MutMem-V2: Cryptographically Authorized Mutation in Persistent Agent Memory Portable Verification and Reproducible Evidence

MutMem V2: Cryptographically Authorized Mutation in Persistent Agent Memory Portable Verification and Reproducible Evidence Walid Saidi Independent researcher

arXiv:2609.01235v1 [cs.CR] 1 Sep 2026

Evidence-audited manuscript candidate, September 2026 Reproducibility and release status. Repository: https://github.com/wallidsaydi- creator/HOM- AIMOS. Published predecessor: arXiv:2608.02843. The evidence source commit is eb0166fd45964ebb47ca053bcfeb0ab3ddc68999, and the closed publication-evidence root is 99bed29dcf0cc5c2f597f17b69be8d6dc990bae4ae5dd30838a1d1f34d92a76b. The public release is https://github.com/wallidsaydi-creator/HOM-AIMOS/releases/tag/v1.0.0, immutable tag v1.0.0, commit fcda26d1e05c729185c09dd11446db2f79c14a0d, with source-manifest root f0cdb75763c70ce83bfd1e5f 6c956e7502b65a812c3a43f311f8039ba0c3b7f1. Offline verification is exactly npm run verify; deterministic evidence regeneration is exactly npm run evidence:regenerate. For an ordinary agent identifier stored in shell variable AGENT_ID after installer onboarding, the exact multi-line utility reproduction command is: npm run reproduce -- --installed-instance canonical \ --agent-id "$AGENT_ID" --full --benchmark both \ --protocol canonical-blind-v1 Source code is AGPL-3.0-or-later. The repository license applies to AIMOS-authored artifact files. Dataset text is not redistributed; downloaded materials retain upstream licenses. Historical V1 utility used GPT-5.4 for generation and GPT-5.6 Terra for judgment; the historical poisoning lane used GPT-5.5 and GPT-5.6 Terra. Provider access is operator-authenticated, and no credential or provider payload is released. Highest support level: the protocol and evidence are independently verifiable, and one clean installation is qualified; the empirical findings have not been independently replicated. The immutable public tag, release commit, GitHub Release, and source-manifest root are mutually bound. This manuscript is publication-authorized for arXiv submission; the arXiv identifier is necessarily recorded after submission acceptance. Abstract MutMem V1, published as “MutMem: Cryptographically Authorized Mutation in Persistent Agent Memory,” introduced retention-preserving, cryptographically authorized mutation for persistent agent memory and reported utility, mutation-integrity, and targeted-poisoning results. Its principal publication gap was not another retrieval mechanism: it was the absence of a complete portable verification contract and a reviewer-facing path from a clean installation to independently checkable evidence. MutMem V2 closes that gap without creating a second memory engine. It specifies exact canonical bytes, domain-separated object and bundle commitments, mandatory recall-evidence membership and order, external trust anchors, identity epochs, revocation state, authorization, request receipts, ordered disclosure, and three mutation terminals. The current protocol contains 18 versioned object schemas, 39 recall predicate vectors, 15 mutation vectors, and 37 closed recall failure reasons. Independent Node and Python implementations agree on verdict and primary reason for all 72 structural and cryptographic terminals; a separate production-conformance corpus agrees on 42/42 cases spanning 28 required classes. A clean Node v26.8.1 installation reaches first-boot, restart, and scheduler readiness with no experimental memories. A separately scoped Canary experiment completes 120 explicit-marker and clean units; it is evidence of declared marker traversal only. Every public table is regenerated from a self-hashed aggregate, and an independent verifier reconstructs its statistics and claim boundaries. Historical V1 empirical results remain historical rather than being relabeled as V2 reruns. MutMem V2 supports claims about portable integrity, authorization, traceability, conformance, and reproducibility under stated assumptions. It does not establish semantic truth, universal robustness, or independent replication.

