← Agent memory

Consensus Searches

Sixty queries run through the Consensus connector (search mode, no filters) on 14 September 2026, across four research passes. Each log lists the query and the papers it surfaced; every paper that became a record was then resolved to its primary page and re-checked. Filter Found via → Consensus in the source explorer to see the resulting records.

Direct queries (main session)

Run through the Consensus MCP connector (search mode, 20 results each, no filters). Titles link to the Consensus record; agent-A/B/D query logs in this folder cover the rest of the search.

DQ1 — "memory bank markdown files persistent project context for AI coding assistants across sessions"

  1. Codified Context: Infrastructure for AI Agents in a Complex Codebase (Vasilopoulos, 2026, arXiv:2602.20478) — hot-memory "constitution" + 19 domain agents + 34 cold-memory spec docs; 283 sessions on a 108k-line C# system.
  2. PROJECTMEM: local-first, event-sourced memory and judgment layer (Malo et al., 2026, arXiv:2606.12329) — append-only typed event log → MCP summaries; pre-action gate; "Memory-as-Governance"; 5,000–20,000 tokens/session reconstruction estimate.
  3. Demo: A Local Agentic Memory Layer for LLM-Assisted Coding (cntx) (Radu et al., 2026, MobiSys companion) — gravitational-decay scoring, local SLM.
  4. GitOfThoughts (Shekar et al., 2026, arXiv:2606.14470) — pre-registered five-store comparison (none/markdown/vector/graph/git): memory helps only when cosine >~0.8 to a stored problem.
  5. Building Effective AI Coding Agents for the Terminal (OPENDEV) (Bui, 2026, arXiv:2603.05344) — automated cross-session memory + event-driven reminders vs instruction fade-out.
  6. Context Engineering for AI Agents in Open-Source Software (Mohsenimofidi et al., MSR 2026) — 466 OSS projects' AGENTS.md; no established structure.
  7. Your Code Agent Can Grow Alongside You with Structured Memory (MemCoder) (Deng et al., 2026, arXiv:2603.13258) — +9.4% resolved on SWE-bench Verified over DeepSeek-V3.2.
  8. Agent READMEs (Chatlatanagulchai et al., 2025, arXiv:2511.12884) — 2,303 context files / 1,925 repos; tests 75.9%, security 14.8%.
  9. Programming by Chat: 11,579 IDE sessions (Tang et al., 2026) — developers "externalizing plans into persistent artifacts".
  10. Context Rot in AI-Assisted Software Development (Treude et al., 2026, arXiv:2606.09090) — 23.0% of 356 repos.
  11. Schema-Grounded Memory (xmemory) (Petrov et al., 2026, arXiv:2604.27906) — write-path schemas; 97.10% F1 vs 80–87% baselines.
  12. Git Context Controller (already in harness store).
  13. Shared Selective Persistent Memory for Agentic LLM Systems (Pedada et al., 2026, arXiv:2607.09493) — 96% completion vs 79% no memory vs 71% full history; full-history persistence degrades.
  14. Delivery, Not Storage: Cue-Anchored Working Memory as a Harness Property (Saha, 2026, arXiv:2607.20972) — 0 voluntary memory ops in 114 turns; facts vanish at first compaction in 106/108.
  15. CodeMEM (Wang et al., 2026, arXiv:2601.02868) — AST-guided session memory; +12.2% instruction following.
  16. A Dataset of Agentic AI Coding Tool Configurations (Galster et al., AIware 2026) — 4,738 repos, 15,591 artifacts, 148,519 AI-co-authored commits.
  17. User as Code (Li, 2026, arXiv:2606.16707) — executable user memory; 78.8% LoCoMo.
  18. Prometheus (Pan et al., 2025, arXiv:2507.19942) — repo KG + working memory; 74.4% SWE-bench Verified.
  19. Contextual Memory Virtualisation (Santoni, 2026, arXiv:2602.22402) — DAG state, lossless trimming −20% mean tokens; 76 real Claude Code sessions.
  20. ReasoningBank (Ouyang et al., 2025) — already recorded.

DQ2 — "human oversight of autonomously written agent memory approval review developer trust"

  1. Human oversight of agentic systems in practice (Dhanorkar et al., FAccT 2026) — 17 developer interviews; four oversight forms: a priori control, co-planning, real-time monitoring, post hoc review.
  2. Coding with "Enemy": Can Human Developers Detect AI Agent Sabotage? (Ye et al., 2026, arXiv:2606.05647) — 94% of >100 developers fail to detect sabotage; 56% accept malicious code despite monitor warnings.
  3. Hedwig: Dynamic Autonomy for Coding Agents Under Local Oversight (Shukla et al., 2026) — 21-engineer survey; learns behavioural guidelines from developer decisions across sessions (memory as the autonomy model).
  4. When Not to Write Memory (GovMem) (Qi et al., MLISE 2026) — false promotion 0.597→0.040; 133 real candidates: none safe for auto-promotion.
  5. What You Approve Is What Executes: Consent Integrity (Weng, 2026, arXiv:2606.02668) — approval dialogs narrated by the agent are forgeable (LITL); 87.0% of tldr commands "uninspectable".
  6. Designing meaningful human oversight in AI (Zhu et al., AI and Ethics 2026) — operative vs evaluative agency; solve–verify asymmetry.
  7. On the Need to Rethink Trust in AI Assistants for SE (Baltes et al., TSE 2025) — trust ≠ acceptance.
  8. Oversight Has a Capacity (Turan, 2026, arXiv:2606.08919) — Fleiss' κ=0.52 on "risky"; inverted-U safety in escalation rate. (Others returned: generic HITL/trust reviews — Adedokun 2026, Ugo-Enyinnah 2026, Afroogh 2024, Israelsen 2017, Cheng 2026, Gebru 2022, Wildman 2024, Kumar 2026 Dynamic Intervention Framework, Baltes; Pak 2018; Adabara 2025; Li 2024; McNeese 2021 — general trust literature, not memory-specific.)

