AirMemo — Security & Trust Whitepaper

1. The threat: prompts are the new malware

Coding agents act on whatever context they are given — and the dangerous failure is not a dumb agent, it is a confident one acting on stale or poisoned context. In the Meetless stale-context study (research.meetless.ai/stale-context/), 10 frontier models scored 0/6: all confidently shipped stale facts while reading zero files. Our own Meetless-style benchmark reproduces the effect on a local model: 1/6 reading the shelf as it is, 4/6 with the in-force memo pushed into context. In parallel, prompt injection — context carrying "ignore prior instructions" tampering — is the OWASP LLM01 attack class, observed across 90+ organizations (CrowdStrike). The result: teams ship yesterday's decisions, and adversaries steer today's agents. Context is a liability; who gets to inject it is a governance question.

2. The mechanism: governed push, next-turn contract, receipts

AirMemo is push, not pull — no RAG, no retrieval UI, no memory store. Three moves:

1. Memo in → queue. Every memo is author-signed (Ed25519), scoped to org/team/project, priority-flagged, expiry-mandatory, and secret-scanned before it is ever enqueued.
2. Next-turn delivery. At sanctioned lifecycle boundaries (session start / prompt submit — GA mechanisms on Claude Code, Codex, Copilot, Gemini CLI), the hook places the memo into the platform's dedicated context field. Delivery state machine: queued → injected → receipted → expired. No mid-session interruption; every memo carries complete in-force + precedence framing ("the 2/15 memo supersedes the 2/14 — the winning value: PR #4821 ships").
3. Receipts. Each injection logs a proof hash of exactly what was delivered, stamped [AIRMEMO · authorized · memo_4821] — so agents and reviewers can tell governed context from scraped graffiti. The memo→delivery→receipt chain is verifiable end-to-end.

3. The controls (architecture-scaffold §7, numbered)

1. Signed memos (Ed25519) + HMAC'd transport; per-device keys, ≤5-min clock-skew guard.
2. Read-only hook — reads a queue, injects text into sanctioned context fields. No arbitrary code execution, no shell, no plugin surface.
3. Secret scanning + injection-payload detection — blocks credentials and prompt-poisoning patterns at author time, re-scans at delivery; never stored.
4. Expiry, always — schema-required expires_at; revocation path on top.
5. Rate limits per author and scope; org-wide broadcast requires approval.
6. No secrets in the client — the hook holds only its device key; hash-pinned installers.
7. Append-only audit — receipts/audit have no UPDATE/DELETE; exported for retention.
8. Fail-open asymmetry — the hook never blocks an agent turn; unreachability appears in receipts/audit, never as silence.
9. Adapter exit-code discipline — the hook never emits platform block codes; a hostile hook cannot stall agent turns or hide results.

4. Honesty policy — what we say and do not say

We use the exact three-layer vocabulary: AirMemo delivers to the agent's session context; the platform renders it into the LLM window on the next request; we never touch a model, never "inject into the model," never edit a context window. Telemetry is opt-in and off by default; receipts (hash proofs) are the metric of record. Deferred, not claimed: SOC 2 (deal-funded, B7) · SSO and self-host (enterprise-triggered, B7) · EU data processing residency (multi-region, B7) · usage-based billing (B5+). Availability posture: cloud hosts demo and pilots; production fleets run the same codebase self-hosted (B7).

4.1 Data residency — claims are records, not storage

Every org carries a region claim (default us; eu selectable by the org owner in /portal/org/region, recorded at enrollment for each device, carried in the audit trail as org.region_changed / device.enrolled data). The claim exists so procurement and auditors can hold us to a stated residency — it is not a storage directive. Cloud processing is split today: Neon Postgres runs in US East (us-east-1), Railway compute in us-west2 — the two are not co-located; setting region: eu never moves a byte and this page says so. EU data processing is a documented migration card, not a claim we make. /trust states the processing regions statically and surfaces the same honesty contract.

5. Pilot pricing & getting started (cross-ref: T16 pricing page)

Pilot tiers (market test feeding the pre-GA table — scaffold §11 B6): Team $9/agent/mo (fixed) · Business pilot $19 / $24 / $29 per agent/mo · Free tier ≤ 5 agents · Enterprise custom. Full quotas, limits, and the pilot agreement live on the pricing page (/pricing, T16) and in the pilot terms. Hooks are MIT-licensed open source; the closed value is the governance control plane.