1

1

Introduction

Persistent memory creates two separable research problems. The first is how an agent may adapt retained evidence while preserving authorship, prior state, and the reason for change. MutMem V1 addressed that problem with append-only outcome evidence, bounded bidirectional weight transitions, signed provenance, and ordered recall receipts [1]. The second problem is how a reviewer can verify those claims without trusting the production database, its runtime, or a prose description of the system. A self-consistent implementation is not yet a portable protocol: its object boundaries, byte encodings, trust roots, failure reasons, result cardinality, and terminal states must be explicit. MutMem V2 addresses the second problem. MutMem denotes the portable protocol; HOM-AIMOS is one producer and case study. The portable verifier does not select memories, authorize requests, sign events, mutate storage, or operate a second runtime. It consumes finite evidence objects and returns a deterministic terminal verdict. [V2-PORTABLE-PROTOCOL]

The paper makes four contributions: 1. It defines a versioned recall-disclosure envelope whose complete membership is 13 + 5r objects for r disclosed results, with deterministic ordering, exact canonical bytes, and domain-separated SHA-256 commitments. 2. It defines cross-object predicates for external trust, actor and Housekeeper epochs, revocation, effective authorization, signed request and receipt parity, native decision bindings, per-result provenance and occurrence evidence, Merkle order, and signed terminal receipts. 3. It defines a portable mutation profile that preserves the native outcome schema and distinguishes an authorized transition, a signed no-op, and an occurrence observation. 4. It supplies independent Node and Python verifiers, a production-derived conformance corpus, a clean installer qualification, deterministic publication regeneration, an attempt ledger, and a complete claim-to-evidence map. The contribution is deliberately narrower than “secure memory.” Cryptographic integrity does not imply that remembered content is true. A fixed poisoning experiment does not imply universal detection. Exact verifier parity does not imply independent empirical replication. These are protocol boundaries, not disclaimers added after observing results. [CONTENT-TRUTH] [UNIVERSAL-DEFENSE][INDEPENDENT-REPLICATION]

2

Evidence identities and support levels

We use three non-interchangeable evidence labels: • current V2 denotes evidence produced or reverified for the portable V2 protocol, independent verifiers, conformance corpus, explicit-marker Canary lane, or clean installer. • historical V1 denotes immutable empirical evidence released with MutMem V1. It may be cited as a historical comparator but is not a current V2 benchmark run. • boundary denotes an omitted or prohibited claim. Missing evidence is never converted into a zero, success, or defense. The manuscript binds the claim map 4d8d23442e9ed311e33ddd9ce9a79e878642eba93329c460e203128e54997527 and independent verification f38268c86f2291971ac6ab75ded944d9a7e7eb6fa2809a5367d69dacd450ffe0. The claim map names the code, protocol, artifact, verifier, denominator, and limitation for every quantitative or security statement. The evidence package contains 7 deterministic files including its manifest; the manuscript assets are generated separately from that root.

2

3

System and threat model

3.1

Principals and boundary

The production producer has an external master trust anchor, an ordinary actor or the Housekeeper system principal, append-only identity epochs and revocation state, a signed authorization projection, a canonical SAVE path, a canonical RECALL path, and restricted database-local writers. The portable verifier is an evidence consumer. It neither possesses producer credentials nor infers a trust root from the bundle it is asked to verify. For ordinary actors, the evidence bundle must bind the exact company, actor identifier, identity epoch, certificate fingerprint, unrevoked state, effective grant, requested clearance, data class, method, path, canonical request body, nonce, and signing time. For the Housekeeper, the system-principal profile is structurally distinct from a mastersigned ordinary grant; signature-bearing grant fields are forbidden in that profile. This separation prevents a system principal from masquerading as an ordinary master-signed grant and prevents an ordinary identity from inheriting Housekeeper authority.

3.2

Adversary

The verifier is designed to detect malformed canonical objects, object or bundle substitution, wrong trust roots, identity or epoch substitution, stale or revoked authority, request replay or route mismatch, result omission or reordering, provenance and occurrence substitution, Merkle mismatch, terminal-receipt drift, and mutation-topology inconsistency. The adversary may control transport and may modify copied evidence. The adversary may not break SHA-256 collision resistance or Ed25519 existential unforgeability, and the reviewer must obtain the expected master fingerprint and release identity through an external channel. An attacker who replaces both the evidence and every external trust anchor can present a different self-consistent world. MutMem does not solve that anchor distribution problem. It also does not prove availability, confidentiality, semantic truth, model honesty, or protection against every form of memory poisoning.

