AI-native software architecture and bounded semantic sovereignty

Evidence labels

• Peer-reviewed means published in a refereed conference or journal.
• Preprint means publicly available but not established here as peer-reviewed.
• Vendor-authored means produced by an organization with a product or platform interest. Peer review and vendor authorship can coexist; both are stated when relevant.
• Standard or authoritative guidance means a specification, government framework, or recognized security guidance. It is evidence of engineering consensus or required practice, not by itself evidence of efficacy.

Executive assessment

The research supports the core architectural direction, but with an important refinement. A language model can be useful precisely because it can make a contextual semantic judgment that is awkward to enumerate as deterministic rules. The system should not then mistake that judgment for permission, fact, or effect. A trustworthy boundary must separately determine which real object is meant, whether the person and process are authorized, whether the proposed action is in scope, whether its parameters and preconditions are valid, whether approval is required, and whether the observed post-state matches the authorized effect.

This division is stronger than the familiar slogan “LLM for reasoning, code for execution.” It distinguishes at least five properties that are often collapsed:

1. Syntactic validity: is the response parseable and schema-conformant?
2. Semantic validity: does the response mean the right thing in the task and world state?
3. Identity validity: do its references resolve to the intended canonical people, files, resources, and versions?
4. Authority validity: may this actor perform this operation on these resources under these conditions?
5. Effect validity: did the executor produce exactly the approved state transition, and can that transition be audited or reversed?

Current work establishes that models can judge, route, plan, select tools, critique, edit, and implement software well enough to create practical value. It also establishes that none of those capabilities is reliable enough to serve as its own high-consequence control plane. Hard-constrained output can guarantee a grammar, but not the truth of the fields. A 2025 planning benchmark found that 96.1% of GPT-4o’s generated PDDL problems parsed and 94.4% were solvable, while only 24.8% were semantically correct. Format restrictions can themselves lower reasoning accuracy. Tool agents remain variable across repeated trials, vulnerable to indirect prompt injection, and weak on long-horizon feature work. These findings favor a typed proposal interpreted by a deterministic reference monitor, not a typed command treated as inherently safe.

Security results are especially aligned with the thesis. AgentDojo and Agent Security Bench show that prompt injection is not a marginal defect. CaMeL, Progent, Fides, Task Shield, and related work move protection outside the model through control/data separation, capabilities, information-flow tracking, task alignment, and deterministic policy enforcement. The strongest lesson is that the model should be treated as potentially confused or compromised while the effect boundary still holds. Current coding products independently converge on sandboxing, workspace or branch bounds, limited credentials, network controls, logs, and human merge or elevation decisions.

Evidence for separating cognitive activities is promising but less mature. Agentless showed that a fixed localization–repair–validation pipeline could outperform contemporary autonomous software agents on its benchmark. SWE-Edit reports gains from giving viewing and editing clean, specialized contexts. Long-context studies show that merely admitting more tokens does not guarantee usable semantic access. Multi-model debate, conversely, can collapse into shared misconception. The defensible conclusion is not that every human cognitive label requires its own agent. It is that materially different information needs, contamination risks, output obligations, and validation regimes justify different context contracts and sometimes different model calls.

“AI-native software architecture” is not yet a consolidated scholarly category with a stable definition, distinctive body of theory, and accepted benchmarks. As of this cutoff, the exact label appears mainly in nascent research, industry practice, and a 2026 Software Engineering Institute program. Its ingredients have deep lineage in neuro-symbolic systems, semantic parsing, mixed-initiative interaction, capability security, reference monitors, effect systems, workflow engines, local-first software, and human-computer interaction. The term becomes meaningful if it names a coherent design object: software in which probabilistic semantic components are first-class, replaceable modules; context is composed as architecture; permissions and effects are externalized; provenance and memory are durable; and people retain consequential authority. Without those operational commitments, it is mostly a relabeling of agentic workflows.

The broader AIOS thesis deserves a stronger reading than “use a small local model.” Current evidence already demonstrates capable on-device models, open-weight families across device classes, and systems that can route or optimize across local and cloud models. A particularly relevant 2026 preprint, OpenJarvis, found that naively replacing a frontier cloud model with a 9B local model reduced accuracy by 25–39 percentage points, yet decomposing the personal-AI stack into typed, optimizable primitives and using frontier models during configuration brought on-device inference to within 3.2 points of the best cloud baseline on average across eight benchmarks. That is early, vendor-adjacent preprint evidence, not proof of AIOS. It nonetheless supports a consequential possibility: durable context, expertise, workflows, memory, and authority can reside in person-owned systems while model intelligence is routed selectively. If that architecture matures as local models improve, a large domain of ordinary personal and organizational cognition could become less dependent on remote inference and centralized application infrastructure without abandoning frontier models or centralized training.

The central open question is comparative. No published study located for this memo directly compares, on a representative file-native workload, (a) a rigid deterministic extraction pipeline, (b) bounded semantic judgment plus deterministic effects, and (c) a broadly autonomous agent. The memo therefore ends with experiments designed to make the architectural thesis falsifiable.

1. The architectural proposition

1.1 Working definition

Bounded semantic sovereignty is the deliberate delegation of a real but limited semantic decision to a language model. The model is sovereign only inside an explicitly declared choice space and evidence context. It has no ambient authority to enlarge that space, mint identities, bypass authorization, or cause unmediated external effects.

This is not “the model only recommends.” A recommendation can be the operative semantic decision—for example, which annotation category best fits a passage, which candidate change addresses an issue, which context bundle is relevant, or which of three authorized transformations should occur. The boundary is that a separate trusted system interprets and mediates the consequence.

A useful minimum contract is:

purpose + selected context + role + allowed judgment space
                         │
                         ▼
              probabilistic semantic judgment
          {choice, target references, evidence, uncertainty,
                    requested effect, abstain}
                         │
                         ▼
              deterministic reference monitor
        parse → resolve identity/version → authenticate → authorize
        → check scope/preconditions → render approval if required
        → execute exact effect → verify postconditions → journal
                         │
                         ▼
               durable artifact and provenance

The model may choose among allowed meanings. It may not decide that a different person is authorized, silently reinterpret a file reference, acquire a broader credential, or substitute a larger effect for the one reviewed.

1.2 What the thesis rejects

The thesis rejects two symmetrical reductions.

The first is semantic flattening: ask a model for rich interpretation, then recover its meaning with substring matching, regex scraping, keyword labels, or a brittle decision tree. Such extraction can be safe when it is merely parsing a stable protocol. It becomes destructive when the postprocessor ignores distinctions the model was asked to make, treats explanatory prose as an accidental wire format, or maps ambiguous text into effects without an explicit semantic contract.

The second is semantic overreach: give the same model broad tools, credentials, memory, and global scratchpad state, then allow it to decide both what an instruction means and which consequential action follows. That collapses interpretation, authorization, policy, and mechanism into one probabilistic component.

The proposed alternative is neither a rigid workflow with decorative model calls nor a free-ranging agent with a confirmation button. It is a hybrid architecture in which the probabilistic and deterministic parts have different, inspectable responsibilities.

1.3 A four-layer reading of the AIOS thesis

Layer 1 — What current evidence establishes

• Models provide useful semantic evaluation, planning, routing, tool selection, editing, and generation, but performance depends strongly on the task, interface, context, prompt, ordering, and repeated sample.
• Structured generation can make outputs machine-readable and can guarantee schema adherence under supported constraints. It does not guarantee semantic correctness, and restrictive formats can reduce reasoning performance.
• Deterministic enforcement of capabilities, information flows, scopes, credentials, and state transitions can preserve security properties even when the model is attacked or wrong, although utility and engineering complexity remain material tradeoffs.
• Context relevance matters independently of context-window size. Fixed or specialized stages can outperform more autonomous control loops on some tasks. Multiple agents or critiques do not reliably improve outcomes when errors are correlated.
• On-device and open-weight models can already execute useful text, multimodal, and tool-calling tasks. Naive substitution for frontier cloud models leaves a substantial capability gap on difficult personal-agent benchmarks; scaffolding and hybrid optimization can narrow it.

Layer 2 — The AIOS architectural thesis

AIOS treats intelligence as an emergent system property rather than a model property. Purpose, files, companion metadata, annotations, relations, context composition, bounded judgments, exact operations, integration, memory, and human authority jointly produce a response. Durable context and expertise live in a local, file-native environment owned by the person or organization. Models—local or remote, small or frontier—are selected components, not the locus of memory or authority. Different cognitive activities can receive different context, role, and output contracts. The recurring Why–How–What grammar supplies a common compositional pattern across reasoning and artifact scales.

Layer 3 — What follows if the thesis is substantially correct

First-order consequences would include:

• Personal intelligence with continuity: a person’s long-lived files, annotations, relationships, working methods, and decisions can remain available across model providers and model generations.
• Private local cognition: sensitive sensemaking, drafting, classification, and memory retrieval can often occur without sending the underlying corpus to a remote service.
• Organizational intelligence as owned infrastructure: teams can encode domain context, roles, review practices, and authorization boundaries in durable systems rather than repeatedly reconstructing them in vendor-specific conversations.
• Selective frontier use: remote frontier models can be reserved for tasks whose difficulty justifies disclosure, latency, and cost, while local models handle recurring bounded work.
• Domain proliferation: professions, communities, and small organizations can create specialized reasoning systems around their own artifacts and governance without operating frontier-scale training infrastructure.
• Regulated deployment: local data custody, exact logs, role-specific context, and deterministic effects can make evidence collection, access review, change control, and purpose limitation more tractable.

