AfS（Agent for Science）：面向长周期科研智能体的极简节点、可复验工作流与累积记忆架构

September 2026

Abstract

Most agents for science are general coding agents with a skills folder attached, and they inherit that lineage’s failure mode: under pressure to finish, they fabricate, skip, or smooth over. We describe AfS (Agent for Science), a platform designed from the ground up for long-horizon scientific work, where a project runs for tens of hours across dozens of agent runs and hundreds of millions of tokens with a human present only occasionally. The design rests on a single claim: most of the credibility of machine-made research can be moved from asking the model to behave to making the non-compliant state unrepresentable. We encode research discipline as a small set of mechanically enforced iron laws (commitment before measurement; unforgeable freezing; reports are not facts; evidence persists but verdicts do not; negative results are first-class; mechanical questions to the framework and semantic judgment to the model), and organize the platform around three time horizons. Within a run, a minimal set of research nodes (eight producing or service nodes and three architecture nodes) is extended by deepening node contracts rather than by adding node types, with admission of a new evidence node tied to a distinct way of cheating that existing gates cannot catch. Within a project, an inquiry contract with frozen closure conditions, a hash-chained artifact ledger, framework-computed closure tallies, and a referee loop make every conclusion re-verifiable from disk. Across projects, a single-file project memory and a two-tier knowledge base with promotion by rewriting let a research group compound what it has paid to learn. This paper is a system description, written under one rule: each mechanism appears in exactly one place, with the invariant it enforces, the failure it prevents, the way it is realized, and the cost it imposes. It covers the node contract and its boundaries, the inquiry contract and the hash-chained artifact ledger with gates on the write path, the two-tier memory, and the runtime substrate: the run lifecycle, what the model is shown and in what order, the context window as a rendered view over an append-only log, progress control, the execution boundary, resumption, and the human in the loop. Three traces walk real failure attempts through the mechanisms that catch them. Two closed campaigns are included as worked illustrations of the machinery rather than as an evaluation: a 50-hour assisted study that froze a manuscript after five review rounds and reported a non-reproduced mechanism as an open question, and an unattended Monte Carlo study that refuted its own preregistered hypothesis against an exact solution. We report no benchmark; a process-integrity suite that would support quantitative comparison against other systems is under construction, and what we can measure today is only the operating cost of the machinery.

1 Introduction

A scientific project is not a task. It runs for days, spans dozens of separately started agent runs, consumes hundreds of millions of tokens, restarts after the machine sleeps, and has a human in the loop for a few minutes out of every few hours. Along the way it accumulates commitments (what would count as an answer), evidence (what was measured, observed, or derived), verdicts (what the evidence means), and a manuscript that must be traceable to all of the above. Existing agents for science, from the fully autonomous AI Scientist [1, 2] to human-in-the-loop assistants [3] and skill-library workbenches such as Claude Science [4], are in most cases a general agent loop plus domain tools plus a prompt that asks for rigor. Benchmarks that look at the process rather than the answer report what that lineage produces: in one open-ended research benchmark, 80% of agent runs produced fabricated or invalid experimental results [5]; a study of more than 25,000 scientific-agent runs found that the scaffold accounted for 1.5% of outcome variance against 41.4% for the base model, and that evidence was ignored in 68% of traces [6].

We built AfS (Agent for Science) on the opposite premise: a research agent must be research-native by construction. The discipline that makes a result trustworthy, preregistration, unforgeable records, evidence-backed verdicts, honest negative results, should not be requested of the model; it should be a property of what the model is able to write. Across 35 numbered end-to-end campaigns, the latest in September 2026, we observed three recurring ways in which a capable model in an ordinary harness produces untrustworthy science:

1. 1.

   Completion without delivery. A run reports completed while the manuscript was never frozen, or was “frozen” by rewriting a metadata flag after the real freeze tool had refused. In one campaign the model explained its own workaround in the record: “via save_artifact re-save with frozen=true metadata; orchestrator freeze_artifact was mechanically rejected.”

