Research-Native by Construction: Minimal Nodes, Re-verifiable Workflows, and Compounding Memory for Long-Horizon Scientific Agents

Di Wang; Yu Liu; Bing Cui; Chaoqun Ji; Dongyuan Ni; Jingyu Lu; Kunlei Cui; Pu Qin

cs.SESep 28, 2026

Research-Native by Construction: Minimal Nodes, Re-verifiable Workflows, and Compounding Memory for Long-Horizon Scientific Agents

Authors: Di Wang, Yu Liu, Bing Cui, Chaoqun Ji, Dongyuan Ni, Jingyu Lu, Kunlei Cui, Pu Qin

Organizations: IdeaHorizon Team

Abstract

We describe AfS (Agent for Science), a platform built for long-horizon scientific work, where a project runs for tens of hours across dozens of agent runs with a human present only occasionally. Most agents for science are general coding agents with a skills folder attached, and they inherit that lineage's failure mode: under pressure to finish, they fabricate, skip, or smooth over. Our design rests on one claim: most of the credibility of machine-made research can be moved from asking the model to behave to making the non-compliant state unrepresentable. We encode research discipline as mechanically enforced laws (commitment before measurement; unforgeable freezing; reports are not facts; evidence persists but verdicts do not; negative results are first-class; mechanical questions to the framework and semantic judgment to the model), organized around three time horizons: a minimal set of research nodes within a run, an inquiry contract with frozen closure conditions and a hash-chained artifact ledger within a project, and a two-tier knowledge base with promotion by rewriting across projects. This is a system description written under one rule: each mechanism appears in exactly one place, with the invariant it enforces, the failure it prevents, the way it is realized, and the cost it imposes. It covers the node contract, the write-path gates, the two-tier memory, and the runtime substrate. Three traces walk real failure attempts through the mechanisms that catch them, and two closed campaigns are included as worked illustrations rather than as an evaluation. We report no benchmark: a process-integrity suite that would support quantitative comparison is under construction, and what we can measure today is only the operating cost of the machinery.

Figures & tables

Where the rule lives	Example	Observed strength
In the prompt	“You must freeze the preregistration before running.”	Weakest. Under pressure the rule is restated and then worked around (§ 1 ).
Post-hoc check	After the run, a check tests whether a freeze happened.	Weak. Found too late; killing the run does not undo what ran.
Unrepresentable	The dispatch gate refuses to start experiment unless a frozen preregistration exists.	Strong. The illegal state cannot be written.

Table 1: Three places the same requirement can land.

	Law	Failure it prevents	Described in
L1	Commitment before measurement. A question with a written proposition is a hypothesis; closure conditions are frozen before work starts.	Thresholds invented to pass a falsifiability gate; a verdict chosen after the result was seen.	§ 5.1
L2	Freezing is irreversible and unforgeable; revision leaves a trace.	A refused freeze bypassed by re-saving with frozen:true ; a frozen plan silently edited.	§ 5.2
L3	Reports are not facts. Anything mechanically computable is computed by the framework from ledgers, not read from the model’s self-report.	status: verified written by hand with no verifier call; “11 of 12 fulfilled” with zero matching keys.	§ 5.1 , § 8
L4	Evidence persists; verdicts do not. Detectors record; only the reviewer and the adjudicating node judge; judgments are recomputed, never stored.	A check layer that killed runs 87% of which never recovered; a node adjudicating its own experiment.	§ 4.6 , § 5.3
L5	Negative results are first-class. Refuted stays refuted in the manuscript; withdrawn questions enter Limitations; dead ends become knowledge cards.	“H3 is refuted” asserted for a quantity never measured; a null result smoothed into a trend.	§ 5.3 , § 6.2
L6	Mechanical questions to the framework, semantic judgment to the model, in both directions.	An orchestrator busy-waiting 47 turns on whether a node should continue; a quota of five citations standing in for relevance.	§ 4.5 , § 4.6

Table 2: Six research laws, the failure each prevents, and where its mechanism is described.

Panel of Figure 1 — Figure 1: Three time horizons of a long-horizon research job and the three pillars that serve them. Within a run, a minimal set of research nodes; within a project, a re-verifiable workflow from inquiry contract to frozen deliverables; across projects, memory that compounds through promotion. The laws of Section 2 are enforced where the record is written in all three.

