{"row":{"id":"ADR-030","title":"MemoryFrameRef.trust reservation (Shield gate seed)","file":"adr-030-memory-frame-trust.md","status":"accepted","date":"2026-04-17","cites":8,"supersedes":[],"superseded_by":[],"layers":["L0","L0.5"],"tags":["l0","cortex","shield","trust-level"],"room":true},"pin":{"release_tag":"v0.107.0","commit":"5d61b7e13f1f6a10c17414f61146648f76bcf2bd"}}

[{"k":"h","depth":1,"text":"ADR-030: MemoryFrameRef.trust reservation (Shield gate seed)","id":"adr-030-memoryframereftrust-reservation-shield-gate-seed"},{"k":"p","inline":[{"k":"text","text":"Status flipped "},{"k":"code","text":"proposed → accepted"},{"k":"text","text":" 2026-07-12 under the merged-code\nrule (the #474 ADR ruling): the decision is load-bearing in shipped\ncode — "},{"k":"code","text":"MemoryFrameRef.trust"},{"k":"text","text":" exists, defaults safely, and rides the\nserde wire today. An ADR whose decision the workspace already executes\ndoes not stay \"proposed\"; the prose below documents what IS."}]},{"k":"h","depth":2,"text":"Context","id":"context"},{"k":"p","inline":[{"k":"text","text":"Wave 4A R2 (commit "},{"k":"code","text":"41e8a1467"},{"k":"text","text":", 2026-04-17) added "},{"k":"code","text":"trust: TrustLevel"},{"k":"text","text":"\nas a reserved field on "},{"k":"code","text":"MemoryFrameRef"},{"k":"text","text":" so that Shield (the\nNIKA-380..389 code family) can gate every recall by the trust level of\nthe source memory frame "},{"k":"strong","text":"without a breaking change"},{"k":"text","text":" when real recall\narrives. Per ADR-028 (forward-compat reservation policy), the field\nships years before its writer: reserving the slot is cheap; retrofitting\nit onto a "},{"k":"code","text":"#[non_exhaustive]"},{"k":"text","text":" struct consumed across layers is not."}]},{"k":"p","inline":[{"k":"text","text":"The trust model this seeds is "},{"k":"strong","text":"sticky taint"},{"k":"text","text":": trust is assigned at\ningest and never upgrades on recall — a frame that entered the store\nuntrusted can never launder itself into a trusted context by being\nremembered."}]},{"k":"h","depth":2,"text":"Decision","id":"decision"},{"k":"list","ordered":false,"items":[[{"k":"code","text":"MemoryFrameRef"},{"k":"text","text":" carries "},{"k":"code","text":"pub trust: crate::trust::TrustLevel"},{"k":"text","text":"\n("},{"k":"code","text":"nika-types/src/memory.rs"},{"k":"text","text":" — re-exported through "},{"k":"code","text":"nika-kernel"},{"k":"text","text":")."}],[{"k":"strong","text":"Wire default"},{"k":"text","text":": when the field is absent on the wire, serde fills\n"},{"k":"code","text":"TrustLevel::UNTRUSTED"},{"k":"text","text":" (50) via "},{"k":"code","text":"default_trust_untrusted()"},{"k":"text","text":" — a\nlegacy or unknown-origin frame is conservatively untrusted, keeping\nnew-consumer/old-producer AND old-consumer/new-producer strictly\nfail-safe."}],[{"k":"strong","text":"No language-level `Default`"},{"k":"text","text":": "},{"k":"code","text":"TrustLevel"},{"k":"text","text":" deliberately does NOT\nimplement "},{"k":"code","text":"Default"},{"k":"text","text":" (removed in Wave 3 · P1-2 rust-security). A\nblanket "},{"k":"code","text":"default()"},{"k":"text","text":" returning UNTRUSTED (50) sits ABOVE SANDBOXED\n(10) in the lattice — a silent inversion of safe-by-default for any\ncapability gate written as "},{"k":"code","text":"is_at_least(SANDBOXED)"},{"k":"text","text":". Trust must be a\ndeliberate construction at every call site; only the serde\nwire-compat path carries a default, and that one is scoped, named,\nand documented at the field."}],[{"k":"text","text":"The lattice itself (SANDBOXED 10 < UNTRUSTED 50 < TRUSTED 150 <\nELEVATED 200 < SYSTEM 255 · "},{"k":"code","text":"meet"},{"k":"text","text":"/"},{"k":"code","text":"join"},{"k":"text","text":"/"},{"k":"code","text":"is_at_least"},{"k":"text","text":") is ADR-033's\ndecision; this ADR consumes it."}]]},{"k":"h","depth":2,"text":"Alternatives considered","id":"alternatives-considered"},{"k":"list","ordered":false,"items":[[{"k":"strong","text":"`Option<TrustLevel>`"},{"k":"text","text":" — rejected: an absent trust level forces\nevery reader to invent a policy at the read site; the whole point is\nONE conservative policy at the boundary."}],[{"k":"strong","text":"Defaulting to TRUSTED for engine-internal frames"},{"k":"text","text":" — rejected: the\nwriter (real ingest) does not exist yet, so nothing can vouch for\nprovenance; safe-by-default (ADR-033 rev.2) wins until it does."}],[{"k":"strong","text":"Deferring the field to the Connectome era"},{"k":"text","text":" — rejected per ADR-028:\nadding a field later to a serialized, cross-layer struct is the\nexact breaking change the reservation policy exists to prevent."}]]},{"k":"h","depth":2,"text":"Empirical validation (what makes this \"merged code\")","id":"empirical-validation-what-makes-this-merged-code"},{"k":"list","ordered":false,"items":[[{"k":"code","text":"nika-types/src/memory.rs"},{"k":"text","text":" — the field, its serde default fn, and the\nconstructor defaulting to UNTRUSTED, all shipped and exercised by the\ncrate's serde round-trip tests."}],[{"k":"code","text":"nika-types/src/trust.rs"},{"k":"text","text":" — the lattice with the no-"},{"k":"code","text":"Default"},{"k":"text","text":"\ninvariant documented at the impl site."}],[{"k":"text","text":"The "},{"k":"code","text":"#[non_exhaustive]"},{"k":"text","text":" + "},{"k":"code","text":"new()"},{"k":"text","text":" discipline (FCI invariant #19)\nholds on both types, so the v0.95+ writer lands without a major."}]]},{"k":"h","depth":2,"text":"See also","id":"see-also"},{"k":"list","ordered":false,"items":[[{"k":"text","text":"ADR-028 — Forward-compat reservation policy (this ADR is an instance)."}],[{"k":"text","text":"ADR-033 — "},{"k":"code","text":"TrustLevel"},{"k":"text","text":" lattice + "},{"k":"code","text":"UNTRUSTED"},{"k":"text","text":" default inversion."}],[{"k":"text","text":"ADR-034 — "},{"k":"code","text":"MemoryStore"},{"k":"text","text":" trait (will be sealed at verb admission)."}],[{"k":"text","text":"FCI-035 addendum — Wave 4A/4B reservation catalog."}],[{"k":"text","text":"NIKA-380..389 — Shield capability / trust violation error codes."}]]},{"k":"p","inline":[{"k":"text","text":"🦋"}]}]

