R↻
AI RESEARCH INSIGHTSSystems, agents & evaluation
ARXIV · 2608.24876 · AUG 2026
TECHNICAL STUDY14 MIN READPAPER + CODE REVIEW
Recursive memory evolution for long-horizon agents

Memory that learns where it failed.

Recuris keeps the base model fixed and evolves an external memory-control layer: verified task state, reusable experience, a state-conditioned router, and evidence checkers. Failure traces identify the weak component; fixed validation gates decide whether its repair survives under the protocol available to each benchmark.

KC
Kent Chun · Research NoteIndependent synthesis of the paper and public implementation

Recuris turns long-horizon agent improvement into a bounded software evolution problem: compress history into verified state, retrieve skills only when that state requires them, and recursively patch the smallest memory component implicated by evidence.

completed comparisons improved35 / 37across 4 benchmarks and 10 models
longest-horizon gain+32.2absolute points reported
failure localization64.8%from structured traces
failure mode reductionup to 80%on long-horizon errors
WHAT IS ACTUALLY NEW

Working memory and experience evolve together.

Most agent harnesses treat state tracking and skill libraries as separate features. Recuris makes them one addressable memory package, then learns whether each failure belongs to experience, state, routing, or verification.

M = (E, W, ρ, C)
E · experiential cards
W · verified working-memory ledger
ρ · state-grounded invocation policy
C · evidence and draft checkers
THE STRONGEST INSIGHT

The model must not own the truth about its progress.

The agent may propose pending work, but only real environment or tool receipts can mark it done. That separation prevents a confident but false “completed” belief from corrupting routing, termination, and future actions.

model proposes state
checker validates evidence
harness commits truth

Representative results

The benefit is largest where histories are long and the next useful memory depends on current progress.

Benchmark / modelBaseRecurisGain
τ² Retail · GPT-5.6 Sol58.376.1+17.8
τ² Retail · Doubao-2.0-Pro58.181.4+23.3
SkillFlow · Qwen3.6-27B42.258.7+16.6
Terminal-Bench · Claude Opus 584.688.4+3.8
LOAD-BEARING ABLATION83.6

Full Recuris on τ²-Retail, versus 65.6 when the model controls the same skill library and receives all skills.

82.0WORKING MEMORY ONLY
101kTOKENS / SUCCESS
−18 ptALL-SKILLS PROMPT
+46%COST / SUCCESS
02 · Dependency-aware workflow

Two loops, one controlled evolution.

The inner loop grounds every task step in verified state. The outer loop converts repeated failures into a scoped memory patch, but only admits the patch after deterministic validation.

Runtime dependency spineUPSTREAM TRUTH → DOWNSTREAM BEHAVIOUR
FROZEN LAYERModel + environmentThe base policy, task tools, and evaluation interface do not change.
→
STATE LAYERVerified ledger WCurrent goals, evidence, blockers, authorization, and completion.
→
CONTROL LAYERRouter ρ + skills ECurrent state decides which card reaches the model and when.
→
TRUTH LAYERCheckers C + receiptsObserved evidence settles state and produces an auditable trace.
INTERACTIVE SYSTEM TRACE

Initialize verified working memory

FRAME 1 / 8AUTO PLAYING
03 · Component deep dive

From paper abstraction to repository modules.

The public implementation deliberately separates the invariant machine in src/recuris/ from the evolvable packages in skill_memories/. This makes the “only memory changes” claim inspectable.

EExperience

Markdown cards: knowledge, procedures, and worked action examples distilled from prior failures.

WWorking state

A schema-driven ledger whose DONE/BLOCKED fields require harness or oracle authority.

ρInvocation

Event and state rules that deliver relevant cards at turn start, after an intent/state update, or at the pre-write boundary.

CCheckers

Completion predicates and draft checks decide whether observations support proposed state changes; the fixed grounding and commit kernel enforces that boundary.

