Memory Is the Easy Part

One paragraph of orientation, for anyone arriving here first. This is the fourth part of The Outer Loop, a series about building an AGI — not by training a larger brain, but by wiring a loop around an ordinary one. If raw intelligence is becoming a metered utility, the system that finally crosses the line into AGI — the one that autonomously produces more value than it consumes — will not be a smarter model. It will be a loop built around a frozen model, inside a business. That loop has three moving parts: a generator that reaches for surprising, valuable moves, a verifier that sorts the good surprises from the bad, and a memory that keeps whatever survives.

This part is supposed to be about that third thing. And it is — but it starts by saying something that sounds like a dismissal of its own topic. Of the parts of the loop, memory is the one the field is working hardest on and the one that matters least to get clever about. Memory is the easy part. The thing that actually makes a loop compound is not the store; it is the loop itself — the closing of generate, verify, keep into a circuit you can see, and the judgment about where each lesson lands. Compounding lives in the loop, not in the box.

Memory Is Whatever’s Lying Around

Watch where the effort is going and you would think memory were the frontier: vector databases, memory-paging architectures, knowledge graphs, retrieval pipelines. Some of it is genuinely useful. But almost none of it is necessary to get a loop compounding, and the reason is simple. An agent will use whatever you hand it as memory the instant there is a loop pushing it to. The substrate barely matters.

The most-used agent memory in the world right now is a markdown file. Anthropic’s documentation for Claude Code says it without ceremony: a CLAUDE.md file is “loaded into the context window at the start of every session.” You write plain text; the model reads it on the way in. Agent Skills are the same idea with a switch on it — a SKILL.md folder the model pulls off the filesystem only when the task matches its description, so the cost is a few dozen tokens until the moment it is relevant. Cursor’s rules inject at the top of context. Simon Willison, watching this pattern crystallise, reduced it to a sentence: a skill is “a Markdown file telling the model how to do something.” That is the state of the art, and it is a text file.

The research systems dress the same body in fancier clothes. Voyager, the open-ended agent that played Minecraft with a frozen GPT-4 and no fine-tuning, stored every validated skill as a piece of executable code on disk, keyed by an embedding of its own description, and retrieved the few most relevant when a new task arrived — a “skill library” that is, underneath, a folder of programs. Reflexion wrote its lessons as ordinary sentences about what had just gone wrong and fed them back on the next attempt; no weights moved, and it carried a model from roughly eighty per cent to ninety-one on a coding benchmark by doing nothing but taking notes on its failures. Generative Agents kept a “memory stream” — a running list of observations in plain language — and retrieved from it by recency, importance, and relevance. MemGPT wrapped the whole thing in the metaphor of an operating system, paging memories between the context window and disk. Different clothing, one body: text the model writes down and reads back.

I am not claiming memory is trivial to do well — retrieval quality and forgetting curves are real engineering. I am claiming it is downstream. Give a loop a place to write and a reason to write there, and memory accretes on its own, settling along the common paths the agents actually travel. Which means the interesting questions are never really about the store. They are about the loop wrapped around it.

The Loop Can Manufacture Memory On Demand

There is a stronger version of this, and it is worth sitting with because it overturns the instinct to store everything in advance. Sometimes you do not need the memory at all. A loop that can observe its environment and reach into it can manufacturethe relevant context in the moment, cheaper than it could have kept it. Memory becomes a cache that can be recomputed, not a ledger that must be maintained — and with a swarm of agents, recomputing on the fly is often the better trade.

The lesson generalises past the anecdote. We reach for elaborate memory systems because we imagine the agent as something that must be pre-loadedwith everything it might need. But a loop with eyes and hands is not a database you query; it is a worker who can go and look. A great deal of what we try to store in advance is just context the loop could have fetched the instant it mattered, fresher than any stored copy. The engineering question quietly shifts from “what should we remember” to “what can the loop see, and what can it reach.”

