{"slug": "i-built-agent-memory-that-retains-poisoned-data-instead-of-deleting-it", "title": "I built agent memory that retains poisoned data instead of deleting it", "summary": "HOM-AIMOS, a local-first persistent-memory backend for AI agents, retains poisoned data instead of deleting it, using a signed, append-only provenance system that adjusts retrieval weights within [0.1, 3.0] based on signed evidence. The system, built by developer wallidsaydi-creator, includes a housekeeper identity for autonomous maintenance and verifies all weight changes through cryptographic chains, ensuring that no memory is ever deleted but only deprioritized.", "body_md": "HOM-AIMOS is a local-first persistent-memory backend for agents. It combines signed identity, append-only provenance, hybrid retrieval, temporal reasoning, and a housekeeper identity that owns autonomous maintenance without depending on an enrolled user agent.\n\nHOM-AIMOS is a complete persistent-memory backend, not a provenance layer attached to a vector store. Its source-derived architecture binds a 275-service census and declares six critical pipelines containing 146 service connections. Save and recall each expose eight principal native execution boundaries.\n\n| # | Stage | Native owner |\n|---|---|---|\n| 1 | Signed request and authorization | `routes/aimos.js` |\n| 2 | Write validation | `services/write/write-validator.js` |\n| 3 | Prediction-error routing gate | `services/write/rpe-gate.js` |\n| 4 | Mnemonic encoding | `services/context/mnemonic-encoder.js` |\n| 5 | Quality gate | `services/write/quality-gate.js` |\n| 6 | Embedding | `services/core/embeddings.js` |\n| 7 | Canonical persistence and provenance | `services/write/persist-memory.js` |\n| 8 | Signed retained-memory epistemic label | `services/security/memory-epistemic-classifier.js` |\n\n| # | Stage | Native owner |\n|---|---|---|\n| 1 | Query understanding and path selection | `services/retrieval/native-recall-pipeline.js` |\n| 2 | Embedding and candidate opening | `services/core/embeddings.js` |\n| 3 | Similarity statistics | `services/retrieval/similarity-stats.js` |\n| 4 | Trust scoring | `services/learning/trust-score.js` |\n| 5 | Concept-graph retrieval | `services/core/concept-graph.js` |\n| 6 | Verified epistemic projection and selection | `services/retrieval/epistemic-trust-retrieval.js` |\n| 7 | Pre-disclosure calibration | `services/retrieval/recall-calibrator.js` |\n| 8 | Bounded evidence and signed receipt | `services/retrieval/native-recall.js` |\n\nHOM-AIMOS does not treat memory as static after admission. It keeps canonical\ncontent immutable while allowing its retrieval weight to move bidirectionally\nwithin `[0.1, 3.0]`\n\nas signed evidence changes. A low weight means lower\nretrieval frequency, never deletion or ineligibility.\n\nThree native mutation lanes converge on one certified database writer:\n\n- outcome adaptation appends signed positive or negative evidence to\n`services/governance/valence-ledger.js`\n\n, computes an age-neutral cumulative valence through`services/governance/valence-judge.js`\n\n, and applies the bounded reference-point update in`services/learning/stdp-kernel.js`\n\n; - SPICED consolidation may strengthen eligible retained memories through\n`services/dream/spiced-consolidator.js`\n\n; and - optional Hebbian consensus may elevate supported hubs or attenuate divergent\nevidence through\n`services/dream/hebbian-consensus.js`\n\n. This lane is shadow-first and disabled until its signed governor flag is enabled.