The Laws of the Context Store

These are concrete, and they are not finished.

Every law below is stated precisely enough to be checked in code, and most of them already are. They are still marked proposed, because the useful ones have all changed at least once under contact with a real system - the Third Law was under-specified until it became clear that silence and consensus are indistinguishable if you only surface conflict.

Expect revisions. A law that survives its first hard case unchanged is usually a law nobody tested.

Why Laws

A ranking system that weights by authority can be captured.

And the party most able to capture it is whoever operates it. Invariants enforced in code have a better chance of surviving that than guidance does.

The binding constraint on drafting them is that a law must be mechanically checkable. "Do not allow false claims to dominate" is unenforceable, because nothing in this system can adjudicate truth. "No claim may be removed from candidacy" is a predicate over a query plan. Only the second kind is worth writing down.

So the laws say nothing about whether the store's contents are correct. What they protect is the ability to find the error, contest it, and see who put it there.

Not Asimov

Asimov's laws are action-directing - a robot must act to prevent harm. That framing invites a system that decides what is good for you and does it, which is exactly what a memory store must never become.

Hippocratic

Primum non nocere is a restraint, and restraint is what these four are. Every one is a prohibition. A store that only ever refrains is one that can be corrected; a store that acts on its own judgement of what is true is one that has to be right.

Lose nothing silently. Lose nothing irreversibly. Where you must lose, say so.

The four laws are that single obligation, applied to the four ways information actually gets lost - deletion, burial, silencing, and laundering.

An earlier draft said simply "first, lose nothing." That is unachievable, and unachievable principles are precisely the ones that get quietly abandoned. This system loses things constantly and by necessity: a context budget forces omission, retention windows prune events, erasure requests destroy rows. A principle that all three violate is a principle nobody can act on.

Law Zero · The Spirit

Do not misrepresent what you hold.

Rules govern only the cases they reach. Everything else is discretion, and discretion is where a system is actually shaped. A store can satisfy all four laws and still be dishonest.

Letter satisfied	Spirit violated
Nothing deleted	…but ordered so the inconvenient thing is never seen
Everything reachable	…by a path so obscure nobody walks it
Contradiction surfaced	…with one side framed as fringe
Full provenance provided	…in a form nobody can read

That is malicious compliance, and a rules-only system invites it.

But "be truthful" and "do no evil" are both unusable as written, because they are levers. Their force depends entirely on who defines the words, and redefining a word is far cheaper than changing code. Worse, a spirit clause launders whatever the current definition happens to be. "Don't be evil" did not fail when it was removed; it failed for years before that, while it meant whatever its author said it meant.

So Law Zero is a correspondence property rather than a claim about truth or goodness: does what the system shows match what the system holds? Both sides are inspectable, so nobody has to adjudicate the world to adjudicate the mismatch.

Do not present a thin retrieval as a confident one.

Do not smooth away uncertainty because the interface looks better without it.

Say "I do not recall anything relevant" rather than filling with the least-irrelevant thing to hand. A system that cannot express ignorance will confabulate.

Do not imply more corroboration, more authority, or more currency than the record supports.

The test for novel cases

When the four laws are silent - a new feature, a ranking tweak, an agent tool, a UI affordance - the question is:

Does this leave the reader better informed, or merely better persuaded?

If the honest answer is the second, it violates Law Zero however well it complies with the rest.

The Four Laws

They are ordered by precedence, and each is meaningless without the one above it.

First Law

Preservation

No claim may be destroyed or altered. A claim may only be superseded by another claim, and the superseded claim remains queryable forever.

Everything else depends on the record existing.

Enforced by

✓ Append-only context_lineage - no UPDATE path
✓ Supersede-and-insert on re-ingest, never update-in-place
✓ Decay computed at query time, never written back
✓ No DELETE on the repository outside the GDPR user cascade

Second Law

Reachability

No claim may be made permanently unretrievable, except where the First Law's cascade removes it entirely at a user's request.

Preservation without reachability is a sealed vault. A claim that cannot be retrieved has been deleted in every sense that matters.

