A Memory Firewall sits between recall and the agent prompt. It prevents relevant-but-unsafe memory from acting as instruction.
Relevance is not permission
A failed branch, stale target, or contested fact can be highly relevant. If it enters the prompt as plain context, the agent may treat it as a current instruction.
The Memory Firewall separates candidate retrieval from admission. Retrieval proposes. Aionis adjudicates.
Four action surfaces
use_now carries accepted state. inspect_before_use keeps uncertain evidence visible but gated. do_not_use blocks memory from direct influence while preserving it as evidence. rehydrate points to raw detail only when the compact context is not enough.
That routing is what lets Aionis work in front of existing memory stacks instead of replacing every store.