AI Agent Memory Architect

Wrote docs/architecture/memory-architect/00-overview/memory-architect-overview.md and docs/architecture/memory-architect/verification/fitness-self-check.md. Complete multi-tier AI agent memory architecture specifying record provenance, admission authority gates, 150 ms retrieval budget, 24-hour GDPR deletion cascade, and red-capable fitness self-checks.

---

skill: memory-architect

Memory Architecture: WealthAdvisor Copilot [MEM-WLTH-001]

Summary

This architecture establishes the persistent memory model and lifecycle contracts for WealthAdvisor Copilot v2.0 under run ID wealth-mem-001, supporting 150,000 retail investment clients. It resolves the core tension between client continuity and regulatory compliance by partitioning memory into three bounded tiers: volatile Working Memory (8k token prompt envelope), indexed Episodic Memory (PostgreSQL 15 with pgvector, 1536 dims), and structured Semantic Memory (encrypted client profile store). The design strictly rejects autonomous model memory admission in favor of programmatic validation gates: only explicit client-stated facts gain permanent admission, model-inferred preferences remain untrusted derived proposals, episodic logs automatically expire after 90 days, GDPR Article 17 forgetting events deterministically purge vectors and derived summaries within 24 hours, and raw financial identifiers (PANs, bank account numbers) are masked at the admission boundary.

Detailed Description

Unconstrained conversational memory creates severe risks of behavioral drift, hallucinated commitments, and compliance violations. In wealth management, an unconfirmed model inference (e.g., assuming high risk tolerance from an offhand remark) stored as fact directly breaches fiduciary duties. Furthermore, storing raw chat transcripts breaches GDPR data minimization principles.

Client Interaction (Turn Start)
        │
        ├─► [ Memory Retrieval Gate: p95 <= 150 ms ]
        │         │
        │         ├─► Fetch Client Profile (Semantic Store: Postgres 15)
        │         └─► Vector KNN Filtered by client_id (pgvector: max 5 chunks)
        ▼
[ Working Memory Context Envelope (Max 8,192 tokens) ]
  ├── System Prompt & Guardrails
  ├── Grounded Retrieved Memories (Untrusted Data Block)
  └── Active Turn Dialog
        │
        ▼ (Turn End / Session Close)
[ Programmatic Admission Filter (Boundary Wrapper) ]
  ├── Mask Account Numbers / PANs (Regex & Lexical Sanitizer)
  ├── Filter 1: Client-Stated Facts ──► Write to Semantic Profile (Author: Client)
  ├── Filter 2: Episodic Chunks ─────► Upsert pgvector (TTL: 90 Days)
  └── Filter 3: Inferred Claims ─────► Mark `derived-proposal` (Never Cited as Fact)

Mechanism Specifications

1. Model and Agent Boundary:

   • Owner: AI Systems Engineering (Sarah Chen).
   • Trigger: Session completion or explicit client fact utterance.
   • State/Algorithm: Programmatic admission engine validates extracted candidate entities against strict schema. The LLM may propose memory candidates, but runtime middleware executes admission. Model self-admission without verification is rejected.
   • Failure Behavior: If admission validation fails, memory is dropped to a quarantined audit log; active user session is unaffected.
   • Test Oracle: Automated test assertion verifying unconfirmed model inferences receive class derived-proposal and cannot overwrite canonical profile facts.

2. Tool Policy and Authority:

   • Owner: Database Platform Team / Security.
   • Trigger: Agent tool execution during memory write or deletion cascade.
   • State/Algorithm: Tools memory_write_profile and memory_purge_client require service tokens with role memory-writer and tenant scope wealth-mgmt.
   • Failure Behavior: Denied operations return HTTP 403 / status unauthorized_memory_mutation; writes abort cleanly without partial commits.
   • Test Oracle: Integration test confirming unauthorized role cannot write to client_semantic_profile.

3. Evaluation Oracle:

   • Owner: Chief Compliance Officer (David O'Reilly) / Evaluation Guild.
   • Trigger: Weekly regression testing and post-run pipeline verification.
   • State/Algorithm: Deterministic factual recall harness comparing memory-augmented outputs against ground-truth client ledger state. Self-graded evaluation is forbidden.
   • Failure Behavior: Factual regression or ungrounded preference citation halts memory extractor deployments.
   • Test Oracle: Test oracle suite test_factual_attribution_no_self_grade evaluating downstream recommendations against golden client profiles.

