This report describes the architecture, research context, and operating principles behind Halo-2.0. Private prompt templates, routing weights, security controls, and implementation-specific thresholds are intentionally omitted.
Executive finding
A context window is not a memory system. It is a temporary computational surface whose usefulness declines as irrelevant tool output, repeated reads, stale plans, and superseded file states accumulate. Halo-2.0 treats memory compaction as an active control problem: preserve the information that can still change a decision, preserve the evidence that can still prove a claim, and remove the text that now functions only as friction. The aim is not merely to fit under a token limit. It is to maintain a high signal-to-noise ratio across a long autonomous session.
This report describes three complementary layers. First, large tool outputs are distilled immediately into precise ranges, semantic observations, and full-log references. Second, duplicate or equivalent reads are detected so superseded payloads can be truncated without erasing changed versions. Third, when the session approaches a model-specific effective limit, an automatic compaction pass creates a durable continuation state containing the mission, task ledger, decisive evidence, open risks, file state, and current operating intent. The compactor is selected for retrieval fidelity and schema reliability, not for rhetorical quality.
The architecture overlaps with public approaches in Claude Code and Codex while extending them with model-specific thresholds, version-aware read handling, and receipt-preserving state. Claude Code automatically compacts near its context limit and provides hooks to restore critical context; Codex uses a compaction item that carries prior state into subsequent windows.42 Halo’s difference is that compaction is connected to the execution substrate: file digests, read coverage, receipts, and task settlement remain addressable after the prose history has been compressed.
The context may shrink, but the agent’s ability to explain what it knows, what changed, and what remains unverified must not.
Why more context can produce less intelligence
Long context is useful only when the model can retrieve and reason over the relevant parts. Research on the “lost in the middle” effect found that performance often drops when needed information sits away from the beginning or end of a long prompt, even in models advertised for long context.7 More recent models improve substantially, but the variance remains large: Anthropic reported 76% for Claude Opus 4.6 and 18.5% for Sonnet 4.5 on the eight-needle, one-million-token MRCR v2 setting.8 A nominal token capacity therefore does not equal a reliable working capacity.
Agent transcripts are especially hostile long contexts. They contain raw command output, repeated paths, failed attempts, generated code, search snippets, error stacks, and messages that were useful only for one decision. The middle of the context becomes a graveyard of formerly relevant details. Models can respond by re-reading files they already saw, forgetting a constraint stated many turns ago, or anchoring on a stale output because it is more salient than the updated state. The problem is not simple amnesia; it is competition among too many partially relevant representations.
Compaction should consequently begin before the hard context limit. Halo maintains an effective working threshold for each model and provider, based on long-context tests, tool-heavy replays, and observed drift. A model with a million-token window may still receive compaction much earlier if its decision quality falls after a smaller practical boundary. Another model with strong retrieval may be allowed a larger live history. This is why a single global percentage is inadequate for provider-independent agents.
Nominal context is not usable context
Anthropic’s reported eight-needle, one-million-token MRCR v2 scores show how sharply long-context retrieval can vary between model generations.
Memory as layered state
Halo separates memory into layers because different information has different lifetimes. The user’s original objective and mission contract are durable. The task ledger changes slowly and must survive every compaction. File contents are mutable and should usually be represented by current digests, relevant excerpts, and snapshot references rather than repeated full text. Tool outputs may be immediately useful but can later collapse into a receipt and a semantic conclusion. Model reasoning is the least durable: it can be valuable, but it should not outrank external evidence.
The live prompt is therefore a view assembled from several stores rather than a transcript copied wholesale. It includes the mission frame, current task focus, selected recent turns, unresolved decisions, relevant memory summaries, workspace truth, and the minimum receipts needed for the next action. Other information remains retrievable by identifier. This architecture allows the agent to forget a forty-thousand-character build log while still remembering that the build failed, which command produced the failure, where the full log is stored, and which lines identify the root cause.
This is also a safety property. When memory is a single mutable summary, a mistaken compactor can silently rewrite history. Layered state limits the damage. The summary may be imperfect, but the task ledger, snapshots, file hashes, and receipts can contradict it. Halo treats those external structures as higher-authority memory. Compaction is allowed to reduce narrative detail; it is not allowed to invent completion or erase an unresolved verification gap.
Immediate distillation of large outputs
When a tool returns a large file or command output, the next agent turn has an additional responsibility before ordinary execution: determine which exact regions matter. The agent can select multiple non-contiguous ranges—lines 1–9, 18–20, 22–55, and 57–69, for example—rather than keeping one blunt excerpt. It must also state what each range establishes and whether any missing region could change the conclusion. The full payload remains stored outside the prompt and can be recalled if the interpretation is challenged.
