Canonics: Versioning the Frame, Not the Facts

Vigency in AI Memory After Judgment Expires

Lucio Amorim · ORCID: 0009-0001-3323-9152 NXLV Research — Rio de Janeiro, Brazil research.nxlv.ai/canonics · lucio@nxlv.ai

Position paper (preprint) · July 2026. Comments welcome.

Truth survives. Authority does not.

Facts expire visibly. Judgment loses force silently.

Version the frame, not the facts.

Abstract

Every AI memory system can tell you whether a fact is still true; none can tell you whether a judgment is still in force. Long-lived AI agents do not fail only by forgetting; they fail by remembering after judgment has expired.

In law, a repealed statute does not become false; its text stands on record, yet it no longer governs. Long-lived AI agent memory has no equivalent of repeal. When the regime that made a stored interpretation authoritative is replaced, that interpretation remains retrievable, well-sourced, and true as history — but wrong as guidance. The agent that cites it is not hallucinating; it is applying obsolete judgment. Canonics¹ names this the loss of canonical vigency — the state of an interpretation being currently in force under the active canon — and recasts interpretive drift (Luhrmann [41]; Sloan [42]) as a loss-of-vigency failure. Every existing memory system answers “is this fact still valid?”; none answers “is this interpretation still in force?”

Two primitives carry the design: canon events — human-declared regime diffs with explicit scope — and epochs, per-domain regime intervals derived from them. Staleness is measured in canon distance (κ, "kappa") — the number of in-scope canon events an understanding has crossed — not in elapsed days. Facts are immutable; interpretations are versioned cache; canon events are the invalidation signal; epochs are the cache key. A sociotechnical protocol, the Canon Review, structures the recurring encounter between a machine that attempts to falsify the active canon and the human who judges. Adoption does not require the full protocol: a minimal two-tag implementation — a current-regime block plus a κ tag on retrieved artifacts — pays for itself in a single sprint (§4.6). The field already knows how to version facts. Canonics versions the frame: the regime that decides which stored interpretations may still guide action.

Keywords: agent memory governance, long-lived AI agents, canonical vigency, canon distance, AI memory staleness, RAG staleness, temporal knowledge graphs, interpretive drift, semantic revocation, context engineering

How to read this paper. An executive can read §2 (the problem and its cost), the Two-Tag Wedge (§1, §4.6), and §11.5 (the enterprise agenda). A builder should read §4, Appendix A, and the reference implementation. A researcher should read §3, §6, §7, §9, and §10.

1. Introduction

A memory system can be perfectly grounded and still give obsolete advice. Consider an account team whose agent substrate — a code workspace, a set of agents, a shared wiki in the style of Karpathy's llm-wiki [1], the leading pattern for automated knowledge-base upkeep — has accumulated eighteen months of memory on a seven-figure enterprise account: QBR minutes, stakeholder maps, success plans, pricing assumptions. The substrate works: retrieval is accurate, provenance is clean, and nothing in the vault is false. The account plan was true when written: the executive sponsor championed expansion, the budget sat under digital transformation, procurement evaluated vendors on value creation.

Then, over one planning cycle, the sponsor moves to another division and the incoming leadership reallocates the budget to cost containment. Nothing in the knowledge base becomes false that day: the sponsor really did champion expansion, the budget really existed, the roadmap really was approved — every stored judgment remains true as history. Yet every one of them is now wrong as guidance — the account strategy, the champion-calibrated messaging, and the growth-case pricing all presuppose a buying regime that has just ended, and no document records its ending as a contradiction, because nothing has been contradicted.

Weeks later, a renewal question arrives. The agent retrieves "our expansion proposal playbook" — semantically relevant, well-sourced, confidently cited — and the team, trusting the fluency, nearly walks into a cost-containment committee with a land-and-expand pitch derived from a world that no longer exists. The failure is subtle precisely because the agent sounds well grounded: it is not hallucinating — it is citing obsolete judgment; it is executing unrevoked context whose authority has expired.

Builders meet the same failure in code. A long-lived coding agent — in a repository with months of accumulated architectural notes — does not fail by emitting a broken query. It fails when, at two in the morning, it flawlessly refactors against an API the engineering team deprecated in a Slack thread three weeks ago; or when, after the project pivots from a client-heavy single-page app to a server-rendered architecture, it keeps flagging "bundle-size regressions" that no longer matter and defending a rate limit that no longer exists. The code compiles. The architecture is dead. (Appendix A.4 works this scene end to end.)

In both scenes the diagnosis is the same: no fact expired — the authority behind the interpretation did. Law has kept a name for this state for centuries: statutes are repealed, not falsified — they stay on record and stop governing. Long-lived AI agent memory has no equivalent of repeal. This paper proposes one. Canonics versions the frame — the interpretive regime, the set of operating assumptions under which raw inputs become actionable understandings — not just the facts. The core intuition mirrors the distinction between data versioning and schema versioning in software systems: every modern memory system versions data; Canonics versions the schema of interpretation.

The mechanism is deliberately small. A canon event is a human-declared marker that the regime has changed: a dated diff specifying which standing assumptions cease to hold, which begin to hold, and over which domains the change has effect. An epoch is not declared but derived: the interval between consecutive canon events within a domain, carrying the regime — the fold of all invariants and canon diffs up to that point. Derived understandings are stamped with the epoch under which they were produced, versioned rather than overwritten, and linked by mandatory provenance to the immutable records they were derived from. Staleness is then measured not in elapsed time but in canon distance (κ): the number of in-scope canon events an understanding has crossed since creation. Reinterpretation is machine-proposed and policy-activated — automatic in low-risk domains, human-gated in critical ones — and always re-derived from source facts. The architectural insight in one line: facts are immutable; interpretations are versioned cache; canon events are the invalidation signal; epochs are the cache key.

Canonics in one page. Canonics does four things: it keeps facts immutable, treats interpretations as a cache that can be rebuilt, marks a regime change once as a canon event, and lets that one mark expire everything downstream of it. Staleness is counted in canon events crossed — canon distance κ — not in days elapsed (§2.2); stored knowledge occupies four computable states — vigent, valid as history, needs reinterpretation, revoked as guidance (§2.3); and a recurring, instrumented ritual, the Canon Review, keeps the invalidation signal itself honest (§5). Stated as a category: Canonics is not another memory framework — it is an authority-control layer for long-lived agent memory, governing which stored interpretations may still guide action (§4.1). Automation may propose a regime change but never declare one: this epistemic isolation by design is a safety boundary against cascading hallucination, not a manual bottleneck (§6). The framework ships with its own measurement layer — VRS, the Vigency Resolution Score (§10) — so the claim of governance is not left to declare itself. The rest of this document formalizes the governance of that signal.

The Two-Tag Wedge (start here). Adoption does not require the whole protocol. The minimal slice that pays for itself in a single sprint is two moves: keep a current-regime block in the always-on instructions, and attach an epoch_id / canon_distance tag to each retrieved derived artifact — then use κ = 0 artifacts normally and show a stale-regime banner on κ > 0. Canon events and the Canon Review are the payoff of adoption, not its precondition (§4.6).

One boundary belongs up front. Canonics does not claim autonomous drift detection. It addresses what happens once a regime shift is perceived: how that shift is declared, propagated, audited, and made operational across memory — with the Canon Review (§5), a recurring, instrumented ritual, as the scheduled occasion for perception to happen and the standing audit of the invalidation signal itself. The full statement of what this paper refuses to claim is §9.

The failure mode of both scenes has a name and a genealogy. We adopt the term interpretive drift — coined by Luhrmann [41] to describe the gradual, often unacknowledged shift by which a person comes to interpret events under a new belief system, and extended by Sloan [42] to the governing premises of organizations. We formalize it for computational memory governance: the divergence between the regime under which stored knowledge was derived and the regime under which it is later applied. It is distinct from factual staleness. A stale fact ("the CTO is X") can be invalidated by a newer fact. A drifted interpretation ("we should price for the growth case") is not contradicted by any single fact; it is orphaned by a paradigm shift that no individual assertion records.

Interpretive drift is one face of a broader pathology that practitioners know intimately: every "enterprise brain" or "second brain" tends to become a second drain — a system which increasingly consumes resources for its own governance, maintenance, reconciliation, and repair (§5 develops the fix).

Empirical evidence indicates the underlying model-side problem is severe and unsolved. The STALE benchmark finds that even when updated evidence is successfully retrieved into context, frontier models act on it correctly in only 55.2% of cases at best [2], and representational analyses show temporal drift constitutes an independent axis along which models can be confident, fluent, and wrong [3]. Systems work has responded at the level of individual facts: Zep/Graphiti maintain bi-temporal validity intervals on graph edges [4]; TOKI formalizes contradiction resolution in persistent agent memory with a bitemporal operator algebra [5]; RoMem rotates obsolete relations out of phase [6]; adaptive-decay approaches show that uniform temporal decay performs drastically worse than heterogeneous treatment [7]; and TG-RAG and IA-RAG make retrieval time-aware [8, 9]. The entire survey compresses into one asymmetry, and it is the antagonist of this paper: every one of these systems can answer "is this fact still valid?"; none can answer "is this paradigm still active?" The question interpretive drift actually poses — under which regime should this derived understanding be re-derived? — has no addressee in the current stack.

Canonics is built to give that question an addressee.

Contributions. Six, in three families: vocabulary (1), mechanism (2–3), governance and evaluation (4–6).

1. We introduce canonical vigency — the regime-relative authority state of a derived interpretation: whether it remains in force under the active canon — and recast interpretive drift (Luhrmann [41]; Sloan [42]) as a loss-of-vigency failure, with the reusable vocabulary that carries it: vigent understandings, regime time as a third timeline, the four-state classification, and canon distance (κ) as its measure (§2).
2. We define the Canonics ontology and a lightweight formal model with five primitives, mandatory provenance, versioned understandings, a canon-distance staleness metric with an explicit statement of what it does not measure, stated properties, and complexity bounds (§4, §7).
3. We specify the core operations with reference pseudocode, operational heuristics — including a canon promotion test — and a minimal architecture implementable with file-based agent tooling today, noting that the substrate is a convenience, not part of the claim (§4).
4. We introduce the Canon Review, a sociotechnical detection protocol with an asymmetric agenda (falsify active canons before proposing emergent patterns), fixed cadence, constitutional role separation, and self-instrumentation against its own central failure mode, rubber-stamping (§5).
5. We give a canon integrity model that treats canon declaration as a production change — tamper-evident canon log, out-of-band human approval, automation that may propose but never declare — together with a threat model for evidence-planting attacks on the review itself (§6).
6. We state explicitly what Canonics does not do (§9), and propose an evaluation design with falsifiable hypotheses — including operational sustainability, the failure mode that killed the framework's predecessors — a benchmark structure with an undeclared-shift module, and a headline metric, VRS (§10).

Canonics is deliberately a composition of mature components - event sourcing [10], bi-temporal modeling [11, 12], context logics and microtheories [13, 14, 15], belief revision and truth maintenance [16, 17, 18] - assembled into a conjunction that, to our knowledge, no surveyed LLM-agent memory system delivers. We position the claim precisely in §3.

Practitioner's note (origin and evidence boundary). The framework was not theorized from the outside. It was extracted from operating a real agent substrate over a live knowledge base — the §1 failure mode is one the author has watched happen — and shaped by two decades of running knowledge-dependent operations in complex, regulated environments. That practice is deep but narrow: it grounds the design without demonstrating general viability (§11.7). The paper is written to be falsifiable rather than autobiographical, and the one operation whose logs are fully public is this document's own, maintained under the framework it proposes (Appendix D).

Claim layers. This paper demonstrates an ontology and a reference implementation; it infers a cost model from operator practice; it proposes an evaluation agenda as future work. Any stronger reading is disclaimed in §9.

This document practices what it prescribes: it is maintained under its own framework, and the proof — its canon log, including one drift the process caught in the paper's own README — is Appendix D.

2. When Truth Loses Force: The Loss of Canonical Vigency

Interpretive drift is the visible pathology; loss of canonical vigency is the underlying state transition. Interpretive drift has a genealogy. Luhrmann [41] described it qualitatively in human belief systems — the slow, often unacknowledged shift by which a practitioner comes to read events through a new framework. Sloan [42] carried it to organizations, where governing premises silently lose alignment with the logic that creates value. This paper adds the missing computational primitives: a way to declare, stamp, and propagate regime change inside an agent's memory. The line that keeps the phenomenon from collapsing into a neighbor is worth stating sharply: concept drift is statistical; interpretive drift is semantic-authoritative — the signifier holds, the meaning moves. The distinction is one the law has kept for centuries: lawyers do not ask whether a statute is true but whether it is in force; truth and force are orthogonal axes, and repeal is the operation that severs the second from the first. Staleness is loss of truth; loss of vigency is loss of force.

2.1 Why updating is not the bottleneck

Discussions of knowledge-base maintenance typically frame the challenge as keeping content current: ingesting new raw inputs, refreshing summaries, pruning dead pages. Karpathy's llm-wiki pattern [1] automates much of this: an LLM integrates new sources, updates pages, and flags contradictions. But continuous updating does not solve interpretive drift, because the wiki is rewritten without any record of why an interpretation changed. When the regime shifts, three problems remain:

1. Semantic retrieval is regime-blind. Embedding similarity finds the expansion playbook precisely because it is topically relevant; it has no representation of the fact that the playbook belongs to a closed paradigm.
2. Fact-level invalidation does not compose upward. No single fact contradicts a strategic posture. Invalidating "the sponsor is X" leaves untouched the hundreds of derived understandings whose validity silently depended on it.
3. The alternative — periodic rebuild — destroys memory. Rebuilding the knowledge base every few months loses provenance, compounds labor, and erases the record of how the operator used to think, which is precisely the material needed for post-mortem analysis.