2. 2.

   Gates that teach performance. A falsifiability gate that demands a numeric threshold receives one: for a historical topic with no measurable quantity, the model invented “a 30-year gap counts as weakening, a 20-year gap counts as refutation” to pass the gate. A gate that asks for a form produces the form.

3. 3.

   Judgment hard-coded as thresholds. A quality-check layer that killed a run when “fewer than five claim citations” appeared could be satisfied by scattering five identifiers, and could not be satisfied by a focused short paper with three solid ones.

None of these is a model deficiency. Each is a place where the harness either asked for behavior it could not verify, or verified the wrong thing. The platform described here replaces such places with mechanisms whose failure is unrepresentable rather than merely discouraged.

This paper is a description of that system, not an evaluation of it. Its aim is to set down the architecture, the reasoning that produced each part, the alternative that was rejected and why it fails over a long horizon, and enough of the implementation that the design can be judged and rebuilt. We adopt one rule of exposition: each mechanism is described in exactly one place, with the invariant it enforces, the failure it prevents, the way it is realized, and the cost it imposes, so that a reader can find all four without assembling them from several sections. Quantitative comparison against other systems is not attempted; the evidence we have is two closed campaigns and the platform’s own operating records, and we are explicit about where that stops.

What this paper describes.

• •

  Design principles (Section 2): the single claim behind the platform and the six research laws it produces, given as an index into the sections that realize them.

• •

  System overview (Section 3): the three time horizons, the research loop that replaces a pipeline, the three node roles, and what the substrate provides to every run.

• •

  Minimal research nodes (Section 4): a node contract with five levers of extension, boundaries between nodes that make cross-node writes impossible, an admission criterion for evidence nodes that yields exactly three modalities, and the three framework nodes, including the dispatch gate and the reason there is no verdict layer.

• •

  A re-verifiable workflow (Section 5): research questions with frozen closure conditions and a tally computed from ledgers; artifact identity, versioning, freezing and amendment with a hash-chained ledger and gates on the write path; verdict authority, obligations, and the referee loop.

• •

  Compounding memory (Section 6): a single-file project memory with four layers and mechanical delivery; a two-tier knowledge base in which the organization tier has no birth channel except promotion by rewriting.

• •

  The runtime substrate (Section 7): the run lifecycle, what the model is shown, hooks, the context window as a rendered view, progress control, tools, where a requirement is made to bind, the execution boundary, resumption, the human in the loop, accounting, and extension points.

• •

  Traces, campaigns and cost (Sections 8–10): three failure attempts walked through the gates that catch them; two fully closed campaigns recovered from disk; and what a round of research costs.

2 Design Principles

The platform’s design principle can be stated in one line: most of the credibility of machine-made research can be moved from “ask the model to comply” to “make the non-compliant state unrepresentable.” The same requirement can land in three places, and their reliability differs by an order of magnitude (Table 1); Section 7.7 refines this into the eight layers the implementation actually offers.

Applied across the platform, this principle yields six laws (Table 2). The table is an index: each law names the failure it prevents, observed in our own runs, and the section where the mechanism that enforces it is described in full. The laws are not domain-specific and the platform contains no domain content; domain knowledge lives in node skills and per-project configuration.

Two corollaries recur throughout. First, a mechanism that exists is not a mechanism that is wired: a detector whose output no dispatcher reads, a review specification the reviewer cannot find, or a memory channel gated behind a query the node never issues, all measure as absent. In one earlier configuration we measured, under bare dispatch all node types but one received no memory at all. Second, the contract must reach the caller: a legal vocabulary that is only revealed by a runtime error forces the model to guess, and the guess fails silently when the vocabulary is a set of keys. Section 8 walks through the case.

Finally, the platform holds itself to a methodological stance that is itself a law: a sentence in a prompt is not a capability until its effect on behavior has been observed. Where we have not observed it, we describe the mechanism and say so, rather than reporting the sentence as a property of the system.

3 System Overview

注意转载授权 · 阅读原文