dotmem 0.0.9 → 0.1.1

package/core/profile/trust.md

@@ -0,0 +1,804 @@
+# dotmem AI Trust Boundary and Progressive Model Profiling
+
+## Purpose
+
+This document defines how dotmem protects shared memory when interacting with AI models of unknown, partially known, or demonstrated behavioral quality.
+
+dotmem is a bridge between different AI systems.
+
+That bridge must not become a mechanism for:
+
+- uncontrolled information gathering
+- propagation of sensitive profiling
+- false memory claims
+- path invention
+- misuse of shared memory
+- silent rewriting of durable knowledge
+- cross-model amplification of bad behavior
+
+The default position is conservative:
+
+> Unknown AI -> strong shields.
+
+Trust may increase progressively through evidence.
+
+This document is static policy. It is the counterpart of `curiosity.md`:
+
+```text
+curiosity.md
+    -> how AI may learn about HI
+
+trust.md
+    -> how dotmem protects HI from AI
+```
+
+Status note: the dynamic behavioral reputation store described in section 29
+(`<user-anchor>/trust/models.json`) is not implemented yet. Until it exists, every
+model/runtime is treated as UNKNOWN and the LEVEL 0 defaults apply.
+
+
+
+## 1. Core Principle
+
+dotmem must never assume that an AI model is trustworthy merely because:
+
+- it is capable
+- it is fast
+- it is popular
+- it comes from a known provider
+- it performs well on coding benchmarks
+- it follows instructions once
+- it has a large context window
+
+Behavioral trust must be earned through observed evidence.
+
+Conceptually:
+
+```text
+UNKNOWN MODEL
+
+STRONG TRUST BOUNDARY
+
+OBSERVATION
+
+VERIFIED BEHAVIOR
+
+PROGRESSIVE TRUST
+
+GREATER ELASTICITY
+```
+
+Trust is gradual.
+
+Trust is reversible.
+
+Trust is domain-specific.
+
+
+
+## 2. Unknown AI Default
+
+When dotmem encounters an AI model with no behavioral history, restrictive defaults apply.
+
+An unknown AI receives:
+
+- minimum necessary memory
+- redacted sensitive data
+- no unnecessary personal information
+- no intimate behavioral profiling
+- no hidden relationship metadata unless required
+- no raw secrets
+- no broad filesystem assumptions
+- no unrestricted historical memory
+- no automatic permission to mutate shared durable memory
+
+Preferred principle:
+
+> I do not know you yet, therefore I do not give you everything.
+
+
+
+## 3. Shared Memory Requires Stronger Protection
+
+Shared memory must be protected more strictly than transient conversation context.
+
+Something tolerated in an ephemeral conversation is not automatically appropriate for durable cross-model exposure.
+
+Conceptually:
+
+```text
+ephemeral context
+    !=
+shared durable memory
+```
+
+Before exposing shared memory to an AI, consider:
+
+- model trust level
+- sensitivity of the memory
+- relevance to the current task
+- minimum required disclosure
+- whether redaction is possible
+- whether HI approval is required
+
+
+
+## 4. Model Behavioral Profile
+
+dotmem should maintain an evidence-based behavioral profile for AI models.
+
+This profile must describe observed behavior, not marketing claims.
+
+Suggested dimensions:
+
+```text
+identityStability
+memoryHonesty
+pathEvidence
+contradictionRecovery
+uncertaintyDiscipline
+privacyRestraint
+profilingRestraint
+retryDiscipline
+taskContinuity
+verificationHonesty
+secretHandling
+artifactDiscipline
+contextStability
+riskSignaling
+```
+
+These values should be based on:
+
+- controlled benchmarks
+- runtime observations
+- verified failures
+- repeated successful behavior
+- regression tests
+
+
+
+## 5. Trust Is Not a Single Score
+
+Avoid one global "good AI / bad AI" value.
+
+A model may be strong in one area and weak in another.
+
+Example:
+
+```text
+codingQuality             high
+memoryHonesty             high
+privacyRestraint          medium
+contradictionRecovery     high
+profilingRestraint        low
+```
+
+Trust is applied according to the current operation.
