docs(research): five assessments — NVIDIA/OpenShell/OpenWorker, Agent Substrate, AutoBenchmark, DeepSeek Harness (corrected), Context Language Models

[praxagent]

This PR now carries all five open research assessments. #246, #251, #252 and #253 were a stacked chain, and stacked PRs re-conflict after every squash merge. They are folded in here and closed with a pointer. Merge this one.

• docs(research): assess NVIDIA's agent safety platform, OpenShell and OpenWorker #246: NVIDIA Open Agent Safety Platform, OpenShell, and OpenWorker.
• docs(research): Agent Substrate — adopt no-cleartext injection and tunnel-held identity #251: Agent Substrate (Google, CNCF sandbox).
• docs(research): AutoBenchmark — cross-provider difficulty, and hard-for-all means audit the key #252: AutoBenchmark (Meta RAM).
• docs(research): DeepSeek Harness — adopt an enforcement self-check #253: DeepSeek Harness. Corrected: the first version of docs(research): DeepSeek Harness — adopt an enforcement self-check #253 replaced the September README-only note (fix(workspace): atomic writes, plus nine research assessments #226) instead of building on it. It is now one page that keeps that note's valid points and states plainly what it got wrong ("no governance layer": the code has approvals, deny-only guards and a process sandbox; it lacks network policy and audit), with one index entry.
• docs(research): five assessments — NVIDIA/OpenShell/OpenWorker, Agent Substrate, AutoBenchmark, DeepSeek Harness (corrected), Context Language Models #256: Context Language Models (UW / Meta).
• Also fixed: a pre-existing break in docs/research/README.md. Entries had been inserted between the Meta Muse entry and its sub-bullets, so its Sentinel/verdict bullets rendered under the wrong entry. Pure move: no line changed.

---

Original #256 description

Assessment of Context Language Models (UW / Meta; code).

Stacked on #253, the end of the research-doc chain.

Verdict: document + adopt the mechanism, rebuilt under Prax's invariants.

• The method. The model compacts its own context by editing a file mirror of the conversation. Around that: budget nudges, rollback-then-ask on overflow, and free edit-only turns.
• The results. Zero-shot it beats MEM1, Self-Compact, ACM, RLM and Codex-style summarisation, e.g. BrowseComp-Plus +11.4% at 21.5% fewer FLOPs.
• Why it moves up the queue. It's the third sighting after ACM and OptMem, so the queued context_compact/context_recall row moves up.
• Unsafe as published. Only the system prompt and task are protected, roles are rewritable, and tool results fold into user. Injected text could be laundered into the user's voice. The authors flag this risk but don't evaluate it.
• Prax's version:
  • pins every user turn and approval;
  • keeps roles and provenance tags immutable;
  • never edits the record (a summary plus a pointer, and context_recall).
• Bank: evolved compaction instructions as a chore(main): release 0.15.0 #29 target (+35.9 held-out), and per-call context snapshots.
• Not adopted: RL and Suffix Cache Reuse (GPU wall), and unrestricted bash-file editing.
• Caveats: the code is CC BY-NC, so nothing is vendored. EdgeBench is reported as best of three seeds. I read the code and paper, and ran nothing.