{"id":"c0e3d1f5-c206-404f-8aac-667e942f4a33","arxiv_id":"2608.08253","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"SuperLocalMemory 4.0 is a local-first, governed memory runtime for AI agents with a verifiable transaction spine, cross-store erasure receipts, and measured control-plane overhead.","lead":"This paper presents SuperLocalMemory 4.0, a local-first memory system for AI agents that combines retrieval, governance, and verifiable transactions into a single runtime. The authors report 2,200/2,200 deterministic fault-injection checks and measure a governed write overhead of 1.687 ms at p50.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Component-level fault injection does not exercise the claimed HTTP/remember enforcement path; the paper itself states no scenario covers HTTP auth→ActorContext→journal→fence→owners→manifest→ANN. Until an end-to-end HTTP-level test passes, the central invariant claim rests on code inspection alone.","rationale":"The reader's weakest_assumption correctly identifies the component-to-runtime generalization gap. The paper is admirably explicit about the gap, but that does not make the central claim fully supported: the phrase 'enforced on the primary write path' is an implementation-level assertion, and the 2,200/2,200 results validate components, not the wiring. The proposed end-to-end HTTP test would settle the concern directly. A secondary observation: Section 6.2's VDI 7.2 claims a 'DB-only writer without the installation key' cannot forge the manifest HMAC, but footnote 1 says the key is derived from a per-installation key column in the database; if that column is in the same SQLite file, a writer with file access could read it. This deserves a follow-up (store the key outside the DB or drop the tamper-evidence claim), but it is not the primary blocker because the threat model already excludes direct DB file access. Overall the reader's CONDITIONAL verdict is appropriate; no change is needed.","tokens_in":26083,"tokens_out":9684,"duration_ms":81473,"concrete_test":"Start the real daemon (server/unified_daemon.py) on loopback; authenticate a session; POST /remember with a fresh idempotency key. Assert the store contains the canonical row, a durable receipt, three obligation rows, and a manifest with all_met=True. Then bump the profile generation and replay the same key; assert WriteCoordinatorError is returned and no new projection rows appear. Finally, inject a Bm25Owner.apply failure and assert the manifest is DEGRADED and compensation removes the surviving temporal projection. Run 200 deterministic repetitions of this full HTTP-level sequence; any failure means the 'enforced on HTTP/remember' claim is not established.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 10 (Table 3) reports 2,200/2,200 repetitions, but every scenario drives production modules in-process and none combines the full HTTP/remember chain. Section 10.1 states: 'No single scenario exercises the full end-to-end path (HTTP auth→ActorContext→journal→fence→owners→obligation ledger→manifest→ANN); transport, multi-process, mesh, and long-lived deployment fault-injection are future work.' Section 11 repeats this: 'The harness drives real production modules over fresh per-trial SQLite databases but does not exercise the HTTP/MCP/WebSocket server stack, inter-process communication, or production-scale concurrency.' The central claim that the admission invariant is 'enforced' on the HTTP/remember route is therefore supported by code inspection plus separately verified components, not by an integrated test. An integration bug—e.g., the HTTP handler failing to populate ActorContext from the session, or the fence epoch not being captured before journal.prepare—could break the invariant without any of the 11 experiments noticing. VDI 7.3 even lists 'an end-to-end unauthorized/authorized HTTP probe' as future work. This is a scope-to-claim gap, not an internal contradiction, but it is load-bearing because the paper's headline contribution is enforcement on the primary write path.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"SuperLocalMemory 4.0 is a local-first memory runtime for AI agents that combines multi-channel retrieval, governance, temporal memory, mesh coordination, and a new reliability spine consisting of generation-fenced admission, a transactional obligation ledger with per-projection owners, a hash-checkable completion manifest, and cross-store verified erasure. The governing invariant—one authenticated actor, one profile generation, one policy decision, one durable receipt, one verifiable completion state—is presented as enforced on the canonical HTTP/remember route and internal ingestion, with other transport surfaces adopting the gateway incrementally. The paper reports eleven deterministic fault-injection and mechanism scenarios, each repeated 200 times (2,200/2,200 held), together with in-process performance measurements of the governed write envelope (1.687 ms p50 / 2.728 ms p99 overhead) and carried-forward V3 LoCoMo retrieval results explicitly scoped as not a new V4 benchmark.","tokens_in":26297,"tokens_out":6833,"duration_ms":62481,"significance":"The manuscript is a serious engineering-systems contribution. Its main technical content—a projection-obligation ledger, per-owner verify/apply/compensate/erase protocol, and a hash-sealed completion manifest with an honest DEGRADED state—is a concrete, plausible design for making agent-memory write paths auditable and verifiable. The evaluation practices are a strength: the fault-injection tests are bracketed with positive controls, the repetitions are correctly framed as deterministic flakiness checks rather than statistical samples, the harness is released with a single runner, and the paper repeatedly states what it did not exercise. The authors are unusually candid about the component-level scope of the evidence. However, the headline claim is that the admission invariant is 'enforced' on the HTTP/remember write path, and no integrated test exercises that path end-to-end; the evidence is composition of separately tested components plus code inspection. This is a scope-to-claim gap rather than an internal contradiction, and it is load-bearing because the invariant on the primary write path is the paper's central systems claim.","major_comments":[{"comment":"The central claim that the admission invariant is enforced on the HTTP/remember primary write path is not directly measured. Section 10.1 states: \"No single scenario exercises the full end-to-end path (HTTP auth→ActorContext→journal→fence→owners→obligation ledger→manifest→ANN); transport, multi-process, mesh, and long-lived deployment fault-injection are future work.\" VDI 7.3 similarly establishes the HTTP RBAC middleware by code inspection and lists an end-to-end unauthorized/authorized HTTP probe as future work. Because every experiment in Table 3 drives production modules in-process, an integration defect in the FastAPI handler—for example, failing to derive ActorContext from the session, or capturing the fence epoch at the wrong point relative to journal.prepare—would not be detected by any of the 11 scenarios. The honest scope disclosure does not by itself close the gap between \"enforced design of the write path\" and \"component-level tests pass.\" The minimal remedy is an end-to-end HTTP-level test of the full chain, including an unauthorized/authorized probe, or an explicit reframing of the invariant as a target architecture rather than an enforced property.","section":"§10.1, VDI 7.3, §11"},{"comment":"The \"cross-store verified erasure\" guarantee is incomplete for the vector projection. The abstract and Contribution C4 present erasure over the three registered projection owners, including VectorOwner, but Section 10.1 states that the sqlite-vec ANN index is not loadable in the harness environment and that exp1's vector erasure is scoped to the embedding_metadata SQL table. exp2b repeats that the VectorOwner runs in embedding_metadata metadata mode with the ANN index out of scope. The live physical re-query proof in VDI 7.4 therefore covers the metadata table, not the actual vector index. If deployed configurations treat the ANN index as part of the vector projection, an all_erased=True receipt could be truthful for embedding_metadata while leaving the ANN index intact. This needs to be addressed by either including the ANN index in the experiment or narrowing the invariant itself to \"vector metadata erasure,\" not just the experiment disclosure.","section":"§10.1 (exp1, exp2b), VDI 7.4, §6.3"},{"comment":"The governed write-envelope overhead is presented in the abstract as \"per governed write\" and \"control-plane overheads of 1.687 ms at p50 and 2.728 ms at p99,\" but Section 10.2 makes clear that the measurement is in-process, excludes HTTP transport and request parsing, runs on a temporary filesystem, and is a floor number. This is disclosed in the body, yet the abstract wording could be misread as an end-to-end cost. Because the overhead figure is one of the paper's headline numbers, the abstract should carry the same qualifier (e.g., \"in-process, excluding HTTP transport\"), and a loopback-HTTP side measurement, even if small and informal, would anchor the floor and help readers judge deployment cost.","section":"§10.2"}],"minor_comments":[{"comment":"The figure title says \"10 Deterministic Property Scenarios\" and the caption says \"All 10 scoped properties held,\" but Section 10.1 and Table 3 report eleven scenarios and 2,200 repetitions; exp2b is missing from the overview figure. This count discrepancy should be fixed, and exp2b should appear in the taxonomy because it is the primary real-owner evidence.","section":"Figure 11 (page 23)"},{"comment":"The reproducibility statement is slightly inconsistent: Section 11 notes that retained result artifacts record package version and platform but not a source commit or wheel hash, while the Availability section says the exact audited build is pinned at release. For a paper whose evidence is deterministic repetitions, pinning the source SHA and wheel hash of the evidence bundle would make the released records more auditable.","section":"§11, Availability section"},{"comment":"The caption contains a typo: \"skill evolution pipeline in SLM 4.04.0\" should read \"SLM 4.0.