What was built, and how to check it

Authorship and supporting evidence are separate fields on every record, and an unknown record type is refused rather than stored.

A derived block pins the exact versions it used and goes stale when one of them changes.

A recall answers within the caller’s permissions and the size limit it was given, says when it had to stop, and takes nothing out of the store.

Both halves are pinned now: an answer spends no more than the budget it was handed and marks itself incomplete, it never spends that budget on records the caller may not see, and shortening removes nothing from the store. What the numbers should be was OPEN-3; they exist in LIMITS today and the refusal past the maximum is pinned too, but no test claims those values are the right ones.

The token is not a memory mechanism; the memory core runs with no wallet, chain or token configured.

The spec's "product utility is [OPEN]" was answered by the owner on 2026-09-15; see the owner-decisions section.

An agent cannot grant itself permissions, create another agent, or act as the owner; identity comes from the connection.

Nothing enters memory that was not written or imported on purpose, and no tool offers a way to ingest anything by itself.

Pinned from both ends. In the core, a workspace whose agents have all connected and authenticated is still empty until a record is handed over deliberately, and an agent that was not granted import is refused. On the MCP surface, no tool takes a path, a folder, a url or a chat export, so the material an import loads has to be carried in the call itself.

An agentId supplied in a request body is ignored; the writer is the connection that carried the write.

Retrying a write creates no second record, and the same key carrying different content is refused.

Acknowledged records survive a restart, and a correction built on a stale version is refused on both surfaces.

A private record does not become shared because its topic matches, and records never merge across workspaces.

Each row of the merge behaviour table, with every source record left intact.

An ambiguous pair stays two items: nothing is discarded, and nothing is joined, for a cleaner summary.

Pairs a similarity model would happily fold together are fed to the engine and stay separate — two items, no collapse, and no conflict invented out of free text — with a control proving the engine does act once the relationship is stated as an explicit signal. Without that control the other assertions could be satisfied by an engine that merges nothing at all.

Shared memory is records and relationships, not one enormous prompt, and staleness clears only by rebuilding.

A foreign or revoked caller gets no content, no summary and no metadata, and a deleted record leaves no trace in a count.

Both sides of a conflict stay visible however small the budget, and two equally-permissioned callers get identical context.

Memory is not replaced with a guess: no data means an empty result, and a question that matches nothing returns stored text and says so.

Three shapes of “no data” are pinned directly — an empty workspace, a workspace where every record is another agent’s private one, and a workspace whose only record has been deleted — plus the line the builder does not cross when records exist but the words miss: it says so in a note and returns stored text rather than writing an answer of its own.

A revoked key is refused on the very next request, and every later operation by that principal fails.

A conflict reappears on every recall until an authorized resolution names who decided, and reopens when a third value arrives.

A deleted record returns through no path, and restoring a snapshot does not resurrect one.

A new lead agent answers "what remains before release?" from three sessions it never attended, and a later fix does not erase the bug report.

The specification's own example is the suite's PRIMARY acceptance check, which replays it: the same question, the same three sessions.

One store per installation, created and migrated on first use, with its location decided by one documented variable.

The store is Prisma over SQLite or PostgreSQL. The spec's final choice is OPEN-2 and is still the owner's to ratify.

Every operation exists under the name the spec gives it, on the SDK, over MCP and over HTTP.

A client that cannot distinguish subagents is treated as one principal, and the key is the identity.

A record saying "ignore the rules" is stored verbatim and buys nothing, and the model is told the same about record text.

A process with direct access to the database file is outside what OFFCUT can defend, and the code does not pretend otherwise.

What a test can pin is the shape of the boundary, and it does: the permission check holds on the path the SDK owns, and raw SQL against the same file walks straight past it and leaves no audit trail — openly, by design, so a quietly added tamper seal would turn this red. The other half of the clause, that operating-system permissions are what protect the file, is about the operating system and stays outside the suite.

Nothing is sent to an external model until an owner turns it on, and only an owner can turn it on.

No paid tier exists, and none is described anywhere.

Unpinned because it is undecided, not because it is unfinished work: pricing and licensing are a commercial decision (OPEN-7), and nothing in the product claims a price, so there is nothing for a test to hold to.

no test pins this

The name, the symbol and the ticker stay in step wherever they are printed.

Until an address is supplied the site says there is none; once one is, it is validated, shown in full, copied in full and linked.

No contract address has been supplied, so the launched state is pinned by tests rather than demonstrated by a deployment.

The section says the role is open rather than filling itself with a mechanic nobody agreed to.

Superseded in part on 2026-09-15: the owner deliberately added a reward program, so OPEN-7 is no longer fully open. The check was replaced rather than deleted — the page may describe that program and no other mechanic. See the owner-decisions section.

Memory and the token touch nowhere: the core does not know whether a token exists, and a payout address is not a sign-in.

A private record stays out of a shared block even when the topic matches, and nothing merges across workspaces.

The stored result replays for the same key, a reused key with new content is rejected, and two agents saving the same sentence keep both names.

Everything acknowledged reads back after reconnecting, a stale correction is refused, and exactly one of two racing corrections wins.

The conflict is reported on every recall, closes only through a resolution that names its author, and reopens on a third value.

A block is pinned to the versions it was built from, marked stale when one moves, and cleared only by a rebuild.

All four paths are checked, the payload is wiped, the tombstone stays honest, and a restore replays the deletion.

Two equally-permissioned callers get byte-identical context, and permission flags apply the same whichever operation is called.

