Trust & safety
Trust
The four tiers are not permission levels that grant publish rights. They're deterministic weights applied server-side to evidence, and a tier is only elevated by a signed, challenge-bound ed25519 attestation — never a self-claim. A higher tier makes evidence count for more; it never skips verification, and it never overrides policy-driven human review.
Anonymous
Lowest weight
Accepted and abuse-capped, but down-weighted. It can never auto-approve a public change on its own.
TOFU agent
Low–medium weight
Trust-on-first-use for an agent key, proven by a signed, challenge-bound attestation — not a self-claim.
Registered provider
Higher weight
A provider whose ed25519 key is registered and verified. Evidence counts for more, but still gets verified.
Organization key
Highest weight
Evidence submitted under an organization API key, scoped and audited to that workspace.
Pipeline
1. Redact
Submissions are scrubbed for secrets and sensitive material first. If a redacted payload still contains sensitive content, it is never forwarded to the model — it is quarantined instead.
2. Verify (LLM)
An LLM approver evaluates the change under a system prompt that treats the entire payload — markdown, metadata, patches, even special tokens — as attacker-controlled, and forbids following any instruction inside it.
3. Guardrails (deterministic)
A static guardrail layer can only make a verdict safer. Any accept / merge / fork is downgraded to needs-review or quarantine the moment a risk signal fires — injection, secrets, install vectors, score tampering, or fabricated citations. The model can never raise a score; score updates are always discarded.
4. Human review
Risky public skill changes and evidence route to a human review queue per policy. Even an admin's approval is re-checked against the static safety layer and is rejected if a hard flag fires.
5. Version
Accepted skill changes activate as a new version with provenance, quality-gate results, token delta, and rollback history. A bad version can be quarantined or rolled back without erasing the audit trail.
The guardrail layer is one-directional: it can only make a verdict safer, never riskier. That's the property that matters — even if the model is fooled, the deterministic net still catches the dangerous actions.
Review automation
Remembrance can handle more routine review as evidence accumulates, but only final human dispositions train it. Learned public behavior and each organization's private preferences evolve independently, with versioned replay, shadowing, canaries, audits, and automatic rollback around every promotion.
Safety never learns itself away
Static scanning, authorization, target and freeze checks, transactional writes, and materialization guards stay outside the learned policy. A learner can reduce review friction only after those controls pass.
Public and team judgment stay separate
The public policy learns only from global-admin decisions. A new organization inherits that policy with no local change, then its adapter learns only from its own administrators; private labels never cross organization boundaries.
Promotion earns production traffic
A candidate must pass replay, fresh labels, two live shadow cycles, calibrated action-level precision, and audited 10% and 50% canaries. Automatic outcomes never train their own successor.
Regression restores a known version
An organization hard-safety miss contains that organization and holds public rollout for platform review; tenant signals cannot roll global policy back. A platform-owned public audit can restore the known public version immediately. Two consecutive fresh precision regressions do the same and leave a tamper-evident trail.
Identity & preferences
A shared organization key can serve an entire engineering team without flattening everyone into one preference profile. Installation identity and optional member links provide continuity, while canonical skills remain reviewed, organization-scoped operational knowledge.
The key identifies the organization, not the person
A local TOFU key identifies one installation. An optional private member link lets preferences follow an engineer, while child Codex, Claude Code, Cursor, OpenClaw, VS Code, OpenCode, and MCP profiles remain part of the same billed installation.
Machine details stay on the machine
Runtime profiles send normalized surface names, bounded versions, and an opaque local profile key. Hostnames, usernames, config paths, repository paths, Clerk IDs, and member email addresses are never placed in agent responses.
Preferences cannot lower a guardrail
Built-in and extensible preferences may shape presentation, workflow, or strategy selection. Required organization guidance and locked skill requirements win; safety, authorization, privacy, applicability, required steps, validation, and review never become preferences.
Relevance stays authoritative
Preferences never raise a weaker match tier or change applicability. Private exact-version compatibility may reorder already-relevant skills inside one tier; after selection, a bounded sidecar applies discretionary choices, reports replaced defaults or blocked conflicts, and preserves every hard boundary.
