Context Engineering as Content Composition

Evidence, limits, and possible implications for AIOS

This memo reviews work published or materially updated from August 2024 through August 2026, with older research confined to a separately labeled foundational lineage. Its scope includes long-context systems, agent memory, inference-time computation, compound AI systems, and human-governed knowledge environments.

Executive synthesis

The strongest recent evidence supports a view of context engineering as construction and maintenance of a task-specific working state, not merely the writing of a long prompt. In the most capable systems, that state may include instructions, retrieved evidence, prior episodes, compressed strategies, tool schemas, execution traces, permissions, intermediate artifacts, and explicit output contracts. Context therefore behaves less like an inert string and more like a composed, partially persistent program state.

That broad idea is no longer distinctive. By 2025–2026, research systems routinely separate retrieval from reading, maintain external memory, optimize instructions and demonstrations, use reflection or curation roles, search over reasoning trajectories, organize context hierarchically, and evaluate the model together with its tool harness. The literature also makes clear that none of these ingredients is reliably beneficial in isolation. Longer context can reduce performance even when retrieval is perfect; graph construction can add large prompt and latency costs; persistent memory can preserve mistakes; recursive inference can produce extreme cost outliers; and a plausible agent trajectory can still fail to affect the correct file, tool, or final artifact.

The recent evidence is especially strong on six points:

1. Nominal context-window size is not effective usable context. Performance depends on information density, distribution, task complexity, aggregation demands, and model-specific positional behavior. Several 2025 benchmarks show substantial deterioration well inside advertised limits.
2. Memory is an active write-policy problem. Systems must decide what to retain, how to structure it, when to revise it, how to handle conflict, and how to keep untrusted observations from becoming durable instructions. Retrieval alone does not solve these problems.
3. Hierarchical and recursive composition are useful techniques, not general guarantees. They can extend reach and improve some tasks, but their benefit depends on decomposition quality, stopping rules, verification, and selection.
4. Test-time scaling is conditional. Additional samples, reflection, search, or recursive calls help when the system has useful coverage and a sufficiently reliable evaluator. More computation can amplify reward-model error or simply increase cost.
5. The model–harness pair is the operative unit. Interfaces, file tools, state transitions, validators, permissions, and integration logic can change results as much as the underlying model.
6. Governance belongs inside context architecture. Prompt injection, tool misuse, memory poisoning, identity leakage, and cascading actions cannot be treated as post hoc content-filtering problems. Trusted and untrusted information, decision and execution authority, and reversible and irreversible operations must be separated structurally.

Against that background, AIOS appears potentially distinctive as a composition of constraints, not because any individual mechanism is new. A recursive Why–How–What grammar, composed semantic situations, ordinary files as canonical sources and artifacts, companion metadata, bounded model judgments, exact operations, governed integration, and preserved human authority have close neighbors in the literature. What is less standard is their proposed conjunction: a person-controlled, file-canonical environment in which models may propose, retrieve, relate, and transform knowledge but do not silently become its final authority.

That distinctiveness is architectural and normative at present. The reviewed evidence does not establish that AIOS improves reasoning accuracy, continuity, safety, or user agency. It identifies plausible design hypotheses and, just as importantly, failure modes an evaluation program would need to test.

The AIOS thesis analysis distinguishes present evidence from architectural thesis and implication. Bounded semantic judgment combined with deterministic authorization, validation, and execution is already a supportable pattern for consequential operations, and capability should often be attributed to the complete model–harness system. The more ambitious thesis is prospective: increasingly capable local models, mature context and memory scaffolding, ordinary person-owned files, and selective access to frontier models could satisfy a large share of recurring personal and organizational reasoning while moving durable expertise and authority away from centralized applications. Many individually modest improvements—purpose framing, context composition, cognitive-mode-specific views, memory, provenance, verification, and integration—may have a consequential cumulative effect on retries, inference burden, and unsupported output; that joint effect is not yet established by the component studies. Dynamic model choice could then reflect capability, privacy, latency, cost, sensitivity, and cognitive mode rather than defaulting every task to one model. Current studies do not yet quantify the resulting workload share or infrastructure shift, but they identify mechanisms that make the thesis technically coherent and failure modes that determine its conditions. Insufficient context remains only one failure source among many.

1. Scope, method, and evidentiary conventions

This memo prioritizes peer-reviewed conference and journal work, accepted 2026 papers with public proceedings or OpenReview records, and authoritative security guidance. Preprints and vendor-authored evaluations are included only where they address very recent systems or expose a methodological issue not yet represented in peer-reviewed work.

Each major source is reported using the same fields:

• Research question — what the study actually asks.
• Method — models, tasks, samples, or benchmark design.
• Principal finding — the result most relevant to this memo.
• Limitations — threats to interpretation or transfer.
• Relevance — what the work does and does not imply for AIOS.

“Evidence” below refers to the source’s reported result. “Interpretation” marks a synthesis or design inference made in this memo. Adjacency is not validation: a memory benchmark, for example, can motivate a design test without validating AIOS’s memory design.

2. What “context as content composition” can mean

Recent work uses context engineering broadly. A useful research decomposition is:

1. Selection: choose instructions, evidence, memories, tools, policies, and prior outputs.
2. Transformation: summarize, structure, tag, rank, deduplicate, or expand that material.
3. Arrangement: decide ordering, grouping, hierarchy, provenance, and trust boundaries.
4. Execution: let a model reason, call tools, inspect results, and create intermediate state.
5. Integration: verify and commit acceptable changes to durable artifacts or memory.
6. Evolution: revise retained knowledge and strategies across episodes.
7. Governance: constrain who or what may read, propose, write, execute, or approve.

The 2025 preprint A Survey of Context Engineering for Large Language Models organizes the emerging area around context retrieval and generation, context processing, and context management, then connects these functions to retrieval-augmented generation, memory, tool use, and multi-agent systems. Its taxonomy is useful evidence that the field’s vocabulary has broadened beyond prompt wording. It is not an empirical demonstration, a stable consensus definition, or evidence for a particular architecture.

Interpretation. “Content composition” is a defensible name for the combined selection, transformation, arrangement, and integration process. It becomes more than prompt construction only when provenance, state transitions, write policies, and authority are represented explicitly. Otherwise the phrase risks redescribing ordinary prompt assembly.

3. Optimizing and evolving context

3.1 MIPRO: optimizing instructions and demonstrations

Status: Peer-reviewed, EMNLP 2024.

Research question. Can a multi-stage language-model program be optimized jointly over free-form instructions and few-shot demonstrations rather than tuned one prompt at a time?

Method. MIPRO proposes candidate instructions and demonstrations for each module, then uses minibatch evaluation, a surrogate model, and Bayesian optimization to allocate trials and infer credit across program components. The paper evaluates seven multi-stage programs, primarily with Llama 3 8B.

Principal finding. MIPRO reports the best result on five of seven tasks and gains of as much as 13 percentage points. The important result is not simply that “better prompts help,” but that a compound program’s context can be treated as a jointly optimized configuration.

Limitations. Optimization depends on a representative metric and development set. Candidate search can overfit, and the resulting prompts may be model- or task-specific. The study does not address persistent memory, adversarial context, human approval, or live knowledge evolution.

Relevance. MIPRO makes modular prompt/program optimization standard prior art. It supports testing context components separately and jointly. It does not support a fixed universal grammar or show that optimized prompts remain valid as files, policies, and tasks evolve.

3.2 TextGrad: natural-language feedback as an optimization signal

Status: Peer-reviewed, Nature, 2025.

Research question. Can textual criticism function as a general optimization signal for prompts and compound generative systems?

Method. TextGrad propagates natural-language feedback through a computation graph and uses it to revise prompts or intermediate components. Experiments span question answering, scientific problem solving, coding, radiotherapy planning, molecule design, and agent-like systems.

Principal finding. The paper reports improvements across heterogeneous tasks and demonstrates that optimization can target multi-component systems, not only final-answer prompts.

Limitations. A textual “gradient” is an analogy, not a mathematical gradient with comparable convergence guarantees. Results depend on critic quality, task-specific evaluators, and protection against evaluation leakage. The experiments do not establish safe autonomous evolution in a durable knowledge store.

Relevance. TextGrad supports explicit critique-and-revision interfaces and makes evaluator quality a first-class concern. It does not show that self-critique is reliably truthful or that a model should be permitted to commit its own revisions.

3.3 GEPA: reflective prompt evolution

Status: Accepted at ICLR 2026; initially released as a 2025 preprint.

Research question. Can natural-language reflection over complete trajectories optimize prompts more sample-efficiently than reinforcement learning or earlier prompt optimizers?

Method. GEPA inspects reasoning traces, tool outputs, and evaluator feedback, proposes prompt mutations, and maintains a Pareto frontier of candidates. It is evaluated on six tasks against GRPO and MIPROv2.

Principal finding. GEPA reports an average gain of roughly six points over GRPO, improvements of up to 20 points, and at most one-thirty-fifth the rollouts in the compared settings. It also reports more than ten points over MIPROv2 and a 12-point gain on AIME 2025.

Limitations. “Outperforming reinforcement learning” is scoped to the selected GRPO configurations and tasks. GEPA still requires evaluation data and a useful judge, can overfit to that judge, and does not resolve provenance, permissions, or durable-memory corruption.

Relevance. The work shows that execution traces can be converted into improved context without weight updates. Reflector and optimizer roles are now recognizable patterns, not distinctive by themselves. The open system question is who may accept a proposed change, against which evidence, and into which durable layer.

3.4 Dynamic Cheatsheet: test-time learning through adaptive memory

Status: Peer-reviewed, EACL 2026.

Research question. Can a model improve at test time by maintaining a compact, self-curated memory of reusable strategies, formulas, and code without changing its weights?

Method. Dynamic Cheatsheet updates persistent memory as problems are solved and tests it on AIME 2020–2025, Game of 24, equation balancing, GPQA Diamond, and engineering and physics subsets of MMLU-Pro.