This is not generic summarization. A summary such as “the file defines authentication” may be concise but operationally useless. A governed distillation records the path, version digest, selected intervals, relevant symbols, decisive values, and open uncertainty. For terminal output it may preserve the command, exit code, first/middle/last preview, artifact paths, and a reference to the complete log. The result is small enough for subsequent turns but precise enough to support a patch, a test decision, or a closeout claim.
The distillation step is deliberately adjacent to the original read. Waiting until the context is full makes compression harder because the compactor must reconstruct which output mattered to which decision. Immediate reflection captures relevance while the task state is still local. Halo’s earlier architecture specification describes a reflection gate that can pause queued tool calls until pending raw output has been interpreted, preventing the model from acting on a large payload without first extracting its meaning.
Compaction is a pipeline, not one summary
Raw evidence remains retrievable while the live context carries only what the next decision needs.
Sparse chunk selection and coverage
Line ranges alone are not enough. A model may choose a convenient excerpt that supports its current hypothesis while omitting a later branch that contradicts it. Halo therefore tracks read coverage. The system knows which byte or line intervals were actually seen, which intervals overlap, and which reads were superseded. When a model proposes a mutation based on incomplete coverage, the runtime can warn that the necessary region was never inspected. The aim is not to force exhaustive reading; it is to distinguish deliberate sampling from accidental ignorance.
Sparse selection is most effective when it is anchored semantically. A range can be associated with a function, configuration key, error frame, or test case so later file edits do not make the memory meaningless. If the file changes, the old excerpt remains tied to the old digest. A new read can then be compared rather than silently replacing history. This reduces a common agent failure in which the model remembers a line number from a previous version and applies a patch to the wrong location.
Coverage metadata also improves compaction. The compactor does not have to preserve every read, only the set of ranges that support current decisions or remain relevant to pending tasks. It can collapse three overlapping reads into one canonical coverage record, retain the strongest semantic observation, and keep a pointer to the source output. In effect, the system compacts not just text but the graph of evidence.
Duplicate reads are a memory bug, not harmless repetition
Language models often repeat reads because the first output has become cloudy inside a long context. The command may be identical, or it may be rewritten with different flags, a different shell idiom, or an equivalent range. If every repetition remains in the prompt, the session accumulates several copies of the same file and the model can no longer tell which copy is current. Smaller models and models optimized aggressively for cost or multilingual breadth showed greater sensitivity to this noise in Oscerra’s internal tests, but the behavior is not exclusive to any geography or parameter count. It is a context-management problem that can affect frontier systems as well.
Halo normalizes read intent rather than comparing raw command strings. It considers the target path, requested interval, operation family, and file-state digest. When a later command is semantically equivalent and the file has not changed, the earlier payload can be replaced in active context by a compact marker such as [truncated: superseded by output R42]. The new output remains visible, accompanied by a concise note that the file was already read and that the previous copy has been collapsed. This both reduces noise and gently discourages repetitive loops.
The system does not punish the model for rereading. A repeated read may be rational if the earlier output was insufficient or the task focus changed. The runtime preserves the latest result and keeps the historical receipt. What it removes is duplicate bulk. The distinction matters: memory control should help the model, not create an adversarial environment in which it fights the harness to recover information.
Duplicate suppression must be version-aware
Equivalent unchanged reads collapse; changed-file reads remain available for comparison.
Version-aware truncation
Duplicate suppression becomes dangerous if the file changed. A one-character edit can alter a configuration flag, a comparison operator, or a checksum. Halo therefore includes the file-state digest in read identity. If the path is the same but the digest differs, the new output is not treated as a duplicate. The previous read remains available because the model may need to compare before and after states, verify that a patch landed, or diagnose an unintended mutation.
This rule prevents a subtle class of hallucination. Without version awareness, the system might tell the model that it has already read a file when the model is correctly attempting to inspect the updated version. The model would then either proceed on stale memory or repeatedly issue stronger commands to defeat the truncation layer. By recognizing state change, Halo aligns the memory system with the agent’s natural expectations: unchanged evidence can collapse; changed evidence deserves a new record.
Version awareness also applies to generated artifacts and tool outputs. A build log produced before dependency installation is not equivalent to a build log produced afterward. A browser screenshot from a previous deployment is not the current interface. A search result may become stale. Compaction records therefore carry temporal and causal metadata, not just text hashes, so the system can preserve the sequence needed to explain why a decision changed.
Automatic compaction at a model-specific threshold
Eventually even a disciplined live context becomes large. Halo triggers automatic compaction when the rendered prompt approaches the effective threshold for the current model. The threshold is lower than the provider’s hard maximum and can vary by task type. A session dominated by code and exact tool outputs may tolerate a different profile than a research session with many semantically similar sources. The goal is to compact while the model still has enough working capacity to produce a reliable state transfer.
