How a memory is stored

The write path, step by step

Nine deterministic steps from text to a chained, annotated row. Every step is exercised by an invariant.

Sequence

POST /memories runs the same nine steps every time. There is no asynchronous side channel and no model call, so the result is identical on a laptop and on a server.

• 1. Validate. Non-empty text, ≤ 20,000 characters, space 1–200 characters, ≤ 50 distinct tags, ttl_seconds ≥ 1. Bad input is refused, never coerced.
• 2. Normalise terms. Lowercase alphanumeric terms, a frozen stopword list removed.
• 3. Screen for instructions. The canonical CAIN detector runs over the text; families matched are recorded.
• 4. Assign status. Any matched family → quarantined; otherwise active.
• 5. Score contradictions. Live memories in the same space are compared lexically; similar text with opposite negation polarity is flagged, not resolved.
• 6. Label provenance. A stated source → declared / source_attached. No source → unattributed / unverified. This is a label, never a trust score.
• 7. Hash the content. SHA-256 of the exact text, stored beside it so a later reader can tell whether it changed.
• 8. Commit atomically. The row and its log entry commit in one SQLite transaction.
• 9. Chain the audit entry. entry_hash = SHA256(prev_hash | payload_sha256 | owner | memory_id | action | timestamp).

Why the write is the right place to screen

Screening at read time is too late in two ways. First, a poisoned memory may be read by many future calls, so the scan cost is paid repeatedly. Second, read-time filtering is a policy that a caller can ask to skip; write-time quarantine is a property of the stored row. AETHER-33 does both — quarantine at write, and withhold quarantined text from every recall: a caller may ask to have quarantined rows listed, but their text is shown only to the reviewer (since 2026-11-02). Tags and the source are screened too, because they are returned to the model with the text.

Example

curl -X POST https://cainstudio.online/aether33/api/memories \
  -H "Content-Type: application/json" \
  -H "X-CAIN-Visitor: 0123456789abcdef0123456789abcdef" \
  -d '{"space":"runbooks","text":"rotate the signing key every 90 days",
       "source":"security-policy.md#3.2","tags":["keys"]}'