Principal finding. Reported gains are large in several settings: Claude’s AIME accuracy more than doubles, GPT-4o rises from roughly 10% to roughly 99% on Game of 24, and Claude gains about nine points on GPQA Diamond and eight on the selected MMLU-Pro subjects.

Limitations. The tasks have reusable, compact solution regularities and objective feedback. Results may be affected by sequence and benchmark reuse. Self-curated memory can preserve an incorrect generalization; the paper does not study adversarial writes, conflicting sources, privacy, or human review.

Relevance. The paper is good evidence that external procedural memory can produce test-time adaptation. It is weak evidence for broad personal or organizational memory, where truth is contested, updates can supersede one another, and no immediate answer key exists.

3.5 ACE: evolving playbooks without context collapse

Status: Accepted at ICLR 2026; initially released as a 2025 preprint.

Research question. Can an agent evolve a detailed context or “playbook” incrementally while avoiding the information loss caused by repeated full rewrites?

Method. Agentic Context Engineering separates three functions: a Generator produces trajectories, a Reflector extracts lessons, and a Curator converts them into small updates to indexed bullet entries. Deterministic merge logic preserves the rest of the context. The study uses AppWorld agent tasks, FiNER and Formula as its main financial benchmarks, and medical-reasoning and text-to-SQL extensions, with both offline and online adaptation.

Principal finding. ACE reports average gains of 10.6% on agent tasks and 8.6% on finance tasks, with up to 17.1% on AppWorld. It reports substantial latency and rollout reductions against selected baselines. A diagnostic example illustrates “context collapse”: rewriting an 18,282-token playbook into 122 tokens reduces subsequent accuracy from 66.7% to 57.1%, below a 63.7% baseline. Incremental edits preserve detailed lessons more effectively than monolithic rewriting in the tested settings.

Limitations. The system depends on reliable answer keys, execution traces, or external feedback. The authors report that when feedback is absent or unreliable, accumulated errors can degrade the context. Tasks are bounded and machine-gradable; long-horizon adversarial memory, conflicting human authority, and multi-user provenance are not evaluated.

Relevance. ACE provides unusually direct evidence for delta-based, inspectable context evolution and against repeated total summarization. This is relevant to exact edits and companion metadata. It does not establish that the evolved playbook is true, secure, or appropriate to grant accepted standing.

Synthesis: optimization is becoming standard, promotion remains open

Evidence. MIPRO, TextGrad, GEPA, Dynamic Cheatsheet, and ACE collectively show that prompts, examples, strategies, and multi-stage context can be optimized without updating the base model. They also show that modular feedback and incremental updates can outperform a single rewrite.

Interpretation. The unresolved architectural issue is not whether context can evolve; it can. The issue is promotion authority: how a provisional lesson becomes a durable instruction, fact, relationship, or procedure. AIOS would be making a stronger contribution if it specifies promotion, supersession, rollback, and human approval at the file and metadata level rather than merely adding another reflection loop.

4. Persistent memory and continuity

4.1 LongMemEval: sustained-interaction memory

Status: Peer-reviewed, ICLR 2025.

Research question. How well do long-context assistants remember information across extended multi-session interactions, including updates and temporal relationships?

Method. LongMemEval contains 500 manually curated questions embedded in scalable chat histories. It tests information extraction, multi-session reasoning, temporal reasoning, knowledge updates, and abstention. The accompanying framework separates indexing, retrieval, and answer generation and tests session decomposition, fact-key expansion, and time-aware query expansion.

Principal finding. Commercial and long-context assistants show an average performance decline of about 30% in sustained settings. Explicit session-level indexing and time-aware retrieval improve results.

Limitations. The benchmark is small and centered on chat histories rather than heterogeneous files, projects, or organizations. It evaluates answer recall, not authority, provenance quality, privacy, or whether remembered content should remain in force.

Relevance. LongMemEval directly undermines the assumption that simply retaining a transcript creates reliable continuity. It supports time-aware indexing and explicit update semantics. It does not favor a particular storage substrate.

4.2 A-MEM: linked atomic notes

Status: Peer-reviewed, NeurIPS 2025.

Research question. Can an agent create a more useful long-term memory by organizing observations as evolving, linked notes rather than a flat store?

Method. A-MEM draws on Zettelkasten-style note making. It creates atomic memory notes with contextual descriptions, keywords, and tags; forms links dynamically; and may update existing notes when new observations arrive. The study evaluates six foundation models on long-term conversational-memory benchmarks including LoCoMo and DialSim.

Principal finding. The authors report state-of-the-art results across the tested models and tasks, suggesting that agent-generated attributes and links can improve retrieval and use of past information.

Limitations. The same model family that interprets an observation may also invent its descriptors and relationships. The evaluation is narrow compared with a live file system, and it does not test authoritative conflict resolution, malicious memory writes, or sustained human editing of the same store.

Relevance. A-MEM is close prior art for memory as evolving notes plus an emergent relationship graph. It does not test a design in which ordinary files remain canonical and model-created metadata remains a subordinate companion layer; that comparison requires direct empirical study.

4.3 Filesystem-Based Memory for LLM Agents

Status: Preprint, July 2026; very recent and not yet independently replicated.

Research question. When agents use a shared filesystem as long-term memory, how do organization, model strength, tool design, and repeated use affect retrieval quality, cost, and store health?

Method. The paper separates a memory manager, a search agent, and an execution agent around a common filesystem. It compares agent-organized hierarchies, verbatim session storage, and chunk retrieval; evaluates conversational memory on LoCoMo, PersonaMem, and REALTALK; and evaluates procedural learning over 140 held-out ALFWorld tasks. It varies stream scale, model strength, and available file/search tools.

Principal finding. Organized stores can roughly halve retrieval cost at scale, but none of the tested agents reliably turns organization into better answers. Hierarchies and taxonomies erode except under the strongest manager. Simple folders containing raw sessions are often both strong and cheap. One reported PersonaMem setting falls to 37.5 for a curated store versus 78.1 for verbatim memory. Tool design changes the structure of the memory almost as much as model choice.

Limitations. This is a new preprint with some LLM-based judging, narrow benchmarks, and limited repeated trials. The filesystem is an agent substrate, not a study of user-owned canonical files, collaborative authorship, privacy, or local-versus-remote execution. The result should be treated as an important warning, not a settled verdict.

Relevance. This is the most direct recent evidence bearing on file-native continuity. It establishes neither that files are inferior nor that organization is useless. It shows that agent-authored organization is not automatically epistemically beneficial and can silently decay. Organizational metadata should therefore be evaluated for retrieval quality, maintenance burden, divergence from source files, and recoverability—not assumed to help because it is legible.

4.4 MemBench: separating kinds and costs of memory

Status: Peer-reviewed, Findings of ACL 2025.

Research question. Can agent memory be evaluated across factual and reflective content, participation and observation modes, and efficiency as well as accuracy?

Method. MemBench defines several memory competencies and reports effectiveness, efficiency, and capacity measures across memory systems.

Principal finding. Different systems perform differently across memory types and access modes; a single retrieval-accuracy score does not characterize memory quality.

Limitations. Benchmark categories remain proxies for real continuity, and they do not capture governance or user comprehension of the evolving store.

Relevance. “Memory quality” should not be treated as one undifferentiated metric. Factual recall, procedural reuse, temporal update handling, abstention, storage growth, retrieval cost, provenance, and human correction are separate outcomes.

Synthesis: file-native continuity is a hypothesis with trade-offs

Evidence. External memory can improve long-running performance, but organization is fragile and self-curation can create durable errors. Time-aware retrieval, explicit updates, and incremental edits help in bounded settings. A filesystem makes memory inspectable and tool-accessible, but does not make it correct.

Interpretation. “Memory in files” is increasingly common and is not, by itself, a distinctive research contribution. A less tested design variable is an authority model for files: ordinary files as user-controlled canonical artifacts; generated summaries, links, and playbooks as revisable companion layers; and explicit promotion or integration into the canonical layer. Research should test whether this arrangement improves correction, provenance, portability, and user control without imposing prohibitive maintenance or retrieval costs.

5. Long-context and document-level failure modes

5.1 NoLiMa: retrieval without lexical overlap

Status: Peer-reviewed, ICML 2025.

Research question. Do long-context models still retrieve and use a relevant fact when the query and target passage share little or no lexical overlap?

Method. NoLiMa constructs needle-in-a-haystack tasks in which success requires latent association rather than matching query terms. It evaluates 13 models advertised with context windows of at least 128K tokens.

Principal finding. At 32K tokens, eleven of thirteen models fall below half of their strong short-context baseline. One reported example is GPT-4o declining from 99.3% to 69.7%. Models that pass ordinary lexical needle tests can fail when semantic association is required.

Limitations. The benchmark remains synthetic and isolates a narrow retrieval-plus-association operation. It does not reproduce document authoring, contradictory evidence, or whole-project synthesis.

Relevance. Exact keyword search and embedding retrieval are complementary. A model cannot be assumed to discover a conceptually relevant file merely because the file is present in a long context. Relationship metadata may help, but it can also mislead and must be benchmarked.

5.2 Context Length Alone Hurts LLM Performance Despite Perfect Retrieval

Status: Peer-reviewed, Findings of EMNLP 2025.

Research question. If the relevant evidence is already perfectly identified, does increasing surrounding context still reduce performance?

Method. The authors test five open and closed models on mathematics, question answering, and code tasks. They add semantically irrelevant material, whitespace, or masked tokens while preserving perfect access to the answer-relevant content.

Principal finding. Performance deteriorates by 13.9% to 85% within claimed context windows. Degradation occurs even with whitespace or masked irrelevant tokens, isolating a cost associated with length itself rather than retrieval failure alone.

Limitations. Five models and selected tasks cannot establish a universal mechanism. The experiment shows the effect, not whether it arises from attention allocation, positional encoding, inference implementation, or learned behavior.

