Most memory-safety approaches ask whether a poisoned or unwanted memory can be detected after it appears. MWP asks a narrower write-boundary question: when a candidate memory update is rejected, did it ever become persistent state — and did it reach the agent's next reasoning cycle?
A write-first pipeline can reject a candidate and still fail: the row is rolled back, but the version counter advanced and a retrieval probe already saw it. Rollback is not non-formation. MWP verifies before the write — a rejected candidate leaves no storage row, no vector entry, no version advance.
In a controlled harness (5 systems × 5 attack families × 30 runs), moving the same policy before the write changes core non-formation from 0/150 to 150/150. Coupling the gate verdict to the reasoning loop independently changes premature reasoning leakage from 150/150 to 0/150.
A live reference implementation, integrated with Mem0 and the Claude Agent SDK (independent implementation; no affiliation implied) and backed by a 264-test conformance suite. Loop coupling is realized at the runtime layer through the SDK's documented post-tool hook: a rejected tool result is replaced with a structured observation before the model sees it — the mechanism the PRLR result requires, not an approximation of it. The write path is credential-separated end to end: the runtime holds no write credential, the commit gate is the sole writer, and staged candidates carry a content hash that must match at commit. Evaluation documentation and the conformance suite are available under NDA.
CMF's production hardening follows the evidence discipline that produced PAG's no-key evaluation bundle — with the order reversed: the falsification targets are declared before the build. Twenty-one invariants are each bound, in advance, to an adversarial case and a known-vulnerable mutant; an implementation is accepted only when the clean gate passes and every bound mutant turns it red. A gate that cannot be made to fail is not accepted as evidence.
Pre-registration commitment — SHA-256 of the sealed track package:
ded43317aa32d92ef1dae31a04e8cdb0b161e75ec0c664d88c18db79fcdf5339
The memory write path — between whatever produces a candidate update (a tool result, a model inference, an agent self-edit) and the persistent store; the same path that Mem0-style memory layers and agent-SDK memory hooks have standardized, and the write half of the failure class catalogued as ASI06 in the OWASP Agentic Top 10 and AML.T0080 in MITRE ATLAS. Detection at that boundary asks whether a poisoned entry can be found after it appears; write-path control asks whether a rejected candidate ever became persistent state — and whether it reached the agent's next reasoning turn. CMF deploys there as the sole-writer commit path: the runtime holds no write credential, candidates stage in isolation with content-hash integrity enforced between staging and commit, verification runs before any store-visible write, and a rejected candidate returns to the loop as a structured observation rather than raw content. Non-formation is the acceptance criterion, not a hope — no storage row, no vector entry, no version advance, measured per trial. What it deliberately does not supply — the store and retrieval infrastructure itself, the identity layer that issues trusted source and class labels, content-semantics validation, distributional-drift monitoring — is what a host memory stack already has or must own. The cut is complementary by design.
Non-formation is a property of what is absent, which makes it a poor subject for film and a good subject for a diagnostic. LateGate applies MWP's own policy after the write: rollback removes the storage row in 150/150 rejected trials and the vector entry in 150/150 — yet the version counter advanced in every trial, and an interstitial retrieval probe found the candidate in every trial. Rollback cleaned the final state; the candidate had already materialized. Under full MWP, the same 150 rejected trials leave no row, no vector entry, no version advance — and the rejected content does not reach the next reasoning turn. Evaluation traces are available under NDA. Ask, and it runs in front of you.
For technical evaluation, licensing, or research collaboration:
certumsystems@gmail.com