4. Context Budget:

   • Owner: AI Systems Engineering.
   • Trigger: Turn assembly.
   • State/Algorithm: Retrieved episodic and semantic records are capped at 2,048 tokens within the overall 8,192 token working memory budget. Memory is injected inside <retrieved_memory> delimiters as untrusted passive context.
   • Failure Behavior: If retrieved candidates exceed 2,048 tokens, lowest-relevance chunks are truncated deterministically.
   • Test Oracle: Token budget assertion test_context_budget_ceiling verifying injected context never breaches 2,048 tokens.

Alternatives rejected

Contracts and Invariants

Client-Stated Admission Authority [ADM-01]
  Only facts explicitly uttered by the verified client (e.g. "I plan to retire at 65") enter
  the semantic profile store. Model-inferred deductions are classified as `derived-proposal`,
  stored in secondary review buffers, and must never be cited or acted upon as client-stated facts.

GDPR Erasure Cascade Invariant [DEL-01]
  Upon receipt of a client forgetting event (`gdpr_delete_requested`), all episodic vectors in
  pgvector, semantic profile rows in PostgreSQL, and any derived summaries referencing `client_id`
  must be hard-deleted and tombstoned within 24 hours across all storage layers.

Financial Identifier Sanitization [SEC-01]
  Raw bank account numbers (IBAN/BBAN), credit card Primary Account Numbers (PANs), and national
  tax IDs must never be written to episodic or semantic memory. The admission wrapper must mask
  all matching patterns with surrogate tokens (`ACCT-***-XXXX`) before persistence.

Episodic Eviction Ceiling [RET-01]
  Episodic interaction vectors expire after 90 days by default. Partitioned pgvector tables drop
  aged partitions automatically unless an explicit regulatory hold tag is associated with the session.

Retrieval Budget and Isolation [RET-02]
  Every memory retrieval query must enforce tenant filter `tenant_id = 'wealth-mgmt'` and
  `client_id = :authenticated_user`. Total vector search and retrieval latency must not exceed
  150 ms at p95 under 60 QPS concurrent load.

Ownership and Handoffs

Traceability

Verification

No validator was supplied, so no command was run.

Reviewer self-checks

• Mechanism rules verified: model/agent boundary, tool policy, evaluation oracle, and context budget are explicitly specified with triggers, failure behavior, and test oracles.
• Concern rules verified: short-term working memory envelope (8k tokens), long-term vector memory (pgvector with 90-day TTL), and conversation truncation (2,048 token retrieved memory cap) are bounded.
• Claim classifications verified: all factual inputs and architectural constraints carry explicit classification and source attribution.

Open Decisions

None. All constraints and boundaries resolved from intake requirements and compliance policies.

---

skill: memory-architect

WealthAdvisor Copilot Memory — Fitness Self-Check [MEM-FIT-001]

Summary

This fitness self-check evaluates the memory architecture for WealthAdvisor Copilot v2.0 against three critical domain failure modes: unbounded autonomy, self-graded evaluation, and prompt-only control. All targeted probes pass by design construction. A self-check is supporting evidence, never the authoritative gate. Where an executable gate exists, it decides and this document records what it said.

Detailed Description

Residual Risk

• Cross-device race conditions: if a client updates preferences simultaneously on mobile and web within a 200 ms window, the older fact may overwrite the newer fact if client clock skew exceeds network latency. Accepted by Sarah Chen pending distributed timestamping protocol implementation in Q4.

Traceability

Verification

No validator was supplied, so no command was run.

Open Decisions

None.

Next steps

1. Database Platform Team provisions PostgreSQL 15 with pgvector extension and applies automated 90-day table partition drops.
2. AI Systems Engineering implements programmatic admission wrapper with regex-based PAN/account masking and explicit fact/proposal classification.
3. Chief Compliance Officer reviews automated 24-hour GDPR deletion test report before production customer traffic cutover.