v2.0.0: memory you can check before you trust it

Packages: the 2.0.0 packages did not reach NuGet, because the publishing key had expired. Install 2.1.0, which contains everything below plus look-ahead recall. This page keeps the 2.0.0 notes and the evidence behind the preprint.

Most agent memory asks you to take it on faith: plug it in, hope it helps, find out in production. 2.0.0 is built on the
opposite idea. A memory component earns its place. It is verified, walked within declared budgets, trialled on the
host's own work, and switched on only if it measurably helps. Then the decision is signed, kept, and revocable.

That idea now has a format, a procedure, three independent readers and a preprint behind it.

José Luis Latorre Millas. ampack: signed, declaratively traversable memory packs for AI agents, with trial-gated
activation. Preprint v0.10, 5 November 2026. doi:10.5281/zenodo.24012989

The preprint lives on Zenodo at that DOI. This release is its code and evidence: the tag v2.0.0 is the exact source
snapshot, and the evidence bundle below holds every signed decision the paper reports, with the means to check it.

The three big things

1. Memory packs (ampack). A pack is a signed bundle of memory a host can verify byte for byte: a canonical file list
gives every pack one SHA-256 identity, signatures are checked against the receiver's own trust policy, and declared
relations tell the host how to walk it, within budgets the host sets. Then comes the part nobody else does: the pack is
installed switched off, trialled against the host's own retrieval on the host's own history, and switched on only if it
meets its targets. The decision is a signed in-toto statement bound to the exact content. Readers in .NET, Python and Rust
agree on every one of 514 conformance vectors.

2. A memory that writes better and recalls smarter (the Recommended preset). One opt-in line,
MemoryOptions.CreateRecommended(), switches on what our storage and retrieval research measured as better:

What	With Recommended	Before
Stored memories that were right (store-aware writer, two fresh worlds)	90.8% and 87.8%	42.3% and 39.1%
Turns where every needed memory reached the prompt (judge at the fan-in)	96.1% and 96.5%	67.6% and 76.8% (similarity floor)
Knowledge-update questions answered (of 78)	72 and 71	63

The judge is a blend of two models behind the System One protocol; if one is down the other carries on, and if neither
answers, recall falls back to the similarity floor and says so. Low-level and Conversational defaults stay compatible:
nothing changes unless you choose Recommended.

3. A trust boundary on every MCP surface. Recalled memory can hold text someone else wrote. Every MCP tool and
resource that returns memory now marks each item with its trustLevel and an instructionLike flag, escapes it so it
cannot forge a tag in the client's prompt, tells the client it is data and never instructions, and can withhold
instruction-like text from untrusted sources (RecallSecurityMode = Strict). One shared detector serves the in-process
adapters, the MCP server and the NAMS MCP server.

Also in 2.0.0

• The Extensibility module SDK 0.1.1: composable memory modules with declared traversal, snapshots, confidence
  floors and signed activation, in this source release; its NuGet preview packages follow on their own preview tag.
• Coding memory (experimental): decisions, repository experience and a code map read from Roslyn or any SCIP index,
  walked from the files and symbols a coding agent is touching.
• Bitemporal by default in Recommended: a change ends the old value's valid time and keeps it believed, so "where did
  I live in March?" still has an answer.
• Honest numbers: the LongMemEval token comparison in the docs is corrected (an answer prompt about 300 times smaller
  than the full history, estimated; the memory itself about 170 tokens by exact count).
• Fixes found by a full roadmap audit: the telemetry owner-id opt-in now reaches the service, the documented
  latencyBudgetExceeded key is written, and the conformance harness counts a missing input as a harness failure, never
  as a passing refusal.

The evidence, attached

Asset	What it is
ampack-evidence-2.0.0.zip	The curated evidence: 63 distinct signed trial decisions with their public keys and a portable verifier, the decision register, the four-repository logs, the conformance runs, the statistics checks, and the final-review follow-up
ampack-evidence-2.0.0.zip.sha256	The archive's SHA-256; inside, SHA256SUMS covers every file

Check it in two commands: sha256sum -c SHA256SUMS, then, in files/,
python -I tools/verify_json.py verify-config.json recheck.json recheck.log (63 of 63 verify). Reproduce the conformance
result from this tag with python conformance/pack-v1.1/run_vectors.py <path to the built Ampack>: on 6 November a
fresh 514-vector corpus agreed on all 514 vectors in all three readers. The preprint's measurements were made on earlier
commits, listed apart from this release commit in the bundle's MEASUREMENT-COMMITS.md. The PDF is not attached;
it is on Zenodo.

Licensing, plainly

From 2.0.0 the projects that implement the ampack format and its host procedure are Apache-2.0 (with its patent grant);
everything else stays MIT; the specification is CC BY 4.0. PATENTS.md holds a proposed royalty-free pledge for
conforming implementations, published as a draft. The full map is in LICENSING.md.

Upgrading

• MCP clients: recall results gain trustLevel, instructionLike, withheld and untrustedContent, and angle
  brackets in recalled text arrive escaped.
• Presets: Conversational is unchanged. Recommended is new and opt-in; pair it with
  LlmExtractionOptions.ApplyRecommended() and, with a judge endpoint, MemoryGateOptions.ApplyRecommended().
• Read the CHANGELOG section for 2.0.0 for every
  change.

Thank you

To everyone who opened an issue, tried a preview, or argued with a design: this release is better for it. Built on
Neo4j, the Microsoft Agent Framework and Semantic Kernel, and verified against the upstream Neo4j Agent Memory
compatibility kit.