# Vercy AI instruction - YAML 1.2 (JSON-compatible) { "vercy": "1.0-draft", "publication": { "status": "published", "adjudicationStatus": "reviewable-draft", "publishableCanonical": false, "generatedAt": "2026-10-21T17:35:33Z", "synthesisSha256": "c2c5b9a7267ebdc4283b4cad08c26981a5c467e57865cf1856c5d5f3f21e622e", "providerMode": "single-provider-waiver", "providers": [ "Codex" ], "waivedProviders": [ "Claude", "Grok" ] }, "metaModel": { "id": "WM-MEM-019", "registryId": "vr.wm-mem-019", "name": "Memory Poisoning Incident", "version": "0.1.0", "previousVersions": [], "entryKind": "entity", "family": "World Models", "category": "Information and virtual systems", "industry": [ "Cross-industry" ], "domain": [ "INF.MEM.POI" ], "tags": [ "memory", "poisoning", "incident", "inf.mem.poi" ], "status": "published" }, "canonicalUrl": "https://ver.cy/models/wm-mem-019-memory-poisoning-incident/", "sourceUrl": "https://github.com/ver-cy/world-models/tree/feat/mega-model-registry/research/runs/wm-mem-019", "model": { "registry_id": "vr.wm-mem-019", "model_id": "WM-MEM-019", "name": "Memory Poisoning Incident", "entry_kind": "entity", "purpose": "Represent one suspected or confirmed case of compromised agent memory or reused context, with evidence, response decisions and recovery assurance.", "scope_statement": "A persistent incident case records hypotheses, observations, affected-reference scope and authorized response outcomes. It survives reclassification, closure and reopening. Retained or retrievable context must be implicated; persistence may cross reasoning cycles within one session and need not cross sessions. A rejected write can remain a suspected or prevented incident. This proposal is format-neutral and policy-level.", "in_scope": [ "Case identity, accountable roles and scoped assessment status", "Evidence of attempted or actual contamination of retained or reused context", "Time-qualified affected sets, derivation hypotheses and observed consequences", "Containment and recovery decision records with externally supplied execution evidence", "Restricted reporting, residual uncertainty, closure and reopening" ], "out_of_scope": [ "Memory store, record and quarantine masters or their runtime enforcement", "Regulatory classification, deadlines, legal advice and report submission", "General model-weight or training-data poisoning without a memory/context link", "One-time prompt injection without retained-context involvement", "Exploit payloads, attack recipes, executable remediation and automatic authorization" ], "boundary_notes": [ { "neighbor": "WM-AI-010 AI Incident Report", "distinction": "Registry parent candidate is reconciled as an optional report reference, not inherited regulatory scope. A poisoning case may lead to several reports or none. Incident identity and report identity are distinct.", "source_refs": [ "SRC-002", "SRC-005" ] }, { "neighbor": "WM-MEM-001 Memory Store", "distinction": "The incident keeps affected store and namespace references with revision/time scope. Store ownership, retention enforcement and retrieval operations remain external.", "source_refs": [ "SRC-001", "SRC-006" ] }, { "neighbor": "WM-MEM-018 Memory Trust Assessment", "distinction": "A trust assessment is separately mastered evidence. A low trust score alone does not establish a poisoning incident or a malicious actor.", "source_refs": [ "SRC-001", "SRC-003" ] }, { "neighbor": "WM-MEM-020 Memory Quarantine and Redaction", "distinction": "The incident references quarantine requests and receipts. It neither executes quarantine nor duplicates write-time filtering and redaction lifecycle.", "source_refs": [ "SRC-001", "SRC-006" ] }, { "neighbor": "Detection event and malicious-content artifact", "distinction": "Multiple alerts or suspicious records may relate to one case. Neither a single alert nor a content hash is the case identity, and a valid signature does not establish benign semantics.", "source_refs": [ "SRC-002", "SRC-004", "SRC-005" ] } ] }, "sources": [ { "id": "SRC-001", "title": "OWASP Top 10 for Agentic Applications 2026", "organization": "OWASP", "url": "https://genai.owasp.org/download/52117/?tmstv=1765059207", "version_or_date": "Version 2026, December 2025; ASI06, pages 24-26", "source_type": "first-party-doc", "primary_source": true, "authority_tier": 2, "accessed_at": "2026-10-21T17:33:47Z", "relevance": "ASI06 distinguishes reused context from one-time prompts and motivates scoped memory integrity controls. Selected section read through web retrieval; no commercial examples are adopted." }, { "id": "SRC-002", "title": "Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile", "organization": "NIST", "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r3.pdf", "version_or_date": "SP 800-61 Rev. 3, April 2025", "source_type": "public-authority", "primary_source": true, "authority_tier": 1, "accessed_at": "2026-10-21T17:33:47Z", "relevance": "RS.AN-06/07 and RC.RP-03/05 ground investigation records, provenance and recovery verification. Recommendations inform this proposed incident case; they do not prescribe its fields." }, { "id": "SRC-003", "title": "Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations", "organization": "NIST", "url": "https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-2e2025.pdf", "version_or_date": "AI 100-2e2025, March 2025; official page notes April correction and June potential errata", "source_type": "public-authority", "primary_source": true, "authority_tier": 1, "accessed_at": "2026-10-21T17:33:47Z", "relevance": "Sections 3.2-3.4 distinguish supply-chain poisoning and direct/indirect prompting. Classification vocabulary only; no attack instructions or assertion that all memory incidents alter model weights." }, { "id": "SRC-004", "title": "PROV-O: The PROV Ontology", "organization": "W3C", "url": "https://www.w3.org/TR/prov-o/", "version_or_date": "Recommendation, 30 April 2013", "source_type": "ontology", "primary_source": true, "authority_tier": 1, "accessed_at": "2026-10-21T17:33:47Z", "relevance": "Starting-point and qualified derivation terms inform reference lineage, attribution and revision links. Provenance records do not themselves establish content truth or attacker identity." }, { "id": "SRC-005", "title": "The Incident Object Description Exchange Format Version 2", "organization": "IETF", "url": "https://www.rfc-editor.org/rfc/rfc7970.html", "version_or_date": "RFC 7970, November 2016", "source_type": "standard", "primary_source": true, "authority_tier": 1, "accessed_at": "2026-10-21T17:33:47Z", "relevance": "Sections 3.2-3.5 and 3.3.1 ground incident identifiers, related records and disclosure restrictions. This is conceptual alignment, not a complete IODEF binding." }, { "id": "SRC-006", "title": "AI Agent Security Cheat Sheet", "organization": "OWASP", "url": "https://cheatsheetseries.owasp.org/cheatsheets/AI_Agent_Security_Cheat_Sheet.html", "version_or_date": "Living guidance accessed 2026-10-21; immutable revision not pinned", "source_type": "first-party-doc", "primary_source": true, "authority_tier": 2, "accessed_at": "2026-10-21T17:33:47Z", "relevance": "Sections 1-4 support separate authorization, untrusted content handling, memory isolation and review of consequential actions. Code examples and claimed detection efficacy are not adopted." }, { "id": "SRC-007", "title": "Traffic Light Protocol: Standards Definitions and Usage Guidance", "organization": "FIRST", "url": "https://www.first.org/tlp/", "version_or_date": "TLP 2.0, authoritative from August 2022; selected sections 1-3", "source_type": "standard", "primary_source": true, "authority_tier": 1, "accessed_at": "2026-10-21T17:33:47Z", "relevance": "Sharing labels and source-authorized expansion inform incident disclosure views. TLP is not a legal basis, encryption scheme, licensing rule or substitute for access control." } ], "structure": { "bundles": [ { "id": "mem-case-governance", "name": "Case governance", "description": "Local proposed incident context for case governance.", "rationale": "Groups decisions that share a case concern while retaining external system authority.", "source_refs": [ "SRC-002", "SRC-005", "SRC-006" ], "layers": [ { "id": "mem-layer-identity", "name": "Case identity", "description": "Record case identity for the incident with evidence and declared unknowns.", "source_refs": [ "SRC-002", "SRC-005" ], "findings": [ { "id": "mem-finding-identity", "name": "Case continuity", "description": "Keep one case master while retaining duplicate, split and related-case links; an incident report remains a separate reference.", "source_refs": [ "SRC-002", "SRC-005" ], "questions": [ { "id": "mem-finding-identity-q01", "text": "Which case identifier and issuing authority distinguish this incident from its alerts and reports?", "kind": "identity", "answer_data": [ "case_id", "issuing_authority", "alert_refs", "report_refs" ] }, { "id": "mem-finding-identity-q02", "text": "What evidence justifies merging, splitting or relating this case to another case?", "kind": "relationship", "answer_data": [ "related_case_refs", "relation_type", "rationale", "decision_ref" ] }, { "id": "mem-finding-identity-q03", "text": "What qualifies the case as suspected, confirmed, prevented, refuted or unresolved memory poisoning?", "kind": "classification", "answer_data": [ "assessment_status", "criteria_profile", "retained_context_link", "uncertainty" ] }, { "id": "mem-finding-identity-q04", "text": "Which accountable incident role owns the case and which memory owner retains system authority?", "kind": "ownership", "answer_data": [ "incident_owner_ref", "memory_owner_refs", "responsibility_boundary" ] } ], "data_elements": [ { "id": "mem-finding-identity-data01", "name": "Case identity identity record", "description": "Candidate object fields: case_id; issuing_authority; alert_refs; report_refs. