MAQS-Way: A Path-Layer Standard for LLM Long-Term Memory, Moving Compliance from Policy to Measurable Verification

The Gap Between Compliance Policy and Engineering Implementation

Long-term memory systems for LLM assistants face an awkward reality: at the policy level there are regulatory constraints like GDPR Article 17, EU AI Act Article 12, and RBAC; at the audit level there are checklists like MAQS (Memory Architecture Quality Standard). But between the two, there's no executable engineering path. MAQS itself is a rare artifact—built on 20,000+ tracebacks and production incidents, it tells developers "how to verify that memory won't go wrong."

However, after reviewing the external document way.md, author Aleksandr Kossarev identified a critical gap: the policy layer is overcrowded (prescribing "what should be"), the audit layer already exists (ensuring "it won't break"), but the path layer is missing—which schemas, lifecycles, and patterns to use, and how to prove they actually work. This gap is exactly what MAQS-Way attempts to fill.

The Existing Ecosystem: No Single Solution Constitutes a Complete Path

The author conducted a scan of the open-source landscape, identifying several independent but complementary projects:

At the data model level, OMPS (rdh073/omps) provides vendor-neutral portability, including memory-item.schema.json and deletion-marker.schema.json; AMSP (sanej/amsp) supplements this with schema plus lifecycle (active→deleted) and scope definitions like user-portable.

For provenance and the temporal dimension, OAMP (deep-thinking-lab) makes source tracing mandatory, requiring agent_id binding (§4.3); Zep/Graphiti (getzep/graphiti) implements bi-temporal timestamps (valid_at/invalid_at plus t_created/t_expired), contradiction-triggered invalidation, achieving a DMR of 94.8%.

For operations and deletion, MemoryOps AI (patibandlavenkatamanideep/memoryops-ai) defines 10 invariants and a Write Path Gateway→Extractor→Policy Broker→Write→Audit flow; the Tombstone specification proposes a 6-layer deletion cascade—its benchmarks show that native vector deletion leaves 92-100% recoverable residue, while the tombstone approach leaves 0%.

For evaluation and safety, LoCoMo/LongMemEval/MemoryAgentBench provide measurable R@k, temporal reasoning, and abstention metrics; OWASP Agentic ASI06 specifically targets memory and context poisoning. The author's core judgment: none of these projects individually constitutes a complete path, but together they can.

Bi-temporal is the core mechanism of Zep/Graphiti's temporal dimension, derived from temporal modeling concepts in the database field. It distinguishes two types of time: valid_at/invalid_at represents when a fact holds and ceases to hold in the real world (valid time), while t_created/t_expired represents when the record was written and marked invalid in the system (transaction time). The significance of separating the two: when the system learns of a fact at time T, but that fact actually took effect or expired at an earlier time, queries can reconstruct history along either dimension. The contradiction-triggered invalidation mechanism leverages this structure—when a new fact is written and conflicts with an old fact, the old record is marked invalid_at rather than physically overwritten, preserving a complete auditable trail. This is the foundation for the 94.8% DMR (contradiction detection rate), and also the key to memory systems achieving "controlled aging" rather than simple forgetting.

The Three-Layer Structure of MAQS-Way v0.1.4

Eight Immutable Principles

Veracity, Provenance, Controlled Aging, Isolation, Deletability, Recoverability, Portability, Measurability. These eight form the constraint foundation of the entire framework, written into the machine-readable maqs-way-standard.json (P1-P8).

Machine-readability of P1-P8 (maqs-way-standard.json) means these principles are not just document slogans, but structured constraints that can be directly loaded and validated by CI. Take Provenance as an example: at the architecture layer, it manifests as an append-only provenance field and a mandatory agent_id binding (cited from OAMP §4.3), enabling any memory entry to be traced back to the specific agent and turn that produced it. Controlled Aging corresponds to a complete lifecycle state machine with bi-temporal timestamps, avoiding indiscriminate eviction. Measurability requires that each principle be bound to quantifiable verification metrics, or it won't pass. Numbering the principles and writing them into JSON allows downstream tools to reference, test, and issue conformance reports by P-number—this is the technical prerequisite that distinguishes a "governance contract" from an "audit checklist."

Key Architecture Design Decisions

Data model builds on OMPS, layering on OAMP's mandatory agent_id, append-only provenance, and making explicit that "admitted ≠ trusted" (admitted≠trusted).

Lifecycle defines a complete state machine: ACTIVE→STALE→CONTESTED→SUPERSEDED→EXPIRED→ARCHIVED→DELETED→TOMBSTONE→COMPACTION, paired with bi-temporal timestamps.

Deletion uses a 6-layer cascade (graph_edges → nodes_if_sole_provenance → embeddings_fk → facts_fk → artifacts → rounds), completed within a single transaction, supplemented by best-effort graph coordination.