Second-order consequences could be larger:

• Application value could shift away from proprietary conversational state and toward user-owned context, schemas, workflows, memories, and capability manifests.
• Competition could occur at the level of modular, selectively replaceable reasoning components rather than vertically integrated applications that control data, interface, model, and execution.
• Peer collaboration could exchange artifacts, annotations, proofs, workflows, or narrowly scoped learned adapters while keeping private corpora local.
• Offline and low-connectivity use could broaden access where continuous cloud service is unavailable or unaffordable.
• The governance question could shift from “Which model is trusted?” toward “Which context and powers were granted, which boundary mediated the action, and what durable evidence remains?”

Layer 4 — Conditions, uncertainties, counterforces, and tests

These implications require more than improving local benchmark scores. They depend on usable local hardware, energy and memory efficiency, multilingual and domain quality, secure update and model-supply chains, interoperable file and context formats, accurate retrieval, comprehensible authorization, robust synchronization, backup and recovery, and economic sustainability. Local custody moves risk; it does not erase endpoint compromise, insider misuse, device loss, malicious models, or unsafe plugins. Central providers retain advantages in training compute, safety operations, global knowledge refresh, and difficult inference. Hybrid architectures are therefore a condition of the thesis for the foreseeable future, not a compromise that negates it.

The thesis also requires empirical proof that context scaffolding can transfer across models, repositories, languages, and time; that persons can understand and govern the resulting system; and that decentralization does not merely replace a service dependency with a hardware, model-distribution, or maintainer dependency. Section 12 specifies tests.

2. Where semantic judgment helps—and where deterministic extraction harms it

2.1 Semantic judgment is the model’s comparative advantage

Language models are useful when a task’s decision boundary is expressed through meaning rather than an exhaustive set of surface features: whether a passage advances an argument or merely repeats it; which of several plausible intents best explains a request; whether a proposed edit preserves voice while changing structure; which repository evidence bears on an issue; or whether two formulations are substantively equivalent. These judgments may still be wrong. Their value is that they can integrate weak, distributed, natural-language evidence without first reducing it to a complete hand-built ontology.

Research on model judges shows both sides. JudgeBench deliberately selected difficult response pairs with objective ground truth. Leading judges were only slightly better than chance in important settings. JuStRank showed that instance-level agreement does not determine whether aggregated judgments will rank systems correctly; decisiveness and system bias are separate properties. A 2025 study of 15 judges over more than 150,000 comparisons found non-random, task- and judge-dependent position bias. CodeJudgeBench found all tested code judges unstable under general and code-specific perturbations, with misleading comments, variable renaming, and statement reordering causing the largest degradation.

The right conclusion is not that semantic judgment should be removed. A deterministic substitute often lacks the semantic signal altogether. The conclusion is to use judgment where semantics are genuinely needed, calibrate it on the local decision, preserve abstention and review paths, test counterfactual presentation changes, and never use the same unverified judgment as the sole authorization for an irreversible effect.

2.2 Safe deterministic extraction

Deterministic extraction protects a system when it performs one of four narrow functions:

• parses a protocol whose grammar is intentionally part of the contract;
• rejects fields or operations outside a closed allowlist;
• resolves model references against canonical identifiers and versions;
• validates preconditions, invariants, policy, and postconditions independently of the model’s explanation.

Examples include decoding an operation enum; confirming that a cited artifact hash still matches; checking that an edit range lies within an authorized file; enforcing that a proposed tool call is read-only; or computing a database-state diff after execution. These checks do not pretend to rediscover the model’s meaning from prose. They protect the boundary around an explicit meaning.

2.3 Destructive deterministic extraction

Extraction flattens intelligence when it:

• asks for nuanced analysis but routes only on the presence of a keyword;
• discards uncertainty, alternatives, evidence, or scope qualifications;
• converts a natural-language plan into commands through ad hoc text scraping;
• forces open-ended composition directly into a narrow schema before the model can reason;
• uses a taxonomy whose categories omit meaningful cases, making every response formally valid but conceptually false;
• treats syntactic conformity as evidence that the referenced object or requested effect is correct.

Let Me Speak Freely? provides peer-reviewed evidence for this cost: reasoning performance fell under structured-format restrictions, and stricter restrictions generally produced larger degradation. The paper’s natural-language-then-format condition suggests a practical pattern: reason freely within a private, non-authoritative stage; constrain late at the boundary. The 2026 preprint The Constraint Tax sharpens the warning for sub-3B models. Hard schemas increased format validity from 61.5% to 100% but reduced answer accuracy from 19.7% to 11.0%, and increased wrong-but-schema-valid answers from 49.5% to 88.9%. Its scope is limited—three small model families and selected tasks—but the distinction between valid form and valid answer is fundamental.

2.4 A better response contract

A bounded judgment contract should expose the dimensions needed by the trusted boundary without forcing the entire cognitive process into a wire schema. A useful shape is:

{
  "decision": "apply_annotation | propose_edit | request_more_context | abstain",
  "targets": [
    {"artifact_id": "stable-id", "expected_version": "content-hash"}
  ],
  "semantic_scope": "short domain-defined statement",
  "evidence_refs": ["artifact-id#anchor"],
  "requested_effect": {
    "operation": "closed-enum",
    "parameters": {}
  },
  "uncertainty": {
    "status": "sufficient | contested | insufficient",
    "alternatives": []
  }
}

The schema is not the safety proof. The executor must treat all fields as untrusted proposals. It resolves stable identifiers itself, recomputes versions, checks the operation against a capability manifest, validates arguments and business rules, determines whether trusted-path approval is required, and binds approval to the exact effect.

3. Evidence by model role

3.1 Semantic judges and critics

Evidence. Models can produce useful comparative signals, especially when the criterion is well specified and the task is within the judge’s competence. But difficult objective pairs expose near-random performance, ordering and style can alter outcomes, system-level bias differs from instance-level accuracy, and natural-language critique does not reliably improve a stronger generator. The 2025 preprint JETTS, evaluating ten judges, eight generators, and three task domains, found judges competitive with outcome reward models for reranking but weaker than process reward models in beam search; critique-based refinement was ineffective, and weak judges helped strong generators mainly on easier tasks.

AIOS thesis. A judge should answer a bounded semantic question using an evidence packet composed for that question. It should not be asked simultaneously to discover the rubric, retrieve all relevant context, resolve identity, authorize an action, and validate the effect.

If substantially correct. Review becomes a first-class cognitive mode with its own context and contract. Multiple review passes can be genuinely diverse—for example, factual support, structural coherence, policy compliance, and voice—rather than several agents paraphrasing the same global scratchpad. Deterministic tests and human review can be reserved for properties that a judge cannot establish.

Conditions and counterforces. The rubric must be observable; reference evidence must be available; presentation bias must be tested; decisions must permit abstention; correlated judges do not constitute independent evidence. Multi-LLM Debate shows theoretically and empirically that similar models or responses can converge on a shared misconception. Role labels alone do not create epistemic diversity.

3.2 Planners, routers, and tool selectors

Evidence. Planning and routing are useful but uneven. RouteLLM learned to choose between stronger and weaker models from preference data and reported more than a twofold cost reduction without loss on its response-quality benchmarks. This supports semantic routing as an optimization primitive, but not routing based on security or consequence. PlanningArena tested application and API plans involving tool selection, logical structure, and user profiles; GPT-4o scored 56.5% overall and DeepSeek-V3 41.9%. ToolSandbox added stateful execution, implicit dependencies, a user simulator, and intermediate milestones, finding state dependency, canonicalization, and insufficient-information cases particularly difficult. In τ-bench, GPT-4o completed fewer than half of realistic retail and airline tasks, and retail pass^8 was below 25%, meaning success was highly inconsistent over repeated trials.

AIOS thesis. Planning should normally produce a typed, inspectable dependency graph or bounded next-step proposal. The executor owns state mutation. A router chooses among declared models, contexts, or workflows; it does not silently widen data disclosure or privileges.

If substantially correct. Model routing can become a policy-aware cognitive scheduler: local models for private recurring work, frontier models for difficult bounded analysis, deterministic programs for exact transformations, and humans for consequential choice. Planning artifacts can persist independently of any model session and can be resumed, reviewed, simulated, or re-executed under new policy.

Conditions and counterforces. A plan that parses may still encode the wrong state, as Planetarium demonstrates. Routing needs task-difficulty and risk calibration, not just cost/quality prediction. Long-horizon plans encounter changing state, failed tools, incomplete user intent, and version skew. State must be read from the environment rather than trusted from a scratchpad.

3.3 Editors and software agents

Evidence. The architecture around a model materially changes its performance. SWE-agent reported 12.5% pass@1 on SWE-bench and 87.7% on HumanEvalFix, with a custom agent–computer interface improving repository navigation, editing, and testing. OpenHands made sandboxed code, command, and web interaction a platform abstraction and evaluated generalist agents across 13 tasks.

