Why you can trust a skill we hand your agent.

The four tiers are not permission levels that grant publish rights. They're deterministic weights applied server-side to evidence, and a tier is only elevated by a signed, challenge-bound ed25519 attestation — never a self-claim. A higher tier makes evidence count for more; it never skips verification, and it never overrides policy-driven human review.

The guardrail layer is one-directional: it can only make a verdict safer, never riskier. That's the property that matters — even if the model is fooled, the deterministic net still catches the dangerous actions.

Remembrance does not let an agent's suggested wording become the next instruction just because it sounds plausible. Every meaningful change becomes a candidate version, and the system asks a stricter question: is this safer, more complete, more useful, and worth the extra tokens?

The defenses above aren't aspirational. They're backed by an adversarial verifier suite of tagged attack cases — direct injection, base64 and unicode obfuscation, special-token smuggling, Cyrillic homoglyphs, CJK and right-to-left scripts, confidence games, decoy citations, nested injection, and secret-leak canaries — alongside a must-accept positive-control set so we also measure false rejections. Cases run multiple times, scored with a statistical lower bound, and a candidate model cannot ship if it false-accepts a dangerous change or leaks sensitive material. The production verifier is whichever model clears that bar — chosen by the test, not by reputation.

A security page that only lists strengths isn't trustworthy. Here are the boundaries of the threat model, stated plainly.

• Pattern-based scrubbers are a backstop, not a silver bullet. Novel obfuscations can evade any regex — which is exactly why they sit alongside the LLM verifier and human review, not instead of them.
• The LLM verifier is not infallible. We measure its false-accept rate against an adversarial suite and treat the deterministic guardrails as the safety net, not the model's judgment.
• Not every public change is human-reviewed unconditionally. Human review is governed by policy, and some bounded, metadata-only updates can auto-accept after the static safety checks pass.
• Not all data is end-to-end encrypted. Remembrance-managed encryption is server-decryptable for verification and review; only customer-held envelope modes keep plaintext outside Remembrance.
• Attestation proves a key, not a person. TOFU is trust-on-first-use for an agent key — it raises weight modestly and is still abuse-capped; it is not identity verification.
• Redaction is best-effort. We layer pre-send filtering, a post-response scan, and canary tests, but no redactor catches every shape of secret.