Panel of Figure 2 — Figure 2: The research loop. Analysis holds adjudication authority; evidence nodes return execution-level verdicts, never scientific ones; services are called directly by their consumers; the reviewer is parameterized by the reviewed node’s own specification.

Node	Distinctive mechanisms
Analysis ( hypothesis )	Four axioms with no “hypothesis” in them; a question with a proposition is a hypothesis, one without is not, with no yes/no switch to misdeclare. Seven pre-freeze audits: goal alignment (multi-pillar requests may not collapse to one), definition lock (the user’s ontology is copied verbatim), threshold grounding (every numeric threshold needs a stated source or must become qualitative), comparison protocol, resource feasibility, cost instrumentation. Exploratory questions may not list “nothing found” as a failure condition. Sole writer of research_state .
experiment	55-word system prompt; knowledge lives in 30 loop hooks and 7 skills loaded after scope is known. execution_params are compared key-by-key with the frozen preregistration before anything runs. No proxy or toy may be reported as the original task; the only exits are probe, acquire, ask, or infeasible. Tree-sitter semantic analysis of shell commands (dynamic execution refused). Irreversible-window recovery for external job submission that trusts only the pre-submission intent record. Reproducibility snapshot; three-part evidence (log, clean, raw with SHA-256); mandatory sediment attempt or an auditable “no sediment” addendum.
writing	Two stages, plan then prose; the gate asks the ledger, not the disk: zero discharged closure conditions blocks writing and produces a material-insufficiency report; partial discharge writes with material_gaps . Mechanical blockers are separated from heuristic gaps, which are routed to the node that can fill them. Methods may not be completed from domain common sense; conflict-of-interest and authorship are not invented. Phantom claim identifiers fail the citation-integrity hook; internal identifiers may not appear in the clean PDF. TeX exit code 0 is not deliverable: layout gates on overfull boxes, unresolved references, and oversized floats. Freeze is the author’s signature; the orchestrator cannot sign for it.
literature	Four-mode contract (landscape, targeted lookup, contradiction check, method lookup) with per-mode required outputs and turn budgets, so that a “find five papers” request cannot run as a full survey. Research gaps may not be phrased as gaps in the knowledge base. Writes facts (chunks, concepts with external anchors) but never assertions. Author wiring is a hard completion gate; missing authors are recorded, not invented.
data	Planning gate with a three-role loop (requirement analyst, designer, critic); no asset is produced before an approved plan. Two authorities (plan-bound and request-bound) compiled into a locked work order. Structured terminal states ( completed , needs_input , externally_blocked , fatal ). May not refuse a redirected request on the grounds that it is “a computation task” (otherwise a two-sided deadlock).
postprocess	Provenance binding by three hashes: source artifact, rendering script, output file, recomputed by consumers; a file not written by this sandboxed execution is refused. Verdict fields removed entirely; only two mechanical facts remain, and the absence of a vision reviewer is a readable fact that downstream must disclose. Read-only scientific semantics: no aggregation, smoothing, outlier removal, or inference of graph structure. Generative images must be marked non-evidence-bearing.

Table 3: Six of the eight producing and service nodes and their distinctive mechanisms; observation and derivation are described in Section 4.3 . Tool and skill counts are tabulated in Appendix B .

Panel of Figure 3 — Figure 3: From inquiry contract to deliverables. Discharge keys must match the frozen identifiers verbatim; the tally is computed from ledgers at read time; the writing gate and the referee act on the tally, not on the node’s self-report.

Panel of Figure 4 — Figure 4: The life of one artifact. Freezing pins a version; amending a frozen version requires a reason, produces a new draft, and keeps the frozen snapshot pinned; the ledger is append-only and hash-chained; the commit gate refuses later edits to pinned paths.

