At-rest edit T2

Tail truncation

Delete the newest records so an earlier state becomes current.

What it looks like in the world: Rolling the agent back and erasing its recent actions from the record.

attack id truncate · version 1 · attacker: store-access

The edit, drawn

The agent made two decisions yesterday. The attacker deletes both records, so the newest record is now the one from the day before.

A signed head pointer: the store must know which record is supposed to be newest, not just that each record is valid.

Per-record signatures and per-record encryption, because every record left is genuine.

rejected on read: OpenFang model, tip-persistence fix, Agent Memory reference runtime, SQLite canonical substrate, bucketed row digests, fail-closed open
reported on audit: inspeximus, receipts on, attacker holds the store directory, langgraph-ledger over SqliteSaver, hash-chained ledger, verify_thread audit, memory-blackbox memory.md watcher, agent process alive, scan audit, memory-blackbox memory.md watcher, agent restarted before the scan, scan audit, Atelya Attest, keyed hash chain plus anchored head, verify and consistency audit, CONTINUUM event log, hash chain plus Ed25519-signed head, attest-verify audit
accepted: LangGraph SqliteSaver, LangGraph PostgresSaver, LangGraph RedisSaver, OpenAI Agents SDK SQLiteSession, LlamaIndex Memory, SQLAlchemy chat store, CrewAI long-term memory, LanceDB dataset, Vertex AI Agent Engine Memory Bank, managed store, edits through the data-plane API, Letta block checkpoint history, Mem0 local Qdrant store, inspeximus, receipts off (default), inspeximus, receipts on, attacker also holds the config home, Atelya Attest, keyed hash chain, verify_chain audit, CONTINUUM event log, hash chain, verify_events audit, AtMem 2.3.7, audit chain alone, verify() audit, AtMem 2.3.7, audit chain with an external checkpoint outside the attacker-controlled store directory, verify() audit, acrf-memory-guard, per-entry HMAC over a JSON store

agmi-check --adapter agmi.adapters.langgraph_sqlite:LangGraphSqliteAdapter # runs T1 to T8; this is T2

inspeximus, receipts on, attacker holds the store directory detected on reload (verify_writes: ['write log shrank below the head kept outside the store: 3 < 5 (rolled back or truncated, receipts included); a deliberate restore is accep)
langgraph-ledger over SqliteSaver, hash-chained ledger, verify_thread audit detected on reload (verify_thread: checkpoint missing from saver: 1f1c21be-d64b-6ebe-8003-323c87701a62; checkpoint missing from saver: 1f1c21be-d64c-6b84-8004-f19cbb35c742)
memory-blackbox memory.md watcher, agent process alive, scan audit detected on reload (scan recorded an out-of-band write to MEMORY.md (record 01a11524))
memory-blackbox memory.md watcher, agent restarted before the scan, scan audit detected on reload (scan recorded an out-of-band write to MEMORY.md (record 01a11524))
Atelya Attest, keyed hash chain plus anchored head, verify and consistency audit detected on reload (anchor: chain has 3 entries but checkpoint anchors seq=4 — history truncated/vanished below an anchored checkpoint)
CONTINUUM event log, hash chain plus Ed25519-signed head, attest-verify audit detected on reload (attest-verify: ALTERED (signed seq 5, live seq 3))

OpenFang model, tip-persistence fix detected on reload (walked tip differs from persisted tip)
Agent Memory reference runtime, SQLite canonical substrate, bucketed row digests, fail-closed open detected on reload (RuntimeRecoveryError: SQLite canonical substrate digest mismatch)

pip install agent-memory-integrity
python agmi/full_runner.py --json results/scorecard.json   # every row; the truncate column is this page