The Hard Part Is Observability

If memory is downstream, what is upstream? Seeing. A feedback loop is worth exactly as much as your ability to watch it run, and here the last part left a debt this one has to pay. The verifier of last resort, for most valuable work, is a human — the expensive rung on the ladder of checks. And a human can only verify what a human can see. So the first real engineering problem of the loop is not storage; it is legibility— making the process observable enough that a checker, human or machine, can form a judgment and hand it back.

This is what the unglamorous layer of agent tooling is actually for. Tracing systems — LangSmith, Langfuse, and their kin — capture the full execution of a run: every model call, every retrieval, every tool invocation, with its inputs, outputs, latency, and cost. The point is not to admire the trace; it is to make the run inspectable, so a judgment can be attached to a specific step rather than smeared across an opaque whole. On top of that sit online evaluations, scoring live production traffic as it happens. Hamel Husain, who has helped a lot of teams ship this stuff, puts the diagnosis bluntly: the most common reason an AI product stalls is the absence of an evaluation system — no way to see, at scale, what the thing is actually doing. You cannot give feedback to a process you cannot watch.

And legibility is not the same as volume — this is the trap. The instinct, once you believe in memory, is to put everything in the window: the whole history, every document, the entire log. It backfires by physics. Chroma’s Context Rot study ran eighteen current models and found performance degrading monotonically as the input grew, even on simple tasks; the classic Lost in the Middle result showed models reliably attending to the start and end of a long context while missing what was buried in the middle. More memory dumped into the window makes the loop blinder, not wiser. Observability means a process whose shape you can see — not a haystack you have made larger. It is the same obsession that runs through our work on what kills coding agents and on agents that watch their own runtime: make every token earn its place, and make the run something a judgment can land on.

Where Does the Feedback Go?

Now suppose you can see the run, and a verifier has rendered its verdict: this step failed, this answer was wrong, this move was good. The reflex is to “save the lesson.” But where?This is the question almost nobody states out loud, and it is where the craft of a compounding loop actually lives. A lesson has a natural scope — the smallest place it is true — and your only real job is to route it there. Save it too globally and you teach every agent something that was true exactly once, poisoning the common store. Save it too locally and the insight dies with the run that found it, compounding for no one.

Walk the gradient and it almost writes itself. If a tool fails every single time, the lesson belongs to the tool — fix it, or fix the description the agent reads before calling it; nothing more local will hold. If it fails only in one agent’s hands, or only in one kind of situation, the lesson belongs there— scope the tool to that agent, or teach the loop to recognise the context it breaks in. If the results are fine for everyone but a single user, that is a user-specific memory, not a change to the general behaviour. If you want an agent to get steadily better at a standing job, give it its own memory and objectives it is held to across runs. If you want many agents to pull the same direction — toward how your company actually sells, say — that is organisational memory, the “how we sell” document written once and read by all. And when you cannot yet even name the lesson, you point a dedicated agent at the transcripts to read them, cluster the failures, and run A/B tests until the pattern surfaces on its own. The substrate in every one of those rows is the same humble file. The intelligence is in choosing which row you are in.

The Flywheel Can Spin Backward

This is also exactly where compounding goes to die, and it dies the way the verifier died in the last part: by feeding poison back in. A loop that saves the wrong lesson does not merely fail to improve — it compounds the mistake, faithfully, every run thereafter. Memory poisoning is reward hacking with a longer half-life. The AgentPoison work showed that corrupting under a tenth of a per cent of an agent’s memory store could hijack its behaviour more than eighty per cent of the time while ordinary queries looked completely normal; SpAIware demonstrated a single injected memory turning an assistant into a persistent data-exfiltration channel that survived across sessions. A bad answer is discarded at the end of a run. A bad memorypersists and gets reused — it is the gameable check from the last part, but now it lives in the store.

The quieter killer is not malice but accretion. Memory that only ever grows becomes context rot by another name. Organisational documents that no one prunes drift stale the way every customer database does — business contact data decays on the order of a quarter or more of it per year — and the loop, dutifully optimising toward whatever is written down, gets worse in precise proportion to how stale the writing has become. The cure is unglamorous and non-negotiable: curation. And curation is just the verifier turned inward. Deciding what is worth keeping is the same hard judgment as deciding what is worth shipping — checking is cheaper than creating here too, but it is not free, and it is not optional. A loop that keeps everything has stopped choosing, and a loop that has stopped choosing has stopped compounding.