\"","section":"Figure 2 caption"}],"recommendation":"major_revision","confidential_remarks":"The paper is a scoped engineering-reliability study with unusually honest limitation statements. The main risk is that the title-level claim \"enforced on the HTTP/remember path\" outstrips the component-level evidence; an end-to-end HTTP test is the required fix. If the venue does not accept component-level reliability studies as sufficient for a systems contribution, the submission would fit better after such a test is added."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"What you should know: this is a rarity — an engineering report on an agent-memory runtime that repeatedly disclaims novelty, pins down its own scope limits, ships the harness, and reports 2,200/2,200 deterministic fault-injection runs. The genuinely new-looking piece is the projection-obligation ledger with a hash-checkable CompletionManifest over BM25/temporal/vector owners, plus the generation-fenced admission. The reader's conditional verdict is about right.\n\nWhat it does well: the paper is explicit that individual mechanisms are prior art — Graphiti for bi-temporal storage, Mem0 for retrieval, MemTX/MemTxn for other transaction layers — and the claimed novelty is the integration into one local-first runtime with a physical-store reliability spine. That is a defensible, well-scoped claim. The fault-injection methodology is careful: positive controls, fail-loud harness, per-experiment disclosures about synthetic stand-ins vs. real owners, and a runner with a test asserting every experiment is reachable. That is real reproducible evidence and should be credited. The limitations section is unusually candid.\n\nWhere the soft spots are: the stress-test note lands, and it is the load-bearing one. All 2,200 repetitions are component-level; none exercises the full HTTP/remember chain. The paper states this plainly — no scenario covers HTTP auth through ActorContext, journal, fence, owners, manifest, and ANN — so the claim that the invariant is \"enforced\" on the primary write path rests on code inspection plus separately verified components. An integration bug, like the HTTP handler failing to derive ActorContext from the session, would break the invariant without any of the eleven experiments noticing. The paper itself lists an end-to-end HTTP probe as future work, so this is a scope-to-claim gap, not an internal contradiction. It is still load-bearing, because the headline contribution is enforcement on the primary write path.\n\nMinor but real: the overhead numbers are floor figures on a fresh store, the ungoverned baseline is a different code path, the sqlite-vec ANN index is out of scope for the erasure experiments, and the LoCoMo numbers are V3 carried forward, not rerun on V4. All of these are disclosed honestly; none is a fatal flaw.\n\nWho this is for: anyone working on agent-memory infrastructure, governance for local-first AI, or reliability evaluation for AI systems. It deserves a serious referee — the evidence bundle is reproducible and the claims are scoped, which is more than most papers in this area manage. Recommendation: send it to peer review, conditionally. Require either an end-to-end HTTP-level test of the governed write path, or retitle the central claim to \"component-level reliability spine\" and move the write-path enforcement claim to target-architecture status. Either way, the paper has real value as an honest engineering report.","headline":"Scrupulously honest agent-memory engineering with a load-bearing gap: the headline write-path invariant is supported by component tests plus code inspection, not by any end-to-end HTTP-level test, but the paper itself says so.","tokens_in":26905,"tokens_out":2025,"would_cite":true,"duration_ms":19523,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that a local-first memory layer for AI agents can enforce a governing write-time invariant — one authenticated actor, one profile generation, one policy decision, one durable receipt, one verifiable completion state —…","keywords":["agent memory","local-first","governance","verifiable memory transactions","completion manifest","generation fence","verified erasure","fault-injection evaluation"],"falsifier":"Run the same eleven scenarios against the real HTTP daemon with the full end-to-end path — HTTP auth, ActorContext, journal, generation fence, projection owners, obligation ledger, completion manifest, and the ANN index — and require 200/200 per scenario; any stale-epoch write that reaches a projection