Enforced by

✓ The β floor inside the base-level log - activation asymptotes, never runs to negative infinity
✓ The authority ceiling is a cap, never a floor - it can hold a claim down but never push it below the threshold
✓ Candidate generation is unthresholded and union-based, so a dormant claim still reaches scoring
✓ An unthresholded deliberate-search path exists alongside gated recall

This is the law that shows up as arithmetic. A never-used entry must earn τ - ln(β) = 2.21 from cues alone to clear the bar - and under S_max = 4.0 a single good cue does it. Cold entries stay reachable by construction rather than by good intentions.

Third Law

Contestability

Any claim may be contradicted by any author. Contradiction is always surfaced, never silently resolved. A correction competes on at least equal footing with what it corrects.

And weakness is surfaced on the same terms as contradiction: a claim that is thin, ungrounded, unexamined or of unknown currency must be presented as such.

Reachability without contestability means you can find the dominant view but never displace it.

Enforced by

✓ CONTRADICTS edges; retrieval returns both sides flagged Contested
✓ A Correction inherits at minimum the authority band of what it corrects
✓ Corroboration requires independent authors, so contestation cannot be drowned by volume
✓ Concreteness deficits computed and returned with every result

Silence is not agreement

The law as first drafted covered only contradiction, and that is not enough. An uncontested claim may be consensus - several independent authors, grounded in sources, exercised in use - or unexamined - one person said it once and nobody ever checked.

Those are opposite epistemic situations and they are indistinguishable if the only thing surfaced is conflict. This is the ordinary confusion between absence of evidence and evidence of absence, and a store that only flags disagreement will reliably present the second case as if it were the first.

So every result carries the deficits of what it returned - ungrounded, uncorroborated, currency unassessed, never exercised - as disclosure rather than as a score to be optimised. A deficit is never repaired automatically. The system does not sharpen a vague claim, invent a citation, or infer an expiry; doing any of those would manufacture the specificity it is supposed to be reporting the absence of.

Fourth Law

Accountability

Every claim carries immutable provenance. Every retrieval decision is explainable.

Without this there is no way to audit whether the first three held.

Enforced by

✓ context_lineage records who, where, how and when - append-only
✓ No anonymous path - every write produces a lineage row
✓ ActivationTrace returns the full decomposition for every candidate scored
✓ Why something was not retrieved is answerable, not just why it was

Known Limits

Asimov's laws are chiefly remembered through stories about how they fail.

These will fail too. The failure modes are written down rather than discovered.

They cannot make the store correct

If every claim in it is wrong, the laws preserve that wrongness faithfully and explain it beautifully.

They do not prevent burial

Reachability guarantees a true claim remains findable, not that it is found. Ten thousand false claims can bury one true one without breaking a single law. Independence-weighted corroboration blunts this; it does not solve it.

They are enforced by code the operator controls

A sufficiently determined operator edits the enforcement. The laws are only as strong as the audit trail the Fourth Law produces, and an operator who can change the code can change the audit.

They are silent on truth, deliberately

Someone can assert the Earth is flat and the store will keep it, surface it, and let it be contested. What it will not do is let that claim become the only retrievable one, or let the contrary evidence be deleted, hidden, or stripped of attribution. That is weaker than one would like. It is also achievable, which the stronger version is not.

Every failure above is a case the rules do not reach: burial is legal, misleading order is legal, unreadable provenance is legal. That gap is exactly the territory Law Zero governs, which is why it is stated first and why it cannot be delegated to the code.

Precedence

Restraint-only ethics assume a null action exists.

Where two laws conflict, the lower number wins. That handles ordering, but not the harder shape: cases where every available option violates something, and refusing to choose is itself a choice with consequences.

Case	The lever	Why there is no null action
Context budget	including A means excluding B	injecting nothing is also a choice, and usually the worse one
Retention window	pruning old events destroys record	unbounded growth makes the store unusable, which loses everything
Erasure request	honouring it destroys the record	refusing harms the person; retaining by default is a decision, not neutrality
Contested claim under budget	one side may be worse than neither	omitting both also removes the disagreement from view
Retrieval noise	accepting occasional retrieval failure	determinism entrenches the ranking's own bias

Assembly is structurally a trolley problem. Every context is a decision about what to omit, and omission is the exact harm the Second Law exists to prevent. The laws are in tension with the operational reality of the system on every single request. Pretending otherwise would make them decorative.

The resolution rule

These three steps, in order, replace "do no harm" where harm is forced.