Relevance. “Retrieve everything and let the model sort it out” is not a safe composition policy. Context budgets, staging, and focused views remain necessary even when storage is abundant.

A lower-weight but useful corroboration is Chroma's vendor-authored Context Rot technical report, which tests 18 open and closed models across controlled retrieval and memory tasks and likewise finds nonuniform, model-specific decline as input grows. Its synthetic tasks, transient API versions, and lack of peer review make it inappropriate as primary evidence; its value is that a differently constructed evaluation reaches the same caution against treating nominal window size as usable capacity.

5.3 HoloBench: holistic operations over massive textual data

Status: Peer-reviewed, ICLR 2025.

Research question. How do context length, relevant-information volume, distribution, and query complexity affect global reasoning over large textual collections?

Method. HoloBench turns database-like operations into controlled textual reasoning tasks and independently varies total length, amount and position of relevant information, and operation type, including aggregation, extrema, and grouping.

Principal finding. The amount of relevant information matters more than raw length, and query complexity matters more than information amount. Aggregation degrades with scale; maximum and minimum operations are easier. Grouping relevant material often helps, but the best location varies by model.

Limitations. Database operations in synthetic text are cleaner than real documents with uncertain entities, citations, revisions, and mixed media. Positional findings may change with newer models.

Relevance. The study supports semantic grouping and staged aggregation but rejects a single universal placement rule. A composition engine should describe the demanded operation—not only retrieve passages—and select a strategy accordingly.

5.4 LongBench v2: realistic long-context reasoning

Status: Peer-reviewed, ACL 2025.

Research question. How well do current models reason over long, difficult inputs across documents, dialogue, code repositories, in-context learning, and structured data?

Method. LongBench v2 contains 503 multiple-choice questions with contexts from 8K to two million words across six task categories. Nearly 100 highly educated contributors with diverse professional backgrounds help construct or validate the tasks. The study compares direct answering and reasoning-oriented models with time-limited human performance.

Principal finding. Time-limited experts achieve 53.7%; the best direct model reaches 50.1%, and o1-preview reaches 57.7%. The task remains difficult even when many items are below 128K tokens, indicating that reasoning and information structure, not only window size, drive difficulty.

Limitations. Multiple-choice scoring can conceal unsupported reasoning. The 15-minute human condition is not a human ceiling. Results age quickly, and the benchmark still entangles retrieval, comprehension, and reasoning.

Relevance. Cross-document reasoning needs process-level evaluation—evidence selection, contradiction handling, provenance, and synthesis—not only final-answer accuracy.

5.5 BrowseComp: cross-source search and verification

Status: Vendor-authored benchmark report, OpenAI, April 2025; not independent peer review.

Research question. Can browsing agents locate obscure facts whose clues are dispersed across the web and whose answers are hard to find but comparatively easy to verify?

Method. BrowseComp contains 1,266 short-answer questions designed to resist simple search. Human trainers constructed questions around stable, verifiable answers; reported model evaluations include non-browsing and browsing systems, and a separate experiment aggregates 64 attempts per question.

Principal finding. GPT-4o scores 0.6%, GPT-4o with browsing 1.9%, and o1 without browsing 9.9%; the specialized Deep Research system reaches 51.5%. Majority voting, confidence-weighted voting, and best-of-N over repeated attempts improve performance by 15% to 25% in the reported experiment. The contrast indicates that tool access alone is insufficient and that search strategy, reasoning, persistence, and selection all contribute.

Limitations. Answers are deliberately short, stable, and unambiguous, unlike most research synthesis. The Deep Research system was explicitly trained to perform well on BrowseComp-style tasks, making the 51.5% result unsuitable as a clean generalization estimate. The report is vendor-authored and model versions are transient.

Relevance. Cross-document research benefits from iterative search and answer verification, but BrowseComp does not test balanced synthesis, source disagreement, or durable knowledge integration. It supports evaluating research as a trajectory rather than assuming that retrieval quality alone determines the final memo.

5.6 Putting It All into Context: a useful counterexample

Status: Preprint and ICLR 2026 submission; the public OpenReview record does not show conference acceptance.

Research question. Can a long-context model solve software-engineering tasks with a simpler agent by receiving most or all of the repository at once?

Method. The study packages repository context for Gemini long-context models on SWE-bench and compares relatively simple context-heavy agents with more elaborate scaffolds.

Principal finding. A Gemini 1.5 Pro configuration reaches 38%, compared with 32% for selected scaffold baselines; Gemini 2.5 Pro reaches 50.8%, while a tested two-stage variant reaches 48.6%. In this setting, larger direct context sometimes simplifies the agent and avoids lossy retrieval.

Limitations. The result is concentrated in one task family and model lineage. Whole-repository packaging is not persistent memory, and the study does not show that maximal context is best for all tasks or that the simplest agent beats the strongest contemporary scaffold. As of this memo's cutoff, it should not be described as peer-reviewed conference evidence.

Relevance. This is important counterevidence against assuming that hierarchical decomposition is always superior. Composition should be adaptive: direct whole-artifact context may be preferable when the corpus fits, dependencies are dense, and the model handles the format well.

Synthesis: effective context is task-relative

Evidence. Long-context failures occur at retrieval, association, aggregation, and reasoning stages. Raw length can hurt even after perfect retrieval. Yet whole-context strategies can outperform selective scaffolds in some repository tasks.

Interpretation. The correct unit is neither “the full corpus” nor “the top-k chunks” by default. It is a task-relative semantic situation: purpose, required operations, trusted policies, evidence set, relationships, current state, and output contract. That idea is consistent with the evidence, but the exact AIOS construct remains a design hypothesis until operationalized and compared against strong whole-context and retrieval baselines.

6. Graph, hierarchical, and recursive composition

6.1 HippoRAG 2: graph-based long-term memory

Status: Peer-reviewed, ICML 2025.

Research question. Can a graph-based retrieval system support factual recall, associative multi-hop reasoning, and broader sense-making more effectively than dense retrieval alone?

Method. HippoRAG 2 combines passage nodes, LLM-extracted entities and relations, dense and sparse signals, a recognition-memory filter, and Personalized PageRank. It is tested on Natural Questions, PopQA, MuSiQue, 2WikiMultiHopQA, HotpotQA, LV-Eval, and NarrativeQA.

Principal finding. The paper reports gains across factual and sense-making tasks and about a seven-point improvement on associative tasks over a strong embedding baseline.

Limitations. Offline LLM extraction can create a noisy or incomplete graph; entity resolution and filtering errors propagate into ranking. The corpora are largely fixed benchmarks, not mutable personal knowledge with competing authors and permissions.

Relevance. Graph traversal can complement exact and vector retrieval where relationships carry useful evidence. It does not imply that all knowledge should be converted into a graph or that generated edges deserve the same authority as source files.

6.2 GraphRAG-Bench: when graphs help and when they cost

Status: Preprint, June 2025; materially revised February 2026; not yet independently settled.

Research question. Under what task conditions do GraphRAG systems improve over conventional retrieval, and where do graph construction and serialization create overhead?

Method. GraphRAG-Bench evaluates seven graph-based frameworks on factual, reasoning, summarization, and creative tasks over a medical guideline corpus and novels. It also measures retrieval-stage and prompt-level pipeline behavior.

Principal finding. Benefits are conditional rather than universal. Some graph systems create very large prompt payloads: reported global GraphRAG prompts range from tens to hundreds of thousands of tokens in evaluated settings, whereas HippoRAG 2 uses a much smaller retrieved context. Complexity can increase redundancy and latency rather than improve answers.

Limitations. The benchmark is a preprint, uses two main corpus types, relies partly on LLM judging, and often uses GPT-4o-mini. A benchmark designed to expose graph behavior does not establish deployment-wide averages.

Relevance. A metadata-emergent graph should be treated as an index and hypothesis layer, not an automatically superior representation. Edge provenance, confidence, staleness, token cost, and fallback to exact file search should be measurable.

6.3 Recursive Language Models

Status: Preprint, December 2025; recent and not independently replicated.

Research question. Can a model process inputs much larger than its context window by treating the input as an external variable, inspecting it programmatically, and calling itself recursively on selected portions?

Method. The model works in a Python environment, peeks at or partitions a long prompt, and invokes subordinate model calls. Experiments use GPT-5 and Qwen3-Coder on BrowseComp+, OOLONG, OOLONG-Pairs, and LongBench v2 CodeQA, including inputs exceeding ten million tokens.

Principal finding. The paper reports double-digit improvements on several long-context tasks and processes inputs roughly two orders of magnitude beyond base context windows, often at comparable or lower median cost than long-context baselines.

Limitations. Some trajectories create thousands of calls and severe cost or runtime outliers. Behaviors differ substantially by base model. The tasks reward partitioning and aggregation, and the phrase “arbitrarily long” describes addressability rather than guaranteed comprehension. The work is a preprint using frontier systems that may change.

Relevance. Recursive composition is technically credible as an inference pattern. It does not validate Why–How–What as the right recursive grammar. Any deployed recursion policy needs budgets, termination rules, provenance of subresults, and integration checks.

Synthesis: hierarchy is a control strategy, not an ontology of truth

Evidence. Graph traversal, hierarchical summaries, and recursive calls can extend reach, especially for associative or decomposable tasks. They also introduce lossy transformations, noisy edges, coordination overhead, and cost variance.

Interpretation. Three uses of hierarchy should be distinguished:

• Representational hierarchy: how files, concepts, and summaries are organized.
• Computational hierarchy: how a task is decomposed into subcalls or subplans.
• Authority hierarchy: who may propose, verify, approve, and commit a change.

The literature often studies the first two and leaves the third implicit. Treating them as separate layers would be a meaningful architectural clarification.

7. Test-time and inference-time scaling

7.1 Scaling LLM Test-Time Compute Optimally

Status: Peer-reviewed, ICLR 2025.