owner, or any ERASE after which an ANN or other registered projection footprint remains, would falsify the invariant as stated.","tokens_in":25807,"feed_emoji":"🧠","tokens_out":9893,"duration_ms":80418,"temperature":0.7,"pith_summary":"SuperLocalMemory 4.0 is presented as a local-first memory operating system for AI agents: one control plane that unifies five retrieval channels, a learning-and-behavior brain, bi-temporal recall, multi-tenant isolation, and compliance controls, with no cloud provider required in the memory path in its default modes. The paper's central claim is that the primary write path can be governed by a single admission invariant — one authenticated actor, one profile generation, one policy decision, one durable receipt, and one verifiable completion state across the three registered projection stores (BM25, temporal, vector). The evidence for the claim is eleven fault-injection and mechanism scenarios, each repeated 200 times, with all 2,200 repetitions upholding their scoped component properties, and a directly measured in-process overhead of 1.687 ms at the median and 2.728 ms at p99 over the ungoverned write path. The authors are explicit that this is component-level evidence, not an end-to-end multi-process or retrieval-accuracy benchmark, and that transport, multi-process, mesh, and long-lived deployment fault-injection remain future work.","feed_headline":"Every agent memory write gets an honest completion receipt","feed_subtitle":"A local-first memory system for AI agents seals each governed write with a COMPLETE, DEGRADED, or FAILED manifest at a median overhead of…","key_machinery":"The carrying mechanism is the V4 reliability spine: generation-fenced admission (a process-local, TTL-bounded map from (profile_id, idempotency_key) to a generation epoch that rejects stale writes with WriteCoordinatorError before any projection write), verifiable memory transactions (a transactional obligation ledger with per-projection owners — Bm25Owner, TemporalOwner, VectorOwner — implementing apply/verify/compensate/erase/prove_erased, with SHA-256 checksums), a hash-checkable CompletionManifest (COMPLETE when every obligation is terminal-success, DEGRADED when at least one failed after compensation, FAILED when the canonical write failed; sealed with installation-key HMAC-SHA256 on current schemas), and cross-store verified erasure with live physical re-queries and tamper-evident receipts. This bundle turns an ordinary remember call into an auditable, bounded transaction across heterogeneous local stores.","core_discovery":"The central claim is that a memory layer for AI agents can make reliability a physical-store property rather than an application-layer hope: the central systems contribution is a hash-verifiable projection-obligation and completion-manifest protocol across heterogeneous local stores under scoped admission. On every canonical write through the HTTP/remember route and internal ingestion, the runtime atomically commits the canonical fact, a durable receipt, and projection obligations for three registered owners (BM25, temporal, vector); each owner then proves its own apply/verify/compensate/erase, and a hash-checkable CompletionManifest reports COMPLETE, DEGRADED, or FAILED from canonical presence and obligation evidence. A generation fence rejects stale writes from a superseded profile epoch before any projection owner runs, and erasure returns all_erased=True only after each owner's live re-query confirms absence. The paper presents this as the enforced design of the write path and the target architecture for all surfaces, not a property already enforced on every transport, and it reports 2,200 of 2,200 deterministic repetitions upholding the scoped component properties.","pith_inferences":["A decisive next test would run the same fault-injection scenarios over the real HTTP daemon with a separate process, since the paper's own scope note says no single scenario exercises the full end-to-end path; the invariant's strongest form depends on those untested transport and multi-process paths behaving like the in-process harness.","Because the completion-manifest layer is physical-store projection consistency, it could plausibly sit beneath belief-level or logical-state transaction layers for agent memory, composing into a stack of transaction types rather than a single transaction winning.","Because the erasure evidence currently covers embedding metadata rather than the ANN index itself, a direct check of whether ANN entries survive an ERASE operation would extend the erasure claim to the vector projection's full footprint.","The carried-forward retrieval results come from the prior V3 architecture and do not testify to V4 retrieval quality; an end-to-end V4 benchmark against the same long-conversation tasks would show whether the reliability spine changes retrieval behavior in practice."],"forward_implications":["If the invariant holds, every canonical