Summary

Adds a new roadmap iteration (3e) and updates design documents to address memory poisoning — classified as OWASP ASI06 (Memory & Context Poisoning) in the 2026 Top 10 for Agentic Applications. Based on a deep research report covering 33 sources (academic papers, CVE disclosures, OWASP standards, and industry analyses).

Changes across 3 files (docs only, no code changes):

• ROADMAP.md — New Iteration 3e with 4 implementation phases (input hardening → trust-aware retrieval → detection & response → advanced protections), addressing 9 identified memory-layer security gaps
• MEMORY.md — New "Memory Security Analysis" section: full threat taxonomy (intentional + emergent corruption), 9-gap table with severity ratings, 6-layer defense architecture diagram, existing mitigations catalog, academic references
• SECURITY.md — OWASP ASI06 classification, expanded attack vectors (MINJA, GitHub issue injection, experience grafting, RAG poisoning, emergent self-corruption), 6-layer defense requirements, updated Known Limitations

Key findings from research

1. MINJA achieves 95%+ injection success against undefended agent memory (query-only, no direct access needed)
2. Emergent self-corruption (hallucination crystallization, feedback loops) is equally dangerous — no attacker signature
3. Defense requires 6 layers working together; no single control is sufficient
4. The platform has strong network security but 9 memory-layer gaps — most critically, loadMemoryContext() injects retrieved memory without any validation

9 identified gaps

4-phase implementation roadmap

• Phase 1 — Input hardening: content sanitization, GitHub issue filtering, provenance metadata, SHA-256 integrity hashing
• Phase 2 — Trust-aware retrieval: trust scoring, temporal decay TTLs, memory validation Lambda
• Phase 3 — Detection & response: CloudWatch anomaly detection, circuit breaker, quarantine API, snapshot rollback
• Phase 4 — Advanced protections: guardian model, cross-task drift detection, Merkle tree provenance, MINJA/AgentPoison red teaming

Test plan

• Verify ROADMAP.md renders correctly with new Iteration 3e section and updated summary
• Verify MEMORY.md threat taxonomy tables, gap analysis table, and defense architecture diagram render correctly
• Verify SECURITY.md expanded attack vectors and updated Known Limitations are consistent with MEMORY.md
• Verify cross-references between ROADMAP.md ↔ MEMORY.md ↔ SECURITY.md resolve correctly
• Confirm no breaking changes to existing content (docs-only PR)