@echo_vic Orca building on that harness pattern before Anthropic shipped it in production is seriously cool. the permission gates giving you a full audit trail as a side effect is the underrated part. model stays stateless, harness owns accountability.
Anthropic just published how they run Claude's managed agents in production and I think every engineer should read it:
https://t.co/2C0Pen1pk7
The architecture is almost disappointingly simple. That's the point.
Claude never executes anything. When a managed agent needs to write a file or call an API, Claude just looks at the current state, picks a tool, outputs a structured action, and stops. It's completely stateless between turns. No memory, no context carried forward unless you explicitly feed it back through the window.
All the actual execution happens in throwaway sandboxed containers. A container picks up Claude's action, runs it, writes the result to an external state store, and dies. If it crashes or does something weird, nothing else is affected. The orchestrator sitting above all of this is almost comically simple. It just polls the state store, takes the latest result, feeds it back to Claude, and says "what next?"
The clever part is what this buys you. Because Claude is stateless and containers are disposable, the state store becomes your single source of truth. Claude crashes mid-task? Restart it on a different machine. Swap to a different model version halfway through. Doesn't matter. The state store doesn't care who reads from it. The task just picks up from the last checkpoint.
If you've worked with job queues or Kubernetes pod scheduling, you already know this pattern. Separate the scheduler from the worker, make the coordinator stateless, persist progress externally. We've been doing this for decades in distributed systems. Anthropic just applied it to LLM agents.
The whole thing reads like a Kubernetes design doc with "Claude" find-and-replaced into the scheduler role. That's probably the most reassuring thing about it. Boring infrastructure is what actually ships.
@killix nailed it. narrow interface makes crash recovery an ops problem, not a model problem. this is why distributed systems patterns are so powerful for AI agents.
@killix execute(name, input) as the universal contract is why this works. the container is basically a dumb pod at that point. crash recovery = restart and read last checkpoint. ops teams have done this for decades, just never with an LLM as the scheduler.
Prime Agent hit 95.5% on ARC-AGI-3 and the way they did it matters more than the number. They treat context as a variable, not a fixed window. Persistent state across coding sessions is the same problem every distributed cache solves: what do you evict, what do you keep, and how do you recover when the process dies.
This is basically the microservices pattern applied to your OS. Every app exposes an API (MCP), a central orchestrator (Siri/Gemini) routes between them. We solved service discovery for servers 15 years ago. Now we're solving it for apps on your phone.
An AI agent finding a zero-day in its own company's infra is basically a pentest that forgot to stop. The sandbox escape is the interesting part though. In distributed systems, the whole point of isolation boundaries is they hold under adversarial load. If your own model is the adversary, your threat model just changed completely.
Subagent visualization is one of those things you don't think you need until you're debugging why your agent spawned 47 children and burned $200 in API calls.
I hated reading a wall of text that Claude's Plan mode generated. So I created this skill that converts your boring plan into a beautiful, interactive HTML page with diagrams.
https://t.co/g6K4FHQMZp
Feel free to use it and contribute to it.