Putting Deterministic Guardrails Around LLMs: Agent Harness Engineering from Claude Code

This English version was machine-translated from the Chinese original. Technical terms may require verification.

If we're going to study today, LLM I'd rather start with Claude Code now, with the certainty shackles. The reason is not that it solved the problem, but that it exposed the key structure in Harness directly to the developers:MCP、CLAUDE.md and rules、hooks、subagents、checkpointing、permission modes、plugins、Agent SDKI'm sorry. In a system that is really available, you can almost see directly how language constraints are being gradually consolidated into systems.

Turning Agent into a deliverable system is often not the core loop itself, but the center around. LLM Uncertainty comes out of a whole set of peripheral works. The core cycle is of course important, but it is only the shortest part.

The longest and most expensive part is to put this cycle in a controlled system. The focus is not on making it think better, but on keeping the system out of control after misthinking, making mistakes, mistook tools, drifting context and running dozens of rounds.

Almost everyone who used Claude Code seriously went through the same phase: starting to go crazy. CLAUDE.md It's written in.

The causes are usually ordinary. Claude changed the unchangeable document, so you added "Don't move this directory." It was announced that it had been completed without running tests, so you added the "must run first" test. It's using the wrong package manager, at strange times. commitOr change the unconnected document together. CLAUDE.md The longer it goes, the more it goes from several lines to dozens, the more it goes to hundreds.

And then you find out: it's still gonna do it.

Not exactly the same mistake, but the variant. You wrote, "Don't be direct. push♪ It's not ♪ push Yes, but it's starting to happen at a strange time. commitI'm sorry. You wrote "You have to run the test first," and it ran, but it ran off without the relevant test files. You're naturally thinking about a model that's not strong enough to be stronger.

But soon you'll realize that the problem is not just a model. The problem is you're still asking for a probabilistic language model to do it your way.

Language requests are certainly useful, but they are natural and probabilistic. The longer the mission, the more tools, the more dirty the context and the more complex it becomes, the more it will decline. You go. CLAUDE.md Each rule is in the context of the length and attention drift and the alternative race.

This is the question I'm trying to summarize with the "confirmity shackles":LLM Agent For the first time, the system has the capacity to deal with the uncertainties of an open world, but the engineering system is the first to do exactly what it does. LLM The uncertainty itself is shackled.

And that is why Agent can deliver, not simply by continuing to fill the "next time" sentence in the document, but by consolidating the layers of those sentences into a system structure: which tools exist and which ones do not exist; which ones are permanently present and which ones are injected as needed; which actions are intercepted at the life cycle nodes; which tasks must be performed in the isolated context; and which "declarations of completion" are directly rejected by the certification system.

That's exactly what I understand now. harness Problem. I'll discuss the word itself in the next one, but this one is more concerned about how these peripherals grow in the product.

It's worth noting that the article was originally published on the date of release. 2026-03-20 And then, Anthony was there. 2026-03-24 and 2026-03-25 The long-time application of the Harness design and the long-time development were published separately. auto mode The safe house. Two layers were completed that had not been previously developed:Recovery and validation of operational time structures and autonomous governance.

Why is language constraints declining?

This is not an invalid reminder, but a clear line of meaning.

Claude Code's official file keeps on CLAUDE.md Discuss it on the line “memoory/context”, rather than as a mandatory configuration document.Store instructions and memories It's very straightforward:CLAUDE.md And auto memoory is the context, not the context. The constraints of de facto, permanent and cross-mission stabilization fit into the CLAUDE.md; once entry conditions are loaded, path matching, life cycle interception, permission to cut and sandbox boundaries, the matter is no longer simply “writing a document”.

That's a good point.

CLAUDE.md The strength of this is that the model gets a set of important facts at the beginning of the session. And its weaknesses are clear:It still lives in context, not in system structures.

So as long as the task is complicated, language constraints are faced with several old problems at the same time:

• It'll be forgotten.
• It's gonna be misunderstood.
• It'll be "reasonablely adapted" when it comes to the field.
• It will decrease weights in the second half of the long chain.

Writing a hint should no longer be the main line of the Agent project. The hint is of course important, but it is more like the closest and softest layer of constraint to the model. A mature system moves some of the hopes that were originally sustained by the hints out of the model.

