{"slug":"canonical/adr/ADR-2026-09-04-13-memory-informs-truth-promotion","title":"ADR-2026-09-04-13 — Memory informs truth but never silently becomes it","section":"canonical","sectionLabel":"Canon","status":"canon","type":"adr","path":"canonical/adr/ADR-2026-09-04-13-memory-informs-truth-promotion.md","bytes":2154,"description":null,"updated":null,"source":"integratewise/Integratewise-docs-wiki","content":"\n**Status:** ACCEPTED — 2026-09-04 (Founder Canon §4/§4A constitutional memory rule; Full Ontology laws 17–18)\n\n## Context\n\nAI systems that write their observations straight into shared memory make \"the model said it\"\nindistinguishable from \"the organization knows it.\" Personal notes and AI session state that leak\ninto shared context break privacy and poison organizational truth alike.\n\n## Decision\n\n- **Constitutional rule:** `User thought ≠ AI inference ≠ Organizational truth`.\n- Three memory scopes are first-class and separate: **Organizational Memory** (durable, governed,\n  shared), **Personal Contextual Memory** (private by default; only the owner cites it; sharing\n  is an explicit governed transition), **AI Continuity Memory** (AI working continuity; never\n  canonical truth).\n- Promotion is the only bridge: `raw → parsed → normalized → triaged → candidate → review\n  (reject | approve) → promoted → canonical`. Promotion records origin, confidence, proposed_by,\n  reviewer, authority basis and timestamps.\n- **Flow C boundary:** AI-origin writes never auto-approve — regardless of tenant autoPromote\n  policy or signal strength.\n- Memory **informs** context assembly; it does not silently mutate it. Knowledge emerges from\n  processed outcomes (evidence → triage → candidate → governance), never from raw data or raw\n  model output.\n- The eleven state planes stay separated even when physically co-located; Spine Cache is always\n  rebuildable and never truth; knowledge representations retain evidence links.\n\n## Alternatives considered\n\n- Single unified memory store with scope flags — rejected: flags rot; the boundary must be\n  structural.\n- Auto-promotion above a confidence threshold — rejected: confidence never grants authority.\n\n## Consequences\n\nMemory services must persist scope, origin, confidence and approval lineage; promotion queues are\nauditable; private content must remain traceable without overexposure in projections. The Flow-C\nboundary test in the pipeline is a canon test, not an implementation detail.\n"}