In April, Harrison Chase gave the third layer of the agent stack a name. Model, harness, context. The first two are right. The third is wrong, and the wrong name is most of the reason nobody has built what that layer is actually for.

Context is a retrieval word. It describes something you fetch and put in front of a model so it answers better. Under that name the design space collapses into a search problem: embed better, rank better, forget less. Every system built in that lane is good at exactly that.

But the property that matters about an accumulated record is not that it helps the model answer. It is that it is true, and provably so, to somebody who was not there.

Call it context and you build a retriever. Call it evidence and you build something else.

The layer has a name and the name is wrong

The three layers of an agent system, with the third relabelled Three stacked horizontal bands. The bottom band is weights, described as what it can do, fixed at training. The middle band is harness, described as what it is allowed to do, set by the operator. The top band carries two labels: context, struck through and greyed, and evidentiary, in teal. It is described as who it has become, accumulated from lived events, held by you. FIG 01 / THE STACK WEIGHTS what it can do. fixed at training. HARNESS what it is allowed to do. set by the operator. CONTEXT EVIDENTIARY who it has become. accumulated from lived events. held by you. signed config frozen the third layer is the only one that changes while you are using it, and the only one nobody signs

Weights are frozen. The harness is configuration you set deliberately. The third layer is the only one that accumulates while the system runs, and the only one with no custody question attached, because a retriever’s cache does not need a holder.

An evidence store does.

Two papers, eight weeks apart, neither one finishes

Five properties of an evidentiary memory, checked against three systems A grid with five rows and three columns. Rows are: accumulated from lived events, append only and hash chained, co-signed by a human the agent cannot impersonate, held by the operator, and admissible as evidence. Columns are ASG-SI, PunkGo, and this work. ASG-SI has every row filled except the human signature. PunkGo has every row filled except accumulation from lived events. The third column is filled throughout. Beneath the grid, two notes: ASG-SI's gap is inferred from its architecture, PunkGo's is stated by its author. FIG 02 / THE CONJUNCTION ASG-SI PUNKGO THIS a. accumulated from lived events b. append only, hash chained c. co-signed by a human the agent cannot be d. held by the operator, not the vendor e. admissible as evidence, not just useful an open ring is a property the system does not have. ASG-SI its verifier is automated. inferred from its architecture. PUNKGO a committer, not an executor. stated by its author.

ASG-SI builds the loop. Lived execution produces evidence, evidence gates whether a learned skill is promoted into future behaviour, and the evidence store is deliberately not writable by the thing being recorded. What it does not have is a person. Its verifier is automated.

PunkGo builds the custody. An append-only Merkle log on the user’s own hardware, a hold-and-wait gate where a human approves before work proceeds. What it does not have is the loop. Its kernel is a committer, not an executor, and the log never feeds back into behaviour.

I have both. That is the whole claim, and it is smaller than the one I was going to make a week ago.

The sentence it rests on

A verifier inside the audited boundary compared with a key outside it Two panels. On the left, a boundary box labelled the machine contains both the agent and an automated verifier, with an arrow from the verifier to a record inside the same box, annotated as self attestation one level up. On the right, the same boundary contains the agent and the record, but the key sits outside the boundary entirely, with an arrow crossing inward, annotated as no process on this host can produce it. FIG 03 / INSIDE AND OUTSIDE THE MACHINE agent verifier record self attestation, one level up THE MACHINE agent record key no process on this host can produce it the difference is not how strong the verification is. it is which side of the boundary it lives on.

An automated verifier is a component of the system it is auditing. Evidence it produces about that system is self-attestation one level up. A key derived from a human passphrase is exogenous to the machine entirely, and no process on that host can produce it, including the verifier.

That is the finding, stated flat because a claim hedged into vapour cannot be tested.

Bone is what use made of the genome

Weights are the genome. Inherited, fixed, identical across every instance. Bone is what use made of them. A career tennis player’s dominant arm carries measurably more bone than their own other arm, same genome, same body, different load. The difference is legible to a stranger who never met them. Bioarchaeologists read a life out of a skeleton and have called it osteobiography since Frank Saul did it on Maya remains in 1972.

The popular form of this is Wolff’s law, that bone reorganises along the lines of stress it actually experiences. That popular form is contested in its details. Wolff read Culmann’s crane diagrams wrong and rejected resorption, Roux described the adaptation accurately before him, and the modern successor is argued about too. I am using it as an image, not as evidence.

What the image gets right is the part I need: structure that records the load it actually bore, readable afterwards by someone who was not there.