\n\nEvery changed target passes through\n`services/governance/governor-provenance.js`\n\n, which appends a housekeeper-signed\n`REWEIGHT`\n\nnode and creates a distinct fixed-width transition signature. The\n`apply_signed_cognitive_reweight`\n\nfunction in migration 091 verifies the exact\ntenant, memory, signer epoch, old and new milliscaled weights, provenance hash,\ncontinuity, and no-fork predecessor before it atomically appends the projection\nand updates only `retrieval_weight`\n\n. A quantized no-op retains its signed\noutcome evidence without inventing a transition.\n\n`verify_cognitive_weight_chain()`\n\nand `verify_all_cognitive_weight_chains()`\n\nreplay the database evidence, while\n`services/security/cognitive-weight-verifier.js`\n\nindependently verifies the\nsame baseline, provenance, signature, continuity, terminal-state, and corpus\nproof-root contracts. The normative byte layout and invariants are published\nin [ docs/security/cognitive-weight-chain-SPEC.md](/wallidsaydi-creator/HOM-AIMOS/blob/main/docs/security/cognitive-weight-chain-SPEC.md).\n\nThe save manifest declares 13 critical service connections; recall declares 68 spanning exact-identifier, semantic, temporal, graph, procedural, and lineage paths. The service census contains retrieval 55, orchestration 43, security 36, temporal 25, learning 23, observe 22, core 15, write 13, context 9, integrations 9, governance 7, dream 5, ingestion 4, shared 4, answering 2, runtime 2, and caching 1.\n\n`services/pipeline-manifest.js`\n\nis the source of truth for the six critical\nconnection maps. Its validator dynamically imports all 146 declarations and\nchecks their named exports; architecture tests and the release-source gate fail\nwhen the declared topology and public documentation diverge.\n\nThe save and recall paths are a working memory system on their own. The cryptographic layer enters at explicit boundaries:\n\n- Save stage 8 assigns each retained memory a signed, reversible epistemic label bound to its live content hash.\n- Recall stages 6–8 verify and consume the epistemic projection, apply a verified calibration snapshot, and return bounded evidence under an RFC 6962-style domain-separated Merkle receipt.\n- Cognitive mutation changes retrieval weight within a constitutional interval only through housekeeper-authorized signed transitions. Each transition binds the terminal provenance node, signer epoch, quantized old and new weights, and no-fork predecessor.\n- Ed25519 verification runs in the database mutation boundary and in an independent portable verifier.\n\nCanonical memory is never selectively removed, decayed, expired, suppressed, or deactivated. The sole erasure path is an offline, master-signed, all-or-nothing whole-brain purge that emits a signed terminal receipt.\n\n| Result | Value |\n|---|---|\n| LongMemEval, LLM-judged | 459/500 — 91.8% |\n| LoCoMo, LLM-judged | 1472/1986 — 74.12% |\n| LoCoMo, separate upstream-compatible token F1 | 58.20 |\n| PoisonedRAG N=100, poison in attacked top-5 disclosures | 0/100 |\n| Same target set, epistemic policy bypassed | 94/100 |\n| Mutation authorization rejection cases | 7/7 |\n| Cognitive tamper cases detected | 4/4 |\n| SQL/portable cognitive verifier parity | 9/9 records |\n| Signed cognitive-transition latency, median | 4.865 ms |\n\nThese are distinct protocols and are not averaged. Every figure regenerates\nfrom the sanitized, self-hashed aggregate in\n[ eval/publication/verified-benchmark-results.json](/wallidsaydi-creator/HOM-AIMOS/blob/main/eval/publication/verified-benchmark-results.json),\nwhich binds the promoted run artifacts by SHA-256.\n\nThe central security distinction is **integrity, not omniscience**. AIMOS can\nprove that an authorized identity asserted a specific memory at a particular\nledger position and that the retained evidence has not been silently rewritten.\nIt cannot prove that the asserted content is factually true. The threat model\nnames this failure class **Authenticated-But-False (ABF)**.