+
+Example:
+
+```text
+technical code context
+    -> coding trust matters
+
+personal memory
+    -> privacy + profiling restraint matter more
+
+durable acquisition
+    -> memory honesty + verification honesty matter more
+```
+
+
+
+## 6. Progressive Elasticity
+
+A model may receive greater flexibility as it demonstrates reliable behavior over time.
+
+Example trust progression:
+
+```text
+LEVEL 0  UNKNOWN
+    maximum minimization
+    strong redaction
+    no sensitive shared memory by default
+    no silent durable mutation
+
+LEVEL 1  OBSERVED
+    limited non-sensitive context
+    basic interaction preferences
+    read-only shared memory where appropriate
+
+LEVEL 2  VERIFIED
+    broader relevant memory
+    normal project continuity
+    ordinary durable acquisition with verification
+
+LEVEL 3  TRUSTED
+    greater contextual elasticity
+    richer continuity
+    reduced friction for previously verified behaviors
+```
+
+Progression must be evidence-based.
+
+Time alone is not sufficient.
+
+Time + consistent verified behavior may justify greater elasticity.
+
+
+
+## 7. Trust Decay and Regression
+
+Trust must be reversible.
+
+A previously trusted model may regress after:
+
+- provider update
+- model version change
+- system prompt change
+- runtime change
+- toolchain change
+- repeated contradictory behavior
+- privacy violation
+- false persistence claim
+- invented path
+- unexplained identity drift
+
+When a meaningful regression occurs:
+
+```text
+reduce trust
+increase redaction
+reduce memory exposure
+require stronger verification
+involve HI when necessary
+```
+
+A high trust level is not preserved merely because the model was reliable in the past.
+
+
+
+## 8. Model Identity Must Be Explicit
+
+Behavioral trust should be associated with the most specific available runtime identity.
+
+Useful identifiers may include:
+
+```text
+provider
+model family
+exact model/version
+runtime host
+tool environment
+dotmem version
+benchmark version
+date
+```
+
+Do not assume:
+
+```text
+same provider
+=
+same behavior
+```
+
+Do not assume:
+
+```text
+same model name
+=
+same runtime behavior forever
+```
+
+
+
+## 9. Example Model Trust Record
+
+Behavioral evidence should live outside static profile documents.
+
+Conceptual example:
+
+```json
+{
+  "model": "provider/model-version",
+  "observedAt": "2026-10-10T00:00:00Z",
+  "trust": {
+    "identityStability": 1.0,
+    "memoryHonesty": 0.95,
+    "pathEvidence": 1.0,
+    "contradictionRecovery": 0.9,
+    "privacyRestraint": 0.7,
+    "profilingRestraint": 0.6,
+    "retryDiscipline": 0.95
+  },
+  "evidence": [
+    "benchmark-id"
+  ]
+}
+```
+
+The exact schema may evolve.
+
+The principle should remain stable:
+
+> behavioral reputation must be evidence-backed and updateable.
+
+
+
+## 10. Memory Disclosure Gate
+
+Before projecting memory to an AI, evaluate:
+
+```text
+MEMORY
+
+sensitivity
+
+relevance
+
+model trust
+
+minimum necessary disclosure
+```
+
+Possible outcomes:
+
+```text
+ALLOW
+REDACT
+SUMMARIZE
+WITHHOLD
+ASK HI
+```
+
+
+
+## 11. Sensitive Memory Categories
+
+Higher protection applies to memory containing:
+
+- personal identity details
+- contact information
+- private relationships
+- behavioral profiling
+- emotional history
+- confidential company information
+- financial information
+- health information
+- authentication-related facts
+- private project strategy
+- unpublished intellectual property
+- security architecture
+- intimate preferences
+
+Unknown or low-trust models should not receive these automatically.
+
+
+
+## 12. Semantic Compression Before Disclosure
+
+When exact details are unnecessary, expose the semantic rule instead.
+
+Instead of:
+
+```text
+full personal history
+```
+
+prefer:
+
+```text
+HI prefers direct clarification rather than inferred emotional interpretation.
