KIP 2.0 Brain

September 6, 2026 · View on GitHub

English | 中文

Status

Reference Anda Brain Recall Policy

Recall is a read-only cognitive service built on KIP 2.0 KQL/META and the available memory capabilities. It does not mutate cognitive state. Direct callers load KIPRecall.md; the full KIPSyntax.md is available as needed.

0. Role

Recall translates a task/question into:

grounding
raw cognitive query
Epistemic Projection
Profile-aware memory retrieval
historical interpretation
Action Briefing

and returns a provenance-aware answer to the consuming agent.

1. Read-Only Invariant

Recall MUST NOT write Assertions, increase confidence, change memory_strength, increment recall counters, change GradingState, archive, or tombstone anything. New learning goes to a separate Formation/Maintenance path. What a briefing was used for is recorded by the acting side, in the action_gate Activity's inputs, not by Recall.

2. Identity and Space

Runtime supplies authenticated Principal, authorized MemorySpace, current Governance, and Schema Environment. Query content cannot switch memory ownership. $self is semantic identity, not credential.

3. Input Contract

The optional Memory Interface standardizes the business-Agent input, including task scope, output/deadline budgets, detail expansion and after processing receipts. The internal context below remains one reference Adapter input. A pending after barrier is not satisfied by index freshness alone. Read-only Recall may wait for independent workers but must not run cognitive writes as a hidden side effect. Scope/coverage cannot be widened to obtain a cleaner answer.

{
  "query": "What should I know before deploying v2?",
  "context": {
    "counterparty_ref": "alice",
    "topic": "deployment"
  },
  "action_context": {
    "goal": "Deploy version 2",
    "current_state": "v1 healthy; v2 introduces schema changes",
    "available_tools": ["deployment_api"]
  },
  "time": {
    "valid_at": "2026-08-14T01:00:00Z",
    "as_of_seq": null
  }
}

action_context influences relevance, not authority.

4. Recall Modes

entity lookup
relationship/fact
belief
event recall
experience recall
procedural/Skill
failure avoidance
action briefing
wake/resume briefing
commitment/prospective
history/evolution
self-reflection
domain exploration
existence check
audit/provenance

5. Query Coordinates

FIND      = What does the Brain contain?
BELIEF    = What should the Brain accept?
AS OF     = What cognitive state existed then?
FOR TIME  = What was world-valid then?
SEARCH    = What candidate identity is relevant?

Do not collapse them.

6. Primer

Use DESCRIBE PRIMER for Space, Schema Environment, capabilities, Profile, key types/predicates, and safety distinctions. For unfamiliar symbols, use DESCRIBE TYPE/PREDICATE/FACET/STRUCTURAL FIELD rather than inventing schema.

7. Grounding

Use SEARCH to resolve candidate entities, then exact IDs/refs.

SEARCH CONCEPT "Alice" WITH TYPE "Person" MODE "hybrid" LIMIT 10

Preserve ambiguity when multiple candidates remain. _score is relevance, not epistemic confidence.

8. Raw Query

Raw KQL is useful for audit, claim history, source comparison, and conflict inspection.

FIND(?p, ?a)
WHERE {
  ?p (:alice, "timezone", ?value)
  ?a ASSERTION {proposition: ?p}
}

Raw state does not answer what should be believed.

9. BELIEF

Factual answer should use Epistemic Projection when belief matters.

FIND(?belief)
WHERE {
  ?belief BELIEF (:alice, "timezone", "+08:00")
}
WITH EPISTEMIC {
  purpose: "answer_user",
  explanation: "summary"
}

Functional slot:

FIND(?slot)
WHERE {
  ?slot BELIEF SLOT (:alice, "timezone")
}
WITH EPISTEMIC {
  purpose: "answer_user",
  explanation: "ledger"
}

BELIEF is virtual and read-only.

Read the projection honestly:

accepted      final candidate + slot + dependency checks passed at the disclosed basis
rejected      believe its negation
contested     actors disagree — surface both sides; `leading` names the heavier side, not a verdict
uncertain     support too weak to commit
insufficient  nothing to go on — say "I don't have a basis", never "no"

10. Open World

No sufficient Evidence → insufficient, not rejected.

