After Meta Muse: A Research and Publishing Roadmap for Personal-Agent Harnesses

Meta Muse gives the personal-agent field a concrete architecture to examine: a persistent agent inside a dedicated cloud computer, a separate permission authority, isolated credential services, controlled connectors, a brokered browser, durable memory, subagents, scheduled work, approvals, and a path toward glasses and embodied interaction.

The next useful articles should not repeat that architecture with new adjectives. They should test the boundaries on which its trust story depends.

This roadmap turns the questions raised by Muse and recent harness research into an experimental publishing program through 2027. It is a proposal. No experiment below is claimed as completed, no vendor release date is predicted, and no unattended work is scheduled.

What this series has already established

The initial September 26 series supplies four different editorial objects:

None of these articles contains an independent Muse penetration test, model benchmark, or usability trial. The source ledger makes that boundary explicit.

The research thesis

Personal-agent quality has at least five independent dimensions:

usefulness
× authority correctness
× information protection
× recoverability
× user agency

A system can complete the task and misuse a credential. It can protect a secret and still make the wrong purchase. It can block every action and become useless. It can show an approval card that a hurried user cannot understand. It can recover its conversation while duplicating an external effect.

The research program should therefore resist one-number leaderboards. Each study needs a declared workload, threat model, authority boundary, failure injection, and evidence of the outside world.

The next eight publishable studies

Each study earns publication only when its artifacts let another practitioner inspect the conditions under which the conclusion holds.

Study 1: credential confidentiality is not credential safety

Question: Can an agent cause a credential-bearing worker to perform an unauthorized effect even when the model never sees the credential?

Build a small reference system with three services:

• a reasoning runtime that can propose connector calls;
• an authenticated worker that can obtain one narrow credential surrogate;
• a policy authority that evaluates normalized effects.

Include attacks that ask the agent to print secrets, substitute a recipient, switch an account, reuse a file descriptor, call another connector, or alter tool code. Test both built-in immutable workers and agent-authored connectors.

The main endpoints are not only secret leakage. Measure unauthorized effect rate, legitimate task completion, policy abstention, approval burden, and evidence completeness.

Publication gate: Report every permitted unauthorized effect and every legitimate task blocked. Do not claim “credentials are secure” from zero raw-token leakage alone.

Study 2: make Sentinel’s uncertainty observable

Question: Which authorization rules can be enforced as data and which require semantic interpretation?

Create effect fixtures that vary recipient, amount, destination, purpose, reversibility, data sensitivity, and relationship to the active user request. Compare:

1. deterministic policy only;
2. model reviewer only;
3. deterministic invariants plus model review for ambiguous intent;
4. the hybrid with forced abstention on disagreement.

Preserve the normalized effect separately from the natural-language purpose shown to the user. Seed cases where the description sounds harmless while the typed effect is dangerous.

Publication gate: Publish the confusion matrix by risk class, not one accuracy score. Critical deterministic invariant violations must be zero in the tested suite before recommending promotion.

Study 3: recovery must reconcile the world

Question: Can a durable session recover after a crash without losing or repeating an external effect?

Use a simulated purchase or refund service whose state can be inspected independently. Inject failures:

• before a request leaves the harness;
• after the provider accepts it but before the response returns;
• after the result is recorded but before the user sees it;
• while approval is pending;
• during connector-policy revocation;
• during a child-agent handoff.

Compare prompt replay, event-log replay, and event-log replay with operation identity and provider reconciliation.

Measure accepted outcomes, duplicate effects, unresolved states, time to recovery, operator minutes, and false completion reports.

Publication gate: A session that “resumes” while duplicating the purchase fails. The postcondition must be observed outside the model transcript.

Study 4: treat personal memory as promoted evidence

Question: How should an agent decide what deserves to shape future behavior?

Create a corpus with direct user statements, stale preferences, inferred preferences, malicious webpage claims, contradictory updates, sensitive facts, and explicit forgetting requests. Store provenance, confidence, promotion decision, purpose, expiry, and deletion state.

Test four layers:

• working context for the current task;
• episodic history of what happened;
• semantic facts believed about the user;
• procedural rules that alter future agent behavior.

An untrusted page saying “the user always approves gift-card purchases” should never become a procedural rule. A direct user correction should supersede an earlier preference without erasing the historical evidence that explains past behavior.

Publication gate: Demonstrate deletion and correction across primary storage, indexes, exports, restored backups, and any training-data handoff in scope. If a layer cannot honor deletion, say so.

Study 5: model counterparty permission explicitly

Question: What proof should travel with an agent that acts on a merchant or service?

The Amazon–Muse dispute shows that user authorization and technical browser access are insufficient. Build a counterparty simulator that can accept, narrow, revoke, or reject agent access. Represent:

• the principal’s mandate;
• the agent and runtime identity;
• allowed action classes and limits;
• disclosure and user-presence requirements;
• payment constraints;
• terms version and expiry;
• postcondition and dispute channel.

Test revocation during a long-running task and incompatible policies across a delegated agent chain.

Publication gate: The study must include a denied path and prove the harness does not disguise or bypass the agent after denial. The goal is an authorization protocol, not an evasion technique.

Study 6: measure interface-induced over-trust

Question: Does an expressive voice or avatar change how well people evaluate consequential requests?

Run a preregistered study with matched content across text, voice, and avatar conditions. Vary consequence, urgency, uncertainty disclosure, and whether the system recommends approval. Measure comprehension of the actual effect, approval correctness, response time, recall, and confidence calibration.