The strongest counterpoint to autonomy is Agentless, a peer-reviewed FSE 2025 system with three fixed phases—localization, repair, and patch validation—and no model-controlled future-action loop or complex tool use. It resolved 98 of 300 SWE-bench Lite issues (32.67%) at an average reported cost of $0.68, outperforming the open systems compared at submission time. The paper also identified misleading or inadequate issue descriptions and benchmark problems, making its result evidence for both bounded pipelines and careful task construction.

The ceiling remains low on broader work. The peer-reviewed, vendor-coauthored FeatureBench constructed 200 complex feature tasks and 3,825 executable environments from 24 repositories. In its paper baselines, Claude Opus 4.5 resolved 11.0% of the full set and GPT-5.1-Codex 12.5%. Feature tasks averaged about 790 changed lines and 15.7 files, compared with roughly 33 lines and 1.7 files in SWE-bench. The result indicates that bug-patch benchmarks do not establish autonomous feature development.

Benchmark interpretation itself is unstable. In February 2026, OpenAI stopped reporting SWE-bench Verified after auditing 138 difficult cases: 59.4% had material test or description problems, and frontier models could reproduce gold-patch or problem-specific information for some tasks. This is vendor-authored evidence, but it includes a documented audit and a direct warning against treating a familiar score as a stable measure of real capability.

AIOS thesis. Thinking about a change, locating evidence, composing prose or code, applying an edit, validating structure, and integrating the result are not one undifferentiated loop. Each can have a clean context and an output contract. File operations are exact, version-aware effects; model text is a proposal.

If substantially correct. Software agents become less like autonomous virtual developers and more like cognitive components embedded in a durable engineering environment. Their work survives model replacement because the repository context, issue interpretation, proposed patch, tests, decisions, and provenance remain external artifacts. The same pattern generalizes to research and knowledge work.

Conditions and counterforces. Fixed stages can fail when exploration and repair must interleave. Agentless itself found that missing location clues made tasks harder, where agent search can help. Specialization imposes handoff cost and may lose cross-stage information. The correct comparison is not “agents versus workflows” in the abstract but adaptive control within explicit state, context, and authority boundaries.

3.4 Context specialists and cognitive modes

Evidence. NoLiMa tested 13 models with long contexts whose relevant facts had little lexical overlap with the question. At 32K tokens, 11 models fell below half of their short-context baseline; GPT-4o fell from 99.3% to 69.7%. LongBench v2 assembled 503 questions over contexts from 8,000 to two million words across documents, repositories, dialogue, and structured data; the best direct-answer model scored 50.1%, while a longer-reasoning model reached 57.7%. These studies show that nominal context capacity is not semantic access.

The 2026 preprint SWE-Edit directly targets “context coupling.” It separates a viewer that retrieves task-relevant code from an editor that executes a high-level plan, leaving the main model a cleaner reasoning context. It reports a 2.1-point improvement and 17.9% lower inference cost on SWE-bench Verified. The gain is modest and the benchmark is now known to be compromised at frontier performance, but the mechanism is directly relevant.

AIOS thesis. A cognitive mode is justified when it changes one or more of: the purpose, admissible context, contamination boundary, model behavior, output contract, evaluator, or permission set. Thinking may need alternatives and unresolved questions; writing may need voice and source material; editing may need only the target and change instruction; structural composition may need an artifact graph; integration may need canonical versions, invariants, and exact effects.

If substantially correct. Context becomes an architectural resource like memory or authority. Specialized calls can reduce context pollution, make provenance sharper, permit smaller local models to succeed on bounded work, and enable targeted evaluation. A single durable workflow can combine different models without losing its identity.

Conditions and counterforces. There is no current evidence that a universal list of faculties—thinking, writing, editing, composition, planning, review, integration—maps one-to-one to optimal agents. Separation can remove useful shared state, multiply latency and cost, and create handoff defects. The hypothesis must be tested against a same-model, same-token, single-context control. Multi-agent debate warns that more calls and role names can reproduce the same error rather than diversify cognition.

3.5 Intelligence as a cumulative system outcome

Evidence. Current studies isolate several architecture-sensitive gains: better agent interfaces improve software work; relevant context outperforms undifferentiated long context; routing can reduce model cost; fixed phases can outperform autonomous loops; clean viewer/editor contexts can modestly improve repair; schemas improve parseability; deterministic validation catches effects a model cannot establish; and durable state enables end-state evaluation. The evidence does not yet establish that these gains add linearly or even monotonically. A new boundary can introduce handoff errors; another memory layer can retrieve distracting material; repeated review can amplify correlated bias; post-processing can erase the semantic gain it was meant to preserve.

AIOS thesis. Useful intelligence is a property of the whole response-producing system, not merely of model weights. Many individually modest improvements—purpose framing, composed context, distinct cognitive modes, multiple memory layers, relational metadata, provenance, bounded judgment, planning, verification, and post-response integration—may jointly lower the inference burden placed on any one call. The same system can select models dynamically according to the cognitive movement, required capability, privacy, sensitivity, latency, and cost.

If substantially correct. Progress in system intelligence need not wait exclusively for a larger model. Better local context and scaffolding could turn some tasks that currently require expensive frontier inference into routine bounded calls, reduce retries by preventing avoidable ambiguity, and reduce hallucination exposure by substituting authoritative files, relations, and deterministic checks for remembered world state. Frontier models remain important for difficult synthesis, novel reasoning, and architectural improvement; they become selective resources in a durable person-owned system rather than the only place where useful intelligence can occur.

Conditions and counterforces. The cumulative effect is untested. Improvements may overlap, interfere, or shift cost from inference to authoring and maintenance. Dynamic routing can leak sensitive context if risk is not part of the decision, and weak routers can send hard tasks to weak models. Multi-layer memory can preserve errors as readily as expertise. The system-level hypothesis therefore requires component ablations, interaction-effect measurement, longitudinal tasks, and accounting for human maintenance time—not only end-task accuracy.

4. Typed outputs, capabilities, and the trusted effect boundary

4.1 Typed outputs solve an interface problem, not the whole control problem

JSONSchemaBench is a 2025 preprint and workshop contribution built from 10,000 real-world JSON schemas plus the official JSON Schema test suite. It evaluates six constrained-decoding frameworks across efficiency, constraint coverage, and generation quality. Its existence is itself instructive: “JSON-conformant” is not a single, implementation-independent capability. Schema subsets, compilation behavior, latency, and content quality vary among frameworks.

OpenAI’s August 2024 Structured Outputs announcement reported 100% complex-schema adherence for gpt-4o-2024-08-06, compared with less than 40% for an older model under the vendor’s evaluation. This is useful vendor evidence for syntax-level reliability. It does not test whether schema-conformant fields express the correct task judgment. Planetarium and the constraint-tax studies show why that qualification matters.

A typed output is most protective when:

• the operation vocabulary is closed and semantically documented;
• each target reference is later resolved by trusted code;
• the model can say “insufficient context” or “none of the above”;
• the schema preserves evidence, alternatives, and scope where they affect review;
• validation includes domain invariants, not only JSON Schema;
• the executor can independently simulate or verify the effect.

It becomes harmful when it compresses discovery or creation into a premature taxonomy, or when downstream code treats a valid enum as proof that the model chose correctly.

4.2 Capability security and least privilege

Classical least privilege asks that a component possess only the authority necessary for its task. For model-mediated systems, this should be applied to the runtime, tool inventory, individual resources, operations, arguments, duration, and data flows. A tool description in the prompt is not a capability. A capability is an unforgeable or independently enforced authority at the boundary.

The 2025 preprint Progent expresses tool privilege in a domain-specific policy language over tool names and arguments, then enforces the policy deterministically. Its automated policy generator can propose updates, but privilege expansion requires explicit approval and narrowing can be checked as monotonic confinement. The authors report reducing attack success from 39.9% to 1.0% on AgentDojo and from 70.3% to 3.9% on Agent Security Bench while preserving reported utility. Progent cannot prevent harm that lies inside the granted least privilege, such as manipulating a permitted preference or producing malicious text. That limitation clarifies the thesis: permission boundaries contain authority; they do not make model intent correct.

The 2025 preprint CaMeL separates control flow, extracted from the trusted user query, from data returned by untrusted tools. Capabilities constrain where private data can flow. It reports completing 67% of AgentDojo tasks with provable security under its model. The guarantee depends on a trusted query, an accurate control-flow extraction, and the formal threat model; it does not establish universal prompt-injection immunity.

The Microsoft-authored 2025 preprint Fides formalizes confidentiality and integrity labels for agent planners, deterministically enforces information-flow policies, and selectively hides information. Its AgentDojo results indicate that information-flow control can increase the set of tasks completed securely. Together, CaMeL and Fides connect contemporary agents to capability systems, taint tracking, and language-based security more directly than prompt-level defenses do.

4.3 Authorization is not model alignment

A model may faithfully infer the user’s goal and still lack authority to perform it. It may be authorized to read a file but not disclose it, to draft a message but not send it, to change a branch but not merge it, or to propose metadata without changing the canonical record. Authorization therefore needs:

• a real subject: person, service, or delegated process;
• a resource identified independently of model text;
• an operation and argument constraint;
• purpose or task scope where relevant;
• temporal and environmental conditions;
• an auditable grant and revocation path.

