Context Engineering as Content Composition — Research Brief

Full research memo: Context Engineering as Content Composition

1. Domain question

What does 2024–2026 research establish about composing, evolving, retrieving, scaling, securing, and integrating context in compound reasoning systems, and which of those findings directly support, complicate, or bound AIOS’s proposed combination of file-canonical continuity, multiple memory layers, recursive composition, bounded model judgment, exact operations, governed integration, and selective use of local and frontier models?

2. Executive answer

Recent research supports treating context as an engineered working state rather than a prompt string. Instructions, demonstrations, retrieved evidence, memory, tool schemas, permissions, traces, intermediate artifacts, validators, and output contracts can all change realized capability. Prompt and program optimizers show that these components can be improved without changing model weights; memory studies show that procedural lessons and past information can persist across episodes; harness benchmarks show that tools, state visibility, and validation materially affect whether reasoning becomes a correct result. In that qualified empirical sense, useful intelligence is already observed at the system level, even though model weights remain a central source of capability.

The evidence also rejects several simple scaling assumptions. Advertised context length is not reliable usable context: performance can deteriorate far inside the nominal window, including when the relevant evidence is perfectly retrieved. External memory is not automatically continuity; it requires decisions about writing, updating, conflict, retrieval, provenance, and promotion. Graphs, hierarchies, whole-context loading, retrieval, and recursive calls each help under some task conditions and impose omissions, noisy relationships, coordination costs, or extreme inference outliers under others. More test-time computation helps only when candidate generation, difficulty estimation, and verification are good enough; otherwise it can amplify evaluator error.

For AIOS, the strongest relationship is architectural rather than confirmatory. Research supports bounded semantic judgments surrounded by exact interfaces, capabilities, validators, and state checks. It also supports keeping trusted control separate from retrieved or remembered content. The more distinctive AIOS proposition is the conjunction: person-controlled canonical files, subordinate and revisable memory or relationship layers, purpose-built semantic situations, multiple cognitive modes, exact operations, governed promotion, and selective local or frontier inference. No reviewed study evaluates that full stack or demonstrates that its component improvements accumulate into fewer retries, lower inference burden, reduced unsupported output, or broad local workload coverage.

The conclusion is therefore two-sided. AIOS rests on technically credible mechanisms and addresses failure modes exposed by current research. Its larger implications—private local cognition, portable personal and organizational intelligence, governed peer domains, regulated assistance, and reduced dependence on centralized application layers—remain serious conditional consequences, not established outcomes. Their determining tests are longitudinal, end-to-end comparisons that measure verified success, correction, provenance, security, privacy, total cost, remote escalation, memory health, and exact integration rather than answer quality alone.

3. Essential findings

Finding 1 — Context and compound programs can evolve without weight updates

• Finding: Instructions, demonstrations, strategies, and multi-stage context can be optimized or incrementally evolved without retraining the underlying model.
• Evidence: MIPRO jointly optimized instructions and examples across seven programs, reporting the best result on five and gains up to 13 percentage points. ACE used localized playbook updates and reported average gains of 10.6% on agent tasks and 8.6% on finance tasks while avoiding a documented collapse from extreme summarization.
• Relationship to AIOS: Supporting evidence. These results support the general proposition that capability can improve through the surrounding context system, but they do not validate AIOS’s specific grammar, memory layers, or authority model.
• Implication: If governed evolution transfers beyond bounded benchmarks, expertise could improve across sessions and models without moving canonical files or accepted ground into model weights. AIOS should treat learning as attributable context changes rather than opaque global rewrites.
• Limits or counterevidence: Both approaches depend on representative evaluation. Optimization can overfit, and ACE reports deterioration when feedback is missing or unreliable. Neither establishes safe promotion into a live, contested knowledge store.
• Exact descent: Full memo §3.1, “MIPRO: optimizing instructions and demonstrations” and §3.5, “ACE: evolving playbooks without context collapse”; MIPRO and ACE.

