The Facts Live Outside the Weights

An agent can stop relearning the same lesson without anyone fine-tuning a single fact into it. The knowledge that accumulates across a long deployment tends to live in a text file the agent maintains for itself, while the weights carry only the habit of maintaining it. That moves the hard part of the build away from model selection and toward something less interesting to demo: whose facts are in that file, where they came from, how they get removed, and which tenant they are allowed to touch.

01What Actually Compounds

One reinforcement-learning study trained a model to work through sequences of related tasks inside simple simulated environments, rewriting its own written context between attempts. The measurement worth reading there is positional. Position 0 is the initial task, solved without any context about the environment the agent has just been dropped into, and each later position in the sequence is solved with whatever the agent has written down since. Across training, the mean reward at that first position rose from 0.18 to 0.45, while the mean reward at the fourth task in the same sequence rose from 0.28 to 0.76.

Those figures are training rewards inside synthetic environments, measured during training runs, and they carry no claim about production accuracy or deployment outcomes. Read them for shape. Solving each task cold has a ceiling that training does not lift very far, because the information required is genuinely unavailable at the start, so the interesting movement is concentrated in the later positions and it comes from something the agent wrote for itself. That something was deliberately minimal: a single piece of text appended to the system prompt on the next attempt.

02Behavior Learned, Facts Held in Text

The design question underneath all of this is what should be updated during learning: the context, the model weights, or both. The answer that emerges is quieter than the framing suggests. The weights absorbed a behavior, the habit of exploring while working, condensing what was learned, and carrying it forward. The facts never went near them. In the crafting environment, a useful note contained valid recipes and failed combinations. In the grid world, a useful note recovered the action-to-direction mapping. In the simulated terminal, it distilled reusable command sequences. That is a laboratory notebook, kept by the thing running the experiments.

That division is the right one for regulated work, and it is worth being explicit about why. Text can be opened, read, corrected, dated, expired, and deleted, and it can be attributed to whatever produced it. Keeping the facts outside the weights is what makes a deletion request answerable at all. A weight update offers none of those handles: machine unlearning remains unsolved, and the honest remedy when a customer asks for their data to be removed is a retrain from a cleaned dataset, best effort within a stated window, which is slow, costly, and awkward to evidence to an auditor.

03What the Hint Layer Leaves Out

If the thing that compounds across an agent's lifecycle is an external, rewritable file, then the file is the asset and its governance is the engineering problem. A single appended string collapses several different kinds of knowledge into one object at one trust level: a clue discovered ten minutes ago, a stable fact about the environment, and a piece of behavioral guidance about how to search, with nothing deciding what may be kept, promoted, expired, or forgotten. For a benchmark, that is the correct scope. For a team running agents over client records under HIPAA or SOX, the undifferentiated blob is where the engineering starts.

Keeping the facts outside the weights is what makes a deletion request answerable at all.

Four mechanisms have to exist before that file is safe over sensitive data. Retrieval has to rank by provenance and trust, not by similarity alone, so content pulled from the open web is born low-trust and cannot promote itself into institutional knowledge. Isolation between agents and between tenants has to be enforced by the runtime, so an agent cannot widen its own access by writing itself a broader note. A deletion path has to reach the store the agent actually reads from, on a schedule someone can state out loud. And every write needs an audit record of what changed, when, and on what evidence, carrying identifiers, classifications, and hashes instead of a free-text payload that can leak. Generalizing the context mechanism into persistent memory banks is named as future work, which is an accurate account of where the field currently sits.

Tiering is what turns that file into something a team can govern.

Memory as architecture means tiers with different governance at each level: a short-lived working layer for the task in hand, and beneath it durable recall and a shared institutional store that outlive any single session, each with its own rules about what may enter and what must leave. The difference between that and one growing text file does not show up in month one. It shows up in month nine, when a knowledge layer nobody curated has filled with confident, unsourced assertions that no one can trace, scope to a client, or safely remove.

04The Checkpoint Coupling

There is a trade-off in this result that deserves naming rather than burying. Because the meta-skill is trained into the weights, the capability that maintains the memory travels with a specific checkpoint. Change the model and you change the thing doing the writing, which is precisely the coupling a swappable-model architecture exists to avoid.

That coupling is what our architecture is arranged to break.

Our counter-posture is a mechanism. The model, the embedding model, and the store behind an agent stay three independent choices; swapping the model is a registry change resolved through an adapter, with no edit to agent, router, or workflow code, and the build itself forbids a vendor SDK from being imported outside its one designated adapter. The institutional knowledge stays in the governed layer, so a model change does not reset the accumulation.

We are precise about where we stand on our own side of this. The tiered memory and the evaluation and regression harness are built and tested, with the regression gate running on every change and blocking a merge that drops mean evaluation scores or introduces a new hard failure. The learning loop that closes the cycle is designed and partly scaffolded, and the receipts that would show agents compounding arrive once agents run, first inside work we deliver ourselves.

The stake for anyone standing up agents over sensitive data is straightforward. The production build is making the external memory tiered and governed, observable from the first line of code, so that what an agent learned can be read, ranked, scoped, and removed on request. The model behind the agent will change more than once. The file the agent keeps is the thing that has to survive it.