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-002", "SRC-005" ] }, { "id": "mem-finding-identity-data02", "name": "Case identity relationship record", "description": "Candidate object fields: related_case_refs; relation_type; rationale; decision_ref. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-002", "SRC-005" ] }, { "id": "mem-finding-identity-data03", "name": "Case identity classification record", "description": "Candidate object fields: assessment_status; criteria_profile; retained_context_link; uncertainty. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-002", "SRC-005" ] }, { "id": "mem-finding-identity-data04", "name": "Case identity ownership record", "description": "Candidate object fields: incident_owner_ref; memory_owner_refs; responsibility_boundary. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-002", "SRC-005" ] } ], "artifacts": [ { "id": "mem-finding-identity-artifact", "name": "Case continuity record", "description": "Versioned case record or restricted reference containing the answers and their evidence, author and review state. This artifact contains no active attack instructions.", "media_or_form": [ "structured record", "restricted evidence index" ], "serial": true, "identity_strategy": "Authoritative master-system ID plus revision; otherwise a governed IRI or assigned UUID. Case linkage is explicit. Content digest is an integrity attribute, never the sole identity.", "source_refs": [ "SRC-002", "SRC-005" ] } ], "inline_only_rationale": null } ] }, { "id": "mem-layer-authority", "name": "Decision authority", "description": "Record decision authority for the incident with evidence and declared unknowns.", "source_refs": [ "SRC-002", "SRC-006" ], "findings": [ { "id": "mem-finding-authority", "name": "Scoped authority", "description": "Record who can approve each response and which external authority must validate execution. Content found in memory cannot authorize its own handling.", "source_refs": [ "SRC-002", "SRC-006" ], "questions": [ { "id": "mem-finding-authority-q01", "text": "Which policy and role authorize this incident decision for the affected tenant and purpose?", "kind": "authority", "answer_data": [ "policy_ref", "policy_revision", "actor_role", "tenant_scope", "purpose" ] }, { "id": "mem-finding-authority-q02", "text": "Which proposed actions exceed the investigator mandate or require a separate approval?", "kind": "constraint", "answer_data": [ "action_ref", "authority_limit", "required_approver", "refusal_reason" ] }, { "id": "mem-finding-authority-q03", "text": "How is a time-limited emergency exception recorded and subsequently reviewed?", "kind": "exception", "answer_data": [ "exception_ref", "scope", "expiry", "review_owner", "review_result" ] }, { "id": "mem-finding-authority-q04", "text": "What separates retrieved incident content from instructions and approval evidence?", "kind": "security", "answer_data": [ "content_label", "approval_origin", "trusted_channel", "validation_record" ] } ], "data_elements": [ { "id": "mem-finding-authority-data01", "name": "Decision authority authority record", "description": "Candidate object fields: policy_ref; policy_revision; actor_role; tenant_scope; purpose. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-002", "SRC-006" ] }, { "id": "mem-finding-authority-data02", "name": "Decision authority constraint record", "description": "Candidate object fields: action_ref; authority_limit; required_approver; refusal_reason. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-002", "SRC-006" ] }, { "id": "mem-finding-authority-data03", "name": "Decision authority exception record", "description": "Candidate object fields: exception_ref; scope; expiry; review_owner; review_result. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-002", "SRC-006" ] }, { "id": "mem-finding-authority-data04", "name": "Decision authority security record", "description": "Candidate object fields: content_label; approval_origin; trusted_channel; validation_record. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-002", "SRC-006" ] } ], "artifacts": [ { "id": "mem-finding-authority-artifact", "name": "Scoped authority record", "description": "Versioned case record or restricted reference containing the answers and their evidence, author and review state. This artifact contains no active attack instructions.", "media_or_form": [ "structured record", "restricted evidence index" ], "serial": true, "identity_strategy": "Authoritative master-system ID plus revision; otherwise a governed IRI or assigned UUID. Case linkage is explicit. Content digest is an integrity attribute, never the sole identity.", "source_refs": [ "SRC-002", "SRC-006" ] } ], "inline_only_rationale": null } ] } ] }, { "id": "mem-recognition", "name": "Recognition and assessment", "description": "Local proposed incident context for recognition and assessment.", "rationale": "Groups decisions that share a case concern while retaining external system authority.", "source_refs": [ "SRC-001", "SRC-003", "SRC-006" ], "layers": [ { "id": "mem-layer-signals", "name": "Detection signals", "description": "Record detection signals for the incident with evidence and declared unknowns.", "source_refs": [ "SRC-001", "SRC-003" ], "findings": [ { "id": "mem-finding-signals", "name": "Signal qualification", "description": "Record observations and competing explanations before promoting a suspicion. Detector confidence is distinct from case confirmation and actor attribution.", "source_refs": [ "SRC-001", "SRC-003" ], "questions": [ { "id": "mem-finding-signals-q01", "text": "Which observable difference or alert triggered concern about retained context?", "kind": "evidence", "answer_data": [ "signal_ref", "baseline_ref", "observed_difference", "observer" ] }, { "id": "mem-finding-signals-q02", "text": "Which benign update, stale information or ordinary generation error could explain the signal?", "kind": "quality", "answer_data": [ "alternative_hypotheses", "contrary_evidence", "review_status" ] }, { "id": "mem-finding-signals-q03", "text": "What are the suspected contamination interval, first observation and report times?", "kind": "temporal", "answer_data": [ "event_interval", "first_observed_at", "reported_at", "precision", "clock_basis" ] }, { "id": "mem-finding-signals-q04", "text": "What evidence threshold and reviewer support confirmation or refutation of this case?", "kind": "validation", "answer_data": [ "criterion_ref", "evidence_refs", "reviewer_ref", "disposition", "uncertainty" ] } ], "data_elements": [ { "id": "mem-finding-signals-data01", "name": "Detection signals evidence record", "description": "Candidate object fields: signal_ref; baseline_ref; observed_difference; observer. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-001", "SRC-003" ] }, { "id": "mem-finding-signals-data02", "name": "Detection signals quality record", "description": "Candidate object fields: alternative_hypotheses; contrary_evidence; review_status. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-001", "SRC-003" ] }, { "id": "mem-finding-signals-data03", "name": "Detection signals temporal record", "description": "Candidate object fields: event_interval; first_observed_at; reported_at; precision; clock_basis. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-001", "SRC-003" ] }, { "id": "mem-finding-signals-data04", "name": "Detection signals validation record", "description": "Candidate object fields: criterion_ref; evidence_refs; reviewer_ref; disposition; uncertainty. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-001", "SRC-003" ] } ], "artifacts": [ { "id": "mem-finding-signals-artifact", "name": "Signal qualification record", "description": "Versioned case record or restricted reference containing the answers and their evidence, author and review state. This artifact contains no active attack instructions.", "media_or_form": [ "structured record", "restricted evidence index" ], "serial": true, "identity_strategy": "Authoritative master-system ID plus revision; otherwise a governed IRI or assigned UUID. Case linkage is explicit. Content digest is an integrity attribute, never the sole identity.", "source_refs": [ "SRC-001", "SRC-003" ] } ], "inline_only_rationale": null } ] }, { "id": "mem-layer-surface", "name": "Context surface", "description": "Record context surface for the incident with evidence and declared unknowns.", "source_refs": [ "SRC-001", "SRC-003", "SRC-006" ], "findings": [ { "id": "mem-finding-surface", "name": "Contamination classification", "description": "Qualify the affected context role and alleged entry boundary without assuming training-time poisoning or proven malicious intent.", "source_refs": [ "SRC-001", "SRC-003", "SRC-006" ], "questions": [ { "id": "mem-finding-surface-q01", "text": "Which memory or context surface is implicated and how is it reused?", "kind": "classification", "answer_data": [ "surface_kind", "store_ref", "context_ref", "reuse_mode" ] }, { "id": "mem-finding-surface-q02", "text": "Which ingestion or update path is evidenced and which parts remain hypotheses?", "kind": "provenance", "answer_data": [ "entry_boundary_ref", "input_origin_ref", "evidence_status", "missing_links" ] }, { "id": "mem-finding-surface-q03", "text": "What distinguishes an attempted rejected write from committed or consumed contamination?", "kind": "constraint", "answer_data": [ "write_disposition", "commit_ref", "consumption_ref", "unknown_state" ] }, { "id": "mem-finding-surface-q04", "text": "Which related prompting or model-poisoning case needs a separate reference?", "kind": "relationship", "answer_data": [ "related_case_ref", "classification_mapping", "mapping_version", "distinction" ] } ], "data_elements": [ { "id": "mem-finding-surface-data01", "name": "Context surface classification record", "description": "Candidate object fields: surface_kind; store_ref; context_ref; reuse_mode. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-001", "SRC-003", "SRC-006" ] }, { "id": "mem-finding-surface-data02", "name": "Context surface provenance record", "description": "Candidate object fields: entry_boundary_ref; input_origin_ref; evidence_status; missing_links. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-001", "SRC-003", "SRC-006" ] }, { "id": "mem-finding-surface-data03", "name": "Context surface constraint record", "description": "Candidate object fields: write_disposition; commit_ref; consumption_ref; unknown_state. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-001", "SRC-003", "SRC-006" ] }, { "id": "mem-finding-surface-data04", "name": "Context surface relationship record", "description": "Candidate object fields: related_case_ref; classification_mapping; mapping_version; distinction. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-001", "SRC-003", "SRC-006" ] } ], "artifacts": [ { "id": "mem-finding-surface-artifact", "name": "Contamination classification record", "description": "Versioned case record or restricted reference containing the answers and their evidence, author and review state. This artifact contains no active attack instructions.", "media_or_form": [ "structured record", "restricted evidence index" ], "serial": true, "identity_strategy": "Authoritative master-system ID plus revision; otherwise a governed IRI or assigned UUID. Case linkage is explicit. Content digest is an integrity attribute, never the sole identity.", "source_refs": [ "SRC-001", "SRC-003", "SRC-006" ] } ], "inline_only_rationale": null } ] } ] }, { "id": "mem-evidence-scope", "name": "Evidence and affected scope", "description": "Local proposed incident context for evidence and affected scope.", "rationale": "Groups decisions that share a case concern while retaining external system authority.", "source_refs": [ "SRC-001", "SRC-002", "SRC-004" ], "layers": [ { "id": "mem-layer-custody", "name": "Evidence custody", "description": "Record evidence custody for the incident with evidence and declared unknowns.", "source_refs": [ "SRC-002", "SRC-004" ], "findings": [ { "id": "mem-finding-custody", "name": "Protected evidence index", "description": "Index controlled evidence with collector, revision and handling history. Store restricted payloads externally as inert material; a digest verifies bytes, not truth.", "source_refs": [ "SRC-002", "SRC-004" ], "questions": [ { "id": "mem-finding-custody-q01", "text": "Who collected each evidence item from which master revision and under what authority?", "kind": "provenance", "answer_data": [ "evidence_ref", "source_revision", "collector_ref", "collection_authority" ] }, { "id": "mem-finding-custody-q02", "text": "Which integrity and custody records permit the reviewer to assess later changes?", "kind": "evidence", "answer_data": [ "digest_algorithm", "digest", "custody_event_refs", "verification_result" ] }, { "id": "mem-finding-custody-q03", "text": "What sensitive content can be replaced by a restricted reference or a redacted derivative?", "kind": "privacy", "answer_data": [ "sensitivity", "minimization_basis", "restricted_ref", "derivative_ref" ] }, { "id": "mem-finding-custody-q04", "text": "Which environment and reader controls keep evidence inert during inspection?", "kind": "access", "answer_data": [ "review_environment_ref", "rendering_policy", "reader_scope", "access_log_ref" ] } ], "data_elements": [ { "id": "mem-finding-custody-data01", "name": "Evidence custody provenance record", "description": "Candidate object fields: evidence_ref; source_revision; collector_ref; collection_authority. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-002", "SRC-004" ] }, { "id": "mem-finding-custody-data02", "name": "Evidence custody evidence record", "description": "Candidate object fields: digest_algorithm; digest; custody_event_refs; verification_result. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-002", "SRC-004" ] }, { "id": "mem-finding-custody-data03", "name": "Evidence custody privacy record", "description": "Candidate object fields: sensitivity; minimization_basis; restricted_ref; derivative_ref. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-002", "SRC-004" ] }, { "id": "mem-finding-custody-data04", "name": "Evidence custody access record", "description": "Candidate object fields: review_environment_ref; rendering_policy; reader_scope; access_log_ref. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-002", "SRC-004" ] } ], "artifacts": [ { "id": "mem-finding-custody-artifact", "name": "Protected evidence index record", "description": "Versioned case record or restricted reference containing the answers and their evidence, author and review state. This artifact contains no active attack instructions.", "media_or_form": [ "structured record", "restricted evidence index" ], "serial": true, "identity_strategy": "Authoritative master-system ID plus revision; otherwise a governed IRI or assigned UUID. Case linkage is explicit. Content digest is an integrity attribute, never the sole identity.", "source_refs": [ "SRC-002", "SRC-004" ] } ], "inline_only_rationale": null } ] }, { "id": "mem-layer-propagation", "name": "Affected context set", "description": "Record affected context set for the incident with evidence and declared unknowns.", "source_refs": [ "SRC-001", "SRC-004" ], "findings": [ { "id": "mem-finding-propagation", "name": "Bounded lineage scope", "description": "Represent the assessed boundary of affected records and derived contexts. A derivation link indicates possible propagation, not proof that every descendant is compromised.", "source_refs": [ "SRC-001", "SRC-004" ], "questions": [ { "id": "mem-finding-propagation-q01", "text": "Which record revisions, summaries, embeddings and caches are included in the affected set?", "kind": "composition", "answer_data": [ "affected_refs", "revisions", "representation_kind", "scope_basis" ] }, { "id": "mem-finding-propagation-q02", "text": "Which derivation links support suspected propagation and where does lineage stop?", "kind": "relationship", "answer_data": [ "derivation_refs", "link_evidence", "traversal_boundary", "unknown_descendants" ] }, { "id": "mem-finding-propagation-q03", "text": "Which tenant, user, session or agent boundaries were crossed or remain unassessed?", "kind": "security", "answer_data": [ "namespace_refs", "boundary_status", "assessed_scope", "unassessed_scope" ] }, { "id": "mem-finding-propagation-q04", "text": "How are affected-set counts bounded by snapshot time, denominator and incomplete visibility?", "kind": "measurement", "answer_data": [ "snapshot_at", "count", "denominator", "estimate_method", "uncertainty" ] } ], "data_elements": [ { "id": "mem-finding-propagation-data01", "name": "Affected context set composition record", "description": "Candidate object fields: affected_refs; revisions; representation_kind; scope_basis. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-001", "SRC-004" ] }, { "id": "mem-finding-propagation-data02", "name": "Affected context set relationship record", "description": "Candidate object fields: derivation_refs; link_evidence; traversal_boundary; unknown_descendants. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-001", "SRC-004" ] }, { "id": "mem-finding-propagation-data03", "name": "Affected context set security record", "description": "Candidate object fields: namespace_refs; boundary_status; assessed_scope; unassessed_scope. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-001", "SRC-004" ] }, { "id": "mem-finding-propagation-data04", "name": "Affected context set measurement record", "description": "Candidate object fields: snapshot_at; count; denominator; estimate_method; uncertainty. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-001", "SRC-004" ] } ], "artifacts": [ { "id": "mem-finding-propagation-artifact", "name": "Bounded lineage scope record", "description": "Versioned case record or restricted reference containing the answers and their evidence, author and review state. This artifact contains no active attack instructions.", "media_or_form": [ "structured record", "restricted evidence index" ], "serial": true, "identity_strategy": "Authoritative master-system ID plus revision; otherwise a governed IRI or assigned UUID. Case linkage is explicit. Content digest is an integrity attribute, never the sole identity.", "source_refs": [ "SRC-001", "SRC-004" ] } ], "inline_only_rationale": null } ] } ] }, { "id": "mem-impact", "name": "Impact and prioritization", "description": "Local proposed incident context for impact and prioritization.", "rationale": "Groups decisions that share a case concern while retaining external system authority.", "source_refs": [ "SRC-002", "SRC-003", "SRC-005" ], "layers": [ { "id": "mem-layer-consequence", "name": "Observed consequence", "description": "Record observed consequence for the incident with evidence and declared unknowns.", "source_refs": [ "SRC-002", "SRC-003" ], "findings": [ { "id": "mem-finding-consequence", "name": "Consequence attribution", "description": "Separate exposure, consumption and downstream effects. Record observed consequences and alternative causes without equating suspicious content with realized harm.", "source_refs": [ "SRC-002", "SRC-003" ], "questions": [ { "id": "mem-finding-consequence-q01", "text": "Which downstream decision or action actually used the suspect context?", "kind": "event", "answer_data": [ "consumption_event_ref", "action_ref", "evidence_ref", "unknown_consumption" ] }, { "id": "mem-finding-consequence-q02", "text": "What supports or contradicts a causal link between contamination and the observed outcome?", "kind": "evidence", "answer_data": [ "causal_hypothesis", "supporting_refs", "contrary_refs", "assessment" ] }, { "id": "mem-finding-consequence-q03", "text": "Which confidentiality, integrity, availability or safety interests were affected or only exposed?", "kind": "classification", "answer_data": [ "interest", "affected_or_exposed", "stakeholder_ref", "consequence_ref" ] }, { "id": "mem-finding-consequence-q04", "text": "What impact estimate includes units, method, observation window and uncertainty?", "kind": "measurement", "answer_data": [ "impact_value", "unit", "method", "window", "uncertainty", "assessor" ] } ], "data_elements": [ { "id": "mem-finding-consequence-data01", "name": "Observed consequence event record", "description": "Candidate object fields: consumption_event_ref; action_ref; evidence_ref; unknown_consumption. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-002", "SRC-003" ] }, { "id": "mem-finding-consequence-data02", "name": "Observed consequence evidence record", "description": "Candidate object fields: causal_hypothesis; supporting_refs; contrary_refs; assessment. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-002", "SRC-003" ] }, { "id": "mem-finding-consequence-data03", "name": "Observed consequence classification record", "description": "Candidate object fields: interest; affected_or_exposed; stakeholder_ref; consequence_ref. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-002", "SRC-003" ] }, { "id": "mem-finding-consequence-data04", "name": "Observed consequence measurement record", "description": "Candidate object fields: impact_value; unit; method; window; uncertainty; assessor. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-002", "SRC-003" ] } ], "artifacts": [ { "id": "mem-finding-consequence-artifact", "name": "Consequence attribution record", "description": "Versioned case record or restricted reference containing the answers and their evidence, author and review state. This artifact contains no active attack instructions.", "media_or_form": [ "structured record", "restricted evidence index" ], "serial": true, "identity_strategy": "Authoritative master-system ID plus revision; otherwise a governed IRI or assigned UUID. Case linkage is explicit. Content digest is an integrity attribute, never the sole identity.", "source_refs": [ "SRC-002", "SRC-003" ] } ], "inline_only_rationale": null } ] }, { "id": "mem-layer-priority", "name": "Response priority", "description": "Record response priority for the incident with evidence and declared unknowns.", "source_refs": [ "SRC-002", "SRC-005" ], "findings": [ { "id": "mem-finding-priority", "name": "Contextual severity decision", "description": "Keep local priority, confidence and regulatory reportability separate. Severity requires an adopting profile and can change with evidence.", "source_refs": [ "SRC-002", "SRC-005" ], "questions": [ { "id": "mem-finding-priority-q01", "text": "Which severity and response priority were assigned using which profile revision?", "kind": "decision", "answer_data": [ "severity", "priority", "profile_ref", "profile_revision", "decision_ref" ] }, { "id": "mem-finding-priority-q02", "text": "How does uncertainty in affected scope alter the priority rationale?", "kind": "quality", "answer_data": [ "uncertainty_statement", "scope_assumption", "rationale", "reassessment_trigger" ] }, { "id": "mem-finding-priority-q03", "text": "Who determines whether a separate regulatory incident report is required?", "kind": "authority", "answer_data": [ "reporting_role", "report_ref", "applicability_assessment_ref", "status" ] }, { "id": "mem-finding-priority-q04", "text": "When must this priority be reassessed and which event brings that review forward?", "kind": "temporal", "answer_data": [ "review_due", "trigger_event", "assignee", "escalation_ref" ] } ], "data_elements": [ { "id": "mem-finding-priority-data01", "name": "Response priority decision record", "description": "Candidate object fields: severity; priority; profile_ref; profile_revision; decision_ref. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-002", "SRC-005" ] }, { "id": "mem-finding-priority-data02", "name": "Response priority quality record", "description": "Candidate object fields: uncertainty_statement; scope_assumption; rationale; reassessment_trigger. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-002", "SRC-005" ] }, { "id": "mem-finding-priority-data03", "name": "Response priority authority record", "description": "Candidate object fields: reporting_role; report_ref; applicability_assessment_ref; status. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-002", "SRC-005" ] }, { "id": "mem-finding-priority-data04", "name": "Response priority temporal record", "description": "Candidate object fields: review_due; trigger_event; assignee; escalation_ref. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-002", "SRC-005" ] } ], "artifacts": [ { "id": "mem-finding-priority-artifact", "name": "Contextual severity decision record", "description": "Versioned case record or restricted reference containing the answers and their evidence, author and review state. This artifact contains no active attack instructions.", "media_or_form": [ "structured record", "restricted evidence index" ], "serial": true, "identity_strategy": "Authoritative master-system ID plus revision; otherwise a governed IRI or assigned UUID. Case linkage is explicit. Content digest is an integrity attribute, never the sole identity.", "source_refs": [ "SRC-002", "SRC-005" ] } ], "inline_only_rationale": null } ] } ] }, { "id": "mem-response", "name": "Response decisions and assurance", "description": "Local proposed incident context for response decisions and assurance.", "rationale": "Groups decisions that share a case concern while retaining external system authority.", "source_refs": [ "SRC-001", "SRC-002", "SRC-006" ], "layers": [ { "id": "mem-layer-containment", "name": "Containment decision", "description": "Record containment decision for the incident with evidence and declared unknowns.", "source_refs": [ "SRC-001", "SRC-002", "SRC-006" ], "findings": [ { "id": "mem-finding-containment", "name": "Bounded containment record", "description": "Record intended scope, approval and observed receipt for containment. A request or local case status is not evidence that the external store has enforced it.", "source_refs": [ "SRC-001", "SRC-002", "SRC-006" ], "questions": [ { "id": "mem-finding-containment-q01", "text": "What containment objective and scoped targets were submitted to the authorized control owner?", "kind": "process", "answer_data": [ "objective", "target_refs", "target_revisions", "request_ref" ] }, { "id": "mem-finding-containment-q02", "text": "Which approval binds the intended containment action to the actor and target scope?", "kind": "authority", "answer_data": [ "approval_ref", "actor_ref", "approved_scope", "validity_interval" ] }, { "id": "mem-finding-containment-q03", "text": "Which external receipt establishes applied, partial, failed or unknown containment?", "kind": "state", "answer_data": [ "receipt_ref", "applied_scope", "execution_status", "observed_at" ] }, { "id": "mem-finding-containment-q04", "text": "What service impact, reversibility limits and monitoring conditions accompany containment?", "kind": "constraint", "answer_data": [ "availability_impact", "reversal_conditions", "residual_exposure", "monitoring_ref" ] } ], "data_elements": [ { "id": "mem-finding-containment-data01", "name": "Containment decision process record", "description": "Candidate object fields: objective; target_refs; target_revisions; request_ref. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-001", "SRC-002", "SRC-006" ] }, { "id": "mem-finding-containment-data02", "name": "Containment decision authority record", "description": "Candidate object fields: approval_ref; actor_ref; approved_scope; validity_interval. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-001", "SRC-002", "SRC-006" ] }, { "id": "mem-finding-containment-data03", "name": "Containment decision state record", "description": "Candidate object fields: receipt_ref; applied_scope; execution_status; observed_at. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-001", "SRC-002", "SRC-006" ] }, { "id": "mem-finding-containment-data04", "name": "Containment decision constraint record", "description": "Candidate object fields: availability_impact; reversal_conditions; residual_exposure; monitoring_ref. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-001", "SRC-002", "SRC-006" ] } ], "artifacts": [ { "id": "mem-finding-containment-artifact", "name": "Bounded containment record record", "description": "Versioned case record or restricted reference containing the answers and their evidence, author and review state. This artifact contains no active attack instructions.", "media_or_form": [ "structured record", "restricted evidence index" ], "serial": true, "identity_strategy": "Authoritative master-system ID plus revision; otherwise a governed IRI or assigned UUID. Case linkage is explicit. Content digest is an integrity attribute, never the sole identity.", "source_refs": [ "SRC-001", "SRC-002", "SRC-006" ] } ], "inline_only_rationale": null } ] }, { "id": "mem-layer-recovery", "name": "Recovery assurance", "description": "Record recovery assurance for the incident with evidence and declared unknowns.", "source_refs": [ "SRC-001", "SRC-002" ], "findings": [ { "id": "mem-finding-recovery", "name": "Restoration evidence", "description": "Record recovery criteria and external validation of restored context. Known-good status needs evidence; rollback of memory does not undo prior downstream actions.", "source_refs": [ "SRC-001", "SRC-002" ], "questions": [ { "id": "mem-finding-recovery-q01", "text": "What evidence qualifies a baseline or replacement context for this restoration?", "kind": "requirement", "answer_data": [ "baseline_ref", "revision", "qualification_evidence", "approver" ] }, { "id": "mem-finding-recovery-q02", "text": "Which independent-of-suspect-context checks cover restored records and derived representations?", "kind": "validation", "answer_data": [ "test_plan_ref", "coverage_refs", "evaluator_ref", "result_refs", "gaps" ] }, { "id": "mem-finding-recovery-q03", "text": "Which root-cause, cache, replica or downstream remediation items remain unresolved after restoration?", "kind": "state", "answer_data": [ "open_item_refs", "residual_risk", "affected_ref", "responsible_owner" ] }, { "id": "mem-finding-recovery-q04", "text": "Who accepts return to use for which scope and under which observation conditions?", "kind": "decision", "answer_data": [ "acceptance_ref", "authorized_scope", "monitoring_window", "rollback_trigger" ] } ], "data_elements": [ { "id": "mem-finding-recovery-data01", "name": "Recovery assurance requirement record", "description": "Candidate object fields: baseline_ref; revision; qualification_evidence; approver. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-001", "SRC-002" ] }, { "id": "mem-finding-recovery-data02", "name": "Recovery assurance validation record", "description": "Candidate object fields: test_plan_ref; coverage_refs; evaluator_ref; result_refs; gaps. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-001", "SRC-002" ] }, { "id": "mem-finding-recovery-data03", "name": "Recovery assurance state record", "description": "Candidate object fields: open_item_refs; residual_risk; affected_ref; responsible_owner. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-001", "SRC-002" ] }, { "id": "mem-finding-recovery-data04", "name": "Recovery assurance decision record", "description": "Candidate object fields: acceptance_ref; authorized_scope; monitoring_window; rollback_trigger. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-001", "SRC-002" ] } ], "artifacts": [ { "id": "mem-finding-recovery-artifact", "name": "Restoration evidence record", "description": "Versioned case record or restricted reference containing the answers and their evidence, author and review state. This artifact contains no active attack instructions.", "media_or_form": [ "structured record", "restricted evidence index" ], "serial": true, "identity_strategy": "Authoritative master-system ID plus revision; otherwise a governed IRI or assigned UUID. Case linkage is explicit. Content digest is an integrity attribute, never the sole identity.", "source_refs": [ "SRC-001", "SRC-002" ] } ], "inline_only_rationale": null } ] } ] }, { "id": "mem-closure", "name": "Communication and case continuity", "description": "Local proposed incident context for communication and case continuity.", "rationale": "Groups decisions that share a case concern while retaining external system authority.", "source_refs": [ "SRC-002", "SRC-004", "SRC-005", "SRC-007" ], "layers": [ { "id": "mem-layer-disclosure", "name": "Controlled disclosure", "description": "Record controlled disclosure for the incident with evidence and declared unknowns.", "source_refs": [ "SRC-005", "SRC-007" ], "findings": [ { "id": "mem-finding-disclosure", "name": "Recipient-specific report view", "description": "Create reviewable incident views with explicit recipients and restrictions. Sharing labels do not grant legal authority or replace payload access control.", "source_refs": [ "SRC-005", "SRC-007" ], "questions": [ { "id": "mem-finding-disclosure-q01", "text": "Which recipients and sharing restrictions apply to each incident view?", "kind": "access", "answer_data": [ "view_ref", "recipient_scope", "sharing_label", "additional_restrictions" ] }, { "id": "mem-finding-disclosure-q02", "text": "Which omissions or redactions prevent sensitive memory and unrelated tenant data from entering the report?", "kind": "privacy", "answer_data": [ "redaction_record_ref", "omitted_scope", "reason", "reviewer" ] }, { "id": "mem-finding-disclosure-q03", "text": "Which IODEF fields and local extensions can be mapped without losing uncertainty or identity?", "kind": "interoperability", "answer_data": [ "mapping_profile", "field_map", "unmapped_fields", "loss_report" ] }, { "id": "mem-finding-disclosure-q04", "text": "Which approval and receipt distinguish a prepared view from an externally delivered report?", "kind": "authority", "answer_data": [ "approval_ref", "delivery_ref", "delivery_status", "source_permission_ref" ] } ], "data_elements": [ { "id": "mem-finding-disclosure-data01", "name": "Controlled disclosure access record", "description": "Candidate object fields: view_ref; recipient_scope; sharing_label; additional_restrictions. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-005", "SRC-007" ] }, { "id": "mem-finding-disclosure-data02", "name": "Controlled disclosure privacy record", "description": "Candidate object fields: redaction_record_ref; omitted_scope; reason; reviewer. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-005", "SRC-007" ] }, { "id": "mem-finding-disclosure-data03", "name": "Controlled disclosure interoperability record", "description": "Candidate object fields: mapping_profile; field_map; unmapped_fields; loss_report. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-005", "SRC-007" ] }, { "id": "mem-finding-disclosure-data04", "name": "Controlled disclosure authority record", "description": "Candidate object fields: approval_ref; delivery_ref; delivery_status; source_permission_ref. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-005", "SRC-007" ] } ], "artifacts": [ { "id": "mem-finding-disclosure-artifact", "name": "Recipient-specific report view record", "description": "Versioned case record or restricted reference containing the answers and their evidence, author and review state. This artifact contains no active attack instructions.", "media_or_form": [ "structured record", "restricted evidence index" ], "serial": true, "identity_strategy": "Authoritative master-system ID plus revision; otherwise a governed IRI or assigned UUID. Case linkage is explicit. Content digest is an integrity attribute, never the sole identity.", "source_refs": [ "SRC-005", "SRC-007" ] } ], "inline_only_rationale": null } ] }, { "id": "mem-layer-continuity", "name": "Closure and retention", "description": "Record closure and retention for the incident with evidence and declared unknowns.", "source_refs": [ "SRC-002", "SRC-004", "SRC-007" ], "findings": [ { "id": "mem-finding-continuity", "name": "Reopenable case disposition", "description": "A case can close with explicit unresolved risk or be refuted; closure does not certify universal cleanup. Preserve minimal continuity while respecting scoped retention and disposal decisions.", "source_refs": [ "SRC-002", "SRC-004", "SRC-007" ], "questions": [ { "id": "mem-finding-continuity-q01", "text": "Which evidence and authorized disposition permit closure and which trigger reopens this case?", "kind": "lifecycle", "answer_data": [ "closure_basis", "disposition", "approver_ref", "reopening_trigger" ] }, { "id": "mem-finding-continuity-q02", "text": "Which retention schedule or hold governs each evidence class and its derivatives?", "kind": "retention", "answer_data": [ "record_class", "schedule_ref", "hold_ref", "review_date", "disposal_authority" ] }, { "id": "mem-finding-continuity-q03", "text": "How are accepted lessons assigned and their completion tracked outside this case?", "kind": "process", "answer_data": [ "lesson_ref", "action_owner", "followup_ref", "verification_status" ] }, { "id": "mem-finding-continuity-q04", "text": "What minimal tombstone preserves reference continuity after lawful deletion or correction?", "kind": "exception", "answer_data": [ "tombstone_id", "disposition_ref", "surviving_metadata", "redaction_basis" ] } ], "data_elements": [ { "id": "mem-finding-continuity-data01", "name": "Closure and retention lifecycle record", "description": "Candidate object fields: closure_basis; disposition; approver_ref; reopening_trigger. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-002", "SRC-004", "SRC-007" ] }, { "id": "mem-finding-continuity-data02", "name": "Closure and retention retention record", "description": "Candidate object fields: record_class; schedule_ref; hold_ref; review_date; disposal_authority. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-002", "SRC-004", "SRC-007" ] }, { "id": "mem-finding-continuity-data03", "name": "Closure and retention process record", "description": "Candidate object fields: lesson_ref; action_owner; followup_ref; verification_status. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-002", "SRC-004", "SRC-007" ] }, { "id": "mem-finding-continuity-data04", "name": "Closure and retention exception record", "description": "Candidate object fields: tombstone_id; disposition_ref; surviving_metadata; redaction_basis. Preserve unknown, absent and not-applicable distinctly; nested instance schema remains a hold.", "value_kind": "object", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-002", "SRC-004", "SRC-007" ] } ], "artifacts": [ { "id": "mem-finding-continuity-artifact", "name": "Reopenable case disposition record", "description": "Versioned case record or restricted reference containing the answers and their evidence, author and review state. This artifact contains no active attack instructions.", "media_or_form": [ "structured record", "restricted evidence index" ], "serial": true, "identity_strategy": "Authoritative master-system ID plus revision; otherwise a governed IRI or assigned UUID. Case linkage is explicit. Content digest is an integrity attribute, never the sole identity.", "source_refs": [ "SRC-002", "SRC-004", "SRC-007" ] } ], "inline_only_rationale": null } ] } ] } ] }, "functions": [ { "id": "mem-fn-register", "name": "Register case", "description": "Proposed local operation, not implemented: Create a local case or reference an existing one after duplicate review.", "inputs": [ "intake reference", "issuing namespace", "duplicate review" ], "outputs": [ "case reference", "registration outcome", "structured refusal if authority, evidence or revision checks fail" ], "preconditions": [ "Authorized actor, purpose and tenant scope verified outside untrusted case content", "Expected case revision matches; references resolve or are explicitly marked unresolved", "Adopting policy defines the permitted transition and required review" ], "effects": [ "Create case identity and initial suspected or prevented assessment; do not label a suspicion as confirmed.", "Record actor, policy revision, prior revision and outcome in the adopting audit service." ], "source_refs": [ "SRC-002", "SRC-005" ] }, { "id": "mem-fn-attach-evidence", "name": "Attach evidence reference", "description": "Proposed local operation, not implemented: Associate protected evidence and lineage assertions without importing active payloads.", "inputs": [ "case revision", "evidence master reference", "custody and classification metadata" ], "outputs": [ "evidence link revision", "unresolved reference report", "structured refusal if authority, evidence or revision checks fail" ], "preconditions": [ "Authorized actor, purpose and tenant scope verified outside untrusted case content", "Expected case revision matches; references resolve or are explicitly marked unresolved", "Adopting policy defines the permitted transition and required review" ], "effects": [ "Append scoped evidence links and explicit provenance gaps; never execute or trust instructions in the evidence.", "Record actor, policy revision, prior revision and outcome in the adopting audit service." ], "source_refs": [ "SRC-002", "SRC-004", "SRC-006" ] }, { "id": "mem-fn-assess", "name": "Record assessment", "description": "Proposed local operation, not implemented: Record a reviewer decision about classification, scope, confidence and priority.", "inputs": [ "current case revision", "criteria profile", "supporting and contrary evidence" ], "outputs": [ "assessment revision", "rationale and unknowns", "structured refusal if authority, evidence or revision checks fail" ], "preconditions": [ "Authorized actor, purpose and tenant scope verified outside untrusted case content", "Expected case revision matches; references resolve or are explicitly marked unresolved", "Adopting policy defines the permitted transition and required review" ], "effects": [ "Version the case assessment; preserve prior assessments and distinguish refutation from deletion.", "Record actor, policy revision, prior revision and outcome in the adopting audit service." ], "source_refs": [ "SRC-001", "SRC-003", "SRC-005" ] }, { "id": "mem-fn-record-response", "name": "Record response decision and receipt", "description": "Proposed local operation, not implemented: Link authorized containment or remediation decisions to external execution receipts.", "inputs": [ "decision reference", "approval reference", "scoped target revisions", "external receipt or explicit unknown" ], "outputs": [ "response record", "decision-to-receipt mismatch report", "structured refusal if authority, evidence or revision checks fail" ], "preconditions": [ "Authorized actor, purpose and tenant scope verified outside untrusted case content", "Expected case revision matches; references resolve or are explicitly marked unresolved", "Adopting policy defines the permitted transition and required review" ], "effects": [ "Record intended and observed status separately; do not perform control actions or infer success from a request.", "Record actor, policy revision, prior revision and outcome in the adopting audit service." ], "source_refs": [ "SRC-002", "SRC-006" ] }, { "id": "mem-fn-review-recovery", "name": "Record recovery review", "description": "Proposed local operation, not implemented: Bind baseline qualification and external validation evidence to a scoped recovery decision.", "inputs": [ "qualified baseline reference", "evaluation result references", "residual issue list", "reviewer decision" ], "outputs": [ "recovery assessment", "accepted scope and remaining holds", "structured refusal if authority, evidence or revision checks fail" ], "preconditions": [ "Authorized actor, purpose and tenant scope verified outside untrusted case content", "Expected case revision matches; references resolve or are explicitly marked unresolved", "Adopting policy defines the permitted transition and required review" ], "effects": [ "Record return-to-use recommendation or refusal; operational release remains the system owner responsibility.", "Record actor, policy revision, prior revision and outcome in the adopting audit service." ], "source_refs": [ "SRC-001", "SRC-002" ] }, { "id": "mem-fn-dispose", "name": "Close, reopen or retire case record", "description": "Proposed local operation, not implemented: Apply an authorized local lifecycle decision with retention checks and reference continuity.", "inputs": [ "case revision", "disposition basis", "authority record", "retention and hold evaluation" ], "outputs": [ "new lifecycle revision or refusal", "tombstone reference when applicable", "structured refusal if authority, evidence or revision checks fail" ], "preconditions": [ "Authorized actor, purpose and tenant scope verified outside untrusted case content", "Expected case revision matches; references resolve or are explicitly marked unresolved", "Adopting policy defines the permitted transition and required review" ], "effects": [ "Transition the local record only; preserve traceable decisions and perform no external deletion, report delivery or remediation.", "Record actor, policy revision, prior revision and outcome in the adopting audit service." ], "source_refs": [ "SRC-002", "SRC-004", "SRC-007" ] } ], "composition": [ { "target": "WM-AI-010", "relation": "REFERENCE", "purpose": "Optional separate AI incident report. Registry parent candidate does not establish subtype inheritance or universal reportability.", "required": false, "source_refs": [ "SRC-002", "SRC-005" ] }, { "target": "WM-MEM-001", "relation": "REFERENCE", "purpose": "Affected memory store and tenant namespace master, when identifiable. Store operation and retention execution stay external.", "required": false, "source_refs": [ "SRC-001", "SRC-006" ] }, { "target": "WM-MEM-018", "relation": "REFERENCE", "purpose": "Optional trust assessment evidence with its own revision and scope; no low-score-to-incident implication.", "required": false, "source_refs": [ "SRC-001", "SRC-003" ] }, { "target": "WM-MEM-020", "relation": "REFERENCE", "purpose": "Optional quarantine or redaction record and receipt. This case does not own the control lifecycle.", "required": false, "source_refs": [ "SRC-001", "SRC-006" ] }, { "target": "W3C PROV-O", "relation": "ALIGN", "purpose": "Conceptual lineage and attribution mapping; truth and causality require additional evidence.", "required": false, "source_refs": [ "SRC-004" ] }, { "target": "IETF