A1
STATE COMPRESSION

Evidence-grounded working memory

Continuously reconstruct the smallest useful task state, while reserving settled truth for the harness.

wₜ → UW → w̃ₜ₊₁ → C → wₜ₊₁
HOW THE ALGORITHM RUNS

Proposal and commit are separate

  1. The model extracts current pending goals.
  2. Old pending entries become audit history.
  3. Verified DONE/BLOCKED entries are preserved.
  4. A receipt matcher binds new evidence to a pending entry.
  5. Only the harness commits the state transition.
SIMPLIFIED IMPLEMENTATION
def update_state(ledger, proposal, receipts): pending = parse_pending(proposal) ledger.replace_pending(pending) for receipt in receipts: entry = match_binding(receipt, ledger) if entry and receipt.is_genuine: ledger.mark_done( entry.id, evidence=receipt.id, writer=HARNESS) return ledger.snapshot()

Conceptual code reflecting the repository’s write-authority pattern.

CODING EXAMPLE + USE CASE

A patch spanning many turns

Initial stateReproduce bug → inspect parser → patch tokenizer → run targeted test → run regression suite.
What prevents false completionThe agent saying “tests should pass” cannot mark testing DONE. Only the actual test-run receipt with exit code 0 can settle it.
Where else it appliesAML investigation checklists, customer-service actions, deployment runbooks, and multi-document research.
A2
NEED-DRIVEN RETRIEVAL

State-grounded skill invocation

Select memory from current unresolved state and runtime events, rather than from the initial prompt alone.

Eₜ = ρ(wₜ, eventₜ, toolₜ)
HOW THE ALGORITHM RUNS

Retrieve at the action boundary

  1. Observe a dispatched runtime event.
  2. Read pending ledger entries and their tool scope.
  3. Filter cards by event, tool, type, and episode limits.
  4. Deliver the smallest relevant set.
  5. Record a fingerprint proving the carrier fired.
SIMPLIFIED CONFIGURATION
delivery: - use: need_driven_retrieval at: intent_recorded cfg: scope_by_tool: true max_per_episode: 1 card.trigger: event: intent_recorded tool: run_tests

Illustrative manifest pattern, simplified from Recuris package concepts.

CODING EXAMPLE + USE CASE

Testing knowledge arrives when useful

Before the patchA generic debugging card would distract the model during repository inspection.
At verification stateWhen “run targeted tests” becomes pending, ρ injects the project’s verification procedure: test command, expected artifact, and regression rule.
Why not inject everything?The paper reports that all-skills prompting added 3,111 first-call tokens, scored 18 points lower, and cost 46% more per success.
A3
ADDRESSABLE EXECUTION EVIDENCE

Structured trace construction

Turn every action into a causal record connecting state, retrieved memory, behaviour, evidence, and committed truth.

Γₜ=(wₜ,Eₜ,aₜ,oₜ,w̃ₜ₊₁,cₜ,wₜ₊₁)
HOW THE ALGORITHM RUNS

Capture before and after

  1. Snapshot state before retrieval.
  2. Record exactly which cards were delivered.
  3. Store the action and real observation.
  4. Keep both proposed and committed state.
  5. Attach checker results and mechanism fingerprints.
SIMPLIFIED TRACE OBJECT
trace.append({ "state_before": wm.snapshot(), "skills": delivered_card_ids, "action": tool_call, "observation": tool_receipt, "proposed_state": proposal, "checker": checker_result, "state_after": wm.snapshot(), "fingerprint": fired_mechanisms })

Equation 3 in the paper defines this complete trace contract. The public runtime currently distributes the evidence across benchmark trajectories, ledger snapshots, checker outcomes, and mechanism fingerprints rather than emitting this exact object on every turn.

CODING EXAMPLE + USE CASE

Why did the agent submit too early?

Outcome-only evidence“Patch failed hidden tests” cannot distinguish weak knowledge from missing execution discipline.
Structured evidenceThe trace shows the test card existed but was never delivered, submission occurred while testing remained pending, and no checker bounced the draft.
Diagnostic valueThe paper reports 64.8% failure localization from structured traces versus 13.0% from task outcome alone.
A4
FAILURE ATTRIBUTION

Evidence-bounded component diagnosis

Find the first reachable divergence, test whether memory could have changed it, and assign one primary owner.

