consolidation has no lineage audit: compression and episodic→semantic abstraction can promote a low-trust memory to higher confidence

[cdeust]

The store-phase attack class in arXiv 2604.16548 is "compression-amplified toxins": "Toxins promoted to higher confidence during summarization/reflection", "progressive erosion through multi-step distillation", and "loss of audit trail during compression." Required defense: compression must operate "under audit thresholds" with "compression-lineage preservation" and separation of audit logs from operational memory. The survey reports compression auditing "absent from all examined systems" and that store/forget phases "remain sparsely studied."

Cortex has an unusually deep distillation stack, which makes this the most load-bearing instance of the problem rather than a marginal one:

• core/compression.py — full-text → gist → tag
• core/dual_store_cls.py + core/dual_store_cls_abstraction.py — episodic → semantic (CLS)
• core/schema_engine.py + core/schema_extraction.py — Piaget accommodation into cortical schemas
• core/synaptic_tagging.py — retroactive promotion of weak memories sharing entities (Frey & Morris 1997)
• core/replay.py / core/sleep_compute.py — dream replay, cluster summarization, auto-narration
• core/reconsolidation.py — memory updating on access

synaptic_tagging.py is the sharpest case: retroactive promotion by shared entities means a single high-heat memory can lift the standing of weak memories that merely share an entity — the survey's "promoted to higher confidence" made mechanical. Combined with #365 (a poisoned memory can be written with a decision cue) the promotion path is reachable from untrusted input.

What is missing

There is no lineage record answering: this semantic memory was abstracted from which episodic memories, at which stage, under which confidence, and did any of its ancestors have untrusted provenance? Confidence is carried, but not the derivation chain that produced it, so a promotion cannot be audited or reversed on the ancestor being invalidated.

Partial credit where due: infrastructure/artifact_store.py preserves the pre-compression raw text content-addressed, which is real lineage for the first hop (full-text → gist). The gap is the hops after it — episodic → semantic → schema — and the absence of any trust attribute travelling along them.

Ask

1. Record derivation lineage across each distillation hop: which ancestors produced this derived memory, at which stage.
2. Propagate a trust/provenance floor along the chain — a derived memory cannot exceed the trust of its least-trusted ancestor (depends on security: WebFetch/WebSearch output is auto-captured into long-term memory on a keyword the content controls — end-to-end poisoning path #365 introducing the attribute).
3. Make invalidation transitive: forget/rate_memory-as-bad on an ancestor must be able to find and re-evaluate its descendants (depends on privacy: forget() deletes one row — raw artifacts are never deleted and wiki claims are only SET NULL, so PRIVACY.md overstates deletion #366 for the deletion half).
4. Keep the audit trail separate from operational memory, per the survey, so audit records are not themselves consolidation inputs.

Acceptance criteria

• Lineage is queryable both directions (ancestors of a derived memory; descendants of an episodic one) on SQLite and PostgreSQL (§12.3).
• A test builds an untrusted-provenance episodic memory, runs consolidation, and asserts the resulting semantic memory does not carry higher trust than its ancestor.
• A test invalidates an ancestor and asserts descendants are reported/re-evaluated, with the signal asserted (§13 F1).
• Ingest and consolidation cost measured before/after; lineage writes are on the hot consolidation path (§13 C1/C3).
• Zero surviving non-equivalent mutants on changed files (§12).

Relates to #365, #366, and #364 — note #364 asks whether compression costs reasoning fidelity; this issue asks whether it costs auditability. Both point at the same stack for different reasons.