The compaction pass is assigned to a model that is inexpensive enough to run routinely but strong enough on long-context retrieval, schema adherence, and “needle” evaluations. MRCR-style tests are useful because they require distinguishing among similar items at different positions rather than retrieving one obvious phrase. Halo supplements public benchmarks with internal replay: can the compactor preserve the user’s original constraint, the current branch, the exact failing test, a deferred task, and the reason one path was rejected? A cheap model that misses one of those may be more expensive than a stronger compactor once rework is counted.
The output is a structured continuation state, not a pleasant narrative. It includes mission identity, active and settled tasks, key decisions with evidence references, current workspace facts, relevant file versions, unresolved risks, recent failed approaches, required next actions, and retrieval pointers to full logs or documents. The schema is intentionally bounded so compaction cannot expand into another large transcript.
Comparison with Codex compaction
OpenAI’s Responses API supports server-side compaction when a configured token threshold is crossed. The returned compaction item carries forward key state and reasoning in fewer tokens and can replace earlier input items for subsequent turns.1 OpenAI’s description of the Codex agent loop explains that Codex automatically invokes a compact endpoint after an auto-compact limit and receives an opaque encrypted item preserving latent understanding.2 GPT-5.1-Codex-Max was also described as the first OpenAI model trained to operate across multiple context windows through compaction.3
Halo shares the objective of continuing long-horizon work across context windows, but its state is more inspectable. An opaque latent item can preserve model understanding efficiently, while a product runtime still needs human-readable task state, file references, receipts, and replay. Halo can use provider-native compaction where available, yet it does not make that item the sole memory authority. The runtime retains a parallel explicit continuation record that can be validated, edited, or rehydrated by another provider.
This provider independence is important during model routing. A compaction format tied to one model family may not transfer cleanly to another. Halo’s explicit state packet acts as a lowest common operational language. Provider-native latent state may supplement it for continuity with the same model, but the mission remains recoverable from ordinary structured data if the session switches providers, the API fails, or an evaluator needs to inspect what was preserved.
Comparison with Claude Code compaction
Claude Code enables auto-compaction by default as context approaches the limit, exposes manual /compact, and provides pre- and post-compaction hooks.45 Its documentation also explains that project-level CLAUDE.md instructions are re-read after compaction, while conversation-only instructions may disappear unless they are persisted.6 This is a valuable design lesson: critical state should live in a durable substrate that can be re-injected, not only in the conversation.
Halo generalizes that lesson. The original mission, task ledger, workspace manifest, and memory checkpoints are outside the model transcript. After compaction, the system reconstructs the live prompt from these sources. If a compactor omits a project constraint, the next prompt can still retrieve it from the mission frame or persistent file. If a model forgets which tasks were completed, the ledger remains authoritative. The model’s summary is one input to continuity, not the continuity mechanism itself.
The comparison also highlights a trade-off. Human-readable summaries are auditable but lossy; opaque model-native items may preserve subtle latent relationships but are harder to inspect and less portable. Halo uses a hybrid strategy where available: explicit structured memory for governance and provider transfer, plus recent raw context or native compaction state for local coherence. The runtime decides what must be provable and what may remain implicit.
What the compactor must preserve
A good compactor preserves constraints before commentary. The user’s requested output, forbidden changes, target paths, acceptance criteria, and unresolved questions must survive even if the conversation’s explanatory prose does not. It preserves decisions together with reasons: “use the existing authentication layer because the repository already exposes X” is more useful than “authentication decided.” It preserves failures that constrain future action, such as a build command that failed for an environmental reason rather than a code defect.
It also preserves negative knowledge carefully. “File not found” is not enough; the state should record what path was searched, what scope was covered, and whether absence was confirmed or merely inferred. The same applies to tests: a passing subset is not equivalent to the full suite, and a skipped test is not evidence of correctness. Receipt identifiers and coverage records allow the compacted state to express these distinctions without carrying the complete logs.
Finally, it preserves ownership and temporal order. Which model currently owns the thread? Which specialist has a pending delegation? Which snapshot is current? Which file changed after the last read? Which task is concluded but not yet verified? These facts determine the next valid action. A summary that captures the subject matter but loses operational position can sound accurate while sending the agent backward.
Rehydration: forgetting must be reversible
Compaction is safe only when the system can retrieve what it removed. Halo stores full tool outputs, file snapshots, and document sources outside the active prompt. The compacted state contains stable identifiers and short descriptions so a later model can request the original evidence. Rehydration can be narrow: one log segment, one file version, one browser screenshot, or one decision branch. The model does not need to reload the entire previous window to answer a local uncertainty.
