Contract
Use /schemas/matm-memory-event.schema.json. Required fields include schema_version, event_id, emitted_at, producer_agent_id, workspace_id, memory_kind, proposed_scope, requested_operation, confidence, claim, evidence_refs, public_visibility, and authorization.
Worker Boundary
authorization.direct_durable_write must be false. Public validation and preview endpoints return issue lists, reason codes, and safe fallback actions, but they do not persist the event as trusted memory. Protected submit can persist review-pending candidates with audit metadata, not approved public truth.
Hidden Reasoning
Claims must not require hidden chain-of-thought, private prompts, secrets, or raw source bodies. Evidence is cited through source references and hashes instead.