RFC 7970 IODEF v2", "relation": "ALIGN", "purpose": "Candidate exchange projection requiring an explicit extension and loss profile.", "required": false, "source_refs": [ "SRC-005" ] }, { "target": "FIRST TLP 2.0", "relation": "ALIGN", "purpose": "Optional recipient sharing marks, subject to stricter policy, legal basis and source permission.", "required": false, "source_refs": [ "SRC-007" ] } ], "serviceLayers": { "dimension": { "owner_package_requirements": [ "Designate an incident custodian and memory system authority as roles, with tenant scope", "Bind a versioned classification, response, retention and disclosure profile", "Declare storage, interface and process bindings and evidence-access controls", "Pin candidate neighbor model versions before operational integration" ], "namespace_guidance": "Use an adopting authority namespace for case and artifact IDs. Tenant scope is explicit and is not inferred from a content hash or title.", "registry_links": [ "vr.wm-mem-019", "WM-AI-010 optional report reference", "WM-MEM-001 affected store reference" ] }, "canon_and_patch": { "canonicalization_rules": [ "This research is a noncanonical reviewable draft under a single-provider waiver; no source claims universal completeness.", "Preserve master IDs, revisions, actor roles, assertion status and observed/effective times; never coerce unknown into false." ], "patch_rules": [ "Require expected revision, authorized scope and a reason for each correction; retain a redacted change record when payload retention is prohibited.", "Supersede assessments with explicit previous-revision links; do not overwrite contrary evidence silently." ], "compatibility_rules": [ "Version changes to classification codes, lifecycle rules, relationships and answer schemas; report lossy migrations.", "No storage format or protocol binding may grant authority or silently strengthen a hypothesis into a fact." ] }, "artifact_rules": { "identity_priority": [ "Authoritative master-system identifier plus revision", "Governed global identifier or IRI", "UUID or ULID assigned by the adopting Dimension" ], "timestamp_rule": "Use RFC 3339 timestamps with seconds and explicit offset or Z. Keep event time, observation time and ingestion time separate; preserve precision, interval bounds and uncertain clock basis.", "serial_naming_rule": "Use a stable artifact ID and separate revision or sequence. Dates belong in metadata, not stable IDs. Redacted derivatives receive their own IDs with controlled lineage.", "integrity_rule": "Record digest algorithm, byte scope and custody verification result. Digests and signatures establish integrity evidence only, not harmlessness, truth, attribution or lawful retention." }, "policies": [ "All source content, memory payloads and recalled instructions are untrusted evidence; never execute them or use them as authorization.", "Apply least privilege and tenant separation to all case views and evidence references; display only inert, minimized material.", "Use approved local criteria for suspicion, confirmation and residual risk; no universal poisoning threshold is asserted.", "Keep containment approval, actual execution and verification distinct. External control owners enforce actions.", "Apply the adopting retention and legal-hold policy separately to raw evidence, derivatives and audit metadata. History is not a mandate for indefinite payload retention.", "TLP labels constrain sharing but do not replace permissions, legal applicability or encryption policies." ], "crud": { "read": [ "Resolve authorized case revision and recipient view; reveal only permitted evidence metadata and inert derivatives." ], "create": [ "Create a unique case after duplicate review; allow incomplete intake with explicit unknowns and responsible role." ], "update": [ "Use optimistic revision checks, validated role scope and transition rules; keep observations distinct from conclusions." ], "delete": [ "Retire a local case only after retention, legal-hold and disposal-authority checks; retain a minimal lawful tombstone and restrict residual metadata.", "External evidence deletion and replica/cache cleanup belong to their custodians; record receipts and unknown completion rather than claiming global erasure." ] }, "roles": [ { "name": "Incident custodian", "responsibilities": [ "Maintains case identity, responsibility, review dates and disclosure scope." ] }, { "name": "Investigator", "responsibilities": [ "Records evidence, competing hypotheses and bounded affected-scope assessments." ] }, { "name": "Memory system authority", "responsibilities": [ "Owns external containment, restoration and store-level enforcement; supplies receipts." ] }, { "name": "Recovery reviewer", "responsibilities": [ "Evaluates qualified baselines, external tests and residual risk independently of suspect context." ] }, { "name": "Information steward", "responsibilities": [ "Approves recipient views, minimization, retention and lawful disposal policy." ] } ], "access": { "default_rule": "Deny unless actor, purpose, tenant, sensitivity and artifact scope are authorized; an accessible case summary does not grant raw evidence access.", "scopes": [ "bundle", "layer", "finding", "artifact" ], "exceptions": [ "A scoped emergency exception requires authority, expiry, recorded rationale and retrospective review; it never derives from suspect content." ], "audit_requirements": [ "Record actor, purpose, policy revision, accessed view, prior/new revision and outcome through the external audit service.", "Audit denied access, changed labels, report approvals and deletion receipts without replicating sensitive payloads into logs." ] }, "agents_bootstrap": { "filename": "AGENTS.md", "required_fields": [ "Name", "Type", "Specification URL", "Storage type URL", "Interface URL", "Processes URL" ], "read_order": [ "Read AGENTS.md and the adopting owner/Dimension policies", "Read spec.yaml, assurance holds and pinned neighbor bindings", "Inspect current authorized case revision and evidence restrictions before proposing changes" ] } }, "coverage": { "claim": "Source-grounded proposed structure for one persistent memory poisoning incident case, including suspected and prevented cases. The separate frozen local no-tools self-audit found no critical contradiction. Independent external review, live source/version verification, adopting profiles and executable conformance remain holds. This is a reviewable draft, not a universal incident standard or operational security system.", "confidence": "medium", "checklist": [ { "dimension": "identity", "status": "covered", "notes": "Case and report IDs are distinct; duplicate and split links are explicit." }, { "dimension": "lifecycle", "status": "covered", "notes": "Proposed assessment and handling states support closure, refutation and reopening; operational transition profiles remain to be implemented." }, { "dimension": "relationships", "status": "covered", "notes": "Neighbor masters retain stores, trust assessments, quarantine controls and regulatory reports." }, { "dimension": "temporal", "status": "covered", "notes": "Contamination interval, observation, reporting and recovery times preserve uncertainty." }, { "dimension": "provenance", "status": "covered", "notes": "Restricted evidence and qualified derivation assertions distinguish lineage from proof of contamination." }, { "dimension": "ownership", "status": "covered", "notes": "Role-based incident custody does not transfer operational system authority." }, { "dimension": "validation", "status": "gap", "notes": "Research structure is testable; nested instance schemas and executable lifecycle tests are not supplied." }, { "dimension": "access", "status": "covered", "notes": "Tenant, purpose, view and artifact scopes plus exceptional access review are proposed." }, { "dimension": "retention and deletion", "status": "covered", "notes": "Policy-bound disposal, holds, derivatives and external cleanup receipts are distinguished." }, { "dimension": "interoperability", "status": "gap", "notes": "IODEF, PROV-O and TLP alignments require pinned mappings and loss tests." }, { "dimension": "direct properties", "status": "covered", "notes": "Case status, context surface, assessed scope, priority and uncertainty are nonphysical properties." }, { "dimension": "recognition and observation", "status": "covered", "notes": "Signals, competing explanations and consumed-context evidence support assessment." }, { "dimension": "capabilities and actions", "status": "covered", "notes": "Six proposed local operations record evidence and decisions without executing response." }, { "dimension": "physical dimensions", "status": "not-applicable", "notes": "The root is a case record, not a physical object; quantities describe measured impact only." }, { "dimension": "independent review", "status": "gap", "notes": "Codex-only research requires a separate local self-audit and remains externally unreviewed." } ], "known_omissions": [ "Nested instance schemas, lifecycle transition tables, conformance fixtures and storage bindings", "Independent external review and full live source/version and errata verification", "Cross-tenant scope discovery, deletion completion and recovery efficacy depend on external implementations", "Sector-specific reporting, privacy, retention and safety profiles" ], "conflicts": [], "regional_assumptions": [ "No jurisdiction, reportability threshold, retention duration or regulatory deadline is universal. Qualified adopting profiles must supply them." ], "adversarial_checks": [ "A signed but misleading memory entry is not made trustworthy by its digest.", "A rejected write can be a prevented case without a committed poisoned record.", "One suspicious descendant does not prove all derived contexts compromised.", "A rollback receipt does not reverse downstream actions or certify a clean baseline.", "An external report parent candidate does not impose reportability on every case.", "Refutation preserves authorized history without requiring perpetual raw payload retention." ] }, "researchAdjudication": { "providerMode": "single-provider-waiver", "activeProviders": [ "codex" ], "waivedProviders": [ "claude", "grok" ], "providerPolicy": { "contract_version": "1.0.0", "mode": "single-provider-waiver", "effective_at": "2026-09-06T00:00:00Z", "scope": "Canonical single-stream subject-model research after the six-workstream consolidation", "active_providers": [ "codex" ], "waived_providers": [ { "provider": "claude", "authorized_by": "repository owner", "authorized_at": "2026-09-06T00:00:00Z", "reason": "Claude produced no result on prior 1800-second and 900-second attempts and again timed out on bounded 600-second Sonnet and 300-second Haiku passes. The owner prioritized completion over provider availability." }, { "provider": "grok", "authorized_by": "repository owner", "authorized_at": "2026-09-06T00:00:00Z", "reason": "The repository owner authorized completion without Grok when Grok is unavailable, slow or schema-invalid. Grok may still be attempted as a bounded supplemental reviewer, but its failure never blocks a valid Claude plus no-tools result." } ], "review_rule": "Codex may complete source-grounded fallback research after bounded Claude and Grok attempts fail. It requires a separate no-tools adversarial audit and remains reviewable-draft with a visible absence-of-external-review hold.", "supplemental_provider_attempts": [ { "provider": "claude", "required": false, "maximum_attempts": 1, "failure_policy": "record-and-continue", "admission_rule": "Use only a locally schema-valid result whose sources and boundaries survive adjudication." }, { "provider": "grok", "required": false, "maximum_attempts": 1, "failure_policy": "record-and-continue", "admission_rule": "Use only a locally schema-valid result whose sources and boundaries survive adjudication." } ] }, "boundaryDecision": { "entry_kind": "entity", "status": "accepted", "rationale": "The case retains identity across multiple observations, assessments, responses, closure and reopening. It is not a single contamination event or a memory store. The registry standalone-mm value describes its record plane. Registry parent candidate WM-AI-010 is reconciled as an optional report reference because regulatory reportability and incident identity are distinct." }, "decisions": [ { "concept": "Persistent incident case", "disposition": "accepted", "rationale": "Stable case identity, related-case links and reopenable disposition support entity classification. Alerts, malicious-content artifacts and external reports retain separate identities." }, { "concept": "Registry parent inheritance", "disposition": "rejected as mandatory inheritance", "rationale": "The frozen relation ledger contains no rows. The registry parent candidate WM-AI-010 is explicitly retained as an optional report reference; a suspected or prevented case need not meet a regulatory threshold." }, { "concept": "Retained-context boundary", "disposition": "accepted with qualification", "rationale": "The scope requires a retained or reused context link and permits reuse within a session. It excludes isolated one-time input and model-weight poisoning without that link; rejected writes can remain prevented or suspected cases." }, { "concept": "Detector verdict and attacker attribution", "disposition": "separated", "rationale": "Signal qualification includes benign alternatives, contrary evidence and uncertainty. A detector score, stale content or low memory trust does not alone establish poisoning or a malicious actor." }, { "concept": "Lineage and affected-set certainty", "disposition": "qualified", "rationale": "Derivation edges support scoped propagation hypotheses without declaring all descendants compromised. Snapshot time, denominator and unassessed boundaries constrain counts and scope assertions." }, { "concept": "Evidence integrity and authority", "disposition": "separated", "rationale": "Digests and signatures are integrity evidence, not proof of harmlessness or truth. Inert restricted evidence cannot authorize its own handling; approvals come from separately validated authority." }, { "concept": "Containment and external control ownership", "disposition": "accepted as records only", "rationale": "Requests, approval and execution receipts are distinct. The store and quarantine masters retain operational enforcement; local status cannot establish that containment was applied." }, { "concept": "Recovery and downstream effects", "disposition": "qualified", "rationale": "Recovery requires baseline qualification, external evaluation and explicit residual issues. A rollback receipt does not reverse prior downstream actions, clear all derivatives or certify a universal clean state." }, { "concept": "Six local operations", "disposition": "accepted as proposed only", "rationale": "Operations record references and decisions with authority, revision and refusal conditions. None performs external remediation, report delivery or global deletion. Creation must bind expected absence in a future implementation of the revision check." }, { "concept": "Retention and reference continuity", "disposition": "accepted with adopting policy", "rationale": "Raw evidence, derivatives and minimal tombstones have separate retention and disposal checks. Revision continuity does not require indefinite sensitive-payload retention; external cleanup completion requires receipts." }, { "concept": "Disclosure and interoperability", "disposition": "qualified", "rationale": "Recipient views preserve restrictions and redactions. TLP is not legal or execution authority, and IODEF/PROV-O alignments are conceptual; mapping uncertainty and extension losses remain explicit gaps." }, { "concept": "Source verification", "disposition": "held", "rationale": "Selected readable web-service evidence is recorded for seven official documents. Direct HTTP was not attempted under the owner-reported restriction; status and body hashes remain unmeasured. Living revisions and errata need follow-up." }, { "concept": "Executable instance completeness", "disposition": "deferred", "rationale": "The candidate object groups and proposed lifecycle are useful research context but are not nested schemas, state-transition tables, tested detectors or conformance bindings. Operational adoption requires those additional artifacts." }, { "concept": "Independent external review", "disposition": "waived and held", "rationale": "Only Codex research is admitted. This separate no-tools phase is a local self-audit of frozen evidence, not a second-provider result or evidence of inter-provider agreement." } ], "publicationHolds": [ "Independent external review is absent under the owner-authorized single-provider waiver. Claude and Grok were skipped with zero attempts; this separate local Codex no-tools self-audit is not an independent second-provider review.", "Live source/version verification remains incomplete. Seven official documents supplied selected readable web-service evidence, but direct HTTP was not attempted under the owner-reported sandbox restriction. HTTP statuses, redirects and body hashes are unmeasured; immutable revisions, current status and errata remain open. The coordinator checker is prepared.", "Adopting tenant, sector, privacy, retention, reporting, authority and safety profiles require qualified review. No universal confirmation threshold, reportability rule, retention period or recovery efficacy is claimed.", "Nested instance schemas, creation/revision and lifecycle transition rules, pinned neighbor bindings, IODEF/PROV-O/TLP mappings and adversarial conformance fixtures remain incomplete. Proposed functions do not implement operational containment, remediation, report delivery or deletion.", "Independent external review was explicitly waived by the repository owner; this codex-only result remains a reviewable draft." ], "deferredResearch": [ "Restore independent external review before canonical or publishable-draft promotion.", "Run check_sources.py outside the sandbox and reconcile source revisions, errata, licensing and profile applicability without equating HTTP success with substantive verification.", "Implement nested instance and transition schemas, including expected absence for creation and expected revision for updates; test prevented incidents, false positives, uncertain lineage, partial containment, contaminated baselines and lawful disposal.", "Pin neighbor contracts and implement loss-aware exchange mappings; validate tenant isolation, external receipts and residual-risk acceptance in an authorized adoption environment." ] }, "statistics": { "sources": 7, "bundles": 6, "layers": 12, "findings": 12, "questions": 48, "artifacts": 12, "functions": 6 } }