Governed Persistent Memory: Source-Bound State Semantics and Fail-Closed Release for Long-Horizon Agents

Governed Persistent Memory (GPM) is introduced as an auditable bitemporal state-transition model for long-horizon agents, addressing the problem that retrieval alone does not determine whether contradictory, superseded, retracted, deleted, or stale records may support an outgoing claim. The model includes source-bound admission, derived lifecycle state, current public barriers, and fail-closed structured release. Five executable clauses cover ledger integrity, source binding, conflict isolation, non-revival after retraction or deletion, and exact claim closure over a fresh view at one verified head.

On a prespecified hash-frozen 3,600-case GPM-ReleaseBench, GPM matches all complete outcomes; the strongest of three intentionally simple complete policies (flat conflict-preserving) matches 1,800/3,600 and makes unmatched releases on 50% of violation cases. A separate sealed end-to-end service evaluation exercises real ingestion and release across eight query families. In its publicly disclosed V3 arm, the governed lane is correct on 2,400/2,400 clusters versus 600/2,400 for ungoverned local Qwen2.5-7B; it repairs all 1,800 baseline failures with no regression (one-sided 95% lower bounds 99.875% and 99.834%). A later V5 reseal over Chinese- and English-command arms, with generation-date pinning and no post-freeze reducer amendment, again obtains 2,400/2,400 per arm. A production-code-independent finite model explores 331,776 semantic and 1,990,656 query states without a full-contract counterexample, and a 100,000-trace three-engine differential yields zero mismatches.

These are bounded contract and implementation results, not open-world model accuracy or evidence of world truth. Governed answers in the sealed service evaluation are deterministic service outputs; the 7B result is the ungoverned comparison, not a claim that a language model itself became perfectly accurate.

Improvements to AI Systems:

1. Add a bitemporal state-transition layer to long-hhorizon agents, so every retrieved fact carries a lifecycle state (active, superseded, retracted, deleted) and a validity interval. The improved system can refuse to generate claims from stale or revoked records, and can explicitly state this was true until [date], then retracted instead of presenting outdated information as current.

2. Implement source-bound admission control for all ingested knowledge. The system only accepts facts with a verifiable origin and a cryptographic hash, preventing unverifiable or conflicting data from entering the agent's memory. The improved system can trace every claim back to its exact source and timestamp, enabling auditability and dispute resolution.

3. Add fail-closed structured release for answer generation. When the agent produces a response, it must first construct a fresh, consistent view of its memory at a single verified head, then check that the claim is supported by active, non-conflicting records. If any supporting record is missing, superseded, or revoked, the system outputs cannot confirm rather than guessing. The improved system can guarantee that every answer is either fully supported by current evidence or explicitly flagged as unverifiable.

4. Introduce conflict isolation and non-revival rules in the memory store. Once a fact is retracted or deleted, no future retrieval or inference can resurrect it, and contradictory records are quarantined so they cannot jointly support a claim. The improved system can maintain logical consistency over time, even when new information contradicts old data, and will never produce an answer that relies on a fact that was officially withdrawn.

5. Add exact claim closure verification before any output. The system checks that the set of supporting records for a claim is complete and that no other active record contradicts it, using a deterministic, hash-frozen contract. The improved system can certify that its answer is not only plausible but is the unique logical consequence of the current, verified state of its knowledge base—eliminating hallucination from incomplete or mixed-version retrieval.

6. Use a governed lane for high-stakes queries (e.g., medical, legal, financial). The system runs a separate, auditable inference path that applies the above rules, while a faster ungoverned path handles casual queries. The improved system can automatically route critical questions to the governed lane, ensuring that any answer with real-world consequences is fully traceable and conflict-free, while maintaining speed for low-risk interactions.

What the improved AI system can do: It can answer questions with provable consistency over time, never silently contradicting itself or relying on revoked data, and can produce an audit trail for every claim. It can handle long-horizon tasks (e.g., multi-day research, ongoing project management) where facts change, by automatically updating its internal state and clearly marking what changed and when. It can also generate certified answers that are guaranteed to be free of internal contradictions and based only on the latest, verified evidence—useful for compliance, journalism, and decision support.

Long-term agent memory is usually treated as select--store--retrieve, but retrieval does not decide whether contradictory, superseded, retracted, deleted, or stale records may support an outgoing claim. We introduce Governed Persistent Memory (GPM), an auditable bitemporal state-transition model with source-bound admission, derived lifecycle state, current public barriers, and fail-closed structured release. Five executable clauses cover ledger integrity, source binding, conflict isolation, non-revival after retraction or deletion, and exact claim closure over a fresh view at one verified head. On a prespecified hash-frozen 3,600-case GPM-ReleaseBench, GPM matches all complete outcomes; the strongest of three intentionally simple complete policies matches 1,800/3,600 and makes unmatched releases on 50% of violation cases. A separate sealed end-to-end service evaluation exercises real ingestion and release across eight query families. In its publicly disclosed V3 arm, the governed lane is correct on 2,400/2,400 clusters versus 600/2,400 for ungoverned local Qwen2.5-7B; it repairs all 1,800 baseline failures with no regression (one-sided 95% lower bounds 99.875% and 99.834%). A later V5 reseal over Chinese- and English-command arms, with generation-date pinning and no post-freeze reducer amendment, again obtains 2,400/2,400 per arm. A production-code-independent finite model explores 331,776 semantic and 1,990,656 query states without a full-contract counterexample, and a 100,000-trace three-engine differential yields zero mismatches. These are bounded contract and implementation results, not open-world model accuracy or evidence of world truth. Governed answers in the sealed service evaluation are deterministic service outputs; the 7B result is the ungoverned comparison, not a claim that a language model itself became perfectly accurate.