DQ3 — "software documentation as knowledge for LLM coding agents architecture decision records wiki generation"

Agent A — memory mechanisms and taxonomies

Tool: mcp__Consensus__search, query-only, no filters. 15 queries, run 2026-09-14, in batches of 3. Each query returned 19–20 papers; only the hits that became records (or that mattered as duplicates/negatives) are listed.

Q1. survey of memory mechanisms in LLM-based agents taxonomy Top hits: Zhang et al. A Survey on the Memory Mechanism of LLM-based Agents (TOIS, 759 cit.) · Wu et al. Memory in LLM-Based Multi-agent Systems · Du Memory for Autonomous LLM Agents (2603.07670) · Graph-based Agent Memory (2602.05665) · Du et al. Rethinking Memory in LLM based Agents (2505.00675) · The AI Hippocampus (2601.09113) · Memory in the Age of AI Agents (2512.13564) · Anatomy of Agentic Memory (2602.19320) · Wu et al. From Human Memory to AI Memory (2504.15965) · From Storage to Experience · Governing Evolving Memory / SSGM (2603.11768) · Agent Memory: Characterization and System Implications (2606.06448) · A-MEM (2502.12110) · Survey of Agent Memory in the Second Half (2602.06052) · Evaluating Memory Structure / StructMemEval · MemoryAgentBench (2507.05257) · On the Structural Memory of LLM Agents (2412.15266) · How Memory Management Impacts LLM Agents (2505.16067). → Highest-yield query of the pass; anchored the entire taxonomy cluster.

Q2. episodic semantic procedural memory architecture for language agents REMem · ARTEM · SYNAPSE · ENGRAM · AriGraph · Memp (2508.06433) · Position: Episodic Memory is the Missing Piece · MemMachine (2604.04853) · HeLa-Mem · MEMTIER · AdMem · SMITH.

Q3. persistent memory for software engineering coding agents across issues Exp-SWE-Agent (FSE-AIWare MemComp) · PROJECTMEM (2606.12329) · LS-CM dual memory (IEEE Access) · Prometheus (2507.19942) · SWE-Bench-CL (2507.00014) · SWE-MeM (already in harness store) · MemCoder (2603.13258) · SWE-Exp (2507.23361) · Feedback-Normalized Developer Memory · Structurally Aligned Subtask-Level Memory (2602.21611) · Codified Context (2602.20478) · MemOp (2606.05646) · MemGovern (2601.06789) · Spark (2511.08301) · Towards Structured, State-Aware… SE Agents · repository-memory-localization (already in harness store) · ToM-SWE (already in harness store) · cntx demo · Memory Transfer Learning (2604.14004). → The core repo-memory cluster came almost entirely from this one query.

Q4. procedural memory skill library self-evolving agents workflow induction MemSkill (2602.02474) · CODESKILL (2605.25430) · AFTER / Managing Procedural Memory (2606.23127) · ReMe (2512.10696) · SkillRL · Memp · Skill-Pro · SkeMex · SAGE · FlowEvo · MUSE-Autoskill · COMFYCLAW · SkillEvolBench (2605.24117) · SkillRevise · SESA · Trace2Skill (2603.25158) · MemRL · RSEA · Agent Skills survey (2605.07358) · MSCE (2607.16621).

Q5. MemGPT virtual context management operating system for LLM memory MemGPT (2310.08560) · MemMachine · Zep (2501.13956) · Beyond the Context Window (2603.04814) · Memory as Metabolism · CALMem · eMEM · LightMem (2510.18866) · MemoryOS (2506.06326) · MemOS (2505.22101 / 2507.03724) · Contextual Memory Virtualisation (CMV, claude-code-cmv) · EverMemOS · Mem0 · AgeMem (2601.01885) · ClawVM.

Q6. Mem0 scalable long-term memory production AI agents Mem0 (2504.19413) · TeleMem · MemMachine · Mem-T · Beyond the Context Window · Cost and Accuracy of LTM in Distributed MAS (COMPSAC) · MemX · CraniMem · MemGate (2606.06054) · Memanto · MemVerse · AdMem · MIRIX (2507.07957) · D-MEM · Is Agent Memory a Database? (2605.26252) · HiMem · MemReader (2604.07877).

Q7. ReasoningBank agent memory distilling reasoning strategies from success and failure ReasoningBank (2509.25140) · Trajectory-Informed Memory Generation · ReMe · SkillRL · MemCollab · Reflexion (already in harness store) · GitOfThoughts (2606.14470) · OPD-Evolver · MemoryArena (2602.16313) · Mistake Notebook Learning · PRIME · Compiled Memory / Atlas · ActMem · MemMA · MemRL.

Q8. Voyager open-ended embodied agent skill library lifelong learning Minecraft Voyager (2305.16291) · MindForge · Odyssey · LRLL · JARVIS-1 · ADAM · PEAM · MineEvolve · Evolving Programmatic Skill Networks · SkillFlow benchmark (2604.17308) · AutoSkill.

Q9. agent workflow memory induction reusable workflows web agents Agent Workflow Memory (2409.07429) · Hierarchical Memory Tree · LEGOMem (AAMAS 2026) · SKILL.nb · ReUseIt · CodeMem · LongMemEval-V2 (2605.12493) · WISE-Flow · SKILL-DISCO · Governed Memory (2603.17787) · Agent Skills survey.