The runtime can also rehydrate proactively. If the next task references a file whose relevant excerpt was compacted, the prompt assembler may include the current digest and selected lines automatically. If a new model takes ownership, the system can provide a slightly richer state transfer than it would for the same model continuing. If a finish validator encounters a claim without visible evidence, it can request the referenced receipt before accepting closeout.
This makes memory a demand-driven graph rather than a shrinking paragraph. Nodes include mission facts, tasks, files, receipts, decisions, and artifacts; edges express support, supersession, dependency, and temporal order. The live context is a view over that graph chosen for the current decision. Compaction reduces the view, not the underlying record.
Failure modes
Compaction can fail by omission, distortion, over-compression, or stale preservation. Omission drops a critical constraint. Distortion changes the meaning of a decision. Over-compression removes the evidence needed to act. Stale preservation keeps an old file state or rejected plan as if it were current. Another failure is recursive noise: the compacted summary itself is repeatedly summarized until concrete facts become generic phrases. These risks grow when a model is asked to summarize a transcript without access to the runtime structures that distinguish current truth from historical discussion.
Halo contains these failures by validating the compacted packet. Required fields must be present. Task IDs and file references must resolve. Receipt citations must exist. The current workspace digest must match the referenced state. Open verification gaps cannot silently disappear. A compaction pass that fails validation can be retried with a stronger model or a narrower input. The previous active context remains available until the new state is accepted atomically.
The system also monitors post-compaction behavior. A sudden increase in rereads, plan reconstruction, repeated failures, or contradictory claims suggests that the state transfer was weak. Those signals can lower the compactor’s capability score and trigger targeted rehydration. Compaction quality is not judged solely by token reduction; it is judged by how little useful work must be repeated afterward.
Evaluation protocol
Memory systems should be tested with long missions, not isolated summarization prompts. Oscerra’s evaluation design records a known set of constraints, files, decisions, failures, and deferred tasks across a tool-heavy session. After compaction, a different model may be asked to continue, explain the current state, identify the next valid action, or prove why a previous approach was rejected. Scoring includes factual retention, evidence traceability, task continuity, unnecessary rereads, repeated mutations, and total tokens consumed after the boundary.
Needle-style benchmarks are useful but insufficient. They measure retrieval of planted information, while agent memory must distinguish current from stale, evidence from speculation, and completed from merely attempted work. Halo therefore includes adversarial cases: the same file read before and after a change, two similar error messages from different commands, a task marked concluded but not verified, and a user constraint mentioned only near the beginning. A compactor succeeds only if the continuation behaves correctly, not if it can recite the hidden phrase.
Cost evaluation includes downstream recovery. A smaller compactor may reduce the immediate bill but cause the next agent to reread a repository or repeat a failed build. A stronger compactor may be cheaper at the mission level. The routing registry therefore treats compaction as its own capability domain with separate metrics for retention, schema validity, and post-boundary rework.
Privacy, portability, and provider independence
Memory is also a data-governance surface. A long transcript may contain secrets, proprietary code, personal data, or outputs that should not be sent to every model in a routed session. Sparse retrieval and delegated context reduce that exposure. A specialist receives only the mission slice required for its task. A compactor can be restricted to an approved provider or local model. Sensitive raw outputs remain in the workspace while the cross-provider state packet contains redacted facts and identifiers.
Portability is equally important. If the session depends on one provider’s opaque memory representation, switching providers may erase the effective history. Halo’s explicit continuation state is designed to survive that switch. It uses ordinary structured records and stable workspace references. The system can still take advantage of provider-native compaction for same-model continuity, but the user’s mission does not become hostage to a hidden state format.
This is the larger meaning of “memory compaction without losing proof.” The system is not trying to remember every token. It is trying to preserve the minimum portable state from which a competent agent can continue safely, retrieve original evidence, and explain the chain of decisions. That state belongs to the mission, not to any one model.
Conclusion
Halo-2.0’s memory architecture begins with a refusal to equate context length with memory quality. Large windows are valuable, but tool-heavy autonomous work produces redundancy, stale state, and positional retrieval problems faster than ordinary chat. The correct response is not indiscriminate summarization. It is a layered discipline of immediate output reflection, sparse range selection, read-coverage tracking, version-aware duplicate suppression, model-specific auto-compaction, and reversible rehydration.
Public systems validate parts of this direction. Codex compacts across context windows and can carry opaque state forward; Claude Code auto-compacts and re-injects durable project memory. Halo connects those ideas to a provider-independent execution runtime. The mission frame, task ledger, snapshots, receipts, and workspace facts remain outside the prose summary, so a model transition or compaction error cannot silently rewrite reality.
The result is a memory system optimized for continued work. It keeps the details that can still alter a decision, the evidence that can still prove a claim, and the references needed to recover anything else. Everything that has become repetition is allowed to disappear. This is not forgetting as loss. It is forgetting as an engineered operation that protects attention.