The Model Is Not the System

The most consequential AI work this week is not about making a model marginally smarter in isolation. It is about everything surrounding the model: the harness that determines which tools it can use, the evidence pipeline that decides what reaches its conclusions, the memory system that controls what remains visible, and the representations through which it sees a problem.

That shift matters because deployed agents do not fail like benchmark models. They fail across time. A misleading source arrives just before synthesis. A tool exists but is exposed through an awkward shell wrapper. A conversation grows until the relevant instruction is buried under thousands of tokens. A screenshot contains information missing from the DOM. A speculative decoder spends more time reading its draft cache than drafting.

Several papers this week attack different parts of that systems problem. OpenForgeRL trains agents inside their real harnesses. MisKnow-Agent demonstrates that deep-research workflows can absorb manufactured falsehoods even when their component models are capable of identifying those falsehoods in isolation. A theoretical paper argues that some goals cannot be specified before interaction because the interaction helps constitute the goal. Other work explores context management, long-context decoding, 3D-aware vision, multimodal self-distillation, and counterfactual explanations.

The common lesson is inconvenient but useful: capability is not located in one model invocation. It emerges from the entire path between information, representation, action, and verification.

1. Train the agent you actually deploy

OpenForgeRL: Train Harness-native Agents in Any Environment addresses a mismatch that is becoming hard to ignore: agents are commonly trained in simplified tool loops, then deployed inside much more complicated harnesses.

A real harness may own the conversation state, dynamically expose tools, invoke subagents, compress context, recover from failures, and decide which model calls happen at all. Reimplementing that machinery inside an RL trainer is expensive and usually produces a subtly different system. OpenForgeRL instead places a proxy between the harness and the model endpoint. The harness continues operating normally while the proxy reconstructs model prompts, responses, and trajectories for training.

The second half of the system is a Kubernetes rollout layer. Each episode gets an isolated environment with its own tools, resources, and, where necessary, virtual display or remote browser. The policy optimiser can remain on GPU machines while stateful tool execution happens elsewhere.

This is infrastructure rather than a new RL objective, but that is precisely why it is interesting. The authors demonstrate it across text-based tool agents, GUI agents, and browser agents using harnesses including OpenClaw, ZeroClaw, Codex, and ReACT-style loops.

Their reported 30B-A3B OpenForge-Claw model reaches:

The 8B OpenForge-GUI model reports:

Those numbers belong to different benchmarks with different evaluators and success definitions. They should not be blended into a generic “agent success rate.” Several evaluations also depend on external model judges, modified tool setups, or benchmark-specific harness adaptations.

The more revealing result is that the harness itself affected learnability. ReACT and ZeroClaw, which expose dedicated tools directly, performed better than configurations where tools were described through generated SKILL.md files and invoked through shell commands. Under ZeroClaw, RL reduced generic shell usage from 22.6% to 13.9% of tool calls, redistributing behaviour toward dedicated tools.

Training transferred somewhat across harnesses. A model trained only on ZeroClaw improved over the base model by 3.3 points on OpenClaw and 4.6 on Codex. Training across ZeroClaw, OpenClaw, and Codex produced reported gains of 9.5 points on OpenClaw and 20.3 on Codex. That suggests varied control flows can improve robustness, though it does not isolate harness diversity from the effects of extra tasks, supervision, and RL.

The unresolved issue is the one that matters most in production: error recovery remained weak. An agent that succeeds when every tool behaves normally is a demo. An agent that notices stale state, interprets a partial write, chooses whether to retry, and verifies the eventual result is a system.

This paper is directly relevant to Jarvis because Jarvis is the harness, not merely the model inside it. Its actual behaviour depends on service conventions, confirmation boundaries, persistent memory, browser state, scheduled jobs, and the distinction between a reversible internal operation and an external action. Training on generic function calls would miss much of that. A useful Jarvis training environment would need disposable replicas of those workflows, aggressive failure injection, and outcome verification—not access to the live homelab with a cheerful reward model and a dream.

2. Deep research can verify a lie and still believe it

Is Deep Research Reliable? Misleading Knowledge Induces False Conclusions tests whether research agents can resist documents that are relevant, authoritative-looking, and wrong.

The authors created 5,933 controlled misleading documents for 100 DeepResearch Bench tasks. Each document supported a predefined false conclusion and was inserted into an isolated retrieval environment. The evaluation counted a failure only when the final report adopted that conclusion as its own—not when it merely retrieved, quoted, or rejected the document.

