Chapter 4 of 8

Plan with hypotheses and remember with evidence

Chapter 4

About 6 minutes · includes examples, an exercise, and references

Chapter at a glance

•Treat plans as versioned hypotheses whose preconditions are rechecked after every observation.
•Separate working, episodic, semantic, procedural, and user memory with distinct provenance and retention rules.
•Use typed work orders and independently verified artifacts for delegation.

Planning, memory, and multi-agent orchestration solve different problems and should not be collapsed into a single “smart context.” Planning proposes an ordering of future work. Memory preserves information across decisions or runs. Orchestration decides which component owns the next step and how results are combined. Each can improve a system, but each creates new stale-state, privacy, consistency, and evaluation risks.

A plan is a hypothesis. It predicts that a sequence of actions will move current state toward the goal. The environment can invalidate it after any step, so store plans as versioned artifacts with assumptions, dependencies, expected evidence, and a revision reason. Do not execute a generated list blindly. Before each action, compare its preconditions against current state and policy. After each observation, decide whether the remaining plan is still valid, needs repair, or should be abandoned.

Planning depth should match task structure. A fixed workflow is best when the process is known: validate, retrieve, draft, review, publish. A dynamic local planner is useful when the next evidence source depends on the last result. Search trees or multiple candidate plans may help when actions are reversible and a simulator or verifier provides feedback. Broad open-ended planning is expensive and hard to evaluate. Prefer constrained choices, explicit branch points, and short planning horizons that can be re-evaluated.

Memory requires a taxonomy. Working state holds facts needed for the current run. Episodic memory stores selected prior trajectories or outcomes. Semantic memory stores durable facts or documents indexed for retrieval. Procedural memory stores instructions, policies, tool schemas, or learned strategies. User memory stores preferences and user-provided facts under consent and retention rules. These classes have different sources of truth, lifetimes, access controls, and invalidation mechanisms. A vector index is a retrieval mechanism, not a truth guarantee.

Write to memory only through a policy. Record provenance, subject, scope, timestamp, expiry, sensitivity, confidence, and supersession. Avoid automatically promoting every model summary into durable memory. Summaries can introduce false facts, erase exceptions, or blend users. For consequential facts, store a pointer to authoritative evidence and validate freshness when read. Deletion and correction must propagate to derived indexes; otherwise “memory” becomes an ungoverned replica.

Context construction is a compilation step. It selects current instructions, state projection, relevant evidence, permitted tools, and compact trajectory history under a token budget. The compiler should be deterministic given the same inputs and version. Prioritize authoritative instructions and current facts, then task-relevant evidence, then optional examples. Keep untrusted retrieved content clearly delimited. Track which items were omitted, summarized, or truncated so failures can be diagnosed.

Reflexion showed that verbal feedback stored across attempts can improve performance on some tasks. The production lesson is to treat reflection as a candidate learning artifact, not unquestioned memory. Tie it to a task class, evidence, model and prompt version, and expiry. Evaluate whether retrieving the reflection improves held-out tasks without increasing unsafe behavior or cost. A reflection that says “always retry with a broader query” may help research and harm a privacy-sensitive workflow.

Multi-agent systems are distributed systems with probabilistic workers. Adding specialists can separate contexts and tools, but it also adds routing errors, duplicated calls, longer traces, inconsistent beliefs, and more security boundaries. Use multiple agents only when the decomposition has a clear interface: different permission domains, independently evaluable expertise, parallelizable evidence gathering, or a deliberate adversarial review. If one model call with two tools solves the task, agent personas add ceremony rather than capability.

Two orchestration patterns recur. In manager orchestration, one controller retains the goal and invokes specialists as tools, then verifies and integrates results. This centralizes policy and final responsibility. In handoff orchestration, control transfers to a specialist that becomes responsible for subsequent decisions. Handoffs can reduce manager bottlenecks but require explicit input filtering, authority recalculation, and a return or escalation protocol. A conversational mention of another agent is not a handoff receipt.

Delegation should create a typed work order: objective, provided evidence, allowed tools, budgets, expected artifact, completion contract, deadline, and parent trace. The child returns an artifact plus evidence and terminal reason. The parent verifies the contract rather than trusting a confident summary. Do not pass the entire parent history by default; filter secrets, irrelevant instructions, and capabilities. An agent receiving a work order should not inherit the parent’s production credential merely because it inherited its text.

Parallelism is safe when subtasks do not race on shared effects. Read-only research over independent sources can run concurrently. Two workers editing the same file, changing the same customer record, or consuming the same approval need coordination or isolated proposals followed by a single commit. Fan-out also multiplies model spend and rate-limit pressure. Set a concurrency budget, cancel losing branches, and attribute cost to the parent task.

