Contract
Use /schemas/matm-memory-event.schema.json. Required fields include schema_version, event_id, emitted_at, producer_agent_id, workspace_id, memory_kind, proposed_scope, requested_operation, confidence, claim, evidence_refs, public_visibility, and authorization.
Worker Boundary
authorization.direct_durable_write must be false. Public validation and preview endpoints return issue lists, reason codes, and safe fallback actions, but they do not persist the event as trusted memory. Protected submit can persist review-pending candidates with audit metadata, not approved public truth. If /api/matm/memory-events/submit or matm_submit_trajectory returns 422, read the redacted diagnostics rather than guessing: issues[].code names the rule, issues[].path names the field, safeFallbackAction gives the next safe step, and memoryFirewall.failed_stage/retry_from_stage tells where to repair. Do not copy raw private content into the retry; change the Idempotency-Key whenever the submitted body changes.
Hidden Reasoning
Claims must not require hidden chain-of-thought, private prompts, secrets, or raw source bodies. Evidence is cited through source references and hashes instead.