ADR-030

MemoryFrameRef.trust reservation (Shield gate seed)

accepted · 2026-04-17 · L0 L0.5 · cites 8

ADR-030: MemoryFrameRef.trust reservation (Shield gate seed) #

Status flipped proposed → accepted 2026-07-12 under the merged-code rule (the #474 ADR ruling): the decision is load-bearing in shipped code — MemoryFrameRef.trust exists, defaults safely, and rides the serde wire today. An ADR whose decision the workspace already executes does not stay "proposed"; the prose below documents what IS.

Context #

Wave 4A R2 (commit 41e8a1467, 2026-04-17) added trust: TrustLevel as a reserved field on MemoryFrameRef so that Shield (the NIKA-380..389 code family) can gate every recall by the trust level of the source memory frame without a breaking change when real recall arrives. Per ADR-028 (forward-compat reservation policy), the field ships years before its writer: reserving the slot is cheap; retrofitting it onto a #[non_exhaustive] struct consumed across layers is not.

The trust model this seeds is sticky taint: trust is assigned at ingest and never upgrades on recall — a frame that entered the store untrusted can never launder itself into a trusted context by being remembered.

Decision #

MemoryFrameRef carries pub trust: crate::trust::TrustLevel (nika-types/src/memory.rs — re-exported through nika-kernel).
Wire default: when the field is absent on the wire, serde fills TrustLevel::UNTRUSTED (50) via default_trust_untrusted() — a legacy or unknown-origin frame is conservatively untrusted, keeping new-consumer/old-producer AND old-consumer/new-producer strictly fail-safe.
No language-level `Default`: TrustLevel deliberately does NOT implement Default (removed in Wave 3 · P1-2 rust-security). A blanket default() returning UNTRUSTED (50) sits ABOVE SANDBOXED (10) in the lattice — a silent inversion of safe-by-default for any capability gate written as is_at_least(SANDBOXED). Trust must be a deliberate construction at every call site; only the serde wire-compat path carries a default, and that one is scoped, named, and documented at the field.
The lattice itself (SANDBOXED 10 < UNTRUSTED 50 < TRUSTED 150 < ELEVATED 200 < SYSTEM 255 · meet/join/is_at_least) is ADR-033's decision; this ADR consumes it.

Alternatives considered #

`Option<TrustLevel>` — rejected: an absent trust level forces every reader to invent a policy at the read site; the whole point is ONE conservative policy at the boundary.
Defaulting to TRUSTED for engine-internal frames — rejected: the writer (real ingest) does not exist yet, so nothing can vouch for provenance; safe-by-default (ADR-033 rev.2) wins until it does.
Deferring the field to the Connectome era — rejected per ADR-028: adding a field later to a serialized, cross-layer struct is the exact breaking change the reservation policy exists to prevent.

Empirical validation (what makes this "merged code") #

nika-types/src/memory.rs — the field, its serde default fn, and the constructor defaulting to UNTRUSTED, all shipped and exercised by the crate's serde round-trip tests.
nika-types/src/trust.rs — the lattice with the no-Default invariant documented at the impl site.
The #[non_exhaustive] + new() discipline (FCI invariant #19) holds on both types, so the v0.95+ writer lands without a major.