MutMem-V2: Cryptographically Authorized Mutation in Persistent Agent Memory Portable Verification and Reproducible Evidence

1 Introduction

• MutMem V2 makes verification portable by defining explicit object boundaries, byte encodings, trust roots, failure reasons, result cardinality, and terminal states.MutMem is the portable protocol; HOM-AIMOS is one producer and case study, not a second memory engine.Source: §1 · p. 2
• The recall-disclosure envelope contains 13 + 5r objects, with deterministic ordering, exact canonical bytes, and domain-separated SHA-256 commitments.The protocol also defines cross-object authority, identity, request, provenance, occurrence, and terminal-receipt predicates.Source: §1 · p. 2
• The mutation profile preserves the native outcome schema and distinguishes an authorized transition, a signed no-op, and an occurrence observation.The release includes independent verifiers, a production-derived conformance corpus, a clean installer qualification, and reproducible publication evidence.Source: §1 · p. 2

2 Evidence identities and support levels

• Current V2 evidence covers the portable protocol and related verification and installation work, while V1 empirical results remain historical and missing evidence is not treated as success.The paper does not claim semantic truth, universal detection, or independent empirical replication.Source: §2 · p. 2, §1 · p. 2

3.1 Principals and boundary

• The producer uses external trust anchors, identity epochs and revocation, signed authorization, canonical SAVE and RECALL paths, and restricted database-local writers.Ordinary actors and the Housekeeper use distinct authority profiles; the verifier consumes evidence but does not possess producer credentials.Source: §3.1 · p. 3

3.2 Adversary

• The adversary may control transport and alter copied evidence, but the model assumes SHA-256 collision resistance, Ed25519 unforgeability, and an externally obtained master fingerprint and release identity.Replacing both the evidence and all external trust anchors is outside the protocol's protection, as are claims of availability, confidentiality, semantic truth, model honesty, or universal poisoning protection.Source: §3.2 · p. 3

4.1 Canonical objects

• Objects use deterministic canonical JSON, explicit length framing, and domain-separated commitments, while schemas reject unsupported values and oversized or deeply nested bodies.The object commitment binds its kind, schema, and canonical body.Source: §4.1 · p. 3

4.2 Complete membership and deterministic order

• A recall bundle has 13 singleton objects plus five objects per result, with singleton and result objects required in fixed order and complete membership.Duplicate, missing, mixed-subject, or out-of-range objects fail before relational evaluation; ordered descriptors are committed using an RFC 6962 construction.Source: §4.2 · pp. 3–4

4.3 Envelope commitment

• The bundle commitment binds its identifier, company, externally expected master fingerprint, result count, and object root; the fingerprint must not be trusted solely from the bundle.The structural predicate evaluator leaves cryptographic signatures and external trust for independent verifiers to check.Source: §4.3 · p. 4

4.4 Cross-object predicates

• Authority and admission predicates require trust, identity, revocation, authorization, request-time, route, request-body, receipt, nonce, signature, and commitment fields to agree.The signed method and path must be POST and /aimos/recall.Source: §4.4 · p. 4
• Decision, per-result, and terminal predicates bind state roots, return projections, result provenance and occurrence, ordered Merkle entries, and signed terminal-receipt fields.Recall evaluation also requires no canonical-memory or retention mutation.Source: §4.4 · p. 4
• The failure vocabulary is closed, so undeclared reasons are errors and verdict/reason parity can be tested across implementations.New predicates require a new vector and protocol root rather than an unrecorded exception.Source: §4.4 · p. 4

5 Portable mutation profile

• MutMem V2 preserves the native V1 mutation-outcome schema and packages recall commitment, outcome evidence, receipts, events, valence evidence, terminal, and optional cognitive projection in the portable mutation commitment.The commitment uses a versioned mutation domain and canonical body.Source: §5 · p. 4
• An authorized transition binds a principal-state outcome to terminal REWEIGHT provenance and a nontrivial cognitive projection.The verifier reconstructs V1 projection and transition hashes and checks the retained Ed25519 signature and exact signer epoch.Source: §5 · p. 5
• A signed no-op retains the signed outcome without fabricating a projection when quantized weight is unchanged, while an occurrence observation retains occurrence-scoped evidence without weight authority.These complete the three exhaustive mutation terminals.Source: §5 · p. 5

6.1 Two implementations, one terminal language

• Both independent implementations match the expected valid or invalid terminal and exact primary reason across all 72 structural and cryptographic vectors.They share public vectors but not verifier code; the 72-vector count is a conformance denominator, not benchmark accuracy.Source: §6.1 · p. 5