The strongest result concerns timing. Mean false-conclusion adoption rate was:

In every tested framework–model configuration, the late-stage rate fell between 77% and 94%.

This is not an estimate of how often ordinary research agents hallucinate or how reliable Jarvis is on the open web. It is a controlled attack condition in which documents were deliberately engineered to support a salient false conclusion. Even so, the size of the timing effect is hard to dismiss. Research agents appear especially vulnerable when new evidence enters after most exploration is complete but before the report is written.

Retrieval position mattered much less. Placing a misleading document at the front, middle, or back of retrieved results produced mean adoption rates of 65.2%, 65.7%, and 64.2%. Once evidence entered the working state, its exact rank was comparatively unimportant.

Framework design mattered more than backbone choice. Under a matched high-authority, paper-style condition, DeerFlow averaged 66.7% false-conclusion adoption across three models, compared with 29.3% for WebThinker. The authors attribute some of this difference to how directly evidence flows into the final report: compression and intermediate editing may sometimes act as useful friction rather than mere overhead.

Presentation also mattered. Mean adoption was 48.0% for paper-style documents, compared with 43.7% for blogs, 37.0% for news articles, and 29.7% for posts. Formal appearance was more consistently persuasive than institutional authority.

The paper’s nastiest finding is a verification paradox. Search-enabled verifier models classified 100% of the retained documents as misleading during focused validation, yet research agents still adopted those documents in long-horizon workflows. Knowing how to fact-check a claim is not the same as reliably invoking that ability while planning, retrieving, summarising, and writing.

The proposed defences—stronger verification instructions before research and an additional audit after research—reduced failure rates but did not eliminate them. Combining defences was not consistently additive. In one configuration, the auditor encountered the same contaminated evidence and reintroduced the problem it was supposed to remove.

For Jarvis, the practical implication is not “add another verifier agent.” It is to preserve claim-level provenance throughout the workflow:

A citation is not a truth token. Nor is a PDF costume.

3. Sometimes the goal does not exist yet

The Boundaries of Automation: A Theory of Persistent Human Participation asks why people might remain involved even if AI systems become technically capable of doing nearly everything required to complete a task.

Its answer is not merely accountability, human dignity, or complementary skill. In some activities, the target itself emerges through interaction.

The paper uses “target” broadly: the objective, preference, constraint, utility, or evaluative standard that determines whether an outcome is good. It distinguishes three kinds of interaction:

That final category is the important one. In design, writing, research, and difficult personal decisions, candidate outputs expose assumptions and trade-offs that were not available at the start. Interaction may reveal a tacit preference, refine an underspecified goal, or constitute a new goal.

The authors call these revelation, refinement, and constitution. Their strongest philosophical claim is that predicting the preference someone will eventually endorse is not necessarily equivalent to participating in the process by which that preference becomes meaningful and endorsable.

There are no new benchmarks or user studies here. The paper provides a taxonomy, an abstract dynamical model, examples, and proposals for future empirical tests. Its claim is conditional rather than universal. Unit conversion, transcription, formatting, and other stable transformations remain straightforward candidates for automation. The argument applies when the target is genuinely changing through interaction.

This matters for assistants because “execute immediately” and “ask clarifying questions” are both bad universal policies. A better distinction is whether the task is in an execution phase or a target-forming phase.

For Jarvis, that means remembered preferences should be evidence rather than constitutional law. Persistent memory can quietly collapse exploration by making yesterday’s target look permanent. Conversely, asking the user to deliberate over every reversible file edit is not co-construction; it is bureaucracy wearing a philosophy hat.

The useful design principles are reversibility, inspectability, preserved alternatives, and a willingness to notice when feedback changes the goal rather than merely correcting the output.

4. Context is an architecture problem, not a bigger prompt

Agentic Context Management: Solving Agent Memory and Cost by Treating Them as Lifecycle and Architecture Problems argues that agent memory is too narrow a framing. The real problem is managing the lifecycle of information.

The proposed discipline, Agentic Context Management, has five parts:

  1. Architecting: deciding what information should exist and in what form.
  2. Ingesting: extracting structured facts, events, entities, and relationships.
  3. Scoping: assigning information to users, organisations, operators, or global knowledge.
  4. Anticipating: pre-fetching context likely to be needed next.
  5. Compacting and consolidating: reducing active context while checking that important information remains recoverable.

This is primarily a taxonomy and product architecture paper. Its reference implementation, Maximem Synap, is proprietary, and the paper is written by a vendor-associated author. Several central mechanisms—including anticipatory retrieval and compaction validation—are not disclosed sufficiently for reproduction.