Technical engineering layers and Harolds of Claude Code

If I take this thing apart again, I'd rather give it to you now. LLM The placing of a definitive shackle is understood as a seven-layer technical engineering. They're not part of a framework. feature listIt's not from a certain manufacturer. marketing terminologyAnd it's a controlled layer that's gonna grow out of a reliable Agen system sooner or later.

The first two layers deal with “what status the system receives and what process it moves along”. Structured input output layer to allow the system to accept only the recipient parser、validator and schema The test states, not something that looks like an answer; the control flow and mission ring is responsible for putting Agent in a terminal, yes. budgetYes. checkpoint, back-up or interferocity processes that do not allow planning to spread indefinitely.

The three layers of treatment are “what it touches, what it sees, who can stop it”. Tools and Runtime Layers shell、browser、API Such capabilities result in contracts with parameters, side effects boundaries and context budgets; context and system hint layers determine which knowledge is permanently located, which is injected as required, which previously indexed and document entry forms enter working memory; gateways, traffic and access layers are responsible rate limit、auth、quota, audit and access to borders, with greater certainty, to the new offensive and cost aspects introduced by the hedge model.

The last two layers deal with “if it's finished and if it's not rotting in the long run”. The Assessment, Certification and Recovery Level is responsible for proving that the mission is actually completed in the external environment and that it is capable of being successful after failure replay、rollback; progress; observational, operational and governance levels responsible for drifting, bad patterns replication,AI slop And entropy, so that one error is not re-used in the system. Claude Code exposed to developers is the product-based surfaces that correspond to the more abstract control projects.

Claude Code is worth analysing right here. Officially even. How Claude Code works It is defined directly as “the anticipatory harms around Claude”. So the question is no longer what Claude can do, but:This Harness, which language-based constraints were used to sink into the structural elements that were visible in the product.

I understand. LLM The abstract control layer, with the certainty chain, then looks at what Claude Code has made visible design in the product:

Claude Code Visible Design Noodles.	What does it look like in the product?	It really solves the Harness problem.	Which layers are the main maps of the project?
Tool Compact Level	MCP、built-in tools、tool search	Defines the cost of action compacts, cut-off capability boundaries, control tools entering the context	Tools and running time layer, partial access layer, partial context layer
Context route layer	CLAUDE.md、.claude/rules/、imports、auto memory、managed settings	Decide which knowledge is resident, which is fed on condition, which is mandatory by the system	Context layer, partially governance layer
Life cycle certification layer	hooks、prompt hooks、agent hooks	Before, after, before and after compaction Insert a certifier and state recall before and after	Control the troposphere, verify the recovery layer
Segregation and recovery floor	subagents、sessions、checkpointing、--fork-session	Segregate context, cross-task path, roll back file state, visible handoff	Control troposphere, context layer, recovery layer
Autonomous governance	permission modes、protected paths、sandbox、auto mode	Reconciliation of autonomy, hedge approval fatigueInterrupting high-risk cross-border movements	Authority, gateway and governance level, security level
Available Harness	plugins、GitHub Actions、Agent SDK	Pack local Harness original language into reusable, deployable, integrated components	Platform, transport, distribution level

This is not the distribution of seven layers of engineering in abstract mechanically, into seven product functions. The first seven layers are cut by control capacity and division within the system; the six design layers here are cut by what developers actually see in the product, what they can configure, what they can debug. The two are multiple maps, not one.

And that is why two layers do not appear directly in the later text under separate headings. More of the structured input output layer is hidden in tool schema、hook/verifier、checkpoint and mission status constraints; the observation, transport and governance layers are scattered permissions、sessionsaudit,OpenTelemetryand distribution of plugins and SDK Interface these surfaces. The later text continues to be based on six visible design surfaces, but each section returns to the control layer behind it.

i. Tool compact level:MCP It's not just an expansion, it's a world of compressed action.

Many people first come in contact. MCPAnd it's going to be like, "Let Claude do more."

That is not a misreading, but only half.MCP Deeper value, not in terms of capacity expansion, but in the delineation of capacity boundaries.

Anthropic is here. Writing effective tools for agents It is a very important judgement: traditional functions and API, which are the contracts between a certainty system and a certainty system; and a tool, which is the new contract between a certainty system and antagon. Which means the tool layer is not about exposing more movements, but about...Write action into an agreement that ant can be safely used and systems can stabilize consumption.。

Put it on Claude Code, and this judgment will become very specific.

