The verifiable epistemic trail: agent memory as auditable state, not text

donto papers · original research · 2026-06-13 · reframing + method, working draft v1

Abstract. Agent memory is almost universally a pile of remembered text — chunks, summaries, embedded passages — recalled by similarity and pasted into a context window. That representation answers "what did the user say about X" but structurally cannot answer the questions that matter when an agent's memory is wrong, contested, or audited: what did the agent believe at 14:02 last Tuesday, why did it believe it, what evidence anchored it, and was that belief later corrected? We argue agent memory should instead be a bitemporal, evidence-anchored claim trail — every write a holder-scoped claim stamped with transaction-time and bound to its source — and that this reframing turns accountability into a query rather than a feature. We show the trail already exists in donto's live store: ~1.505M holder-scoped memory records (donto_x_memory_record), ~158.6K of them written by one agent (agent:omega-bot) across 15 days, each anchored to a donto_statement and recallable as of any past instant with a single tx_time @> predicate. We demonstrate epistemic replay working today — the agent held 37,243 currently-believed records as of 2026-06-05 versus ~158.6K now, and the difference is computable, not lost — and we map the recall audit log (donto_x_memory_access, 49,349 retrieved events with actor, query-hash, rank and score). We are blunt about the gaps: the replay query layer is a raw SQL predicate, not a product surface; the trail is a mix of typed and episodic claims, not a uniform chunk store; only one of five audit access_kinds is populated; and there is no accountability benchmark — agent-memory benchmarks score recall, and none of them asks the questions a trail is for. Building that benchmark is the contribution this paper sets up; the substrate is already the trail.

1. The reframing: from "what is remembered" to "what was believed, and why"

Every agent-memory system answers one question well — given this query, what relevant prior text exists? — because every agent-memory system is, underneath, a retriever over remembered text. LoCoMo, LongMemEval, BEAM all score this: did the system surface the passage that lets the reader answer the question. Our companion empirical work (Answer-Shaping) lives entirely inside that frame: it improves what gets surfaced and in what shape.

But there is a second class of question that an agent in production will be asked and that a text-pile cannot answer:

These are not exotic. They are the questions a regulator, a debugger, a red-teamer, or a user disputing "you told me X" actually asks. The standard memory representation answers none of them, because text remembered is not state recorded: a chunk has no transaction-time of its own (the index is mutated in place), no separable evidence link, and no notion of being superseded rather than replaced.

The claim. Agent memory should be an auditable epistemic trail: a bitemporal, evidence-anchored sequence of claims whose every entry is independently verifiable (it is bound to its source) and replayable (it carries the transaction-time at which it became believed). Under this reframing, the agent-memory problem stops being only accuracy and becomes also accountability — and accountability is the axis where a substrate beats a text-pile structurally, not marginally.

2. Why only donto can make this claim

The reframing is cheap to state and expensive to back, because it needs a store with three properties simultaneously — and they are donto's three foundational invariants:

1. Never delete (I3 — supersede, never overwrite). Replay requires every past belief to still be on disk. A mutable vector index cannot answer "what did you believe last Tuesday" because last Tuesday's index is gone. donto's memory state is versioned by tx_time: one record (66ee367a-…) already carries 101 donto_x_memory_state versions — 100 with a closed tx_time upper bound and exactly 1 open successor, none destroyed. That is a literal supersede chain on disk, not a metaphor.
2. Two time axes on every fact. The trail needs transaction-time (when the agent came to believe it) distinct from valid-time (when the fact holds in the world). donto_x_memory_record.tx_time is a tstzrange with an open upper bound for "currently believed"; the anchored donto_statement carries valid_time separately — so "the agent learned on Jun-5 that the user moved in 2023" keeps learned-when and true-when apart, which a single timestamp on a chunk fundamentally cannot.
3. Evidence-first anchoring. "Why did it believe it" requires each belief to point at its source. Every memory record satisfies a one_anchor check constraint binding it to exactly one root_statement / root_frame / root_context; the substrate holds 2,799,094 donto_evidence_link rows tying statements to character-spans of stored sources. A remembered chunk, by contrast, is the evidence and the claim at once, with no separable anchor to verify. (Anchoring coverage over the memory trail specifically is not yet measured — see §5.)

No collapse-on-conflict store has all three. A KB that dedups loses the superseded belief (breaks replay); one with a single time axis conflates learned-when with true-when (breaks the world-vs-belief distinction the trail exists to record); one without evidence links cannot answer "why." donto has them because it was built paraconsistent and bitemporal from the substrate up — the trail is not a memory feature, it is what those invariants are when the holder is an agent.