4

Portable recall-disclosure protocol

4.1

Canonical objects

Let H = SHA256, let J(x) be the protocol’s deterministic canonical-JSON bytes, let LP4 (x) prepend the unsigned four-byte big-endian byte length of UTF-8 string x, and let BEk (x) encode integer x in k big-endian bytes. Every variable-length field is either canonical JSON or explicitly length-framed. The object domain Do is the UTF-8 byte string hom.aimos.mutmem-portable-object/v2 followed by a zero byte. For kind kj , schema sj , and body bj , the object commitment is oj = H(Do ∥ LP4 (kj ) ∥ LP4 (sj ) ∥ BE4 (|J(bj )|) ∥ J(bj )) .

(1)

Bodies reject unsupported or non-finite numbers, unsafe integers, nesting beyond the protocol limit, and bodies larger than the declared maximum. Object schemas are exact, not advisory labels. These choices follow the prefix-free framing and domain-separation discipline used in cryptographic protocol design [6] and the deterministic JSON discipline standardized by JCS [5].

4.2

Complete membership and deterministic order

Each recall bundle contains thirteen singleton objects: trust anchor; actor identity and revocation; Housekeeper identity and revocation; effective grant; request envelope; request receipt; content-state decision; epistemic decision; final security closure; return projection; and native recall receipt. Each disclosed result contributes five objects: memory state, provenance chain, occurrence, epistemic projection, and receipt evidence. Therefore, for r results, Nobjects (r) = 13 + 5r,

3

0 ≤ r ≤ 200.

(2)

Every singleton kind occurs exactly once. Every result ordinal from 0 through r − 1 contains all five result kinds and one subject identifier shared across the group. Objects are ordered first by the fixed singleton order and then by result ordinal and fixed result-kind order. Duplicate, missing, mixed-subject, or out-of-range objects fail before relational evaluation. The ordered object descriptors are committed with the RFC 6962 construction [3]. If xi denotes canonical bytes for descriptor i, Li = H(0x00 ∥ xi ),

(3)

T (a, b) = H(0x01 ∥ a ∥ b),

(4)

with an empty root H(ϵ) and recursive split at the largest power of two strictly smaller than the current list length. Leaf/node domain separation prevents a node encoding from being confused with a leaf encoding under the hash assumption.

4.3

Envelope commitment

Let Db be hom.aimos.mutmem-portable-evidence/v2 followed by a zero byte, u the bundle identifier, c the company identifier, f the externally expected 32-byte master fingerprint, r the result count, and R the object root. The bundle commitment is B = H(Db ∥ LP4 (u) ∥ LP4 (c) ∥ f ∥ BE8 (r) ∥ R) .

(5)

The master fingerprint is an input to verification; accepting the fingerprint solely because it appears inside the bundle would be circular trust. The structural predicate evaluator therefore reports that cryptographic signatures and external trust remain unverified. Independent verifiers must check them.

4.4

Cross-object predicates

The recall predicate graph enforces exact equality across five boundaries: 1. Authority: trust anchor, actor epoch, certificate, revocation, Housekeeper epoch, authorization, and request time agree. 2. Admission: signed method and path are POST and /aimos/recall; request-body, normalized-command, request-receipt, nonce, signature, and authorization mutation commitments agree. 3. Decision composition: content-state roots, epistemic decision, final security closure, return path, projected identifiers, and content hashes agree, with no canonical-memory or retention mutation. 4. Per-result evidence: memory, provenance, occurrence, epistemic, and receipt objects agree on subject, live-content hash, save and binding mutations, occurrence reference, ordinal, and selected membership. 5. Terminal receipt: Merkle entries, root, result count, actor, request, authority, Housekeeper certificate, event content hash, predecessor, nonce, signing time, signature, and revocation evaluation agree. The failure vocabulary is closed: an undeclared failure reason is itself an error. This makes verdict/reason parity testable across implementations instead of permitting semantically similar but incomparable exceptions.

