[drk-ram]

What changed

Memory writes and reads now carry cross-session lineage. memoryStore gains a lineage member (lineage_id, origin_session_id, the writing session's provenance_summary), and each memoryContextRetrieval result echoes it with the stored provenance. memory_id is required on both hooks when the scope is user, tenant or global. Stored untrusted content can no longer read back as system, user_input or an unattributed retrieved entry under ACS-Provenance. Specification section 7.3 states the rules a schema cannot enforce.

Which issue does this implement

Closes #501

• This is an editorial correction (typo, grammar, link, formatting) with no change in
  meaning, so it needs no issue

Base branch

• integration, because this touches the specification, schemas, a reference
  implementation, an adapter, tests, or CI
• main, because every changed path is on the documentation lane allowlist in
  CONTRIBUTING.md

Type of change

• Specification change (schema, hooks, events, AgBOM)
• Reference implementation or adapter
• Documentation
• Tooling or CI
• Governance (licensing, security policy, contributor docs)

Specification changes

• I opened a Discussion before this PR
• Schema changes validate against the JSON Schema spec
• I described the impact on downstream implementers below

Breaking for implementers? Mostly additive. The base schemas gain optional members, so an ACS-Core sender that sends no lineage still validates, with two exceptions. A write or read in a user, tenant or global store without a memory_id is now invalid, and a result that carries lineage must have provenance.origin: retrieved. A sender claiming ACS-Provenance must now send lineage on every write and read result, a non-empty derived_from on each result's provenance, and the writer's provenance_summary.

Choices made for the issue's open questions:

• Identifier. A store-scoped lineage_id, plus origin_session_id, because a provenance_id resolves only in its own session. The result's provenance.derived_from cites the lineage_id (prose in section 7.3, since a schema cannot compare siblings).
• Join key. memory_id required when the scope is not session.
• No lineage. A Guardian treats the entry as the least-trusted origin it knows, or denies it, and never as fresh.
• Labels across sessions. The writer's provenance_summary travels in lineage and the reading session starts from at least its origins_seen.
• Trust stays off the wire. Section 7.1 reserves trust for a later version, so this carries facts (origin, lineage, summary) and leaves classification to policy. It adds no source_trust or taint-tag member.
• Reference Guardian. Dispatching memoryStore and memoryContextRetrieval in methods_evaluated is a code change and is left to a follow-up.

I tested this

• I synced my branch with the base branch before opening this

• uv run pytest -v passes on my machine

• uv run mkdocs build --strict passes on my machine

• uv run pytest tests/test_memory_lineage.py -q: 45 passed. The 31 schema and prose tests fail when the specification and docs changes are stashed.

• uv run pytest -q: 1245 passed, 10 failed, 20 errors. The failures and errors are the same symlink, subprocess and timing tests in test_fetch_roadmap, test_overrides, test_pr_intake_workflow, test_publish_schemas and test_closing_choice that fail on this Windows machine without this change.

• uv run mkdocs build --strict: passes

Checklist

• Commits are signed off with git commit -s (required by the DCO)
• Prose follows STYLE.md
• No secrets, tokens, or internal URLs in the diff

Security

• This change has no security impact

This closes a memory-poisoning path (ASI06): untrusted content written in one session could be read back in another as trusted recall. The change adds wire members and rules that let a Guardian recover the trust basis of a stored entry.

[github-actions]

Thanks for this. It is queued rather than ignored. A lead has not reviewed this pull request yet. A lead will read it when they have time, and we can't promise a date. Nothing here is rejected. If a check below fails, please fix it. A pull request that waits a long time may be closed, and you can reopen it later.