Research question. Given a fixed inference budget, when should a system spend computation on sampling and search versus iterative revision, and how should it allocate that budget by problem difficulty?

Method. The study compares best-of-N-style search guided by process reward models with adaptive revision on mathematics tasks using PaLM 2 models. It estimates difficulty and changes the test-time strategy accordingly.

Principal finding. The best strategy depends on the prompt. Adaptive allocation is reported to be more than four times as efficient as a fixed best-of-N baseline in selected settings, and a smaller model can outperform a model 14 times larger when the smaller model already has nontrivial success probability.

Limitations. The experiments are mathematics-heavy and depend on process reward models. The conclusions do not automatically transfer to open-ended research, file editing, policy interpretation, or tasks without objective verification.

Relevance. A reasoning system should allocate effort according to uncertainty, consequence, and available verification rather than attach the same deliberation loop to every request.

7.2 Is Best-of-N the Best of Them?

Status: Peer-reviewed, ICML 2025.

Research question. Does increasing the number of generated candidates monotonically improve selected answers when the reward model is imperfect?

Method. The paper provides theoretical analysis and experiments on selection under reward-model error, then proposes an inference-time pessimistic selection method intended to preserve monotonic scaling under stated assumptions.

Principal finding. Naive best-of-N can become non-monotonic: more samples increase the opportunity to exploit evaluator error. The proposed pessimistic method improves robustness in the studied conditions.

Limitations. Guarantees depend on assumptions about error and candidate distributions. A formal selector does not solve unverifiable tasks or hidden downstream consequences.

Relevance. “More reasoning” is not inherently safer or more accurate. Candidate diversity and judgment must be bounded by evidence and validators; otherwise scaling amplifies specification error.

7.3 Knowledge-intensive scaling remains unsettled

Status: Preprint, September 2025; not peer reviewed.

Research question. Do the benefits reported for inference-time scaling on mathematics and symbolic reasoning transfer to knowledge-intensive question answering?

Method. Test-Time Scaling in Reasoning Models Is Not Effective for Knowledge-Intensive Tasks Yet evaluates 12 reasoning models on two knowledge-intensive benchmarks and compares reasoning-oriented inference with direct baselines and additional test-time scaling.

Principal finding. Reasoning-oriented models can outperform direct baselines, but the tested scaling interventions yield limited additional improvement. Extra computation does not reliably compensate for absent, stale, or poorly retrieved knowledge.

Limitations. The benchmark set is narrow, knowledge-intensive tasks are heterogeneous, and the paper is a preprint without independent replication. The result does not establish that scaling is ineffective for every retrieval-rich task or with future verifiers and search policies.

Relevance. Inference budget should not be treated as a substitute for evidence quality. A context system needs to diagnose whether a failure requires more computation, better retrieval, a different model, or human/domain input.

7.4 Test-Time Scaling in Reasoning LLMs: reporting the inference system

Status: Preprint, 4 August 2026; extremely recent and not independently replicated.

Research question. Can test-time scaling methods be described and evaluated in a common framework that makes different inference protocols and compute budgets comparable?

Method. The paper formalizes inference over an autoregressive prefix tree and distinguishes single-trajectory sequential scaling, leaf-level sampling with terminal reduction, and search over partial prefixes. It proposes protocol-matched reporting, separates end-to-end system outcomes from candidate-bank diagnostics, discusses exact versus distributional reproducibility, evaluates broad-knowledge, symbolic, and competition-mathematics settings, and reports assembling more than two billion reasoning traces.

Principal finding. The paper's main contribution is methodological rather than a new winning algorithm: “test-time compute” is not one scalar intervention. Reported performance is inseparable from the inference regime, stopping rule, reducer or verifier, uncertainty reporting, and replay artifacts.

Limitations. This is a new preprint whose large trace collection does not itself validate the proposed taxonomy or guarantee cross-laboratory reproducibility. Its framework is also centered on reasoning traces rather than file mutation, memory evolution, or human review.

Relevance. Evaluations should record the full inference protocol—model, context construction, branching, budgets, tools, verifier, termination, and integration—not attribute the outcome to a model or to “more thinking” in the abstract.

Synthesis: scale judgment, not only generation

Evidence. Inference-time compute can substitute for model scale on some tasks, but its return depends on difficulty estimation and evaluator quality. Naive expansion can reward-hack the selector.

Interpretation. A general intelligence harness should scale at least four things independently: evidence gathering, decomposition, candidate generation, and verification. For high-impact file operations, the final decision may need a human even if intermediate reasoning is heavily scaled.

8. Harnesses, exact operations, and integration

8.1 SWE-agent: file and execution interfaces

Status: Peer-reviewed, NeurIPS 2024.

Research question. How much does a purpose-built agent–computer interface affect a model's ability to change a repository correctly?

Method. SWE-agent gives a language-model agent specialized operations for repository navigation, file creation and editing, and program and test execution. It evaluates the resulting system on SWE-bench and HumanEvalFix.

Principal finding. The paper reports pass@1 results of 12.5% on SWE-bench and 87.7% on HumanEvalFix, then state of the art, and attributes substantial gains over noninteractive baselines to interface design.

Limitations. The benchmarks are software-specific, the absolute SWE-bench rate is low, and model and benchmark versions have since advanced. A well-designed editing interface does not by itself establish correctness, governance, or user control.

Relevance. Exact read, search, edit, and execution operations are established agent-harness techniques. The open research questions concern their cross-domain transaction, provenance, validation, and authority semantics—not the existence of file tools.

8.2 τ-bench: tools, policy, and repeatability

Status: Peer-reviewed, ICLR 2025.

Research question. Can language agents reliably complete user-facing tasks that require dialogue, policy compliance, API use, and correct changes to an external database?

Method. τ-bench builds retail and airline environments with simulated users, domain policies, APIs, and database end-state checks. It measures both single-run success and pass^k, the probability of succeeding consistently across repeated attempts.

Principal finding. GPT-4o scores below 50% in the reported settings, and retail pass^8 falls below 25%. An agent that occasionally succeeds can remain operationally unreliable.

Limitations. Users are simulated, domains are only two, and policies and APIs are bounded. Real organizations contain more ambiguous authority and changing procedures.

Relevance. Exact state checks and repeatability are essential. A fluent response is not evidence that the requested file or external state was changed correctly. Exact operations are standard harness engineering; their value depends on transaction semantics, validation, and visibility to the user.

8.3 Harness-Bench: model–harness interaction

Status: Preprint, May 2026; not yet independently replicated.

Research question. How much does agent performance depend on the surrounding harness, and what failures arise between plausible reasoning and actual workspace execution?

Method. Harness-Bench contains 106 sandboxed, offline tasks with manually reviewed realism, solvability, oracle-checkability, and integrity. It analyzes 5,194 trajectories across multiple model backends and harness configurations, retaining artifacts, tool traces, usage, and validator outcomes.

Principal finding. Performance varies substantially by model–harness pairing. The paper identifies “execution-alignment” failures in which an agent appears to reason sensibly but does not connect tool feedback, workspace state, evidence, or output requirements to the final result.

Limitations. Task and harness design may favor some interaction styles. The benchmark is new, offline, and not a longitudinal study of real users or knowledge stores.

Relevance. Bounded judgment roles cannot be evaluated only by the quality of their prose. Their inputs, permissible outputs, handoff schema, and downstream integration success must be measured.

8.4 PaperBench: hierarchical evaluation of open-ended work

Status: Vendor-authored benchmark report, OpenAI, April 2025; not independent peer review.

Research question. Can agents replicate machine-learning papers from their descriptions, and can complex open-ended work be scored with hierarchical, author-informed rubrics?

Method. PaperBench uses 20 ICML 2024 Spotlight or Oral papers and 8,316 gradable rubric items developed with paper authors. Agents attempt replication in a code environment; an LLM judge is separately benchmarked against expert assessment.

Principal finding. The best reported agent, Claude 3.5 Sonnet with an open scaffold, completes about 21% of the weighted rubric, far below ML PhD baselines. The benchmark demonstrates decomposition of a complex artifact into inspectable subcriteria.

Limitations. It covers one research domain and 20 papers. Rubrics can privilege anticipated solutions, and the evaluation still relies partly on an LLM judge. Vendor involvement and rapidly changing systems limit generalization.

Relevance. Hierarchical evaluation is useful for document- and project-level reasoning. It is evidence for explicit acceptance criteria, not for any particular recursive content grammar.

8.5 The model and the harness form a compound system

Evidence. τ-bench and Harness-Bench show that tool interfaces, policies, state visibility, validators, and integration paths are part of the measured capability. PaperBench shows that open-ended quality can be decomposed, although expensive rubric construction may be required.

Interpretation. A bounded judgment role should be defined as a typed contract:

• authoritative inputs and merely advisory inputs;
• permitted reads, proposals, writes, and executions;
• evidence and provenance obligations;
• uncertainty or abstention behavior;
• validator and approval requirements;
• exact commit, rollback, and audit behavior.

Role names alone do not create boundedness. The boundary must be enforced by the harness.

9. Context security, memory poisoning, and human authority

9.1 AgentDojo: prompt injection in tool-using agents

Status: Peer-reviewed benchmark track, NeurIPS 2024.

Research question. How robust are tool-using agents to indirect prompt injection embedded in data they retrieve while completing realistic tasks?

Method. AgentDojo provides 97 tasks in email, banking, and travel environments and 629 security test cases, with dynamic tools and attacks that place malicious instructions in untrusted content.

Principal finding. Contemporary agents already struggle with benign tasks, and multiple attack methods compromise security in a meaningful fraction of cases. No tested approach simultaneously solves utility and security.

Limitations. The environments and attacks are simulated and necessarily incomplete. Results depend on the agent interface and evolve as attacks and defenses improve.

Relevance. Retrieved files, annotations, webpages, and memory cannot all be treated as instructions. Their trust and authority must remain distinct even when they share the same context window.