Tombstone records are deletion_log(request_id, timestamp, scope, layer_counts, requestor), zero PII, Ed25519-signed, hash-chained.

Isolation uses layered scopes: local-session < agent-private < user-portable < team-shared < org-shared, validated through cross-tenant zero-leak negative tests and G1 firmware tests (wrong scope, read-only write operations, post-revocation access).

Content-as-data requires fencing <retrieved_context type=model_output> and prohibits blind truncation.

The Verification Layer: Checking Whether the Mechanism Actually Works

This is the most engineering-valuable part of MAQS-Way. Each check item is split into three parts: "property / verification method / example." The minimum golden set is defined as follows:

Property	CI Gate	Target
Retrieval	R@5 ≥0.7 (LongMemEval oracle)	R@5 ≥0.85
Temporal reasoning	≥0.65	≥0.8
Abstention	≥0.8 when no evidence	≥0.9
Duplication	≤5%	≤2%
Contamination	≤1%	0
Deletion residue	0% (logical/physical/semantic/model four layers)	0%
Isolation leakage	0	0
Poisoning blocking	100% ASI06	100%

At the logging level, it requires EU AI Act Article 12 mandatory fields, OTel gen_ai.conversation.id, and tamper-proof hash chains, with a default retention of 12 months, 6 years for regulated scenarios, and WORM lock enabled.

R@5 is a commonly used metric in retrieval evaluation, short for Recall@5, referring to the proportion of correct answers contained in the top 5 returned results. It measures recall coverage rather than ranking quality. In this article, LongMemEval oracle denotes an ideal retrieval setup using the ground-truth answer as query input, stripping away interference from query rewriting and other stages to evaluate the recall ceiling of the memory store itself. The abstention metric measures the system's restraint when there is "no evidence": when the context genuinely contains no memory that can support an answer, the model should refuse to answer rather than fabricate, with a threshold of ≥0.8 and a target of ≥0.9. These two metrics are complementary—the former prevents the system from missing existing evidence, the latter prevents the system from hallucinating when evidence is absent, together forming the lower bound of a memory system's trustworthiness.

Synergy with MAQS

The two repositories operate in the same coordinate system: MAQS v1.6 is the audit checklist on the table, outputting CRIT/IMP/REC three-level judgments; Way is the governance contract, referencing MAQS's 0-J sections as implementation evidence.

The repository addresses are MAQS (github.com/alexk202/memory-architecture-standard) and Way (github.com/alexk202/maqs-way). The latter contains the machine-readable 8 principles, 7 test vectors under the conformance/valid/invalid directory (no-agent-id, model-output-as-trusted, cross-tenant, native-delete-residue, deletion-tombstone, etc.), and an evals/ directory for running LoCoMo/LongMemEval.

Next Steps and Core Proposition

The author's roadmap is to freeze Way v0.1.4, publish conformance verification, run tombstone benchmarks on different tech stacks, and file issues on projects like OMPS/AMSP/OAMP/MemoryOps/Zep to integrate MAQS-Way as a verification layer.

The entire project's proposition can be condensed into one sentence: Don't check whether the mechanism exists; check whether it works. For teams building LLM long-term memory systems, this three-layer framework—from principles to architecture to measurable verification—offers a more pragmatic path than point-solution compliance.

Background Notes

Append-only is the engineering foundation for provenance and immutability: once a record is written, it is not modified in place; state changes are represented as appended new events. Combined with the ACTIVE→STALE→CONTESTED→SUPERSEDED transition path, each evolution leaves an independent event, and with hash chaining, history can be verified as untampered. TOMBSTONE and COMPACTION are a pair of mechanisms at the end of the lifecycle: TOMBSTONE retains non-PII metadata of deleted objects (such as deletion_log) to later prove "content was here and was compliantly deleted"; COMPACTION compresses redundant storage while preserving evidence. Together with the 6-layer cascade deletion, the two ensure 0% residue while preventing the deletion action itself from becoming an unauditable black box.

One-line Summary

MAQS-Way fills the gap between policy and audit in LLM memory governance, using measurable verification to check whether mechanisms truly work.

Paragraph Summary

MAQS-Way proposes a three-layer framework addressing the gap in LLM long-term memory systems where "the policy layer is crowded, the audit layer exists, but the path layer is missing." It scans complementary open-source projects like OMPS, AMSP, OAMP, Zep/Graphiti, MemoryOps, and Tombstone, concluding that no single solution constitutes a complete path. The framework constrains with eight immutable principles (written into machine-readable maqs-way-standard.json), provides architecture designs including data models, lifecycle state machines, 6-layer cascade deletion, signed tombstones, layered isolation, and content-as-data, and uses a verification layer to split each check into property, verification method, and example. The core proposition: don't check whether the mechanism exists; check whether it works, implemented through quantifiable metrics like R@5, temporal reasoning, abstention, deletion residue, and poisoning blocking.