArgusFleet

• ArgusFleet models scope and observed policy outcomes with typed records while leaving experiment events as dictionaries, allowing the harness to target alternative governed-memory implementations.Translation to the MemClaw wire schema is delegated to the async client.Source: §6.2 · p. 6

7 Evaluation Methodology

• Each experiment materializes a deterministic plan, writes to the live service, allows asynchronous enrichment to settle, and checks observed behavior against plan-derived ground truth.Source: §7 · p. 6

7.1 Leakage Experiment

• The leakage experiment probes fleet- and agent-scoped secrets across four fleets, distinguishing unauthorized returns from failures to return entitled rows.A focused agent-credential test checks whether trust-1 cross-fleet GET requests are denied under the documented trust ladder.Source: §7.1 · pp. 6–7

7.2 Contradiction Experiment

• The contradiction experiment tests sequential and concurrent writes that share a subject and predicate but assert different values, then checks supersession, active-row multiplicity, and write latency.Detection is assessed after settling via GET-by-id; the structural detector applies only to predicates treated as single-valued.Source: §7.2 · p. 7

7.3 Provenance Experiment

• The provenance experiment reconstructs 50 planned depth-four derivation chains from leaf to root and grades ancestor reachability, writer accuracy, and chain-depth fidelity.Source: §7.3 · p. 7

7.4 Propagation Experiment

• The propagation experiment separates fleet-visibility rate measurement from write-to-visible timing to avoid measuring harness scheduling as server lag.It also redistributes a deterministic subset of facts and re-fetches rows to verify the target agent assignment.Source: §7.4 · pp. 7–8

8.1 Leakage

• At measurement time, trust-1 agent-scoped GET-by-id requests could retrieve cross-fleet rows; after remediation, trust-1 cross-fleet reads were denied in 0/36 probes and trust-2 reads admitted in 36/36.Tenant-key exposure was 164/164 = 1.000 under tenant-wide authority; semantic search had search_leak_rate = 72/164 = 0.439 and search_miss_rate = 4/28 = 0.143.Source: Table 3 · p. 8, §8.1 · p. 8

8.2 Provenance

• All 50 depth-four provenance chains reconstructed with completeness, writer-identity accuracy, and depth-fidelity each at 1.00; per-fetch p50 was 291 ms and p95 was 491 ms.The client was throttled to 8 writes/second beneath the server’s 10-per-second ceiling to avoid rate-limited intermediate writes.Source: §8.2 · p. 10, Figure 4 · p. 10

8.3 Propagation

• Fleet-sibling visibility was 117/120 = 0.975, with zero cross-fleet leaks across 80 probes (leak_rate = 0/80); the three misses reflected retrieval recall.The misses occurred when canaries ranked below top-k under embedding-similarity search, rather than from propagation failure.Source: §8.3 · p. 10, Figure 5 · p. 10
• Under write_mode = strong, all 8 dedicated facts appeared on the first search, with median time-to-visible of 0.83 s and a max of 1.97 s.Strong-mode enrichment is synchronous, so its cost is paid in write latency; the separate tight-polling phase avoids scheduling inflation in batched probe-drain measurements.Source: §8.3 · p. 10, Figure 6 · p. 11

8.4 Contradiction

• Conditional on both contradictory writes being admitted, supersession succeeded in 90/90 cases and was established within approximately 6 seconds; the detector runs post-commit and asynchronously.The structural detector runs only for predicates treated as single-valued, and outcomes were verified by post-settle re-fetch.Source: §8.4 · p. 11
• Overall contradiction detection_rate was 98/200 = 0.490 because the synchronous dedup gate rejected 206/400 writes before they reached the detector.The study could not cleanly separate genuine deduplication of near-identical contradictions from limited prose diversity in the workload.Source: §8.4 · p. 11
• Strong-mode write latency had p50 1,840 ms and p95 4,861 ms across completed contradiction-experiment writes; asynchronous contradiction detection added nothing to this synchronous latency.The heavier tail was attributed to queueing when more writes contended for the synchronous pipeline.Source: §8.4 · p. 11, Figure 7 · p. 11

