The governance / temporal pillar of verifiable memory.
Provable forget (Pillar 2)
ErasureAuditor.compliance_receipt(subject, values, sign=, pubkey=, request_id=, basis=)— runs the audit and packages it as a shareable, signed proof-of-erasure receipt (the artifact a DPO hands a regulator under GDPR Art. 17 / EU AI Act record-keeping): which stores were checked, the per-store adversarial-recovery verdict, request/basis, timestamp — tamper-evident under your key.verify_compliance_receipt+ed25519_signer/ed25519_verifyBYO-key helpers (or plug an HSM/KMS). Crypto is a lazy import — the framework stays dependency-free until you sign.probes/forget_verification_bench.py— an open benchmark no recall leaderboard covers: after a right-to-erasure deletion, does the value provably stop being recoverable across the 6-store fan-out? Scores the common 'delete the row' bug (~0.17 — five stores still leak) vs a correct hard-delete (1.00, verified).
Bitemporal audit (Pillar 3)
as_of(key, when, as_recorded=)gains a second clock: pass a transaction-timeas_recordedto reconstruct what we believed, at that recording time, was true at valid-timewhen— a later correction can't leak into the earlier belief.believed_at(key, as_recorded)returns what the agent would have acted on if frozen then.as_recorded=Noneis byte-identical to the prior valid-timeas_of.
57 tests pass; opt-in and backward-compatible throughout.