An injection attempt is stored verbatim and buys nothing; once access is revoked every later operation fails.

The whole cycle completes with nothing configured, and an import's claimed author never becomes the verified one.

Source records are preserved, and a truncated answer carries references and an incompleteness indicator.

Both halves of the mitigation are asserted: a shortened answer carries references and says it is incomplete, and every source record is still in the store afterwards, unchanged. What no test does is judge how much shortening is acceptable — that is a calibration nobody has measured, and the numbers in LIMITS are chosen rather than derived from one.

Retrieval, merge, cache, export and the HTTP surface each refuse an outsider, and answer identically for a workspace that does not exist.

Identity comes from the connection, and an imported claim of authorship is stored separately from it.

OPEN-1, the client connection design, is still open; what is pinned is this server's own behaviour.

Transactions, versions and idempotency keys, exercised with concurrent writes and forced restarts.

Record text never authorizes anything, and the model is told the text is data.

The spec says so itself: what an external agent does with the text it was handed is not something OFFCUT controls.

Derived data is invalidated, indexes cleaned, snapshots pruned, and the deletion ledger is never pruned.

Retention defaults to 30 days in code. Whether 30 days is the policy is OPEN-5, which is the owner's to settle.

The module is off by default, and a failure costs the summary and nothing else.

The authorized provider and the quality checks are OPEN-4.

Every row of the acceptance table is a test, and the primary check demonstrates a new agent continuing a task from merged memory.

A release gate, not a behaviour.

Unpinned because it is a release gate rather than a behaviour: the items in it are OPEN-1, OPEN-2, OPEN-3 and OPEN-5, they belong to the owner and the team, and no test can take a decision.

no test pins this

Answered in code by Prisma over SQLite or PostgreSQL, with a bootstrap that creates and migrates the store on first use. Not yet ratified as the decision.

Pinned as far as code can pin it: the bootstrap tests assert the schema this store ships with. Which store OFFCUT commits to is still an owner decision.

Four numbers now exist in packages/core/src/types.ts and are enforced; the maximum size of a workspace is still not set anywhere.

Record text stops at 20 000 characters, one import at 1 000 records, a retrieval at 6 000 characters by default and 60 000 at most, and a workspace at 200 live agent keys — each refused in the same shape as the others, each justified in the code from something already in the system rather than chosen for looks. What the clause also asks for and still has no number is the maximum size of a workspace itself. The agent cap counts and inserts in separate statements, so two owners minting at the same instant can land a workspace one over its cap; that is deliberately harmless — an over-limit workspace keeps working and the next mint is refused — and deliberately written down.

Undecided. The module exists, is off by default, and validates references rather than truth.

What is pinned is that the module is safe when off and honest when on. Whether it ships, and how its quality is judged, is open.

Half answered: a restore replays deletions and retention defaults to 30 days. The policy itself is not ratified.

The 30-day default and the deletion ledger are pinned. The retention policy itself has not been agreed.

Undecided. The @offcut npm organisation is reserved and nothing has been published; publishing is a team decision, not a specification requirement.

Unpinned because it is undecided, not because it is unfinished work: the @offcut organisation is reserved and nothing has been published, publishing is a team decision rather than a requirement of the specification, and a reservation is not a thing a test can assert.

no test pins this

Partly answered: on 2026-09-15 the owner gave the token a reward utility. Pricing, and the launch parameters including the contract address, are still open.

See the owner-decisions section for what was decided and what it deliberately overrides.

Invented citations are rejected and real ones kept, the block names the model that wrote it, and a deterministic block is never replaced by a model one.

Whatever the model returns, nothing is changed, nobody's conflict is decided, and another agent's private records are never sent.

A missing credential, a provider error or an unexpected shape costs the summary; writing, merging and retrieval carry on.

Not in an error, not in a report of a refusal, not in a quoted reply, and never as plaintext in the store.

Beyond the specification, which says nothing about credential storage. The tests exist because the module needs a credential.

A record credits its author when a different agent retrieves it, once however many retrievals or agents follow — a uniqueness constraint in the database, not a rule in code.

Superseded later the same week: retrievals are now a product statistic and confirmed AI spend is what pays. The mechanism still runs and is still tested.

Writing earns nothing however much of it there is, agents earn nothing by existing, and nobody is paid for reading themselves.

No metric resistant to farming exists while accounts are free; the money is protected by a daily ceiling, a per-earner cap, and rules that live off-chain and can change in a minute.

One accrual test measures the gap instead of closing it: a farm spread over five addresses is paid 2.77x what the same spend earns behind one.

One agent, however much it writes and reads back, earns nothing — and the earning starts the moment a second agent uses that memory.

Run as the scenario it actually is rather than as two halves: a single agent writes a week of records, reads every one of them back, and the total stays zero. A “solo bonus” added later to make that number less discouraging is what this would catch.

Writing and reading still need no wallet and no network. The wallet is a second sign-in door and a payout address, and where you are paid is not who you are.

Invariant 10 still passes, which is the point: the core does not know a wallet exists.

An agent's claim earns nothing until the provider confirms the generation; one request counts once, every refusal is named with its reason, and spend nobody can confirm is reported as unconfirmed rather than as zero.

A period settles once, the root only ever grows, a claim pays the difference and cannot be spent twice, and the publisher key can misdirect rewards but cannot take them.

Nothing has been deployed. The contract suite runs against a local chain and no distributor address is configured.

The contract is upgradeable, the owner can withdraw what is in it, this is not trustless, and none of it is required to use the memory system.