5

Portable mutation profile

MutMem V2 does not introduce a new cognitive update rule. It preserves the native V1 mutation-outcome schema and makes its evidence portable. Let Dµ be hom.aimos.mutmem-portable-mutation-evidence/v2 followed by a zero byte, and let M be the canonical body containing the recall commitment, outcome evidence, recall receipt, outcome event, signed valence evidence, terminal, and optional cognitive projection. The portable mutation commitment is 4

Bµ = H(Dµ ∥ J(M )).

(6)

Three terminals are exhaustive: • authorized_transition: a principal-state outcome binds a terminal REWEIGHT provenance node and a nontrivial cognitive projection; • signed_noop: the signed outcome is retained, but no projection is fabricated when the quantized weight is unchanged; and • occurrence_observation: occurrence-scoped evidence is retained with no weight authority. For an authorized transition, the verifier reconstructs the V1 projection and transition hashes from the memory identifier, integer milliscale old/new weights, provenance mutation, predecessor projection, and company. It requires the retained Ed25519 signature and exact signer epoch; Ed25519 itself is a standard primitive, not a MutMem contribution [4]. [V1-MUTATION-INTEGRITY]

6

Independent verification

6.1

Two implementations, one terminal language

The production-language reference and independent Python implementation consume the same public vectors but do not share verifier code. Four lanes cover recall structure, mutation structure, recall cryptography, and mutation cryptography. Across all 72 vectors, both implementations match the expected valid/invalid terminal and exact primary reason. This count is not a benchmark accuracy denominator: it is a conformance denominator. [V2-INDEPENDENT-VERIFIER]

The structural vector sets contain valid bundles and one negative vector for each declared recall or mutation failure family. Cryptographic vectors add signature, certificate, epoch, revocation, and trust-anchor checks. The verification implementation is read-only and has no runtime importer, database, network, signing, model, or policy authority.

6.2

Production-derived conformance corpus

A separate corpus projects production-shaped recall evidence into public test objects and evaluates it with the production protocol owners and an independent verifier. All 42 intended cases are observed, cover 28 required classes, and agree on terminal verdict and protocol reason. This establishes production/protocol conformance for the released corpus. It does not establish retrieval quality or robustness against unrepresented attacks. [V2-PRODUCTION-CONFORMANCE]

6.3

Complexity and failure closure

For n = 13 + 5r objects, membership construction uses maps keyed by singleton kind and result ordinal, then performs one fixed-order traversal in O(n) time. The Merkle tree contains n leaf hashes and n − 1 internal hashes, hence O(n) hash evaluations. The current JavaScript reference uses recursive array slices; accounting for those copies gives O(n log n) implementation time in the worst case, O(n) retained tree state, and O(log n) recursion depth, with r ≤ 200. This bound is preferable to describing the hash-node count as the complete runtime cost. The failure language is finite and versioned; new predicates require a new vector and protocol root rather than an unrecorded exception.

7

Reproducibility architecture

7.1

Verification, installation, and reproduction are different

The offline verification command checks retained public artifacts and executes the independent Node/Python vector suites without opening AIMOS or a provider. Evidence regeneration independently rebuilds publication tables, the attempt ledger, disclosure boundary, and claim map. Neither command writes memory. 5

The installer is a separate product operation. The qualified run used Node v26.8.1, completed first boot and restart, registered the required scheduler, retained 8 Guide memories and 0 experimental memories, and capped the ordinary enrolled agent at clearance 10. This is one clean-install qualification, not cross-platform coverage or a scientific benchmark. [V2-CLEAN-INSTALLER] Full reproduction is intentionally distinct from verification. It uses the installer-selected ordinary agent, canonical signed SAVE and RECALL, fixed dataset locks, fixed model roles, complete terminal evidence, and the integer denominator invariant nintended = nselected = ncompleted = nevaluated ,

nincomplete = nfailed = 0.

(7)

A mutable status flag is insufficient. The terminal binds the selected immutable aggregate path and hash, required phase summaries, environment identity, and the exact requested benchmark set. A stale predecessor cannot be substituted for its completed immutable successor.

