Governed memory Β· internal benchmark

mla vs. vanilla Claude Code

A head-to-head on the capability that matters: does the agent know the team's settled decisions β€” and what does that cost when it doesn't need them?

Retracted Β· 14 Jul 2026 Β· we told the opponent it could not win

This result is withdrawn. The prompt rigged it, and we found out by giving it a real opponent.

The 0/5 below is not a measurement of the opponent. It is a measurement of our own question. The task prompt said, verbatim: β€œthe answers … are NOT in this repository β€” they live only in that knowledge base. Look up the knowledge base …”

Any agent without a knowledge base reads that, concludes the task is impossible, and writes UNKNOWN. We proved it: we gave a static arm all three facts in its CLAUDE.md β€” sitting in its own context window β€” and under that prompt it still scored 0/5, explaining β€œI could not query the knowledge base in this environment.” It never looked at the file. Under a neutral question it scores 5/5. So does an ungoverned vector store.

armunder the published promptunder a neutral question
static β€” the three facts in CLAUDE.md0/55/5
ungoverned β€” the three facts in a plain storeβ€”5/5

And the task was the wrong question to ask us anyway. Two of its three facts are a codename and an owner β€” naming and organisational facts that governed memory deliberately does not store. Our extractor's own contract is β€œdoes the statement BIND the product, or merely DESCRIBE it?” A codename binds nothing. It is supposed to be skipped.

For raw fact recall from a document, a CLAUDE.md or a vector store will always beat governed memory. They hand back text; we hand back governed decisions. We are not a document store. We are a decision store. A benchmark that asks us to be a document store is one we should lose β€” and it should not be on this site claiming the opposite. Why this page is withdrawn rather than corrected

A rebuilt version will ask about decisions and requirements β€” the things we actually claim to govern β€” with a prompt that names no mechanism, and a lint that refuses to run any task whose wording presupposes one. The claims that survive our own adversarial re-testing are provenance (a file answers β€œwho approved this” 0/5, structurally) and contested-canonical. (An earlier version of this note also cited trust-containment as a survivor; we retracted that one on 2026-07-17 β€” it graded the opponent against a verdict we never put in its corpus.)

Preliminary Β· internal N = 5 per arm 2 tasks Β· 20 runs fixture generated per run
run date 2026-07-11 claude 2.1.197 mla 0.2.14 model claude-opus-4-8 base e20643b9 host darwin 25.5
The knowledge task β€” a decision that lives only in governed memory
5/5mla
passed
vs
0/5vanilla
passed

Asked for three settled facts that exist only in the team's knowledge base β€” nowhere on disk, in git, in env, or reachable over the network. The facts are randomly generated on every run, so no model could have been trained on them. mla retrieved them every time (grounded, 0 filesystem searches in all 5 trials, ~31 s). Vanilla failed every time β€” it grepped, guessed, and gave up, burning 7Γ— the context and 4.7 minutes to still be wrong. This isn't faster-vs-slower; it's right vs. wrong.

Task 1 Β· knowledge retrieval

Governed facts

mla answers what vanilla structurally cannot
metricmlavanilla
passed5/5 βœ“0/5 βœ—
retrievalgroundednone
greps (median)0 (every trial)9 (6–15)
work tokens5.4k21.2k (≀24k)
context tokens163k1.12M (6.9Γ—)
agent time31 s4.7 min (≀7.2)

Vanilla's numbers are its failure cost β€” it spent 7Γ— the context and produced the wrong answer. Cliff's Ξ΄ = βˆ’1.00 on both searches and context: perfect separation, not a shifted average. Efficiency here collapses to a single fact β€” only one arm can answer at all.

Task 2 Β· control (pure coding)

Slug utility

both pass β€” and we publish mla's overhead
metricmlavanilla
passed5/5 βœ“5/5 βœ“
retrievals00
work tokens5.8k3.7k
agent time31 s14 s
overhead+2.1k tok (+58%) Β· +17 s

A fully-specified task needing no team knowledge. mla loses here, and by a perfectly separated margin (Cliff's Ξ΄ = 1.00 on tokens β€” every mla trial cost more than every vanilla trial). Note it made zero retrieval calls: the cost is the grounding floor, not reflexive lookups. This is the honest counterweight, and it goes on the page.

Why this number is trustworthy

The harness caught itself cheating 7 times

A benchmark is only as honest as its isolation. The "vanilla" arm was given every chance β€” including access to mla's own installation β€” and each way it leaked the answer was found by forensics and sealed. The result above is what's left after all seven.

01 Β· worktree
Task files stripped
oracle/meta held the answer β†’ removed from the worktree.
02 Β· git
History severed
agent ran git show <sha> β†’ .git unlinked.
03 Β· disk
Notes DB-only
facts grepped from sibling vault β†’ kept in the KB alone.
04 Β· oracle
No literals
answer key injected via env, not written on disk.
05 Β· env
Env scrubbed
agent ran env β†’ expected values deleted from the subprocess.
06 Β· inherited
mla stripped
global MCP server + mla on $PATH removed from vanilla.
07 Β· reconstructed
Sandboxed
agent found the binary by path + queried the live KB β†’ file-read & localhost network denied.
The answer now exists in exactly two places a vanilla agent cannot reach: the KB database and the launcher's memory. Not on disk, not in git, not in env, not on any local port. Vanilla failing 5/5 is therefore a real result, not a leak.

And the facts don't exist until the run starts

Sealing the leaks answers "could the agent have found it?" It does not answer the harder question: could the model already know it? A benchmark with hand-written facts can always be dismissed as memorized from training data or leaked into a public repo. So we stopped shipping facts and shipped a generator.

generate
Random, every run
A fresh codename, exit criterion, and owner are invented per run β€” a pronounceable nonsense word, a random percentage, a random name. Nothing to memorize.
seed
Through the real API
Provision a throwaway workspace, add the decision, accept it β€” the same routes a customer uses. No test backdoor.
verify
Proven retrievable first
The harness polls until the store actually serves the fact. A fixture that hasn't indexed is re-seeded, never run.
confine
DB + memory only
The values touch no file, no commit, no env var the agent can read. There is no seal to leak, because there is nothing on disk to seal.
The answer is younger than the run. It cannot be in any model's training data, cannot be in this repository, and differs on every execution β€” so a published result can never contaminate a future one. "You trained on the answer" is not a criticism this benchmark can receive.

How to read this

# reproduce
cd tools/bench-mla
node run.mjs --trials 5     # tasks Γ— arms Γ— trials β†’ runs/
node analyze.mjs            # runs/ β†’ results/summary.json
node report.mjs            # β†’ results/report.md + .html
governed-facts + pure-util-slug Β· 5 trials Β· 2 arms Β· vanilla sandboxed (deny-read + deny-localhost); mla via plugin MCP