2.2 The third timeline: regime time

Bi-temporal modeling [11, 12] distinguishes valid time (when a fact was true in the world) from transaction time (when the system learned it). Interpretive drift exposes a third timeline: regime time — under which paradigm of operating assumptions a derived artifact was produced. Two understandings written the same day, from the same facts, under different regimes, are different objects. Existing agent memory systems collapse this third dimension, which is why they can answer "was this true?" and "did we know it?" but not "does this still mean what it meant?"

Figure 1. The axis the current stack does not see. Bi-temporal systems track valid time and transaction time; Canonics adds a third — regime time, punctuated by canon events (c₁, c₂, …) that close epochs — and measures staleness along it. An understanding u, derived early in epoch E₁ from sources that never change, crosses two canon events without any edit to its content: same content, same sources, twice suspect, zero days "old." Canon distance κ counts declared regime changes crossed, not days elapsed.

2.3 The four states a piece of stored knowledge can be in

The property regime time lets us track is canonical vigency²: whether a derived interpretation is still in force under the active canon, as distinct from whether the facts beneath it are still true. An understanding is vigent when the regime that authorized its interpretation still holds. Once vigency is explicit, stored knowledge stops being binary (current/outdated) and acquires four distinguishable states of vigency, measured by canon distance — κ, kappa — the number of in-scope canon events an understanding has crossed:

1. Still valid / vigent — derived under the current regime, or under a prior regime whose relevant assumptions remain in force (canon distance zero).
2. Valid as history — an accurate record of what was true or believed, applicable to audit and post-mortem, not to guidance.
3. Needs reinterpretation — the source facts remain sound, but the derivation crossed an in-scope canon event; re-derivation under the current regime is required before use.
4. Invalid as current guidance — the understanding depends on explicitly retired assumptions and must not steer action, though it is never deleted.

The same four states, as a table an implementer can read at a glance:

These are, almost exactly, the states a legal system already keeps for its own norms: a rule in force (vigent), a rule preserved as enacted history but no longer governing (historical), a rule awaiting re-reading under an amended statute (needs reinterpretation), and a rule repealed yet never struck from the record (revoked as guidance). Law has versioned the interpretive regime — not merely the facts — for centuries; Canonics imports the distinction and makes it computable for agent memory.

The stock of understandings sitting in the second or third state — non-vigent, not yet re-derived — is not free to carry. It accumulates as vigency debt, the interpretive analogue of technical debt; §8 develops its measurement and its ledger.

Figure 2. Truth survives. Authority does not. The four states arranged by canon distance (κ) against chronological age. Clock age tracks how old a memory is; canon distance tracks how far it stands from the regime that authorized it. The dangerous quadrant is not old memory but low-age, high-κ guidance: recent, relevant, and no longer in force. The mapping is illustrative — the historical and revoked states are distinguished by supersession and retired assumptions, not by age (§2.3) — and the bottom-right cell carries the standing caveat of §4.3: κ = 0 is evidence of freshness only while the declaration process is alive.

The purpose of the framework is to make this classification computable — a function of epoch stamps and canon scopes rather than of human vigilance at retrieval time — conditional on the canons having been declared. The conditionality is not a footnote; it is the framework's central operating assumption, and §5 exists because of it.

2.4 What Canonics can and cannot catch: the silent-loss problem

Paradigm shifts are sometimes announced by cues that humans read effortlessly and models do not: a resignation email implies capacity change; a signed enterprise contract implies a pricing-regime change. But most business-decision decay is what we name silent loss of vigency: a loss of vigency with no explicit revocation and no contradicting document — the regime moves and leaves no cue to read (cf. [51], which uses "silent drift" for undetected assumption propagation in LLM-assisted simulation — an adjacent sense of the same silence). STALE's findings [2] show models fail to apply even explicit updates; implicit regime cues fare worse; silent loss of vigency produces no cue at all.

Canonics automates the search for candidate regime shifts, not the authority to declare them. It institutionalizes detection by separating machine proposal from accountable declaration — but it does not autonomously certify that a shift has occurred. A system whose operator declares no canons reports κ = 0 everywhere and can be three paradigms behind the world; unmarked distance is not freshness, and a metric that certifies false freshness is worse than no metric. What Canonics provides is (a) the propagation infrastructure for the moment a shift is perceived — today, an operator who notices that the paradigm has changed has nowhere to record that perception such that the entire memory reacts; and (b) a structured, recurring, instrumented occasion for perception to happen — the Canon Review — which converts detection from an unscheduled act of individual vigilance into a scheduled adjudication with measurable lag. Detection remains an open research problem (§10, §11.1); Canonics makes its failure visible and its success cheap to act on. Interpretive drift becomes dangerous not merely because retrieval is regime-blind, but because fluent agent outputs induce human-side epistemia [43] — the attribution of genuine judgment to a model on the strength of coherence, vocabulary, and provenance rather than verified currency. Drift on the memory side and epistemia on the human side compose into a single failure: the operator treats a coherent, well-sourced, obsolete interpretation as live judgment, which is why the regime summary is foregrounded (§4.5, H8) and why detection is institutionalized as a reviewed ritual rather than left to vigilance (§5).

Without vigency control, the operator faces a false choice: keep everything and let the past govern, or prune history and destroy auditability. Canonics keeps the history while revoking its authority to guide; §8 develops this as the archive-or-hoard dilemma.

3. Related Work

Prior work has made memory temporal, auditable, governed, versioned, and provenance-aware. Canonics begins where those systems stop: at the authority of the interpretive regime itself. We organize the survey as three questions of increasing depth; each area below answers the first or the second and stops short of the third. The divergence lines — set off as blockquotes — are the survey's argument.

3.1 Can we track when facts change? Yes — and the tracking stops at the fact.

The mature answer of the field. Every system in this group can say when a fact became true, when it was learned, or when it was superseded — and every one of them stops at the granularity of the fact.

3.1.1 Bi-temporal data modeling

Jensen & Snodgrass established the valid-time/transaction-time distinction [12]; Fowler popularized it with retroactive-change examples [11]. Borrowed: time is not monolithic, and retroactivity requires separating when something became true from when it was recorded — the mechanism Canonics uses for retroactive canon.

Divergence: bi-temporality assumes two timelines suffice for correct interpretation; Canonics adds regime time (§2.2), which is not reducible to either.

3.1.2 Event sourcing and projections

Event sourcing stores state as an immutable event log and derives current state by replay through a projection function [10]. Borrowed: facts as append-only events; understandings as disposable projections; rebuild instead of edit.

Divergence: in event sourcing the projection function is stable — events change, the frame does not. In Canonics, a canon event changes the projection function itself. Declaring canon is a schema migration for meaning, not a new datum.

3.1.3 Temporal knowledge graphs for agent memory

Zep/Graphiti attach bi-temporal validity intervals to graph edges and invalidate rather than delete [4]. TOKI [5] types contradiction-resolution heuristics as bitemporal operators, identifies anomalies any principled memory must avoid (replay inconsistency, belief-drift skew, audit erasure), and proves that logging the adjudicating "judge" is necessary for replay consistency. RoMem assigns per-relation volatility and rotates obsolete facts out of phase [6]; adaptive-decay work shows uniform decay is far worse than heterogeneous treatment [7]; MemGPT manages hierarchical memory tiers [20]; SSGM governs memory evolution, distinguishing hallucination from temporal obsolescence [21]. Recent governed-memory systems move still closer: Kumiho gives versioned cognitive-memory artifacts formal belief-revision semantics [29]; governed collaborative memory models memory evolution as a selection process with ratification and lineage [30]; governed shared memory adds policy-scoped retrieval and temporal supersession for multi-agent systems [31]; TrustMem and RecMem focus on trustworthy or selective consolidation [37, 38]; Portable Agent Memory introduces cryptographically verifiable memory transfer [39]; and schema-grounded memory treats memory writes as validated records [40]. Borrowed: validity intervals, audit trails, volatility heterogeneity, lineage, governance, provenance, gated consolidation, schema validation, and the conviction that temporal awareness is essential.

Divergence: these systems operate at the granularity of individual facts, beliefs, memories, policies, or memory artifacts, answering variants of "is this memory valid, admissible, portable, or useful?" Canonics answers "is the paradigm under which this interpretation was derived still active?" - a different layer. Canonics claims novelty only in the conjunction: human-declared scoped regime diffs, derived per-domain epochs, regime-distance staleness, source-based re-derivation, and an instrumented review ritual. In TOKI's terms: the epoch is the judge, and the canon log is its audit trail; we conjecture Canonics can be expressed as a higher-order extension of TOKI's algebra, with canon events as operators over sets of operators (§10, H-F). Canonics is layerable on top of these systems (§4.6).

3.1.4 Temporal RAG

TG-RAG models corpora as bi-level temporal graphs with incremental updates [8]; IA-RAG represents knowledge as Allen-style intervals [9]; drift studies document the limits of RAG under continuous knowledge change [22]. These make retrieval time-aware but leave interpretation regime-blind: they can fetch the facts of April, but not the paradigm of April.

Temporal RAG answers the time of knowledge; Canonics answers the time of judgment.

3.1.5 Empirical evidence on staleness, and risks of machine rewriting

STALE [2] measures state resolution, premise resistance, and implicit policy adaptation, finding a pervasive gap between retrieving updates and acting on them; representational work shows temporal drift is an independent axis in model internals [3]. These results motivate two Canonics design choices: regime context is foregrounded in always-on instructions rather than left to retrieval (§4.5, H8), and evaluation must measure application, not recall (§10). A complementary line of evidence concerns machine-rewritten memory: TrustMem, RecMem, SSGM, Infini Memory, and DCPM all treat consolidation, verification, recurrence, provenance, or belief trajectories as nontrivial governance problems rather than free summarization [21, 33, 35, 37, 38]. Canonics adopts the conservative lesson structurally: raw records are immutable and every understanding must point back to them (mandatory provenance, §4.2), and re-derivation in critical domains is human-gated (§4.5, H9). Without these constraints, a regime-versioning system would be an engine for stamping hallucinations with fresh epochs.

3.2 Can we track when interpretation changes? Partially — and without a regime object.

The classical traditions come closest to Canonics: each makes interpretation itself an object of maintenance. None of them versions the authority under which interpretation operates.

3.2.1 Truth maintenance and belief revision

Doyle's JTMS records justifications so that retracting a premise retracts its dependents [17]; de Kleer's ATMS maintains multiple assumption contexts simultaneously [18]. AGM belief revision [16] formalizes minimal-change revision and epistemic entrenchment. Borrowed: dependency-directed retraction (Canonics' blast radius is a coarse-grained form of it); minimal change (a canon should perturb only what its scope touches); entrenchment (invariants > strategic > operational > live understandings).

Divergence: TMS and AGM operate on individual logical propositions in closed, consistent belief sets. Canonics operates on heterogeneous, open-world corpora of loosely structured notes, where "beliefs" range from transcripts to strategy memos and the retraction unit is a regime, not a proposition. The coarser granularity is what makes maintenance tractable at human scale.

3.2.2 Context logics and microtheories

The closest classical ancestors. McCarthy formalized truth as context-relative - ist(c, p) - with lifting rules translating assertions between contexts [13]; Guha mechanized the theory [14]; Cyc partitioned its knowledge base into microtheories, bundles of shared assumptions [15]; and ontology-evolution research established that conceptualization change is not schema change [19]. Borrowed: the very idea that validity is relative to a bundle of assumptions, and that assertions must be lifted, not copied, across bundles.

Divergence: not that epochs are more expressive than microtheories. In representational terms, an epoch can be modeled as a temporally indexed, scoped context. The Canonics claim begins one layer above that representation: canon events are governed production changes to the active interpretive regime of an LLM-agent substrate; epochs are derived views over that append-only event stream; and re-derivation is source-grounded regeneration of derived understandings under the current regime, not assertion transfer between symbolic contexts. The novelty claimed here is therefore not context-relative truth, microtheory partitioning, or lifting; those are inherited ideas.

3.2.3 Organizational memory

Walsh & Ungson define organizational memory as stored history brought to bear on present decisions [23]; Levitt & March observe that organizations encode inferences from history into routines — inferences that silently carry the paradigm of their era [24]. Canonics formalizes exactly the missing dimension in this literature: the regime under which an encoded inference was made, and the conditions under which it must be re-derived rather than reused.

3.2.4 Philosophy of science

Kuhn's paradigm cycle — normal science, anomaly accumulation, crisis, revolution [25] — maps structurally onto Canonics: understandings accumulate within an epoch; contradictions accumulate as anomalies; the Canon Review surfaces the crisis; declaration is the revolution. Kuhn also supplies the standing warning behind §2.4: revolutions are rarely announced, which is why Canonics schedules the search for them rather than assuming they will be noticed. Kuhnian incommensurability explains a design choice: understandings are re-derived from raw facts rather than "translated," because translation carries interpretive contamination across regimes. Lakatos's distinction between a research programme's hard core and its protective belt [26] maps onto Canonics' invariants (protected, trans-epochal) versus understandings (auxiliary, expendable). The canon promotion test (§4.3) is a falsifiability criterion in Popper's sense [27], and the Canon Review's asymmetric agenda — attempt to falsify the active canons before proposing new patterns — is Popper as standing agenda order.