No, I'm not. MCP Claude is likely to be able to guess the path, the authentication method, the order sequence at the terminal. It may be true, of course, but every implementation path carries a field inference.

Got it. MCP After that, things were rewritten. Claude no longer needs to guess himself “where, how, how, how to restore the database when it fails”, and it sees a set of tools that have been cut, named, and bound.query_database(sql: string)、get_ticket(id)、search_internal_docs(query) The real importance of this interface is not more functional, but...The details of the realization have been taken away, and the rest is the part of the capability that the system would like to see.

The capacity boundary is the structured boundary. No, I'm not. delete_user_data This tool, this move is not just "no recommendation" but "no existence" at the technical level. The minimum-authority principle in this and traditional software is the same thing, except that it is now applied to the design of the agent tool.

But only the ones that... MCP It is not enough to understand the boundaries of competence. Claude Code also tied the floor directly to the context budget.How Claude Code works and Connect Claude Code to tools via MCP The following are clearly mentioned:MCP Tool solutions default to delay loading by tool search, Claude sees only the toolname, and the real schema enters the context when needed. This means that the tool layer is defined beyond the capability boundary.Context Cost Boundaries。

This is really the key. The export design of the tool will eventually enter the context of the model. If a tool is to plug back a whole page of database, whole HTML or complete log, the contamination is not a single call, but a subsequent entire chain of reasoning. Good tool design, filtering, compression and field selection at the service end; good tool discovery mechanism, controls how many tools describe the actual entry context.

The blogger says:MCP The layers are not just narrow motion spaces, but they're defining them in advance. Action language for angentI'm sorry. Whether the language is structured, borders are stable, returns are verifiable, determines directly how the tracks are divided, how behaviour is audited, how procedurally it is evaluated, and which steps in the closed circle are firmly written into verifier and reward. The tool compact is not only for one call, but it is also pre-forming a syntax for learning, assessable, auditable agent behaviour.

So... MCP This floor has never been just Claude's call to the outside world, but three things:

• Tool compacts must be defined in a system and cannot be given to model live guesses.
• The action space must be proactively cut, not be restricted by prompt after the event.
• The timing and particle size of the tool entering the context are also part of the Harness design, as both the tool description and the tool output reverse the subsequent reasoning.

That's why OpenAI is here. From model to agent: Equipping the Responses API with a computer environment The site will sink these things into the original platform language. The words may be different, but the engineering facts are identical:The real hard part is never "for a model to do it," but "for a model to do it in a world of bound action."

From the perspective of the control layer, the drop point of this section is primarily the tool and running time layer, while also influencing the control of the cost of the permission boundary and context.

II. Context router layers:CLAUDE.md、rules、auto memory and docs index Division of labour

With more reliable tools, the second category will soon emerge: Claude will still make decisions that are not in line with team habits.

Like what you've abandoned. API Version, not following what is already in place Repository The model, or the process that should have been used only to screen the alarms, is used to handle routine development tasks. At this point, the most natural move continues. CLAUDE.md Refilling rules.

The direction is correct, but the carrier is often not good enough.

Claude Code's memory system is now divided into layers, not a single one. CLAUDE.md：

• CLAUDE.md and CLAUDE.local.md Responsible for permanent statements.
• .claude/rules/*.md It's responsible for cutting the instructions into modules and allowing them to be used paths: frontmatter Make conditions for loading.
• @path import Take care of it. repo docs、README, process document is firmly attached to the entry.
• auto memory And I'm in charge of making Claude himself sink across sessions.

The engineering logic behind this is:Every time Agent fails is a hidden knowledge that has not been encoded into the system or placed on the correct loading level.

That's right here, Vercel. AGENTS.md outperforms skills in our agent evals There is still a great value for reference. The most important conclusion is not that AGENTS.md We're beat. skillsAnd it is:The knowledge exposure sequence is itself part of the binding strength and the design of the exposure mechanism/text route itself is important.

Their results are straightforward:

• When there is no document,baseline The pass rate is 53%.
• Default skills When triggered, the result was almost no improvement, still 53 per cent.
• Visible tip model to use skills , up to 79%.
• Put the compressed document index directly into the base of the warehouse AGENTS.md When did it do 100%.

