Every artifact carries its lineage.

Where the memory came from, who wrote it, what it derives from, when it was created. Provenance is a runtime invariant — not a debugging convenience.

Injection attempts don't get stored silently.

Fifteen rule families, seventy-two patterns, validated at 100% recall and zero false positives on a representative corpus. Every memory write is scanned — turn, document, bootstrap import.

Every artifact is scored at the moment it is written.

UMA classifies the origin at write time and attaches a trust_score that travels with the artifact permanently. The score survives schema migrations and directly shapes retrieval ranking.

The same scan runs twice — once before the LLM sees anything, once before storage.

UMA exposes a pre-LLM gate that runs before any model call. Then it runs the same scan a second time at the storage boundary as defense-in-depth; on high severity it raises InjectionDetectedError and nothing reaches the storage layer.

Tamper protection on every write.

Every memory artifact carries a SHA-256 hash over its canonical content, computed at write time. If a record is tampered with after the fact, the hash no longer matches. Lite provides on-demand verification through the management API.

Suspicious writes are preserved, not dropped.

High-severity hits are quarantined out of retrieval. A small management API lets operators list, reinstate, or purge — with an audit trail. You see what tried to enter your memory.

The boundary is defended.

MIME consistency checks before parsing. Executables masquerading as documents are rejected, not stored. HTML and Markdown are sanitized of active payloads before chunking.