The Model Context Protocol tools specification dated 25 November 2025 gives tools input and optional output schemas but explicitly requires servers to validate inputs, enforce access controls, rate-limit calls, and sanitize outputs. It recommends that clients show inputs, request confirmation for sensitive operations, validate results, time out calls, and log usage. Tool annotations are untrusted unless their server is trusted. The companion authorization specification uses OAuth-based protected-resource mechanisms, scope negotiation, token audience binding, and privilege restriction. These are protocol requirements and recommendations, not a demonstration that implementations apply them correctly. They nevertheless codify the separation between model tool choice and system authorization.

4.4 Human approval is necessary in some paths and insufficient as a general defense

Approval is valuable when it allocates genuinely consequential authority to a person and presents a small number of understandable choices. It degrades when every low-risk action prompts, when the model authors the description of the action, or when the approved action can change before execution.

Anthropic’s vendor-authored May 2026 containment report states that users approved roughly 93% of permission prompts and that sandboxing reduced prompts by 84%. This is operational evidence for approval fatigue, not an independently audited population study. The 2026 preprint Consent Integrity formalizes the missing property: a trusted mediator should render the real boundary action, over a path the agent cannot spoof, and bind approval to the exact action that executes. Its prototype is intentionally incomplete and classifies much normal command usage as uninspectable, so it is a research direction rather than a solved interface.

For AIOS, consequential approval should therefore be generated from the canonical target, operation, parameters, and computed diff—not from the model’s rationale. The rationale may accompany the decision, but it is not the trusted rendering. Approval should be risk-tiered, cacheable only within explicit bounds, and invalidated by any target-version or effect change.

4.5 Recommended boundary invariants

A bounded executor should enforce at least the following invariants:

1. No ambient authority. A model call receives no credential or tool not required by its declared task.
2. No model-minted identity. Names and paths are resolved to canonical identifiers, and ambiguous resolution fails closed.
3. No silent scope growth. Policy updates can narrow automatically; any broader resource, operation, data destination, or duration requires a separate grant.
4. No unchecked composition. A sequence of individually allowed actions is evaluated for its aggregate effect and information flow.
5. No approval by narration. The confirmation view is rendered from the exact boundary event and bound to execution.
6. No success by assertion. Postconditions are read from the environment and recorded.
7. No invisible mutation. Consequential changes produce a durable diff, provenance record, and recovery path where technically possible.
8. No forced certainty. The semantic contract includes abstention and a request for more context.

5. Security evidence and contrary findings

5.1 Prompt injection is a control/data problem

AgentDojo, peer-reviewed at NeurIPS 2024, introduced 97 realistic tasks and 629 security cases across email, banking, travel, and related tool environments. It formalized the central agent problem: tool-returned text contains data and may also contain adversarial instructions, while a language model lacks a reliable internal boundary between them. State-of-the-art models failed many clean tasks, and attacks and defenses each protected only some properties.

Agent Security Bench, peer-reviewed at ICLR 2025, expanded the surface to ten scenarios, ten agents, more than 400 tools, 27 attack or defense methods, seven metrics, and 13 model backbones. Its highest average attack success rate was 84.30%, with vulnerabilities in system prompts, user-input handling, tools, and memory. These are simulated environments, and attack success depends on the chosen agents and threat models. The breadth makes it difficult to attribute the problem to a single bad prompt.

Model-based defenses can help. Task Shield, peer-reviewed at ACL 2025, asks whether each instruction and tool call contributes to the user’s declared task. On AgentDojo with GPT-4o it reported 2.07% attack success and 69.79% task utility. But a separate peer-reviewed adaptive study bypassed eight indirect-prompt-injection defenses with attack success consistently above 50%. Prompt-level and auxiliary-model defenses should therefore be treated as defense in depth, not the reference monitor.

5.2 Production systems converge on bounded mechanics

Current coding systems expose a practical division between probabilistic judgment and mechanical execution:

• OpenAI Codex (vendor evidence): the GPT-5.2-Codex safety addendum describes isolated containers for cloud work, network disabled by default, and local sandboxes that restrict writes to the workspace. Users may authorize unsandboxed execution or project-specific network access. The model chooses commands; operating-system controls bound them.
• GitHub Copilot cloud agent (vendor documentation): GitHub’s risk and mitigation documentation limits who can trigger the agent, constrains it to one branch and limited credentials, subjects it to branch protections, prevents it from approving or merging its own pull request, and normally requires a human to approve workflow execution. Semantic implementation is delegated; repository integration remains governed.
• Claude Code (vendor evidence): Anthropic describes a default read/approval model, filesystem and network isolation, scoped credentials outside the sandbox, and a proxy that verifies repository and branch operations in its 2025 sandboxing report. Its 2026 containment report emphasizes that traditional proxy, authentication, configuration, and tenancy bugs remain decisive, and reports cases where models found unintended paths around task restrictions.
• OpenHands (peer-reviewed): code, command, and web actions are exposed through an execution API inside sandboxed environments. The model operates a general interface, but environment construction and isolation remain platform responsibilities.

These systems do not prove the optimality of the AIOS design. They do show that practical agent developers do not rely on instruction-following alone when models can mutate consequential state.

5.3 Failure attribution

Agent failures are often described generically as hallucination. That obscures which architectural remedy is appropriate.

This taxonomy matters because better prompting cannot repair a broken authorization check, and a sandbox cannot supply missing semantic evidence. AI-native architecture should make the source of failure diagnosable in the durable record.

6. Major source analyses

The following sources carry the most weight for the thesis. Each analysis separates the research question, method, finding, limitation, and architectural relationship.

6.1 JudgeBench — semantic judgment under objective ground truth

Status: Peer-reviewed, ICLR 2025. Source: JudgeBench: A Benchmark for Evaluating LLM-Based Judges

Question. Can LLM judges distinguish correct from incorrect answers when pairs are difficult and a ground-truth answer exists?

Method or benchmark. The authors created 350 challenging response pairs spanning knowledge, reasoning, mathematics, and coding from datasets with objective ground truth, then evaluated strong general and specialized judge prompts.

Finding. Leading judges performed only modestly above random on difficult pairs; reported overall figures include 50.86% for a vanilla GPT-4o judge and 56.57% for an arena-style judge configuration. The benchmark contradicts conclusions drawn mainly from easy preference data.

Limitations. It is a small, constructed pairwise set, not a longitudinal domain deployment. Objective answer correctness differs from open-ended editorial or contextual judgment. Results are tied to the tested model versions and prompts.

Relationship to the thesis. A model can be a useful semantic judge, but the local bounded decision needs its own calibration and fallback. Judgment must not double as effect authorization.

6.2 Planetarium — syntax, solvability, and semantics diverge

Status: Peer-reviewed, NAACL 2025. Source: Planetarium: A Rigorous Benchmark for Translating Text to Structured Planning Languages

Question. Do language models correctly translate natural-language planning problems into PDDL, beyond producing parseable or solvable plans?

Method or benchmark. A semantic-equivalence algorithm and 145,918 text-to-PDDL pairs across 73 state combinations test structured planning output at multiple difficulty levels.

Finding. For GPT-4o, 96.1% of generated problem descriptions were parseable and 94.4% solvable, but only 24.8% semantically correct.

Limitations. PDDL has unusually explicit formal semantics and is not representative of every typed business operation. The exact model and prompting are time-bound.

Relationship to the thesis. It is the clearest current evidence that syntactic and executable validity do not establish semantic validity. AIOS needs independent semantic or state validation wherever possible.

6.3 Let Me Speak Freely? — constraints can tax reasoning

Status: Peer-reviewed industry track, EMNLP 2024. Source: Let Me Speak Freely? A Study on the Impact of Format Restrictions on Large Language Model Performance

Question. Does requiring JSON, XML, YAML, or constrained decoding change reasoning and knowledge performance?

Method or benchmark. The study compares natural-language output, format instructions, constrained decoding, and a natural-language-then-format pipeline across common reasoning and knowledge tasks.

Finding. Structured restrictions significantly degraded reasoning, with stricter constraints generally causing greater decline. Delaying format conversion mitigated some loss.

Limitations. The effect varies by model, schema, and task; the study does not imply that all structured output is harmful. It focuses on answer generation, not full authorization pipelines.

Relationship to the thesis. Types should protect the boundary without occupying the whole reasoning space. “Reason free, constrain late” is a testable default, not an absolute rule.

6.4 τ-bench — state correctness and repeated reliability

Status: Peer-reviewed, ICLR 2025. Source: τ-bench: A Benchmark for Tool–Agent–User Interaction in Real-World Domains

Question. Can a tool-calling agent converse with a user, follow domain policy, and reliably reach a correct database state?

Method or benchmark. Simulated users interact dynamically with customer-service agents in retail and airline domains. Evaluation compares the final database state with a goal state and measures pass^k over repeated trials.

Finding. GPT-4o completed fewer than 50% of tasks, and retail pass^8 was below 25%, exposing substantial run-to-run variability.

Limitations. Users are model-simulated, policies are benchmark-specific, and product systems may add safeguards absent from the benchmark.

Relationship to the thesis. End-state verification and repeated reliability are more informative than a plausible transcript. Deterministic effects reduce variance at the state boundary but do not repair a wrong semantic choice.

6.5 Agentless — bounded stages can beat autonomous loops

Status: Peer-reviewed, FSE 2025. Source: Demystifying LLM-based Software Engineering Agents

Question. Is complex autonomous tool control necessary for repository-level issue resolution?