D(Γ,M) → owner ∈ {E,W,ρ,C,∅}
HOW THE ALGORITHM RUNS

Opportunity before ownership

  1. Compare failed trials with successful counterfactuals.
  2. Locate the earliest observed intervention point.
  3. Set action opportunity O: present, absent, or unknown.
  4. Set patchability P: memory, external, or unknown.
  5. Patch only when O=present and P=memory.
Eskill missing/wrong
Wstate/grounding wrong
ρskill did not fire
Cdiscipline escaped
SIMPLIFIED DECISION LOGIC
if opportunity != "present": return NO_PATCH if patchability != "memory": return NO_PATCH if needed_skill_missing: return "E" if verified_state_wrong: return "W" if skill_exists and not skill_fired: return "RHO" if unsupported_action_escaped: return "C"
CODING EXAMPLE + USE CASE

Three similar failures, three repairs

E failureThe agent never learned the repository-specific test command. Add a reusable verification card.
ρ failureThe card exists, but its trigger watches the wrong tool event. Repair routing—not card content.
C failureThe test step remains pending but submission is allowed. Add a pre-submit checker.
A5
SCOPED MEMORY EVOLUTION

Smallest connected patch

Translate diagnosis into one local mutation plus only the wiring needed to make that mutation reachable.

Mₖ₊₁ = Mₖ ⊕ Δowner
HOW THE ALGORITHM RUNS

Minimize the repair surface

  1. Choose one primary E/W/ρ/C owner.
  2. Express the reachable event → trigger → intervention → next behaviour chain.
  3. Create a disposable candidate package.
  4. Preserve all unrelated cards and manifest behaviour.
  5. Reject task IDs, real records, and benchmark answers.
SIMPLIFIED PATCH
# Before: card exists but is unreachable delivery: [] # Candidate: bind the existing carrier delivery: - use: exemplar_bounce at: pre_write cfg: exact_only: true # Card frontmatter supplies tool scope --- id: verification_before_submission type: action_result trigger: event: pre_write tool: submit_patch ---

This is executable Recuris vocabulary: exemplar_bounce is a pre-write deliverer, while action-result card frontmatter supplies its tool scope.

CODING EXAMPLE + USE CASE

Prevent untested submission

TriggerThe draft attempts submit_patch while the testing ledger entry is still pending.
InterventionBounce the draft with the existing verification exemplar and allow one corrected draft.
Expected immediate behaviourThe next action calls the targeted test tool rather than merely promising to test later.
A6
CONSERVATIVE ADMISSION

Repair and paired held-out gating

Separate creative patch proposal from deterministic acceptance using repair evidence, regression limits, and item-level uncertainty.

accept ⇔ repair ∧ Δheldout>0 ∧ regress≤cap
HOW THE ALGORITHM RUNS

Validation in layers

  1. Validate plan schema, package format, lint, and leakage.
  2. Probe whether the new mechanism can actually activate.
  3. Confirm the diagnosed source tasks improve.
  4. Evaluate base and candidate on identical held-out items.
  5. Count regressions and bootstrap items—not correlated trials.
SIMPLIFIED GATE
diff = candidate_scores - base_scores net = mean(diff) ci = bootstrap_by_item(diff, n=10_000) accept = ( source_repair > 0 and net > 0 and regressions <= reg_cap and mechanism_fired and not leakage ) return ACCEPT if accept else REJECT
CODING EXAMPLE + USE CASE

A card fixes one bug but harms others

Repair resultPreviously failing parser tasks improve from 0/3 to 3/3.
Held-out resultThe broad instruction causes two unrelated deployment tasks to regress beyond the cap.
DecisionReject the candidate despite fixing its source failure. Narrow the trigger and test a new disposable package next round.
Critical timing boundary: inference uses memory; evaluation rounds optimize memory.No live task turn rewrites its own cards or manifest. A turn only reads the active package and emits state, receipts, fingerprints, and traces. Between batches, the Meta-Agent edits a disposable copy; code promotes it only after repair and held-out checks.
R1 · PACKAGE COMPILATION

How declarative memory becomes executable behaviour

The loader converts a package directory into runtime objects once when the agent is constructed.

skillmemory.py ↗
def load_skill_memory(root): raw = yaml.safe_load("manifest.yaml") schema = _build_schema(raw["wm"]) manager = make_manager(raw["wm"]) em = EMStore.load(root / "em") deliverers = _bindings(raw["delivery"]) checkers = _bindings(raw["checkers"]) return SkillMemory( schema, manager, em, deliverers, checkers)

What “hooking memory” actually means

  • W becomes a ledger schema and manager object.
  • E becomes an indexed store of Markdown cards.
  • ρ becomes deliverer instances bound to runtime events.
  • C becomes checker instances bound to draft_ready.