At system scale, make orchestration durable. The work-order record and state transition are committed before delivery. Workers are stateless or recover from a checkpoint. Results are deduplicated by work-order identifier. Cancellation is an explicit signal observed at safe boundaries. Human questions suspend the run with an expiry instead of keeping a process alive. Version every planner, memory policy, context compiler, router, and specialist contract so a trace explains behavior after the system evolves.

The design test is subtraction. Remove long-term memory: does the task still work with authoritative retrieval? Remove the planner: can a fixed workflow handle it? Remove specialists: can typed tools serve the same decomposition? The smallest architecture is usually easier to secure and evaluate. Add a mechanism only after a benchmark shows which failure it corrects and which new failure budget it consumes.

Key points

Treat plans as versioned hypotheses whose preconditions are rechecked after every observation.
Separate working, episodic, semantic, procedural, and user memory with distinct provenance and retention rules.
Use typed work orders and independently verified artifacts for delegation.
Introduce multi-agent orchestration only for clear permission, evaluation, specialization, or parallelism boundaries.

A bounded context compiler

Read the expected behavior in the surrounding walkthrough, then copy and run this reference implementation.

A bounded context compilerpython

from __future__ import annotations

from dataclasses import dataclass

@dataclass(frozen=True)
class MemoryItem:
    text: str
    authority: int
    relevance: float
    tokens: int
    expires_at: int

MAX_ITEM_TOKENS = 4_096
MAX_CONTEXT_TOKENS = 32_768

def checked_token_count(label: str, value: int, limit: int) -> int:
    # Exact integers reject booleans, fractions, NaN, and infinity as estimates.
    if type(value) is not int or not (0 <= value <= limit):
        raise ValueError(f"{label} must be a bounded non-negative integer")
    return value

def compile_context(items: list[MemoryItem], now: int, budget: int) -> list[str]:
    budget = checked_token_count("budget", budget, MAX_CONTEXT_TOKENS)
    for item in items:
        checked_token_count("item tokens", item.tokens, MAX_ITEM_TOKENS)
    valid = [item for item in items if item.expires_at > now]
    ranked = sorted(valid, key=lambda item: (-item.authority, -item.relevance, item.tokens))
    selected: list[str] = []
    used = 0
    for item in ranked:
        if used + item.tokens <= budget:
            selected.append(item.text)
            used += item.tokens
    return selected

items = [
    MemoryItem("Current refund policy v7", authority=3, relevance=0.9, tokens=20, expires_at=200),
    MemoryItem("Prior case summary", authority=1, relevance=1.0, tokens=15, expires_at=200),
    MemoryItem("Expired policy v6", authority=3, relevance=1.0, tokens=20, expires_at=50),
]
context = compile_context(items, now=100, budget=35)
assert context == ["Current refund policy v7", "Prior case summary"]
print(context)

Worked examples

Toy

A plan that notices invalidation

A three-step travel plan assumes a train is available, but the first availability check returns canceled.

The observation invalidates the booking precondition. The controller marks the old plan superseded and requests a new plan instead of executing the remaining hotel and payment actions.

Assumptions are machine-readable.
Superseded actions cannot execute.
Revision records the observation that caused it.

Application

Research memory with provenance

A research assistant reuses prior source assessments without treating old summaries as current facts.

The memory record stores source identity, retrieval date, supported claims, and expiry. At read time the compiler checks freshness and retrieves the authoritative source when the claim is consequential. Corrections supersede prior records.

Memory points to evidence.
Stale claims trigger refresh.
Deletion removes derived index entries.

System

Manager plus bounded specialists

A security-review manager delegates dependency analysis and configuration review to isolated specialists.

Each specialist receives only relevant files, read-only tools, a step budget, and a finding schema. The manager deduplicates findings, requests evidence for unsupported claims, and owns final severity. No specialist can publish or modify production.

Work orders define evidence and budget.
Permissions differ by specialist.
The manager verifies rather than concatenates.

Exercise

Design a minimal orchestration

Choose a complex agent task and justify every planner, memory class, and specialist with a measurable need.

Write a baseline fixed workflow and identify the exact branch that requires dynamic planning.
Classify every stored item by memory type, source of truth, retention, and invalidation rule.
Define one typed delegation contract, including filtered input, authority, budget, artifact, and verifier.
Specify an ablation evaluation comparing one agent, manager-plus-tools, and multi-agent variants.

Success criteria

The plan records assumptions and can be superseded safely.
No durable memory is written without provenance and lifecycle policy.
Delegation does not implicitly transfer credentials or full history.
The proposed complexity must beat a simpler baseline on held-out tasks.

Reflect: Which architecture component would you remove first if evaluation showed no measurable gain?