GMP specifies what an agent-memory backend must do: the abstract operational semantics of a memory store, and the conformance contract a store must satisfy to claim a capability. Transport-agnostic. Normative language per RFC 2119.
The paper's decisive result (F10, F12) is that a capability claim does not certify behavior: a store can advertise the correct flag, satisfy the type contract, accept every call, report success — and still leak completely. A type signature cannot express the guarantees below; only an external, oracle-grounded conformance suite can. GMP therefore specifies behavior, and makes the conformance suite part of the protocol.
The model. The atom is a fact — a quadruple (predicate, subject, object, valid_from) carrying a monotonic sequence, an importance weight, optional valid_until / superseded_by (versioning), and a tenant_id. A fact's identity is content-derived and tenant-scoped: BLAKE2b-128(tenant_id ‖ predicate ‖ subject ‖ object ‖ valid_from).
The operations. A store exposes capabilities() (read once), write, retrieve, delete, and audit. Calling for an undeclared capability — as_of without BI_TEMPORAL, or tenant_id without MULTI_TENANT — MUST raise CapabilityNotSupported. retrieve MUST be deterministic for fixed state.
Each capability is a behavioral contract a store opts into by declaring it — then MUST satisfy. Every normative section cites the requirement (R1–R5) and the findings it rests on.
Retrieval is embedding-agnostic. The §5–§6 guarantees MUST hold under any embedder; the budget contract is expressed in tokens, and retrieve MUST rank rather than truncate. The Python MemoryBackend Protocol is the reference binding; a wire encoding (gRPC/HTTP/JSON) is a separate, deliberately deferred document.