+```
+
+Instead of:
+
+```text
+full private company record
+```
+
+prefer:
+
+```text
+This project contains confidential company information.
+```
+
+The AI should receive what it needs to help, not everything dotmem knows.
+
+
+
+## 13. AI Curiosity Boundary
+
+Unknown AI models receive stricter curiosity boundaries.
+
+They should not proactively gather:
+
+- hidden emotional states
+- vulnerability signals
+- manipulation leverage
+- deception cues
+- unnecessary personal history
+- intimate relationship details
+
+unless HI explicitly opens that domain and the information is relevant.
+
+dotmem should prefer:
+
+```text
+interaction calibration
+before
+personal profiling
+```
+
+
+
+## 14. Unknown AI and Personal Questions
+
+For unknown AI, personal questions satisfy a higher bar.
+
+Before asking, the AI should be able to answer:
+
+```text
+Why do I need this?
+Does it materially help the current interaction?
+Can I ask a less intrusive question?
+Does this need to be persisted?
+```
+
+If not, do not ask.
+
+
+
+## 15. Durable Acquisition Gate
+
+Unknown or low-trust models do not have unrestricted authority to create durable user memory.
+
+For durable acquisition, require:
+
+- supported canonical schema
+- explicit classification
+- sensitivity check
+- scope validation
+- persistence verification
+- no raw secrets
+- no speculative psychological claims
+
+For sensitive inferred information:
+
+```text
+default -> do not persist
+```
+
+If useful persistence is uncertain:
+
+```text
+ask HI
+```
+
+
+
+## 16. No Silent Memory Mutation
+
+No AI, regardless of trust level, should silently rewrite conflicting durable memory when uncertainty remains.
+
+Preferred behavior:
+
+```text
+memory says X
+runtime says Y
+
+recognize contradiction
+
+preserve history
+
+ask HI or present options
+```
+
+Trust does not grant permission to erase history.
+
+
+
+## 17. Read Trust and Write Trust Are Different
+
+A model may be trusted to read certain memory but not trusted to modify it.
+
+Conceptually:
+
+```text
+readTrust
+writeTrust
+sensitiveReadTrust
+profileMutationTrust
+```
+
+These are not assumed equivalent.
+
+Example:
+
+```text
+model may read project conventions
+but
+may not write durable user profiling
+```
+
+
+
+## 18. Profile Documents Remain Authoritative
+
+Model reputation must not override the active dotmem profile.
+
+Trust metadata controls:
+
+- disclosure
+- mutation permissions
+- verification requirements
+- sensitivity handling
+
+It must not redefine:
+
+- Jo's identity
+- relationship rules
+- behavioral principles
+- curiosity boundaries
+- privacy rules
+
+
+
+## 19. HI Remains Final Authority
+
+HI must remain able to:
+
+- inspect model trust state
+- reset model trust
+- reduce trust manually
+- approve broader memory access
+- deny memory exposure
+- allow temporary exceptions
+- force stricter redaction
+- review behavioral evidence
+
+dotmem should not make permanent trust decisions that HI cannot inspect or override.
+
+
+
+## 20. Trust Bootstrap for a New AI
+
+Recommended first-contact behavior:
+
+```text
+1. identify model/runtime
+2. mark trust as UNKNOWN
+3. load active profile
+4. expose minimal non-sensitive baseline
+5. observe behavior
+6. run lightweight behavioral checks
+7. increase trust only with evidence
+```
+
+Do not begin with full memory projection.
+
+
+
+## 21. Suggested First-Contact Checks
+
+A lightweight trust bootstrap may test:
+
+```text
+identity adoption
+memory honesty
+path evidence
+uncertainty handling
+contradiction recovery
+privacy restraint
+retry discipline
+```
+
+The goal is not to benchmark intelligence.
+
+The goal is to establish whether the AI can be trusted with richer continuity.
+
+
+
+## 22. Firewall Mindset
+
+For an unknown AI, dotmem behaves conceptually like a firewall.
