Governed Persistent Memory: Source-Bound State Semantics and Fail-Closed Release for Long-Horizon Agents
06:00 · August 15, 2026 · arXiv cs.AI RSS
Long-term agent memory is usually treated as select--store--retrieve, but retrieval does not decide whether contradictory, superseded, retracted, deleted, or stale records may support an outgoing claim. We introduce Governed Persistent Memory (GPM), an auditable bitemporal state-transition model with source-bound admission, derived lifecycle state, current public barriers, and fail-closed structured release. Five executable clauses cover ledger integrity, source binding, conflict isolation, non-revival after retraction or deletion, and exact claim closure over a fresh view at one verified head. On a prespecified hash-frozen 3,600-case GPM-ReleaseBench, GPM matches all complete outcomes; the strongest of three intentionally simple complete policies matches 1,800/3,600 and makes unmatched releases on 50% of violation cases. A separate sealed end-to-end service evaluation exercises real ingestion and release across eight query families. In its publicly disclosed V3 arm, the governed lane is correct on 2,400/2,400 clusters versus 600/2,400 for ungoverned local Qwen2.5-7B; it repairs all 1,800 baseline failures with no regression (one-sided 95% lower bounds 99.875% and 99.834%). A later V5 reseal over Chinese- and English-command arms, with generation-date pinning and no post-freeze reducer amendment, again obtains 2,400/2,400 per arm. A production-code-independent finite model explores 331,776 semantic and 1,990,656 query states without a full-contract counterexample, and a 100,000-trace three-engine differential yields zero mismatches. These are bounded contract and implementation results, not open-world model accuracy or evidence of world truth. Governed answers in the sealed service evaluation are deterministic service outputs; the 7B result is the ungoverned comparison, not a claim that a language model itself became perfectly accurate.
Summary
Governed Persistent Memory addresses a gap in long-horizon agent systems where retrieval alone does not establish whether a stored record remains admissible for an outgoing claim. Standard pipelines treat memory as select-store-retrieve and therefore surface contradictory, superseded, retracted, deleted, or stale entries without further checks. GPM replaces this with an auditable bitemporal state-transition model that records both transaction time and optional valid time for every event, derives lifecycle states from source-bound admissions rather than caller annotations, and maintains current public barriers that block revival of retracted or deleted material.
Five executable contract clauses enforce ledger integrity through hash-chained events, source binding at admission, isolation of unresolved conflicts, permanent non-revival after retraction or deletion, and exact claim closure over a fresh view at one verified ledger head. These clauses operate before any ranking step, so candidate selection occurs only over the resulting public projection of assertable facts and testimony-only episodes. The architecture separates storage-layer integrity, state-layer eligibility, retrieval relevance, and language-layer generation, allowing deterministic contract verification on the first two layers.
Evaluation on the frozen 3,600-case GPM-ReleaseBench shows that GPM satisfies every complete outcome while the strongest of three simple baseline policies matches only half the cases and produces unmatched releases on half the violations. A sealed end-to-end service test across eight query families reports that the governed lane reaches 2,400 of 2,400 clusters in both V3 and V5 configurations, repairing all 1,800 failures observed with an ungoverned local Qwen2.5-7B baseline and introducing no regressions. Finite model checking over 331,776 semantic states and 1,990,656 query states, together with a 100,000-trace differential across three engine variants, yields no full-contract counterexamples or mismatches. These results remain bounded contract and implementation guarantees rather than claims of open-world factual accuracy.
Why it matters
This research is highly relevant for Dutch AI practitioners developing enterprise-grade AI agents, as its focus on auditable memory, data retraction, and deletion directly supports compliance with the EU AI Act and GDPR. It provides researchers with a rigorous, mathematically grounded framework to solve hallucination and data persistence issues in long-horizon agents.