Invalid event bindings fail at startup, preventing a configured but unreachable mechanism from silently becoming the treatment.

R2 · τ² AGENT HOOK

The benchmark calls Recuris as the agent’s normal next-turn method

The adapter subclasses the official LLM agent, preserves its message state and tools, and redirects one lifecycle method into the invariant runtime.

tau2/agent.py ↗
class RecurisAgent(LLMAgent): def __init__(..., skill_memory): self.sm = load_skill_memory(skill_memory) write_tools = { t.name for t in tools if _is_write_tool(t) } self.runtime = TurnRuntime( self.sm, write_tools) def generate_next_message(message, state): state.messages.append(message) port = _Tau2Port(self, state) final = self.runtime.run_turn( state.rs, port, message) return final, state

The adapter is a dependency inversion layer

TurnRuntime does not know τ² message classes, tool formats, or LLM APIs. _Tau2Port translates them into the generic HarnessPort contract:

INIncoming kindUser, tool result, system check, or other
LLMDraft callsNormal generation, ledger extraction, corrected redraft
OBSTool receiptsCall ID, tool, arguments, error, and content
OUTCommitAppend the final assistant message to benchmark state
R3 · INVARIANT TURN

Exactly what happens on every live τ² turn

Event ordering is engine law. The package chooses which strategy runs at each permitted event, but cannot reorder the safety checkpoints.

runtime.py · run_turn ↗
def run_turn(state, port, incoming): _ground(port.extract_receipts()) notes = _deliver(TURN_START) if manager.should_update(state): _update_ledger() notes += _deliver(INTENT_RECORDED) wm_text = render_wm(state.ledger) + notes draft = port.llm_draft(wm_text) draft = inspect_and_redraft_once(draft) port.commit(draft) draft = _pre_write(draft) return sanitize(draft)
01Ground firstPrevious tool results settle ledger entries before new reasoning.
02Update WThe model proposes pending state; settled state remains protected.
03Invoke ρ(E)Cards selected at turn or intent events are appended to WM context.
04DraftThe frozen model sees system prompt + compiled memory + history.
05Check CA rejected draft gets at most one evidence-based correction.
06Pre-write reviewA risky tool call may be bounced; synthetic results are registered so they cannot later ground DONE.
07InstrumentDelivery, bounce, grounding, and error events enter the fingerprint.
R4 · A DIFFERENT HOOK SHAPE

Terminal-Bench preserves Terminus and attaches at prompt, command, and completion boundaries

Recuris is not wired identically into every agent. The Terminal-Bench adapter uses the official loop’s existing methods instead of replacing its whole turn implementation.

tb21/harbor_terminus.py ↗
async def _handle_llm_interaction(..., prompt): prompt = bridge.prepare_prompt(prompt) result = await super()._handle_llm_interaction( chat, prompt, ...) if result.is_complete: bounce = bridge.check_completion(...) return result async def _execute_commands(commands, session): timed_out, output = await super()._execute_commands(...) bridge.observe_commands( commands, output, timed_out=timed_out) return timed_out, output

Why this matters

Command output becomes a real ToolReceipt; error text can trigger targeted retrieval; unchanged WM is replaced with a compact marker to avoid repeated prompt cost; and completion can be blocked while verified obligations remain.