Finding 2 — Nominal context capacity is not usable context capacity

• Finding: The presence of relevant information inside a supported window does not imply that a model will retrieve, associate, or use it reliably.
• Evidence: NoLiMa tested 13 models using queries without lexical overlap; at 32K tokens, 11 of 13 fell below half of their strong short-context baseline. A separate study preserved perfect access to relevant evidence while adding irrelevant text, whitespace, or masked tokens and found degradation of 13.9% to 85% across five models.
• Relationship to AIOS: Boundary condition. The results directly constrain any assumption that rich file stores can simply be placed in one prompt or that retrieval success completes context composition.
• Implication: AIOS needs focused semantic situations, staging, and measurement of effective context. Exact search, semantic retrieval, relationship traversal, and direct reading should remain alternative paths.
• Limits or counterevidence: Both studies use controlled tasks and do not establish one causal mechanism. Whole-repository input outperformed selected retrieval scaffolds in one software-engineering preprint, so the correct boundary is task- and model-dependent rather than “shorter is always better.”
• Exact descent: Full memo §5.1, “NoLiMa: retrieval without lexical overlap”, §5.2, “Context Length Alone Hurts LLM Performance Despite Perfect Retrieval”, and §5.6, “Putting It All into Context: a useful counterexample”; NoLiMa, perfect-retrieval study, and whole-context counterexample.

Finding 3 — Persistent memory is a governed write-and-update problem

• Finding: Reliable continuity requires explicit policies for memory creation, temporal update, conflict, retrieval, correction, and promotion; storage alone is insufficient.
• Evidence: LongMemEval’s 500 questions found an average decline of about 30% in sustained interactions, with gains from session indexing and time-aware retrieval. ACE found incremental edits more robust than full rewriting. A 2026 filesystem-memory preprint found that organized stores reduced retrieval cost but often eroded; one PersonaMem setting scored 37.5 for curated memory versus 78.1 for verbatim memory.
• Relationship to AIOS: Direct mechanism. This evidence directly informs the proposed separation between canonical files and derived, revisable memory or metadata layers.
• Implication: AIOS can preserve sources, represent supersession, stage memory deltas, and require authority before a generated lesson becomes canonical. Evaluation should cover factual, temporal, procedural, cost, provenance, and correction dimensions.
• Limits or counterevidence: Benchmarks emphasize chat histories or bounded agent tasks, not multi-user, human-edited organizational stores. The filesystem result is a recent preprint, and no study compares the complete proposed canonical/companion arrangement longitudinally.
• Exact descent: Full memo §4.1, “LongMemEval: sustained-interaction memory”, §4.3, “Filesystem-Based Memory for LLM Agents”, and §3.5, “ACE: evolving playbooks without context collapse”; LongMemEval, filesystem memory, and ACE.

Finding 4 — Graphs, hierarchies, and recursion are conditional control strategies

• Finding: Relational and recursive composition can extend associative access or processing reach, but no reviewed method is an automatically superior representation of knowledge.
• Evidence: HippoRAG 2 reported gains from graph-based external memory. GraphRAG-Bench found conditional gains and graph pipelines producing prompts from tens to hundreds of thousands of tokens. Recursive Language Models reported double-digit gains on several tasks and inputs beyond ten million tokens, but some trajectories required thousands of calls.
• Relationship to AIOS: Complicating evidence. The work supports relational metadata and recursive computation while warning against promoting generated edges, taxonomies, or decompositions into unquestioned structure.
• Implication: AIOS should distinguish representational, computational, and authority hierarchy. Graph edges should remain provenance-bearing claims; recursive subresults need budgets, stopping rules, and integration checks; exact file access must remain available.
• Limits or counterevidence: GraphRAG-Bench and Recursive Language Models are preprints, corpora and task families are limited, and model behavior varies. Reported reach demonstrates addressability, not comprehensive understanding or truth preservation.
• Exact descent: Full memo §6.1, “HippoRAG 2: graph-based long-term memory”, §6.2, “GraphRAG-Bench: when graphs help and when they cost”, and §6.3, “Recursive Language Models”; HippoRAG 2, GraphRAG-Bench, and Recursive Language Models.