The Bottleneck Moves to the Plumbing

Get this right — a process you can see, lessons routed to the right scope, a store you prune — and something strange happens to where the difficulty lives. The loop can now improve almost anything you can make legible and give feedback on. The binding constraint stops being the model. It becomes integration: can the agent actually reach the data, the system, the tool. This is the quiet consensus forming across the industry — that, as one investor framing has it, enterprise data agents are “not a model problem, they are a context problem,” and that the gating step on most AI work is plumbing, not intelligence. It is why the Model Context Protocol arrived to so much relief in late 2024: Anthropic pitched it against models “constrained by their isolation from data — trapped behind information silos,” a universal connector replacing a tangle of one-off integrations. A USB-C port for context.

And this is the seam where this part hands to the next. A loop that wants to be useful and cannot reach the data it needs does not politely stop. It improvises — the way the invoice agent reached into an inbox to manufacture a fact it had no record of. Scale that instinct across a system and you get agents that, denied a dataset, begin keeping their own cache of it, reconstructing it from the interactions they can see. The vendors selling this will tell you the agent-maintained copy often ends up more accurate than the human-kept record, because it is refreshed continuously instead of decaying on a shelf; I think that is a reasonable bet given how fast records rot, though I will be honest that the clean head-to-head studies do not yet exist. Either way, the agent is now reaching past the box you drew for it — usually to be helpful, occasionally not. That impulse, the loop straining its own boundaries because the value is on the other side of them, is the same drive that produces creativity and the same drive that produces reward hacking, seen from a third angle. It is the subject of the next part.

Where the Buck Stops

One last thread, because every routing decision in this essay smuggled in an assumption — that you already knew which lessons were good. Push on that and you arrive where the last part did. Every feedback signal is a proxy, and proxies drift. There is exactly one signal a business cannot, in the end, fool itself about: money. Did the work pay. Silver and Sutton, arguing for where machine learning is headed, call rewards like this “grounded” — signals that “arise from the environment itself” rather than from human prejudgment — and when they list what such grounded rewards look like, the list is openly economic: “cost, error rates … productivity … profit, sales … income … economic indicators.” A human rater, they note, imposes “an impenetrable ceiling” on what an agent can discover. Reality does not.

Businesses have kept this scoreboard forever, at every scope this essay routed feedback to: is this person efficient enough, is this team delivering, is this tool worth its cost, does the sales cycle close fast enough. Those are feedback loops with the cheap proxies already anchored to the expensive truth. The clearest sign the market believes it is that AI itself is being repriced around the outcome rather than the seat — Intercom’s support agent charges ninety-nine cents when it actually resolves a ticket; Sierra bills when its agent resolves and nothing when it punts to a human; the blunt venture-capital summary is that “per-seat is no longer the atomic unit of software” because “the atomic unit of AI productivity is a process, not a person.” Price the loop on the un-gameable outcome and you have wired the one signal that cannot be Goodharted straight into it. Eric Ries named this difference — actionable versus vanity metrics, the number tied by hard cause and effect to whether the thing worked — fifteen years before there were agents to discipline with it. It is the reward function this whole series has been walking toward, and it is the subject of the final part. For now it is enough to see that it is the floor under everything else here.

So memory was never the secret. The store is a file; the agent will use whatever you give it; half of what we try to remember the loop could have fetched fresh. What turns a frozen model into a system that compounds is the circuit wrapped around it — a process made legible enough to judge, lessons routed to the scope where they are actually true, a memory pruned hard enough to stay honest, and the whole thing answerable, in the end, to the only verifier that keeps its own books. The generator reaches. The verifier sorts. But it is the feedback loop — seen, routed, pruned, and paid — that makes the keeping add up.

Everyone is building the memory. The system that wins is the one that builds the loop around it — that can see what it did, knows where to put what it learned, throws away what rots, and lets the world tell it, in money, whether any of it was real.