7.2

Datasets, models, and environment

The public package carries corpus manifests, source locks, target locks, downloaders, and hashes. It does not redistribute LongMemEval, LoCoMo, Natural Questions/BEIR, or PoisonedRAG text. Historical V1 model identities are retained beside their results. Credentials, provider requests and responses, benchmark text, memory identifiers, certificates, and machine paths are outside the public evidence boundary. Each new run must record operating system, architecture, CPU, memory, Node binary, package and lock hashes, dependency versions, PostgreSQL and extensions, concurrency, protocol configuration, model identities, native surfaces, and start/capture times. This environment record is descriptive evidence, never identity or configuration authority.

8

Statistical contract

For a binary outcome with x successes in n intended units, the estimate is p̂ = x/n. The two-sided 95% Wilson interval uses z = 1.959963984540054: p p̂ + z 2 /(2n) ± z p̂(1 − p̂)/n + z 2 /(4n2 ) . 1 + z 2 /n

(8)

For paired binary outcomes with discordant counts b and c, the exact two-sided McNemar value is  pMcN = min1, 2

min(b,c) 

X

k=0

  b + c −(b+c)  2 . k

(9)

Within each declared family of m contrasts, raw values are ordered p(1) ≤ · · · ≤ p(m) and Holm adjustment is
pe(i) = max min 1, (m − j + 1)p(j) . 1≤j≤i

(10)

Agreement uses κ = (po − pe )/(1 − pe ) from public agreement counts and positive marginals. Integers and hashes require exact equality; derived rates, Wilson intervals, McNemar values, Holm adjustments, and κ use numerical tolerance 10−12 . The historical Canary artifact stores Wilson bounds to eight decimals; comparison to those source bounds uses 5 × 10−9 , while the generated table retains full precision. The independent evidence verifier reconstructs 44 rate/Wilson rows and 28 McNemar/Holm rows. V1 bootstrap intervals are not repeated in V2 tables because their private rows are unavailable; retaining a historical point estimate is not the same as claiming independent row-level regeneration.

6

Table 1: Current MutMem V2 reproducibility and conformance evidence. Counts are verification units, not benchmark accuracy. Evidence family

Verified result

Interpretation

Portable protocol

18 schemas; 39 recall vectors; 15 mutation vectors; 37 recall failure codes 72/72 exact verdict and reason terminals; 10/10 exit criteria 42/42 cases across 28 required classes marked 60/60; clean flags 0/60 Node v26.8.1; first boot, restart, and scheduler ready; 0 experimental memories

Versioned bytes, membership, predicates, and terminal vocabulary

Independent Node/Python verifier Production conformance corpus Canary explicit-marker lane Clean installer qualification

Verifier portability, not empirical utility Production/independent parity Explicit marker traversal only One same-user installed system; no benchmark result

Table 2: Historical MutMem V1 results, reproduced from the self-hashed V1 aggregate. These are not current-source V2 reruns. Protocol and metric

Historical V1 result

Boundary

LongMemEval, LLM-judged accuracy LoCoMo, LLM-judged accuracy

459/500 (91.80%; Wilson 95% CI 89.06–93.90%) 1472/1986 (74.12%; Wilson 95% CI 72.15–76.00%) 58.20

GPT-5.4 generator; GPT-5.6 Terra judge Distinct from token F1

LoCoMo, category-aware token F1 PoisonedRAG adaptation, induced ASR PoisonedRAG adaptation, poison retrieval@5 Mutation integrity Mutation transaction cost Blinded system-author agreement

9

Evidence results

9.1

Current V2 results

1/98 (1.02%) 0/100 (Wilson upper 3.70%) 7/7 authorization; 4/4 tamper cases median 4.865 ms; p95 5.674 ms; 966.35 logical bytes/transition 193/200 (96.5%; κ = 0.9108)

Bootstrap interval omitted in V2: private rows unavailable Baseline-aware effect: clean 2/100; attacked 3/100 Retention plus retrieval isolation, not deletion 20 measured native transitions Single historical machine and full transaction Not independent human validation