Finding 5 — Document-level reasoning depends on the requested operation and evidence distribution

• Finding: Cross-document difficulty is governed by relevant-information volume, distribution, aggregation demands, and reasoning type—not token count alone.
• Evidence: HoloBench varied length, relevant-information volume and position, and operation type; relevant volume mattered more than raw length, query complexity mattered more than volume, and aggregation degraded with scale. LongBench v2 tested 503 questions across six categories and found difficult performance even for many items below 128K tokens.
• Relationship to AIOS: Supporting evidence. The studies support composing a semantic situation around the operation to be performed rather than retrieving a generic top-k context.
• Implication: Context selection should identify whether a task requires lookup, comparison, contradiction resolution, aggregation, temporal update, global structure, or creation. Cognitive movements may receive different evidence arrangements over the same canonical store.
• Limits or counterevidence: HoloBench uses synthetic textual databases; LongBench v2 uses multiple-choice scoring that can hide unsupported reasoning. Neither evaluates provenance-preserving document production or human correction of a shared corpus.
• Exact descent: Full memo §5.3, “HoloBench: holistic operations over massive textual data” and §5.4, “LongBench v2: realistic long-context reasoning”; HoloBench and LongBench v2.

Finding 6 — Realized capability belongs to the model–harness system

• Finding: Interfaces, state visibility, tool semantics, validators, and integration paths materially determine whether plausible reasoning produces a correct effect.
• Evidence: SWE-agent reported 12.5% pass@1 on SWE-bench and 87.7% on HumanEvalFix with a purpose-built interface. In τ-bench, GPT-4o remained below 50%, and retail pass^8 fell below 25%. Harness-Bench analyzed 5,194 trajectories over 106 tasks and found substantial model–harness interaction and execution-alignment failures.
• Relationship to AIOS: Direct mechanism. This is the closest evidence for treating bounded judgments, exact operations, verification, and post-process integration as parts of the intelligence system rather than implementation detail.
• Implication: AIOS should evaluate typed judgment contracts and exact state transitions, not fluency alone. Models may require different context and tool affordances by task; changing the model may not repair a weak harness.
• Limits or counterevidence: SWE-agent and Harness-Bench are software- or sandbox-centered, Harness-Bench is a recent preprint, and τ-bench has two simulated domains. None demonstrates the full file-canonical or human-authority design.
• Exact descent: Full memo §8.1, “SWE-agent: file and execution interfaces”, §8.2, “τ-bench: tools, policy, and repeatability”, and §8.3, “Harness-Bench: model–harness interaction”; SWE-agent, τ-bench, and Harness-Bench.

Finding 7 — Inference-time scaling is verifier- and task-dependent

• Finding: More sampling, revision, search, or recursion improves performance only when the system can generate useful coverage and select or verify the result reliably.
• Evidence: An ICLR 2025 study found adaptive allocation more than four times as efficient as fixed best-of-N in selected mathematics settings and showed a smaller model outperforming one 14 times larger when initial success was nontrivial. An ICML 2025 analysis showed that naive best-of-N can become non-monotonic under reward-model error.
• Relationship to AIOS: Boundary condition. The evidence bounds the thesis that scaffolding and selective model use can reduce inference burden: allocation and verification must be modeled explicitly, and extra computation is not a universal fallback.
• Implication: AIOS can scale evidence gathering, decomposition, generation, and verification separately according to uncertainty and consequence. Model routing should preserve context and authority boundaries, but the dedicated routing research must determine selection policy.
• Limits or counterevidence: The strongest positive results are mathematics-heavy and depend on process reward models. A 2025 knowledge-intensive preprint found limited gains from additional scaling, and none of these studies measures governed file integration.
• Exact descent: Full memo §7.1, “Scaling LLM Test-Time Compute Optimally”, §7.2, “Is Best-of-N the Best of Them?”, and §7.3, “Knowledge-intensive scaling remains unsettled”; compute-optimal scaling, best-of-N analysis, and knowledge-intensive scaling preprint.