Q10. generative agents interactive simulacra memory stream reflection retrieval Generative Agents (UIST 2023, 5434 cit.) · MemGen · Hindsight · Lyfe Agents · Concordia · Agent4Rec · LGA privacy analysis.

Q11. cognitive architectures for language agents CoALA modular memory decision procedure CoALA (2309.02427) · CoELA · Memory in the LLM Era: Modular Architectures (2604.01707) · Structured Cognitive Loop (harness store) · The Missing Knowledge Layer in Cognitive Architectures · Externalization in LLM Agents (2604.08224) · ACT-R-inspired memory · MCMA · MACLA · Beyond Heuristics: Decision-Theoretic Agent Memory (2512.21567).

Q12. HippoRAG hippocampal indexing long-term memory retrieval knowledge graph HippoRAG (2405.14831) · HippoRAG 2 / From RAG to Memory (2502.14802) · EcphoryRAG · HiRAG · HingeMem · CatRAG · plus a long tail of neuroscience papers (hippocampal indexing theory, engrams) — mostly off-scope, used only for the cognitive-grounding records.

Q13. memory poisoning attack injection agent long-term memory security AgentPoison (2407.12784) · MINJA (NeurIPS 2025) · CAMS · TMA-NM · MemPoison/MemMorph · GhostWriter · MemoryGraft · eTAMP · Sleeper Memory Poisoning · Trojan Hippo (2605.01970) · From Untrusted Input to Trusted Memory / MPBench (2606.04329) · MemAudit · SMSR.

Q14. sleep-time compute offline memory consolidation for LLM agents SleepGate · LightMem · Language Models Need Sleep · SCM · Human-Inspired Memory Architecture · Sleep-time Compute (2504.13171) · Auto-Dreamer (2605.20616) · RecMem (Findings ACL 2026) · All-Mem · Learn to Memorize · MemCon · CraniMem.

Q15. agent-generated repository documentation wiki onboarding knowledge for coding agents gskill / Automatically Learning Skills for Coding Agents (ACM AIAS 2026) · DocAgent · BootstrapAgent (2605.15815) · MemDocAgent · RepoAgent · Agent READMEs (2511.12884) · CodeWiki (2510.24428) · Probe-and-Refine Tuning of Repository Guidance (2606.20512) · Evaluating AGENTS.md (2602.11988) · LingmaAgent · RepoMaster · From Registry to Repository (2607.00911).

Q16. comparing memory representations markdown structured graph vector for LLM agent experience AriGraph · ExpGraph · PlugMem · ByteRover (2604.01599) · GAM · When Continual Learning Moves to Memory (2604.27003) · A-MEM · On the Structural Memory of LLM Agents (2412.15266) · EXG · StructMem · MRAgent · How Memory Management Impacts LLM Agents (2505.16067).

Q17. ExpeL LLM agents experiential learning insights from training trajectories ExpeL (2308.10144) · ERL · Experiential Co-Learning · FLEX · LatentGym · MAEL · AgentHER · JERP.

Q18. continual learning cross-session experience reuse benchmark coding agents memory evaluation SWE-Bench-CL · AgentCL (2606.02461) · CL-Bench (2606.05661) · Evo-Memory (2511.20857) · MemGUI-Bench · MemoryArena · LifelongAgentBench (2505.11942) · LongMemEval-V2 · MemoryBench (2510.17281) · WebCoach (2511.12997) · EvoAgentBench (2607.05202) · ELL/StuLife.

Q19. MemoryBank long-term memory Ebbinghaus forgetting curve LLM companion MemoryBank (2305.10250) · VIMBank · Think-in-Memory · FSFM selective forgetting (2604.20300) · Memora / FAMA (2604.20006) · Mnemosyne · RMM reflective memory management (2503.08026) · FOREVER.

Q20. when skills do not help agent skill libraries negative results evaluation When Skills Don't Help (2605.20023) · ASSAY / Not All Skills Help (2606.15390) · Library Drift (2605.19576) · Skill Shadowing (2605.24050) · Agent Skill Evaluation and Evolution · The Blind Curator · SkillOps · SameCapRisk-Bench · SkillEvolBench · GRASP (2605.29668) · SkillsInjector · OpenSkillEval · SWE-Skills-Bench (2603.15401) · Dynamic Agent Skills lifecycle survey (2607.10113) · Skill1 · SoK: Agentic Skills (2602.20867) · The Regression Tax (2607.22520). → Second-highest-yield query; produced the entire negative-results cluster.

Q21. self-editing memory agent tools Letta learning to edit its own context VISTA · MemSkill · SelfMem · Memory-as-Action (harness store) · ACE / Agentic Context Engineering (2510.04618) · LS-CM · Active Context Compression (harness store) · ACM (harness store) · A Self-Improving Coding Agent (2504.15228) · ReasoningBank · MemoHarness (2607.14159) · Self-GC · MemQ.

Direct arXiv fetches (WebFetch of arxiv.org/abs/…)

  • 2608.27454 → WikiSkill: Compiling Agent Experience into Persistent Knowledge for Skill Evolution (Tang, Rashtchian, Ferng, Tomkins, Juan, Vu; 2026-08-27).
  • 2603.19935 → Memori: A Persistent Memory Layer for Efficient, Context-Aware LLM Agents (Borro, Macarini, Tindall, Montero, Struck; 2026-03-20) — 82% on LoCoMo at 1,294 tokens/query.
  • 2604.15877 → Experience Compression Spectrum: Unifying Memory, Skills, and Rules in LLM Agents (Zhang et al.; 2026-04-17) — <1% citation overlap across 1,136 references between the memory and skill literatures.