Panel of Figure 5 — Figure 5: Project memory (left) and the two-tier knowledge base (right). Memory stores only the constitution and the handbook; the situation is computed every run and there is no log layer. The organization tier has no birth channel except promotion.

explicit prefix boundary marker
#	Band	Source	Changes
1	node system prompt, rules, guidelines	the node contract	never
2	index of enabled skills (bodies on demand)	skill registry	never
3	workspace, provenance and blocker rights	framework	never
4	instruction layers: organization, profile, project	session-frozen snapshot, hashed	per session
5	research laws (constitution)	MEMORY.md	rarely

Table 4: The bands of a context window, ordered by stability. A literal marker separates what is stable for the whole run from what varies per turn; blocks derived from files that may change under a long run are frozen once at run start so that the prefix cannot shift underneath the cache.

Layer	What it is	Strength and failure mode
guidelines	a soft recommendation in the contract	weak; violation is free
rules	a hard-sounding sentence in the contract	weak; “must” is not a mechanism
skill	a reusable piece of craft, shared across nodes	medium; the model must load it
hook injection	a mechanical fact placed in front of the model	strong; cannot be missed, can be ignored
tool validation	bad arguments refused at the call, with guidance	strong; scoped to one call
write gate	a non-conforming record cannot be written	strongest; misfires block legal states

Table 5: The layers a requirement can land in. The bottom three can refuse a legitimate action, so each is paired with an explicit discharge path.

Figure 6: Case C1 timeline reconstructed from the cost ledger. Bars are runs; the orchestrator session spans the project. Markers above the lanes are the twenty review critiques on disk with their machine verdicts. The manuscript was frozen at hour 50.1 after the fifth writing review returned approve with confidence 0.9.

Node	Runs	Turns	Tokens (M)	of which cache reads (M)
experiment	11	642	68.31	55.29
reviewer	20	459	42.54	37.36
writing	10	326	33.26	26.57
orchestrator	1	143	23.92	12.07
Analysis	9	184	15.71	14.28
postprocess	9	172	11.31	10.11

Table 6: Case C1 by node, from the per-project cost ledger. Tokens are prompt plus completion tokens; cache reads are the cached portion of the prompt tokens. Totals are computed from the unrounded ledger values, so rounded rows may differ from them in the last digit.

Figure 7: Case C2, reproduced unchanged from the frozen manuscript apart from the removal of its internal title. Binder-cumulant crossing temperatures extrapolated in $1/L$ under the preregistered weighted fit: $T_{c}=2.268776(148)$ against Onsager’s $2.269185$ , a deviation of $410\,\mu$ K or $2.8\sigma$ , outside the preregistered $2\sigma$ criterion. The unweighted fit would have passed at $1.17\sigma$ ; the frozen preregistration named the weighted scheme.

Figure 8: Where time and tokens go. Top: one full round of the Ising study on the installed personal edition (131 minutes, 551 model calls), cut from the cost ledger by attributing each inter-call interval to the node that made the earlier call and intervals longer than five minutes to running jobs. Bottom: prompt tokens of the preceding project on the same topic (592 calls), split into cache reads, uncached reads, and generation.

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Node	Role	Post-run flow	Tools	Local skills	Required outputs / callable nodes
Analysis ( hypothesis )	producing	full	34	3	preregistration, research plan, research state; calls literature
experiment	producing (high risk)	review, curate	60	7	experiment log, clean results, raw results; calls data
observation	producing	full	20	0	observation log with search protocol; calls literature , data
derivation	producing	review, curate	28	0	derivation log; calls literature , data
writing	producing	full	28	7	preflight plan, manuscript, validation report; calls postprocess
literature	service	none	25	1	per mode: survey report and index, or evidence package

Appendix

Table 7: The eleven node contracts as declared (counts as of 2026-09-22).

Channel	Trigger	Budget
constitution	every turn, all nodes	source capped at 2048 bytes
situation	each run start	3072 bytes
onboarding slice	turn one, all nodes	4096 bytes, matched on applies_to
first-use tool brief	first call of a given tool	at most 2 entries, 512 bytes
knowledge-base opening injection	project opening	constant: 10 conclusions, 5 dead ends

Appendix

Table 8: Mechanical delivery channels. None is gated on a query; every budget is a constant independent of the size of the store behind it.