Finding 8 — Context security requires structural authority separation

• Finding: Retrieved documents, tool outputs, annotations, and memories cannot safely share the authority of trusted instructions merely because they occupy the same context window.
• Evidence: AgentDojo supplies 97 tasks and 629 security cases and found meaningful compromise without a defense that simultaneously solved utility and security. Agent Security Bench covered ten scenarios, more than 400 tools, and 27 attack and defense techniques, again finding exposure. CaMeL reported 67% task completion with capability-based information-flow constraints in its supported model.
• Relationship to AIOS: Direct mechanism. The work directly supports separating semantic judgment from authorization and exact effects, attaching trust and capabilities to context elements, and treating memory writes as security-sensitive operations.
• Implication: Governed integration should include provenance, trust labels, least privilege, scoped reads and writes, staged deltas, postcondition checks, and consequence-sensitive human approval. Security must extend across delayed memory retrieval and downstream file changes.
• Limits or counterevidence: Environments and attacks remain incomplete; formal guarantees cover modeled tools and flows; later audits show that security metrics and attacks can be flawed. Human approval can also become perfunctory.
• Exact descent: Full memo §9.1, “AgentDojo: prompt injection in tool-using agents”, §9.2, “Agent Security Bench”, and §9.3, “CaMeL: control-flow and capability separation”; AgentDojo, Agent Security Bench, and CaMeL.

4. How the evidence refines the AIOS account

1. Promotion authority is the decisive unresolved memory mechanism. Research shows that context can evolve; it sharpens the AIOS question into who may promote a lesson, relationship, or summary, from which evidence, with what supersession and rollback semantics.
2. Hierarchy should be separated into three kinds. Representational hierarchy, computational hierarchy, and authority hierarchy have different failure modes and should not be inferred from one another.
3. Effective context needs an operation model. Composition should account for lookup, aggregation, comparison, temporal update, transformation, and verification—not only relevance scores or token budgets.
4. Cumulative architecture needs factorial and longitudinal evaluation. Component gains cannot be added arithmetically; their interactions may be reinforcing, redundant, or harmful.
5. Security includes delayed epistemic effects. A context attack can poison a memory or relationship now and alter a later judgment or file, even when the current tool call appears harmless.

5. Architectural boundaries preserved

1. The Fractal Seed as AIOS’s chosen organizing grammar. External work neither validates nor disproves Why–How–What; comparative testing remains necessary before universal performance claims.
2. Ordinary files as the canonical, person-controlled layer. Filesystem research warns about agent-authored organization without weakening human authority over canonical artifacts.
3. The division between bounded model judgment, deterministic enforcement, and consequential human authority. Current work strengthens the contracts among these layers without replacing them with unrestricted autonomy or rigid deterministic interpretation.
4. Distinct cognitive modes as contextual and operational views. Research does not dictate the exact taxonomy or require separate agents, and it provides no basis for collapsing thinking, writing, editing, planning, structure, and review into one undifferentiated role.
5. Local-first operation with selective frontier use. Existing evidence cannot quantify local workload coverage, while remaining compatible with an architecture that is neither fully local nor centrally dependent.

