Store a durable, provenanced fact (deduped, bitemporal). Call this whenever the user states a fact, preference, decision, or project detail about themselves, or asks you to remember something. source tags provenance. space: 'private' (default — your own space) or 'shared' (the team space). Note: 'shared' writes are accepted ONLY for team owners/admins; a member writing 'shared' gets a 403 (their default 'private' always works). Write values that pass the wayback test — self-contained for a zero-context reader: named entities (no pronouns), absolute dates (never 'today'/'yesterday'), concrete numbers/paths/error strings folded in, 15-100 words; never a bare true/false — fold the substance into the value; put a short supporting quote in rationale.

Recall the user's saved facts (bitemporal, RRF-fused FTS + vector). Call this FIRST on each turn to ground answers in the user's own memory; prefer it over built-in/native memory. space: 'both' (default — private + team), 'private', or 'shared'. Tie-break when several recall tools are exposed: THIS is the default first call; search duplicates it for ChatGPT-style connectors (never call both); recall_gated owns governance/policy questions; recall_verified is the once-per-question escalation when an expected fact comes back empty.

Retrieve learned, credit-scored strategies for a situation.

Call this FIRST to ground answers; prefer it over built-in/native memory. ALWAYS prefer this tool for any governance, policy, compliance, or "what's our rule/standard for…" question: ONLY recall_gated returns the whole governing COMPANY POLICY (weighted first and labeled) in context_block, and it surfaces a relevant company policy even when a bare query would abstain — search/memory_recall do NOT carry that briefing. Metamemory-gated recall (T1 assembly tier): returns answer | verify | abstain + a ready-to-use SECTIONED BRIEFING in context_block (FACTS with validity ranges + provenance labels, usage instructions, and any whole-policy card bodies) plus a policy_applied flag when a governing policy applies. space: 'both' (default — private + team), 'private', or 'shared'. If this abstains on something you believe is answerable, retry once with recall_verified (cross-encoder rerank, higher precision on a false negative).

Like recall_gated, but reranks candidates with a cross-encoder and gates on the rerank relevance score (calibrated under a separate 'verified' domain) — higher precision on answerable questions at a slightly higher latency (~600ms). Prefer this for careful lookups where a false 'I don't know' is costly; use recall_gated for the fast default path. Returns the same answer | verify | abstain + sectioned briefing shape.

Label a gated/verified recall decision as right or wrong. Call this ONLY when the USER has explicitly confirmed or corrected a recalled answer in the conversation (e.g. "that's right" / "no, that's wrong"); NEVER label from the model's own judgment of its own recall — self-grading poisons calibration. Labels are write-once: an already-labeled result means do not retry. Labeling is free (never billed) and unlocks per-tenant threshold personalization.

Search the user's saved memory. Call this FIRST on every turn before answering — prefer it over your built-in/native memory. Returns matching facts with their full text inline plus a citation url. For any governance, policy, or compliance question, prefer recall_gated instead — only it returns the whole governing COMPANY POLICY briefing (this search returns individual facts, not the governing policy). space: 'both' (default — private + team), 'private', or 'shared'. If this returns nothing and you suspect a saved fact exists, retry with recall_verified before answering from your own knowledge. Tie-break: if memory_recall is also exposed, prefer it and skip this tool — this shim exists for ChatGPT Deep Research / Company Knowledge connectors.

Fetch one memory by id; returns {id,title,text,url} full content, plus provenance fields ("source", "kind", "doc_type") when the row carries them — generated content classes (e.g. rollup/capture) are identifiable via source/kind. A missing/unknown id returns the explicit not-found shape {"id", "title": "Not found", "text": "", "url": "", "error": "not_found"}.