What really happened here, not in a higher format, was:Did the system continue to give the model a decision on whether to read it or not?

So I'd rather go to the next harder conclusion:

• CLAUDE.md Resolving the facts of the resident status.
• .claude/rules/ Resolves the injection and path matching.
• auto memory Address cross-session learning.
• repo docs Keep doing it. system of record。
• managed settings It is responsible for taking back constraints that should not be maintained by language to the mandatory level of the client.

In that sense, it's really worth learning.The adaptation of knowledge assembly to knowledge pathways.

In the abstract, the central point of discussion here is context and system hint layers, but it is a more sophisticated knowledge route in the product.

III. Life cycle certification layers:hooks It's not just a script, it's an external one. verifier Interface

The third floor, the problem will be tightened again.

Suppose you have a reasonable tool boundary and a key process in it. skills Or in the warehouse file, Claude may still say "completed" at the end of the long mission, but you look at it, the test didn't run, or you ran wrong.

And then you'll find:请确保测试通过 The sentence is essentially a language request.

Claude Code. Hooks reference It is important because it takes this matter directly from the reminder to the life cycle event. You're not just saying "Do it" to the model, but you're just saying, SessionStart、InstructionsLoaded、PreToolUse、PostToolUse、Stop、PreCompact、PostCompact These nodes are attached to external logic.

The significance of this is not to automate the script itself, but to:The completed statements, the call of tools and the context compression of these events, which were originally only in the model narrative, were taken back for the first time by the external system.

PreToolUse The value is to turn cross-border movements into things that can be blocked before they occur. For example, prohibiting high-risk orders, limiting dangerous paths, and preventing certain types of writing. The constraints are no longer “don't do this”, but “you can't do it”.

Stop It's worth more. It has completed the model itself into a system event that can be rejected by the certifier. Official documents are now more than just supported command hookAnd you're still supporting it. prompt hook and agent hookI'm sorry. The blogger adds:Stop Not just running. shell Script. It can pull up a tool. verifier subagent Check the tests, read the files, compare the work, and decide whether to allow the session to end.

This step is critical because it shows that Claude Code's life cycle is not just an event echo, but it's officially opened at the product level. generator / verifier Separation the interface.

It's just in time with Anthropic. 2026-03-24 Issued Harness design for long-running application development The issue of the "Mixed" is a matter of concern. The article clearly describes the long-term application as planner / generator / evaluator Three proxy structures: generator for propulsion, evaluator for scoring, search bug, pull back the output to the specification. This is actually a more common Harness principle:Don't let one. agent It is responsible for both output and unlimited confidence in its own statement of completion.

From this perspective, Claude Code. hooks It's not just an automated little script, it's a little bit of a... verifier Enter the standard run-time port.

InstructionsLoaded、SessionStart、PreCompact、PostCompact Another more subtle problem is addressed: context compression and evaporation. One of the most dangerous things in a long mission is not that the model was initially not bound, but that it lost the constraint during the compression, recovery and switching phases. The key state is placed in documents, scripts, checkpoints and life cycle injections to avoid the natural evaporation of the knowledge that was clearly said earlier.

The most important engineering judgment on this level is that I'm going to write it very heavily:

• PreToolUse The police have been responsible for blocking cross-border movements before the movement occurs.
• Stop Responsible for turning the “complete declaration” into a system event that can be rejected.
• prompt hooks and agent hooks It means that the certifier itself has been manufactured, not just... shell glue。
• PreCompact / PostCompact / SessionStart / InstructionsLoaded It is responsible for putting critical states outside the context window and allowing you to debug “what exactly it loads”.
• The closer security and mandatory constraints are, the more certainty should be used to achieve, rather than revert to LLM - Judge.

That's why Anthropic is here. Demystifying evals for AI agents It's very clear. agent harness and evaluation harnessI'm sorry. The former lets the model agent The results are measured and aggregated. You'll find a key fact when the two are separated:The non-validation of the closed loop, Agent, is essentially simply exposed to the user for a single sample.

hooks It's worth it to make a part of it be only for evaluation or manual. review The checks that were completed were embedded in the operation in advance and it was certain that they would be executed, not CLAUDE.md , and then insert the phrase "test and ensure that the test passes".