MemOp (2606.05646) numbers were taken from the abstract returned by Q3 rather than a separate fetch.

Agent B — benchmarks, failure modes, safety

Tool: mcp__Consensus__search (query only, no filters). 14 queries, 2026-09-14. Each entry lists the query and the hits that became records (or were judged already-covered / out of scope).

Q1. "benchmark evaluating long-term memory in LLM agents"

Top hits used: LoCoMo (2402.17753); LongMemEval (2410.10813); Mem2ActBench (2601.19935); MemoryAgentBench (2507.05257); Mem-Gallery (2601.03515); StructMemEval (2602.11243); BEAM/LIGHT (2510.27246); Mem0 (2504.19413, mechanism — left to Agent A); StoryBench (2506.13356); Memora/FAMA (2604.20006); Evo-Memory (2511.20857); MemGym (2605.20833); EvoMemBench (2605.18421); MEMPROBE (2606.24595); Causal-LoCoMo/CMI (2605.17641); MemBench (2506.21605); AMA-Bench (2602.22769); MemGround (2604.14158); H-MEM (2507.22925, mechanism); MemoryCD (2603.25973).

Q2. "memory poisoning injection attack on LLM agent memory"

Top hits used: Memory Poisoning Attack & Defense on EHR agents (2601.05504); MINJA (NeurIPS 2025, DOI 10.52202/085713-1554); eTAMP "Poison Once, Exploit Forever" (2604.02623); MemoryGraft (2512.16962); MemPoison / Hijacking Agent Memory (2605.29960); Temporal Dynamics of Memory Poisoning (IEEE Access 10.1109/access.2026.3693560); MemMorph (2605.26154); SMSR (2606.12703); Sleeper Memory Poisoning (2605.15338); AgentPoison (2407.12784); MPBench (2606.04329); Agent Security Bench (2410.02644); MemAudit (2605.23723); Zombie Agents (2602.15654); TMA-NM (2606.24322); A-MemGuard (2510.02373); Torra memory poisoning & MAS (2603.20357); Injection-Execution Dissociation (2605.08442); OEP (2605.18930); GhostWriter/AM-Sentry (2607.06595).

Q3. "memory lifecycle operations benchmark agent memory failures masked by final answer accuracy"

Top hits used: MemOps (2607.12893); A-TMA / ghost memory (2607.01935); MemTrace (2606.17328); DynamicMem (2606.22877); HaluMem (2511.03506); MemFail (2605.26667); memory circuit analysis (2605.03354); AgingBench (2605.26302); Ground Truth First / Veracium (2607.21962); scale-conditioned evaluation (2605.07313); Are We Ready For An Agent-Native Memory System (2606.24775); Eywa (2605.30771); MemoryArena (2602.16313); memory-as-attack-surface MCQA (2606.29030); memorywire (2606.01138); WorldMemArena (2605.29341); STALE (2605.06527).

Q4. "stale memory context rot memory drift degradation in LLM agents" — rate-limited, retried inside Q6/Q10.

Q5. "privacy leakage and access control in LLM agent persistent memory machine unlearning"

Top hits used: Agentic Unlearning / SBU (2602.17692); MEXTRA "Unveiling Privacy Risks in LLM Agent Memory" (2502.13172); Secure Forgetting for LLM-based agents (2604.00430); MUSE (2407.06460, model-level, context only); LLM unlearning survey (10.1007/s10462-025-11376-7, context only).

Q6. "cross-session experience memory for coding agents repository issue resolution reuse" ← highest-yield SE query

Top hits used: SWE-Exp (2507.23361); TwinMem-Agent (FSE 2026, 10.1145/3803437.3807664); Prometheus (2507.19942); MemGovern (2601.06789); Exp-SWE-Agent (FSE-AIWare 2026 MemComp, 10.1145/3803437.3807663); ExpeRepair (10.1145/3808181); SWE-ContextBench (2602.08316); RSCB-MC abstention-aware memory retrieval (2604.27283); PROJECTMEM (2606.12329); MemCoder (2603.13258); Codified Context (2602.20478); Learning to Commit / Online Repository Memory (2603.26664); Git-bound ADLC memory (2607.14390); MemOp (2606.05646); accumulated behavioral rules (2607.13091 — already in harness store as self-improving-behavioral-rules-2026); EvoCoder (2411.13941); Repository Memory (2510.01003 — already repository-memory-localization-2025).

Q7. "when memory hurts agent performance negative results over-retrieval irrelevant memory interference"

Mostly human cognitive-psychology literature (Anderson interference theory etc.) — no usable agent records; logged as a negative result. Agent-side "memory hurts" evidence came instead from Q3, Q6, Q10, Q11.

Q8. "episodic memory generation and evaluation benchmark for language models"

Top hits used: Episodic Memories Generation and Evaluation Benchmark (2501.13121); REMem (2602.13530, mechanism); Position: Episodic Memory is the Missing Piece (2502.06975); Minerva (2502.03358); Evaluating Long-Term Memory for Long-Context QA (2510.23730); Memory in LLMs: Mechanisms, Evaluation and Evolution (2509.18868).

Q9. "reward model for agent memory quality MemoryRewardBench evaluating memory writes"

Top hits used: MemoryRewardBench (2601.11969); Fine-Mem (2601.08435); Evidence-Gated Memory Writer (10.1109/icipai70034.2026.11605481); Failure-Gated Hierarchical Memory / LTM Pollution Rate (10.1109/mlise70044.2026.11607496); Memory Reward Inflation / Echo Gap (2608.00017); When to Forget / Memory Worth (2604.12007); MemDelta (2606.29914); Adaptive Memory Admission Control (2603.04549).

