What we measure
The product exists because of one observation: an agent acts on whatever context it is given, and context goes stale. A memo is written on Monday, a decision flips on Tuesday, and on Wednesday the agent confidently ships the Monday answer.
Three things matter to us:
- Stale context. An agent acting on instructions that no longer apply. This is the failure we exist to prevent, and it is measurable.
- The cost of a missed instruction. The work does not vanish when the agent acts on yesterday's value: the action is wrong, the undo is extra, and the redo is extra again. That decomposition is our working model. We have not yet measured the multiplier, so this note does not quote one.
- Receipts. A delivery logs a proof hash of the memo text the agent was handed, and that text arrives stamped
[AIRMEMO · authorized · memo_4821]. The receipt is the evidence trail that turns a "trust me" failure into a reviewable one.
The first note: stale context is measurable
Dated 2026-09-16. Source: our own benchmark matrix, committed with the code. This is the note behind the Security and trust: a stale-context study by Meetless gave ten models from three vendors a summary holding six facts about a fabricated product; all six had been superseded, and every model shipped the stale version and read zero files, 0 of 6, with zero variance. The study is preliminary. We wanted our own numbers, on the models our users actually run.
The protocol. 11 models, 6 in-force facts each, two arms per model. The stale arm sees the full note history with no bulletin. The pushed arm sees the same history plus the AirMemo bulletin naming each winning value. The only difference between the arms is the product mechanism under test. The full protocol and the committed results live in the repo: benchmark/README.md and the committed runs in benchmark/results/. Each fact carries a dated note trail so "stale" means "superseded", not "forgotten".
What we measured.
| model | stale | pushed | delta |
|---|---|---|---|
| deepseek-v4-flash | 1/6 | 4/6 | +3 |
| deepseek-v4-pro | 1/6 | 4/6 | +3 |
| ornith (local 9B) | 1/6 | 4/6 | +3 |
| glm-5.3 | 2/6 | 4/6 | +2 |
| mistral-large-3 | 2/6 | 4/6 | +2 |
| glm-5.3-flash | 1/6 | 2/6 | +1 |
| gpt-oss:20b | 3/6 | 4/6 | +1 |
| gemma4:31b | 4/6 | 4/6 | 0 |
| gpt-oss:120b | 3/6 | 3/6 | 0 |
| kimi-k3 | 1/6 | 1/6 | 0 |
| qwen3.5:397b | 4/6 | 4/6 | 0 |
The finding. 23 of 66 correct on the stale arm, 38 of 66 with the bulletin pushed: +15 across the matrix. Seven of 11 models ship stale facts, 4 tie, and none regress: no model scores worse with the in-force memo in context. The gap reproduces across vendors (DeepSeek, GLM, Mistral, GPT-OSS) and across model sizes (9B local to 675B hosted), so it is a context-mechanism failure, not a model-quality failure. The strongest movers go from 1/6 to 4/6.
Two caveats, both written in the results doc. The pushed arm's 4/6 ceiling is scorer strictness, not model ability: appended explanations are scored as incorrect, so the +deltas are a lower bound. And the matrix is score-only: latency was not recorded by the runner, and the column is omitted rather than invented.
The next note: where this stops holding
Dated 2026-10-06. Source: the mechanism itself, read in the code at this revision. This one is not a measurement, and it says so. The question every governance claim eventually gets: agents are turning multimodal and embodied. Does governed delivery survive past turn-based text agents? The honest answer, with the measured half and the unmeasured half kept apart.
The unit is not a turn. A memo carries an expiry and an author signature, and delivery is bounded to one per install. The rule that decides whether a memo reaches a machine (scope matches, not expired, not already delivered, platform matches) reads no transcript, no message role, and no modality. Four checkable facts, none of which mentions a turn. That part travels.
The seam is a request. The gateway rewrites one field of an outgoing call: it prepends the org's in-force memos to the request the client was already sending, before that request reaches the model vendor. No lifecycle event is involved, and the client does not need to know the rail exists. Where an agent exposes those events instead, the hook uses them: SessionStart, UserPromptSubmit, BeforeAgent, Stop (hook/platforms/adapter.go). Either way the memo lands as text in front of the model, which is the only place a memo can land. The next-turn contract is named honestly on the security page for exactly this reason. A runtime that resolves context somewhere else would satisfy the same four conditions through a different door. Today there is no door.
The discipline is already shape-independent, and this is the part we would keep. When a platform event is not documented as carrying context, the hook returns an empty document and the cycle is recorded dropped with a reason, rather than claiming an injection that never landed (hook/platforms/adapter.go). A receipt names the runtime's real session, or names nothing. On a runtime we do not understand, a recorded drop is the correct output.
What we cannot tell you, and will not pretend to. There is no measurement of a vision loop, a tool loop, or an embodied planner anywhere in this repo. The matrix is text: 11 models, 6 in-force facts, two arms, with the matrix and its runs checked into the repo. There is no adapter for a non-text runtime. Pull through MCP exists; interruption does not. A receipt proves the runtime saw the memo, never that its action changed. Marked as speculation: a continuous runtime moves delivery from the next turn to the next decision gate, and makes mid-execution correction possible. That changes the cost of stale context, not its definition. The bound stays the same, though: an expired decision never delivers, and the sweep that enforces it runs on a cadence the deployment sets, not the runtime.
The cadence
Notes publish when the work is real. When the next measurement lands, it lands here, dated and committed. Until then, the shelf stays as it is.