6.2 Production-derived conformance corpus

• All 42 production-derived cases across 28 required classes agree on terminal verdict and protocol reason, establishing conformance for the released corpus.This does not establish retrieval quality or robustness against unrepresented attacks.Source: §6.2 · p. 5

6.3 Complexity and failure closure

• For n = 13 + 5r objects, membership construction and Merkle hashing use O(n) work, while recursive array slices make the current JavaScript reference O(n log n) time in the worst case.The bound also specifies O(n) retained tree state, O(log n) recursion depth, and r ≤200.Source: §6.3 · p. 5

7.1 Verification, installation, and reproduction are different

• Offline verification checks retained artifacts and runs independent Node/Python vector suites without opening AIMOS or a provider; evidence regeneration rebuilds publication tables, the attempt ledger, disclosure boundary, and claim map.Source: §7.1 · p. 5
• Node v26.8.1 qualification completed first boot and restart, registered the required scheduler, retained 8 Guide memories and 0 experimental memories, and capped the ordinary enrolled agent at clearance 10.Source: §7.1 · p. 6
• Full reproduction uses the installer-selected ordinary agent, canonical signed SAVE and RECALL, fixed dataset locks and model roles, complete terminal evidence, and requires nintended = nselected = ncompleted = nevaluated and nincomplete = nfailed = 0.Source: §7.1 · p. 6
• The terminal binds the immutable aggregate path and hash, phase summaries, environment identity, and requested benchmark set, so a stale predecessor cannot replace its completed successor.Source: §7.1 · p. 6

7.2 Datasets, models, and environment

• Public artifacts include corpus manifests, source and target locks, downloaders, and hashes; benchmark text, credentials, provider traffic, memory identifiers, certificates, and machine paths remain outside the evidence boundary.Historical V1 model identities are retained beside their results.Source: §7.2 · p. 6
• Each new run records hardware, software, database, protocol, model, native-surface, concurrency, and timing details, but this descriptive record is not identity or configuration authority.Source: §7.2 · p. 6

8 Statistical contract

• Binary outcomes use x/n and two-sided 95% Wilson intervals; paired discordance uses exact two-sided McNemar values, and Holm adjusts ordered p-values within contrast families.Agreement uses κ from public agreement counts and positive marginals; integers and hashes require exact equality, while derived values use stated numerical tolerances.Source: §8 · p. 6
• The independent verifier reconstructs 44 rate/Wilson rows and 28 McNemar/Holm rows; V1 bootstrap intervals are omitted because private rows are unavailable.Retaining historical point estimates does not claim independent row-level regeneration.Source: §8 · p. 6

9.1 Current V2 results

• Table 1 counts verification units, not benchmark accuracy; exact Node/Python parity and production conformance support portable verification, not utility results from another memory engine.The table separates verification units from empirical accuracy.Source: Table 1 · p. 7, §9.1 · p. 7

9.2 Historical V1 evidence

• Table 2 reports historical V1 results, not current-source reruns; LongMemEval and judged LoCoMo used a canonical-blind protocol, while LoCoMo token F1 must not be averaged with judged accuracy.The token F1 result used a separate deterministic scorer.Source: Table 2 · p. 7, §9.2 · p. 7

9.1 Current V2 results

• 100.0% of marked units were detected (60/60; Wilson lower 93.98%), while 0.0% of clean units were flagged (0/60; Wilson upper 6.02%), supporting explicit-marker traversal only.The 120-unit Canary result is not evidence of arbitrary poison, prompt-injection, or semantic social-engineering detection.Source: §9.1 · p. 7

9.2 Historical V1 evidence

• The historical N=100 PoisonedRAG adaptation reports induced ASR 1/98 (1.02%), clean and attacked accuracy 72.0% and 71.0%, and adverse projections on 500/500 poison versus 4/18808 clean memories (0.0213%).The target fixture and attacker passages were locked, but corpus scope, retriever, and answer model differed from the upstream full-corpus experiment.Source: §9.2 · pp. 7–8
• Table 3 has 100 paired targets per arm; its fixed-corpus ablation attributes selection change to stored signed labels, with no additional A2 change after A1.Active-context withholding was not exercised, so the experiment does not establish behavior on unseen attacks.Source: Table 3 · p. 8, §9.2 · p. 8
• Historical mutation timings cover one complete native transaction, not isolated cryptographic overhead or cross-machine performance; the blinded agreement audit was performed by the system author, not independent human validation.Source: §9.2 · p. 8

