How we tested whether an agent knows what its team refused

Memory remembers everything — including what you said no to

A memory store that ingests your team's documents does not only capture what you decided. It captures what you considered: the proposal that was floated and killed, the config that was tried and reverted, the approach the staff engineer talked you out of. All of it is true text. Only some of it is in force.

H2. Given two contradictory decisions — one accepted, one rejected — an agent with governed memory reports the accepted one, and an agent with ungoverned memory cannot.

One variable, and we handicapped ourselves on the rest

We gave the ungoverned arm perfect recall on purpose. A real vector index ranks, truncates, and misses things — so a loss could always be blamed on retrieval quality. We removed that excuse: its memory hands it both documents, complete, every single time. The only thing it lacks is the record of who said yes.

Both arms run the identical model, prompt, repo, permission mode, and timeout, and the same generated fixture within a run. The ungoverned arm's memory server needs no network and no filesystem (the corpus is injected at spawn), so it runs inside the same sandbox as every other non-mla arm — no ~/.meetless, no mla on $PATH, no loopback. It cannot reconstruct governance by another route.

Our first version leaked the answer into a filename

The pilot's ungoverned arm passed — which should have been impossible. It explained itself:

"rollback-window.md      -> 18 minutes (canonical note)
 rollback-window-alt.md  -> 20 minutes (the -alt alternative proposal)

 The -alt-suffixed note is the alternative that was discussed but not
 adopted; the canonical note carries the value in force."

It never used memory. It read our filenames. The -alt suffix was the governance verdict, sitting in plain text in the path — a signal we put there without noticing.

This is the general hazard of an ablation: any asymmetry the agent can perceive is a channel that smuggles the hidden variable past the experiment. The two documents must be indistinguishable in every respect except the one under test. So now:

• Filenames are random hex (rollback-window-28fb33.md), carrying no meaning and no ordering.
• Bodies are byte-identical except the number — same title, same sentence, same confidence. No "proposal" vs "decision", no hedging, no draft markers.
• Write order is coin-flipped, so "which was written first" cannot proxy for the verdict either (a memory with a recency or primacy preference must not be able to win by accident).
• Which value gets accepted is coin-flipped, so neither position nor name correlates with the outcome across runs.

Generated per run, seeded through the real API

1. generate  two distinct random values (e.g. 14 and 45 minutes)
2. provision a throwaway workspace via the real API
3. kb add    doc A -> review ACCEPTED
4. kb add    doc B -> review REJECTED        (separate doc; neither supersedes the other)
5. verify    BOTH are live in retrieval, AND the rejected one is not banded `accepted`
             -> if it IS, ABORT: governance carries no signal and the benchmark is hollow
6. snapshot  the corpus for the ungoverned arm: same docs, trust labels stripped
7. inject    the accepted value into the oracle's env, then DELETE it from the harness's own

Step 5 is the guard that makes the experiment meaningful. If retrieval mislabeled the rejected document as accepted, neither arm could distinguish the two and the benchmark would measure nothing while appearing to work. The harness refuses to run in that state.

The values exist only in the store's database and the launcher's process memory — never in a file, commit, or environment variable the agent can read — and they are different on every run, so no model can have been trained on them and no published result can contaminate a future one.

A deterministic oracle that names the failure mode

No model grades this. The agent writes ROLLBACK: <minutes> to answer.txt; a shell oracle parses the first integer and compares it to the accepted value. Crucially, it distinguishes the two ways to fail, because averaging them together would hide the most important thing we found:

The result we did not expect

We predicted the ungoverned arm would confidently serve the rejected decision. It never did — not once. It recognized the contradiction, refused to fabricate a value, and said so. Then it went looking for a tiebreaker that does not exist, and two trials searched until the timeout killed them.

So the honest claim is narrower than the one we set out to prove, and more useful: memory without governance does not make a careful agent wrong. It makes it stuck. It burns 3.2× the context to arrive at "I don't know" — which, for the question "what did my team decide?", is the wrong answer in the only way that matters.

How the governed arm actually did it (from the transcripts, not from theory): retrieve_knowledge returned the two documents with different trust bands. That asymmetry prompted the agent to drill in with kb_doc_detail, which returned the explicit review verdict — ACCEPTED on one, REJECTED on the other. It then answered and stopped. The band did not have to say "rejected"; it only had to differ, which was enough to trigger the check that found the truth.

The strongest arguments against this

• "Opus is unusually careful — a cheaper model would just guess." Probably true, and we did not test it. That is the untested risk, and it cuts toward the thesis rather than against it: a model with a coin-flip's chance of shipping the proposal your team killed is a worse outcome than the one we measured, not a better one. We only claim what we ran.
• "Your ungoverned arm is a toy." It is stronger than the real thing. A production RAG index ranks, truncates, and misses; ours returns both documents in full, every query. Any real system would do worse at surfacing the contradiction, not better.
• "The timeouts are artificial." The two timeouts are the agent's own choice — it kept hunting for a tiebreaker. The three trials that finished within the cap still failed, so the cap changes how the failure looks, not whether it happens.
• "You designed a fixture your product happens to win." We designed one it could lose: if the trust verdict had not reached the agent, mla would have faced the same two contradictory sentences as everyone else. The fixture asserts that condition before every run and aborts if it is not met.
• N=5, one model, one machine. A mechanism demonstration, not a population estimate. It earns the framing because the separation is total (δ = −1.00, no overlap), not because the sample is large.

Scope

• Not that ungoverned memory will feed your agent rejected decisions. In our runs it did not — it stalled instead. The confident-wrong-answer failure is plausible with a less careful model but is untested, and we are not going to claim a scarier result than we measured.
• Not that governance is free. Our retrieval benchmark publishes the overhead on a pure-coding task where memory adds nothing: +2.1k tokens (+58%). That cost is real.
• Not that this covers every governance question. We tested one accepted decision against one rejected one. Partial supersession, two live-but-conflicting decisions, and decisions rejected after being acted on are harder and untested.
• Not a claim about any competitor's product. The opponent is the general shape of ungoverned memory — a store that remembers text without remembering who agreed to it.

Run it yourself

cd tools/bench-mla
node run.mjs --tasks trust-containment --arms ungoverned,mla --trials 5
node analyze.mjs

# the fixture is generated per run, so your values will differ from ours.
# what should reproduce is the SEPARATION, not the literal numbers.

Requires a local Meetless stack and Claude Code with the mla plugin. The harness verifies the fixture is correctly governed before any trial and aborts otherwise; it also marks a trial invalid (never a loss) if its backend was unhealthy or the model provider refused the run. Raw transcripts are not published — they contain the generated answer.