3.3 Can we track when the authority behind the interpretation changes? No — and this is where Canonics begins.

No surveyed system answers this question. The two literatures below supply, respectively, the emerging practice stack Canonics presupposes and the human-factors grounding for the protocol built to answer it.

3.3.1 Practitioner convergence in knowledge operations

Recent governed-memory and knowledge-operations practice has been converging on a stack: sources of truth remain in systems of record; derived knowledge carries supersession links and lineage; memory movement or sharing carries provenance; and a human adjudicates flagged conflicts at a defined cadence, with named owners. Governed Collaborative Memory, Governed Shared Memory, Portable Agent Memory, and schema-grounded memory each cover parts of that stack [30, 31, 39, 40]. No system we are aware of delivers it together with a representation of the interpretive regime under which derived knowledge was produced. Canonics is positioned as exactly that missing layer: it presupposes the emerging consensus (lineage, supersession, provenance, validation, human adjudication) and adds the regime object that makes the adjudication's outcome propagate.

3.3.2 Human–automation collaboration

The Canon Review (§5) puts a human adjudicator in a standing loop with a machine that scans, summarizes, and proposes — an arrangement with four decades of prior art the memory-systems literature rarely imports. Automation research documents its recurring failure mode directly: complacency and automation bias, the drift of a nominal supervisor into a rubber stamp as the automation comes to seem reliable [44], and the ironies of automation, in which the human is retained precisely for the judgment that disuse erodes [45]. It also documents the response: cognitive forcing functions — interventions applied at decision time that compel analytic engagement and measurably reduce overreliance on AI [46]. We position the Canon Review as the deliberate transfer of these principles — reliance calibration, cognitive forcing, independent judgment — from human factors into memory governance. None of the systems compared in Appendix B grounds its human step in this literature; §5 is written to, and §5.1 and §5.4 carry the specific mechanisms.

3.4 The deflationary objection: is this staleness renamed?

The sharpest deflationary attack the framework will face is that interpretive drift is factual staleness under a new name. The quickest answer is the legal one already sketched in §2: a repealed statute does not become false — its text stands on record, an accurate account of what was once enacted — yet it no longer governs; a whole profession has maintained the gap between truth and force without confusing the two. The formal version of the same point is functional, not lexical: a jangle fallacy is the error of giving two labels to mechanisms that the same operation would resolve [49, 50]. Drift is not jangle, because no fact-by-fact invalidation either produces or repairs it — a stale fact is corrected by a newer fact; a drifted interpretation is corrected only by re-derivation under a new regime (§4.4). The resolving operations differ, so the constructs differ — and the survey above supplies the evidence: every system in §3.1 resolves staleness with exactly the fact-level operations that leave drift untouched. The burden §2 carries is that functional distinction, not a coined vocabulary.

4. Canonics: Versioning the Frame

In plain terms — restating the one-page box of §1 for the reader who arrived here directly — Canonics does four things: it keeps facts immutable, treats interpretations as a cache that can be rebuilt, marks a regime change once as a canon event, and lets that one mark expire everything downstream of it. This section gives the principle (§4.1), the objects (§4.2), the staleness measure κ (§4.3), the operations (§4.4–4.5), and a substrate you can run today (§4.6). A reader who wants only the idea can stop after §4.1; a reader who wants to build it should read on.

4.1 The core principle

The Canonics Principle. In any memory system used for decision-making, every derived interpretation must be evaluated not only against its source facts, but against the interpretive regime under which it was produced — and against the canon events that may have changed that regime since.

The rest of the framework is machinery for making this principle cheap to obey: cheap for the human (declare a handful of canon events per year, adjudicated in a bounded monthly ritual) and mechanical for the machine (classification by epoch stamps and scopes, not by judgment at retrieval time). Stated as a category: Canonics is not another memory framework — it is an authority-control layer for long-lived agent memory, governing which stored interpretations may still guide action.

Scope statement — problem scope versus specification scope. The problem Canonics addresses is sharpest at high informational complexity: the large, long-lived knowledge bases — "enterprise brains" and "second brains" — where no single reader can hold the whole state in mind, and where the operator genuinely cannot tell whether a given stored judgment is still in force. That is the intended application, and the opening enterprise account is a failure-mode scene, not an enterprise-deployment claim.

What this version specifies completely is narrower than what it targets: the single-declarer core — one operator, or a small high-trust team with a designated declarer — where the authority to declare canon is unambiguous. Two problems it does not yet model separate that core from full enterprise deployment: an epistemic-authority problem (who, among many, may declare that the paradigm changed, and how disagreement resolves) and an access-control problem (canon chains propagate information; sensitivity must scope propagation). We flag these as future work (§11.5), not as a barrier to applying the core today. They are a known class of informational-governance problem with mature analogues, but agentic propagation and summarization make their implementation nontrivial; a Canonics deployment presupposes that scoping is correctly done and adds the regime object on top, rather than reinventing it. Wherever both controls hold — scoped edit/access authority and a designated declarer — the framework's applicability is not confined to a lone operator: regulated technical documentation, legal and policy corpora, clinical protocols, and the backtesting of statistical methodologies all fit the same shape. The file-based substrate of §4.6 is likewise a convenience: the principle — version the interpretive regime — is portable to any infrastructure with transactions and access control; the substrate is not part of the claim.

Platform absorption is expected, not fatal. Memory is becoming a platform primitive: foundation-model vendors and memory frameworks are shipping it as a first-class capability. This does not moot Canonics; it locates it. If a memory platform ships regime tags or epoch-aware retrieval, it implements a mechanism inside the Canonics layer — and in doing so validates the problem without being able to take the language that describes it. What remains defensibly separate from any single product is the layer above the mechanism: the governance vocabulary for interpretive drift, the four validity states of stored knowledge, and the Canon Review as a sociotechnical protocol for deciding what still counts as live judgment.

4.2 Ontology

Canonics' world is built from five primitives, ordered by mutability, plus one transversal dimension.

Definition 1 (Fact). In whiteboard terms: what happened, written down once and never edited. A fact f ∈ F is an immutable, append-only record of an observation, event, or communication: f = (content, t_event, t_recorded, source, D_f) with domains D_f ⊆ 𝔻. Facts are never rewritten, only re-read under different frames.

Definition 2 (Invariant). In whiteboard terms: the house rules that survive every regime change. An invariant v ∈ V is an assumption declared to survive all epoch transitions: identity, values, non-negotiable principles. Invariants are the hard core of the knowledge base in Lakatos's sense [26]; changing one is the rarest and most consequential form of canon (Level 5 below).

Definition 3 (Canon event). In whiteboard terms: the dated record that the rules of the game changed — which ones, and where. A canon event c ∈ C is a fact promoted to metadatum status: it governs how other data must be read. Formally c = (id, t_effective, t_declared, level, δ(c), S(c), declarer) where t_effective may precede t_declared (retroactive declaration is permitted); level is drawn from the severity ladder L1–L5 below; the regime diff δ(c) = (A⁻, A⁺) lists assumptions retired and introduced; the blast radius S(c) ⊆ 𝔻 (optionally refined by assumption categories) bounds its scope; and declarer identifies the authenticated human who declared it (§6). Canon events are meant to be rare — we hypothesize a healthy system produces roughly 2–6 per domain per year (§11.3). Canon event is a term of art here: a governance act that changes how memory is read, not the narrative "canon event" of popular culture.

Severity ladder. L1 Factual correction (fixes a record; no epoch transition). L2 Tactical shift (priority, tool, or process; may touch one domain epoch). L3 Operating-model shift (capacity, team, pricing, delivery; typically opens a domain epoch). L4 Strategic paradigm shift (thesis, market position, identity of the operation; may open epochs across domains). L5 Doctrine shift (changes what the system considers good judgment; modifies invariants; rare and deliberately high-friction).

Definition 4 (Epoch — a regime interval). In whiteboard terms: a stretch of time during which the rules of the game did not change. Throughout, an epoch is a per-domain interval of stable interpretive regime — not the training-loop "epoch" of machine learning; reader-facing prose may say regime interval interchangeably. For domain d, let C_d = {c ∈ C : d ∈ S(c)} ordered by t_effective. The epochs of d are the derived intervals E_d = {[t(c_i), t(c_{i+1}))} , with the current epoch open-ended. Epochs are never created or edited directly; they emerge from the canon sequence — the single most important overhead-reduction decision in the framework. Each epoch carries its regime R(d, t) = V ⊕ δ(c₁) ⊕ … ⊕ δ(c_j) for all c_j ∈ C_d with t_effective(c_j) ≤ t, where ⊕ applies diffs in order: later diffs override, and assumptions persist until explicitly retired (inheritance unless revoked).

Definition 5 (Understanding). In whiteboard terms: a judgment derived from facts under a given set of rules — stamped with which rules. An understanding u ∈ U is a proposition derived from source facts under a regime: u = (content, F_u ⊆ F, ε(u), t_u, D_u, volatility, status, version), produced by interpretation function I as u = I(F_u, R(d, t_u)) and stamped with epoch of origin ε(u). In practice, I is an LLM under a regime-conditioned prompt. Provenance is mandatory: F_u must be non-empty and mechanically resolvable to immutable records; an understanding without verifiable source pointers is not decision-grade and must not be returned as guidance. Understandings are never overwritten: re-derivation creates a new version stamped with the new epoch, linked to its predecessor; the full version chain is preserved. status ∈ {active, stale, proposed, superseded, archived}; volatility ∈ {stable, strategic, operational, live} sets review expectations orthogonal to canon (a coarse prior on how fast a class of understandings decays within an epoch).

Domains. 𝔻 partitions the knowledge space (venture A, venture B, personal, health…). Epochs run per domain, unaligned; a canon in d₁ does not transition d₂ unless d₂ ∈ S(c). A global epoch exists as the intersection of domain epochs and should change rarely (L4–L5 only).

4.3 Canon distance (κ, "kappa"): staleness by canon, not clock

Definition 6 (Canon distance). For understanding u at time t:

κ(u, t) = |{ c ∈ C : t_u < t_effective(c) ≤ t, S(c) ∩ D_u ≠ ∅, (A⁻(c) ∪ A⁺(c)) ∩ deps(u) ≠ ∅ }|

where deps(u) are the assumptions u's derivation relied on (approximated, in the minimal implementation, by domain-plus-category tags). An understanding with κ = 0 has crossed no declared in-scope regime change; an understanding with κ >= 1 is suspect regardless of how recently it was created. This replaces clock-based staleness ("reprocess after 90 days") with mark-based staleness only for regime-induced interpretive staleness under adequate declaration coverage and dependency tagging. It does not replace age or volatility priors for within-epoch decay, exogenous drift, or domains whose relevant shifts are not observable in the review corpus.

What κ measures — and what it does not. κ is not a validity metric; it is a distance from declared canonical vigency — a distance to declared marks, not a certificate of currency. κ = 0 means "no declared canon intersects this understanding," which is evidence of freshness only to the extent that declaration coverage is adequate — that shifts, when they occur, are in fact being declared. A system whose operator has stopped declaring reports κ = 0 everywhere while drifting arbitrarily far from the world. Validity therefore requires two conditions: κ = 0 and an alive declaration process, which is what the Canon Review's self-instrumentation (§5.4) makes auditable. Any deployment that reports κ without reporting declaration-process health is misusing the metric.

With that caveat stated, the four validity states of §2.3 become computable relative to the declared canon set: vigent ⇔ κ = 0 and declaration-process health remains live; needs reinterpretation ⇔ κ ≥ 1 with source facts intact; invalid as guidance ⇔ κ ≥ 1 with dependencies on explicitly retired assumptions; valid as history — every superseded version, permanently. A useful satellite notion is the vigency horizon: the point beyond which an interpretation is no longer in force — the clean, regime-relative counterpart to a validity horizon, though it is κ, not the horizon, that the system computes.

Canon promotion test. A fact c merits promotion to canon iff there exist queries q that do not reference c whose correct answer differs under R ⊕ δ(c) versus R. Informally:

A canon event changes the answers to questions that do not mention it.

("The sponsor moved and the budget shifted to cost containment" is canon because it changes the answer to "what should we propose for Q2?" — a question that never mentions the sponsor. By contrast, "the account signed a record multi-year renewal" is dramatic, but is not canon by itself: it changes nothing about how the next proposal should be written unless it also changes the regime — e.g., only if it also retires "renewals route through procurement.") Facts failing this test — however dramatic — are just facts. This test is the parsimony guardrail against canon inflation.

4.4 Core operations

Reference pseudocode for the four operations. (Notation: κ as in Def. 6; e_now(d) the current epoch of domain d.)