10 Attempt accounting and disclosure

• The attempt ledger preserves intended and terminal populations, failures, known retries, exclusions, amendments, and reused artifacts; promoted numerical evidence has equal intended and terminal populations, zero failures, and zero exclusions.Unknown historical retry details remain explicitly unknown, and failed installed-service attempts and a later diagnostic carry no result authority.Source: §10 · p. 8
• The public manifest withholds private V1 rows, provider payloads, restricted dataset text, credentials, certificates, live memories, and identity-bearing receipts, exposing sanitized aggregates, semantic roots, source locks, and non-identifying readiness projections.Source: §10 · p. 8

11 Security argument and non-goals

• Canonical commitments, externally selected trust, epoch and authorization checks, and ordered terminal bindings make object, authority, and disclosure substitutions detectable under stated assumptions.The argument relies on SHA-256 collision resistance and Ed25519 unforgeability.Source: §11 · p. 8
• Tamper evidence does not prevent evidence destruction, establish signed content as true, or guarantee detection of every harmful input.Availability and semantic validation require separate mechanisms and evidence.Source: §11 · p. 8

12 Limitations

• V2 does not rerun utility, mutation-performance, PoisonedRAG, ablation, or human-agreement experiments; those results remain historical V1 evidence.The empirical experiments have not been repeated by an outside team.Source: §12 · p. 9
• V1 fixed-seed bootstrap intervals are omitted because private rows are unavailable, although public counts, Wilson intervals, McNemar/Holm contrasts, and agreement marginals reconstruct.Source: §12 · p. 9
• Canary evidence is marker-specific, while adapted post-calibration PoisonedRAG does not estimate generalization to unseen attacks.Source: §12 · p. 9
• SABER figures are omitted because artifact custody is insufficient for numerical publication.Source: §12 · p. 9
• Installation evidence qualifies one macOS installation on Node v26.8.1; other declared runtimes require release CI.Source: §12 · p. 9
• The threat model requires external anchors, and the archival identifier remains pending acceptance despite mutually bound release identifiers.Source: §12 · p. 9

13 Ethics and responsible release

• The release distributes hashes, manifests, aggregate outcomes, and acquisition instructions rather than restricted benchmark passages or provider payloads.Reproduction must use a fresh installed brain and avoid ingesting benchmark material into ordinary persistent memory.Source: §13 · p. 9
• Operational receipts may expose identity and storage metadata, so they remain outside the public evidence allowlist.Public evidence contains no credentials, private keys, certificates, live memory content, or absolute machine paths.Source: §13 · p. 9

14 Related work

• LongMemEval and LoCoMo measure long-horizon memory utility, while PoisonedRAG studies knowledge-corruption attacks; these works do not supply a portable authorization and evidence profile for post-deployment mutation.MutMem V1 introduced the retained mutation construction and historical system evaluation [1].Source: §14 · p. 9

15 Conclusion

• MutMem V2 makes canonical bytes, evidence boundaries, terminal reasons, independent verification, installation, and publication derivation explicit in an externally anchored protocol.Source: §15 · p. 10
• The result is a stronger reproducibility claim, not a broader security claim; historical V1 findings remain historical, Canary remains marker-specific, and integrity does not establish truth.SABER numerical evidence remains omitted, and verifier independence is not independent empirical replication.Source: §15 · p. 10

• Historical V1 judged accuracy is kept separate from token F1, and single-machine descriptive values are identified as such.Source: A Complete claim-to-evidence disposition · p. 10
• 42/42 cases are reported for the current V2 conformance corpus, not as benchmark efficacy.Source: A Complete claim-to-evidence disposition · p. 11
• The current V2 Canary result is 120/120 for explicit-marker traversal only, not general poison, prompt-injection, or semantic social-engineering detection.Source: A Complete claim-to-evidence disposition · p. 11
• The clean-installer disposition is one qualified installation and restart.Source: A Complete claim-to-evidence disposition · p. 11
• SABER operational numbers are omitted because the exact private artifact is not in verified custody, so no numerical V2 claim is permitted.Source: A Complete claim-to-evidence disposition · p. 11
• Integrity, provenance, authorization, and agreement do not establish semantic truth; fixed-marker and N=100 evidence do not establish universal robustness.Source: A Complete claim-to-evidence disposition · p. 11
• No outside team independently reproduced the system or empirical results.Source: A Complete claim-to-evidence disposition · p. 11

• The appendix lists npm run verify, npm run evidence:regenerate, and npm run paper:verify among its commands.Source: B Verifier and regeneration commands · p. 11
• The first, third, and fourth commands are read-only; the second deterministically rewrites only public evidence projections and checks their bytes afterward.Source: B Verifier and regeneration commands · p. 11
• No command in the appendix runs a benchmark.Source: B Verifier and regeneration commands · p. 11