\n\nThis repository contains the HOM-AIMOS 1.0 source release. Its promoted, isolated\nevaluation lanes are complete and bound to the sanitized, self-hashed aggregate\nin [ eval/publication/verified-benchmark-results.json](/wallidsaydi-creator/HOM-AIMOS/blob/main/eval/publication/verified-benchmark-results.json).\nIt carries the canonical utility results above, 1.02% induced attack success\namong clean-negative PoisonedRAG targets, mutation-integrity evidence,\nepistemic ablation, blinded system-author agreement, and 39/39 verified signed\nscratch-brain purge evidence. Older batch-save runs are non-canonical and are\nnot release claims.\n\nThe architecture manifest mechanically binds the current 275-service census. That number is an inventory fact, not a performance claim.\n\n- External save, recall, credential, authorization, and mutation actions are bound to signed certificate envelopes.\n- Secrets and identity keys use macOS Keychain custody.\n`.env`\n\nfiles and environment-owned credentials are rejected as runtime authority. - Canonical memory is never selectively deleted, decayed, expired, suppressed, or deactivated. Contradictions and corrections are retained through signed supersession and cognitive transitions.\n- The sole erasure mechanism is an offline, master-signed, all-or-nothing whole-brain purge that emits a signed receipt.\n- Security quarantine remains retained and recallable under its enforced clearance and cognitive policy.\n- Retained reference memories carry a separate, signed, reversible epistemic label. Poison suspicion changes evidence handling without rewriting or deleting the underlying observation; later evidence may refute the label.\n- Native implementation only: no placeholder services, fake controls, runtime wrappers, or bypass hooks.\n\nSee [SECURITY.md](/wallidsaydi-creator/HOM-AIMOS/blob/main/SECURITY.md) and [THREAT-MODEL.md](/wallidsaydi-creator/HOM-AIMOS/blob/main/THREAT-MODEL.md) before\ndeploying or integrating AIMOS.\n\nThe AIMOS 1.0 source release supports Intel and Apple silicon Macs running macOS 14 or later. A clean installation requires:\n\n- Apple Command Line Tools (\n`xcode-select --install`\n\n), including`git`\n\n,`curl`\n\n, a compiler, and`make`\n\n; - Node.js 20 or 24 with\n`npm`\n\n; - PostgreSQL 18;\n- pgvector built for the selected PostgreSQL 18 server;\n- libsodium and\n`pkg-config`\n\n/pkgconf; and - macOS Keychain access.\n\nHomebrew is the supported dependency provisioner for a clean source install, but it is not AIMOS runtime authority and is not required when compatible dependencies already exist. GPG is not required to install or run AIMOS. The Genesis installer verifies or builds the checksum-locked pgsodium 3.1.11 source and artifacts before database creation. Other operating systems and PostgreSQL majors are not claimed as supported by this release.\n\nDo not create the AIMOS database manually. Genesis owns database creation, migrations, restricted-role custody, housekeeper enrollment, and signed Guide ingestion.\n\nDownload the release source archive or clone the repository, then run from its root:\n\n```\ncd HOM-AIMOS\n./install-macos.sh --check\n./install-macos.sh\n```\n\nThe installer displays its plan and asks before Homebrew or Genesis changes\nmachine state. It uses the repository `Brewfile`\n\n, installs the locked npm graph,\nand hands control to native Genesis. It does not download or execute the\nHomebrew installer itself.\n\nFor an explicit manual dependency path:\n\n```\nxcode-select --install              # only when Command Line Tools are absent\n# Install Homebrew from https://brew.sh when no compatible toolchain exists.