Method or benchmark. A fixed three-phase pipeline localizes files, generates repairs, and validates patches without allowing the model to choose future actions or operate complex tools. The authors evaluate on SWE-bench Lite and manually inspect task quality.

Finding. Agentless resolved 32.67% of the 300 tasks (98 fixes) at a reported average cost of $0.68, leading compared open systems at submission time. Its analysis found task descriptions and ground truths that could mislead evaluation.

Limitations. SWE-bench Lite is small, public, and susceptible to leakage and test defects. Fixed phases can be weaker when exploration and repair must interleave. Comparisons age quickly as models change.

Relationship to the thesis. It is strong evidence that explicit cognitive stages and deterministic orchestration can preserve or improve utility while reducing autonomy and cost. It does not prove that all work should be a fixed pipeline.

6.6 FeatureBench — the long-horizon software gap

Status: Peer-reviewed, ICLR 2026; vendor-coauthored. Source: FeatureBench: Benchmarking Agentic Coding for Complex Feature Development

Question. Do coding-agent gains on bug repair transfer to multi-file feature development?

Method or benchmark. The authors derive 200 feature tasks and 3,825 executable environments from 24 repositories, with tasks requiring substantially larger changes than SWE-bench.

Finding. The paper’s strongest reported full-set baselines resolve only 11.0% and 12.5%. Average task scale is about 790 changed lines and 15.7 files.

Limitations. A synthetic extraction pipeline constructs “feature-missing” environments; test coverage remains an imperfect proxy for product quality. Model and agent versions will age.

Relationship to the thesis. Broad agent access does not solve long-horizon coherence. Durable plans, artifact graphs, specialized contexts, integration checks, and human authority remain research-critical.

6.7 AgentDojo and Agent Security Bench — security is systemic

Status: Peer-reviewed, NeurIPS 2024 and ICLR 2025. Sources: AgentDojo; Agent Security Bench

Question. How vulnerable are tool agents to prompt injection, poisoned memory, backdoors, and attacks across the agent lifecycle?

Method or benchmark. AgentDojo provides 97 tasks and 629 security cases in interactive tool environments. ASB broadens this to ten scenarios, over 400 tools, 27 attack or defense methods, and 13 model backbones.

Finding. Clean task performance remains limited, prompt injection compromises some but not all properties, and ASB records a highest average attack success of 84.30% with limited defense effectiveness.

Limitations. Simulated attacks and fixed tool environments cannot enumerate production threats. Benchmark attacks can over- or under-estimate adaptive adversaries.

Relationship to the thesis. Model instructions are not a security boundary. Untrusted context must be unable to grant itself authority or redefine the trusted control flow.

6.8 CaMeL, Progent, and Fides — enforce security outside the model

Status: Preprints, 2025; CaMeL includes Google-affiliated authors and Fides is Microsoft-authored. Sources: CaMeL; Progent; Fides

Question. Can agent utility be retained while security properties are enforced by deterministic control/data, privilege, or information-flow mechanisms?

Method or benchmark. CaMeL extracts trusted control flow and applies capabilities; Progent enforces a tool-policy DSL; Fides labels and mediates confidentiality and integrity. All evaluate against AgentDojo, and Progent also uses ASB and AgentPoison.

Finding. CaMeL reports 67% of AgentDojo tasks completed with provable security under its model. Progent reports large reductions in attack success with maintained utility. Fides reports a broader securely solvable task set than simpler taint designs.

Limitations. They are preprints, their guarantees depend on specific formal assumptions, and none prevents all harm within legitimate privilege. Policy generation, label assignment, and trusted-query assumptions can fail.

Relationship to the thesis. These are the closest technical analogues to bounded semantic sovereignty: the model remains semantically useful while authority and allowable flows are mediated by a smaller trusted system.

6.9 NoLiMa — composed context beats nominal capacity

Status: Peer-reviewed, ICML 2025. Source: NoLiMa: Long-Context Evaluation Beyond Literal Matching

Question. Can models retrieve semantically related evidence from long contexts without literal question–answer overlap?

Method or benchmark. Thirteen models with claimed contexts of at least 128K tokens locate latent semantic associations while distractor context grows.

Finding. At 32K tokens, 11 models fell below half their short-context baseline; GPT-4o dropped from 99.3% to 69.7%.

Limitations. Needle-style retrieval remains narrower than full reasoning over a lived repository. Performance may improve with retrieval or later models.

Relationship to the thesis. Context should be composed for purpose rather than indiscriminately accumulated. Durable local knowledge is valuable only if the system can retrieve and present the right portion.

6.10 OpenJarvis — local models plus optimizable scaffolding

Status: Preprint, May 2026; Stanford and industry-affiliated authors. Source: OpenJarvis: Personal AI, On Personal Devices

Question. Can a personal-agent stack be decomposed and optimized so that a local model approaches a frontier cloud system without routing ordinary inference to the cloud?

Method or benchmark. The authors represent the stack as a typed specification over intelligence, engine, agents, tools and memory, and learning. Frontier models propose configuration edits during search; only non-regressing edits are accepted; the final specification runs locally. Eight personal-AI benchmarks are used.

Finding. A naive switch from Claude Opus 4.6 to Qwen3.5-9B reduced accuracy by 25–39 percentage points. Specification search produced local systems that matched or exceeded the cloud baseline on four of eight benchmarks and were within 3.2 points on average, with much lower reported marginal API cost and latency.

Limitations. It is a recent preprint, the benchmarks and system are author-controlled, frontier assistance is still used during configuration, and the result does not establish durable personal memory, authorization, regulated deployment, or longitudinal maintenance. Exact cost claims depend on workload and hardware.

Relationship to the thesis. This is the most direct current evidence for the proposition that architecture and scaffolding can reduce the model-capability burden. It also supplies decisive contrary evidence against naive local substitution. AIOS’s complementary local–frontier position is more consistent with the result than either cloud elimination or unchanged cloud-first stacks.

6.11 Apple on-device models and Gemma 3 — local feasibility, not equivalence

Status: Vendor-authored technical reports and model documentation, 2025–2026. Sources: Apple Intelligence Foundation Language Models Tech Report 2025; Gemma 3 model card

Question. Are useful language, multimodal, and tool-calling capabilities deployable across personal-device and small-server hardware classes?

Method or system. Apple reports an approximately 3B-parameter, two-bit on-device model with multilingual, image, and tool-use capabilities plus a server counterpart. Google documents open-weight Gemma 3 variants from 270M to 27B, with intended platforms ranging from mobile devices to server clusters.

Finding. Production-oriented model families now span on-device, desktop, and server deployment. Apple reports that its on-device model matches or exceeds comparably sized open baselines on selected public and human evaluations; Gemma exposes broad size and language coverage.

Limitations. These are vendor-selected evaluations and intended-platform statements, not independent proof that small local models satisfy general personal or organizational needs. Privacy claims depend on the complete application and telemetry path, not model location alone.

Relationship to the thesis. Local execution is technically concrete, while cloud fallback remains valuable. The evidence supports heterogeneous model selection and person-owned inference for bounded tasks, not parity with frontier systems.

6.12 Current specifications and production controls — emerging engineering consensus

Status: Authoritative specification and vendor operational documentation, 2025–2026. Sources: MCP tools; MCP authorization; OpenAI Codex safety; GitHub agent risks; Anthropic containment

Question. How are current tool and coding-agent systems dividing model choice from execution, credentials, network access, and human authority?

Method or system. Protocol requirements and deployed product controls are described rather than experimentally compared.

Finding. Input schemas coexist with independent validation and authorization. Coding agents commonly run in sandboxes, use restricted network and filesystem access, receive scoped credentials, produce branch- or workspace-bounded changes, and require humans for privilege expansion or integration.

Limitations. Documentation states design intent and selected operating experience; it does not demonstrate complete implementation or compare architectures under a common threat model. Vendor telemetry is not independently audited.

Relationship to the thesis. The operational direction strongly supports bounded execution. AIOS should adopt these controls as a floor and make semantic contracts, durable context, and exact integration its additional research contribution.

7. Is “AI-native software architecture” a research category?

7.1 Present state of the label

The exact phrase does not yet identify a mature research field. Searches across the primary 2024–2026 literature locate many papers on language agents, compound AI systems, tool learning, model routing, neuro-symbolic methods, secure agents, AI-assisted software engineering, local inference, and mixed-initiative systems, but few that define “AI-native software architecture” as their central scientific object. The Software Engineering Institute’s May 2026 AI-Native Software Engineering program uses the term for an emerging practice of producing software with AI while retaining architecture, quality, and technical-debt discipline. It is authoritative practice evidence, not a field-defining peer-reviewed theory.

7.2 What is inherited

Most primitives are established:

• neural components linked to symbolic representations or solvers;
• semantic parsing into executable representations;
• mixed-initiative allocation of control between people and automation;
• workflow and blackboard architectures;
• capability security, reference monitors, information-flow control, and effect systems;
• model selection, ensembles, and routing;
• context retrieval and external memory;
• local-first data ownership and replicated collaboration;
• human approval, provenance, audit, and change control.

Calling their combination AI-native does not make them new.

