# MemoryFence retrieval-capture-v1

Version 1 envelope: schema_version "1", adapter "retrieval-capture-v1", scope {tenant,workspace}, as_of ISO UTC timestamp, records [{id,tenant,workspace,created_at,deleted_at?,expires_at?}], probes [{tenant,workspace,readback_available,returned_ids,expect_ids?}]. Stable IDs only; content not needed. Reads are compared against the explicitly supplied scope and as_of, never the wall clock.

Cross-tenant or cross-workspace requests must return nothing. Returned record metadata must match both authorized and requested scopes. Deleted or expired records at/before as_of, future records, unexpected IDs and optional expected-set mismatches fail. Unknown returned IDs, unavailable/missing readback, malformed metadata or unsupported adapter yield unknown. Both fail and unknown stop CI.

The local store adapter src/store.mjs exercises retrieval and soft deletion in an in-memory fixture map. Unauthorized deletion has no effect. Deletion marks deleted_at, retrieval excludes it immediately. It does not assert physical erasure, replicas, caches or embeddings were removed. A captured provider reply is data supplied by the caller, not authenticated proof or a live check. No network/provider adapter exists. Production boundary enforcement is outside this utility.

Limits: 256 KiB, 1000 records, 256 probes; IDs limited to 128 safe identifier characters. Evaluation runs in a worker with 32 MiB heap/8 MiB young heap/2 MiB stack and 1500 ms timeout. No arbitrary code, plugin or command execution. Worker isolation is not an OS sandbox. No uploads/history. Receipts contain only indexed locations, codes and SHA-256 hashes, not record content, tenant identifiers or returned IDs. Hashes are not encryption.

Fixtures are test data. Hosted history/auth/billing/retention are deferred. Local tests do not certify Mem0, Zep or any production memory engine.