Agents with memory: project write to an append-only JSONL file, one per agent, scoped to the project. An AST-level test enforces that no delete, update, clear, or truncate operations appear in the memory code path. Memory entries can accumulate; they cannot be removed programmatically.
On read, entries are recency-weighted. A baseline_anchor field lets the agent mark a recurring decision so it is loaded on every session without counting against the recency budget.
Pattern-reinforcement defense: if memory keeps returning the same answer, the kit alerts the human. A memory that always says the same thing is either a baseline anchor working correctly — or a poisoning signal. The alert surfaces the distinction.