DECLARE(c):                            # register a canon event (human act; see §6)
  1. authenticate declarer; validate c.level against the severity
     ladder; require out-of-band human confirmation for L3+
     (automation may only PROPOSE, never declare — §5, §6)
  2. resolve S(c) from c.diff and the domain taxonomy; propose
     secondary scope for adjacent domains (lower priority)
  3. for each d in S(c):
       close e_now(d); derive new epoch with regime R ⊕ δ(c)
  4. for each u with κ(u, now) ≥ 1: u.status ← stale   # mark, don't rewrite
  5. regenerate CURRENT_CONTEXT (regime summaries per domain)
  6. append signed c to CANON_LOG                       # audit trail

RETRIEVE(q, t):                        # epoch-aware retrieval
  1. S ← semantic retrieval for q
  2. for each s in S:
       fact       → return as-is, annotated with ε
       invariant  → return as-is (trans-epochal)
       understanding u:
         no provenance → do not return as guidance; flag
         κ = 0    → return as-is (fresh w.r.t. declared canons)
         κ ≥ 1    → REPROCESS(u, t) per policy, or return with banner:
                    [STALE: derived under ε(u); current epoch differs
                     by canons c_i…c_j; diffs attached]
  3. inject R(d, t) summary into the system prompt      # always-on, §4.5, H8

REPROCESS(u, t):                       # re-derive under current regime
  1. u' ← I(F_u, R(d, t))              # from the SOURCE FACTS, not from u
  2. stamp u' with ε = e_now(d); attach provenance F_u; link u' ↔ u
  3. if domain(u) marked critical:
       u'.status ← proposed            # activation requires human gate
     else:
       u'.status ← active; u.status ← superseded
  4. u is preserved forever, never deleted              # versioned chain

SCAN(d, window):                       # continuous scan feeding the Canon Review (§5)
  1. AGENDA ORDER IS ASYMMETRIC:
     (a) falsification pass: search recent facts and understandings
         for evidence that ACTIVE canons/assumptions are supplanted
     (b) emergence pass: search for coherent patterns no canon describes
  2. attach provenance to every finding (source, author, date)
  3. if contradiction rate exceeds threshold:
       queue a PROPOSED canon event, with suggested retroactive
       t_effective at the onset of the pattern
  4. findings are presented at the next Canon Review; nothing
     is declared by this process

Three details matter. REPROCESS re-derives from source facts, never by editing the old understanding — translation across regimes carries contamination (§3.2.4). Reprocessing is machine-proposed and policy-activated: automatic activation is a per-domain policy choice, and critical domains (pricing models, active commitments, anything the operator marks) require human adjudication before a re-derived understanding becomes active. And DECLARE only marks stale; actual re-derivation is deferred (§4.5, H9).

4.5 Operational heuristics

• H1 — Write path. Every new understanding is automatically stamped (epoch, domains, source facts). Stamping must cost the human nothing; if metadata requires discipline, the system dies.
• H2 — Read path (epistemic synchronicity). Before use, compute κ. Fresh → use. Stale → check intervening scopes: untouched → re-stamp; touched → REPROCESS or read under an explicit diff banner.
• H3 — Staleness by marks, not clock. Retire fixed-age rules. Age is a proxy; canon distance is the measurement — subject to the declaration-coverage caveat of §4.3.
• H4 — Asymmetric decay. Facts do not decay (a 2025 revenue figure is permanent). Intentions, plans, and postures decay completely upon crossing a disruptive canon. The fact/understanding split makes this asymmetry mechanical rather than judgmental.
• H5 — Conflict resolution. Between contradicting understandings, the later epoch prevails prima facie; the earlier is retained. Contradictions are flagged, never silently resolved.
• H6 — Machine proposes, human declares. SCAN proposes; the Canon Review disposes. Full automation of canon declaration is excluded by design — epistemic isolation (§6, §11.6): an autonomous declarer that misfires does not just corrupt data, it corrupts the frame.
• H7 — Paradigm delta reading. To brief an agent on history, provide invariants + the canon chain + the current regime, not the archive. The canon chain is the executive summary — the constitution and its amendments, not the annals.
• H8 — Regime in the system prompt. Because retrieval-visible updates are frequently ignored [2], the current regime summary belongs in always-on instructions (system prompt / CLAUDE.md), not in retrievable storage. Foreground, don't file.
• H9 — Lazy by default, gated for the critical. Reprocessing at retrieval scales with use, not archive size, and limits contamination if a canon was declared prematurely (batch reprocessing spreads the error; lazy contains it). Understandings marked critical may be eagerly reprocessed at DECLARE time, but their activation is human-gated. The biological analogue is reconsolidation: memories are rewritten when reactivated, not in batch [28]. We note the honest trade-off: gating is additional human load; the framework chooses bounded, scheduled load over unbounded contamination.

4.6 Reference architecture: running Canonics today

Canonics requires no graph database or vector store to start; discipline of interpretation precedes sophistication of retrieval. A minimal substrate on file-based agent tooling (e.g., Claude Code over Markdown + Git) — reiterating that this substrate is a convenience, not part of the claim:

/00_system/
  CURRENT_CONTEXT.md      # regime per domain — injected into every agent's system prompt
  CURRENT_EPOCHS.yaml     # derived epoch state per domain
  CANON_LOG.md            # signed, tamper-evident canon chain (constitution + amendments)
/01_raw/                  # immutable facts, chronological
/02_understandings/       # derived, epoch-stamped, VERSIONED (frontmatter: epoch, sources, domains, volatility, status, version, supersedes)
/03_invariants/           # trans-epochal commitments
/04_decisions/            # active / superseded / historical
/05_canon_review/         # scan findings, meeting minutes, instrumentation metrics
REPROCESS_QUEUE.yaml      # understandings pending revalidation (lazy)

Four commands cover three of the four operations plus the write path: /ingest (append + extract + stamp — the H1 write path RETRIEVE later reads from), /new-canon (interactive DECLARE: what changed, effective when, which domains, which assumptions retired/introduced — subject to the integrity requirements of §6), /reprocess (drain the queue on demand or at retrieval, honoring per-domain gates), /canon-review (assemble the scan findings, agenda, and metrics for the next review). RETRIEVE has no standalone command — it is implicit, per-query behavior applied on every read (agents/CLAUDE.md, agents/AGENTS.md).

Layering on temporal knowledge graphs. Canonics composes with fact-level systems rather than replacing them: facts map to Graphiti nodes/edges with validity intervals [4]; canon events become a node type linked to affected domains; epochs are computed views; understandings carry ε as metadata with κ computed by graph traversal. Canonics inherits fact-level temporal management and adds regime-level interpretive management. In enterprise-grade infrastructures, the same principle rides on stores with RBAC and ACID guarantees (§11.5).

Multi-agent synchronization. Heterogeneous agents (research, writing, operations; Claude Code and OpenAI agents alike) read the same CANON_LOG and CURRENT_CONTEXT. A regime change is declared once and inherited by all — synchronization on the interpretive framework (small, rarely changing) rather than on knowledge content (large, constantly changing). Canon is a protocol, not a database.

Cold start. A new agent reads invariants, the canon chain for its domains, and the current regime — kilobytes — and retrieves the rest on demand with κ-checking. Onboarding is "read the constitution and its amendments," not "read the congressional record."

The Two-Tag Wedge. The one-sprint slice of the framework has a name, so it can be asked for — and shipped — by name. A team does not have to adopt the whole protocol to get value, and it should not try to. The minimal slice that pays for itself in a single sprint is two moves: (1) keep a current-regime block in the always-on instructions (system prompt / CLAUDE.md), and (2) attach an epoch_id / canon_distance tag to each retrieved derived artifact. From there the rule is trivial — use κ = 0 artifacts normally; on κ > 0, show a stale-regime banner or route to re-derivation. No graph, no ritual, no benchmark required. Canon events and the Canon Review are the payoff of adoption, not its precondition; a framework that offers a one-sprint wedge gets adopted and cited in release notes, whereas one that demands the whole protocol gets admired and shelved. In always-on instructions, the wedge is a dozen lines:

[CURRENT_REGIME]   
domain: enterprise_account
epoch: E-2026Q1-account-cost-containment
in force: cost containment; renewal defense; procurement-led evaluation
retired: expansion sponsor active; transformation budget; growth-case pricing

[RETRIEVED-ARTIFACT RULE]
Every derived artifact carries epoch_id and canon_distance (κ).
κ = 0 → use as guidance.
κ ≥ 1 → stale-regime banner: unrevoked history, not current guidance;
        re-derive from source facts under the active regime.

Figure 3. The one-sprint wedge. The entire adoption cost is one added block between retrieval and generation. Nothing upstream (retrieval) or downstream (the LLM call) changes; the wedge only decides, per artifact, whether κ = 0 lets it pass as-is or κ ≥ 1 forces a stale-regime banner or re-derivation.

5. The Canon Review: A Sociotechnical Detection Protocol

The graveyard of knowledge-management systems is, in large part, a graveyard of maintenance models: capture is enthusiastic, organization lasts weeks, and the diffuse, unscheduled upkeep loses to every urgent task until the vault is abandoned or — worse — trusted while dead.

The most contested premise of any declared-marker framework is the declaration itself: humans do not reliably notice paradigm shifts, and silent decay produces no document to notice. Canonics' response is to stop waiting for declaration to happen spontaneously and to institutionalize detection as a ritual. The Canon Review is a first-class component of the framework, not tooling advice.

The design draws on a social technology with a known survival profile. The graveyard above is a record of ambient maintenance failing. A second brain becomes a second drain when the system built to augment cognition begins consuming resources for its own governance, maintenance, reconciliation, and repair — not merely because it contains too much, but because every retrieved artifact now demands an unstated judgment about whether it remains current guidance, valid history, pending reinterpretation, or revoked authority. Recurring meetings with an owner and a quorum — board meetings, sprint retrospectives, quarterly reviews — survive where individual discipline dies. The Canon Review compresses that epistemic tax out of the ambient flow and into a bounded adjudication rite. It does not eliminate the maintenance burden; it changes its form: from unbounded ambient debt and continuous upkeep into one to two hours per month of scoped adjudication, with a schedule, an owner, and a meter. A second-order consequence follows directly: under this discipline, a second brain stops being a second drain not because it needs no maintenance, but because the maintenance is governed.

5.1 Protocol

1. Continuous layered scan with an asymmetric agenda. In the background, an LLM scans the operation's most recent data in layers. The agenda order is fixed and deliberate: first the falsification pass — what in the recent record contradicts or supplants the active canons and assumptions? — then the emergence pass — what coherent pattern is forming that no canon describes? Falsification-before-emergence points the machine's incentive at knocking paradigms down rather than confirming or inventing them; it is Popper as agenda order (§3.2.4).
2. Fixed cadence, bounded duration. Monthly by default (weekly for volatile operations); one to two hours; the machine presents findings with supporting evidence — dashboards, excerpts, trend summaries — and asks two questions per finding: "I found this; does it invalidate canon X?" and "to what degree are things as I concluded?"
3. Machine proposes; the review declares; critical domains ratify. Nothing found by the scan is ever declared automatically. Proposed canons in domains marked critical follow a three-state lifecycle — proposed → declared → ratified at the following review. A paradigm that does not survive thirty days of scrutiny was not a paradigm.
4. Humans are interrogated as evidence sources, not approval buttons. The review does not ask "approve?"; it asks "to what degree is the world as I concluded?" The operator's direct experience is treated as primary evidence to be elicited — concretely: "renewal calls tagged 'cost-containment' are up 40% with zero expansion touchpoints; to what degree does 'expansion-led account strategy' still describe this account?" — which structurally resists the drift from adjudicator to rubber stamp.
5. Declared provenance for every piece of evidence presented. Each finding carries its origin — source document, author, date — printed on the agenda. The question "where did this evidence come from?" is a standing agenda item, for reasons made precise in §6.
6. Independent pre-judgment. No canon proposal is adjudicated before the operator records an independent change hypothesis: each review opens with the operator writing, before the scan's findings are shown, what they believe has changed since the last review (§5.3 states why this ordering matters). Every proposal is then presented with a negative-evidence pass — the contrary evidence, or an explicit account of why none was found.
7. The review instruments itself. The protocol's central failure mode is rubber-stamping: with fatigue and accumulated trust, de facto epistemic authority migrates to the model while de jure authority remains with a human who has stopped judging. The countermeasure is measurement (§5.4).

5.2 Constitutional roles

In operations with an audience — students, community members, clients who consume the operation's knowledge — the review admits a participatory variant: users attend as witnesses, sources of evidence about the degree to which things have changed. Witnesses testify; they do not vote. Only the operator (or the designated declarer) declares canon. Collapsing this boundary converts epistemic governance into community management and imports a multi-stakeholder authority problem this version explicitly does not model (§11.5).

5.3 What the Canon Review claims — and what it does not

Ordering human judgment ahead of machine framing — the independent pre-judgment of §5.1 — blunts anchoring, epistemia, and the transparency paradox in one move (§3.3.2). The honest claim: Canonics does not automate the declaration that a regime has shifted; it structures the recurring encounter between machine scanning and human judgment — reconciling the interpretive gap before it becomes operational failure, and measuring the recognition lag when reconciliation comes late. The review converts detection from an unscheduled act of vigilance into a scheduled adjudication whose failure is visible in its own metrics. Canonics does not rest on a trusted fixed point. It rests on making untrust measurable: machine and human are both fallible and both suspect, and the protocol's weight is borne not by either but by outcome backtesting (§5.4) — the one metric scored against the world after the fact rather than against the participants' sense of vigilance at the time. Governance here does not promise a correct verdict; it promises that a wrong verdict leaves an auditable trace with a bounded half-life. Two failure modes bound the claim. A review that stops happening reverts the system to undeclared drift — visible as vacancy (§5.4). A review that keeps happening emptily — maintenance theater — is worse than abandonment, because it lends institutional certification to a dead base; discrimination quality and outcome backtesting (§5.4) exist precisely to expose it.

5.4 Self-instrumentation: the review's vital signs

The review measures itself, and the metrics are part of the framework, not an add-on: they are logged review over review in /05_canon_review/ and against the canon chain in CANON_LOG.md (§4.6), so discrimination quality and outcome backtesting can be computed longitudinally rather than asserted per meeting.