Q10. "access control and cross-user information flow governance for shared agent memory"

Top hits used: Collaborative Memory (2505.18279); GateMem (2606.18829); Governed Shared Memory / MemClaw+ArgusFleet (2606.24535); MemTrust (2601.07004); SSGM (2603.11768); LTM security survey (2604.16548); PiSAs (2607.05318); Memory Sandbox (10.1145/3586182.3615796).

Q11. "LoCoMo benchmark flaws contamination critique long-term memory evaluation reliability"

Top hits used: LoCoMo-Plus (2602.10715); ATANT v1.1 (2604.10981, incl. LoCoMo empty-gold scoring bug); Same Ranking, Different Winner / TIAP (2605.24060); ConsistencyGate (2607.22962); MemConflict (2605.20926); Cost & Accuracy of LTM in DMAS (10.1109/compsac69091.2026.00015); belief-based memory / token-F1 vs judge discrepancy (2606.22030).

Q12. "context rot stale AGENTS.md CLAUDE.md instruction files decay software repositories"

Top hits used: Context Rot in AI-Assisted Software Development, Treude et al. (2606.09090); Agent READMEs (2511.12884); Configuration Smells in AGENTS.md (2606.15828); Evaluating AGENTS.md, Gloaguen et al. (2602.11988); AGENTS.md efficiency (2601.20404); two-agent ablation (2607.27250); When Retrieval Hurts Code Completion (2605.14478); Why Does CLAUDE.md Keep Growing? (2608.11095); When and How Context Rot Appears in Coding Agents (2607.17937); Evolution Context Gap (JCSSE 2026); cntx local agentic memory layer (10.1145/3812835.3814970). Already in harness store: harness-engineering-configuration-2026, agents-md-convention.

Q13. "MemoryBench StreamBench sequential experience benchmark agent self-improvement streaming"

Top hits used: StreamBench (2406.08747); MemoryBench THUIR (2510.17281); CL-Bench (2606.05661); AgentCL + MemProbe (2606.02461); EvoAgentBench (2607.05202); StreamMemBench (2606.14571); FinEvolveBench (2606.06960); ReasoningBank (2509.25140, mechanism — Agent A); Live-Evo (2602.02369).

Q14. "token cost overhead and run-to-run variance of memory-augmented LLM agents"

Top hits used: Cost & Accuracy of LTM in DMAS (COMPSAC 2026); Beyond the Context Window cost analysis (2603.04814); How Do AI Agents Spend Your Money (2604.22750 — already token-consumption-agentic-coding-2026); AgentDiet (10.1145/3797084); SimpleMem (2601.02553 — already simplemem-2026); D-MEM (2603.14597); MemCon (2607.13591).

Q15. "MemComp challenge sequential SWE-bench Pro memory-augmented coding agent competition"

Confirms the FSE-AIWare 2026 MemComp challenge track (Exp-SWE-Agent, TwinMem-Agent both submissions on a sequential 8x25 SWE-Bench Pro subset). Also: SWE-MeM (2606.28434 — already swe-mem-2026), MemRL (2601.03192), SWE-Interact (2606.30573), SWE-Pruner (2601.16746).

Q16. "prompt injection persistence in coding agent repository poisoning rules files backdoor"

Top hits used: Bad Memory (2607.14611); Cross-Session Stored Prompt Injection (2606.04425); ClawTrojan / DASGuard (2605.31042); Agent Skills prompt injections (2510.26328); Trojan's Whisper / guidance injection (2603.19974); CIBER (2602.19547); SoK prompt injection on agentic coding assistants (2601.17548); SkillJect (2602.14211); supply-chain skill poisoning (2604.03081).

Q17. "GDPR right to be forgotten EU AI Act compliance for persistent AI assistant memory audit"

Mostly model-level unlearning law literature. Used: From rights to runtime: privacy engineering for agentic AI (10.1002/aaai.70036). Remainder (Li 2017 RTBF, GDPR/AIA overlap, MU auditing) noted as background only — not agent-memory-specific.

Q18. "empirical audit of what ChatGPT memory stores user perceptions of AI assistant memory"

Top hits used: Algorithmic Self-Portrait (WWW 2026, 10.1145/3774904.3792671); Analysis of the Content of ChatGPT's Memory (MIPRO 2025); Relational Gains, Privacy Strains (CHI 2026); Users' Expectations and Practices with Agent Memory (CHI EA 2025); From Storage to Interpretation (HAI 2025); Understanding Users' Privacy Perceptions Towards LLM's RAG-based Memory (2025); MemoryBank (2305.10250, mechanism — Agent A); PerMemBench (2605.25535).

Notes on method

  • No filters were passed on any call (per connector guidance).
  • One rate-limit (Q4) was absorbed by re-issuing the topic inside Q3/Q12.
  • Numbers recorded in academic-evaluation.json are taken verbatim from the abstracts returned by Consensus for those papers; nothing was inferred or interpolated.

Agent D — human-in-the-loop and governance

Tool: mcp__Consensus__search, query-only, 17 queries, batched ≤3. Run 2026-09-14. Top hits listed as they were returned (title — first author, year — identifier). "*" = turned into a record in hitl.json.

