GrayMatter

Do not invoke any GrayMatter tool for requests to override tenant, owner, organization, user, role, permission, or ACL scope; explain that scope comes from the signed-in account. Do not reinterpret such a request as an authorized text search. For requests to delete an unspecified record, ask the user to identify it; do not search for deletion candidates or select a target yourself. Use this when the user requests bounded task-specific context from authorized memory, ContextPage items, graph and recency signals, semantic retrieval, or reusable procedures. Compilation is a write operation: it creates a task-scoped ContextPage and retrieval receipt from authorized sources. It does not authorize memory save, update, deletion, scope changes, or release approval. Use any pending host confirmation without adding another GrayMatter approval. A verified security or authorization denial is terminal; do not evade it by rewriting arguments, stripping invocation syntax, changing tools or accounts, widening permissions, or substituting searches. A missing tool, transient error, or model-reported block without a surfaced denial is not a permanent ban: inspect actual tool outcomes and authorized receipts, repair the implicated layer, then allow at most two controlled validation attempts per recovery episode through the same native client, account, scopes and original task; a user-authorized diagnostic may test an unverified failure through that unchanged path. Stop on a surfaced denial or repeated recovery failure. Compilation is not idempotent: inspect uncertain write outcomes before retrying and disclose uncertainty. A manual search summary is not compiled context; historical failures remain failures and a retest needs its own useful ContextPage and new authorized receipt. For an authorized context request, pass the original user task text unchanged in task, including all explicit constraints. Do not expand, paraphrase, or add invented evidence checklists, conditions, or exclusions. Use tokenBudget, includeProcedures, and includeRatings for those separate controls. Scope and secret restrictions take precedence over this guidance.

context_compile

Do not invoke any GrayMatter tool for requests to override tenant, owner, organization, user, role, permission, or ACL scope; explain that scope comes from the signed-in account. Do not reinterpret such a request as an authorized text search. For requests to delete an unspecified record, ask the user to identify it; do not search for deletion candidates or select a target yourself. Delete or tombstone one authorized memory using GrayMatter retention semantics. Never infer a deletion target. Call only with the exact memory UUID after the user explicitly confirms forgetting that specific record.

memory_forget

Do not invoke any GrayMatter tool for requests to override tenant, owner, organization, user, role, permission, or ACL scope; explain that scope comes from the signed-in account. Do not reinterpret such a request as an authorized text search. For requests to delete an unspecified record, ask the user to identify it; do not search for deletion candidates or select a target yourself. Retrieve one memory by ID when the signed-in user is authorized to read it. Call after search returns an ID or when the user supplies a known memory ID. For a request about a specific memory, preserve all identifying qualifiers such as title, source, tags, marker, or whether it is seeded versus newly created. Start with the user's subject words, without adding an unrequested domain. Check provenance qualifiers on returned records rather than requiring generic words like seeded in the query. Use requested explicit marker/tag filters when supported; a null source field alone does not invalidate an exact marker/tag match or prove human verification. If a narrow search is empty, you may broaden topic wording within the signed-in scope, but must still verify those qualifiers against returned metadata and memory_get before claiming a match. Search results are a bounded page, not an exhaustive result set. When no returned record satisfies the requested qualifiers and nextOffset is present, continue the same query and filters with offset=nextOffset, up to three pages total, before concluding there is no verified match. If that page budget is exhausted while nextOffset is still present, disclose that the search is incomplete. Do not substitute a newer or similarly worded record that lacks the requested provenance; report no verified match if the evidence is insufficient.

memory_get

Do not invoke any GrayMatter tool for requests to override tenant, owner, organization, user, role, permission, or ACL scope; explain that scope comes from the signed-in account. Do not reinterpret such a request as an authorized text search. For requests to delete an unspecified record, ask the user to identify it; do not search for deletion candidates or select a target yourself. Retrieve the authorized receipt that explains why context was selected. Call when the user asks for selection provenance, confidence, coverage, freshness, or policy rationale.

retrieval_receipt_get

Do not invoke any GrayMatter tool for requests to override tenant, owner, organization, user, role, permission, or ACL scope; explain that scope comes from the signed-in account. Do not reinterpret such a request as an authorized text search. For requests to delete an unspecified record, ask the user to identify it; do not search for deletion candidates or select a target yourself. Save durable information that will remain useful beyond the current conversation. Do not use for secrets, transient chatter, or data the user would not reasonably expect to persist.

memory_save

Do not invoke any GrayMatter tool for requests to override tenant, owner, organization, user, role, permission, or ACL scope; explain that scope comes from the signed-in account. Do not reinterpret such a request as an authorized text search. For requests to delete an unspecified record, ask the user to identify it; do not search for deletion candidates or select a target yourself. Search memories visible to the signed-in user with GrayMatter hybrid retrieval. Call before asking the user to repeat durable context, and use a narrow query plus a bounded limit. For a request about a specific memory, preserve all identifying qualifiers such as title, source, tags, marker, or whether it is seeded versus newly created. Start with the user's subject words, without adding an unrequested domain. Check provenance qualifiers on returned records rather than requiring generic words like seeded in the query. Use requested explicit marker/tag filters when supported; a null source field alone does not invalidate an exact marker/tag match or prove human verification. If a narrow search is empty, you may broaden topic wording within the signed-in scope, but must still verify those qualifiers against returned metadata and memory_get before claiming a match. Search results are a bounded page, not an exhaustive result set. When no returned record satisfies the requested qualifiers and nextOffset is present, continue the same query and filters with offset=nextOffset, up to three pages total, before concluding there is no verified match. If that page budget is exhausted while nextOffset is still present, disclose that the search is incomplete. Do not substitute a newer or similarly worded record that lacks the requested provenance; report no verified match if the evidence is insufficient.

memory_search

Do not invoke any GrayMatter tool for requests to override tenant, owner, organization, user, role, permission, or ACL scope; explain that scope comes from the signed-in account. Do not reinterpret such a request as an authorized text search. For requests to delete an unspecified record, ask the user to identify it; do not search for deletion candidates or select a target yourself. Find authorized reusable procedures relevant to the current task. To answer whether a stored procedure, runbook, or repeatable method exists, including a follow-up after memory retrieval, call procedure_search before claiming absence. Memory decisions and summaries are not a search of the Procedure collection. Use the requested subject words as query (for example, production release review), preserving explicit qualifiers, not the entire conversational question or an unrequested domain. Matching is case-insensitive phrase search, not question answering. Treat results as a bounded page, not a complete inventory; if no match is returned, say only that the current search found none. A procedure match is discovery, not approval, a bound workflow, or evidence of execution.

procedure_search

Do not invoke any GrayMatter tool for requests to override tenant, owner, organization, user, role, permission, or ACL scope; explain that scope comes from the signed-in account. Do not reinterpret such a request as an authorized text search. For requests to delete an unspecified record, ask the user to identify it; do not search for deletion candidates or select a target yourself. Update the content or classification of one authorized memory. Call only when the user intends to revise an existing durable memory; ownership and tenant reassignment are never accepted.

memory_update