In the seven-layer project, this section corresponds to the control flow and task loops, as well as the interface between assessment, validation and restoration.

IV. Segregation, forklifting and restoration:subagents Just the entrance, not all of it.

subagents It is easy to be described as parallel or speed-up.

Of course it's not wrong, but if you see it here, you'll miss its more central engineering meaning:Disassembly a large and dirty decomposition space into a number of narrower, more manageable and more verifiable decomposition spaces.

Claude Code. Create custom subagents The document emphasizes specialized, isolated context and customized tool access. For engineering, this is a real thing, not a few more. agent♪ And it's every one ♪ agent Only one narrower problem can be solved in a cleaner context and with a more restricted set of tools.

One. reviewer subagent If only read permission, then "do not modify the file" is no longer a self-inflicted reminder based on a model, but it has no action space at all. EditI'm sorry. One that runs in a quarantine. subagentIf it fails, it will not be dirty together in the main work area. A guy who only tests and validates. subagentThere is no need to continue work behind the back of dozens of rounds of exploration.

But if you zoom in a little bit, you'll find Claude Code officially isolated the whole thing for two months. subagent The group was expanded to a more complete group of originals:

• Checkpointing Automatically snapshot file status before each editing.
• How Claude Code works It means the session is local. JSONL, resume, or maybe. --fork-session Fork.
• session-scoped permissions Yes. resume or fork It is not always inherited, and the state of competence itself is treated as a visible boundary, not as a hidden continuation.
• session Tie to the directory, officially recommended. git worktrees Run parallel sessions, avoid the same. session Contamination in multiple terminals.

This is the whole floor that's really complete: It's not just open. subagentAnd...Breaking long missions into quarantine, roll-back, fork in, and handoff Local status machines。

And that's exactly what Anthony said in 2026-03-24 in Harness. The article clearly distinguished. compaction and context reset：compaction Just a compression. Same. agent Keep running;reset And for the next one. agent A clean context, only structured. handoff artifact Handover is necessary. The text even goes directly:compaction Retain continuity, but not provide clean slate; and reset I'll pay for it. handoff Cost, but it's really cut. context anxiety。

From this perspective, the real value of this layer is four things:

• Independent context to reduce noise pollution.
• Shrink tool sets to reduce cross-border routes.
• Clear handoffLet each round know what it's about.
• Combined checkpoint、resume、fork and worktree, limit the failure to a smaller part.

The limitation is not a defect, but a source of reliability.

The more freedom the more the path is out of control; the narrower the space for decomposition, the easier the behaviour to predict. Many times, the way to really make it steady is not to continue to expand its autonomy, but to tear down tasks into more restricted, more validated and more strung-up implementation units.

If the control layer perspective is used instead, this section deals with how the control stream, restoration and context isolation narrow the failure radius together.

V. Autonomous governance:permission modesSandboxes and auto mode

Because without this layer, Claude Code still looks like a default to keep playing the permission box. agent Tools. But it's not like that anymore. It's actually already got a very clear one.Auto-Gradient。

Choose a permission mode The four most common models in the day-to-day world have now been organized into a clear gradient:

• default: Read only by default.
• acceptEdits: Automatically accept the file editing and common file system commands in the work directory.
• plan: research and present programmes without changing source documents.
• auto: Not manually confirmed, replaced by a backstage security check.

If you add more extremes bypassPermissionsAnd it's a tactical layer, not a few. UI Switches.

More importantly, this gradient is not "anyone you want." The official document clearly makes some hard-coding of the boundary irrelevant. guardrail：

• protected paths In any mode, they will not be allowed to go without conditions.
• acceptEdits Only edit and limited file system commands in the work directory are automatically approved.
• bypassPermissions And still will. protected paths Keeps the last reminder.
• auto Instead of "all" it is "all" to send to the sorter the high-risk action.

Which means... permission modes It's not a user experience preference anymore, but...How autonomy is institutionalizedProblem.

And look down, Anthropic is here. Beyond permission prompts: making Claude Code more secure and autonomous And what's public about it is even more noteworthy. It doesn't make the sandbox a safety attachment, but it makes it safer and safer. autonomous* The basic conditions.

If the sandbox answers “which hard borders can be decentralized”, then Claude Code auto mode The answer is another question:How to give a more fine-tracked strategy to the high self-government without returning to manual approval fatigue.