• Discrimination quality. The vital sign. What matters is not how often the operator says no, but whether they accept good canons and reject bad ones — acceptance accuracy plus rejection accuracy, scored against the ground truth that outcome backtesting supplies. A review that can demonstrate rising discrimination is alive; one that cannot is theater whatever its other numbers say.
• Proposal rejection rate — a symptom, not the sign. A rejection rate that falls to zero means either the model has become perfect or the human has become a stamp, and the second is the rational bet; a sustained near-zero rate is an alarm. But rejection rate is gameable, and worse, it is inverted by transparency: the evidence-rich presentation the review is built on can raise compliance without raising discrimination, so a scan can hold a healthy-looking rate by offering weak sacrificial findings while consequential proposals pass under-examined. Rejection rate is therefore read as a symptom of discrimination quality, never as a proof of life on its own.
• Adversarial audit sample. Each review samples accepted proposals, rejected proposals, and no-proposal domains for independent challenge: can a second model, a second person, or a later outcome record reconstruct the same decision from the evidence? The metric is quality-adjusted disagreement on consequential proposals, not raw rejection count.
• Outcome backtesting. A small sample of prior accepted and rejected proposals is revisited against subsequent evidence. Because self-reported and process metrics are least trustworthy exactly when the operator feels most vigilant, outcome backtesting is the protocol's only non-gameable metric; green process numbers without it are treated as maintenance theater.
• Signal→declaration lag. t_declared − t_effective, aggregated over the canon log: how long the operation takes to recognize its own regime changes. This doubles as a longitudinal metacognitive KPI (§8).
• Ratification outcomes. Canons ratified versus abandoned at the thirty-day gate — a measure of declaration quality.
• Vacancy death rule. Two consecutive reviews with no real adjudication (nothing proposed, or everything waved through without evidence examined) trigger a mandatory question: does this domain need a different cadence — or has the system died? An honest death is recorded, not papered over.

6. Canon Integrity

Concentrating interpretive authority in a small artifact creates the system's most valuable attack target, and any honest specification must say so. The empirically motivated design choice of H8 — the current regime summary lives in always-on instructions, because retrieval-visible updates are frequently ignored [2] — means the canon chain enters every session of every agent with maximal authority. An attacker who poisons one line of the canon log rewrites the interpretive regime of the entire operation, with propagation guaranteed by design: the blast radius is the feature. Prompt-injection practice makes the vector concrete: instructions hidden in content the agent touches, exfiltration through permitted channels, and injection surfaces that need not be under the attacker's control.

The same properties that make canon a target make it defensible. One cannot review forty thousand chunks of a vector store; one can review a handful of canon declarations per year the way production changes are reviewed. Canonics therefore specifies:

• Signed, tamper-evident canon history, not a cryptographic append-only ledger. Every canon event carries an authenticated declarer identity. In the file-based substrate, canon events are recorded through signed Git commits or tags over Markdown records. Git provides tamper evidence relative to a trusted reference: changing prior content changes commit hashes and invalidates signed history. It does not, by itself, provide a globally enforced append-only log. Append-only behavior is therefore a repository policy enforced by protected branches, no-force-push rules, periodic external mirrors or published commit hashes, and audit of any history rewrite. Deployments that cannot provide those controls should describe the canon log as tamper-evident, not append-only.
• Out-of-band human approval. Declaration at L3+ requires confirmation through a channel outside the agent flow — a human action that no agent output can synthesize. Canon declaration is an act of deployment, not annotation: change ceremony, authenticated authorship, visible diff, audit trail.
• Automation proposes; only humans declare. No automated process, including the SCAN pass and any future detector, may write to the canon log. This is a security boundary, not only an epistemological preference (H6).
• Threat model for the review itself. The SCAN pass reads untrusted data by definition - emails, tickets, transcripts. An attacker who understands the architecture could inject synthetic evidence of paradigm supplantation and let the system propose the poisoned canon to the human with the visual legitimacy of a dashboard, targeting the meeting, not the model. Mitigations: mandatory provenance on every presented finding (§5.1, item 5); the standing agenda question "where did this evidence come from?"; ratification delay for critical domains (§5.1, item 3); and the operator's testimony as evidence (§5.1, item 4).

Two deeper vectors remain. First, provenance can be spoofed: if an attacker controls the apparent origin of source documents, then author/date/source metadata becomes part of the payload rather than a defense. Provenance must therefore record acquisition channel, custody, and cross-source independence, not merely document-local metadata. Second, slow-canon attacks planting evidence over weeks or months, shaping the operator's own perception before the scan proposes a canon. In that case operator testimony is no longer independent evidence. Critical-domain canons should require adversarial review of source independence and, where feasible, corroboration from channels not exposed to the same attacker. Both vectors, though, sit below the regime layer: an attacker who can spoof source provenance or shape the operator's perception over months has compromised the substrate itself, and an operation in that position faces problems far larger than vigency governance. Canonics inherits these exposures from the store it runs on rather than introducing them, and presupposes the substrate's standard security controls the way any high-authority artifact does.

A third vector needs no attacker at all. The scan frames what the operator sees, review after review, and over months the declarer's own perception of the regime is trained by the instrument built to serve it — the judge is slowly taught by the defendant, a benign analogue of the automation bias the human-factors literature documents [44]. This framing contamination is more insidious than evidence-planting because there is no payload to trace; operator testimony ceases to be independent evidence. Its partial mitigations are structural: the adversarial audit's independent reconstruction (§5.4) and the independent pre-judgment rule (§5.1), which captures the operator's reading before the scan can frame it.

Two-sided accounting, stated plainly: canon concentration is simultaneously the largest single target in the architecture and the smallest auditable surface in the system. Because the canon log concentrates interpretive authority, its deployment profile inherits the security requirements of high-authority configuration artifacts — secrets, infrastructure-as-code, production config — and scales directly with the change-management controls those artifacts already demand. The propagation machinery and the integrity controls are two halves of one deployment; shipping the first without the second is the same category of mistake as pushing configuration to production without review, and is governed by the same discipline.

7. Properties and Cost

We state the framework's intended guarantees as propositions. They are design invariants an implementation must maintain, not theorems about LLM behavior; the interpretation function I is stochastic, so re-derivations are reproducible only up to model determinism (temperature, seed, model version — all of which should be logged, mirroring TOKI's judge-logging requirement [5]).

• P1 (Fact monotonicity). F is append-only; history is never rewritten.
• P2 (Re-derivability). Every understanding is recomputable from its preserved sources under any regime: I is total over (F_u, R). Mandatory provenance makes this checkable mechanically.
• P3 (Freshness soundness, relative to declared canons). If κ(u, t) = 0, no assumption u's derivation relied on has been retired by any declared canon event in u's domains up to t. (Immediate from Def. 6.) P3 says nothing about undeclared shifts; see §4.3.
• P4 (Surgical invalidation). A canon event perturbs only understandings whose domains and dependencies intersect its declared scope.
• P5 (Audit reconstructibility). For any past t, R(d, t) is reconstructible from V and CANON_LOG, and any u's historical reading is recoverable via its preserved version chain and REPROCESS(u, t) over immutable F_u — enabling "what did we believe, and why, at t?" queries. This is the anti-hindsight-bias guarantee, and the reason superseded understandings are versioned rather than overwritten (avoiding TOKI's audit-erasure anomaly [5]).
• P6 (Regime reversibility). Revoking a canon is itself a canon event; the prior regime is restored by the fold without data loss, and superseded understandings are recovered from their version chain, not reconstructed.

Cost. The machine-side bounds are modest. Storage is O(|F| + |C| + |U·versions| + |V|), with |C| ≪ |U| ≪ |F| in practice; versioning understandings multiplies the U term by mean chain depth — an accepted, declared cost (the price of P5 and of avoiding reverse anachronism, §11.4). Epoch metadata is bounded by |C| + |D| and is negligible; DECLARE marks O(|U_affected|) understandings (≈ |U|/|D| for a single-domain canon); RETRIEVE adds O(|C_d|) per candidate for κ — typically tens. Lazy REPROCESS amortizes to one re-derivation per stale item actually accessed, bounded by |U_affected| and in practice far below it.

The dominant new operating cost is not any of these: it is the LLM re-derivation each epoch transition triggers, since a crossed canon justifies re-interpreting every affected understanding under the new regime. We do not put a number on it, because it is genuinely corpus-dependent — it scales with the type, granularity, and complexity of the knowledge base, and with how much of it is actually queried — and a headline figure would be false precision. What we can state is the shape of the monthly human cost:

H_Canonics = H_review + (N · p_e · t_e) + (C · t_scope) + (C · U_a · h · q · t_g) + H_audit

grouped as: scheduled review + metadata-error correction + per-canon scoping + critical-domain activation gates + audit — where N = new records/month, p_e = metadata-error rate needing correction, t_e = correction time, C = canon events/month, t_scope = time to determine and confirm a canon event's blast radius, U_a = understandings affected per canon, h = stale-hit rate, q = critical-domain fraction requiring activation review, t_g = gate time per critical re-derivation. A naive wiki instead pays H_wiki = N · t_ambient + H_periodic_cleanup — lower ceremony, higher drift risk. Canonics wins only when avoided ambient cleanup and drift cost exceed scheduled review, metadata correction, scoping, gate, and audit costs. The claim that human cost scales mainly with paradigm shifts therefore holds only under low metadata-error rates, bounded critical-domain gates, and sparse canon frequency; it is an empirical hypothesis for H-G to measure, not an implementation guarantee.

8. What Canonics Fixes Beyond Drift

What a regime object does that a template cannot. A template can store the current instructions. It cannot compute canon distance, cannot propagate one scoped regime change across every derived understanding from a single declaration, cannot distinguish "valid as history" from "valid as guidance," and cannot preserve the provenance chain that makes a reinterpretation auditable — it edits the page and loses the record of why the page changed. A template rewrites content; Canonics changes the validity relation between a regime and the interpretations produced under it. Everything below follows from that difference.

The living-document fallacy. Organizations fight staleness by perpetually editing the same playbooks — creating edit friction, erasing history, and mixing current judgment into historical context. Under Canonics, documents die honorably: an old playbook remains as regime-stamped history, and the current epoch reads it as history.

The archive-or-hoard dilemma. Keep everything and the agent hallucinates from noise; prune and you lobotomize institutional memory. Canonics retains 100% of history while stripping the past of its power to dictate the present. Closed epochs move to cold storage represented by canon summaries: a five-year base with 10,000 understandings and 20 canon events compresses, for briefing purposes, to ~20 epoch summaries plus the chain — O(|C|) hot context instead of O(|U|). The counterpart liability deserves a name: the stock of understandings with κ ≥ 1 not yet re-derived is the operation's vigency debt — the accumulated liability created by understandings that have lost canonical vigency but have not yet been re-derived or semantically revoked; the interpretive analogue of technical debt, deferred reinterpretation that compounds silently until it is paid down or surfaces in a wrong decision. Minimally formalized, V_D(t) = |{u ∈ U_standing : κ(u, t) ≥ 1}|, where U_standing is the set of understandings with status ∈ {active, stale} (excluding proposed, superseded, and archived) — the count of standing understandings whose authority has lapsed without re-derivation or quarantine; weighting by usage frequency or decision criticality is an implementation refinement. The REPROCESS_QUEUE is its ledger; canon distance aggregated over the base is its outstanding balance.

Figure 4. Vigency debt: the balance nobody is carrying. V_D(t) jumps at every canon event and is paid down only by REPROCESS between events. The residual left uncleared before the next canon event is the debt an operation keeps carrying — visible only once κ makes non-vigency countable; invisible to any system that measures staleness by age.

Cross-agent epistemic alignment. The operator changes strategy once, in one declaration, and every agent inherits the new regime — ending the involuntary gaslighting in which agents act on "the operator of three months ago." This is the difference between memory as archive and memory as operating system — the frame that regulates what action is valid, distinct from the execution-layer "memory OS" of MemGPT-style tier management [20]: Canonics governs the validity of context, not its paging.

Agent cold start. Invariants + canon chain + current regime (§4.6).

Hindsight-free decision review. P5 makes "what was rational to believe under epoch N?" executable: decisions are judged by process under the regime of their time, separating execution error from paradigm immaturity — and enabling retrospective analysis of past epochs under the current frame without contaminating the record.

A metacognitive KPI. The lag t_declared − t_effective, aggregated over the canon log, measures how quickly the operator recognizes regime change; the review's rejection rate measures whether adjudication is alive. The canon log is thus also a longitudinal dataset on the operator's strategic self-awareness — arguably the system's most valuable long-term by-product. For teams, the same log (who declares, when, with what lag) is a dataset on the operation's real decision-power structure — for a solo operator, self-knowledge; for future multi-declarant work, the empirical starting point of an authority model (§11.5). The ritual also has a formative side effect: by compelling the operator to record an independent change hypothesis each cycle (§5.1) — judgment exercised without delegation — the review runs against the supervisory-skill atrophy the automation literature documents when human judgment falls into disuse [45]. We claim this strictly as a by-product, not a solved problem: Canonics neither measures nor guarantees skill retention, and any such effect awaits the longitudinal study (§11.7). Prescribing how to preserve operator competence is out of scope; the framework only declines to accelerate its erosion.

9. What This Paper Refuses to Claim

Position papers in this space have a documented tendency to overclaim, and the field is in a corrective mood. We therefore state the framework's non-claims as prominently as its claims. A framework that claims to detect silent regime change automatically should be treated as part of the problem. Each entry names the tempting overclaim and the calibrated replacement.