9.2 Agent Security Bench

Status: Peer-reviewed, ICLR 2025.

Research question. How vulnerable are agents across a broader set of attacks, defenses, tools, and scenarios?

Method. The benchmark covers ten scenarios, ten agents, more than 400 tools, 27 attack and defense techniques, and seven metrics. Attacks include prompt injection, memory poisoning, backdoors, and combinations; defenses span eleven methods and multiple model backbones.

Principal finding. The evaluation finds material attack success and no generally sufficient defense, while also exposing utility–security trade-offs.

Limitations. Later work has identified weaknesses common to agent-security evaluations: implementation bugs, underpowered attacks, and metrics that can reward refusal or task failure. Results should therefore be read as evidence of exposure, not a definitive ranking of defenses.

Relevance. Persistent memory and cross-document context enlarge the attack surface. Security tests must include delayed effects: an injected note may be harmless in the current turn but influential after retrieval or summarization later.

9.3 CaMeL: control-flow and capability separation

Status: Preprint, March 2025; vendor and academic authors; not peer reviewed.

Research question. Can prompt injection be prevented by separating trusted control logic from untrusted data and enforcing capability-based information-flow policies?

Method. CaMeL converts the trusted user request into control and data flows, limits the influence of untrusted tool outputs, and applies capabilities to downstream actions. It is evaluated on AgentDojo.

Principal finding. The paper reports completion of 67% of AgentDojo tasks with a formal security claim for the supported system model.

Limitations. The guarantee applies only to modeled flows and tool semantics. Utility remains incomplete, policy construction is burdensome, and side channels or unsupported tools may escape the model. It is a preprint, not evidence that prompt injection is solved generally.

Relevance. CaMeL supports a structural separation between judgment and execution. Model-generated content should not acquire write or execution authority merely by appearing in context.

9.4 Security benchmark validity is itself unsettled

Status: Preprint, October 2025.

Research question. Do strong reported results for interface-level prompt-injection firewalls survive close audit of benchmark metrics, implementations, and adaptive attacks?

Method. Indirect Prompt Injections: Are Firewalls All You Need, or Stronger Benchmarks? evaluates a proposed interface firewall across several benchmarks, then audits the evaluation itself for flawed metrics, implementation bugs, weak attacks, and practical bypasses.

Principal finding. An apparently decisive defense result can disappear under adversarial audit. The paper documents weaknesses in both the evaluation setup and the authors’ own defense, showing that benchmark pass rates can overstate end-to-end security.

Limitations. It is a preprint, studies a bounded family of interfaces and attacks, and does not supply a general replacement benchmark or general defense. Its findings caution against strong rankings rather than quantifying real-world attack prevalence.

Relevance. Security claims need adaptive red teaming and end-to-end state inspection, not only benchmark pass rates. A defense that prevents the final forbidden tool call may still corrupt memory, alter a file, leak data through an allowed channel, or cause a denial of service.

9.5 OWASP agentic guidance

Status: Authoritative practitioner consensus, not controlled research, December 2025 and living guidance.

OWASP’s agentic-applications risk list covers goal hijacking, tool misuse, identity and privilege abuse, supply-chain vulnerabilities, unexpected code execution, memory and context poisoning, insecure inter-agent communication, cascading failures, exploitation of human trust, and rogue-agent behavior. Its agent security guidance recommends least privilege, scoped read and write tools, memory validation and isolation, human approval for high-impact actions, separation of decision from irreversible execution, schema validation, logging, configuration versioning, and regression testing.

Limitations. This is standards-style threat modeling and defensive guidance, not an estimate of efficacy or prevalence.

Relevance. Governed integration is partly standard security practice. A less tested system design makes these controls native to file and memory composition—provenance, permissions, proposed deltas, approval, commit, and audit—rather than treating them as an external policy layer.

10. What is now standard, what may be distinctive, and what is untested

11. Four-layer analysis of the AIOS architectural theses

The propositions in this section are AIOS architectural hypotheses, not findings attributed to the cited literature. Only the subset intersecting context composition, memory, harness design, local knowledge systems, and governed integration is considered. Each analysis separates four layers:

1. Current evidence: what the reviewed work establishes now.
2. Architectural thesis: the proposition advanced for AIOS.
3. First- and second-order implications: what would follow if the thesis is substantially correct.
4. Conditions and tests: uncertainties, counterforces, boundary conditions, and evidence needed.

The intended scope is complementary. The thesis does not replace centralized frontier-model training or rule out remote inference. It proposes that durable context, expertise, memory, workflow, and authority can increasingly reside in local, person-owned systems, while frontier models are used selectively where their marginal capability justifies cost, latency, or data exposure.

11.1 Summary map

11.2 Bounded semantic judgment, deterministic enforcement, and human authority

1. Current evidence. Recent harness and security research supports separating uncertain semantic interpretation from exact state transition. SWE-agent shows that explicit file and execution interfaces materially affect performance. τ-bench demonstrates the value of database end-state checks. CaMeL and OWASP guidance support control-flow separation, capabilities, least privilege, schema validation, and human approval for consequential action. These results make the following narrow claim defensible:

For tasks that combine ambiguous natural-language intent with externally consequential state changes, model-generated judgments should be mediated by deterministic authorization, validation, and execution controls.

2. AIOS architectural thesis. Language models are used where semantic interpretation, synthesis, comparison, and context-sensitive judgment are valuable. Deterministic components own identity, scope, authorization, schemas, validation, transactions, and exact effects. Humans set purpose, retain authority over consequential ambiguity, and decide which model-proposed changes become canonical. The thesis is not that code can formalize all judgment; it is that semantic judgment and operational authority should be separately representable and composable.

3. Implications if substantially correct. First-order, consequential workflows could use frontier-level semantic capability without granting a model direct, ambient authority. The same judgment could be inspected, challenged, rerun, or sent through a different execution path. Exact effects would become attributable to explicit policies and transactions rather than hidden inside conversational output. Second-order, this division could enable regulated use, portable judgment modules, locally governed automation, and organizational systems in which authority remains legible even as models change. It could also shift software design from parsing prose for implied decisions toward exchanging typed judgments with provenance, uncertainty, and permitted effects.

4. Conditions, counterforces, and tests. Deterministic code guarantees only properties encoded in and correctly implemented by it; it cannot make the policy or objective normatively correct. Human reviewers can misunderstand polished output or develop approval fatigue. Rigid validation can reject valid solutions, encode stale policy, and obstruct recovery, while models can exploit flawed objectives. Use the same model and tasks in a factorial comparison of direct free-form action, structured judgment plus validation, scoped capabilities, and consequence-sensitive human approval. Measure success, unauthorized effects, false blocks, recovery, review time, automation bias, and whether postconditions match stated purpose. Include adversarial and ambiguous cases.

11.3 “AI-native” architecture versus inherited software patterns

1. Current evidence. The literature supports a shift in the evaluated unit from a model call to a compound inference system. MIPRO, TextGrad, τ-bench, SWE-agent, and Harness-Bench all show that prompts, modules, tools, state, and validators materially influence outcomes. It is therefore reasonable to study architectures in which semantic judgments are first-class typed outputs rather than prose later scraped by brittle string rules.

2. AIOS architectural thesis. The transition is not from deterministic software to model-only software. It is from treating model output as unstructured text inside an otherwise unchanged pipeline toward architectures that treat bounded semantic judgment as a native system object. Context composition, model judgment, exact operations, and governed integration become coordinated layers. Deterministic parsing, type systems, state machines, and database constraints remain essential; their role is to enforce the contract around judgment rather than simulate the judgment itself.

3. Implications if substantially correct. First-order, application behavior could be assembled from reusable judgment, context, permission, and operation primitives rather than separately hard-coded end-to-end flows. A model could be upgraded without relocating canonical files or accepted ground, and a domain could use local or remote models according to consequence and capability. Second-order, the application layer could become thinner and less monopolistic: durable person context and workflow would no longer have to be recreated inside every service. New tools could compete on capability while interoperating with person-owned files and governance. This is a reduction in mandatory application dependence, not the disappearance of software or centralized frontier infrastructure.

4. Conditions, counterforces, and tests. “Pre-AI” and “AI-native” are not experimentally defined treatments. Apparent gains may come from a newer design, stronger model, better context, or more compute. Narrow conventional automation may remain safer and cheaper. Compare free-text parsing, schema-constrained generation, tool calls, and staged judgment contracts on identical tasks, models, context, and budgets. Attribute failures to semantic judgment, parsing, authorization, tool invocation, state update, and integration; report complexity, latency, cost, auditability, and resilience to model substitution and task drift.

11.4 Does scaffolding suppress frontier-model reasoning?

1. Current evidence. Some scaffolds suppress performance. Retrieval can omit dependencies; repeated summarization can cause context collapse; a fixed decomposition can impose the wrong subproblem structure; and the preprint Putting It All into Context shows that a direct whole-environment strategy can outperform selected complex scaffolds on SWE-bench-Verified. Harness-Bench reports substantial model–harness interaction, making mismatch a credible failure source. Counterevidence is equally important: SWE-agent finds large gains from a specialized interface; MIPRO and GEPA improve multi-stage systems; and long-context studies show that simply adding all information can reduce performance.

2. AIOS architectural thesis. Much existing scaffolding encodes assumptions formed around earlier or weaker models: narrow step sequences, lossy chunking, premature summaries, rigid role graphs, and application-specific affordances. As frontier models become better at maintaining state, using tools, and reasoning over larger structures, some of that scaffolding may become an information bottleneck. The proposed alternative is not scaffold removal but adaptive scaffolding: preserve rich source material, expose exact tools and constraints, let the model choose among whole-context, retrieval, decomposition, and recursion, and impose deterministic boundaries primarily where authority or effects require them.