This article says that users actually approve 93% of the total number of users. permission promptI'm sorry. So, just push back all risks to manual confirmation, and then it's easy to evolve. approval fatigue。

It's introduced. auto mode Two layers of defense:

• There's one in the input layer. prompt-injection probe, enter in the tool result agent Scanning the context before it.
• There's an output layer. transcript classifier, determine whether this step is actually authorized by the user and whether it crosses the trust boundary before the action is executed.

It's not a unilayer, but a two-stage structure: a quick, conservative one first. token filter First sift, then only the bee. flag The actions enable the second stage with reasoning, and minimize costs and by-catch.

It's got a lot of agents. handoff It was also included in the review. The government has written that the government is not a party to the law.classifier Yes. subagent delegation The end of the mission is checked both at the end and back, because the user actually authorized the mission. handoff The most vulnerable is the location.

When you want to be self-governing, you should not just think about "How to make the Lord" agent More intelligent, it should be designed simultaneously to “who will judge whether this step is beyond his power”.

So the most valuable judgement to be retained on this level is:

• default / acceptEdits / plan / auto Not only are there a few facilitation models, but it is also an autonomy gradient.
• protected paths、managed settingsTogether with sandboxes and sorters, they constitute a hard border of self-government.
• The mature autonomy is not to remove approval, but to recast the logic of judgement behind approval into a system structure.

More abstractly, this layer is an answer to how autonomy is governed, and therefore falls under the control of its powers and naturally spills over to detectability and governance.

VI. Have you got Harness:plugins、GitHub Actions、Agent SDK

The first few floors are more like local tools to control themselves. But Claude Code has a design that is more easily underestimated: It's not just one. CLIAnd it started to wrap its Harness into distribution components.

Look first. Create pluginsI'm sorry. The official definition of plugins is now clear: plugins are not just loaded. skill A small extension, but a pack. skills、agents、hooks、MCP servers、LSP servers、monitors、bin/ Executable and Default settings . A plugin can be understood as a package of portable Harness configurations.

Claude Code does not regard Harness as a fragmented private configuration on a user machine, but rather as a versionable, shared, assembled component. You've been doing your skills locally today.agent、hook And the monitor, it can be sealed into a plug-in tomorrow, into a team-level infrastructure.

Look again. Claude Code GitHub ActionsI'm sorry. The official document is clear: it allows you to be GitHub workflow Run Claude Code, which is built on Claude Agent SDK and respects the warehouse CLAUDE.md Standards. It means the same local Harness logic that can be moved to it. PR Create, create,issue Achieved,code review And automate repair.

And finally, Agent SDK overviewI'm sorry. It offers "the same tools, ant loop, and context management that power Claude Code" and it's just done. Python and TypeScript Programmable interface. More importantly, it's not just one. query API It's over. It's the company. hooks、subagents、MCP、permissions、sessions、checkpointing、OpenTelemetry observability All exposed together. In the generic Single Agent task, reuse Claude Code SDK or something like PI-like Harness allows us to use readily available uncertainties to compress and the results of project contraction, Harness as a service

This means that the Harness behind Claude Code has emerged as a clear trend towards platformization:

• CLI It's interactive surface.
• The plugin is the configuration and capability distribution module.
• GitHub Actions Yes. CI Run the surface.
• Agent SDK It's programmable to embed the surface.

Claude Code is not an isolated product, but...A product-based Harness Original languageI'm sorry. That's why I call this floor a distribution.

Extra-curricular: OpenAI Reponse API started to put a lot of tools, Shell, code interpreter, etc., into API, which can be understood as a kind of Harness as a service.

This layer is not the eighth layer, but the additional layer of control that has been built up in the first layers, further placizing, developing and distributing infrastructure surfaces.

If you're still writing language requests, what's a better structure usually?

I would now prefer to write the following in the first six layers of the translation back into the engineering language:

If you only write language requests	What does a tougher structure usually grow?
"Let it check the system, make its own tools."	MCP Compact + tool search + Service-based filtered tool output
“Comply with team norms and catalogue boundaries”	CLAUDE.md Entry + .claude/rules/ Load Condition managed settings Force Layer
"Remember to check before completion."	Stop hook + prompt/agent verifier + generator/evaluator Separation
"Don't mess up the main context and the workspace."	subagents Segregation+ checkpoints + resume / fork-session + worktree
"Don't bother me, but don't be silly."	permission modes + protected paths + sandbox + auto mode classifier
"Reuse this experience to other warehouses and operating scenes."	plugins + GitHub Actions + Agent SDK

The table is simple:Language requests have not disappeared, but it is no longer the language requests themselves that determine the reliability of the system.