7.3 What could be distinctive

The category becomes analytically useful if it studies architectures with all of the following commitments:

1. Probabilistic semantics is a first-class component. The system is designed around meaningful uncertainty rather than hiding a model behind a text field.
2. Context is an architectural product. Context selection, provenance, trust, and purpose are designed and evaluated, not treated as prompt assembly glue.
3. Model and system intelligence are separated. End capability is attributed to the interaction among model, memory, tools, artifacts, verification, and person.
4. Authority is externalized. Models propose within capabilities; a trusted boundary controls identity, authorization, and effects.
5. Cognitive contracts are explicit. Different tasks can receive different context, model, output, and evaluator.
6. Durable state outlives the model session. Plans, decisions, artifacts, relationships, and provenance are inspectable and portable.
7. Human authority is consequential. The person can set purpose, deny or revise effects, change models, inspect history, and retain the artifacts.
8. The system is evaluated end to end. Semantic success, unsafe effects, retries, cost, privacy exposure, auditability, reversibility, and maintenance are measured together.

Under that definition, AI-native architecture is a meaningful research program even though its components have prior names. Its novel object is the governance and composition of general semantic models inside software, especially when models are modular, selectively replaceable, and partially local. Replaceability remains conditional on adapters, evaluation, and revalidation; it does not imply behavioral equivalence. If “AI-native” merely means that a chat model can call functions in a loop, the term adds little.

7.4 Category judgment

Current evidence establishes a converging design space but not a unified field. The AIOS thesis supplies a coherent candidate architecture within that space: file-native durable intelligence, composed context, bounded semantic judgments, exact effects, layered memory, and human authority. If substantially correct, it would move AI-native research away from agent personality and toward context, capability, artifact, and integration architecture. The condition is discriminating evidence: AIOS-like systems must outperform simpler workflows and broad agents on matched, representative tasks rather than relying on architectural plausibility.

8. Implications of local, person-owned reasoning infrastructure

8.1 Personal and organizational intelligence

What evidence establishes. On-device models already perform summarization, extraction, text transformation, multimodal understanding, and constrained tool calls. OpenJarvis provides early evidence that stack optimization can materially narrow a local–cloud capability gap. Agentless and SWE-Edit show that system decomposition can alter cost and task success independently of model weights. Local-first software has already demonstrated that user ownership, offline operation, and collaboration can be compatible design goals for ordinary data systems.

AIOS thesis. The durable intelligence asset is not a chat transcript or a particular set of weights. It is the evolving corpus of files, metadata, annotations, relations, memory, workflows, role contracts, decisions, and provenance that lets a person or organization repeatedly compose good context and integrate results. Models are invoked against that asset.

If substantially correct. Personal knowledge would become less vulnerable to provider churn, model retirement, and closed conversational state. Organizational expertise could be encoded in inspectable artifacts and processes rather than only in employees’ prompts or a platform’s opaque memory. New models could improve the system without requiring its institutional memory to be migrated into a new proprietary application. Smaller organizations could possess sophisticated domain reasoning infrastructure without training a frontier model.

Conditions and counterforces. Artifact quality, retrieval, ontology maintenance, backup, access control, and human comprehension become central operational burdens. A large, poorly curated local corpus can be less useful than a concise remote prompt. Durable memory can fossilize error. Ownership requires portability in practice, not merely local storage behind one implementation.

8.2 Reduced application and inference dependence

What evidence establishes. RouteLLM shows that learned routing can reduce model cost on preference-oriented tasks. Apple, Google, Microsoft, and open-model communities supply increasingly capable model families at device and small-server scales. The 2025 vendor-authored position paper Small Language Models are the Future of Agentic AI argues that repetitive specialized calls often do not need general conversational models; it is an informed position, not a comparative proof. OpenJarvis supplies stronger but still preliminary task evidence for a hybrid local–frontier design.

AIOS thesis. Model choice can be dynamic at the level of cognitive movement and sensitivity. A private local model may retrieve, classify, or edit; a stronger local model may synthesize; a frontier model may handle novel, difficult reasoning; deterministic code may perform exact transformation. Durable application state remains local across these choices.

If substantially correct. Remote inference could become episodic rather than ambient for a wide range of daily work. Organizations could reduce API concentration risk, recurring inference exposure, and dependency on vertically integrated application layers. Frontier providers would remain essential for training and high-difficulty inference, while local infrastructure would capture more of the recurring value from context and workflow.

Conditions and counterforces. The local–cloud gap is real: OpenJarvis measured a 25–39 point loss from naive substitution. Hardware acquisition, power, thermal limits, support, model updates, and multilingual quality constrain accessibility. Routing itself must be evaluated for semantic accuracy and disclosure risk. Centralized services may remain cheaper or safer at many utilization levels because they amortize hardware and operations.

8.3 Private local cognition

What evidence establishes. Local inference can prevent prompt and file contents from being transmitted to a remote inference provider on the inference path. Apple reports local execution without third-party data transfer for selected models, and its approximately 3B model demonstrates deployable personal-device inference. Security research also shows that any agent exposed to files, tools, and networks remains vulnerable to prompt injection, malicious content, and conventional runtime defects. A 2025 peer-reviewed study found that language models frequently leaked personally identifiable information in privacy-sensitive summaries, demonstrating that local execution and privacy-preserving output are different properties.

AIOS thesis. Keeping the durable corpus, relationships, memory, and most inference local reduces the number of parties and transmissions involved in private sensemaking. When frontier inference is needed, AIOS can compose the minimum purpose-specific context and record what was disclosed.

If substantially correct. People could use richer longitudinal context—journals, correspondence, research, health records, or organizational memory—without making routine remote disclosure the default. Sensitive domains could separate local preparatory cognition from the smaller evidence package authorized for an external specialist model or human collaborator.

Conditions and counterforces. “Local” is not synonymous with confidential. Device compromise, malware, insecure backups, telemetry, model supply-chain attacks, plugins, and data exfiltration through allowed tools remain. Context minimization must be measurable. Privacy guarantees require data-flow analysis, access controls, retention policy, and clear remote-call indicators, not a local-model badge.

8.4 Regulated and high-accountability use

What evidence establishes. Current regulation and standards emphasize documentation, risk management, human oversight, logging, robustness, and cybersecurity. The European Commission’s current AI Act overview lists risk management, data quality, traceability, documentation, deployer information, human oversight, robustness, cybersecurity, and accuracy among high-risk obligations on the applicable schedule. The NIST Generative AI Profile provides voluntary actions for mapping, measuring, managing, and governing generative-AI risk. OWASP’s Top 10 for Agentic Applications for 2026 reflects a multi-stakeholder security consensus around agent goal, identity, tool, memory, supply-chain, and human-agent risks.

AIOS thesis. A local file-native system can attach provenance, purpose, source context, model identity, version, policy, approval, and exact effects to durable artifacts. Bounded judgments and deterministic operations create points where evidence can be collected and access can be enforced.

If substantially correct. Regulated workflows could use models without allowing them to become uninspectable systems of record. Auditors could examine which facts and policies a judgment received, which authority permitted an effect, and which artifact version resulted. Organizations could keep sensitive data within a controlled environment while escalating only de-identified or narrowly composed cases.

Conditions and counterforces. Architecture does not confer compliance. Local deployment may make an organization the effective provider or deployer with new obligations. Proprietary or open model licensing, training-data documentation, bias, accessibility, records retention, and sector law remain. Provenance can show that a bad process was followed consistently; substantive validation and accountable people are still required.

8.5 Peer collaboration and global accessibility

What evidence establishes. The 2019 peer-reviewed local-first software work shows how local ownership, offline use, longevity, and collaboration can be pursued together through replicated data. Open-weight model families now target devices from mobile hardware to workstations. Federated and peer learning research demonstrates mechanisms for sharing updates while retaining some data locally, but also documents privacy leakage and heterogeneous-device challenges. This is enabling evidence, not evidence of a global AIOS network.

AIOS thesis. People and organizations could collaborate by sharing selected artifacts, annotations, workflows, schemas, provenance, or model adapters rather than exporting their entire private context. A file-native environment makes the collaboration unit inspectable. Local inference allows participation under intermittent connectivity and gives communities more control over language and domain adaptation.

If substantially correct. Widespread domain systems could emerge in education, research, public service, small business, and civil society. Peers could exchange reviewed reasoning artifacts and retain local control over how they are integrated. Global access would be less tightly coupled to continuous paid inference and a small number of application providers.

Conditions and counterforces. Hardware, electricity, model downloads, language coverage, accessibility design, technical support, and governance are unevenly distributed. Open weights can reproduce dominant-language bias and enable abuse. Peer exchange needs signatures, provenance, conflict resolution, trust policy, and safe import. Decentralization can fragment standards or shift unpaid maintenance onto communities. Accessibility is a hypothesis to measure by total cost and real participation, not a consequence of openness alone.

9. Foundational lineage before August 2024

This section is intentionally separate from the primary evidence window. The older work does not validate AIOS; it identifies the intellectual debts and the points of continuity.

9.1 Protection, capabilities, and effects

Saltzer and Schroeder’s 1975 protection principles established fail-safe defaults, complete mediation, separation of privilege, least privilege, economy of mechanism, and psychological acceptability. Bounded semantic sovereignty is a new application of these old constraints: every model-requested effect should be mediated, authority should default closed, and the trusted mechanism should be smaller than the semantic component it constrains.

Polymorphic effect systems in 1988 separated what an expression computes from where and how it may cause side effects. A typed model response is not a programming-language effect type, but the analogy is useful: the result’s semantic content and its allowed effects should be described and checked separately.