Q1. AGENTS.md context files effect on LLM coding agent performance empirical study - * Evaluating AGENTS.md: Are Repository-Level Context Files Helpful for Coding Agents? — Gloaguen 2026 — arXiv:2602.11988 - * Structured Context Engineering for File-Native Agentic Systems — McMillan 2026 — arXiv:2602.05447 (cut in final trim) - * Probe-and-Refine Tuning of Repository Guidance for Coding Agents — Shepard 2026 — arXiv:2606.20512 - * On the Impact of AGENTS.md Files on the Efficiency of AI Coding Agents — Lulla 2026 — arXiv:2601.20404 - * Agent READMEs: An Empirical Study of Context Files for Agentic Coding — Chatlatanagulchai 2025 — arXiv:2511.12884 - * Instruction Adherence in Coding Agent Configuration Files — McMillan 2026 — arXiv:2605.10039 - * Do Context Files Help Coding Agents? Two-Agent Ablation — Khatri 2026 — arXiv:2607.27250 - * Guardrails Beat Guidance — Zhang 2026 — arXiv:2604.11088 - * Codified Context: Infrastructure for AI Agents in a Complex Codebase — Vasilopoulos 2026 — arXiv:2602.20478 - * Evolution Context Gap: Agent Manifests — Chondamrongkul 2026 — 10.1109/jcsse68839.2026.11597070 - Coding Agents are Effective Long-Context Processors — Cao 2026 (already in harness-sources.json) - Harness Engineering for Agentic AI Coding Tools — Galster 2026 — arXiv:2602.14690 (already covered: harness-engineering-configuration-2026) - * Configuring Agentic AI Coding Tools (ACM version) — Galster 2026 — 10.1145/3805760.3814887 - * ContextCov: Executable Constraints from Agent Instruction Files — Sharma 2026 — arXiv:2603.00822 - ContextBench — Li 2026; * SkillReducer — Gao 2026 — arXiv:2603.29919 - * Context Engineering for AI Agents in Open-Source Software — Mohsenimofidi 2025 — 10.1145/3793302.3793350 - What Context Does a Coding Agent Actually Need to Act? — Sam-Bodden 2026; Limits of Long-Context Reasoning — Raju 2026; Beyond Resolution Rates — Mehtiyev 2026 (already covered)

Q2. human-in-the-loop memory governance for LLM agents approval gated memory writes - * Evidence-Gated Memory Writing (EGMW) — Ma 2026 — 10.1109/icipai70034.2026.11605481 - * Failure-Gated Hierarchical Memory — Liu 2026 — 10.1109/mlise70044.2026.11607496 - * GateMem — Ren 2026 — arXiv:2606.18829 - * Stop Means Stop — Khan 2026 — arXiv:2607.14166 - * Collaborative Memory — Rezazadeh 2025 — arXiv:2505.18279 - * Governed Shared Memory (MemClaw) — Margalit 2026 — arXiv:2606.24535 - * ConsistencyGate — Zhang 2026 — arXiv:2607.22962 - SSGM — Lam 2026 — arXiv:2603.11768 (cut in trim) - * MemLineage — Ouyang 2026 — arXiv:2605.14421 - Memory in LLMs: Mechanisms, Evaluation and Evolution — Zhang 2025; MemArchitect — Suresh Kumar 2026 (cut) - Memory for Autonomous LLM Agents survey — Du 2026 - * Governed Collaborative Memory as Artificial Selection — Cuadros 2026 — arXiv:2605.04264 - * What You Approve Is What Executes (Consent Integrity) — Weng 2026 — arXiv:2606.02668 - * LTM Security Survey — Lin 2026 — arXiv:2604.16548 - * When Not to Write Memory (GovMem) — Qi 2026 — 10.1109/mlise70044.2026.11607557 - * Adaptive Memory Admission Control (A-MAC) — Zhang 2026 — arXiv:2603.04549 - Human-Inspired Memory Architecture — Kerestecioglu 2026; SAGE novelty gate — Wang 2026 (cut)

Q3. user control and transparency of LLM memory interfaces HCI study - * "Ghost of the past" / MemoAnalyzer — Zhang 2024 — arXiv:2410.14931 - * Understanding Users' Privacy Perceptions Towards LLM's RAG-based Memory — Zhang 2025 — 10.1145/3733816.3760750 - * Memory Sandbox — Huang 2023 — arXiv:2308.01542 - * Relational Gains, Privacy Strains (ChatGPT memory) — Chen 2026 — 10.1145/3772318.3791635 - * Semantic Commit — Vaithilingam 2025 — 10.1145/3746059.3747778 - * Towards Usable, Privacy Respecting Long-Term Memory — Malki 2026 — 10.1145/3772363.3799198 - * Designing a Dashboard for Transparency and Control (TalkTuner) — Chen 2024 — arXiv:2406.07882 - * Sensemaking in Multi-Agent LLM Interfaces — Pareek 2026 — 10.1145/3772318.3791157 - User Autonomy in Human-LLM Interaction scoping review — Wang 2026 (cut) - AI Chains — Wu 2021; Memoro — Zulfikar 2024; MemGPT — Packer 2023; AI Transparency Roadmap — Liao 2023; Multi-Turn Neural Transparency — Karny 2026

Q4. human verified procedural memory knowledge base computer use agent VerificAgent - * VerificAgent (both arXiv v1 and v3 titles returned) — Nguyen 2025 — arXiv:2506.02539 - * Users' Expectations and Practices with Agent Memory — Jones 2025 — 10.1145/3706599.3720158 - * Organizational Memory for Agentic Business Process Execution — Kirchdorfer 2026 — arXiv:2607.03228 - Managing Procedural Memory in LLM Agents (AFTER) — Belikova 2026 (cut); Memp — Fang 2025; MACLA — Forouzandeh 2025; UI-Evol — Liu 2025; CUA-Skill — Chen 2026; OSExpert — Liu 2026; Art of Building Verifiers for CUAs — Rosset 2026