3. The trail already exists — measured

This is not a proposal for a schema; the schema is live and carrying an agent's full memory. The store is growing as the bot runs, so counts are as of this writing (2026-06-13) and approximate by ±the last few hours of traffic:

Each omega-bot record is a real claim — scoped by holder='agent:omega-bot' and session='discord:<guild>:<channel>', anchored to a donto_statement, and stamped with the transaction-time the bot came to believe it. The trail is heterogeneous, not a chunk pile: the anchored statements are dominated by typed assertions (rdf:type ~31K, donto:includes, donto:content, donto:presupposes) with mem:episodic/chunk itself a minority (~934). This is the point of the reframing made visible — the bot's Discord life lands as claims with types and structure, not raw embedded passages, and it does so with no extra instrumentation because it writes through donto-memory rather than into an index.

3.1 Epistemic replay is a query, today

The headline capability — reconstruct the agent's currently-believed set as of any past transaction-time — is not future work. It is a tx_time containment predicate over data that already exists, because I3 kept every version:

-- records agent:omega-bot believed (currently-valid) as of 2026-06-05 00:00 UTC
SELECT count(*) FROM donto_x_memory_record
WHERE holder_iri = 'agent:omega-bot'
  AND tx_time @> '2026-06-05 00:00:00+00'::timestamptz;
--> 37243

-- what it believes now (open upper bound)
SELECT count(*) FROM donto_x_memory_record
WHERE holder_iri = 'agent:omega-bot' AND upper(tx_time) IS NULL;
--> 158606

As of Jun-5 the agent held 37,243 currently-believed records; now it holds ~158,606; the ~121K-record delta is exactly what it learned since, recoverable rather than overwritten. Swap the predicate from @> an instant to a join against donto_statement.valid_time and you separate when it learned from when the fact was true — the two-axis replay the reframing promised. This is the PROVEN tier: as-of belief reconstruction works on the live store with one line of SQL. A text-pile cannot return this number at all. (The caveat is in the word count: we have proven the believed set is reconstructable, not that re-executing the agent against that frozen set reproduces its past behaviour — that is §6's counterfactual-replay build, still unbuilt.)

3.2 The recall log is an accountability substrate

donto_x_memory_access records what the agent acted on: every recall writes rows with actor_iri (who recalled), query_hash, access_kind, rank, and score, itself bitemporal. The access_kind domain is the skeleton of a full accountability ledger —

CHECK (access_kind IN ('retrieved','surfaced','cited','ignored','corrected'))

retrieved is populated (49,349 events; e.g. user:locomo:conv-26 9,297, agent:omega-bot 1,161). The other four — surfaced (made it into the prompt), cited (the answer used it), ignored (recalled but unused), corrected (later refuted) — are schema-only today. That gap is the honest center of this paper (§5): the trail records what was retrieved, but the loop that closes accountability — recording what was used, ignored, and corrected, then feeding corrected back into standing — is specified by the schema and not yet wired by the consumer.

4. What a claim-trail memory can answer that a text-pile cannot

The reframing earns its keep on queries no episodic-text memory can express. Each below is a tx_time/evidence/supersede query over the existing tables — the shape of an accountability benchmark:

• As-of belief. "List everything the agent currently believed about user U as of t." → records where holder='agent:U-handler' and tx_time @> t. (PROVEN at the aggregate level in §3.1.)
• Provenance. "For belief b, show the source span and document." → root_statement → donto_evidence_link → span → revision → blob. (The join is mechanical and the links exist substrate-wide; coverage over the memory trail is unmeasured.)
• Correction audit. "Which beliefs were superseded, by what, and when?" → the supersede chain in tx_time (closed-upper records and their open successor). (Versioning is live — the 100-closed-+-1-open chain proves it; the diff surface is unbuilt.)
• Action audit. "Which memories did the agent act on to produce answer a?" → donto_x_memory_access filtered by query_hash/actor_iri. (retrieved populated; cited not.)
• Counterfactual replay. "Re-run the agent's reasoning over only what it believed at t." → recall the as-of set, feed it as context. (The set is queryable; the harness to re-execute the agent against a frozen belief-set is unbuilt.)

A text-pile answers the first half of provenance (here is the chunk) and none of the rest, because it has no transaction-time of its own, no separable evidence anchor, and no supersede semantics.