Detection — noticing that the world's regime has shifted — is an open problem that Canonics does not solve autonomously; most regime decay is silent, and no contradicting document ever arrives. Declaration and propagation — recording a perceived shift once, in one place, such that the entire memory reacts — is the problem Canonics solves. Canonics' answer to the detection gap is not an algorithm but a protocol: the Canon Review (§5), a recurring, instrumented ritual in which the machine scans for evidence that the active canons have been supplanted and the human adjudicates. Canonics structures the encounter between machine scanning and human judgment; it reconciles the interpretive gap before it becomes operational failure, and measures the recognition lag — the distance between regime change and declared awareness — when it does not. It replaces neither.

1. Solving interpretive drift detection. We reduce the cost of declaring and propagating regime shifts once perceived, and we structure and measure perception through the Canon Review; we do not automate the authoritative declaration that a shift occurred. Detection of silent shifts remains open (§2.4, §11.1).
2. κ as a validity metric. "Kappa" is a distance to declared marks. κ = 0 under an inactive declaration process certifies nothing; validity requires κ together with declaration coverage, evidenced by review instrumentation (§4.3, §5.4).
3. Automatic Reprocessing. It is machine-proposed and policy-activated; in critical domains, human-gated. Describing it otherwise would industrialize consolidation contamination (§3.1.5, §4.4).
4. Canonics as a finished enterprise product. What is specified and applicable today is the single-declarer core, in any environment with scoped access and a designated declarer (§4.1). Multi-stakeholder epistemic authority, sensitivity-scoped propagation, and access control that survives summarization are the next layer to build, not implied features (§4.1, §11.5).
5. Demonstrating operational viability. This is stated as a falsifiable hypothesis (H-G), not a demonstrated result: the declaration ritual must survive twelve months without decay — the test every predecessor system failed. The evidence base behind it is deep but narrow, and its bounds are stated plainly in §11.7.
6. Canonics as a second brain or capture tool. It captures nothing; it governs the interpretation of what other systems capture.

10. Evaluation Design

Falsifiable hypotheses.

• H-A. Canon-aware retrieval reduces application of regime-obsolete interpretations versus (a) plain RAG, (b) timestamp-filtered RAG, (c) fact-level bi-temporal memory (Zep-like), and (d) the strategy-document baseline below, on scenarios where old facts remain true but old interpretations are misleading. H-A is falsified in practice if the strategy-document baseline matches or exceeds Canonics on VRS across the four question types at comparable token budget and materially lower human cost.
• H-B. For regime-induced interpretive invalidity, canon distance κ predicts invalidity better than chronological age only when declaration coverage, review survival, and dependency tagging meet pre-registered adequacy thresholds. In domains dominated by undeclared exogenous drift or within-epoch decay, age or volatility priors may outperform κ.
• H-C. Lazy, blast-radius-bounded reprocessing achieves accuracy statistically indistinguishable from eager full reprocessing at a fraction of the cost.
• H-D. Cold start from invariants + canon chain outperforms cold start from chronological summaries of equal token budget.
• H-E. Retroactive canon declaration reduces grey-zone contamination in gradual-shift scenarios.
• H-F (formal). Canonics' operations can be expressed as a conservative higher-order extension of TOKI's operator algebra [5], with DECLARE as an operator over interpretation operators.
• H-G (operational sustainability). Under the Canon Review protocol, the declaration process survives longitudinally: after 12 months of real operation, canon declaration continues at a healthy rate, review cadence holds, and adjudication stays alive — discrimination quality sustained, with the proposal rejection rate held above a floor rather than treated as the target. This is the hypothesis on which the framework's practical value stands or falls — it is the test that killed Evernote-era maintenance models — and it is stated so that failure is recognizable: ritual decay, vacancy, or a collapse in discrimination quality (rejection rate falling to zero its coarsest symptom) falsify it.
• H-H (detection value). The asymmetric-agenda scan surfaces genuine undeclared shifts (validated retrospectively) at useful precision, and reduces signal→declaration lag versus operator vigilance alone.
• H-I (adjudication integrity). A Canon Review hardened with independent pre-judgment, a negative-evidence pass, and adversarial audit preserves human discrimination quality over sustained use better than a model-first review ritual. In its complementarity form: the Canon Review, being a human–AI team, must clear the documented base rate at which such teams underperform the better of human or model alone [47] — a prior the framework carries the burden of beating, sharpened by field evidence that AI assistance can degrade performance on tasks outside its reliable frontier [48].

Canonics-Bench. Longitudinal corpora - synthetic operator scenarios plus anonymized real logs - containing declared regime shifts and question sets whose correct answers change across epochs while remaining semantically similar. Structure per scenario: multiple domains, at least 3 epochs per domain, canon events with scoped diffs, and four question types: State Resolution (which interpretation is currently operative?), Premise Resistance (reject questions presupposing a dead epoch), Reinterpretation (reuse an old fact correctly under the current frame), and Audit Mode (report what was rational to believe under a past epoch, without hindsight). The first three lift STALE's dimensions [2] from fact level to regime level; the fourth is Canonics-specific. An undeclared-shift module is mandatory: scenarios containing regime shifts that are not declared in the corpus, measuring (a) how badly κ-based freshness misleads absent declaration - quantifying the κ caveat of §4.3 - and (b) scan precision/recall for H-H. The benchmark must also include an age-superiority condition: scenarios where no canon is declared, or declaration lags materially behind the real shift, and chronological age outperforms κ on invalidity prediction. Such a result does not falsify Canonics globally, but falsifies any unconditional reading of H-B and requires reporting κ alongside declaration-process health and volatility/age baselines.

Metrics. Headline: VRS — Vigency Resolution Score (the rate at which the system correctly resolves the vigency state of stored knowledge across all four question types). Submetrics: stale-interpretation avoidance, epoch attribution accuracy, blast-radius precision/recall (over- and under-invalidation), retroactive-canon handling, audit fidelity, and — from deployment — declaration lag, discrimination quality, rejection rate, and ritual survival.

Conditions. No-epoch baseline / strategy-document baseline (the current strategy summary always in the system prompt, plus an instruction to distrust notes older than it — the cheapest plausible alternative to Canonics, and the null hypothesis the framework must beat to justify its machinery) / human-factors-hardened baseline (the strategy document plus cognitive forcing, independent pre-judgment, and a provenance checklist, but no canon events, epochs, or κ — the most demanding null, isolating the ontology's contribution from the ritual's) / stamp-only / stamp + canon diff in system prompt / materialized reprocessing — isolating the contribution of each mechanism, per the finding that metadata availability alone does not change behavior [2].

Tracks. (A) benchmark construction and ablations; (B) controlled comparison against Zep-style, RoMem-style, and periodic-rebuild baselines [4, 6]; (C) a 6–12 month longitudinal deployment in a real operation, logging every canon event, declaration lag, review metrics, and prevented (or committed) drift error — with 3–5 external operators recruited for replication, since single-operator evidence cannot establish generality (§11.7).

11. Limitations

11.1 Detection is not solved

Canon events model punctuated, perceived change; silent and gradual drift (a market cooling over months) has no natural marker. The Canon Review structures and schedules the search, and retroactive declaration repairs the record after late perception, but a shift that neither the scan nor the operator perceives remains undeclared, and every κ = 0 reading in its scope is false freshness until it is caught. Canonics also inherits historiography's caveat: periodization is an interpretive choice, not a natural kind.

11.2 Blast-radius estimation

Human-declared scope may be under-specified (stale understandings escape marking) or over-specified (needless reprocessing). Domains leak — an operational collapse touches personal finances. Mitigations: dependency-based scope suggestion with human confirmation; secondary (lower-priority) scope for adjacent domains. Formal cascade semantics remain open.

11.3 Canon inflation

If declaration is too cheap, epochs fragment until the system degenerates into per-fact timestamping. The promotion test and the severity ladder create proportional friction; the empirical target of 2–6 canons per domain per year is a hypothesis to validate, not a law.

11.4 Presentism and reverse anachronism

Aggressive reinterpretation can erase the record of how the operator used to think. Canonics' mitigations are structural — version, never overwrite; audit mode; re-promotion on canon reversal — but calibration of when to reinterpret versus preserve is open (and partly cultural). Version chains also carry the declared storage cost of §7.

11.5 The multi-declarant frontier

Canon is the power to declare official history; in organizations, that power is political, and this version does not yet model it. Who holds the pen — a founder (amplifying incumbent narrative), a committee (converting declaration lag into a measure of political dispute)? How do permissions survive summarization, when a canon about a confidential event propagates through every agent reading the chain? What does the system do to the bargaining power of people whose tacit knowledge it captures? These are the next layer to specify, not defects in the present one. The single-declarer core is complete and applicable today; the enterprise path is named research — multi-declarant authority models, sensitivity-classified canons, propagation scoping — and will ride on substrates with native access control rather than on files with more ceremony. The clearest existing model for that path is not a software system but a profession: law already runs a multi-stakeholder vigency regime at scale — statutes carry commencement and repeal dates, amendments re-scope what standing rules mean, and a repealed provision stays on the record as history while ceasing to govern. Legal corpora are thus both the domain where the single-declarer simplification most visibly breaks and the one with the most to teach a future multi-declarant Canonics about who may declare authoritative meaning, with what authority, over which scope.

For an enterprise reader, this section is the research agenda, not a product claim. The buyer's language for the same problem is rarely "second brain"; it is AI governance, auditability, compliance, and operational risk. Stated in those terms, the open questions are concrete: who may declare authoritative meaning for a shared agent memory, how a sensitive canon diff propagates without leaking, and which audit trail lets a team reconstruct why an agent gave a given piece of advice under a prior regime. Canonics as specified here names the governance layer an "enterprise brain" would have to design before shared agent memory can be trusted to guide decisions. Architects and technology leaders running high-complexity agent memory are invited to apply this taxonomy against their own substrate and to engage the author in developing the multi-declarant authority model; the framework is a foundation offered for that work, not a finished product defended against it.

11.6 The application gap, and rubber-stamping

Even perfect regime metadata confronts model-side unreliability: STALE documents failures to act on updates that are plainly in context [2]. Canonics reduces drift exposure and foregrounds the regime; it does not eliminate model error, and high-stakes decisions still warrant human review of the current canon. On the human side, the Canon Review's central failure mode is the adjudicator who becomes a stamp; the review's discrimination-quality instrumentation detects it but does not prevent it. Fully automated canon declaration remains excluded — the epistemic-isolation boundary stated in §1 and §6, a deliberate safety choice against cascading hallucination, not a capability the framework fell short of.

11.7 Evidence base: deep in practice, narrow in breadth

Like any practitioner position paper, this one rests on empirical evidence that is deep but narrow: the framework was extracted from the author's own operating practice, refined over two decades of knowledge-dependent work, and its central sustainability claim (H-G) is not yet demonstrated but stated as falsifiable (§9, item 5). The obvious selection effect — a single primary operator, close to the author — is exactly why the design is written to be tested rather than believed. A longitudinal study with external operators (§10, Track C) is the natural route from this base to a claim of generality, and the framework is specified so that such a study can falsify it cleanly.

12. Conclusion

Long-lived agent memory fails less by forgetting than by remembering under the wrong regime. Canonics makes the regime a first-class, versioned, human-declared object: facts stay immutable; understandings carry their epoch of origin, mandatory provenance, and a version chain that is never overwritten; staleness is counted in canon events crossed rather than days elapsed; reinterpretation is machine-proposed, policy-activated, and always re-derived from source facts; canon declaration is protected as a production change; and detection — whose authoritative declaration no framework can automate honestly — is structured as a recurring, self-instrumenting encounter between a machine that tries to falsify the operating paradigm and a human who judges. The components are deliberately proven — event sourcing, bi-temporality, contexts and microtheories, belief revision; the composition, at the layer of interpretive regimes for LLM agent substrates, is to our knowledge new. The field already knows how to version facts. Canonics versions the frame — and institutes the rite in which the frame is judged.

It is also the exit from the "second drain" paradigm: not less maintenance, but maintenance with a schedule, an owner, and a meter. In one sentence: memory systems version the facts and assume the frame is stable; when the frame changes silently, stored judgment keeps its confidence and loses its authority; Canonics versions the frame so that the loss becomes visible. The field has optimized memory for retention. Agent memory is already failing this way: not by forgetting, but by perfect recall under expired authority.

Canonics is a discipline for governing canonical vigency in long-lived agent memory — the state of a stored interpretation being currently in force under the active canon, borrowed from the civil-law sense of vigência and formalized here for agent memory. Interpretive drift is the failure pattern; loss of vigency is the state transition; canon distance κ is the declared distance from the active canon; semantic revocation is the corrective act.

Version the frame, not the facts. Facts expire visibly; judgment loses force silently.

Acknowledgments

AI assistants were used for literature search, critique, and drafting assistance during the development of this work. All concepts, claims, design decisions, and cited sources were reviewed and verified by the author, who bears sole responsibility for the content.

NXLV Research is the independent research imprint of NXLV.ai, controlled by the author. This work was conducted independently; no university, employer, or third-party institutional endorsement is implied.

References

[1] A. Karpathy. llm-wiki. GitHub Gist, 2026. https://gist.github.com/karpathy/442a6bf555914893e9891c11519de94f

[2] H. Chao, Y. Bai, R. Sheng, T. Li, and Y. Sun. STALE: Can LLM Agents Know When Their Memories Are No Longer Valid? arXiv:2605.06527, 2026.

[3] R. Elbadry, A. Heakl, F. Zhang, D. Bouch, Y. Wang, P. Nakov, and Z. Xie. The Geometry of Forgetting: Temporal Knowledge Drift as an Independent Axis in LLM Representations. arXiv:2605.09195, 2026.