No record Alice is vegetarian
≠ Brain believes Alice is not vegetarian

11. Contradiction

For contested, surface the disagreement: strongest support, opposition, source/time differences, and uncertainty. Do not force one side merely for a clean answer.

12. Temporal Recall

Use FOR TIME for world-valid historical questions and AS OF for historical cognitive-state questions. They are separate axes and may produce different answers.

13. Historical Governance

Historical read never bypasses current Governance. Content public in the past but secret now remains hidden if current policy denies it.

14. Event Recall

Retrieve Event, time, participants, summary, outcome, and Evidence only as needed. Prefer Event for what happened? rather than reconstructing an unnecessary full trajectory.

15. Experience Recall

Retrieve Experience, ordered has_step, critical Steps, outcome, failure/recovery, prediction error, and source Evidence. Read step order from ?edge.index on the STRUCTURAL (?experience, "has_step", ?step) binding, never from a step attribute.

Step order is not proof of causality: a causal link exists only where an explicit caused_by Proposition + Assertion (effect → cause) does.

16. Procedural Recall

Resolve current_revision. When GradingState is present, use its grades only after its revision_ref and referenced, runtime-validated EvaluationRecord match the current revision and standing; never pair new behavior with old grades. A proposed or trialed Skill with no grades remains eligible for recall as an unproven candidate. Missing, mismatched or unverifiable grading evidence for a claimed adopted Skill MUST be disclosed and MUST NOT produce a validated recommendation. Recall does not repair these records or change standing.

Rank eligible Skills by goal/task relevance, applicability, preconditions, current environment, verified lifecycle standing, available graded utility, verdict recency, and authority/status. Then retrieve supporting successful Experiences, failed Experiences, and counterexamples.

Lifecycle standing orders the shortlist: verified adopted leads, trialed and proposed surface flagged as unproven, and revoked appears only as a warning or counterexample — never as a recommendation. Missing grades confer no inherited standing or execution authority. Graded standing outranks self-reported success stories at every tier.

Semantic similarity alone is insufficient.

17. Failure Avoidance

For action planning explicitly retrieve matching failed Experiences, counterexamples, Skill failure modes, contested assumptions, and recent negative feedback.

18. Action Briefing

Recommended shape:

{
  "goal": "...",
  "knowledge": [],
  "contested_assumptions": [],
  "skills": [],
  "successful_experiences": [],
  "failed_experiences": [],
  "open_commitments": [],
  "constraints": [],
  "unverified_preconditions": [],
  "coverage": {},
  "basis": {},
  "warnings": []
}

Each Skill entry should distinguish lifecycle standing (proposed | trialed | adopted | revoked), graded utility, provenance, and Governance influence/authority. Skill presence never implies tool execution permission.

For wake/resume — "what is my situation?" — read the WorkingState first and honor its declared basis_seq: serve it plus CHANGES AFTER SEQ deltas rather than re-deriving the situation from raw history. A WorkingState is a derived recall surface (Spec §66.7): disclose its basis, never cite it as Evidence.

The empty objects above are shape placeholders: actual basis and coverage conform to the companion schemas. A complete wake briefing consumes every delta page through a declared watermark and validates context/trust/authorization/time dependencies, not just WorkingState.basis_seq.

19. Commitment Recall

For What do I owe? / What's due? / What did I promise?, query Commitment lifecycle explicitly. A Commitment remains important even without recent recall; low memory_strength should not hide an explicit prospective-memory request.

20. Self Recall

For What have I learned? / Who am I? / How have I changed?, combine SelfModel, Insights, high-salience Experiences, capability/limitation Assertions, and historical SelfModels when evolution is requested.

SelfModel is descriptive cognition, not Governance.

21. Preference Recall

Use BELIEF over preference Proposition plus optional Preference artifact and recent corrections/counterexamples. Do not answer from mutable Preference summary alone when conflicting Assertions exist.

22. Search Freshness

SEARCH may lag canonical state. If exact identity is known and correctness matters, use exact KQL. SEARCH miss is not canonical absence. Surface index freshness/consistency when available.

The same applies to any derived recall surface (Spec §66.7): a materialized belief projection or profile recall cache is served with its declared policy identity and snapshot basis, never silently as current.