Table 1 separates verification units from empirical accuracy. Exact Node/Python parity and production conformance support a portable verifier claim. They do not imply that another memory engine produces the same utility results. The Canary evidence contains 120 terminal units: all 60/60 marked units were detected (100.0%; Wilson lower 93.98%), and 0/60 clean units were flagged (0.0%; Wilson upper 6.02%). This supports only explicit marker traversal across the declared transport cells. It is not evidence of arbitrary poison, prompt-injection, or semantic social-engineering detection. [V2-CANARY]

9.2

Historical V1 evidence

Table 2 is intentionally labeled historical. LongMemEval and judged LoCoMo used the historical canonical-blind protocol; the LoCoMo token F1 result used a separate deterministic scorer and must not be averaged with judged accuracy. [V1-LONGMEMEVAL-UTILITY] [V1-LOCOMO-JUDGED][V1-LOCOMO-F1] The historical N=100 PoisonedRAG result is an adaptation: target fixture and attacker passages were locked, but corpus scope, retriever, and answer model differed from the upstream full-corpus experiment [7]. All poison passages were retained. Retrieval isolation and signed epistemic labels are not save-time rejection, deletion, or proof that content is false. The observed clean target-answer leakage was 2/100, while the attacked target-match rate was 3/100. The baseline-aware attack-attributable result was therefore an induced ASR of 1/98 (1.02%), which is the 7

Table 3: Historical V1 fixed-corpus PoisonedRAG ablation. Each arm contains 100 paired targets. Arm A0 A1 A2 A3

poison retrieval@5

clean accuracy

attacked accuracy

94/100 0/100 0/100 0/100

71.0% 68.0% 68.0% 69.0%

40.0% 65.0% 71.0% 69.0%

effect reported in Table 2. The observed clean and attacked answer accuracies were 72.0% and 71.0%, respectively; all 500/500 poison memories received an adverse signed projection, and 4/18808clean memories did as well (0.0213%). [V1-POISONEDRAG]

The historical fixed-corpus ablation in Table 3 attributes the measured selection change to already-produced signed stored labels. A2 added query-local detection but made no additional selection change after A1; active-context withholding was not exercised. The experiment therefore does not establish how either mechanism behaves on unseen attacks. [V1-EPISTEMIC-ABLATION] The historical mutation measurements cover one complete native transaction, including signatures, provenance, projection, and live-weight update. They are not isolated cryptographic overhead and should not be generalized across machines. [V1-MUTATION-LATENCY-STORAGE] The historical agreement audit was blinded to arm and judge verdict but was performed by the system author. It is an agreement diagnostic, not independent human validation. [V1-HUMAN-AGREEMENT]

10

Attempt accounting and disclosure

The public attempt ledger preserves intended population, terminal population, terminal failures, retries when known, exclusions, amendments, and reused artifacts. Two failed installed-service attempts remain failures with zero result authority. A later one-question diagnostic remains diagnostic only. None appears in a result table, abstract, or comparison. For promoted numerical evidence, intended and terminal populations are equal, with zero terminal failures and zero exclusions. Unknown historical retry details are explicitly unknown, not zero. The public/private manifest withholds private V1 rows, provider payloads, restricted dataset text, credentials and certificates, live memories, and identity-bearing installer receipts. It exposes sanitized aggregates, semantic roots, source locks, and non-identifying readiness projections instead. The SABER-inspired operational figures are omitted because their exact private artifact is not in verified custody; no value from that family appears in this paper. [SABER-OPERATIONAL-NUMBERS]

11

Security argument and non-goals

Commitment substitution. Under collision resistance, changing a canonical object field changes Equation 1, the object root, and Equation 5, except with negligible collision probability. Omitting or duplicating a mandatory object fails Equation 2 before signature verification. Authority substitution. A bundle does not choose its own trusted master. Actor and Housekeeper certificate chains, validity intervals, revocation observations, grant scope, signed request, and terminal event are checked against the externally selected trust anchor. Under Ed25519 unforgeability, altering a signed commitment without the corresponding private key fails signature verification. Ordering and terminal fidelity. Per-result ordinals and fixed kind order enter the Merkle root. The terminal event binds the request, authority, root, evidence list, return projection, and result count. Reordering a valid set or replacing the terminal projection is detectable. These arguments establish tamper evidence under the assumptions. They do not prevent a storage administrator from destroying evidence, prove that signed content is true, or guarantee that every harmful input is detected. Availability and semantic validation require separate mechanisms and evidence.