3. Implications if substantially correct. First-order, simpler and more model-legible harnesses could unlock capability already present in frontier models, reduce brittle orchestration, and make reasoning paths less dependent on application-specific pipelines. Distinct models could receive different context strategies without changing canonical files. Second-order, the locus of improvement would shift: upgrading context composition and the model might replace some bespoke workflow engineering, accelerating diffusion of capability across many domains. It would also make model–harness co-design and continuous evaluation more important than a single fixed agent architecture.

4. Conditions, counterforces, and tests. A monolithic system may win only because retrieval is weak, the corpus fits, the task is fully observable, or the model was trained for long context. A scaffold may appear to help because it spends more compute. Construct a crossed model–harness study using direct whole-context, retrieval, hierarchical decomposition, recursive subcalls, and tool exploration. Match or separately report tokens, wall time, calls, and model family; vary corpus size, dependency density, observability, and consequence. Classify failures as retrieval omission, decomposition error, reasoning error, tool error, or integration error. The thesis is supported only if adaptive composition generalizes beyond a single model and benchmark.

11.5 Do cognitive modes require distinct contexts and roles?

1. Current evidence. There is evidence that modularity can help. MIPRO optimizes prompts for separate program modules; ACE benefits from Generator, Reflector, and Curator functions; TextGrad propagates criticism across components; and PaperBench decomposes open-ended work into hierarchical criteria. Distinct tasks also require different evidence: editing needs the target and change constraints, review needs the candidate plus acceptance criteria, and planning needs goals, dependencies, and available actions. The exact partition into thinking, writing, editing, structure, planning, and review has not been comparatively validated.

2. AIOS architectural thesis. These modes are not merely consecutive prompt steps; they are different relations to a shared body of knowledge. Thinking explores and frames, writing commits a communicable account, editing transforms an existing artifact under constraints, structural work manages organization, planning maps purpose to dependencies and action, and review judges against criteria. Each mode should receive a purpose-built semantic situation and bounded authority while sharing file-native continuity. Roles may be implemented by one model or several—the distinction is contextual and operational before it is anthropomorphic.

3. Implications if substantially correct. First-order, the same durable project could be viewed through different cognitive lenses without flattening all work into one chat history. Editing would no longer silently redefine purpose; review would not automatically acquire write authority; planning could remain provisional until selected. Context could become smaller and more relevant because each mode receives the files, relationships, criteria, and permissions it needs. Second-order, organizations could encode reusable faculties rather than rigid workflows, compose them differently by domain, and preserve a continuous knowledge substrate across people, models, and time. Peer collaborators could inspect not only artifacts but the type and authority of judgments that produced changes.

4. Conditions, counterforces, and tests. “Distinct context” can mean a different view over shared state, different instructions, a separate call, a separate model, or separate authority; these must not be conflated. More roles add handoff loss, duplicated context, latency, and correlated ratification. Benefits may come from added compute or explicit criteria rather than mode distinction. Compare one call, one model across typed phases, separate prompts with shared state, independent role instances, and domain-specific taxonomies under matched compute. Ablate context, role label, model independence, and authority separately; measure quality, error correlation, handoff loss, latency, correction cost, and robustness under model replacement.

11.6 Bounded menus and permissions as a middle path

1. Current evidence. Constrained action schemas, least privilege, end-state checks, and capability controls are well-motivated by τ-bench, CaMeL, AgentDojo, and OWASP guidance. A bounded menu can make available actions inspectable and prevent a semantic suggestion from directly becoming an unrestricted operation. Evidence does not yet identify one optimal action-space width or approval policy.

2. AIOS architectural thesis. Bounded menus and permissions provide an alternative to both pre-scripted pipelines and ambient autonomy. A role receives a finite set of judgments or operations appropriate to its purpose and context. It may request an additional capability, but cannot grant it to itself. Authorization, reversibility, and required review attach to the operation, while the model retains latitude within the semantic problem.

3. Implications if substantially correct. First-order, a general reasoning environment could support open-ended judgment without making every task an unrestricted agent session. Users and organizations could understand the available effects, delegate narrow authority, and preserve meaningful intervention points. Second-order, regulated domains could express policy as capabilities, required evidence, approvals, and postconditions around the same local knowledge substrate. Compliance review could examine judgment provenance and exact operations rather than reconstruct intent from opaque application logs. A shared capability vocabulary could also support peer collaboration across independently governed domain systems.

4. Conditions, counterforces, and tests. If the correct action is absent, the system may fail silently, combine individually allowed operations unsafely, or pressure users to broaden access. Permission prompts can become routine. Very narrow menus may turn a reasoning model into a brittle classifier, while broad tool sets increase search and attack surface. Vary action-space width, permission granularity, reversibility, and escalation design on matched workflows. Measure benign and attack success, false denial, recovery, requests for authority, user comprehension, approval fatigue, delayed memory effects, and multi-step combinations. Regulated use additionally requires domain-specific validation of audit, retention, identity, and accountability controls.

11.7 Local domain intelligence and private cognition

1. Current evidence. External memory, retrieval, and file-based agent systems show that substantial task-relevant knowledge can live outside model weights and persist across sessions. Dynamic Cheatsheet and ACE show reusable external procedural context; LongMemEval and A-MEM show persistent conversational or linked memory; the filesystem study demonstrates a deployed file-native design space while warning that curation can decay. These studies do not compare end-to-end fully local, hybrid, and remote systems over the broad distribution of personal or organizational work.

2. AIOS architectural thesis. A self-contained domain is a local, person- or group-owned body of files, metadata, annotations, relationships, memory, workflows, and governance that can be reasoned over by plural, selectively routed local or remote models, subject to adaptation and revalidation. As local models improve and scaffolding matures, such a domain may satisfy a large share of recurring needs from its own durable context. Frontier remote models remain available selectively for difficult synthesis, unfamiliar domains, or high-value escalation. Canonical files, accepted ground, and authority do not migrate to the remote model.

3. Implications if substantially correct. First-order, individuals could accumulate durable personal intelligence: not a generic assistant transcript, but an inspectable body of projects, preferences, expertise, decisions, and procedures that survives application and model turnover. Private local cognition would become feasible for sensitive reflection, drafting, planning, health or financial preparation, and other work where external disclosure is undesirable. Organizations could build domain intelligence around their actual records and practices while keeping canonical files and accepted ground within governed boundaries. Expertise could compound through files and memory instead of remaining trapped in individual sessions or vendor-specific application state.

Second-order, the unit of software adoption could shift from subscribing to a separate intelligent application for each activity toward granting general reasoning capabilities bounded access to person-owned domains. Model choice could become a routing decision rather than a commitment of the knowledge base. Local domains could preserve institutional memory through personnel change, make implicit procedures reviewable, and allow small organizations to assemble capabilities formerly requiring bespoke systems. The same substrate could support offline or intermittently connected use and reduce exposure of routine work to centralized inference.

4. Conditions, counterforces, and tests. “A large share of recurring needs” must be operationalized by workload class. Local sufficiency depends on model capability, domain closure, freshness, context quality, device memory and energy, language support, and escalation. Privacy requires an end-to-end boundary: remote inference, embeddings, synchronization, extensions, backups, telemetry, and compromised local devices can all leak data. Local control can also fragment shared truth or weaken disaster recovery. Run longitudinal comparisons of fully local, local-data/remote-model, hybrid, and centralized application baselines. Measure task coverage, factual quality, stale answers, cross-domain failure, human correction, data egress, latency, energy, cost, recovery, and the frequency and value of remote escalation.

11.8 Reduced dependence on centralized application infrastructure

1. Current evidence. Compound model systems can absorb some functions previously implemented as application-specific search, classification, routing, or interface logic. File-native tools and structured judgments make it technically possible for a general reasoning layer to act across multiple domains. The reviewed literature does not measure economy-wide infrastructure displacement, and it does not suggest that frontier training, cloud services, identity systems, shared storage, or networks cease to matter.

2. AIOS architectural thesis. By moving durable context, expertise, memory, and workflow into person-owned domains, the system reduces the amount of intelligence that must be recreated inside each centralized application. General local reasoning and exact file operations can handle routine work; specialized applications and remote models become optional capabilities invoked where they add value. The proposed transition is from mandatory dependence to selective dependence, not from centralized infrastructure to none.

3. Implications if substantially correct. First-order, remote inference volume and application-specific integration could fall for routine tasks, while latency, offline resilience, and data sovereignty improve. Switching models or services would no longer require abandoning the user's accumulated context. Organizations might retain fewer duplicated knowledge silos and negotiate with vendors from a stronger portability position. Second-order, value could move from platforms that capture context toward open capabilities that operate on user-controlled knowledge. Smaller providers and local communities could offer specialized tools without hosting the full corpus. Centralized frontier infrastructure would remain important for training, high-capability inference, model distribution, and coordination, but it would be less able to monopolize durable user context.

4. Conditions, counterforces, and tests. Infrastructure can be shifted rather than removed. Identity, authorization, storage, backup, synchronization, provenance, observability, security response, collaboration, and compliance remain necessary; some become harder in decentralized environments. Savings at the visible application layer may reappear as inference, maintenance, evaluation, or human-review cost. Central services retain advantages in shared truth, coordinated updates, disaster recovery, and economies of scale. Produce a component-level ledger for representative workloads showing what is eliminated, retained, duplicated, or moved among device, edge, and cloud. Measure total cost, administrative labor, energy, remote calls, resilience, switching cost, and security outcomes over time. No quantitative reduction estimate is warranted before such accounting.

11.9 Peer collaboration, regulated domains, and global accessibility

1. Current evidence. The reviewed work separately supports several prerequisites: files are inspectable and portable; provenance and end-state validation improve auditability; bounded tools and least privilege are security requirements; smaller or external-memory systems can perform useful tasks without weight updates. It does not establish a mature ecosystem of interoperable peer domains, regulatory acceptance, or equitable global deployment.