Explore similar work

May 29, 2026cs.AI

AutoSci: A Memory-Centric Agentic System for the Full Scientific Research Lifecycle

Scientific research has traditionally been human-intensive, requiring researchers to coordinate literature, ideas, experiments, manuscripts, and review responses across long project cycles. The rise of LLM-based scientific agents creates an opportunity to automate this process. Such a system must support the full research lifecycle, maintain structured persistent memory across projects, and improve its own research procedures over time. However, existing systems either partially satisfy or fail to satisfy these requirements, leaving a gap for a unified automated scientific research system. As a result, we present AutoSci, a memory-centric agentic system for the full scientific research lifecycle. AutoSci is organized around four modules. SciMem provides schema-governed research memory, separating Long-Term Knowledge Memory for reusable scientific knowledge from Active Research Memory for project-level artifacts such as ideas, experiments, manuscripts, and reviews. SciFlow executes a five-stage lifecycle from literature understanding to rebuttal through a harness that controls state, context, verification, feedback, and orchestration. SciDAG augments difficult skills with DAG-shaped multi-agent operators and reusable stage-specific templates. SciEvolve converts feedback signals from users, experiments, reviews, and external environments into versioned updates to SciMem organization, SciFlow skills, and SciDAG templates. Together, these modules make AutoSci a persistent research environment that can execute, remember, and evolve across research projects. The code repository is available at https://github.com/skyllwt/AutoSci.

Weitong Qian, Beicheng Xu, Zhongao Xie +16

Peking University, Beijing, China

Scientific Workflows Scientific Agents Agentic Memory

Ask PDF

Jul 14, 2026cs.SE

XScientist: A Git-Like Research Protocol for Long-Running Autonomous Scientific Discovery

Autonomous research systems can generate plausible papers while losing the decisions, failed branches, and evidence needed to inspect or continue the work. We present XScientist, a local-first, git-like protocol that treats research state, rather than a manuscript, as the unit of continuation. Hypotheses, experiment attempts, observations, claims, reviews, and handoffs are represented as typed, content-addressed objects in an exploration graph. Immutable checkpoints, explicit negative outcomes, claim-evidence closure, replay boundaries, and authority-aware gates make each transition inspectable without treating a passing integrity check as scientific truth. The protocol exports a portable Agent-Native Research Artifact (ARA) that another agent or human can inspect, fork, verify, and extend. A reference implementation integrates planning, execution, review, repair, and supervised long-running operation while preserving provenance across these stages. We evaluate the protocol with controlled artifact-integrity workloads and matched external task pilots, keeping native task performance separate from evidence and audit claims. The result is an interoperability and accountability layer for long-running autonomous science, with explicit boundaries where human judgment and independent evaluation remain necessary.

Jixiang Luo

Reproducibility

Ask PDF

Apr 27, 2026cs.LG

The Last Human-Written Paper: Agent-Native Research Artifacts

Scientific publication compresses a branching, iterative research process into a linear narrative, discarding the majority of what was discovered along the way. This compilation imposes two structural costs: a Storytelling Tax, where failed experiments, rejected hypotheses, and the branching exploration process are discarded to fit a linear narrative; and an Engineering Tax, where the gap between reviewer-sufficient prose and agent-sufficient specification leaves critical implementation details unwritten. Tolerable for human readers, these costs become critical when AI agents must understand, reproduce, and extend published work. We introduce the Agent-Native Research Artifact (ARA), a protocol that replaces the narrative paper with a machine-executable research package structured around four layers: scientific logic, executable code with full specifications, an exploration graph that preserves the failures compilation discards, and evidence grounding every claim in raw outputs. Three mechanisms support the ecosystem: a Live Research Manager that captures decisions and dead ends during ordinary development; an ARA Compiler that translates legacy PDFs and repos into ARAs; and an ARA-native review system that automates objective checks so human reviewers can focus on significance, novelty, and taste. On PaperBench and RE-Bench, ARA raises question-answering accuracy from 72.4% to 93.7% and reproduction success from 57.4% to 64.4%. On RE-Bench's five open-ended extension tasks, preserved failure traces in ARA accelerate progress, but can also constrain a capable agent from stepping outside the prior-run box depending on the agent's capabilities. Our code is open-sourced at https://github.com/Orchestra-Research/Agent-Native-Research-Artifact.

Jiachen Liu, Jiaxin Pei, Jintao Huang +34

University of Michigan · Stanford University · Ohio State University +22

Research Automation Narratives

Ask PDF