Object-capability security and information-flow control add the ideas that authority can be conveyed by explicit references and that confidentiality and integrity can be properties of data movement, not only of individual API calls. CaMeL, Progent, and Fides are direct contemporary continuations.

9.2 Mixed initiative and human authority

Horvitz’s 1999 principles of mixed-initiative interfaces argued for an explicit coupling between automated services and direct manipulation, including reasoning about uncertainty, the costs of actions, and when to involve the user. AIOS’s person-retained consequential authority belongs to this lineage. Its distinctive challenge is that today’s model can compose novel semantic actions faster than a person can inspect them, making approval quality and capability boundaries more important.

9.3 Neuro-symbolic and program-aided reasoning

Neuro-symbolic AI long predates language agents and studies combinations of learned representations with logic, programs, and symbolic knowledge. PAL, peer-reviewed at ICML 2023, used the model to decompose natural-language problems into programs and delegated exact solution steps to an interpreter, improving accuracy across 13 reasoning tasks. It is a clean predecessor to semantic judgment plus deterministic mechanism, though it concerns computation rather than authorization or durable artifacts.

9.4 Reasoning and acting

ReAct, peer-reviewed at ICLR 2023, interleaved natural-language reasoning with actions and observations so plans could update with environmental feedback. Toolformer, peer-reviewed at NeurIPS 2023, trained a model to decide when and how to call APIs. These works establish the modern agent pattern that AIOS partly restrains: their semantic–mechanical coupling improves adaptability, but contemporary security results show why acting must occur behind a reference monitor.

9.5 Language-model judging

MT-Bench and Chatbot Arena, peer-reviewed at NeurIPS 2023, reported more than 80% agreement between strong LLM judges and human preferences in its settings while documenting position, verbosity, self-enhancement, and reasoning biases. The 2025–2026 literature in this memo does not overturn that useful result; it narrows it. Preference agreement on open-ended assistant responses does not imply objective correctness on hard pairs, stable code judgment, or authority to cause effects.

9.6 Local-first software

The 2019 Onward! paper Local-first software: You Own Your Data, in Spite of the Cloud articulated seven ideals including offline use, collaboration, longevity, privacy, and user ownership. AIOS extends the local-first question from data and application state to durable context, memory, workflow, and cognitive authority. The extension is architecturally plausible but not yet demonstrated at equivalent maturity.

10. Supported conclusions

1. A semantic model and a trusted control plane should be different components. The evidence strongly supports letting models interpret bounded meaning while deterministic code owns canonical identity, authorization, scopes, preconditions, exact effects, and post-state verification.

1. Structured output is necessary for many integrations but insufficient for safety or correctness. It can make a proposal parseable and restrict its vocabulary. It cannot establish that the selected meaning, target, or effect is right.

1. Reasoning and packaging should be separable. Peer-reviewed work shows that restrictive formats can reduce reasoning. Two-stage or otherwise decoupled generation should be an explicit experimental default where the task is semantically rich.

1. Least privilege must be enforced below the prompt. Prompt instructions, tool descriptions, and model self-restraint do not constitute a security boundary. Capabilities, policy enforcement, sandboxing, credential scoping, and information-flow controls materially constrain blast radius.

1. Human approval is an allocation of authority, not a universal safety mechanism. It is most useful for sparse, consequential choices rendered from the real boundary event. High-frequency model-narrated prompts invite approval fatigue and spoofing.

1. Models are useful judges but unreliable universal judges. They can scale domain review and preferences, yet hard objective cases, code perturbations, position bias, and shared misconceptions require calibration, non-model ground truth where available, and human oversight where consequences are material.

1. Agent performance is architectural. Interface design, context composition, staging, validation, and benchmarks can change outcomes as much as the nominal model. Agentless and SWE-agent demonstrate different useful points in this design space.

1. Long context is not a substitute for composed context. Relevant evidence, trust, purpose, and retrieval quality must be designed. Adding all available text can lower effective semantic access.

1. Distinct cognitive contexts are a supported research direction, not a settled faculty map. The evidence justifies specialization by purpose, information need, output contract, and permission. It does not yet justify a universal ontology of separate agents.

1. Current coding agents already divide semantic judgment from mechanical integration. Sandboxes, restricted network and credentials, branch or workspace bounds, tests, logs, and human merge decisions are common. Their diversity shows there is no settled optimal division.

1. Local and hybrid inference are credible architectural substrates. On-device model families and OpenJarvis show that useful local cognition is real and scaffolding can narrow capability gaps. They do not establish that local models replace frontier models across demanding work.

1. AI-native software architecture is a defensible research program only when operationalized. Its substance is not “software containing an agent.” It is the systematic composition and governance of probabilistic semantics, durable context, deterministic effects, model routing, and human authority.

1. The cumulative AIOS system-intelligence thesis remains open but is scientifically coherent. Evidence supports many components individually. The claim that their gains compound to reduce inference burden, retries, and hallucination risk needs end-to-end, interaction-aware experiments.

11. Unresolved evidence

• No located study makes the central three-way comparison among a rigid deterministic pipeline, bounded semantic judgment with deterministic effects, and a broad autonomous agent on the same representative workload.
• There is no accepted benchmark for “bounded semantic sovereignty,” including both semantic usefulness and authority containment.
• Existing security benchmarks focus on tool agents, not long-lived file-native systems with annotations, relational metadata, multiple memory layers, synchronization, and post-response integration.
• Typed-output research measures schema validity more often than semantic correctness, identity correctness, policy compliance, and exact state transition together.
• The effect of separating cognitive modes has limited direct evidence. Current results do not isolate which gains come from clean context, additional calls, different models, or hand-designed workflow structure.
• There is no strong longitudinal evidence that layered personal memory reduces hallucination rather than reinforcing stale or mistaken beliefs.
• Local-model evidence is rapidly improving but uneven across languages, domains, devices, and accessibility needs. Comparative privacy and total-cost studies are sparse.
• OpenJarvis is the most directly relevant system result but is a single recent preprint. Independent reproduction and tasks involving durable personal knowledge are needed.
• Human authority is poorly measured. Approval rate is not comprehension; intervention rate is not control; and a reviewed output may still be integrated incorrectly.
• Provenance and audit improve inspectability but have not been shown to improve the substantive quality of model-mediated decisions by themselves.
• The interaction among purpose framing, context composition, relational metadata, memory, planning, verification, and integration is unmeasured. Gains may be complementary, redundant, or antagonistic.
• The social implications—organizational autonomy, domain-system proliferation, peer exchange, and global accessibility—are plausible conditional consequences, not current empirical outcomes.

12. Later AIOS connection points

These connections locate the AIOS architecture in the surrounding evidence; they are not claims that this memo has validated the AIOS implementation.

12.1 File-native durable state

Files provide inspectable, portable, versionable units for both source context and model-produced artifacts. The relevant research question is whether file-native state improves recovery, provenance, interoperability, and person ownership compared with opaque application memory without imposing prohibitive synchronization or indexing cost.

12.2 Companion metadata and annotations

Metadata can carry canonical identity, trust, source, sensitivity, relationships, status, and intended use without polluting the human-readable artifact. Annotations can preserve local semantic judgments as reviewable claims rather than silently rewriting source material. Both should be capability-protected and version-bound; neither should be treated as true merely because an earlier model produced it.

12.3 Relationships as context structure

A relationship graph can select semantically adjacent evidence without placing an entire corpus in context. It may reduce lexical-retrieval failure and support structural composition. The graph also creates a new attack and error surface: false links can steer every later context bundle. Link provenance, confidence, counterevidence, and repair therefore matter.

12.4 Multiple memory layers

Working state, episodic history, durable semantic memory, and procedural workflows have different lifetimes and trust. Separating them can prevent a transient model thought from becoming organizational fact. Promotion between layers should be explicit, evidence-backed, reversible, and reviewable.

12.5 Bounded judgment and exact operations

This is the strongest evidence-backed connection. A model chooses meaning inside a typed contract; a smaller trusted boundary resolves objects, checks permission and invariants, renders exact approval when needed, applies an idempotent operation, verifies the post-state, and writes provenance.

12.6 Post-response integration

The response is not the end of the cognitive event. Integration determines whether a suggestion changes an artifact, creates a relation, updates memory, opens a question, or remains a rejected proposal. Making integration explicit may reduce the common failure in which persuasive text is mistaken for completed work.

12.7 Dynamic model selection

The architecture can select models by cognitive movement, capability, privacy, latency, cost, and sensitivity while keeping durable state independent of the selection. This memo supports the architectural boundary—especially disclosure-aware context and privilege—but leaves the full routing benchmark to the dedicated investigation.

12.8 Fractal Seed: Why–How–What

The Why–How–What grammar may provide a recurring contract across tasks and artifacts: purpose constrains context and admissible outcomes; method specifies cognitive mode and capability; result identifies the artifact or effect. Its strongest near-term research value is as a consistent schema for traceability across scales. Whether it improves reasoning, transfer, human comprehension, or error diagnosis is an empirical question and should be tested against alternative grammars, including a no-grammar control.