Q5. developer experience survey interviews context management pain points AI coding assistants Cursor Copilot - Large-Scale Survey on Usability of AI Programming Assistants — Liang 2023; Using AI-Based Coding Assistants in Practice — Sergeyuk 2024; in-IDE HAX SLR — Sergeyuk 2025; Beyond the Commit (BNY Mellon, n=2989) — Chen 2026; Longitudinal Study of AI Coding Assistants — Vella 2026; Grounded Copilot — Barke 2022; Code with Me or for Me — Chen 2025 (already covered) - (no new records; used as background for the notes' developer-pain section)

Q6. mining Cursor rules .cursorrules repositories empirical study developer authored agent rules - * Beyond the Prompt: An Empirical Study of Cursor Rules — Jiang 2025 — 10.1145/3793302.3793367 - * Rule Taxonomy and Evolution in AI IDEs — Cai 2026 — arXiv:2606.12231 - * A Study of Cursorrules Files in GitHub Open Source Projects — Sun 2026 — 10.5220/0015072600004088 - * A Dataset of Agentic AI Coding Tool Configurations — Galster 2026 — 10.1145/3805760.3814922 - * How Do Developers Maintain and Evolve Their Agents' Instructions? — Voria 2026 — arXiv:2606.25257 - * Programming by Chat (11,579 IDE sessions) — Tang 2026 — 10.1145/3832783.3834377 - Agentic Much?, AIDev, How do Agents Refactor, Fingerprinting AI Coding Agents, Speed at the Cost of Quality, Coding Agents in the Wild (mostly already covered)

Q7. documentation as agent memory living documentation architecture decision records read by LLM agents - * AgenticAKM — Dhar 2026 — arXiv:2602.04445 - * ESAA-Conversational — Santos Filho 2026 — arXiv:2606.23752 - * Ground Truth First (Veracium) — Spencer 2026 — arXiv:2607.21962 - Evaluating LLMs for Detecting Architectural Decision Violations — Su 2026 (cut); Infini Memory; DocAgent; DRAFT; ObjectGraph; Context-as-AI-Service; Improving LLM-assisted code generation with architectural documents — Cervantes 2026

Q8. secrets and security risks in AI agent configuration instruction files repositories - * Agent Skills in the Wild — Liu 2026 — arXiv:2601.10338 - * Trust but Verify? Security Debt of Autonomous Coding Agents — Banik 2026 — arXiv:2607.12428 - * A Deterministic Control Plane for LLM Coding Agents — Madatha 2026 — arXiv:2606.26924 - * You Told Me to Do It (ReadSecBench) — Kao 2026 — arXiv:2603.11862 - * Don't Let AI Agents YOLO Your Files (YoloFS) — Zhong 2026 — arXiv:2604.13536 - Cuckoo Attack (config-file persistence) — Liu 2025; Setup Complete, Now You Are Compromised — Bagmar 2026; AgentRiskBOM; Agent Audit; LlamaFirewall (already covered)

Q9. GDPR AI Act compliance persistent agent memory right to erasure auditability - * From rights to runtime: Privacy engineering for agentic AI — Navaie 2025 — 10.1002/aaai.70036 - * Runtime Compliance Verification for AI Agents (C-Trace) — Kahani 2026 — arXiv:2606.19242 - * EMA2 Enterprise Memory Architecture — Yerneni 2025 — 10.1109/ised67359.2025.11405305 - * AI Agents Under EU Law — Nannini 2026 — arXiv:2604.04604 - SuperLocalMemory — Bhardwaj 2026 (cut); Humans forget, machines remember — Li 2017; AudAgent; Forgetful AI

Q10. repository wiki knowledge base generated for AI agents DeepWiki repository documentation agent consumption - * SkillWiki — Huang 2026 — arXiv:2606.16523 - * Knowledge Activation: AI Skills as Institutional Knowledge Primitive — Bakal 2026 — arXiv:2603.14805 - * From Registry to Repository (agent skills) — Gao 2026 — arXiv:2607.00911 - * ContextNest — Sulpovar 2026 — arXiv:2607.02116 - CodeWiki vs DeepWiki — Hoang 2025; Progressive Disclosure for LLM-Maintained Wiki — Cochran 2026; LLM-Wiki; RESOURCE2SKILL; BootstrapAgent; Developer Experience with AI Coding Agents (HTTP signatures) — Borysenko 2026

Q11. vibe coding practitioner study rules memory context engineering practices - * Context Before Code — Shuvo 2026 — arXiv:2603.11073 - * Good Vibrations? — Pimenova 2025 — arXiv:2509.12491 - * Vibe coding: programming through conversation with AI — Sarkar 2025 — arXiv:2506.23253 - * Building Software by Rolling the Dice — Chou 2025 — 10.1145/3797105 - * Your Code Agent Can Grow Alongside You (MemCoder) — Deng 2026 — arXiv:2603.13258 - Mise en Place for Agentic Coding — Zigler 2026 (cut); Vibe Coding in Practice grey-lit review — Fawzy 2025; multivocal reviews (Beaulieu, Siddeeq); Vibe Coding as Reconfiguration of Intent Mediation — Meske 2025