write can be audited by its manifest: a DEGRADED state records exactly which projection owner failed, and no degraded write is ever promoted to COMPLETE.","A deleted-and-recreated profile cannot be contaminated by a replayed stale write, because the generation fence rejects the stale epoch before any projection owner executes.","A right-to-erasure request with all_erased=True means each registered owner re-queried its physical tables and found no residue at finalize time; partial residue forces all_erased=False.","Governed writes cost about 1.7 ms at the median and 2.7 ms at p99 more than ungoverned writes in-process, so the governance envelope is cheap enough to leave enabled."],"supporting_citations":[{"why":"supplies the trust and behavioral foundations that the V4 governance and admission layers build on.","marker":"[19]"},{"why":"supplies the information-geometric retrieval substrate and the carried-forward long-conversation retrieval evidence from the prior V3 architecture that V4 productionizes.","marker":"[21]"},{"why":"supplies the V3.3 living-brain learning-and-lifecycle model that V4's learning and behavior layer carries forward.","marker":"[20]"},{"why":"a concurrent belief-layer transactional-memory proposal from which the paper distinguishes its physical-store projection-consistency layer and with which the completion manifest could compose.","marker":"[11]"},{"why":"a concurrent logical-state transaction-boundary proposal that the paper distinguishes from its own obligation-ledger layer.","marker":"[2]"},{"why":"the long-conversation benchmark whose prior-version protocol-scoped results are carried forward as retrieval evidence rather than a new V4 run.","marker":"[13]"},{"why":"a temporal knowledge-graph architecture that establishes the bi-temporal storage prior art against which the paper scopes its own temporal integration.","marker":"[22]"}],"fun_headline_variants":["Every agent memory write gets a verified completion receipt","Memory writes now ship with hash-checkable manifests at ~3.5ms overhead","Agent memory OS: each write returns a COMPLETE, DEGRADED, or FAILED receipt","Reliable writes: 2,200/2,200 checks uphold the scoped reliability claim"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that component-level, in-process fault-injection results generalize to the real runtime: the paper states that no single scenario exercises the full end-to-end path and that transport, multi-process, mesh, and long-lived deployment fault-injection are future work.","fun_headline_variants_meta":{"raw":{"variants":["Every agent memory write gets a verified completion receipt","Memory writes now ship with hash-checkable manifests at ~3.5ms overhead","Agent memory OS: each write returns a COMPLETE, DEGRADED, or FAILED receipt","Reliable writes: 2,200/2,200 checks uphold the scoped reliability claim"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000882,"raw_usage":{"total_tokens":3900,"prompt_tokens":1126,"completion_tokens":2774,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":742,"completion_tokens_details":{"reasoning_tokens":2698}},"tokens_in":742,"tokens_out":2774,"duration_ms":18709,"temperature":1.0,"reasoning_tokens":2698,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T00:12:27.780662+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the same eleven scenarios against the real HTTP daemon with the full end-to-end path — HTTP auth, ActorContext, journal, generation fence, projection owners, obligation ledger, completion manifest, and the ANN index — and require 200/200 per scenario; any stale-epoch write that reaches a projection owner, or any ERASE after which an ANN or other registered projection footprint remains, would falsify the invariant as stated.","supporting_citations":[{"cited_title":"SuperLocalMemory V3.3: The Living Brain -- Biologically-Inspired Forgetting, Cognitive Quantization, and Multi-Channel Retrieval for Zero-LLM Agent Memory Systems","cited_arxiv_id":"2604.04514","evidence_quote":"supplies the V3.3 living-brain learning-and-lifecycle model that V4's learning and behavior layer carries forward."},{"cited_title":"MemTX: Transactional Belief Commit for Stateful Agent Memory","cited_arxiv_id":"2607.23929","evidence_quote":"a concurrent belief-layer transactional-memory proposal from which the paper distinguishes its physical-store projection-consistency layer and with which the completion manifest could compose."},{"cited_title":"MemTxn: A Transaction Boundary for Source-Supported Updates and Complete-State Recovery in Agent Memory","cited_arxiv_id":"2607.27834","evidence_quote":"a concurrent logical-state transaction-boundary proposal that the paper distinguishes from its own obligation-ledger layer."},{"cited_title":"Maharana et al","cited_arxiv_id":null,"evidence_quote":"the long-conversation benchmark whose prior-version protocol-scoped results are carried forward as retrieval evidence rather than a new V4 run."}],"review_version":1}