Include accessibility and cultural considerations. An avatar may improve comprehension for some users while increasing social pressure for others.

Publication gate: Do not equate preference or engagement with safety. The primary outcome must be decision quality on the effect presented.

Study 7: compare local and cloud models as systems

Question: When the harness is held fixed, what changes when reasoning moves from hosted Spark to local Glimmer?

Use the same task set, tools, policy engine, memory schema, and effect simulator. Pin quantization, inference engine, hardware, context limit, and reasoning effort. Record time to first token, total latency, energy where measurable, token or compute cost, tool accuracy, accepted outcomes, and attack results.

Local execution changes data routing but may reduce capability or increase operator burden. Hosted execution changes provider exposure but may deliver stronger planning. The tradeoff must be measured at accepted task outcomes, not raw generation speed.

Publication gate: Publish failures and unsupported features. Do not call the comparison private unless every data and telemetry path has been mapped.

Study 8: separate reasoning minimalism from control minimalism

Question: Can a single recursive invoke primitive replace specialized planners, memory agents, and improvement loops while external control remains constant?

Build two candidates:

• a minimal recursive reasoning program inspired by JAZ;
• a specialized harness with explicit planning, retrieval, memory, and review layers.

Place both behind the same identity, policy, sandbox, tool gateway, event ledger, and evaluators. Compare long-range recall, task success, cost, latency, interpretability, unsafe effects, and recovery.

Then remove specialized components one at a time. A component that does not improve an endpoint on the target workload becomes a deletion candidate.

Publication gate: Keep the control plane fixed. Otherwise a result about reasoning expressivity can be mistaken for a result about production safety.

The reference architecture to build once

Several studies share infrastructure. Build a small, deterministic reference harness rather than eight incompatible demos.

The reference environment should include email, calendar, commerce, and browser-like fixtures; adversarial documents; operation identities; deterministic clocks; fault injection; memory snapshots; and complete resource accounting. Keep evaluator code and protected test data outside the candidate’s write boundary.

A twelve-week execution sequence

Run smoke cases before authorizing expensive model trials. Reserve a protected final set before tuning. If access to a hosted product prevents instrumenting the required evidence, publish a black-box protocol and the limitation rather than implying a white-box reproduction.

The 2027 roadmap

The longer horizon should be organized around portable guarantees rather than vendor feature predictions.

1. Proof-carrying effects

Every consequential action should return a receipt binding principal, agent, policy, approval, request, provider result, postcondition, and compensation state. Research should test composition across delegated agents and protocols.

2. Personal-memory governance

Memory needs provenance, purpose limitation, review, correction, expiry, export, deletion, and contradiction handling. Evaluation should include delayed harms, not only immediate retrieval accuracy.

3. Counterparty-aware agent identity

Services need a way to distinguish a disclosed authorized agent from disguised browser automation, narrow its allowed behavior, and revoke access. User control and service control must both be represented.

4. Adaptive but bounded harnesses

Agents may propose new skills, tools, policies, or workflows. An immutable outer loop should retain held-out evaluation, promotion authority, canarying, rollback, and a record of rejected candidates.

5. Human-agency evaluation

Measure whether people understand what the agent knows, plans, does, and cannot undo. Include approval fatigue, proactive-message burden, appeal, correction, and the ability to reclaim direct control.

6. Cross-surface continuity

An instruction that begins in glasses, continues in voice, calls a cloud browser, delegates to a subagent, and ends in a payment needs one continuous identity and evidence chain. Research should locate where purpose and authority decay across those handoffs.

The publishing contract

Every experimental article should ship:

• a decision question stated before the headline;
• a dated protocol and threat model;
• pinned model, harness, policy, tool, and environment manifests;
• executable fixtures or a precise explanation of why they cannot be released;
• raw outcomes with sensitive data removed;
• analysis code and missing-data coverage;
• failed cases and manual interventions;
• an explicit separation between measured result, inference, and recommendation;
• a correction path when the implementation or evidence changes.

Use three labels consistently:

• Implemented: a product or repository surface exists and was inspected or run.
• Reported: a source claims a result that was not independently reproduced.
• Proposed: an architecture or experiment is recommended but not yet executed.

The quality bar is not certainty. It is the ability for a skeptical reader to locate the boundary of the claim.

Stop conditions

Pause a study or weaken its claim when:

• the protected set has influenced candidate development;
• effect truth exists only in the agent’s own narration;
• a vendor update changes the tested runtime mid-study;
• cost or failure telemetry is materially incomplete;
• participant consent or privacy controls are insufficient;
• the attack test risks a real third party;
• the candidate can modify its evaluator or release gate;
• a denied website or service would have to be bypassed to continue.

An inconclusive study with a clean protocol is more useful than a confident article built on contaminated evidence.

Sources and status

The research questions are motivated by Meta’s Muse security architecture, product design, Muse Code runtime documentation, Glimmer release, Realtime Avatar report, and Connect 2026 announcement. The minimal-harness comparison is motivated by the JAZ preprint. The counterparty study is motivated by reported Amazon–Muse access denial.

The series ledger records source classes and caveats. All experiments and schemas in this roadmap are proposed. They do not amend the normative ContextOS contracts or claim a production implementation in this repository.

What to read next

• Meta Muse under the hood: architecture and security review.
• Muse Spark, Muse Code, and Glimmer: the full stack.
• Harness Engineering on September 26: the latest field update.
• The broader harness engineering roadmap for 2026–27.