Concrete coding taskA terminal agent builds software for 80 steps. Recuris injects current obligations before inference, observes actual shell output after execution, retrieves a relevant error guide after a compiler failure, and refuses “complete” until the artifact requirement is evidenced.
R5 · τ² CROSS-TASK EVOLUTION

The outer loop runs after evaluation—not inside user inference

Driver.round() treats the current package as data, generates a disposable candidate, and evaluates both packages under paired conditions. This evolve/dev/test protocol describes the τ² campaign; SkillFlow follows family-sequential in-sample template selection, while Terminal-Bench uses within-task adaptation.

metaagent/driver.py · round ↗
EEvaluate working baseRun train tasks, collect failures, trajectories, fingerprints, and regression suspects.
DDiagnoseThe fixed Meta-Agent proposes an evidence-bounded E/W/ρ/C plan.
PPatch candidateCopy the working base into a disposable directory, then apply only planned changes.
V1Static validationPlan schema, allowed paths, lint, leakage, reachability, and activation.
V2Repair screenRe-run base and candidate contemporaneously on diagnosed tasks; skip held-out spend if repair does not improve.
V3Held-out gateCompare the candidate to the committed best with paired seeds and identical benchmark bytes.
KKeep or rejectOnly an accepted candidate calls commit().
train = evaluate(working_base, train_ids) evidence = write_evidence(train.failures) plan = meta_agent.diagnose(evidence) candidate = copy(working_base) patch(candidate, plan) validate(candidate) repair = paired_eval(base, candidate, source_tasks) if repair.candidate <= repair.base: return REJECT dev = paired_eval(committed_best, candidate) verdict = held_out_gate(dev) if verdict.accept: commit(candidate)

The code can support provisional working bases for progressive experiments, but the committed lineage remains unchanged until a strict acceptance certifies the cumulative package.

R6 · WHY THE NEW MEMORY IS REALLY “BETTER”

Promotion requires behavioural evidence and byte identity

The system does not equate “the Meta-Agent wrote a plausible card” with improvement. It binds the admitted result to the exact package and evaluation conditions.

metaagent/gates.py ↗

Acceptance boundary

DISPOSABLE CANDIDATEEditable E/W/ρ/C package
→
IMMUTABLE VERSION MₖPromoted only by commit()
  • Base and candidate use paired seed maps.
  • Benchmark Git commit and input SHA must match.
  • Repair and dev runs must use the same candidate tree hash.
  • The mechanism fingerprint must show the prescribed carrier fired.
  • commit() recomputes the package digest before copying and refuses overwrite.

Three different meanings of “better”

LOCAL REPAIRDid the target failure improve?Necessary before spending held-out evaluation budget.
GENERALIZATIONDid paired held-out utility improve?Controls regressions outside the diagnosed cluster.
MECHANISMDid the intended hook activate?Prevents crediting an accidental score change to a silent component.
What the code can and cannot proveIt proves that exact candidate bytes behaved better under the configured gate. It does not prove every individual edit was causal, nor that the benchmark fully represents production risk.
S1 · INVARIANT KERNEL

TurnRuntime

Owns phase order, delivery events, checker dispatch, grounding, sanitization, redraft, and commit.

src/recuris/runtime.py
S2 · PACKAGE LOADER

SkillMemory

Loads and validates manifests, cards, built-ins, local plugins, schemas, delivery bindings, and checkers.

src/recuris/skillmemory.py
S3 · WRITE AUTHORITY

Working-memory ledger

Preserves settled entries, caps pending state, and enforces that only harness evidence can mark work complete.

src/recuris/wm/ledger.py · schema.py · render.py
S4 · EVIDENCE LAYER

Grounding and guards

Matches real receipts to ledger entries, rejects synthetic evidence, sanitizes outputs, and records mechanism fingerprints.

grounding.py · guards/ · fingerprint.py
S5 · EVOLUTION CAMPAIGN

Meta-Agent driver

Evaluates champions, sanitizes failures, requests a diagnosis and patch, validates the candidate, and records every round.

metaagent/driver.py · settle.py · downstream.py
S6 · DETERMINISTIC REFEREE

Gate and integrity checks

Runs paired bootstrap evaluation, regression caps, plan/lint/leak/reachability checks, and protects measured champion packages.

metaagent/gates.py · integrity.py · reachability.py
S7 · EVOLVABLE DATA

Skill-memory packages

τ² and Terminal-Bench packages use runtime-loadable manifests and cards. SkillFlow is the exception: its package is externally rendered into family-specific prompt templates and is not loaded by TurnRuntime.

skill_memories/*/manifest.yaml · em/**/*.md · skillflow/templates/
S8 · BENCHMARK ADAPTERS

Environment-specific translation

τ² maps benchmark messages into HarnessPort; Terminal-Bench attaches at prompt, command, and completion hooks; SkillFlow renders templates into its one-shot CLI harness.

src/recuris/adapters/ · configs/ · third_party/
04 · Why it works

The principles behind the gain.