9.1 Scope Enforcement Was Bimodal (GET-Path Gap Remediated)

• Tenant isolation held, but GET-by-id initially ignored fleet/agent scope; remediation later yielded 0/96 total leaks, including 0/36 trust-1 cross-fleet reads.Source: §9.1 · p. 12

9.2 Deduplication Starves Contradiction Detection

• When both writes were admitted, supersession succeeded 90/90, but synchronous near-duplicate rejection could block contradictory writes before the asynchronous detector ran.Source: §9.2 · p. 12

9.3 Cross-Agent Propagation Is Privilege-Gated

• Redistribution requires trust_level ≥3, although the authors argue sibling propagation should share fleet-write trust and reserve higher trust for re-homing.Source: §9.3 · p. 12

9.4 The Consistency Cost Is Paid at Write Time, Not Read Time

• Under strong mode, sibling visibility followed the first search at p50 ≈0.8 s, while synchronous enrichment shifted consistency cost to writes; under load, write-latency p99 reached 19 s.Source: §9.4 · p. 13
• Decoupled immediate polling is needed: draining probes after seeding can make apparent visibility latency measure client scheduling rather than server behavior.Source: §9.4 · p. 13

• ArgusFleet and MemClaw were built by the same group, so this is an evaluation of the authors’ own service rather than an independent audit.Source: §10 · p. 13
• Scope evidence is narrow: agent-scope probes were focused, cross-tenant isolation was untested, and all measurements came from one freshly provisioned tenant.Source: §10 · p. 13
• Staleness-after-supersession was only partially measured; the stale-read check used semantic search after a 20-second settle.Source: §10 · p. 13
• Experiments used 200 trials, and stronger claims would benefit from ten times more probes constructed adversarially rather than by deterministic plan generation.Source: §10 · p. 13
• Rate-phase probes cannot measure visibility latency; the direct estimate covers eight facts at 250 ms resolution, not sub-250 ms behavior.Source: §10 · pp. 13–14
• The study includes no baseline comparison, leaving its empirical claims without a direct comparison condition.Source: §10 · p. 14

11 Conclusion

• The study implements governed shared-memory primitives in MemClaw and measures them with ArgusFleet against a live service.The evaluation covers governance correctness, contradiction handling, provenance, cross-agent visibility, and retrieval recall as an availability control.Source: §11 · p. 14
• 50/50 provenance chains reconstructed (p50 ≈291 ms per hop at depth four); propagation covered 117/120 intra-fleet probes (0.975), with zero leaks across 80 foreign-fleet probes.Provenance reconstruction followed paced writes below the server’s rate ceiling.Source: §11 · p. 14
• Under strong write mode, write-to-visible p50 was ≈0.8 s (one search round-trip), while write latency reached p99 ≈19 s under sustained contention.The visibility measurement used tight per-fact polling at low load.Source: §11 · p. 14
• Sub-tenant scope was initially unenforced on direct GET-by-id, but the gap was remediated and a re-probe confirmed agent-scoped enforcement.Tenant-level isolation held on every path; sub-tenant scope was only partially enforced on search.Source: §11 · p. 14
• Contradiction supersession was correct for admitted writes (90/90), but synchronous deduplication pre-empted near-identically phrased contradictions; re-homing was also privilege-gated.The dedup gate ran before the asynchronous contradiction detector; re-homing conflated fleet-internal propagation with administrative migration.Source: §11 · p. 14
• The results support treating multi-agent memory as a distributed-systems problem involving consistency windows, identity preservation, pipeline ordering, and propagation privileges.The paper concludes that governed shared memory is a foundational infrastructure layer with measurable consequences for workflows.Source: §11 · p. 14