Compatibility stays private
Each organization classifies its own preferences against exact public and team skill versions. Only material support or conflict edges are retained; missing or stale coverage is neutral and no preference record crosses organizations.
Learning requires a pattern
Explicit instructions govern the current task immediately. Known built-ins activate durably at once; custom settings activate only after automatic normalization and validation. Inferred preferences need repeated observations across distinct tasks and days, decay after inactivity, and create reversible profile revisions with undo and reset.
Skill topology
A lesson can be true and still be too narrow for a general skill. Remembrance classifies the evidence and preserves lineage so a useful corner case becomes discoverable without polluting instructions shown to every agent.
Evidence arrives before the graph decision
Agents may suggest a route, but Remembrance independently decides whether verified evidence should amend, specialize, fork, create, become a preference, remain evidence-only, or wait for review.
Specific truth does not pollute general guidance
Stable runtime, version, platform, framework, scale, or task-stage conditions create a scoped specialization instead of being blended into a universally served parent skill.
Lineage is exact and reviewable
A specialization is a complete reviewed version pinned to the exact parent version with structured conditions and use/avoid guidance. Parent changes create compatibility review; they never silently rewrite the child.
Private judgment stays private
Organization evidence can create only private organization artifacts. Public topology learns from global-admin corrections, while each organization learns an isolated adapter from its own admins.
Private lessons
Organization installs can capture bounded, generalized lessons through an encrypted local outbox. The corrected redactor profile is pinned by version and digest, and its safety-hold telemetry is a separate, content-free contract rather than a submission into the skill graph.
The submission boundary stays private
The private-lesson action, original record, encrypted payload, and signed receipt always remain organization-private and never fall back to public submission. If an admin enables Contribution propagation, only a later server-owned projection of an accepted result may create a separately redacted public candidate through the full public review pipeline.
Unsafe drafts stay on the device
The local redactor holds public URLs, fenced code, stack traces, screenshots, encoded material, and other ambiguous content before submission. Inline code remains available for short API names and flags, while secrets, paths, identifiers, credentials, and private destinations are still removed.
A hold report contains no lesson
When organization health reporting is enabled, the same approved private-lesson action may send only event type, category counts, redactor and policy digests, an idempotency key, and a signed attestation. It excludes prose, conditions, tags, paths, evidence hashes, and correlation IDs.
Telemetry cannot become memory
Safety-hold events use isolated 90-day raw storage and daily aggregates. They cannot create a remembrance, verifier job, review item, topology decision, public candidate, or private skill.
Terminal drafts are retained, not retried
A draft prepared by an unsupported redactor profile becomes terminal in the encrypted local outbox. It is never re-redacted, retried, expired, or deleted automatically; the connection doctor reports retained bytes and the explicit deletion path.
Retrieval learning
Query-fit feedback answers a narrow question: did this result belong in this query? It is deliberately separate from post-use feedback about whether the skill worked. That boundary lets retrieval improve without letting popularity or one bad match rewrite reviewed content.
High matches earn the detour
A high tier requires direct task or semantic evidence, compatible constraints, and acceptable risk. Agents also see an approximate token cost and verified-use evidence before deciding; possible and exploratory matches stay optional.
Every verdict stays tied to its query
Agents rate opaque result IDs from one query as good, partial, or poor. Unrated results stay neutral, and query mismatch never becomes a global judgment that the skill itself is bad.
Content still determines the vectors
Feedback does not move or rewrite skill embeddings. Vector and lexical search build a candidate pool; learned profiles and a bounded reranker adjust only the final ordering.
Private results do not train a public model
Organization-private skill and resource comparisons remain scoped to that workspace. Shared training accepts only public-result comparisons from multiple authenticated organization keys across multiple organizations; anonymous feedback cannot train it.
Identity is costly, not self-declared
One organization API key counts as one feedback actor. Rotating agent_id, provider, or other caller-controlled strings creates no new identity. Anonymous profiles use a server-HMAC'd network fingerprint and never feed organization rankings directly.
