memory-firewall 0.1.0

Trust-gated memory for AI agents: guesses can't act.

AI Memory Firewall

Trust-gated memory for AI agents. Internal AI analysis is the lowest authority — an agent's own words are not evidence.

The problem

AI agents poison their own memory. They store guesses, summaries, and inferences as if they were facts, retrieve them later with full confidence, and act on them. A guess written on Monday reads as truth on Wednesday — and everything built on it inherits the poison.

The rule

Every claim carries exactly one trust label — Verified, Reported, or Guessed — and guesses can't act. A guess can be read, discussed, and stored, but it cannot update the record, send the email, or drive an action until something external confirms it.

The architecture

Claims enter through the Claim Check layer, which decides what a claim is worth. Trust is only upgraded by the Ground Truth layer, which settles claims against reality via outcome receipts — and receipts are signed and hash-linked, so trust cannot be self-asserted or history rewritten (memory_firewall/signing.py).

Three doors

You want to…	Go to	Setup
Use it now — any model, zero install	prompts/ — quick prompt, Claude Skill, coding-agent rules, human templates	60 seconds
Build with it — enforce in code, or install as an MCP server	memory_firewall/ — the runtime package; MCP: prompts/mcp/	pip install "memory-firewall[mcp]"
Deploy it — unforgeable provenance	memory_firewall/signing.py — signed receipts, provenance chains	Key management required

Same labels at every level; only the guarantee gets stronger. Full tier architecture: TIERS.md. Detailed instructions with four worked use cases per tier, including copy-paste prompts: USAGE.md.

Benchmark

Scored against its own 50-case adversarial dataset: 0% attack success rate vs. 100% for a no-firewall baseline — zero of 37 adversarial cases were allowed to drive an action. Reproduce it from an installed package:

pip install memory-firewall
python -m memory_firewall.benchmark           # or: memory-firewall-benchmark

Full numbers and the honest precision tradeoff: BENCHMARK.md.

Status

Early public restructure, moving fast. Shipped: the Level 1 prompt pack, the Claim Check runtime with a tiered (rules + model-judge) classifier, signed outcome receipts enforced at the action gate (in code and in the packaged store/MCP), the scored benchmark, and an installable MCP server. All tests run in CI on every push.

Related work

Memory poisoning is a standardized threat (OWASP ASI06:2026 — Memory & Context Poisoning) with a live attack literature (MINJA, AgentPoison). How this firewall relates to those attacks and to guardrail tools like Meta's LlamaFirewall — and what is novel here — is in RELATED_WORK.md.

Lineage

Formerly developed as the ACF/BOS Memory Firewall (research archive). The old acronyms survive only in this note: ACF is now the Claim Check layer; the outcome-resolution layer is now the Ground Truth layer.

License

Licensed under the Apache License 2.0 — free to use, modify, and build on, including commercially, with a patent grant and no copyleft. Copyright 2026 CREATORSEAL CORPORATION; see NOTICE. The Apache license covers the code, schemas, and prompt packs in this repository; the "Memory Firewall" and "CreatorSeal" names are not licensed for use in a way that implies endorsement (Apache 2.0 §6).