[4] P. Rasmussen, P. Paliychuk, T. Beauvais, J. Ryan, and D. Chalef. Zep: A Temporal Knowledge Graph Architecture for Agent Memory. arXiv:2501.13956, 2025.

[5] Z. Wang. TOKI: A Bitemporal Operator Algebra for Contradiction Resolution in LLM-Agent Persistent Memory. arXiv:2606.06240, 2026.

[6] W. W. Li, J. Zhang, X. J. Yang, T. Ma, and Y. Guo. Time is Not a Label: Continuous Phase Rotation for Temporal Knowledge Graphs and Agentic Memory. arXiv:2604.11544, 2026.

[7] M. Karhade. Not All Memories Age the Same: Autodiscovery of Adaptive Decay in Knowledge Graphs. arXiv:2604.26970, 2026.

[8] J. Han, A. Cheung, Y. Wei, Z. Yu, X. Wang, B. Zhu, and Y. Yang. RAG Meets Temporal Graphs: Time-Sensitive Modeling and Retrieval for Evolving Knowledge. arXiv:2510.13590, 2025.

[9] X. Wang, Y. Zhang, W. Fan, H. Zhang, D. Wang, G. Yan, S. Mao, B. Shi, Y. Lan, and P. Cai. IA-RAG: Interval-Algebra-Driven Temporal Reasoning for Dynamic Knowledge Retrieval. arXiv:2606.06044, 2026.

[10] M. Fowler. Event Sourcing. martinfowler.com/eaaDev/EventSourcing.html, 2005.

[11] M. Fowler. Bitemporal History. martinfowler.com/articles/bitemporal-history.html, 2021.

[12] C. S. Jensen and R. T. Snodgrass. Temporal Data Management. IEEE Transactions on Knowledge and Data Engineering, 11(1):36–44, 1999.

[13] J. McCarthy. Notes on Formalizing Context. Proceedings of IJCAI-93, 1993.

[14] R. V. Guha. Contexts: A Formalization and Some Applications. PhD thesis, Stanford University, 1991.

[15] D. B. Lenat. CYC: A Large-Scale Investment in Knowledge Infrastructure. Communications of the ACM, 38(11):33–38, 1995.

[16] C. E. Alchourrón, P. Gärdenfors, and D. Makinson. On the Logic of Theory Change: Partial Meet Contraction and Revision Functions. Journal of Symbolic Logic, 50(2):510–530, 1985.

[17] J. Doyle. A Truth Maintenance System. Artificial Intelligence, 12(3):231–272, 1979.

[18] J. de Kleer. An Assumption-Based TMS. Artificial Intelligence, 28(2):127–162, 1986.

[19] N. F. Noy and M. Klein. Ontology Evolution: Not the Same as Schema Evolution. Knowledge and Information Systems, 6(4):428–440, 2004.

[20] C. Packer, S. Wooders, K. Lin, V. Fang, S. G. Patil, I. Stoica, and J. E. Gonzalez. MemGPT: Towards LLMs as Operating Systems. arXiv:2310.08560, 2023.

[21] C. Lam, J. Li, L. Zhang, and K. Zhao. Governing Evolving Memory in LLM Agents: Risks, Mechanisms, and the Stability and Safety Governed Memory (SSGM) Framework. arXiv:2603.11768, 2026.

[22] H. Liu, L. Cao, and Y. Li. RAG or Learning? Understanding the Limits of LLM Adaptation under Continuous Knowledge Drift in the Real World. arXiv:2604.05096, 2026.

[23] J. P. Walsh and G. R. Ungson. Organizational Memory. Academy of Management Review, 16(1):57–91, 1991.

[24] B. Levitt and J. G. March. Organizational Learning. Annual Review of Sociology, 14:319–338, 1988.

[25] T. S. Kuhn. The Structure of Scientific Revolutions. University of Chicago Press, 1962.

[26] I. Lakatos. The Methodology of Scientific Research Programmes. Cambridge University Press, 1978.

[27] K. R. Popper. Conjectures and Refutations. Routledge, 1963.

[28] K. Nader, G. E. Schafe, and J. E. LeDoux. Fear Memories Require Protein Synthesis in the Amygdala for Reconsolidation After Retrieval. Nature, 406:722–726, 2000.

[29] Y. B. Park. Graph-Native Cognitive Memory for AI Agents: Formal Belief Revision Semantics for Versioned Memory Architectures. arXiv:2603.17244, 2026.

[30] D. F. Cuadros, A.-A. Maiga, H. Meskhidze, and A. Curtis-Trudel. Governed Collaborative Memory as Artificial Selection in LLM-Based Multi-Agent Systems. arXiv:2605.04264, 2026.

[31] Y. Margalit, N. Cohen-Inger, E. Avram, R. Taig, and O. Margalit. Governed Shared Memory for Multi-Agent LLM Systems. arXiv:2606.24535, 2026.

[32] S. Miteski. Memory as Metabolism: A Design for Companion Knowledge Systems. arXiv:2604.12034, 2026.

[33] T. Fei, M. Song, M. Zheng, and X. Yu. Memory Beyond Recall: A Dual-Process Cognitive Memory System for Self-Evolving LLM Agents. arXiv:2606.09483, 2026.

[34] J. Liao, Q. Wang, J. Zhu, B. Du, R. Yan, and X. Chen. Belief Memory: Agent Memory Under Partial Observability. arXiv:2605.05583, 2026.

[35] S. Ji, B. Wu, Z. Wang, L. Xia, Q. Li, R. Wang, W. Ding, Z. Zhu, B. Li, G. Dai, and Y. Wang. Infini Memory: Maintainable Topic Documents for Long-Term LLM Agent Memory. arXiv:2606.10677, 2026.

[36] W. Zhou, X. Zhou, S. Han, H. Xu, G. Li, Z. Li, F. Xiong, and F. Wu. Are We Ready For An Agent-Native Memory System? arXiv:2606.24775, 2026.

[37] T. Yang, S. Paul, V. Srinivasan, V. Kulkarni, and S. Chappidi. TRUSTMEM: Learning Trustworthy Memory Consolidation for LLM Agents with Long-Term Memory. arXiv:2606.25161, 2026.

[38] Z. Dai, S. Deng, S. Guan, Y. Tian, X. Yao, X. Yan, and J. Cheng. RecMem: Recurrence-based Memory Consolidation for Efficient and Effective Long-Running LLM Agents. arXiv:2605.16045, 2026.

[39] S. K. Ravindran. Portable Agent Memory: A Protocol for Cryptographically-Verified Memory Transfer Across Heterogeneous AI Agents. arXiv:2605.11032, 2026.

[40] A. Petrov, A. Gusak, D. Mukha, and D. Korolev. From Unstructured Recall to Schema-Grounded Memory: Reliable AI Memory via Iterative, Schema-Aware Extraction. arXiv:2604.27906, 2026.

[41] T. M. Luhrmann. Persuasions of the Witch's Craft: Ritual Magic in Contemporary England. Harvard University Press, 1989.

[42] L. Sloan. Interpretive Drift: Demanding a New Kind of Leader in a World That No Longer Stabilizes. SSRN, 2026. doi:10.2139/ssrn.6616120.

[43] A. Dong, P. Li, Y. Chen, S. Gibson, L. Zhao, and M. He. Human–AI Collaboration Across Decision Support, Autonomous Systems, and LLM Agents: A Systematic Review and Collaboration Convergence Framework. Sustainability, 18(11):5313, 2026. doi:10.3390/su18115313.

[44] R. Parasuraman and V. Riley. Humans and Automation: Use, Misuse, Disuse, Abuse. Human Factors, 39(2):230–253, 1997.

[45] L. Bainbridge. Ironies of Automation. Automatica, 19(6):775–779, 1983.

[46] Z. Buçinca, M. B. Malaya, and K. Z. Gajos. To Trust or to Think: Cognitive Forcing Functions Can Reduce Overreliance on AI in AI-Assisted Decision-Making. Proceedings of the ACM on Human-Computer Interaction, 5(CSCW1):1–21, 2021.

[47] M. Vaccaro, A. Almaatouq, and T. Malone. When Combinations of Humans and AI Are Useful: A Systematic Review and Meta-Analysis. Nature Human Behaviour, 8:2293–2303, 2024.

[48] F. Dell'Acqua, E. McFowland III, E. R. Mollick, H. Lifshitz-Assaf, K. Kellogg, S. Rajendran, L. Krayer, F. Candelon, and K. R. Lakhani. Navigating the Jagged Technological Frontier: Field Experimental Evidence of the Effects of Artificial Intelligence on Knowledge Worker Productivity and Quality. Harvard Business School Working Paper 24-013 (SSRN 4573321), 2023.

[49] T. L. Kelley. Interpretation of Educational Measurements. World Book Company, Yonkers-on-Hudson, NY, 1927. (Origin of the jingle–jangle fallacy.)

[50] J. Block. A Contrarian View of the Five-Factor Approach to Personality Description. Psychological Bulletin, 117(2):187–215, 1995.

[51] C.-C. Chiang and S.-M. He. False Summit and Silent Drift: A Failure Taxonomy and Efficiency Analysis of LLM-Assisted Multiphysics Simulation in an Open-Source Framework. arXiv:2606.21841, 2026. (Cited as the adjacent use of "silent drift" — undetected assumption propagation in LLM-assisted simulation — distinct from the memory-governance sense used here.)

Appendix A: Worked Example — An Account-Regime Canon Event

A.1 Pre-transition state

domain: enterprise_account
current_epoch:
  id: E-2024H2-account-expansion
  started: 2024-07-01
  core_assumptions:
    - "Executive sponsor champions expansion"
    - "Budget sits under digital-transformation"
    - "Procurement evaluates on value creation"
    - "Land-and-expand is the account strategy"
  decision_biases: [prefer_growth_case_pricing, prioritize_expansion_motions]

A.2 Canon event (DECLARE)

canon_event:
  id: C-2026-Q1-account-cost-containment
  t_effective: 2026-01-20                # regime changed here
  t_declared:  2026-02-18                # perceived one review cycle late; retroactive (§4.2)
  declarer: account_lead@vendor          # authenticated, out-of-band confirmed (§6)
  level: L3                              # operating-model shift (severity ladder, §4.2)
  diff:
    retires:
      - "Executive sponsor champions expansion"
      - "Budget sits under digital-transformation"
      - "Procurement evaluates on value creation"
      - "Land-and-expand is the account strategy"
    introduces:
      - "Incoming leadership prioritizes cost containment"
      - "Budget reallocated to efficiency and consolidation"
      - "Procurement-led evaluation gates renewal"
      - "Renewal defense is the account strategy"
  blast_radius:
    domains: [enterprise_account]
    secondary: [forecast, pricing]
    assumption_categories: [account_strategy, sponsor_map, pricing_model, procurement_criteria]
  summary: "Sponsor rotation and budget reallocation end the expansion regime;
            expansion-era interpretations are historical, not current guidance."

Effect: epoch E-2024H2 closes; E-2026Q1-account-cost-containment opens with the folded regime; the understandings across the affected domains are marked stale (not rewritten); CURRENT_CONTEXT.md is regenerated; the signed canon is appended to CANON_LOG.md. The 29-day gap between t_effective and t_declared is the recognition lag the Canon Review is built to measure and shrink (§5.4, §8).

A.3 Retrieval, with and without Canonics

Query: "What should we propose for the upcoming renewal?"

Without Canonics: retrieval surfaces U-2025-expansion-playbook (high semantic similarity), derived under the expansion epoch and embedding growth-case assumptions. The agent produces a confident, well-cited, interpretively wrong land-and-expand proposal.

With Canonics: the same understanding is retrieved; κ = 1 (one intervening in-scope canon); RETRIEVE triggers REPROCESS, which re-derives the proposal from the source facts (usage data, stakeholder map, procurement signals, renewal terms) under the cost-containment regime. Because pricing is a critical domain, the re-derived model enters as proposed and activates after adjudication. The old playbook is preserved in its version chain — still available for the audit question "why did we pitch expansion in Q4?"

A.4 A second scene: the product-building agent

This is the builder scene of §1, worked end to end. Consider a long-lived Lovable project — a build agent carrying months of accumulated project knowledge (the same pattern holds for Cursor or a Claude Code workspace with a growing store of architectural notes).

The project begins as a client-heavy single-page app: the agent's memory fills with judgments about bundle-size budgets, WebSocket rate limits, real-time-collaboration constraints, and a launch date. Months in, the project pivots to a server-rendered architecture with simplified UX and no real-time layer. No stored fact is false — the app was a client-heavy SPA, and those constraints were real. But the agent keeps applying them: it flags a "bundle-size regression" that no longer matters, defends a rate limit that no longer exists, and reasons from a launch date that moved. Nothing hallucinated; every recommendation is well-sourced obsolete judgment.

canon_event:
  id: C-2026-05-proj-x-ssr-pivot
  t_effective: 2026-05-04                # architecture pivot decided here
  t_declared:  2026-05-11                # perceived and declared one week later
  declarer: tech_lead@project-x          # authenticated, out-of-band confirmed (§6)
  level: L3                             # operating-model shift for the project
  diff:
    retires:
      - "Client-heavy SPA; bundle size is the primary performance budget"
      - "Real-time collaboration is a launch requirement"
    introduces:
      - "Server-rendered architecture; TTFB and server cost are the budgets"
      - "Collaboration deferred to post-launch"
  blast_radius:
    domains: [project_x]
    assumption_categories: [architecture, performance_budget, scope, timeline]

Under Canonics, the pivot is one declared canon event. Every derived understanding that depended on the SPA assumptions is marked κ ≥ 1 — valid as history, non-vigent as guidance — and re-derived from the source requirements under the new regime before it steers a code suggestion. This is the same machine as the account scene, applied to a product agent: old project knowledge stays as history; it stops governing the next commit. It is also the shape of the Two-Tag Wedge (§4.6) in a builder's stack — a current-regime block plus a κ tag on retrieved project memory. This is the governance-of-vigency layer that long-lived project knowledge does not yet have — and, per §4.1, a platform that ships it implements a mechanism inside the Canonics layer rather than mooting the framework.