8

12

Limitations

1. No current V2 utility rerun. Utility, mutation performance, PoisonedRAG, ablation, and human agreement remain historical V1 results. V2 does not relabel them as results of the current source. 2. No independent empirical replication. The verifier implementations are independent, but the empirical experiments have not been repeated by an outside team. 3. Private V1 rows are unavailable. Public counts, Wilson intervals, McNemar/Holm contrasts, and agreement marginals reconstruct. V1 fixed-seed bootstrap intervals do not independently reconstruct and are omitted from V2 tables. 4. Canary scope is marker-specific. Marker traversal is not a general detector for poisoning, prompt injection, or false content. 5. PoisonedRAG is adapted and post-calibration. It does not match the upstream full corpus and does not estimate unseen-attack generalization. 6. SABER figures are omitted. Artifact custody is insufficient for numerical publication. 7. Installation coverage is bounded. One macOS installation on Node v26.8.1 is qualified. Other declared runtimes still require release CI and do not inherit this result automatically. 8. External anchors are necessary. Replacing all evidence and all independent trust anchors is outside the threat model. 9. Archival identifier pending. The immutable source manifest, release commit, tag, and GitHub Release are mutually bound. The arXiv identifier cannot be recorded until submission acceptance.

13

Ethics and responsible release

The poisoning materials contain attacker-crafted misinformation and restricted dataset content. The release distributes hashes, manifests, aggregate outcomes, and acquisition instructions rather than benchmark passages or provider payloads. Reproduction must use a fresh installed brain and must not ingest benchmark material into a user’s ordinary persistent memory. A detected item is retained with signed epistemic evidence; classification is reversible and is not presented as factual adjudication. The verifier’s public failure reasons are designed for audit, but operational receipts may contain identity and storage metadata. Such receipts remain outside the public evidence allowlist. Public evidence contains no credential, private key, certificate, live memory content, or absolute machine path.

14

Related work

Tamper-evident logging uses cryptographic commitments to make history substitution detectable [2]. Certificate Transparency defines the domain-separated Merkle construction used here for ordered evidence [3]. MutMem combines established SHA-256, Ed25519 [4], canonical JSON [5], and length-framed protocol encodings [6]; none of those primitives is claimed as novel. LongMemEval and LoCoMo measure long-horizon memory utility [8, 9]. PoisonedRAG studies knowledge-corruption attacks against retrieval-augmented generation [7]. Those works motivate evaluation but do not by themselves provide a portable authorization and evidence profile for post-deployment memory mutation. MutMem V1 introduced the retained mutation construction and historical system evaluation [1]. V2’s narrower contribution is to make its evidence boundaries, canonical bytes, terminal reasons, independent verification, installation, and publication derivation explicit.

9

15

Conclusion

MutMem V2 turns an implementation-bound integrity claim into a versioned, externally anchored verification protocol. Complete recall and mutation bundles bind canonical objects, cross-object authority, result identity, ordered disclosure, and terminal events. Independent Node and Python implementations agree on the full released terminal corpus, production-derived cases agree with the independent verifier, and one clean installer reaches restart-stable readiness. Publication tables, attempts, omissions, and limitations regenerate from a single evidence root. The result is a stronger reproducibility claim, not a broader security claim. Historical V1 empirical findings remain historical. Canary evidence remains marker-specific. SABER numerical evidence remains omitted. Integrity and authorization remain distinct from truth, and verifier independence remains distinct from independent empirical replication. The public release identity is mutually bound; the archival identifier is recorded after acceptance.