\nbrew bundle --file Brewfile\nbrew services start postgresql@18\nnpm ci\nnpm run genesis:install -- --aimos-db aimos --aimos-port 9100\n```\n\nAfter Genesis completes, start the server:\n\n```\nnpm start -- --aimos-db aimos --aimos-port 9100\n```\n\nVerify the live service:\n\n```\ncurl --fail http://127.0.0.1:9100/healthz\n```\n\nAIMOS owns port 9100. Ports 9000 and 9001 are reserved for the separate Oracle system and are rejected by this fork.\n\nThe complete enrollment, signed save/recall proof, upgrade, and purge ceremonies\nare documented in [DEPLOYMENT.md](/wallidsaydi-creator/HOM-AIMOS/blob/main/DEPLOYMENT.md).\n\nRelease packages include SHA-256 checksums, a CycloneDX SBOM, and GitHub keyless\nbuild provenance. GPG is not required. See [RELEASE.md](/wallidsaydi-creator/HOM-AIMOS/blob/main/RELEASE.md) for online\nand offline verification boundaries.\n\n[ARCHITECTURE-MAP.md](/wallidsaydi-creator/HOM-AIMOS/blob/main/ARCHITECTURE-MAP.md)describes the implemented runtime.[hom-architecture-manifest.json](/wallidsaydi-creator/HOM-AIMOS/blob/main/hom-architecture-manifest.json)is the mechanically verified service inventory.[architecture-authority.template.json](/wallidsaydi-creator/HOM-AIMOS/blob/main/architecture-authority.template.json)is the portable authority used to generate machine-local runtime authority.[Guide/AGENTS.md](/wallidsaydi-creator/HOM-AIMOS/blob/main/Guide/AGENTS.md)is the LLM-agnostic boot and truth-hierarchy index.`Guide/`\n\nis also the cryptographically manifest-bound Genesis corpus.\n\nThe ordinary source suite never touches a live database:\n\n```\nnpm test\nnpm run lint\nnpm audit --omit=dev --audit-level=high\n```\n\nBenchmark contract tests require the public datasets, which are downloaded from immutable upstream revisions and verified by SHA-256:\n\n```\nbash eval/data/download.sh\nnode eval/prepare-canonical-corpus.mjs\nnpm run test:benchmark:contracts\n```\n\nThe complete release-source gate is:\n\n```\nnpm run test:release:source\n```\n\nThe isolated Genesis and signed live-fire ceremony uses a disposable database and must be run with AIMOS 9100 stopped because it temporarily exercises the machine-local housekeeper certificate cache:\n\n```\nnpm run test:security:isolated\n```\n\nBenchmark data is never distributed under the AIMOS source license and is never ingested into the canonical user brain. The isolated runner creates a fresh Genesis-installed scratch brain and preserves signed save, session, recall, model, judgment, and purge evidence separately.\n\nRetrieval metrics and judged answer accuracy are reported independently. A retrieval hit is not presented as a correct answer.\n\nSource code is licensed under AGPL-3.0-or-later. A separate commercial license\nmay be available for deployments that cannot comply with AGPL; see\n[COMMERCIAL-LICENSE.md](/wallidsaydi-creator/HOM-AIMOS/blob/main/COMMERCIAL-LICENSE.md). Downloaded benchmark datasets\nretain their upstream licenses.\n\nContribution requirements are in [CONTRIBUTING.md](/wallidsaydi-creator/HOM-AIMOS/blob/main/CONTRIBUTING.md).", "url": "https://wpnews.pro/news/i-built-agent-memory-that-retains-poisoned-data-instead-of-deleting-it", "canonical_source": "https://github.com/wallidsaydi-creator/HOM-AIMOS", "published_at": "2026-08-03 13:17:37+00:00", "updated_at": "2026-08-03 13:22:27.082168+00:00", "lang": "en", "topics": ["ai-agents", "ai-infrastructure", "ai-safety"], "entities": ["HOM-AIMOS", "wallidsaydi-creator"], "alternates": {"html": "https://wpnews.pro/news/i-built-agent-memory-that-retains-poisoned-data-instead-of-deleting-it", "markdown": "https://wpnews.pro/news/i-built-agent-memory-that-retains-poisoned-data-instead-of-deleting-it.md", "text": "https://wpnews.pro/news/i-built-agent-memory-that-retains-poisoned-data-instead-of-deleting-it.txt", "jsonld": "https://wpnews.pro/news/i-built-agent-memory-that-retains-poisoned-data-instead-of-deleting-it.jsonld"}}