Unified Context Memory (UCM)
The machine data-gate for autonomous agents. Enforces a strict concentric ring clearance model across all firm assets, provides standing in-scope folder access, and requires hardware-backed biometric sign-off for scope-crossing exceptions.
Concentric Ring Clearance Architecture
UCM partitions firm memory into strict clearance boundaries. Lower numbers represent higher security sensitivity. No cloud-connected machine identity possesses standing authority to access root tiers.
Root Secrets & Personal Tier
Master seeds, private recovery vectors, sovereign personal memory
Enterprise Vault Tier
Firm operational knowledge, codebase specs, threat models, and architectural data
Public Tier
Public schemas, open documentation, public research feeds, and outgoing deliverables
Ed25519 Request Signing & Replay Defense
Every agent request arriving at the UCM data-gate is cryptographically authenticated. Zero passwords, zero long-lived API tokens, and zero plain HTTP headers.
Deterministic Payload Binding
The client signs the exact HTTP method, path with query parameters, timestamp, and nonce. Any modification in transit by an adversary alters the hash commitment and triggers immediate rejection.
Hardware-Backed Biometric Approval Flow
In-scope reads are instantaneous and friction-free. When an agent requires access to out-of-scope enterprise files, UCM routes an approval request directly to enrolled operator mobile hardware.
Exception Detected
Agent attempts to access an out-of-scope node. UCM traps the call and enters pending state.
Hardware Dispatch
Operator receives push alert showing exact target node_id, requesting machine_id, and stated purpose.
Biometric Attestation
Biometric prompt unlocks hardware StrongBox keypair (P-256) and signs the immutable decision proof.
Ephemeral Window
UCM mints a temporary 10-minute read lease bound strictly to the requesting machine identity.
Secret-Free Daemon Architecture
UCM is completely secret-free. It stores zero database master keys or provider tokens on disk. The service operates under active recurring capability leases issued by the post-quantum capability satellite. Revoking a machine vault in lvls immediately severs UCM access cluster-wide.
Template-Driven Integrity Sweeps
To eliminate blast radius, UCM rejects unbounded synthesizer agents. Agents write directly into strictly typed templates. A non-interpretive, deterministic lint engine verifies broken links, schema compliance, and naming consistency without giving LLMs write privileges.
Explore the Sovereign Cluster
Learn how UCM integrates seamlessly alongside Clutch, lvls, 4Context, and PRISM.