Recuris works because it treats memory as a control system with explicit state, timing, evidence, attribution, and regression boundaries—not as a bigger prompt.

P1

State beats history search

A compact verified ledger preserves what matters now and prevents old turns from dominating attention.

P2

Timing beats volume

The right skill at the action boundary outperforms an undifferentiated library placed in every prompt.

P3

Evidence beats self-report

Tool receipts, environment observations, and deterministic rulings—not confidence—settle progress.

P4

Structure enables blame

Addressable traces distinguish a missing skill from bad state, failed routing, or a weak checker.

P5

Local patches reduce risk

Changing the smallest implicated component preserves unrelated behavior and makes regressions easier to detect.

P6

Gates make recursion safe

A generative model may propose repairs; a fixed benchmark-appropriate validation protocol decides which repairs become memory.

01What is verifiably true now?

Build state from receipts, terminal observations, policy oracles, and explicit user evidence. Keep beliefs separate from settled facts.

02What decision is reachable next?

Locate the first real action opportunity before failure. Do not design a trigger for an event that never occurs.

03Which memory component failed?

Ask whether knowledge was missing, state was wrong, a relevant card failed to fire, or a checker allowed unsupported progress.

04What is the smallest legal repair?

Patch one owner plus necessary wiring; avoid broad prompt rewrites and never encode a benchmark answer into a skill card.

05Did the mechanism cause a safe gain?

Verify reachability and activation, repair the source failure, then compare paired held-out outcomes under a regression cap.

Enterprise translation · investigation agents

A practical pattern for AML or case investigation.

A case can last hundreds of actions across customer records, transactions, documents, policy checks, and escalation. Recuris suggests a safer harness boundary.

W · VERIFIED CASE STATEOpen hypotheses, evidence IDs, unresolved entities, approvals, blockers
ρ · EVENT ROUTINGInvoke source-checking or reconciliation skills only when the case state demands them
C · CONTROL EVIDENCERequire system receipts and cited records before conclusions or escalation
OUTER LOOPTurn repeated production failures into gated package updates on a frozen regression suite

What the evidence supports

01
Working memory is the main load-bearing featureWM alone nearly matches the full system in the retail ablation; state-conditioned retrieval adds the final gain and efficiency.
02
The architecture transfers across modelsMemory evolved with one carrier improves several other closed and open models without weight updates.
03
Value increases with horizonThe system is most useful when state drift, omission, and late retrieval become the dominant failure modes.

What remains conditional

01
Checker quality defines the truth boundaryA bad receipt matcher or domain oracle can confidently commit the wrong state.
02
Failure ownership is a repair hypothesisStructured traces improve localization, but an E/W/ρ/C label is not formal causal proof.
03
This is research-grade infrastructureThe large campaign driver, benchmark adapters, domain packages, and evaluation cost make it a framework to adapt—not a drop-in production memory.
04
Gains are broad, not universalTwo completed pairs regressed slightly, and ceiling effects make some benchmark gains statistically uncertain.
Recuris is best understood as bounded recursive self-improvement in the agent harness: the model stays fixed, while a verified and test-gated memory-control layer learns from experience.

Its durable lesson is not “store more memories.” It is: represent current truth explicitly, activate experience at the moment of need, preserve component-addressable evidence, and let deterministic evaluation—not the proposing model—control evolution.

05 · Interactive scenarios

When should Recuris create a new skill?

Select a case to trace the decision from observed failure to component ownership, runtime activation, evidence, and gated promotion. These are design extrapolations built from the paper’s E/W/ρ/C patch space—not claims that every displayed domain plugin ships in the repository. A new card is created only for a genuine experiential-memory gap; many apparent “skill failures” should instead repair state, routing, or checking.