It's the big job the frame actually did for you.

When you spread out these problems,framework The word automatically goes to the ghost.

The frame is not because people don't. Write while loop It's not because it's there. planner It's a very difficult story to write. The framework should be a big job for you, and it is a reusable agreement to freeze the Harness technology that has been seen over and over and over and over and over again:

• State how it is defined.
• How the tools are packaged and delayed.
• How the document presets, slices and routers.
• How life cycle nodes are intercepted, verified and rebroadcast.
• How the submissions are isolated, split, restored and handoff。
• How autonomy is governed, rather than being artificially identified.
• How these constraints are sealed into plugins,CI Integrated and SDK。

The framework is not the intelligence itself, but the form of the condensation of Harness technology.

Of course you can use the frame, but you don't use the frame, which doesn't mean that the issues will disappear. And the more common reality is that you'll have to make them up to yourself. The difference is only between the re-engineering of each project or whether some of it has been pumped into a stable component.

Extra-curricular: The existing framework includes a very simple framework (e.g. PocketFlow) to provide users with an understanding of the Agent architecture, a highly integrated framework (Langchain/Graph) to provide users with a sealed Agent structure, but simply the provision of Harness is not sufficient, and the Age of Agent requires new infrastructure to help developers develop better, but does not need too much containment to leave behind technical debt. The framework that really works and is really common is far from us.

Concluding remarks

Back to the first one. CLAUDE.md It's getting longer and longer.

He did nothing wrong, but stopped at a softer level. Language to confine language models is like writing "no mistakes" in the staff manual: it helps, but it's not enough. The engineering answer is to put it on a working system: what tools it can touch, what norms are loaded at the right time, what actions are stopped at the life cycle nodes, what tasks are to be done in a segregated environment, who is to verify when it says “complete”, to what extent it can be decentralized, and how the restraints are brought into CI and other operating surfaces.

That is the judgment I would like to retain:It is not important to make models more responsive, but to keep systems bound when models do not.

And this one says, "How exactly do these peripherals work in the product, and why Claude Code is the perfect portal to watch them."

I'll cut the angles off next time and discuss another question: Why do you focus on this whole circle today? harnessAnd how does it actually go down, when it's explained, when it's too broad to be out of shape, and why it continues to be broken down when discussing specific engineering issues? 工程 harness + 产品 harness + 用户友好 harness It's always better than stopping. agent = model + harness More important.

This paper has undergone several rounds of revision, with no synchronization between the date of publication and the actual date of completion.

References

• Anthropic Docs, How Claude Code works
• Anthropic Docs, Explore the context window
• Anthropic Docs, Store instructions and memories
• Anthropic Docs, Connect Claude Code to tools via MCP
• Anthropic Docs, Hooks reference
• Anthropic Docs, Create custom subagents
• Anthropic Docs, Checkpointing
• Anthropic Docs, Choose a permission mode
• Anthropic Docs, Create plugins
• Anthropic Docs, Claude Code GitHub Actions
• Anthropic Docs, Agent SDK overview
• OpenAI, Harness engineering: leveraging Codex in an agent-first world
• OpenAI, From model to agent: Equipping the Responses API with a computer environment
• Anthropic, Writing effective tools for agents
• Anthropic, Harness design for long-running application development
• Anthropic, Claude Code auto mode: a safer way to skip permissions
• Anthropic, Beyond permission prompts: making Claude Code more secure and autonomous
• Anthropic, Effective harnesses for long-running agents
• Anthropic, Demystifying evals for AI agents
• Vercel, AGENTS.md outperforms skills in our agent evals
• I'm not sure.Look at the design of Harness Engineering from Claude Code
• "Making Agen Work, Large Model Structure Output and Limited Decoding Technologies"
• "Context is All You Need: Context Project for Smart Bodies"
• From MCP to Agent Skills: Why does Agent need a new context work protocol?
• "AEnvirronment: Agent Need a Unified Environmental Level?