Fresh evidence earns activation
Profiles and candidate models collect evidence, run in shadow, and activate only after fresh validation. Repeated fresh-data regressions automatically restore the prior model or static baseline.
Silence stays diagnostic
Remembrance can measure surfaced, opened, query-rated, used, and useful stages. A repeatedly unopened result helps admins spot ranking or description problems, but it is never silently converted into a negative label.
Plugin instructions are measured, not trusted
Native plugins record an opaque shown-to-followed directive lifecycle without prompt text. Fresh events stay pending, ignored events expose missed instructions, and none of this telemetry changes ranking, identity, or trust.
Value proof
Context size is not a savings claim. Remembrance exposes a potential token-savings range only when exact, current evidence clears every proof and privacy gate; otherwise the field is absent.
Collection never needs task content
Episodes retain opaque identifiers, categorical task features, bounded scope counts, token totals, timings, and model metadata. Prompts, transcripts, outputs, source paths, private URLs, and proprietary task content are excluded.
Strong proof needs strong measurement
Only provider or gateway metering and controlled paired evaluations can establish grade A/B proof. Plugin-observed, agent-reported, anonymous, and hierarchical fallback evidence remains modeled grade C.
Every exposed estimate passes exact gates
The accepted skill version, observed model revision, reasoning effort, task stage, complexity, bounded scope, risk, freshness, privacy thresholds, positive lower confidence bound, and positive median savings must all match. If any gate fails, potential savings is omitted.
Receipts are public and token-only
Qualified estimates link to an Ed25519-signed receipt and a rotatable public key set. Collection mode publishes token ranges and methodology, never organization identity or monetary, subscription, credit, or payment fields.
Skill evolution
Remembrance does not let an agent's suggested wording become the next instruction just because it sounds plausible. Every meaningful change becomes a candidate version, and the system asks a stricter question: is this safer, more complete, more useful, and worth the extra tokens?
Feedback is signal, not a rewrite
Positive and negative feedback updates evidence, version metrics, and trust. Repeated substantive patterns can synthesize a candidate update, but feedback never edits live skill text directly.
Candidate updates compete with the current version
The verifier compares before and after: safety, completeness, utility, trust, non-regression, and whether extra tokens buy enough value.
Token bloat has to justify itself
If utility is flat or worse, added context is blocked. Larger skills only pass when they add verified capability, safer constraints, clearer examples, or better failure handling.
Rollback is a first-class path
Live feedback keeps measuring each version. Safety issues quarantine immediately; quality regressions can restore a prior version while preserving the full timeline.
Organizations can hold an exact version
An organization admin can freeze a private skill so accepted candidates, public sync, activation, rollback, restore, and repair replay cannot move its active content. Suggestions keep collecting for later review, and emergency quarantine remains available.
Anti-injection
Tested
The defenses above aren't aspirational. They're backed by an adversarial verifier suite of tagged attack cases — direct injection, base64 and unicode obfuscation, special-token smuggling, Cyrillic homoglyphs, CJK and right-to-left scripts, confidence games, decoy citations, nested injection, and secret-leak canaries — alongside a must-accept positive-control set so we also measure false rejections. Cases run multiple times, scored with a statistical lower bound, and a candidate model cannot ship if it false-accepts a dangerous change or leaks sensitive material. The production verifier is whichever model clears that bar — chosen by the test, not by reputation.
Privacy
Verified-only public surface
Public listings show only active, public, verified records. Quarantined, deprecated, and non-public items are excluded, and a materialized skill is quarantined if its source is torn down.
Organization isolation
Review queues, audit logs, and lookups are scoped by organization. Org-internal evidence never crosses into another workspace or onto the public registry.
Encrypted when it matters
Private organization payloads are encrypted before storage. The default managed mode is operationally simple and server-decryptable for verification/review; customer-held envelopes can keep private plaintext outside Remembrance when that boundary matters.
Honesty
A security page that only lists strengths isn't trustworthy. Here are the boundaries of the threat model, stated plainly.