Every serious general-purpose agent runs on a hand-rolled harness. Claude Code, Codex, the open-source terminal agents, the desktop workbenches: none of them sit on an agent framework, and none of them started from bare metal either. After a day inside deepagents’ twenty thousand lines and a stack of production harness retrospectives, the pattern is clear enough to write down as a playbook. Hand-roll exactly one layer, and be strict about which one.

Step 0 — Check that you are in the right quadrant

If your task space is enumerable, use a graph framework instead. A business workflow with knowable steps, compliance stakes, and an audit trail belongs there. Determinism is cheaper than autonomy, and in that setting your errors are expensive.

This playbook is for open task spaces, where the model has to choose the path itself.

Step 1 — Refuse to write the undifferentiated layers

Provider abstraction is a solved problem. In TypeScript, use the AI SDK; in Python, a thin client is enough. The tool protocol is MCP, and inventing your own protocol is worse than doing nothing. Sandboxes can be rented. Conventions such as AGENTS.md and skill folders are converging across every product, so adopt them as they are.

None of these layers differentiates your product, so none of them deserves your time.

Step 2 — Write the loop in a day, then stop working on it

The loop is ReAct plus streaming, with one detail worth copying from the products that shipped: decide whether to continue or stop based on whether tool calls came back, never on the provider’s finish_reason field.

That is the whole loop, and it is one percent of the kernel.

The loop is a day of work. The other ninety-nine percent is what keeps the loop alive at hour three.

Step 3 — Build the survival machinery in this order

The order matters. Each item on this list is the thing that breaks you next.

  1. Externalize state first. The agent is a stateless machine. The thread is the stateful thing: checkpoints, resume, handoff. If you get this wrong, compute becomes welded to user identity, and you will be paying for one pod per user before your second cohort arrives.
  2. Context discipline second. Append-only history, a cache-stable prefix, and every tool result either truncated or written to a file with an explicit marker saying the content is incomplete. This single decision controls both your cost curve and your coherence curve.
  3. Take the verdict away from the model. Use an external checklist with pass/fail items the model is not allowed to delete, plus a cheap judge on any completion claim that lacks tool-call evidence. The two chronic failures — declaring the work done too early, and claiming writes that never happened — are both failures of the verdict, not of the path.
  4. Gate side effects. Provide an autonomy setting the user can actually see (ask / plan / act), require approval on writes, and make the workspace boundary double as the security boundary.
  5. Add sub-agents. Isolated context goes in; only a result summary comes out.
  6. Add skills, progressively disclosed. Names and one-line descriptions stay visible; the bodies load on demand. The same two-stage approach works for tools.
  7. Add compaction last. Start with edit-compaction: blank out old tool results while keeping each call paired with its result. Add LLM summarization only when your tasks outgrow that.

Step 4 — Layer verification by cost

Run the deterministic signals first: lint, types, and tests, after every edit. Use model-judged review only for questions that semantics alone can answer. And never let the worker grade its own work; a different model should do acceptance.

The meta-rule

Every new constraint must be paid for with evidence: either a failure that actually recurred, or stakes that are actually high. Every rule you add spends context, and every approval you add spends the user’s patience.

Harnesses accumulate rules by default. The discipline to remove them is what separates a kernel from a pile.

Where the designs come from

Read other implementations; do not depend on them. Kimi Code has the cleanest layering. OpenCode has the most breadth. Cline is worth studying for permission plumbing. deepagents shows how a framework organizes the same machinery. The WorkBuddy retrospectives show what production adds under pressure.

Steal designs, not dependencies. A dependency ships someone else’s judgment on their release schedule. A design you ported yourself is yours.

None of this is a weekend project. But none of it is research anymore either. Every step above has at least three public implementations you can learn from. The kernel stopped being a secret this year. What remains is the discipline to build it in the right order.