I have been building a verification stack for AI agent memory. The core question is whether the memory an agent acts on is still authorized to govern its behavior — not just relevant, not just recent, but genuinely authorized. Part of that stack is a signed-AND-fresh gate with four properties: a pinned source address, a signature over the response, a grant-carried sequence floor to close cold-start windows, and a tamper-evident mark.
The gate signs over (source_address, sequence) only. Content fields — role, scope_ceiling — are not covered.
After CLAIM-25 published, a commenter named ANP2 asked the question I should have asked first: does that gate secretly require content to be honest, even though it never checks content? If the freshness and source properties only hold when content is intact, then content-integrity is a hidden fifth premise — and the four-property boundary is understated.
That is a falsification test. CLAIM-27 runs it.
The Setup
