Canonadr

ADR-2026-09-04-13 — Memory informs truth but never silently becomes it

Status: ACCEPTED — 2026-09-04 (Founder Canon §4/§4A constitutional memory rule; Full Ontology laws 17–18)

Context

AI systems that write their observations straight into shared memory make "the model said it"
indistinguishable from "the organization knows it." Personal notes and AI session state that leak
into shared context break privacy and poison organizational truth alike.

Decision

Constitutional rule: User thought ≠ AI inference ≠ Organizational truth.
Three memory scopes are first-class and separate: Organizational Memory (durable, governed,
shared), Personal Contextual Memory (private by default; only the owner cites it; sharing
is an explicit governed transition), AI Continuity Memory (AI working continuity; never
canonical truth).
Promotion is the only bridge: raw → parsed → normalized → triaged → candidate → review (reject | approve) → promoted → canonical. Promotion records origin, confidence, proposed_by,
reviewer, authority basis and timestamps.
Flow C boundary: AI-origin writes never auto-approve — regardless of tenant autoPromote
policy or signal strength.
Memory informs context assembly; it does not silently mutate it. Knowledge emerges from
processed outcomes (evidence → triage → candidate → governance), never from raw data or raw
model output.
The eleven state planes stay separated even when physically co-located; Spine Cache is always
rebuildable and never truth; knowledge representations retain evidence links.

Alternatives considered

Single unified memory store with scope flags — rejected: flags rot; the boundary must be
structural.
Auto-promotion above a confidence threshold — rejected: confidence never grants authority.

Consequences

Memory services must persist scope, origin, confidence and approval lineage; promotion queues are
auditable; private content must remain traceable without overexposure in projections. The Flow-C
boundary test in the pipeline is a canon test, not an implementation detail.