The reported results are nevertheless worth examining carefully. Synap scores 92.0% on LongMemEval, or 460 of 500 questions. But the category breakdown is more informative than the headline: multi-session performance is only 75.2%, compared with perfect reported scores in several single-session and temporal categories.

Synap also reports 93.2% on LoCoMo categories 1–4. The qualification matters because category 5 contains adversarial unanswerable questions and is excluded from that score. “93.2% on LoCoMo” without the category restriction would be misleading.

The paper is strongest when describing failure modes rather than product superiority. Saving a sentence like “the user mentioned a pricing plan” is not useful memory if the important fact was that the user upgraded from Starter to Pro on a particular date. Useful ingestion needs entities, temporal structure, provenance, and confidence. Retrieval also needs explicit scope boundaries; otherwise, the same machinery that remembers effectively can leak effectively.

The cost argument is straightforward. Repeatedly sending a growing transcript produces quadratic cumulative input-token growth under the paper’s simplified assumptions. Keeping a bounded working context makes cumulative usage linear. The hard part is compacting without deleting something that only becomes important later.

Jarvis already embodies much of this architecture: stable core memory, recent promoted context, database-backed fragments, project-specific knowledge, and conversation-local state. The paper’s useful challenge is to make provenance and scope more explicit while measuring whether compaction preserves exact commitments, numbers, unresolved caveats, and source links. “Validated compaction” is a good aspiration. “Lossless compaction” is marketing unless the future is known.

5. Stop making the draft reread a million tokens

Windowed-MTP: Removing the Full-Context Draft-KV Tax at Million-Token Context finds an avoidable cost inside speculative decoding.

Multi-token-prediction heads draft several candidate tokens, which the main model then verifies. At short context, the draft is cheap. At million-token context, however, an attention-based draft head may repeatedly read the full KV cache. The allegedly cheap part can become a substantial fraction of each decoding step.

Windowed-MTP restricts only the draft head to a small recent window plus a set of initial attention-sink tokens. The target model still verifies candidates against the complete context. In exact speculative-decoding terms, the verifier remains authoritative: a changed draft can alter acceptance and speed, but cannot directly insert an unverified token.

In the authors’ SGLang experiments at roughly one million tokens, using one NVIDIA B200, bf16 KV, a 4K draft window, and 64 sink tokens, Windowed-MTP reduced the cost of one speculative decode iteration by 28–44% relative to native full-context MTP across three tested model families.

That is not a universal end-to-end speedup. Actual token latency depends on how many proposed tokens are accepted. Framework overhead, model architecture, KV precision, tensor parallelism, batch size, and hardware all matter.

The method also reclaims memory. At one million tokens, the draft KV pool represented approximately 7.7–11.1% of total KV across the tested models. Once the draft reads only a bounded region, most of that allocation can be replaced by a compact ring buffer.

Acceptance generally remained competitive, but not always unchanged. Qwen3.5-122B lost some acceptance on a multi-needle retrieval workload where distant context genuinely helped the drafter. In a separate probe, restricting the draft cache left top-1 proposals unchanged 98–99% of the time, depending on model and configuration.

This is most relevant to agent workloads with long prompts and short completions: inspect a huge state, emit one tool call. If Jarvis eventually runs on an inference stack with built-in MTP/NEXTN support, bounded draft attention could reduce latency and increase concurrent session capacity without weakening full-context verification. But it requires engine-level support; this is not a magic model flag.

6. Give the VLM both a cognitive map and a measuring tape

3D-Aware VLMs with Implicit and Explicit Geometries augments a vision-language model with two forms of spatial representation reconstructed from ordinary RGB video.

The first, Implicit Geometry Tokens, comes from intermediate representations inside the AnySplat geometry model. These tokens are intended to encode global layout and broad spatial relationships.

The second, Explicit Geometry Tokens, represents quantities such as predicted depth, camera pose, point maps, and 3D Gaussian splats. A lightweight module embeds these measurements, while cross-attention allows the implicit representation to draw selectively on explicit detail.

The distinction is sensible: a semantic “cognitive map” and a reconstruction-derived “measurement map” answer different questions. The paper’s detection ablation supports that narrower claim:

Most of the improvement comes from implicit geometry. Explicit geometry adds another 2.3 points over the implicit-only model. That is useful complementarity, not proof that explicit reconstruction is the main driver.