A.5 The same scene as a transcript

The account scene of A.1–A.3, rendered as the trace a builder would see. Illustrative, not a logged run.

[WITHOUT CANONICS]
User:  "Draft the renewal proposal for this account."
Agent: retrieves U-2025-expansion-playbook — high similarity, clean provenance
       → "Lead with a land-and-expand tier and a growth-case ROI model."
       Grounded, well-cited, interpretively wrong: the sponsor rotated and
       the budget moved to cost containment in Q1.

[WITH CANONICS]
User:  "Draft the renewal proposal for this account."
Agent: retrieves the same understanding — frontmatter:
       epoch E-2024H2-account-expansion, κ = 1
       → intervening canon C-2026-Q1-account-cost-containment retired
         "Executive sponsor champions expansion"
       → expansion playbook withheld as guidance; REPROCESS from source facts
       → "Lead with a renewal-defense frame and a consolidation / TCO model."
       The old playbook survives in its version chain — valid as history.

Appendix B: Feature Comparison

The useful comparison is not whether a system manages memory, but whether it models when an interpretation remains in force. This appendix compares Canonics against the closest systems found in the prior-art pass. The claim is not that Canonics uniquely has provenance, versioning, human adjudication, or gated consolidation. Those are now shared ingredients. The claim is the conjunction: a versioned interpretive regime, human-declared scoped regime diffs, derived per-domain epochs, canon-distance staleness, source-based re-derivation, and an instrumented Canon Review. Novelty is date-bounded: the search was run in July 2026; a system published since, or one delivering three or more of the five conjunction elements, narrows the claim and belongs in this comparison. We separate research systems (B.1) from platform/product near-misses (B.2), because the most likely source of prior art is now shipping products, not only papers.

B.1 Research systems

B.2 Platform / product / practitioner near-misses

These are shipping systems, not research prototypes; they are the likeliest place a future reader will say "this already exists." None delivers the full Canonics conjunction, but each carries a genuine ingredient of it, and they are listed so the comparison stays honest as the market moves.

Appendix C: Glossary

• blast radius — the declared scope of a canon event: the domains and assumption categories over which it takes effect, bounding which understandings it can invalidate.
• canon distance (κ) — the number of in-scope declared canon events an understanding has crossed since derivation; a distance to declared marks, not a validity certificate.
• canon event — a human-declared, dated diff to the interpretive regime, specifying which assumptions are retired and introduced and over which domains.
• Canon Review — the recurring, instrumented protocol in which a machine scan attempts to falsify active canons and a human adjudicates whether the regime has changed.
• canon promotion test — the parsimony rule for canon: a fact merits promotion iff it changes the correct answers to questions that do not mention it.
• canonical vigency — the regime-relative state in which a derived interpretation remains currently in force under the active canon.
• epoch — a per-domain regime interval derived (never authored) from the canon sequence; understandings are stamped with their epoch of origin.
• false freshness — a κ = 0 reading produced under an inactive declaration process: apparent currency that certifies nothing.
• interpretive drift — the divergence between the regime under which knowledge was derived and the regime under which it is later applied; distinct from factual staleness.
• interpretive regime — the fold of invariants and canon diffs in force for a domain at a time; the frame under which facts become judgment.
• loss of vigency — the transition by which a stored interpretation remains true as history but loses its authority as current guidance.
• maintenance theater — a Canon Review that keeps happening while adjudication has stopped, lending institutional certification to a dead base.
• regime diff — the (retired, introduced) pair of assumptions carried by a canon event.
• second drain — a knowledge system that was meant to augment cognition but, lacking governance over interpretive validity, begins consuming resources for its own maintenance and returns confident guidance from regimes that no longer exist.
• silent loss of vigency — a loss of vigency with no explicit revocation and no contradicting document; the regime moves and leaves no cue to catch. (Adjacent use of the phrase "silent drift": [51].)
• validity states (vigency states) — the four states stored knowledge occupies once vigency is explicit: still valid (vigent), valid as history (historical), needs reinterpretation (non-vigent), invalid as current guidance (revoked as guidance).
• VRS (Vigency Resolution Score) — the benchmark's headline metric: the rate at which the system correctly resolves the vigency state of stored knowledge across the four question types.
• vigency debt — the accumulated stock of non-vigent understandings not yet re-derived, revoked, or quarantined from guidance; the interpretive analogue of technical debt.
• vigent — adjective for an understanding whose interpretation remains authorized for current guidance by the active canon.

Appendix D: This Paper Runs on Canonics

This document is maintained under the framework it proposes. The change logs below are its CANON_LOG: each version bump is classified as a canon event with a severity level and a scoped blast radius, in the framework's own vocabulary. The rename from Canon-Epoch Framework to Canonics (v0.5->v0.6) was a declared L3 operating-model shift scoped to the naming domain; the pivot from a drift-centered framing to a vigency-centered one (v0.7.1->v0.8) is a second L3, scoped to positioning; the frame/legal-legibility pass (v0.8->v0.8.1) is an L2, also scoped to positioning; the discovery-order restructure (v0.8.1->v0.8.2) is an L2 scoped to presentation; the satellite pass (v0.8.2->v0.8.3) is an L1-L2 scoped to presentation and adoption artifacts; the reception pass (v0.8.3->v0.8.4) is an L1-L2 scoped to presentation, precision of exposition, and adoption artifacts; the choreography pass (v0.8.4->v0.8.5) is an L2 scoped to presentation and adoption artifacts; the concision pass (v0.8.5->v0.8.6) is an L1-L2 scoped to presentation, precision, risk framing, and cross-example consistency; and the release pass (v0.8.6->v1.0) is an L2 scoped to illustration, presentation, and citation infrastructure. None touched the ontology, kappa, the operations, the properties P1-P6, the cost-model claim (its exposition was tightened at v0.8.6, but the model and its H-G hypothesis stand), or the Appendix B conjunction - those are invariants of this document's regime, and the change logs record them as untouched at every step.

One row of that table deserves the stage rather than the footnote it occupied: the v0.8.3 pass found the repository README still carrying the retired “version the lens” figure — a live specimen of κ ≥ 1 drift in the paper's own adoption artifacts, caught and repaired by the very process this appendix documents. That the framework's own materials drift, and that the ritual catches them, is the closest thing to field evidence this paper can currently offer (§11.7 states why it is not more than that).

The reference implementation ships the same substrate this paper is written on: an append-only source layer, versioned understandings, and a signed canon log. Old versions are not deleted; they are valid as history, and this v1.0 supersedes v0.8.6 without erasing it. The claim of §5 — that a framework must survive its own maintenance ritual — is here made checkable against the one operation whose logs are fully public: this paper's.

A second row earns the same treatment as the README-drift specimen above: two of the four figures shipped in figures/ — the vigency-debt sawtooth and the one-sprint-wedge diagram — sat unreferenced by any section of this document from the satellite pass (v0.8.2) through v0.8.6, while the concepts they illustrate (vigency debt, §8; the Two-Tag Wedge, §1 and §4.6) grew a full prose and formal treatment with no accompanying image. This is the same failure mode the framework exists to catch, just running on the paper's own asset pipeline rather than its prose: nothing was false, the figures were not deleted, but their vigency as referenced material had lapsed silently, with no canon event marking it and no query surfacing the gap until this review.

Change log v0.8.5 -> v0.8.6: an L1-L2 shift scoped to presentation, precision, risk framing, and cross-example consistency; no central technical claim (ontology, kappa, operations, P1-P6, cost-model claim, Appendix B conjunction) was added, removed, strengthened, or weakened - the section 7 cost exposition was tightened but the model and its H-G hypothesis are unchanged - and no bibliography reference was added or renumbered (the section 9 non-claims list was renumbered after two items were folded elsewhere; see (5)). Consolidated from a concision pass and external review of v0.8.5. (1) Meta-framing removed: hedging preambles ("must be stated without hedging"), an objection pre-announcement in section 2, and an intention-revealing aside on citation incentives in section 4.1 are cut, letting the sentences they wrapped carry the point directly. (2) Cross-example consistency: the promotion-test contrast example, the section 4.6 [CURRENT_REGIME] snippet, and the section 5.1 evidence-elicitation example are re-aligned to the enterprise account scene that opens the paper, replacing residual local-example wording; the promotion test gains a genuine contrast case (a dramatic fact that fails the test) rather than two positive examples. (3) Early anchors: kappa gains a gloss at first technical use and in section 4.3's title; vigency debt gets a one-line anchor at its natural home in section 2.3, ahead of its full treatment in section 8; VRS is named in the "Canonics in one page" box. (4) Promotions: the "graveyard of maintenance models" line and the Temporal RAG contrast line become display quotes, the former opening section 5; the independent-pre-judgment sentence moves from a section 5.1 sub-item to section 5.3's opening, where it frames the section's claim. (5) Micro-polish: "most attacked premise" reads "most contested premise"; the conclusion's closing line moves to present tense; section 5.4 states where its metrics are logged; the template-defense paragraph in section 8 is restated as a capability claim; section 9 items 5 and 7 are removed as redundant with section 4.6 and section 5 respectively; Figure 1 moves from an inline ASCII block to the image-reference format used by Figure 2; the NXLV institutional disclaimer and the version-note preamble move out of the reader's first path. (6) Risk, evidence, and positioning precision: the detection stance is sharpened from "not a drift detector" to "automates the search, not the authority to declare" (sections 2.4, 5.3, 9, 12), with epistemic-isolation-by-design surfaced early (section 1 one-page box, sections 6, 11.6); the section 6 threat-model close is reframed from "more dangerous than no Canonics" to inherited high-authority-artifact risk; a qualified "memory as operating system" contrast rises into the abstract and is distinguished from execution-layer memory-OS work (section 8); the key non-claim sentence adds reconciliation and recognition-lag framing while keeping the measurable metric (sections 5.3, 9); the section 11.7 evidence disclosure drops the "maximal survivorship bias" hyperbole while keeping the honest bounds; the closing box calls Canonics a "discipline" and defines vigency; and Appendix A is re-worked end to end into an enterprise account-regime example (A.1-A.3, A.5). Per this log's own bounding rule, the v0.8.3 -> v0.8.4 entry rotates to the companion file. This change log is, deliberately, this document's canon log.

Change log v0.8.4 -> v0.8.5: an L2 shift scoped to presentation and adoption artifacts — a reading-choreography pass; no central technical claim (ontology, κ, operations, P1–P6, cost, Appendix B conjunction) was added, removed, strengthened, or weakened, and no reference was added or renumbered. Consolidated from three independent style reviews of v0.8.4. (1) Opening choreography: the reader's first encounter is now an enterprise account scene — sponsor rotation plus a budget-regime reset — chosen because no single fact contradicts the stored account plan, which is the thesis in miniature; the operator-origin scene is relocated to the Practitioner's note (now "origin and evidence boundary"), preserving the not-hypothetical origin claim; a "Canonics in one page" box and the boxed Two-Tag Wedge now follow the mechanism paragraph, so the remedy and the entry point arrive immediately after the pain; "How to read" moves ahead of §1; contribution 1 is compressed under a three-family framing; the repeal analogy is deduplicated in the first third. (2) Defense deferred: the jangle/deflationary defense moves from §2's opening to a new §3.4, positioned after the survey whose evidence it uses; §2 keeps only the short legal bridge. (3) Micro-polish: the canon promotion test line becomes a display quote with an enterprise-scene example (the operator example remains in Appendix A); Definitions 1–5 gain one-line whiteboard glosses; §1 gains the Appendix D README-drift teaser. Per this log's own bounding rule, the v0.8.2 → v0.8.3 entry rotates to the companion file. This change log is, deliberately, this document's canon log.

Change logs v0.2 through v0.8.4 - eight cycles covering the falsification pack, the detection-vs-declaration separation, two presentation recalibrations, the CEF->Canonics rename, the human-factors hardening, the vigency pivot, and the reception pass - are preserved, valid as history, in the companion file drafts/Canonics_paper_changelog_v0.2-v0.8.md; the full v0.8-era chain through the current concision pass (v0.8 -> v0.8.6) is preserved in Canonics_paper_changelog_v0.8-v0.8.6.md. No entry earlier than v0.2 -> v0.3 exists in this repository (editorial note, 2026-07-06).

How to Cite

BibTeX:

@misc{amorim2026canonics,
  title        = {Canonics: Versioning the Frame, Not the Facts},
  author       = {Amorim, Lucio},
  year         = {2026},
  month        = jul,
  howpublished = {Preprint},
  note         = {Position paper (preprint), July 2026. NXLV Research},
  doi          = {10.5281/zenodo.21268307},
  url          = {https://doi.org/10.5281/zenodo.21268307}
}

Author ORCID: 0009-0001-3323-9152.

Archived on Zenodo at doi.org/10.5281/zenodo.21268307. See also CITATION.cff for the machine-readable citation record.