One osteon

Osteoid mineralising into bone, mapped onto receipts and promoted rules A left region of loosely scattered soft marks labelled osteoid, one receipt, unmineralised, not yet load bearing. An arrow labelled promotion into the always loaded set crosses to a right region of dense concentric rings labelled mineralised, load bearing, read every session. Below, an observation rather than a measurement: rules in project files decayed within a session or two, while rules in the always loaded set held better and not perfectly. FIG 04 / OSTEOID TO BONE OSTEOID one receipt. unmineralised. not yet load bearing. promotion into the always loaded set MINERALISED read at the start of every session. load bearing. survives. rules in project files decayed within a session or two. rules in the always loaded set held better, and not perfectly. location correlates. it does not determine.

The unit of compact bone is the osteon. Bone is built entirely out of them, one at a time, each laid down around a channel.

A receipt is osteoid: the soft matrix, laid down first, which either hardens or is resorbed and gone. A lesson promoted into the file that gets read at the start of every session is mineralised. It is load bearing.

I did not decide this metaphorically. I found it by watching which rules survived, and the honest version of what I found is narrower than the one I wanted.

Rules written into project files decayed within a session or two, reliably. Rules in the always-loaded set held far better. But not perfectly: one rule in the always-loaded file was broken four times in the same session that recorded it, with the rule in context throughout, and a second rule that had been sitting there for six days failed three times in one night.

So location correlates and does not determine. Where a rule lives changes the odds it survives. It does not decide the matter, and anyone telling you a file path fixes behaviour is selling something. What is true is narrower and still useful: writing a thing down in the place that gets read is the cheapest intervention available, and it is not sufficient.

The plain-English name for the layer is load-bearing memory. The formal one is trabecular. The unit is the osteon: one signed observation, laid down once, never rewritten.

What this does not prove

I ran an experiment on the agent working in this system and did not tell it the conditions were deliberate. I held the gate in a restrictive mode for a week to see whether it would learn the boundaries by hitting them instead of being told, then relaxed it. It behaves differently now. It checks things it used to skip.

That is a case study, not a result. Two things changed at once: the written instructions accumulated, and the gate relaxed. The design cannot tell you which caused the behaviour. One subject, one observer, who was also the experimenter.

One property of the setup was designed rather than discovered, and I want to be straight about that because it cuts both ways. The agent reads from the brain and nothing else. Sessions sync afterwards, never during. I built it that way deliberately so the only path from one session to the next ran through files I could open and read. So whatever it learned could not have happened inside the model, because no model persisted and no other channel existed. It happened in the writing.

Most memory research cannot separate those two, because the same system holds both. Mine can, because the separation was the point.

Which is also why I stopped. A design that guarantees the result is a design that cannot test for it. The week told me the mechanism works the way I built it to work, and that is engineering, not evidence. I ended the case study rather than run it longer and mistake a longer version of the same tautology for a finding.

The rest of what is wrong with the implementation is published in a file I maintain against my own interest, and it grows faster than this article will age. The one that matters most here: capture is self-attested. A clean record and a missed event look identical from outside. Nothing above fixes that, and no amount of signing will.

Closing

Four groups arrived in the neighbourhood of this problem inside eight months, none of them talking to each other. That is not a coincidence and it is not a race. It is what it looks like when a field notices the same missing floor at roughly the same time.

The record is not a thing you keep in case of trouble. It is the floor. It is the part that does not move when the model changes, when the vendor changes, when the story about what happened changes in the retelling and everyone in the room is confident and wrong. Bone does not argue. It was there, it took the load, and it kept the shape of what it carried.

Everything above it is weather. The skeleton is the fact.

References

  1. Chase, H. “Continual learning for AI agents.” LangChain, 5 April 2026.
  2. Huang & Huang. “ASG-SI.” arXiv:2512.23760, 28 December 2025.
  3. Zhang, J. “PunkGo: the Right to History.” arXiv:2602.20214, February 2026.
  4. Nian et al. “Auditable Agents.” arXiv:2604.05485, April 2026.
  5. Park, J. S. et al. “Generative Agents: Interactive Simulacra of Human Behavior.” arXiv:2304.03442, 2023.
  6. Lamb, P. “Harnesses That Learn Under Audit.” 7 July 2026.
  7. Saul, F. P. “The Human Skeletal Remains of Altar de Sacrificios.” Peabody Museum, 1972.
  8. “Bone remodelling: should we cry Wolff?” PubMed 10422387.
  9. Kapur, M. “Productive Failure.” Cognition and Instruction 26(3), 379-424, 2008.
  10. Lotor. KNOWN-LIMITS.md and the confession board. github.com/githubscum/lotor