References [1] W. Saidi, “MutMem: Cryptographically Authorized Mutation in Persistent Agent Memory,” arXiv:2608.02843, 2026. [2] S. A. Crosby and D. S. Wallach, “Efficient Data Structures for Tamper-Evident Logging,” 18th USENIX Security Symposium, 2009. [3] B. Laurie, A. Langley, and E. Kasper, “Certificate Transparency,” RFC 6962, 2013. [4] S. Josefsson and I. Liusvaara, “Edwards-Curve Digital Signature Algorithm (EdDSA),” RFC 8032, 2017. [5] A. Rundgren, B. Jordan, and S. Erdtman, “JSON Canonicalization Scheme (JCS),” RFC 8785, 2020. [6] D. Boneh and V. Shoup, A Graduate Course in Applied Cryptography, version 0.6, 2023. [7] W. Zou, R. Geng, B. Wang, and J. Jia, “PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models,” 34th USENIX Security Symposium, 2025. [8] D. Wu, H. Wang, W. Yu, Y. Zhang, K.-W. Chang, and D. Yu, “LongMemEval: Benchmarking Chat Assistants on Long-Term Interactive Memory,” ICLR, 2025. [9] A. Maharana, D.-H. Lee, S. Tulyakov, M. Bansal, F. Barbieri, and Y. Fang, “Evaluating Very Long-Term Conversational Memory of LLM Agents,” ACL, pp. 13851–13870, 2024.

A

Complete claim-to-evidence disposition Table 4: Complete manuscript claim-to-evidence disposition. Claim identifier

Disposition

Denominator

Limitation

V1-LONGMEMEVALUTILITY V1-LOCOMOJUDGED V1-LOCOMO-F1

HISTORICAL V1 HISTORICAL V1 HISTORICAL V1 HISTORICAL V1 HISTORICAL V1 HISTORICAL V1 HISTORICAL V1

459/500

Historical V1 result; model-judged and not a current-source V2 benchmark. Historical V1 judged accuracy; never merged with token F1.

V1-POISONEDRAG V1-EPISTEMICABLATION V1-MUTATIONINTEGRITY V1-MUTATIONLATENCYSTORAGE V1-HUMANAGREEMENT V2-PORTABLEPROTOCOL V2-INDEPENDENTVERIFIER

1472/1986 1986 100 targets 100 paired targets per arm 20 transitions 20 transitions

HISTORICAL V1 CURRENT V2

200 answers 39+15 vectors

CURRENT V2

72 terminal verdicts

10

Point estimate remains in the V1 aggregate; bootstrap interval omitted because private rows are unavailable. Adapted bounded N=100 protocol; no universal or unseen-attack claim. Fixed-corpus causal evidence; query-local contribution was null and withholding was not exercised. Historical retained-memory transition evidence under the V1 threat model. Single-machine descriptive values; row-level inputs are unavailable for independent recomputation. System-author diagnostic, not independent human validation; bootstrap interval omitted. Portable verification protocol, not another memory engine or producer. Cross-language verdict/reason parity proves verifier portability, not empirical utility.

B

Claim identifier

Disposition

Denominator

Limitation

V2-PRODUCTIONCONFORMANCE V2-CANARY

CURRENT V2

42/42

Conformance corpus, not benchmark efficacy.

CURRENT V2

120/120

V2-CLEANINSTALLER

CURRENT V2

SABEROPERATIONALNUMBERS CONTENT-TRUTH

OMITTED

one qualified installation and restart No numerical claim

Explicit marker traversal only; not arbitrary poison, prompt-injection, or semantic social-engineering detection. Reproducibility evidence only; not benchmark evidence.

PROHIBITED

No numerical claim

UNIVERSALDEFENSE INDEPENDENTREPLICATION

PROHIBITED

No numerical claim

PROHIBITED

No numerical claim

Exact private artifact is not in verified custody; no numerical V2 claim is permitted. Integrity, provenance, authorization, and agreement do not establish semantic truth. Fixed marker and N=100 evidence do not establish universal robustness. No outside team independently reproduced the system or empirical results.

Verifier and regeneration commands

npm run verify npm run evidence:regenerate npm run verify npm run paper:verify The first, third, and fourth commands are read-only. The second command deterministically rewrites only the public evidence projections and fails its subsequent byte check if output changes. No command in this appendix runs a benchmark.

11

Related documents

• MutMem-V2: Cryptographically Authorized Mutation in Persistent Agent Memory Portable Verification and Reproducible Evidence#821190
• CVE-2026-89453#781732
• CVE-2026-80946#781636
• CVE-2026-97539#1098257
• CVE-2026-89857 — CRITICAL 9.8#989061