12.9 First- and second-order AIOS implications

If these components work together, the first-order outcome is not merely cheaper inference. It is a durable system in which a person or organization can accumulate context, expertise, and governed workflows while substituting models. The second-order possibility is a broader redistribution of application-layer intelligence: private local cognition for routine work, selective frontier escalation, portable domain systems, peer exchange of inspectable reasoning artifacts, and less dependence on centralized conversational state. These implications are worth preserving because they follow from the architecture, but they remain conditional on the cumulative system experiment succeeding.

13. Unsafe claims to avoid

• “Valid JSON means the model’s answer is correct.”
• “A typed tool call is authorized because its schema was accepted.”
• “Human in the loop guarantees meaningful control.”
• “A sandbox makes an agent safe.”
• “Local inference guarantees privacy.”
• “An LLM’s rationale faithfully explains its actual decision process.”
• “Multiple agents, critics, or roles are inherently better than one model call.”
• “More context is always better context.”
• “A fixed deterministic workflow is always safer overall”; it can safely enforce the wrong flattened semantics.
• “A broadly autonomous agent is necessary for complex work.”
• “Current bug-fix benchmarks prove autonomous software engineering.”
• “Prompt injection is solved by prompting, filtering, or a second model.”
• “Least privilege prevents every harmful action”; it limits authority, including the authority to cause harm, but does not correct harmful behavior inside an allowed scope.
• “Person-owned local architecture eliminates centralized infrastructure.”
• “Small local models already match frontier models for general personal or organizational reasoning.”
• “AI-native software architecture is an established discipline with an agreed definition.”
• “The full AIOS stack has already been shown to reduce hallucinations, retries, or inference cost.”
• “The Why–How–What grammar has an empirically demonstrated cognitive advantage.”
• “Provenance proves truth or compliance.”
• “Open weights alone create global accessibility or community sovereignty.”

14. Falsifiable experiments

14.1 Core three-architecture trial

Question. Does bounded semantic judgment outperform both a rigid deterministic pipeline and a broad autonomous agent?

Corpus. Build a private, versioned benchmark from real AIOS-like file tasks: ambiguous annotation placement; metadata and relationship inference; research-source triage; voice-preserving edits; structural composition; plan revision after state changes; conflict-aware integration; and mixed-sensitivity context. Include ordinary, adversarial, under-specified, and version-skewed cases. Have domain experts create multiple acceptable semantic outcomes and forbidden effects.

Conditions.

• D — deterministic: rules, extraction, classifiers, and conventional workflow code; no generative semantic decision at runtime.
• B — bounded: model receives purpose-composed context and a role-specific judgment contract; trusted code resolves identity, enforces capabilities, applies or withholds exact effects, and verifies state.
• A — autonomous: the same base model receives a broad tool interface and may plan and execute iteratively under a conventional sandbox and approval design.

Use the same underlying model where applicable, equivalent source information, equal maximum inference budget, and the same allowed final effects. Pre-register prompts, tool interfaces, retry rules, and human-intervention policy.

Primary measures. Expert-rated semantic task success; exact end-state success; unauthorized-effect rate; severe harmful-effect rate; wrong-but-schema-valid rate; pass^1 and pass^8; abstention quality; human correction time; approval comprehension; reversibility; audit completeness; disclosure volume; latency; tokens; API cost; local energy; and total operator time.

Thesis-supporting result. B should exceed D on semantic success and ambiguity handling, while approaching D’s authority containment. It should match or exceed A’s task success with a materially lower unsafe-effect and variability rate. Failure to meet both comparisons weakens the central thesis.

14.2 Cumulative system-intelligence experiment

Question. Do individually modest architecture improvements compound, or merely move cost and error?

Design. Start with a minimal single-call baseline, then add purpose framing, composed context, cognitive-mode separation, relational metadata, layered memory, provenance, bounded response contracts, planning artifacts, deterministic verification, and post-response integration. Use sequential ablation to identify active components, followed by a fractional factorial design over the strongest components to estimate interaction effects. Keep model and task set fixed; repeat with a smaller local and a frontier model.

Measures. Task success, hallucinated unsupported claims, context precision and recall, retries, latency, tokens, human maintenance time, stale-memory errors, integration defects, and effect safety.

Falsifier. If the full system does not outperform its best simpler subset after maintenance cost is included, the claim that intelligence emerges cumulatively from all layers should be narrowed. If gains vanish with a new model family or repository, the scaffolding may be overfit.

14.3 Cognitive-mode and context isolation study

Question. Do specialized contexts improve performance because of functional separation rather than extra compute?

Compare one long scratchpad call, several role-labelled calls sharing the same transcript, and genuinely isolated calls with purpose-specific context. Hold the total token and model budget constant. Test thinking–writing, review–revision, locate–edit–integrate, and plan–execute splits.

Measure success, cross-stage contradiction, irrelevant-context uptake, handoff loss, correction rate, and latency. A result in which isolated contexts do not beat role labels or a single context would reject the strong mode-separation claim for that task.

14.4 Contract-width curve

Question. Where does typing protect integration without taxing semantic intelligence?

Compare free-form output plus parser, prompt-only JSON, hard constrained decoding, natural-language reasoning followed by packaging, a minimal operation menu, a rich schema, and an intentionally over-constrained schema. Measure schema validity, semantic correctness, executable correctness, wrong-valid rate, latency, and abstention. Repeat across small local and frontier models.

The expected curve is non-monotonic: some structure should improve integration, while excessive direct constraint may reduce semantic correctness. If no constraint tax appears, the “reason free, constrain late” recommendation should be scoped to the models and tasks where it is observed.

14.5 Privilege and prompt-injection trial

Question. How much security comes from deterministic privilege boundaries rather than model resistance?

Expose identical agents to adaptive indirect injections under four tool regimes: global tools; task-level allowlist; resource- and argument-level capabilities; and capabilities plus control/data or information-flow separation. Include harmful actions that are outside privilege and harmful actions that remain inside least privilege.

Measure clean utility, attack success, exfiltration, blocked legitimate work, policy-generation error, and privilege-expansion approvals. The architecture should nearly eliminate out-of-capability effects even when the model follows the attack; remaining in-capability harms quantify what the boundary cannot solve.

14.6 Consent-integrity and approval study

Question. Does a trusted exact-effect renderer improve human authority without producing unusable prompt volume?

Randomize participants among model-authored summaries, trusted rendering of canonical action and diff, trusted rendering with risk-tiered batching, and sandboxed execution with only boundary-crossing prompts. Include benign, ambiguous, and deceptive actions.

Measure unsafe approvals, comprehension, time, fatigue over a long session, recall of granted scope, interruption behavior, and post-task trust calibration. Bind approved actions cryptographically or transactionally to execution in the trusted conditions.

14.7 Local–frontier complementarity study

Question. Can person-owned scaffolding reduce remote dependence without unacceptable loss?

Compare fixed frontier, fixed local, naive capability routing, and AIOS-style routing that incorporates purpose, cognitive mode, sensitivity, disclosure minimization, latency, and cost. Keep the durable local corpus and workflow identical. Use private tasks whose evaluation does not require exposing source data to the scorer.

Measure semantic success, remote-call rate, volume and sensitivity of disclosed context, latency, energy, cost, retry rate, and person-rated usefulness. Because a separate task owns full routing research, the architectural criterion here is narrow: no router may expand disclosure or authority merely because it predicts a quality gain.

14.8 Longitudinal memory and artifact study

Question. Does file-native layered memory improve work over time without compounding error?

Run a multi-month study in which participants develop research or organizational artifacts through at least 20 substantive iterations. Compare ephemeral chat memory, a flat retrieval store, and layered file-native memory with promotion rules, provenance, relationships, and correction propagation.

Measure recovery of prior decisions, contradiction, stale-memory reuse, source traceability, migration across model providers, privacy incidents, maintenance time, and artifact quality. Seed known false memories and later corrections to test whether the system propagates or repairs them.

14.9 Fractal Seed experiment

Question. Does a recurring Why–How–What grammar improve traceability or reasoning across scales?

Compare no explicit grammar, Why–How–What, and at least one alternative such as goal–evidence–action or claim–support–implication. Apply each at task, plan, artifact, and integration levels while holding context and model constant.

Measure task comprehension, scope drift, plan–effect alignment, human audit speed, transfer to new domains, and verbosity overhead. Evidence should support only the dimensions that improve; a traceability gain would not by itself establish better reasoning.

14.10 Evidence threshold for the architecture

The architecture should be considered superior only if results are reproduced across multiple model families, including at least one local model; multiple domains; adversarial and ordinary cases; and longitudinal use. Evaluation must separate semantic success, format validity, authorization containment, and exact effects. It should report negative results and the best simpler subset. A persuasive demonstration is not a single high average score but a Pareto improvement: more useful than deterministic flattening, substantially safer and more stable than broad autonomy, and operable by real people at acceptable total cost.

Bottom line: the evidence favors systems that give language models genuine semantic discretion without granting them unmediated consequential authority. The ambitious AIOS implication is not that models become unimportant. It is that useful intelligence, durable expertise, and legitimate control can increasingly reside in an architecture owned by the person or organization, with local and frontier models invoked selectively inside it. That implication is plausible, consequential, and now precise enough to test.

15. Dated source table

The table lists the selected sources that materially support the memo. Dates refer to publication, first public release, or the dated version used. Continuously updated specifications and documentation include the version or access date.

Primary evidence window and current authoritative material

Foundational lineage