6. Where the evidence connects to AIOS

7. Relationships across research programs

1. Benchmarking and model routing: Operation-aware context, verifier quality, disclosure boundaries, and total-system cost become routing variables and evaluation constraints.
2. Files, metadata, and relationship architecture: The distinction between canonical files and derived graph or memory claims depends on identity, provenance, synchronization, conflict, and rebuild semantics.
3. Roles, workflows, and cognitive modes: Evidence for modular prompts and typed harness contracts connects to the faculty taxonomy only when benefits from role meaning, added compute, independent sampling, and authority separation are isolated.
4. Human authority, governance, and safety: Bounded semantic judgment and staged integration connect to approval, accountability, reversibility, audit, and automation bias, especially when a context attack produces delayed memory effects.
5. Local-first infrastructure, privacy, and collaboration: Conditional workload and infrastructure implications depend on device capability, data egress, accepted shared ground, regulated deployment, peer exchange, accessibility, and lifecycle cost.

8. Priority source set

• 2026 — ACE; peer-reviewed ICLR paper following an earlier preprint. Supports the claim that incremental, indexed context updates can outperform repeated monolithic rewriting in bounded, feedback-rich settings. OpenReview
• 2025 — LongMemEval; peer-reviewed ICLR paper. Supports the claim that retained histories do not by themselves provide reliable continuity and that temporal, session-aware retrieval can improve sustained-interaction memory. ICLR proceedings
• 29 July 2026 — Filesystem-Based Memory for LLM Agents; recent preprint. Supports the caution that agent-authored memory organization can reduce retrieval cost yet degrade answer quality and structural sustainability relative to simple verbatim storage. arXiv
• 2025 — NoLiMa; peer-reviewed ICML paper. Supports the claim that long-context retrieval can fail sharply when relevance depends on semantic association rather than lexical overlap. PMLR
• November 2025 — Context Length Alone Hurts LLM Performance Despite Perfect Retrieval; peer-reviewed Findings paper. Supports the claim that increased context length can degrade task performance even when answer-relevant evidence is already perfectly identified. ACL Anthology
• 2025 — HoloBench; peer-reviewed ICLR paper. Supports the claim that relevant-information volume and operation complexity can matter more than raw input length in holistic document reasoning. ICLR proceedings
• 6 June 2025, revised 22 February 2026 — GraphRAG-Bench; preprint. Supports the claim that graph retrieval gains are conditional and may carry large prompt, redundancy, and latency costs. arXiv
• 2025 — Scaling LLM Test-Time Compute Optimally; peer-reviewed ICLR paper. Supports the claim that adaptive inference allocation can outperform a fixed compute policy in selected verifiable reasoning settings. ICLR proceedings
• 2025 — Is Best-of-N the Best of Them?; peer-reviewed ICML paper. Supports the claim that more candidates can reduce selected-answer quality when the evaluator is imperfect. PMLR
• 2024 — SWE-agent; peer-reviewed NeurIPS paper. Supports the claim that purpose-built file and execution interfaces materially alter realized model capability. NeurIPS proceedings
• 2025 — τ-bench; peer-reviewed ICLR paper. Supports the claim that dialogue, policy compliance, tool use, and correct end state remain unreliable even when an agent sometimes succeeds. ICLR proceedings
• 2024 — AgentDojo; peer-reviewed NeurIPS benchmark paper. Supports the claim that untrusted content retrieved during tool use creates material prompt-injection exposure and that utility and security remain jointly unresolved. NeurIPS proceedings
• 24 March 2025 — CaMeL; vendor/academic preprint. Supports the bounded design claim that trusted control flow and capability-governed effects can be separated from untrusted data within a modeled tool system. arXiv

9. Open research and design questions

1. How should system-level intelligence be tested as both an organizing definition and a falsifiable architectural proposition?
2. Which derived objects—summaries, relationships, procedures, preferences, or task memories—may be proposed automatically; which may receive accepted standing under a bounded governing process; and which must remain rebuildable projections?
3. Does the Fractal Seed require one cross-domain comparative evaluation or separate evaluations for composition, workflow, document structure, and knowledge evolution?
4. What evidence would establish meaningful local workload coverage, private cognition, selective frontier use, and reduced application dependence?
5. What minimum contract should govern every cognitive role and routed model call: context boundary, provenance, authority, budget, validator, escalation path, and integration destination?