WallGuard runtime memory gate and denied durable writeback

[mdheller]

Parent: SocioProphet/sociosphere#443
Depends on: #33
Depends on: SocioProphet/agent-registry#47
Depends on: SocioProphet/policy-fabric#93

Purpose

Implement the Memory Mesh runtime gate for WallGuard memory reads, writes, semantic recall, embedding writes, memory promotion, and clean-room release handoff.

Memory Mesh must not become policy authority. It must consume Agent Registry wall context and Policy Fabric WallGuard decisions, then enforce the resulting admission/denial before exposing or mutating memory compartments.

Runtime objective

Gate these runtime operations:

• read_memory
• write_memory
• semantic_recall
• embedding_write
• memory_promotion
• clean_room_release

Required behavior

• Same-wall memory read can proceed only after canonical allow decision.
• Restricted wall-scoped content cannot write or promote directly to global / firm-approved memory.
• Missing wall context fails closed.
• Contaminated or unknown session state cannot read from or write to global / firm-approved memory compartments.
• Denied durable writeback is explicit and receipt-bearing.
• Runtime gate stores refs, labels, and reasons, not restricted payload content.

Suggested files

• scripts/wallguard_memory_gate.py
• examples/wallguard-runtime/*.json
• scripts/validate_wallguard_memory_gate.py
• Makefile target validate-wallguard-memory-gate

Acceptance criteria

• Same-wall memory read fixture passes with receipt/evidence refs.
• Restricted-to-global write fixture is denied before durable writeback.
• Missing wall context fixture fails closed.
• Contaminated/unknown session fixture denies global / firm-approved memory access.
• Memory promotion and embedding write are covered by runtime fixtures.
• Runtime output can be consumed by Core Ledger without leaking restricted payload content.
• No dependency on cascade, presidio, OrchestraOS, or noncanonical/unlicensed code.

Non-goals

• Do not implement Policy Fabric evaluator here.
• Do not implement AgentPlane collaboration gates here.
• Do not implement product UI here.