Preserve the source.
Control the action.

Dense retrieval and reranking over unchanged conversation history remain a serious baseline.

Raw-RAG leads the compared memory systems in six of seven benchmark/model settings, by 0.13–5.53 percentage points, excluding full-context reference runs. The study covers LoCoMo, LongMemEval, MEME and MemoryAgentBench. In one million-token ingestion comparison it takes 0.33 hours versus 3.25–26.95 hours for completed comparison systems.

Evidence & limits. These are author-reported offline results, not interactive-agent performance. Ingestion excludes answer generation and evaluation; some baselines reuse published scores. Retrieval, packing and reader differences confound a simple “rewriting loses information” explanation. On a PersonaMem-v2 extension, Raw-RAG ranks third. Raw logs also require privacy and deletion controls.

An eloquent request cannot spend an approval that the execution state does not hold.

The proposed Petri-net supervisor enables only tool transitions supported by the required state. Its safety-transfer theorem depends on four assumptions. A release-agent example retains a controllable publication step after deployment begins, allowing a newly arriving freeze to prevent publication. More restrictive safe control can also avoid costly rejected proposals.

Evidence & limits. This is theoretical and illustrative, not a live-LLM jailbreak benchmark. The injection example uses a scripted proposer. Guarantees depend on faithful modeling, complete mediation and authenticated external events; they do not stop secret leakage inside the arguments of an otherwise allowed call. “Certified” is not universal injection immunity.

Retrieving a plausible API and choosing the complete correct tool set are different problems.

The study trains Qwen3 models with a Plan–Retrieve–Select workflow using teacher-generated supervision and reinforcement learning. On 2,124 ToolBench evaluation instructions, the 8B model’s exact-set accuracy rises from 36.2% after supervised training to 41.5% after RL, versus 30.6% for the best prompted Maverick baseline.

Evidence & limits. Training uses 21,361 instructions and 1,419 APIs; supervision differs across comparisons. Tool-set accuracy is not executed task success. Transfer is uneven: Maverick wins TaskBench, 80.6% versus 72.8%. Appendix C says the trained checkpoints, curated data and implementation are not released. There is no ready-to-deploy open-source selector here, or demonstrated end-to-end cost saving.

A shared session API does not make every runtime behavior interchangeable.

The docs date the new-session cutover to October 23. Both runtimes support tool permissions, approvals and subagents; clients discover optional features through reported capabilities. Governance remains in the project manifest, separate from runtime-specific configuration.

Evidence & limits. This is vendor documentation, not an independently tested migration. The date attaches to the cutover, not every documented control. Tool rules without a matching rule allow execution, while several resource grants default to none. A file-path restriction does not restrict shell access to that file. Legacy v1 projects without declared agents run ungoverned.

Sovereignty is an operating capability, not a synonym for where data sits.

AMD describes open-weight foundations, QuTwo compression and fine-tuning, AMD Instinct MI350P hardware and ROCm software, and LeadDesk deployment for customer conversations, starting with Nordic languages. The companies describe a locally operated, vendor-agnostic stack that organizations can inspect and control.

Evidence & limits. “Near-frontier” capability and efficiency are vendor claims: the announcement provides no benchmark table, cost comparison or independently tested portability result. A vertically integrated partnership does not by itself establish freedom from suppliers, foreign jurisdiction or proprietary dependencies.