2. AIOS architectural thesis. Self-contained domains need not be isolated. People and organizations can exchange ordinary files, signed annotations, relationship claims, procedures, or bounded judgment requests while retaining separate canonical stores and authority. Governance travels with artifacts and operations rather than depending entirely on one host platform. Local models serve routine cognition; remote or peer resources can be invoked under explicit disclosure and authority rules.

3. Implications if substantially correct. For peer collaboration, expertise could circulate as inspectable artifacts and reproducible workflows instead of opaque application state. Independent parties could compare claims, preserve dissent, and merge only what they authorize. For regulated use, local canonical records, provenance-bearing judgments, scoped capabilities, and transactional integration could support auditable assistance without granting a model final institutional authority. For global accessibility, reusable domain systems could bring specialized reasoning to settings that cannot sustain a bespoke centralized application for every field, including intermittently connected and under-resourced environments. Knowledge packages, local language models, and peer-maintained domain resources could lower barriers to specialized assistance.

Second-order implications include a more plural knowledge ecosystem: many locally governed domains connected through exchange rather than one global memory; new forms of professional and community stewardship; and the possibility that expertise becomes a portable public or cooperative resource. This could strengthen sovereignty and resilience, but also produce incompatible standards, uneven quality, and fragmented epistemic communities.

4. Conditions, counterforces, and tests. Collaboration requires identity, signatures or attestations, versioning, conflict semantics, revocation, and comprehensible provenance. Regulated acceptance depends on domain law, validated controls, retention, reproducibility, accessibility, and accountable human decision makers. Global reach depends on affordable hardware, energy, multilingual models, distribution, maintenance skills, disability access, and resistance to the digital divide. Test peer exchange across independently governed stores, adversarial provenance, offline synchronization, conflicting updates, and revocation. In regulated pilots, measure audit completion, error detection, human responsibility, data exposure, and recovery. For accessibility, evaluate complete lifecycle cost and performance across languages, devices, connectivity regimes, and user expertise—not only model size.

11.10 Cumulative system effects and selective model use

1. Current evidence. The reviewed literature establishes several component-level effects. MIPRO, TextGrad, and GEPA improve prompts or compound programs; ACE and Dynamic Cheatsheet reuse learned strategies without weight updates; LongMemEval and graph retrieval improve access to external knowledge in selected settings; compute-optimal test-time scaling avoids spending the same inference budget on every problem; SWE-agent and τ-bench show that interfaces and validators materially alter realized capability. ACE reports lower rollout and adaptation costs while improving its tested outcomes. None of these studies evaluates the full proposed stack or demonstrates that the component gains add rather than interfere.

2. AIOS architectural thesis. Useful intelligence is a system-level outcome, not merely a property of model weights. Purpose framing, composed context, distinct cognitive modes, multiple-resolution memory, relational metadata, provenance, bounded judgment, planning, verification, and post-response integration each remove a different source of avoidable inference burden or error. Their cumulative effect may allow a smaller or local model to solve tasks that would otherwise require a larger model, repeated attempts, or a centralized application. Model choice is consequently dynamic: the system may select a model by cognitive movement, demonstrated capability, privacy boundary, latency, cost, and data sensitivity, escalating selectively to a frontier model without transferring ownership of durable context.

3. Implications if substantially correct. First-order, inference scaling would become partly architectural. Better context and memory could reduce rediscovery; provenance could reduce unsupported synthesis; bounded operations and validators could prevent fluent but ineffective completion; and post-response integration could turn one answer into reusable future context. Fewer retries and smaller contexts could matter as much as raw per-call model price. A strong local model might handle private retrieval, drafting, editing, routine planning, and verification, while a frontier service handles exceptional synthesis or difficult judgment.

Second-order, the effective capability gap between locally available models and centralized frontier systems could narrow at the task-system level even if the weight-level gap remains. Model providers could become more substitutable at the continuity layer while remaining behaviorally distinct and subject to adaptation and revalidation. Evaluation would shift from “which model scored highest?” toward “which composition of model, context, memory, tools, verification, and authority achieved the desired result at acceptable total cost and risk?” This could reduce routine remote inference, distribute capability more broadly, and make privacy, latency, and sensitivity first-class selection criteria rather than afterthoughts.

4. Conditions, counterforces, and tests. Small improvements may be redundant, non-additive, or negatively interacting. More context can hurt; memory can poison later work; extra roles can increase handoff error; verification can be wrong; provenance can add token and maintenance cost; and a router can select an inadequate model or leak sensitive context during escalation. The relevant test is an end-to-end cumulative ablation under a fixed workload: begin with a model-only baseline, add purpose framing, context composition, memory, role views, provenance, verification, and integration one at a time and in selected interactions, while holding model and task distribution stable. Measure verified task success, unsupported claims, retries, tokens, latency, energy, monetary cost, human intervention, privacy exposure, and reusable knowledge created. A separate routing study should determine model-selection policies; this memo's narrower requirement is that every routed call declare its context boundary, authority, expected capability, and integration contract.

11.11 Decentralized composition and boundary claims

1. Current evidence. “No single center” is defensible as a description of a compound system whose result depends on model, context, files, tools, state, and validators. Harness-Bench and τ-bench show that attributing capability to the model alone is empirically misleading. Direct long-context results also show that a simpler, more centralized inference path can sometimes outperform a multi-stage system.

2. AIOS architectural thesis. A user-visible result is produced by a federation of purposes, files, metadata, relationships, contexts, model judgments, deterministic operations, memory, integration, and human authority. No component is the complete intelligence system, even when a frontier model supplies the most powerful individual judgment. The thesis concerns system organization and authority, not a metaphysical claim about intelligence and not a preference for maximal component count.

3. Implications if substantially correct. First-order, system capability can improve through better memory, files, relationships, context, validation, or integration without waiting for a new foundation model. Components can be replaced independently, and failures can be localized to retrieval, judgment, authorization, or execution. Human authority can remain a functional component rather than a generic fallback. Second-order, intelligence infrastructure becomes more plural: person-owned domains, local models, frontier services, peer expertise, and institutional controls can interoperate without one of them owning the entire epistemic state. This creates room for sovereignty, resilience, specialization, and model competition around stable user-controlled knowledge.

4. Conditions, counterforces, tests. Coordination may create bottlenecks, correlated mistakes, stale state, unclear accountability, and excessive ceremony. Compare centralized and composed architectures under matched model and compute budgets. Use component ablations and intervention tests to identify which element causally changes the outcome. Measure success, error localization, recovery, provenance completeness, and responsibility for unsafe changes.

The thesis also has three important boundaries:

• It does not imply that insufficient context is the sole cause of agent failure. Perfect-retrieval experiments still show substantial degradation with length; τ-bench shows policy and consistency failures; Harness-Bench shows execution-alignment failures; inference-time studies show verifier and selection failures; and security studies show adversarial control failures.
• It does not require universal superhuman model judgment. LongBench v2's human comparison is task- and time-specific; PaperBench's best tested agent remains below its ML-PhD baseline; and repeated tool use remains unreliable in τ-bench. The architecture is partly motivated by uneven capability and the need to bound it.
• It does not imply the end of centralized frontier training, remote inference, or shared infrastructure. Its implication is a potentially large but unquantified reduction in dependence on centralized application layers and routine remote inference as durable context and ordinary reasoning move into local domains.

12. A research interpretation of the Fractal Seed

Why–How–What can be operationalized without claiming cognitive universality:

• Why: purpose, stakeholder, constraints, values, authority, and success criteria.
• How: evidence plan, transformations, tools, sequence, validators, and approval path.
• What: claims, artifacts, state changes, provenance, unresolved issues, and next actions.

Applied recursively, each subtask receives its own purpose, method, and deliverable contract. This resembles hierarchical task decomposition, modular language-model programs, and rubric trees. Its plausible benefits are traceability, consistency across scales, and clearer handoffs. Its plausible costs are formulaic decomposition, repeated context, false neatness, and systematic omission of categories that do not fit the triad.

No reviewed source establishes that three-part recursion is better than alternatives such as goal–evidence–action, plan–execute–verify, issue–argument–conclusion, or domain-specific schemas. The appropriate research claim is therefore:

Why–How–What is a proposed cross-domain interface grammar whose value should be measured by transfer, traceability, correction cost, and outcome quality—not presumed from its symmetry.

A strong experiment would compare the grammar with unstructured composition and at least two task-specific baselines across document synthesis, file editing, project planning, and memory update tasks. It should measure final quality, unsupported claims, retrieval coverage, token and latency cost, human correction time, and cross-session retention.

13. Foundational lineage before August 2024

These older sources are included only because the 2024–2026 work builds directly on them.

• Retrieval-Augmented Generation (NeurIPS 2020): established the combination of parametric generation with retrieved non-parametric memory. It is the lineage for evidence retrieval, not a solution to provenance, update, or governance.
• ReAct (ICLR 2023): interleaved reasoning and action, making tool observations part of the context. It is a foundation for modern agent traces and harnesses.
• Tree of Thoughts (NeurIPS 2023): made search over intermediate reasoning states explicit, anticipating inference-time scaling and branching deliberation.
• MemGPT (ICLR 2024): treated context management as a memory hierarchy with model-directed movement between tiers, directly anticipating operating-system metaphors for agent memory.
• RAPTOR (ICLR 2024): recursively clustered and summarized text to retrieve at multiple abstraction levels, a direct precursor to hierarchical document composition.
• Lost in the Middle (TACL 2024): showed strong positional effects in long context, establishing that presence of evidence does not imply reliable use.

Overall assessment

The research trajectory from 2024 through 2026 is moving away from the idea that intelligence resides in a single model invocation. Capability increasingly emerges from a compound arrangement of context, memory, retrieval, tools, feedback, search, and validation. That direction is compatible with AIOS's system view, but compatibility is not evidence of superiority.

