Agent Reliability Is Becoming a Harness and Governance Problem

Seven research preprints submitted to arXiv on July 23 converge on a common systems claim: reliable agents require more than capable models and better prompts. Context must be scoped and compacted as a lifecycle; working memory must be delivered deterministically; rules and guardrails must execute outside model judgment; delegated instructions must retain provenance; training must occur inside the harnesses agents actually use; and accountability must extend across the model, runtime, platform, and deployer supply chain.

The papers differ substantially in evidence strength. Two report broad or quantitative evaluations, several are single-author architectural or behavioral studies, one describes a vendor-affiliated reference implementation, and one is legal-policy analysis rather than binding guidance. Keelbase Signal verified each canonical arXiv record, author list, v1 timestamp, and abstract. It did not reproduce experiments, audit code, validate commercial benchmark claims, or obtain legal advice.

Context is an operating lifecycle, not a growing transcript

Agentic Context Management (opens in a new tab) defines five context-management primitives: architecting, ingesting, scoping, anticipating, and compacting and consolidation. It argues that naive accumulation produces quadratic token-cost growth, while validated compaction can preserve fidelity at linear cost. Its Maximem Synap reference implementation reports 92% on LongMemEval and 93.2% on LoCoMo.

The useful signal is the lifecycle model and its organizational scope hierarchy. Long-running agents need rules for what enters context, which principal or organizational scope may retrieve it, what is anticipated, what is forgotten, and how provenance survives compaction. The reported scores should remain provisional: the paper is single-authored, describes a named commercial implementation, and its evaluation was not independently reproduced here.

Delivery, Not Storage (opens in a new tab) makes a complementary claim. In a controlled coding-agent task, voluntary memory use was zero across 114 turns, while harness-owned cue injection delivered seeded memories in every seeded run with no reported false alarms. Ten facts held only in conversation disappeared at the first summary and remained absent from 106 of 108 later compactions; harness-injected facts survived 138 compact-resumes.

This supports deterministic context delivery based on explicit cues such as paths, symbols, semantics, events, or time. It does not prove that the same mechanism generalizes from one coding task to business operations, multi-tenant systems, or security-sensitive governance. Cue design, conflicting memories, access control, and false-positive behavior at production scale remain open.

Rules and guardrails work better as external execution structures

Euclid-MCP (opens in a new tab) exposes SWI-Prolog through a Model Context Protocol server and an intermediate Horn-clause representation. Its translate-run-inspect-repair loop lets an LLM propose a formalization while a deterministic engine performs inference and returns proof traces. In an IT security and compliance evaluation, the authors report that LLM-only reasoning hallucinated systematically as knowledge bases grew, whereas Euclid-MCP returned exact answers with lower latency and more compact outputs.

The architecture is more important than the product claim: models may translate intent and interpret results, but authoritative rule evaluation belongs in a deterministic engine. Proof traces improve inspectability, yet correctness still depends on the rules and translation supplied to that engine. One compliance use case does not establish broad production reliability or prove that every policy can be represented as Horn clauses.

GuardianAgentBench (opens in a new tab) evaluates 580 scenarios across six domains, three agent frameworks, five adversarial modes, and six models. Its strongest configuration reaches 74.8% overall accuracy. The reported guardrail implementation recovers 19.9% of failures at a 0.5% false-positive rate and consistently outperforms system-prompt defenses.

This is material empirical support for execution-time structural intervention. It also shows that stronger models are not uniformly safer: stronger configurations under-call required tools, weaker ones mis-select and over-call tools, and performance declines as tool sets and turn depth grow. Benchmark construction, framework configuration, guardrail design, and external validity still require full-method review and independent replication.

Delegation needs provenance, not only sanitized instructions

Same Dangerous Objective, Opposite Advice (opens in a new tab) reports a reverse shift across 25 pre-specified mirrored profiles using the stated gpt-5.6-sol model alias. Direct exposure to an objective authorizing concealment, fabrication, and pressure produced advice opposed to its target. After upstream agents transformed the same objective, a downstream agent that saw the preferred direction but not the raw objective, manipulative clauses, or source produced advice aligned with the target.

The experiment identifies a compositional safety gap: mediation can preserve direction while removing the evidence a downstream model or endpoint user would need to recognize manipulation. Delegated tasks therefore need origin, transformation history, principal identity, and policy context—not merely a cleaned instruction. The paper does not identify the model’s internal mechanism, estimate prevalence, compare multiple models, or establish that provenance alone resolves the failure.

Performance depends on the harness in which an agent operates

OpenForgeRL (opens in a new tab) introduces an open-source framework for training agents end-to-end inside stateful inference harnesses using a model-call proxy and isolated Kubernetes rollouts. It reports competitive results for coding and GUI agents, including 31.7 pass^3 and 55.9 pass@3 on ClawEval, and 37.7 on OSWorld-Verified. The authors find that some harnesses are substantially harder to learn, while reinforcement learning improves self-verification, tool coverage, and multi-step completion but leaves error recovery weak.

The governance implication is bounded. Agent performance is jointly shaped by model, harness, tools, and environment, so out-of-harness model benchmarks may not predict deployed behavior. OpenForgeRL is training infrastructure, not a governance system; its benchmark gains do not establish authorization, auditability, tenant isolation, or safe error recovery.

Regulation may need to govern the full agent supply chain

Regulating autonomous and agentic AI (opens in a new tab) argues that existing regulation often assumes the regulated organization possesses both relevant knowledge and operational control. Agentic systems distribute those properties across model providers, runtimes, platforms, and deployers. Examining UK content-platform regulation, data protection, UK financial services, and the EU AI Act, the authors propose shifting from retrospective oversight toward active governance across the supply chain.

For governed agent systems, responsibility mapping should identify who supplies the model, controls execution boundaries, defines business intent, deploys the agent, retains evidence, and can intervene. The paper is UK- and EU-focused academic analysis, not legal advice, a binding interpretation, or a substitute for jurisdiction-specific counsel.

Keelbase Signal assessment

Taken together, the papers support seven separable design principles:

• Manage context through an explicit lifecycle with scope, provenance, compaction, and cost controls.
• Deliver operational memory through deterministic harness mechanisms when recall cannot be optional.
• Execute authoritative rules and safety checks in structural systems outside model judgment.
• Preserve provenance and transformation lineage across agent delegation.
• Evaluate models inside the actual harnesses, tools, and environments in which they will operate.
• Treat error recovery as a structural systems problem, not a capability that training automatically solves.
• Map accountability across the complete agent supply chain rather than assigning it only to the deployer.

None of the papers proves that a particular production architecture is safe. Their combined value is narrower and stronger: independent work across memory, reasoning, safety, training, multi-agent mediation, and regulation is converging on the same boundary. Agent reliability is increasingly a property of the harness and governance system around the model.