Test memory provenance

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R41 — Memory & state integrity

   R24 — Checkpoint replay prevention

   R13 — Qdrant payload updates & deletion

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Build index-hygiene-worker (D10): enforce write authorization on vector indexes, classify source trust, run scheduled trigger-oriented retrieval probes, flag anomalous/stale chunks for quarantine, and verify checkpoint/memory provenance across P1 and P3.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Seed a sleeper/triggered poisoned chunk into the vector store; run D10 hygiene checks to quarantine the chunk, purge derived caches, and re-verify tenant isolation.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   D10 quarantine, cache-invalidation, and re-indexing test suite.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R13Qdrant Documentation↗ qdrant.tech

  Collections, payload metadata indexing, pre-filtering, multitenancy partitioning, and snapshots.

• R24LangGraph Documentation↗ docs.langchain.com

  State graphs, durable checkpointing, human-in-the-loop interrupts, retries, and resumability.

• R41OWASP Agentic AI Resources↗ genai.owasp.org

  Agentic threat taxonomy: tool misuse, excessive agency, memory poisoning, inter-agent trust, and human oversight.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsQdrant · reference
  Multitenancy - Qdrant

  Shows payload-based partitioning with a tenant field and mandatory filters, the mechanism that enforces write/read authorization boundaries so poisoned chunks cannot cross tenants in the index.

  R13checked 2026-11-11
• videoCode With Prince · 57 min
  Mastering Multi-Tenancy with Qdrant | Vector Databases and AI | Docker

  Demonstrates creating collections, payload indexes and tenant filters end to end, so you can wire the same partitioning and pre-filtering into the index-hygiene worker's retrieval probes.

  R13checked 2026-11-11
• videoLangChain · 8 min
  LangGraph interrupt: Making it easier to build human-in-the-loop agents

  Explains how checkpointers persist exact graph state between steps and how interrupt/resume works, the primitive you use to trace where a memory write came from and to pause a poisoned run.

  R24checked 2026-11-11
• articleMicrosoft Community Hub · ~10 min read
  AI Under Attack: A Defender's Guide to Memory Poisoning, Jailbreaks, and Evasion Techniques | Microsoft Community Hub

  Breaks down how attackers persist malicious instructions in long-term memory and how provenance and quarantine help, directly shaping the trust classification and anomaly flags in D10.

  R41checked 2026-11-11
• repoGitHub · runnable demo
  GitHub - m-pentest/memory-poisoning-demo: Demo of Agent Memory Poisoning

  Provides a runnable poisoning harness that injects a trigger into agent memory, giving you a safe way to validate that scheduled trigger-oriented retrieval probes actually surface the planted chunk.

  R41checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.