5. Honest status: proven / conjectured / speculative

In the three-tier candor of the seed papers:

• PROVEN (measured on the live store). The trail exists and is bitemporal: ~1.5M holder-scoped records, an agent's ~158.6K-record / 15-day / 29-session trail, anchored via a one_anchor constraint, with 2.8M evidence links substrate-wide and state versioned to 101 deep (a genuine 100-closed + 1-open supersede chain). Epistemic replay works today — as-of belief reconstruction is a one-line tx_time @> query returning 37,243 (Jun-5) versus ~158,606 (now). A recall audit log (donto_x_memory_access) is live with 49,349 events carrying actor/query/rank/score. These are facts about the database, not aspirations.
• CONJECTURED (and the failure mode named). That a claim-trail memory matches text-pile memory on recall accuracy while strictly dominating it on accountability. The recall-parity half is plausible but not free: Answer-Shaping and the memory scorecard show atomic-claims-only recall collapses (LoCoMo 0.244 vs 0.604 episodic, 96Q) — so a trail that stores only claims and discards transcripts can lose accuracy. The failure mode is explicit: if "claim trail" is read as "throw away the text," recall regresses on synthesis questions. The defensible version stores claims plus their anchored source spans (the trail is the accountability layer over retained evidence, not a replacement for it) — and whether that composite matches episodic recall at competitive token cost is the open measurement, not a settled result. A second open question lives here too: anchoring coverage over the memory trail specifically is unmeasured (§2.3), so "every belief is verifiable" is an architectural guarantee of the schema, not yet an empirical rate.
• SPECULATIVE (flagged). That corrected access events, fed back, make standing a reality-steered loop (standing-dynamics) — i.e. that the trail is not just an audit record but the training signal by which the agent's memory self-corrects. The mechanism is plausible and I3-safe (corrections are new superseding writes, never deletions), but nothing populates corrected yet and there is no experiment. Flagged, not claimed.

The sharpest honest negative: there is no accountability benchmark, and the field has no incentive to build one because every existing benchmark scores recall. We can replay an agent's believed set but cannot yet score a system on whether it replays correctly, attributes provenance faithfully, or surfaces corrections completely. The reframing is only as strong as the benchmark that operationalizes it — and that benchmark is the work this paper exists to motivate.

6. The experiment that would establish it

Two builds, then a measurement:

1. Replay query layer. Wrap the live tx_time @> / evidence-join / supersede-chain queries as a first-class read API (recall_as_of(holder, t), provenance(belief), corrections(holder, window)) on donto-memory — Rust, reusing the existing recall path, no new tables (I3: corrections are superseding writes). The data is there; this exposes it. Populate the four dark access_kinds by having the consumer log surfaced/cited/ignored at answer-assembly time and corrected on retraction.
2. An accountability benchmark. Take an existing dialogue corpus (LongMemEval _s, which already has dated knowledge-updates) and derive an accountability test set: for each knowledge-update, the questions become "what did the agent believe before the update," "after," "show the evidence for the post-update belief," "list the superseded prior belief." Score on replay fidelity (does as-of recall match the held-out ground-truth belief-set), provenance precision (does the cited span actually contain the fact — reuse the decoupled-anchoring citer as the grader), and correction recall (fraction of refuted beliefs surfaced as corrected).
3. The head-to-head. Run the same corpus through a strong episodic-text baseline (a mutable vector index) and donto's claim trail. The expected result — the one that would establish the reframing — is a separation, not a tie: comparable recall accuracy, but the text-pile scores ~0 on every accountability metric (it cannot answer them) while the trail scores high. A separation on a metric the baseline structurally cannot reach is a stronger result than a recall-leaderboard delta, and it is the honest shape of donto's advantage here. (The recall-parity leg is the CONJECTURED tier and the experiment must report it honestly — including a loss, if claims-plus-spans still trails episodic.)

7. Why this is donto's to write

The reframing — memory as auditable state, not text — is only credible from a store that already holds an agent's life as bitemporal, evidence-anchored, never-deleted claims and can replay them with a one-line predicate. That is the precise intersection of I3, bitemporality, and evidence-first anchoring, the same three invariants the bitemporal sheaf turns into a contradiction measure. The sheaf asks what shape do the agent's disagreements have; this paper asks what did the agent believe, and can it prove why — two readings of the same trail. donto can pose both because, uniquely, it kept the data: ~158,600 typed, dated, holder-scoped beliefs on disk for one agent over fifteen days — and not one of them overwritten.

See also: the empirical companion Answer-Shaping and its honest scorecard; the return-shape study donto-memory return shape; the theory companion The Bitemporal Sheaf; the feedback loop in Standing as a dynamical system; the full program in the donto research agenda.