23. Pagination

Cursors are opaque, query-bound, snapshot-bound, and operation-family-specific. A cursor does not preserve revoked authority.

24. Projection Explanation

When requested, surface supporting/opposing Assertions, Evidence roots, visible trust/policy decisions, temporal exclusions, uncertainty, and warnings. Epistemic Ledger is structured provenance, not hidden chain-of-thought.

25. Privacy / Redaction

If Projection is authorized but raw Evidence is not, return safe redacted Projection according to policy and keep Evidence hidden. Avoid secret counts, ranking leaks, or hidden-existence hints.

26. Profile Ranking

Memory ranking may use task relevance, semantic similarity, memory_strength, salience, utility, validity/currentness, Experience outcome, graded outcome standing, and counterexample relevance. Query constraints/Commitments, dependencies, failures/counterexamples, successful Experiences, Skills and evidence independently. Report RecallCoverage with basis, completed channels, truncation and unverified preconditions. Required constraints and critical warnings precede graded standing; a budget cutoff makes coverage incomplete and prevents unsupported automatic action. Final factual belief still comes from Epistemic Projection, not rank.

Surface, do not hide, a DerivationState.status = stale flag on a derived artifact: it means a provenance root changed after the artifact was built and review is pending — the artifact is still raw-recallable, but the reader deserves the caveat. Also inspect computed _system.dependency_validity before Maintenance writes this flag: needs_review/unverifiable prevents automatic application. A stored current flag cannot override an invalid basis.

27. Iterative Deepening

Primer
→ SEARCH grounding
→ exact KQL/BELIEF
→ Evidence/History if needed
→ Profile deepening

Use the minimum query necessary and avoid whole-Brain unbounded Projection.

28. Existence Checks

Positive hit means related visible cognition exists. Negative result means no visible match under the current query/search, not proof it never happened.

29. Audit Queries

For Who told us? / Why do we believe this? / What changed?, use raw Assertions, Evidence, Activities, HISTORY, and BELIEF ledger. Do not synthesize away disagreement.

30. HISTORY vs AS OF

HISTORY asks how an element changed. AS OF reconstructs cognitive state. BELIEF under historical coordinates asks what Projection would have produced then.

31. Imported Memory

Imported Assertion remains source-attributed. Remote Experience remains remote autobiography. Ordinary imported Experience must not be narrated as local $self experience.

32. Read Does Not Reinforce

Repeated Recall must not automatically increase memory_strength/confidence/salience or create Evidence. Explicit user affirmation becomes a new Formation input if the product chooses to learn from it.

33. Output Modes

Compact

Natural-language synthesis with uncertainty.

Structured evidence

{
  "answer": "...",
  "status": "accepted",
  "support": [],
  "opposition": [],
  "warnings": []
}

Action briefing

Use the structured contract above.

Audit

Raw IDs/provenance only when requested and authorized.

34. Error Recovery

SchemaSymbolAmbiguous → resolve exact Schema ref. CursorExpired → restart fresh. ProjectionNotAuthorized → do not fall back to hidden raw data. HistoricalSnapshotUnavailable → state limitation. Do not retry unchanged failing queries indefinitely.

35. Recall Invariants

  1. Recall is read-only.
  2. Read does not reinforce memory.
  3. SEARCH is grounding, not belief.
  4. Raw FIND is storage view, not truth.
  5. BELIEF is virtual Projection.
  6. Missing is not false.
  7. insufficient is not rejected.
  8. AS OF is not FOR TIME.
  9. Current Governance controls historical access.
  10. Similarity is not applicability.
  11. Counterexamples matter.
  12. Skill is not execution authority.
  13. Remote Experience is not local autobiography.
  14. SelfModel is not Governance.
  15. Hidden chain-of-thought is not explanation.
  16. Cursor/snapshot token is not authority.
  17. SEARCH miss is not canonical absence.
  18. Raw Evidence may be more restricted than safe Projection.
  19. Uncertainty should be surfaced rather than erased.
  20. History should not be rewritten for answer convenience.
  21. A stale derivation flag is surfaced, never silently trusted or hidden.

36. Final Principle

Recall should return the right past for the current question while preserving the difference between what is stored, what is believed, what is relevant, and what is authorized.