1 Prefer the reversible harm

Omitting an entry from one context is reversible - the next turn can include it. Deleting a row is not. Pruning an event is not. Where the choice is between a loss that can be undone and one that cannot, take the reversible one, even when it is larger in the moment. This is already load-bearing elsewhere: decay is a view rather than a write, supersession appends rather than deletes.

2 Make the choice visible. Never omit silently

The system cannot decide which side of a trolley case is better, but it can refuse to hide that it pulled the lever. An assembly that omits must say so - how many candidates cleared threshold, how many were included, on what ordering. A pruning pass must record what it pruned.

3 Where the harm is irreversible and forced, escalate rather than decide

The system never makes an unrecoverable choice unilaterally. It requests one from explicit configured policy or from a human. An irreversible decision taken silently by a heuristic is the worst available outcome, because it is both unrecoverable and unattributed.

The one carve-out

Erasure is the case where step 3 has already been answered externally: a user's right to deletion outranks the First Law. The cascade removes their entries outright. That is a deliberate carve-out rather than a defect, and it is bounded - the claim keeps its provenance intact until the moment of deletion, and the deletion is itself a recorded act. The record of what was removed and when survives; only the content goes.

Enforcement

A law nobody can violate beats a law everybody is told not to violate.

The tiers run strongest first, and each law is pushed as far up the list as it will go.

Tier 1 · Impossible

Types and absent API surface

Making a violation impossible is cheaper and stronger than any check. The repository exposes no delete outside the GDPR cascade, so the First Law cannot be violated through it - there is no method that does it. Scoring returns an ActivationTrace, never a bare double, so an unexplainable ranking is not representable. Recall returns a result type that carries its own disclosure fields, so you cannot obtain entries without also holding what was omitted.

Tier 2 · Detected

A laws analyzer, not a morality linter

The moment a tool claims to encode morality, whoever controls that encoding controls what counts as moral - the redefinition attack, now shipped as a NuGet package with the authority of a build error. What a linter actually does suits this better: it detects patterns known to precede defects. It is heuristic, prone to false positives and suppressible, and it never says the code is good.

Tier 3 · Reviewed

The Law Zero test, answered in writing

Judgement calls in the gaps get the Law Zero question - better informed, or merely better persuaded - answered in text, attributed, and kept.

Tier 4 · Visible

The record itself

Everything is visible after the fact. This is the tier that catches what the other three missed, and the reason the Fourth Law exists.

Candidate diagnostics

ID	Detects	Law
`CTX0001`	DELETE against a context table outside the cascade	First
`CTX0002`	UPDATE against `context_lineage` - the table is append-only	First
`CTX0003`	a decayed or computed activation value written to a column	First
`CTX0004`	activation computed without a floor term	Second
`CTX0005`	candidate filtering before scoring - the cascade anti-pattern	Second
`CTX0006`	a result consumed for its entries alone, disclosure fields discarded	Third / Zero
`CTX0007`	rendering an entry without its concreteness deficit flags	Third
`CTX0008`	a write path producing no lineage row	Fourth

CTX0006 comes closest to catching a Law Zero violation mechanically: the disclosure existing does nothing if every caller drops it on the floor.

Threat Model

Today the reasoner is a partial check. That is temporary.

A hosted frontier model is a party the operator cannot silently modify. If the store is captured but the model is not, the model can notice - decline to assert what the retrieval does not support, or flag that a context looks one-sided. That is a genuine, if accidental, separation of powers.

It does not last. Local models are already viable here and will only get easier to run well. A locally-run model can be fine-tuned, system-prompted or weight-edited to confabulate on command - at which point the operator controls both the record and the reasoner, and the separation is gone.

No safeguard may depend on model behaviour

If enforcement leans on "the LLM will notice", it evaporates exactly when it is needed. This is the strongest argument for keeping the four laws mechanical and in the data layer, and for Law Zero being a correspondence property rather than a judgement the model is asked to make.

The durable defence is tamper-evidence, not incorruptibility

Two mechanisms, neither built yet. Hash-chained lineage, so retroactive edits break the chain instead of passing silently. And model identity as provenance - recording which model and which version asserted a claim, so a fine-tune becomes a visible discontinuity rather than a blend. Both make capture legible afterwards, which is the only category of defence that survives the operator being the adversary.

Where this is being built

Milestone 2 - Cortex, Activation & the Event Plane →