Agent systems now have two layers

Claim

The runtime layer (where the loop runs and how state persists so work can resume) is now "traditional backend engineering" and has converged on three primitives: an append-only session event log, a stateless disposable harness process, and a sandbox called like any other tool. The context and orchestration layer (which model runs when and what it sees) is still the part that changes per model generation.

Evidence

• Anthropic Managed Agents (2026-04-08): Session is an append-only event log; Harness is stateless and disposable, a crashed one is replaced by a new one that calls wake(sessionId) and resumes; Sandbox exposes execute(name, input) -> string. Credentials never enter the sandbox. Context is stored in the session rather than irreversibly compacted. Moving the harness out of the container let inference start before provisioning: p50 time to first token down 60%, p95 down over 90%.
• Cursor cloud agents (2026-06-02): the agent loop moved into Temporal for durable execution, from "one nine" to over two nines; over 50M actions per day across over 7M workflows; over 40% of internal Cursor PRs now come from cloud agents. Loop, machine state and conversation state are decoupled. Needed infra: VM hibernation and resume, checkpoint and fork of VM images, secret redaction, network policy. "The environment is the single biggest factor in cloud agent output quality"; failures "degrade silently".
• Claude Agent SDK is the Claude Code harness as a library: gather context, take action, verify work, repeat.
• A source study of 11 production harnesses, about 4M lines (2026-07-15): none imports a general agent framework, none uses vector embeddings for code retrieval, 9 of 11 adopt SKILL.md, 8 of 11 MCP, 6 of 11 ACP. Thesis: in the first half of 2026 the harness "shifted from a tool to a platform".
• Claude Code hooks now cover 33 lifecycle events and 5 handler types (command, http, mcp_tool, prompt, agent); exit code 2 blocks. Docs say to use the permission system, not hooks, for hard allow and deny rules.

Open questions

• Whether Managed Agents' self-hosted sandbox option is usable on a LAN VM.

Sources

• https://www.anthropic.com/engineering/managed-agents — blog, Tue Apr 07
• https://cursor.com/blog/cloud-agent-lessons — blog, Mon Jun 01
• https://claude.com/blog/building-agents-with-the-claude-agent-sdk — blog, Sun Sep 28
• https://arxiv.org/abs/2609.00006 — paper, Tue Jul 14
• https://code.claude.com/docs/en/hooks — docs, Wed Oct 21

AI-assisted research: gathered and summarised with AI from the sources above, each claim checked against them.