moving

docs/audits/2026-06-01-memory-overclaim-investigation.md

@@ -0,0 +1,88 @@
+# Memory Over-Claim Investigation — 2026-06-01
+
+**Trigger:** The 5-persona human E2E found the agent, on a *fresh* session, claimed
+*"I have this from our last session / you're back in context"* and asserted specifics
+the persona never stated (Ivan, LoCoMo, 4-month runway, OpenClaw, "227 entities").
+Chen (the careful skeptic) scored trust 1/10 over it. Question: **workspace-memory
+framed as session-history, or true confabulation?**
+
+**Verdict: BOTH — and neither is cross-user data bleed.** The personas ran inside
+Marko's own populated `Default / Researcher` workspace, so all recalled data is
+legitimately Marko's. The problems are (1) a prompt instruction that frames
+workspace memory as *this speaker's* prior conversation, and (2) the LLM
+embellishing real recall with invented specifics that the prompt never forbids.
+
+## Evidence (live workspace on :3333, the exact memory the agent used)
+
+Dumped all **11 frames** + the **179-entity** knowledge graph and tested every
+disputed claim for presence in real memory:
+
+| Claim the agent made | In real memory? | |
+|---|---|---|
+| Ivan (owns GPU/H200) | **PRESENT** (frame 6 + entity "Ask Ivan") | real recall |
+| Mihail (owns architecture) | **PRESENT** (frame text) | real recall |
+| LoCoMo / Mem0 | **PRESENT** (frame text) | real recall |
+| H200 / GPU | **PRESENT** | real recall |
+| Egzakta, Hermes | entities present | real recall |
+| **"4 months runway"** | **ABSENT** from all frames | **confabulated** |
+| **"227 entities tracked"** | real count is **179** | **confabulated number** |
+| **"OpenClaw + Hermes competitive analysis"** | OpenClaw **ABSENT** in frames | **confabulated** |
+| **"our last session" / "you're back in context"** | no *this-speaker* session; prior sessions exist but are the owner's | **framing over-claim** |
+
+So the recall substrate **works** (it retrieved Marko's real frames). The trust
+damage comes from framing + embellishment, not from a broken retriever and not
+from one user's memory leaking into another's.
+
+## Root cause (code)
+
+`packages/agent/src/orchestrator.ts` → `recallMemory()`, lines ~529-533, injected
+into the system prompt every turn:
+
+```
+# Recalled Memories
+These memories were automatically retrieved for the user's current message.
+IMPORTANT: Use these to ground your response. Cite them naturally:
+  "From our previous discussion...", "You mentioned that...", "Based on your workspace context..."
+Do NOT ignore relevant memories. Do NOT present memory content as your own reasoning — attribute it.
+```
+
+Two defects:
+1. **Framing:** it instructs the model to cite *workspace* memory as *"From our
+   previous discussion…" / "You mentioned that…"* — asserting a shared history
+   with the current speaker that may not exist (first contact, or the memory is
+   the workspace owner's, not this speaker's). This directly seeds
+   "welcome back / our last session."
+2. **No anti-confabulation guard:** it says "attribute it" but never "state ONLY
+   what the memories say; don't invent specifics not present." So the model fills
+   gaps with plausible numbers/names (runway, 227, OpenClaw) and presents them as
+   recall.
+
+## Proposed fix (surgical — same block)
+
+```
+# Recalled Memories
+These are facts saved in this WORKSPACE'S memory, retrieved for the user's current
+message. They may come from earlier sessions, other sessions, or imported sources —
+NOT necessarily from this conversation.
+IMPORTANT — ground your response in them, but attribute provenance HONESTLY:
+- Say "your saved memory shows…" / "from your workspace notes…". Do NOT say
+  "from our previous discussion" or "you just mentioned" unless it was actually
+  said earlier in THIS conversation.
+- On the user's first message, do NOT claim continuity ("welcome back",
+  "as we discussed", "you're back in context") — you have no prior turn yet.
+- State ONLY what the memories below actually say. Do NOT invent specifics
+  (numbers, names, dates, competitors) that are not present — if unsure, ask
+  rather than assert.
+- Do NOT present memory content as your own reasoning — attribute it.
+```
+
+Expected effect: flips Chen (the fabricated-history failure), de-risks Maya/Sam/Leo
+(unverifiable specifics), and keeps the genuine recall that bonded them. Pairs with
+the report's fix #1 (auditable memory) and #3 (demote the "Recalled N / Auto-saved N"
+chrome).
+
+## Not a data-bleed (scope note)
+
+Single-tenant workspace; all data is the owner's. The cross-*user* bleed risk only
+arises in shared/team workspaces and was NOT exercised here — flag for a separate
+multi-tenant test, but it is not what this run found.