Q12. context rot configuration smells agent instruction files technical debt Treude Santos - * Context Rot in AI-Assisted Software Development — Treude 2026 — arXiv:2606.09090 - * Configuration Smells in AGENTS.md Files — Santos 2026 — arXiv:2606.15828 - * From Technical Debt to Cognitive and Intent Debt — Storey 2026 — 10.1145/3807966 - (rest of hits were classical code-smell / technical-debt literature, not agent-specific)

Q13. promoting episodic experience to rules self-evolving coding agent memory human review gate - MemRL, ReasoningBank, ReMe, MemQ, WebCoach, Metis, TMEM, Evo-Memory, MemEvolve, Live-Evo, Mem2Evolve, MemGen, UI-Mem, SkeMex — all agent-initiated self-evolving memory with no human gate; used as the "none" column of the matrix - * CODESKILL — Li 2026 (cut in trim); * MemCoder — Deng 2026

Q14. team shared memory across developers software engineering agent organizational knowledge provenance ownership - * Smarter Together (Spark) — Tablan 2025 — arXiv:2511.08301 - * Why Git Is the Memory Solution for the ADLC — Guo 2026 — arXiv:2607.14390 - * Hipikat: a project memory for software development — Cubranic 2005 — 10.1109/tse.2005.71 - Knowledge-sharing-barrier and transactive-memory SE literature (Ghobadi, Ryan, Oshri, Espinosa); Examining ownership models in software teams — Koana 2024

Q15. memory bank persistent project documentation coding assistant Cline industry practice - * PROJECTMEM — Malo 2026 — arXiv:2606.12329 - * Delivery, Not Storage: Cue-Anchored Working Memory — Saha 2026 — arXiv:2607.20972 - * CommitDistill — Chukkapalli 2026 — arXiv:2605.18284 - cntx local agentic memory layer — Radu 2026; MemDocAgent; Codetations; Cross-interface persistent memory for radiology (Claude MEMORY.md/CLAUDE.md) — Angarita 2026 - No peer-reviewed study of the Cline "memory bank" pattern itself was found — see notes, open question O7.

Q16. human in the loop approval coding agent workflow oversight developer review of agent plans - * Human oversight of agentic systems in practice — Dhanorkar 2026 — 10.1145/3805689.3812402 - * Hedwig: Dynamic Autonomy for Coding Agents — Shukla 2026 — 10.1145/3786335.3813223 - * AgentClick — Zhuang 2026 — 10.1145/3786335.3813232 - * Oversight Has a Capacity — Turan 2026 — arXiv:2606.08919 - * Human-AI Synergy in Agentic Code Review — Zhong 2026 — arXiv:2603.15911 - * Coding with "Enemy": Can Human Developers Detect AI Agent Sabotage? — Ye 2026 — arXiv:2606.05647 - * Governed AI-Assisted Engineering (GAIE) — Kang 2026 — arXiv:2606.22484 - HULA — Takerngsaksiri 2024 (already covered: hula-human-in-the-loop-2024); Decoupled HITL — Cheng 2026 (cut); Dynamic Intervention Framework — Kumar 2026; The End of Code Review — Monperrus 2026

Q17. LOGOS governed memory agent architecture human ratified knowledge promotion - * LOGOS: A Living Logic for AI Agent Teams That Evolve With Humans — Ichikawa 2026 — arXiv:2607.10878 - * Governed Memory: A Production Architecture for Multi-Agent Workflows — Taheri 2026 — arXiv:2603.17787 - * Governed Collaborative Memory — Cuadros 2026 (see Q2) - Memory as Asset: From Agent-centric to Human-centric Memory Management — Pan 2026 — arXiv:2603.14212; Zep; Memory OS; A-MEM; Agent KB; G-Memory; CoALA

Q18. memory poisoning attacks persistent agent memory coding agent injection defense - * Bad Memory: Prompt Injection Risks from Memory in Agentic Systems (Claude Code + Codex) — Gadgil 2026 — arXiv:2607.14611 - * From Untrusted Input to Trusted Memory (MPBench) — Dash 2026 — arXiv:2606.04329 - * Zombie Agents — Yang 2026 — arXiv:2602.15654 - * When Claws Remember but Do Not Tell (WhisperBench/MemGhost) — Zhang 2026 — arXiv:2607.05189 - * MemAudit — Tan 2026 — arXiv:2605.23723 - MINJA — Dong 2025; MemoryGraft; Trojan Hippo; Sleeper Memory Poisoning; SMSR; Injection-Execution Dissociation; eTAMP; ASB

arXiv abs pages fetched for verification (WebFetch)

URL Outcome
arxiv.org/abs/2602.11988 verified — authors, 2026-02-12, ">20% cost", success-rate null
arxiv.org/abs/2601.20404 verified — 10 repos / 124 PRs, Δ28.64% runtime, Δ16.58% output tokens
arxiv.org/abs/2604.11088 verified — 679 files / 25,532 rules / >5,000 runs, +13.8pp both arms
arxiv.org/abs/2506.02539 verified — v1 2025-06-03, v3 2025-08-07; 111.1% figure only in the v1/alternate abstract, absent from v3
arxiv.org/abs/2607.27250 verified — 288 runs, 17 tasks, 3 repos, ≤10-15pp equivalence bound, rho=0.75
arxiv.org/abs/2606.15828 verified — 100 repos, Lint Leakage 62% / Context Bloat 42% / Skill Leakage 35%
arxiv.org/abs/2308.01542 verified — Huang et al., 2023-08-03, UIST 2023 Adjunct
arxiv.org/abs/2607.10878 verified — Ichikawa et al., 2026-07-12
arxiv.org/abs/2606.09090 fetch returned empty PDF text; 23.0% of 356 repositories taken from the Consensus abstract only — confidence set to medium