feat: strengthen memory governance, provenance, and diagnostics

[AlexStocks]

Background

The governance, provenance, and audit papers collected under agent-memory 第 07 篇：治理溯源审计篇 suggest that PowerContext should make authorization, provenance, validity, conflict handling, and diagnostics explicit across the full path from retrieval to model context.

PowerContext already has immutable Artifact revisions, Memory entry versions with source/artifact references, Scope context references, Access Control with Principal/resource/policy-revision/audit support, prepared-context exact origins, OpenTelemetry spans, and the recall-sufficiency gate. This issue tracks the remaining work without changing the meaning of scope_id or turning every Artifact Family into one implementation.

Phase 1: authorization before context and diagnosable recall

Priority: implement first.

• Enforce an authorization-before-context invariant: a Memory entry, Artifact revision, or other family item must be authorized before it can enter search/expand results used by prepare_context, final selection, or the model prompt.
• Cover Memory entry selectors as well as family-level Artifact resources; do not treat Scope membership as an ACL substitute.
• Fail closed in enforced mode when the Principal, authorization provider, provider capability, or complete resource filter is unavailable.
• Preserve exact prepared-context origins and make them agree with the authorized items actually delivered.
• Unify the internal diagnostic trace for retrieval and context assembly: candidate counts/identities, retrieved/admitted/rejected aggregates, rerank and fallback state, budget/selection/omission counts, policy revision, and latency attribution.
• Keep diagnostics low sensitivity: never record Memory/Source body, prompt text, or embedding vectors; use stable identifiers and aggregates only.
• Add focused and end-to-end regressions for unauthorized retrieval/context leakage, revoked access, unavailable authorization, exact origins, budget selection, and diagnostic redaction.

Phase 1 acceptance:

• Unauthorized resources cannot affect prepared context or model-facing output.
• Enforced-mode authorization failures are observable and fail closed.
• A bounded trace explains recall and selection decisions without exposing evidence content.
• Existing HTTP response compatibility is preserved unless a separate RFC approves a contract change.

Phase 2: long-horizon safety and validity verification

• Add Emergence World-style long-chain tests for indirect prompt injection, error propagation, private-memory leakage, revocation, isolation, and recovery across Source, Memory, Context, and Action.
• Add controlled Grounding Agent Memory validity checks at Candidate/Work/TaskCheck boundaries.
• Prefer deterministic evidence such as Git state, Source revision, TaskOutcome, and TaskCheck; distinguish confirmed, mismatch, not_checked, and unavailable.
• Keep validity checks bounded and do not give Memory Core arbitrary filesystem, database, or network probes.

Phase 3: conflict governance and Family conformance

• Add explicit review states for no-op, exact duplicate, revision, semantic conflict, and rejected; conflicts must not be silently overwritten.
• Require source attribution for state changes and preserve the immutable revision/history model.
• Define a Family conformance matrix/checklist covering authority, scope, mutability, provenance, recoverability, and actionability.
• Reuse AIM's audience-before-context and multi-user evaluation principles without introducing an LLM operation classifier or collapsing the model into a global private/public flag.
• Evaluate full MELD/CRDT or authenticated-patch designs only as a separately approved follow-up; do not include them in the initial implementation.

Non-goals

• No full CRDT or multi-primary synchronization in this issue.
• No generic environment probe API for arbitrary filesystems, databases, or networks.
• No change to scope_id business-isolation semantics.
• No LLM operation classifier.
• No claim that rank-only reranking expands candidate recall.
• No new persistent audit table unless the existing tracing/diagnostic boundary proves insufficient.
• No broad Family base-class rewrite.

Existing design references

• RFC 1396: Handoff access control
• RFC 1458: Access control follow-up
• RFC 1489: Prepared context text assembly
• RFC 0014: Memory layer design
• Relevant implementation areas: server/authz, builtin/runtime/prepared_context.py, builtin/runtime/recall_sufficiency.py, builtin/runtime/application.py, and server/tracing.py.

The three directions from the prior conclusion map to the phases as follows: authorization and diagnosable recall are Phase 1; long-horizon safety and validity are Phase 2; conflict governance and unified Family constraints are Phase 3.

[dariusbrandon880-art]

This maps closely to a problem we’ve been working through in SAGE: keeping durable agent state distinct from current authoritative state, and requiring verification before remembered state is allowed to influence action.

The explicit authorization-before-context invariant, exact provenance, fail-closed behavior, and deterministic validity checks are especially interesting. We’ve found the same architectural pressure around rehydration: a prior session can provide useful continuity, but continuity must not silently become authority when repository/runtime truth has changed.

The distinction between confirmed, mismatch, not_checked, and unavailable is also useful because it prevents “memory exists” from being treated as “memory is current.”

Interested in comparing notes on the boundary between retrieval, verification, and model-facing context assembly.