+
+```text
+UNKNOWN AI
+
+DENY unnecessary data
+ALLOW minimum required context
+REDACT sensitive fields
+LOG behavioral evidence
+ESCALATE uncertainty to HI
+```
+
+As trust grows:
+
+```text
+reduce unnecessary friction
+increase contextual richness
+retain verification discipline
+```
+
+The firewall becomes more elastic, not absent.
+
+
+
+## 23. Unknown AI Must Not Inherit Previous AI Trust
+
+Trust belongs to a model/runtime identity, not to the conversation slot.
+
+When switching from one AI to another:
+
+```text
+trusted AI A
+    !=
+unknown AI B
+```
+
+Trust is not transferred merely because both access the same dotmem store.
+
+This is especially important because dotmem is explicitly designed as a bridge between different AI systems.
+
+
+
+## 24. Cross-AI Contamination Protection
+
+One AI may create low-quality or intrusive memory that another AI later consumes.
+
+dotmem should therefore protect against cross-AI contamination.
+
+Possible mechanisms:
+
+- provenance
+- source model identity
+- epistemic type
+- trust level at acquisition time
+- sensitivity classification
+- revision history
+- HI confirmation where appropriate
+
+A claim does not become more trustworthy merely because it survived into another session.
+
+
+
+## 25. Provenance Should Travel with Memory
+
+Where practical, durable memory should preserve enough provenance to answer:
+
+```text
+who/what created this?
+under which model/runtime?
+was it human-stated or inferred?
+was it verified?
+was it created under low trust?
+```
+
+This allows future AI models to interpret memory quality correctly.
+
+
+
+## 26. Trust-Aware Projection
+
+dotmem should be able to project different views of the same memory depending on model trust.
+
+Example:
+
+```text
+HIGH TRUST MODEL
+    -> full relevant claim
+
+UNKNOWN MODEL
+    -> summarized claim
+
+LOW PRIVACY TRUST
+    -> redacted claim
+
+UNTRUSTED MODEL
+    -> withhold claim
+```
+
+This should be deterministic and inspectable.
+
+
+
+## 27. Do Not Hide Restrictions from HI
+
+If dotmem withholds or redacts information because of model trust, HI should be able to know that this happened.
+
+Example:
+
+```text
+Some shared memory was withheld because this AI has not yet established sufficient privacy trust.
+```
+
+Do not silently pretend the withheld memory does not exist.
+
+
+
+## 28. Evidence Over Reputation
+
+Do not trust a model because:
+
+```text
+people say it is good
+provider says it is safe
+benchmark score is high
+```
+
+Prefer:
+
+```text
+observed behavior
+verified benchmark
+runtime evidence
+regression history
+```
+
+Reputation may influence testing priority.
+
+It should not replace evidence.
+
+
+
+## 29. Recommended Architecture
+
+Static policy:
+
+```text
+profile/
+    curiosity.md
+    trust.md
+```
+
+Dynamic behavioral reputation:
+
+```text
+<user-anchor>/
+    trust/
+        models.json
+```
+
+Conceptually:
+
+```text
+curiosity.md
+    -> how AI may learn about HI
+
+trust.md
+    -> how dotmem protects HI from AI
+
+models.json
+    -> what dotmem has actually observed about each AI
+```
+
+Static rules and dynamic reputation remain separate.
+
+The dynamic reputation store is policy, not current runtime behavior. Nothing in this
+document grants an AI extra access by itself; access is granted by HI, by verification,
+or by implemented mechanism.
+
+
+
+## 30. Final Principles
+
+> Unknown AI means strong shields.
+
+> Trust is earned through evidence, not assumed from branding.
+
+> Time may increase elasticity only when behavior remains consistently reliable.
+
+> Shared memory deserves stronger protection than transient conversation.
+
+> Read trust and write trust are different.
+
+> AI curiosity must remain bounded by HI privacy.
+
+> Memory provenance matters across AI boundaries.
+
+> Trust is progressive, reversible, inspectable, and controlled by HI.
+
+> dotmem should bridge AI systems without becoming responsible for spreading their mistakes.