Working Memory, Scratch State, and Task Ledgers

Working memory holds information useful during the current task: hypotheses, calculations, tentative plans, unresolved questions, and intermediate artifacts. It should distinguish epistemic status rather than flattening everything into one text block.

A task ledger is a structured form of working memory that tracks commitments, completed steps, evidence, blockers, and budgets. It supports coordination without turning tentative thoughts into durable truth.

Writing the rationale down before acting is a measured effect, not a stylistic preference. The pattern is ReAct: reason, act, observe, repeat. Yao and colleagues published it in 2022, and the abstract carries the number: “On two interactive decision making benchmarks (ALFWorld and WebShop), ReAct outperforms imitation and reinforcement learning methods by an absolute success rate of 34% and 10% respectively, while being prompted with only one or two in-context examples.” An absolute 34% on ALFWorld and 10% on WebShop, over imitation and reinforcement-learning baselines. From one or two examples.

Amazon documents the same loop for its Bedrock agents. The model writes a rationale, invokes an action, then generates an observation that augments the next prompt. The scratchpad is the rationale. The ledger is what survives the observation.

Between a Free-form scratchpad, a Structured task ledger, and Hidden transient reasoning, the difference is how much epistemic status survives. Judge the three by one question. Several turns in, can you still tell which entries the agent assumed from the ones it actually confirmed? The hard case is compression. When the working state is summarised, the hedges and the open questions are usually the first things to go. Whichever design you pick has to keep that from happening unnoticed.

The scratchpad's weakness — easy status loss, hard to validate — is not a hunch about tidiness. Reorder the multiple-choice options so the answer is always “(A)”. Models then rationalise the biased answer, and never mention the bias in their stated reasoning. Accuracy falls by as much as 36% across 13 BIG-Bench Hard tasks, on GPT-3.5 and Claude 1.0. Turpin and colleagues ran that experiment in 2023. Their abstract puts it plainly: “However, we find that CoT explanations can systematically misrepresent the true reason for a model's prediction.”

That is the case for encoding status in fields instead of trusting the note. A written rationale is not merely lossy. It can misstate the actual cause of the answer it accompanies, and no amount of rereading will reveal the discrepancy. Hidden transient reasoning gives you nothing to reread at all.

Verified fact, Assumption, Open question, and Pending commitment are four epistemic states. Flattening them into one note is where working memory fails. Pending commitment should answer to one owner and Failed approach to another, each tested on its own.

A shipped system already refuses to flatten them, and its field names are the argument. Magentic-One, published by Microsoft Research in 2024, pre-populates its Orchestrator's task ledger with four separately named slots: “Upon receiving the task, the Orchestrator reflects on the request and pre-populates the task ledger with vital information– given or verified facts, facts to look up (e.g., via web search), facts to derive (e.g., programmatically, or via reasoning), and educated guesses.”

Read the four slot names against the four states above. Given or verified facts is the verified fact. Facts to look up is the open question. Facts to derive is the pending commitment: work that is owed and not yet done. Educated guesses is the assumption. It gets a field of its own precisely so that a guess never occupies the same slot as a confirmed observation. The paper gives the reason. The educated-guess slot lets the system hold memorised closed-book information “in a guarded or qualified manner” while lessening sensitivity to hallucinations. Separation is a hallucination control, not a filing convention.

A task ledger schema is worth writing against one real workflow, where the fields have to hold half-finished work. Keep writing until the schema forces you to record how you know each entry, not only what the entry says. A slot that stores a guess and a confirmed result the same way is not finished. Neither is one whose caveats disappear the moment the ledger is condensed.

Work through five moves. Use distinct collections for facts, assumptions, questions, actions, and failures. Record source, timestamp, actor, and confidence for every fact. Represent proposed, approved, executing, verified, and compensated states for commitments. Expire scratch calculations and superseded plans when their decision passes. Require a verifier before tentative state becomes durable memory.

Two of those — attaching provenance and setting cleanup rules — stopped being matters of taste under the Artificial Intelligence Act. Article 12, “Record-keeping”, states: “High-risk AI systems shall technically allow for the automatic recording of events (logs) over the lifetime of the system.” The logs have work to do. They must support identifying risk situations under Article 79(1), post-market monitoring under Article 72, and operational monitoring under Article 26(5). For the Annex III point 1(a) systems the minimum log content goes down to the start and end time of each use, and the identification of the natural persons who verified the results. That is the provenance step written as law: what, when, and who checked it.

Article 19 fixes the other end of the lifecycle. Providers must keep those logs for a period appropriate to the intended purpose, “of at least six months”. So the expiry rule is bounded from below. A cleanup policy that drops the ledger sooner is not aggressive housekeeping. It is a compliance boundary crossed.

Keeping those statuses apart is the whole point, and the cost of not keeping them apart has been measured. In the Magentic-One ablations on the GAIA validation set, the Orchestrator was replaced with AutoGen's plain GroupChat mechanism, a baseline that only decides which agent speaks next. That strips out the ledgers, the planning, the progress tracking, the loop detection and the explicit instructions to other agents. The paper reports: “We find that the Orchestrator’s ledgers are important to Magentic-One’s performance: without the full ledgers, performance drops by 31%.” Removing any single worker agent costs between 21% (Coder, Executor) and 39% (FileSurfer). So the bookkeeping sits inside the band of the workers themselves. Deleting the structured ledgers hurts more than deleting the Coder or the Executor. For scale, the full system scored 32.33% ± 5.3 on the GAIA test set with GPT-4o and 38.00% ± 5.5 with GPT-4o plus o1-preview, against human performance of 92.00% ± 3.1.

The third signal below has its own measurement. Accuracy is highest when the needed information sits at the beginning or the end of the context, and it degrades in the middle — a U-shaped curve. Liu and colleagues measured that in 2023: “For example, GPT-3.5-Turbo’s multi-document QA performance can drop by more than 20%—in the worst case, performance in 20- and 30-document settings is lower than performance without any input documents (i.e., closed-book performance; 56.1%).” Piling the whole transcript back into the prompt is not the safe default. It can score below handing the model nothing at all. That is why blockers have to be readable from a compact ledger.

Read the second signal on its own, because a plan and a result are easy to confuse once both are written down. The last two only break down over time, so put them under repeated or adversarial cases.

Do not call every saved text “memory.” Working state, durable evidence, user profile, and learned policy need different rules and lifecycles.

One reference implementation refuses the single word outright. MemGPT, published in 2023, splits agent memory in two: “MemGPT’s OS-inspired multi-level memory architecture delineates between two primary memory types: main context (analogous to main memory/physical memory/RAM) and external context (analogous to disk memory/disk storage).” The prompt itself is then split again, into three sections with three different write rules. Read-only system instructions. A fixed-size read/write working context, editable only through function calls. A FIFO queue. Three regions, three permissions. The opposite of one bucket called memory.

The tiering earns its complexity. On the nested key-value retrieval task with 140 UUID pairs (~8k tokens) and 30 sampled orderings, GPT-3.5 reached 0% accuracy at one nesting level. GPT-4 and GPT-4 Turbo reached 0% by three. MemGPT with GPT-4 was unaffected by nesting depth.

The review that catches most of this is a diff: set a summary beside the state it replaced and see what dropped out. Summaries often erase uncertainty markers first. When the qualifiers are gone and only the conclusions survive, the ledger has quietly turned guesses into settled facts.