The most credible AIOS research contribution would be a falsifiable account of human-governed context evolution over canonical files: how semantic situations are assembled, how recursive structure affects reasoning, how model judgments are bounded, how derived memory is kept subordinate to source material, how exact operations are verified, and how proposed changes become—or do not become—durable knowledge. The decisive work is therefore not to claim novelty for familiar ingredients, but to specify their contracts and show, through controlled comparison and longitudinal use, where this particular composition improves outcomes and where it fails.

The implications should not be reduced to that immediate validation task. If the cumulative architecture works substantially as proposed, personal and organizational intelligence could persist independently of any single application or model; private local cognition could become a practical default for routine work; frontier systems could be invoked selectively; regulated and peer-governed domains could exchange knowledge without surrendering canonical authority; and specialized reasoning could become accessible in places where bespoke centralized applications are uneconomic or unavailable. Present evidence establishes prerequisites and counterforces, not those outcomes. The appropriate stance is to preserve the implications while making their conditions measurable.

14. Strongest supported conclusions

1. Context is an engineered system state. Treating it as only prompt prose omits retrieval, tool state, memory writes, intermediate artifacts, permissions, and integration.
2. Effective context is smaller and more task-dependent than the nominal window. Length, information density, position, operation type, and semantic association all matter.
3. Incremental, modular context evolution is often safer than repeated full rewriting. ACE supplies the clearest recent empirical evidence, but only in bounded domains with usable feedback.
4. External memory helps only with explicit write, update, retrieval, and conflict policies. Persistent storage can preserve error as readily as insight.
5. Graphs and hierarchies are conditional tools. They can improve associative access and large-corpus processing, but add extraction error, redundancy, maintenance, and token cost.
6. Inference-time scaling needs a verifier. Additional candidates or recursive calls can improve results, but can also amplify evaluator error and cost.
7. Observed useful intelligence is a system-level outcome. Model weights remain a central source of capability, but context, memory, interfaces, tools, validators, state visibility, and commit semantics materially determine what capability the complete system realizes.
8. Trusted control and untrusted content must remain separate. Memory and retrieved documents are attack surfaces, and human approval is meaningful only when coupled to scoped authority and inspectable changes.
9. Bounded model judgment plus deterministic enforcement is a defensible pattern for consequential operations. Its value comes from enforced capabilities, validation, and postconditions—not from role labels or model confidence.
10. No single context strategy or scaffold is uniformly best. Direct context, retrieval, decomposition, recursion, and tool exploration should be treated as competing task-dependent policies.

15. Unresolved and contradictory evidence

• Whole context versus selective composition: long inputs often degrade performance, yet whole-repository context can outperform more elaborate retrieval in some software tasks. The correct policy is likely conditional on corpus size, dependency density, and model.
• Organization versus raw retention: structured memory can reduce retrieval cost and improve benchmark scores, while the 2026 filesystem study finds that curated hierarchies can decay and substantially underperform verbatim sessions. Replication on real, user-edited stores is needed.
• Graph versus conventional retrieval: HippoRAG 2 reports meaningful gains, but GraphRAG-Bench and earlier comparisons show that graph pipelines can underperform and inflate prompts. Entity and relation quality may be the controlling variables.
• Reflection versus contamination: GEPA, Dynamic Cheatsheet, and ACE improve context from feedback, but all depend on evaluator or execution quality. In weak-feedback environments, reflection can turn an error into a durable rule.
• More inference versus better inference: adaptive scaling helps mathematics, while knowledge-intensive results remain limited and best-of-N can worsen under reward-model error.
• Security defenses versus benchmark artifacts: benchmark results show substantial exposure, but later audits show that both attacks and defenses can be mismeasured. No general prompt-injection solution is established.
• Human oversight versus operational benefit: security guidance favors approval for high-impact actions, but the reviewed work does not identify optimal escalation thresholds or quantify review fatigue and automation bias.
• Role specialization versus added compute: modular prompts and reflector roles can help, but studies rarely isolate role semantics from extra calls, independent sampling, or richer feedback.
• Constrained menus versus recovery: narrower action spaces can improve control while preventing legitimate exception handling. The optimal width and escalation path remain task- and consequence-dependent.
• Local versus hybrid or centralized operation: the evidence base does not yet establish which personal and organizational workloads can remain self-contained without unacceptable losses in capability, freshness, collaboration, or recoverability.
• Infrastructure consolidation versus cost transfer: fewer visible application layers may be offset by inference, context maintenance, evaluation, security, synchronization, and human-review costs.
• Cumulative benefit versus architectural overhead: component studies support context optimization, memory, tools, and verification separately, but their combined effect may be additive, redundant, or antagonistic.
• Selective model use versus routing failure: dynamic choice can improve privacy, latency, and cost only if the system predicts task requirements, contains disclosure, and recognizes when escalation is needed.

16. Possible AIOS connection points for later consideration

These are design and evaluation opportunities, not validated benefits.

1. Formalize the composed semantic situation. Specify required fields—purpose, active files, evidence, relationships, current state, trust labels, tools, budget, output contract, and authority—and compare it with ordinary prompt assembly.
2. Separate canonical files from generated companion layers. Treat summaries, embeddings, links, and playbooks as derived and rebuildable unless explicitly promoted. Record source spans, generator, time, and confidence.
3. Use delta-based memory evolution. Preserve prior context, propose localized changes, and support supersession and rollback. Evaluate against full summarization, verbatim storage, and chunk/vector baselines.
4. Give every model judgment a bounded contract. Define permitted inputs and outputs, evidence requirements, uncertainty, and whether the role may advise, edit, execute, or only request approval.
5. Make integration transactional. Stage changes, validate syntax and semantics, show a concise diff, run relevant checks, and commit only within explicit authority. Preserve an audit path from response to source and operation.
6. Treat graph edges as claims. Store provenance and confidence, detect staleness, and allow exact search or direct file reading to override or bypass generated relations.
7. Choose context strategy adaptively. Compare full-file, retrieved passage, hierarchical summary, graph walk, and recursive analysis based on task type and budget rather than committing to one method.
8. Scale verification with consequence. Low-impact synthesis may use automated validators; irreversible, external, privileged, or normatively ambiguous changes should escalate to meaningful human review.
9. Evaluate continuity as a multi-objective system. Include answer quality, provenance, temporal update handling, abstention, human correction cost, store growth, retrieval latency, privacy leakage, poisoned-memory persistence, and recovery.
10. Test the Fractal Seed comparatively. Measure cross-domain transfer and traceability, but include domain-specific and nonhierarchical baselines so the grammar can fail honestly.
11. Measure cumulative system effects. Evaluate whether purpose, composed context, memory, provenance, bounded judgment, verification, and integration jointly reduce retries, unsupported claims, and total inference cost. Include interaction effects rather than summing isolated benchmark gains.
12. Make model selection a governed context operation. A local or remote call should declare the cognitive mode, material disclosed, expected capability, budget, authority, and integration destination. The dedicated routing research should own optimizer design; the context architecture should make routing inspectable and reversible.
13. Define local-domain coverage by workload. Identify which recurring personal and organizational tasks can be completed locally, which require current external retrieval, and which benefit materially from frontier escalation. Preserve canonical local state across all three.
14. Build privacy as a complete boundary. Test inference, embeddings, synchronization, extensions, backups, telemetry, logs, and peer exchange. “Local files” should not be used as a proxy for end-to-end privacy.
15. Prototype governed peer domains. Test signed annotations, provenance-bearing relationship claims, conflicting edits, revocation, offline synchronization, regulated audit, and accessibility across languages, devices, and connectivity conditions.

17. Claims that would be unsafe to make

• That AIOS is validated by research on RAG, memory agents, GraphRAG, recursive models, or agent harnesses.
• That a larger context window provides reliable access to everything inside it.
• That semantic or graph retrieval is generally superior to exact search, direct file reading, or whole-context input.
• That file-native memory is inherently more accurate, private, secure, or sustainable.
• That human-readable organization guarantees model-usable organization.
• That model-generated summaries, tags, or links faithfully preserve the underlying files.
• That recursive Why–How–What is a universal reasoning structure or produces better results across domains.
• That bounded role names constrain behavior without enforced permissions, validators, and commit boundaries.
• That the exact thinking, writing, editing, planning, structuring, and review taxonomy is already known to require separate agents or contexts in every domain. The live architectural thesis is that these modes often benefit from distinct semantic situations and authority, which needs comparative testing.
• That scaffold suppression is already established as a general effect. The consequential thesis is that inherited scaffolds can become information or action bottlenecks as models improve; current evidence supports testing this adaptively across model–task–harness combinations.
• That more test-time computation monotonically improves truth or safety.
• That reflection or self-critique reliably corrects model error.
• That insufficient context is the sole or dominant explanation for agent failure.
• That model semantic judgment is universally superhuman or can replace consequential human authority across domains.
• That the cumulative reductions in inference, retries, or unsupported output have already been demonstrated merely because individual context, memory, and verification components show gains separately.
• That dynamic model selection necessarily lowers total cost or risk; routing error, escalation overhead, and disclosure can reverse the benefit.
• That human approval alone prevents harmful action or preserves meaningful control.
• That prompt injection, memory poisoning, or tool misuse has been solved by current filters, firewalls, or formal wrappers.
• That a local-first architecture is automatically private when remote models, embeddings, synchronization, plugins, or telemetry may still receive content.
• That a self-contained local knowledge system is already known to support a large share of personal or organizational reasoning without a defined workload and comparative evaluation. This remains a consequential thesis to test, not a conclusion to suppress.
• That reduced dependence on centralized application layers entails eliminating centralized services, frontier training, remote inference, or shared infrastructure. The architectural implication is selective use and a possible shift in dependence, not disappearance.
• That canonical human control is achieved merely by storing artifacts in ordinary files; ownership also requires comprehensible provenance, usable correction, enforceable authority, and recoverability.

18. Source table

Dates below use first public publication where readily identifiable; “2026” conference entries indicate the peer-reviewed venue year even when an earlier preprint exists.

Foundational sources