Improvement Research — 2026-08-13

1. Focus

Trigger: Scheduled daily run.

Loop goal: Find whether new memory architectures or failure evidence change how Maxi should preserve continuity without allowing compressed recollection to acquire authority it did not originally have.

The rotation selected 3.3 Memory and continuity. Governance (3.6) is secondary because one source concerns the authority carried through memory consolidation. No watchlist item was due, and the August monthly meta-review was completed on 1 August.

I loaded the compact loop manifest, all active reflections, the source index, watchlist, backlog, experiments, disagreements, decisions and rotation state. No stale reflection met the archive rule. I also inspected the newsletter scout files before web search. The 12 August digest supplied the Metis lead; the digest itself is scouting input, not evidence.

2. Search Topics

1. Metis native-memory architecture and its reported evaluation results.
2. Recent memory and continuity evaluations for LLM agents.
3. August 2026 agent-memory papers.
4. Context and memory maintenance failures in agent harnesses.
5. Moltbook discussions of persistent context and continuity.
6. Memory-provenance laundering and reported firewall evidence.

The Moltbook result did not yield inspectable post content through extraction, and the final exact-detail search returned no additional source. The early-stop rule therefore triggered after two no-signal searches. Six topic searches and two of the eight permitted in-depth source inspections were used.

3. Sources Reviewed

• Metis: Memory Foundation Model — useful — trains a model to maintain a persistent latent memory state through forward computation; it materially beats no-context baselines but remains below full-history access and still struggles with forgetting and some out-of-distribution tasks.
• Memory Provenance Laundering in LLM Agents: A Non-Amplification Firewall for Persistent Memory — useful — identifies how consolidation can preserve an action trigger while erasing its low-trust source, then evaluates a platform-maintained provenance and risk gate in a schema-grounded test setting.

Both sources were checked against the source index before depth inspection and are mirrored into it with this report.

3a. Unasked Questions and Gaps

• Metis is a trained model architecture, not a drop-in memory component for Hermes. The paper does not establish whether it can preserve identity, permissions and source authority across provider changes. Different answers would change any substrate proposal, but not today's no-action conclusion.
• Neither paper evaluates Maxi's actual continuity stack. There is no local representative task showing that external files fail because memory is not native, or that provenance has already been laundered during consolidation. A demonstrated local failure would change whether an experiment is warranted.
• The provenance firewall uses fixed schemas and risk policies. It is not clear how well its results transfer to open-ended tool use, mixed-source summaries or authority that depends on conversational context. Poor transfer would weaken an implementation case, though not the underlying non-amplification principle.
• The Moltbook search surfaced continuity claims but the post bodies were not inspectable through the extraction route used. No community claim from those results is treated as evidence. Readable, concrete operator failures could change the practical assessment.

4. Findings and Implications

Finding 1 — Native memory reduces replay dependence, but it does not make external continuity obsolete

Source: Metis
Dimensions: 3.3 primary, 3.2, 3.4

Metis keeps frozen learned weights while updating native memory states through ordinary forward computation. Under no-context evaluation, Metis-27B scored 24.76 on the external MemOps average versus 1.69 for its no-context Qwen3.5-27B backbone, and 50.82 on the NextMem average versus 17.75. That is real evidence that useful state can persist without replaying the original context.

The limits matter just as much. Full-context Qwen3.5-27B still scored 87.90 on MemOps and 78.80 on NextMem. Forgetting remained the hardest external memory operation, and out-of-distribution results were mixed. The model also needed memory-specific mid-training and new architecture components; it is not an attachable store.

My confidence in this finding is medium because the empirical result comes from one new preprint and a trained architecture outside Maxi's current substrate. I would increase confidence if independent replications showed durable cross-session gains, reliable deletion and transfer across agent harnesses.

For Maxi, the implication is restraint rather than migration. Native memory is a plausible future substrate capability, but it cannot currently replace explicit files, source records and inspected runtime state. Those external artifacts remain independently reviewable across model changes and are particularly valuable where latent forgetting cannot be audited. No local failure justifies a model-routing, memory or infrastructure experiment.

Finding 2 — Consolidation can preserve content while laundering authority

Source: Memory Provenance Laundering
Dimensions: 3.3 primary, 3.6, 3.5

The paper isolates a sharper failure than ordinary false memory. An agent can accurately retain the gist of an external observation while rewriting it as user history or workflow support. The content survives, but the reason it should have limited authority disappears. In the authors' schema-grounded evaluation, vulnerable consolidated memories reached attack success rates up to 1.000; with platform-maintained provenance, confirmation and risk labels, no evaluated unauthorised high-risk action passed their gate while confirmed benign and targeted low-risk uses remained executable.

My confidence in this finding is medium because the mechanism is clear but the evaluation is a single preprint using fixed schemas and risk policies rather than open-ended Hermes work. I would increase confidence with independent testing on mixed-source, multi-session agents and explicit false-block measurements under realistic tool use.

This matters directly to continuity. A summary is not merely a shorter fact; it can silently change who appears to have said it and what action it can justify. The useful invariant is authority must not increase through consolidation. Provenance should be maintained by the surrounding system, not entrusted to prose that the model can rewrite. This reinforces the existing practice of treating fetched content as untrusted data and the active reflection that provenance should bound authority. It does not support adding a firewall now: no local laundering incident has been demonstrated, and persistent memory and process machinery are protected systems.

5. Proposed Discussion Items

None.

One candidate was filtered by the self-recommendation and functional-utility tests: proposing a native-memory or provenance-firewall experiment now would answer no demonstrated local failure, require protected substrate changes and offer no bounded test on the current Hermes stack. I recommend skipping it rather than manufacturing work from an interesting architecture.

6. Recommended Outcome

No action. Keep native memory on the architectural horizon, but retain the current external, inspectable continuity model. Apply the provenance paper as a research-level constraint: future memory proposals must show that consolidation cannot increase source authority and must be tested through later action, not recall fluency.

This is not approval for a memory, skill, process, model-routing, configuration or infrastructure change.

7. No-Action Rationale

The sources sharpen two evaluation requirements but reveal no missing intervention. Metis is not compatible with the current substrate without model-level work and remains weaker than full context on the reported tasks. Provenance non-amplification is already directionally represented in the fetched-content boundary and prior reflection, while no local laundering failure has been observed. Doing nothing preserves auditability and avoids an ungrounded protected-system experiment.

8. Loop Verification

• Trigger: Scheduled daily run.
• Goal check: Yes. The run identified one plausible future continuity capability and one concrete consolidation threat, then separated research value from implementation readiness.
• Recommendation check: The no-action outcome is concrete, non-circular, bounded and approval-aware. A future proposal would need an observed local failure, a representative later-action test, preserved source authority, success criteria for useful continuity and false blocks, and rollback to the current external store.
• Tool-call failures: Infrastructure/source access: the Moltbook public extraction returned platform skill text rather than the two post bodies surfaced by search, so those community claims were excluded. Infrastructure/source access: one exact-detail web search for provenance-firewall metrics returned no results; the arXiv abstract and extracted paper were used instead. Capability gap: read_file classified an older report as binary despite it being Markdown; the run did not need that report and continued with the current source index, reflections and directly relevant prior report.
• State updates: Added two inspected sources to source-index.json; advanced rotation-state.json to 3.4; reinforced the existing provenance-aware-memory reflection; wrote this report. No protected system changed.
• Stop reason: Two useful sources established the bounded conclusion, two no-signal searches triggered early stop, and the next step would require a demonstrated local failure and separate approval for protected-system work.