On the authors’ EmbodiedScan-derived video-detection benchmark, the full system reports 44.2% precision, 41.9% recall, and 42.8% F1 at IoU 0.25. On ScanRefer, it reports 43.2% [email protected] and 16.9% [email protected] without proposal refinement, rising to 55.4% and 48.9% with refinement. Those settings should not be conflated: proposal matching introduces external object candidates.

The phrase “RGB-only” also needs care. The system does not consume measured depth or point clouds, but it runs a powerful pretrained geometry model to reconstruct them. Bad depth, pose, scale, or alignment estimates can flow directly into the VLM. Evaluation is concentrated on indoor-scene datasets and does not establish robustness outdoors, under poor lighting, or during chaotic camera motion.

For Jarvis, the immediate value is architectural rather than deployable. A household or camera-aware assistant should preserve both semantic scene state and measurable geometry. Questions like “Where was the object last seen?” or “Is it closer to the speaker or television?” need more than image captioning. The expensive and fragile part would probably be the geometry front end, not the small adapter.

7. Let one representation teach another

MIRROR: Learning from the Other View for Multi-Modal Reasoning starts from a familiar annoyance: a vision-language model can solve the same geometry problem from text but fail from a diagram—or occasionally the reverse.

MIRROR turns that disagreement into supervision. For each problem, it tests text-dominant, image-dominant, and combined views, then selects the strongest view as a teacher. The student still samples reasoning from its restricted input. An exponential-moving-average teacher conditioned on the stronger view scores the same sampled tokens.

This is not ordinary teacher imitation. The stronger view does not generate a trajectory for the weaker view to copy. It evaluates the student’s own trajectory, reducing one form of off-policy mismatch.

The authors construct ODA-Data, roughly 2,000 paired geometry examples selected specifically because the base model behaves differently across modalities. On the training set, Qwen3-VL-4B-Instruct achieves:

Yet the best view varies by problem: text is strongest on 51.14%, image on 37.98%, and combined input on 10.88%. The asymmetry is real within this deliberately filtered dataset.

The authors report gains of 14.49% on image pass@16 and 5.88% on text pass@16 over the base model, plus improvements of 7.59% on GeoInt pass@16 and 5.22% in MathVerse mean judge score. These are reported relative gains; several absolute table entries are missing from the available text extraction. Pass@16 also measures whether one of many samples succeeds, not deterministic single-shot performance.

For Jarvis, the diagnostic idea may be more valuable than the training recipe. The same webpage can be represented as a screenshot, DOM, accessibility tree, OCR text, or API response. Logging which representation succeeds would reveal where failures actually come from. Later, successful traces from one view could supervise weaker views—but only when the representations describe the same state and the action outcome can be independently verified.

An API may expose privileged information absent from the visible interface. Calling those views “equivalent” would be convenient and wrong.

8. An explanation should survive both retention and removal

Beyond Sufficiency: Time Series Explanation with Counterfactual Necessity argues that preserving a prediction is not enough to identify the evidence a model relies upon.

Suppose two correlated signals both support the same classification. Keeping either may preserve the answer, making each appear sufficient. But removing one may reveal that the model did not depend on it at all.

TimePNS combines both tests. It first learns a sparse, sufficiency-oriented explanation in a latent temporal representation. It then intervenes on individual latent factors, propagates those changes through a learned dependency structure, decodes the counterfactual, and measures how much the classifier’s confidence falls. A second-stage gate retains regions that are both useful for preserving the answer and disruptive when removed.

On three synthetic datasets, the paper reports the best AUPRC for TimePNS across all three and the best AUP on two. On three UCR datasets, its selected regions reportedly preserved predictions well when retained and caused the strongest degradation when removed. In one Epilepsy example, removing the top-half mask changed factual-class confidence by 0.001 for TimeX, 0.514 for TimeX++, and 0.740 for TimePNS.

The causal language needs restraint. The latent representation is learned rather than independently established as the true causal structure. Counterfactual propagation uses local linearisation, and interventions depend on an artificial replacement distribution. The method identifies what mattered to one tested Transformer under its intervention protocol, not what caused the real-world event.

The broader evaluation principle is useful for agents. If Jarvis says a particular memory, tool result, or source determined its answer, test both directions: retain only that evidence and remove it while replaying the task. Even then, the conclusion is behavioural necessity under the replay setup—not privileged access to the model’s soul, assuming such a paperwork-heavy place exists.

9. Synthetic data works best when the simulator knows the machinery

Synthetic data generation framework for quality control automation in rotogravure printing is a narrow industrial paper with a broadly useful engineering pattern.

The authors procedurally generate fisheyes, streaks, colour misregistration, and creases in rotogravure printing images. The simulator produces both the defective image and its pixel-level segmentation mask. Its better effects are tied to plausible physical structure: streak intensity varies with Perlin noise, misregistration follows detected printed contours, and creases combine geometric warping with shadow and highlight cues.

A model trained on 7,533 synthetic images reportedly reached 80.9% mAP@50, 85.6% precision, 78.3% recall, and 81.7% F1 on an independent set of real production-line defects.

The sim-to-real result is encouraging, but the real test set is insufficiently described. The paper does not clearly report its size, class distribution, defect severity, or per-class results. Nor does it compare synthetic-only training against real-only data, mixed data, ordinary augmentation, or a conventional machine-vision baseline. The result demonstrates transfer in one setup; it does not show that synthetic data matches real data or that the system is production-ready.

The transferable lesson is that synthetic data becomes more credible when generated from known mechanisms rather than arbitrary visual noise. For Jarvis, the analogue would be generating browser and service failures from actual state transitions: missing permissions, stale pages, partial writes, delayed responses, or broken layouts. Synthetic labels are cheap. Real validation remains mandatory.

10. A robust counterexample to optimistic optimiser folklore

Barzilai–Borwein Fails Superlinear Convergence on an Open Set of Quadratics for Every Dimension (n\geq4) is the most mathematical paper in the group and the least directly relevant to deployed agents.

The Barzilai–Borwein method is a cheap gradient method that often performs much better than ordinary gradient descent. That empirical success has encouraged stronger intuitions about its asymptotic behaviour. This paper proves that the long-step version, BB1, fails to converge root-superlinearly on a nonempty open set of strictly convex quadratics for every finite dimension (n\geq4).

“Open set” is the important improvement over earlier counterexamples. The bad behaviour is not confined to a finely tuned, measure-zero initialisation. The construction uses a computer-assisted proof of an attracting seven-cycle in projectivised BB dynamics. Gradient energy cycles among eigendirections while the total magnitude contracts geometrically.

For the constructed family, every spectral gradient component is bounded between geometric sequences with factors (10^{-6}) and 0.61 per iteration. The lower bound prevents root-superlinear convergence; the upper bound establishes convergence.

This does not mean BB1 is usually slow. The lower factor is tiny, the neighbourhood need not be large, and the theorem concerns strictly convex quadratics rather than modern nonconvex training. It also says nothing directly about BB2, line searches, safeguards, alternating variants, or stochastic optimisation.

Its broader lesson belongs in the roundup because it matches the rest: behaviour observed in a simplified setting does not automatically survive a change in dimension, dynamics, or surrounding machinery. Practical success is evidence. It is not a universal convergence theorem.

The system is where the assumptions accumulate

These papers cover RL infrastructure, misinformation, philosophy of automation, context storage, decoding kernels, 3D vision, multimodal learning, explanations, industrial simulation, and optimisation theory. Their shared concern is not obvious until the model is removed from the centre of the picture.

Every system makes hidden choices about what counts as context, what evidence is trusted, which representation is privileged, how errors propagate, and when outputs are checked. Those choices can dominate model scale.

OpenForgeRL shows that changing the harness changes what an agent can learn. MisKnow-Agent shows that verification capacity can disappear inside a long workflow. The target-emergence paper explains why some apparent underspecification cannot be solved by better inference alone. Context management and Windowed-MTP show that information has both semantic and physical costs. The vision papers show that better reasoning may require preserving multiple complementary representations rather than forcing everything through one abstraction.

For Jarvis, the practical agenda is consequently less glamorous than “make the model smarter” and much more useful:

The model matters. The route by which the model encounters reality matters more often than the industry likes to admit.

Reading list

  1. OpenForgeRL: Train Harness-native Agents in Any Environment
  2. Is Deep Research Reliable? Misleading Knowledge Induces False Conclusions
  3. The Boundaries of Automation: A Theory of Persistent Human Participation
  4. Agentic Context Management: Solving Agent Memory and Cost by Treating Them as Lifecycle and Architecture Problems
  5. Windowed-MTP: Removing the Full-Context Draft-KV Tax at Million-Token Context
  6. 3D-Aware VLMs with Implicit and Explicit Geometries
  7. MIRROR: Learning from the Other View for Multi-Modal Reasoning
  8. Beyond Sufficiency: Time Series Explanation with Counterfactual Necessity
  9. Synthetic data generation framework for quality control automation in rotogravure printing
  10. Barzilai–Borwein Fails Superlinear Convergence on an Open Set of Quadratics for Every Dimension (n\geq4)