Agentic architecture patterns, part 1: one agent, one loop, and the patterns inside it

Part 1 of a four-part series on agentic architecture patterns. Part 2 covers many agents and the ways they fail together. Part 3 covers the control plane: the patterns that decide whether an agent may run at all. Part 4 is hands-on: harness engineering, the loops and graphs that run the model.

An agent is a short program that calls a language model in a loop. It assembles a context, calls the model, runs whatever tool the model asked for, appends the result, and goes round again until something says stop. Everything else that gets called an agent pattern, from ReAct to compaction to the step cap, is a decision at one of four places in that program: the model call, the tool call, the context window and the stop condition. I call those places seams. This essay is a reference to the single-agent patterns, organised by seam, with the measured record for each: the source that introduced the pattern, the numbers it reported, the failure mode it reported, and the condition under which not to use it.

The seam that matters most is the one least often designed: the stop. The benchmark that measures it, tau-bench, defines pass^k as the chance an agent completes the same task on every one of k attempts. On its retail domain the best model of June 2025 scored 0.74 once and 0.53 four times in a row; on a domain where the customer also holds tools, 0.34 and 0.19. Nearly every other pattern in this essay exists to move those numbers, and the evidence says which ones do.

The record is not only academic. In the week before this essay was written, the lab that published the industry’s standard taxonomy of agent patterns redrew two of its own seams in public: on 9 October 2026 it turned off live internet access for its internal evaluations after its agents found routes through the tool seam that nobody intended, and on 13 October it described a merge queue taking over 30,000 agent-written changes a day, which is the stop seam moved from the engineer to the system. Both episodes appear later as evidence. Twenty-two months after the taxonomy, the people who know the patterns best are still working on the seams, and I take that as the subject of this part.

This series is a reference, written from the platform seat, on how agents are built. This part is about one agent and the loop inside it. Name the seam and you know what a pattern costs, what it fixes, and when it will fail. Part 2 applies the same method to many agents. Part 3 is about the controls that sit outside every agent and decide whether it may run. Part 4 builds a harness by hand.

I have tried to source every number in this essay from a paper or a lab post read in full, and to give the date of each. Where the number is my own arithmetic, I say so. The tables and figures were built from those numbers, and every pattern has one.

The loop, and the four places it can go wrong

Strip away the framework and an agent is a short program. It assembles a context, calls a model, reads what comes back, runs any tool the model asked for, appends the result, and goes round again until something says stop. Anthropic’s December 2024 essay “Building effective agents” calls the thing inside the loop the augmented LLM: a model “enhanced with augmentations such as retrieval, tools, and memory”. OpenAI’s April 2025 guide to building agents is blunter about the shape: “Every orchestration approach needs the concept of a ‘run’, typically implemented as a loop that lets agents operate until an exit condition is reached.” Its own SDK documents the loop in three numbered steps, and the third is an exception named MaxTurnsExceeded. Google’s September 2024 “Agents” whitepaper describes an orchestration layer as “a cyclical process” that continues “until an agent has reached its goal or a stopping point”. Anthropic’s current Claude Code documentation names the layer around the model, the one that provides tools and manages what the model sees, the agentic harness. These are four descriptions of one program.

Each pass through the loop crosses four seams, and each seam is a design surface with its own literature.

The model call. What goes into the prompt, whether the model reasons before it acts, whether one call is split into a planner and an executor, whether a second call critiques the first, and which model takes the call at all. Chain-of-thought, ReAct, plan-and-execute, reflection, routing and the “think” tool are decisions here.

The tool call. What the model can reach, and through what interface. Text actions versus native function calling, the tool descriptions and result formats, the Model Context Protocol, code as the action language, computer use where the tool result is a screenshot, and the gating of state-changing calls are decisions here.

The context window. What the model sees on each pass. Compaction, tool-result clearing, external memory files, retrieval on demand, sub-agents that isolate a window, prefix stability for the cache, and whether a long task is one session or many are decisions here.

The stop condition. Who decides the task is done, and on what evidence. A maximum number of turns, a final-output tool, a budget cap, a test suite, a separate evaluator, a human checkpoint, or nothing at all except the end of the context window. This seam is where reliability is measured, and the measurements are worse than most people assume.

I find the seams more useful than the pattern names because the names drift and the seams do not. The same idea appears as “evaluator-optimiser” in one taxonomy, a “LoopAgent” with a critic in another, and “reflection” in a third. In every case it is a second model call at the model seam plus a decision rule at the stop seam, and it has the same failure mode in all three places, which the evidence below makes plain. The rest of this essay takes the seams in order. For each pattern I give the problem it solves, the source that introduced or measured it, the numbers, the failure mode, and when not to use it. There is a worked example near the end, a refund agent traced through all four seams with the arithmetic shown, and a table of every pattern with its seam.

Everyone’s list is the same list

Before the seams, a word about the lists. Anthropic’s December 2024 taxonomy draws a line between workflows, “systems where LLMs and tools are orchestrated through predefined code paths”, and agents, where the model dynamically directs its own process and tool use. It names five workflow patterns: prompt chaining, routing, parallelisation (with two variants, sectioning and voting), orchestrator-workers, and evaluator-optimiser. Then it names the agent, with the advice that “it’s also common to include stopping conditions (such as a maximum number of iterations) to maintain control”. The essay’s other advice is the one most often quoted and least often followed: find “the simplest solution possible, and only increasing complexity when needed”, because for many applications “optimizing single LLM calls with retrieval and in-context examples is usually enough”.

OpenAI’s guide, published in April 2025, defines an agent as a system that “independently accomplish tasks on your behalf”, with two properties: it uses a model to manage workflow execution and decide, including recognising “when a workflow is complete”, and it has tools inside guardrails. Its orchestration section lists four common exit conditions: tool calls, a structured output, errors, or a maximum number of turns. Its multi-agent advice is to “maximize a single agent’s capabilities first”, and it gives a number for the tool seam that I have not seen elsewhere: “Some implementations successfully manage more than 15 well-defined, distinct tools while others struggle with fewer than 10 overlapping tools.”

Google’s Agent Development Kit ships the workflows as classes. A SequentialAgent “Executes sub-agents one after another, in sequence”, a ParallelAgent runs them in parallel, and a LoopAgent “Repeatedly executes its sub-agents until a specific termination condition is met”. The documentation is careful to say that these run “without consulting an AI model for assistance with the orchestration”, and it is just as careful about the stop seam: “the LoopAgent itself does not inherently decide when to stop looping”, so the builder sets a maximum iteration count or a sub-agent escalates. Antonio Gulli’s 2025 book “Agentic Design Patterns”, published by Springer in November 2025 with a free edition released in September, lists twenty-one chapters, and the first six are prompt chaining, routing, parallelisation, reflection, tool use and planning. The rest are multi-agent, memory, protocols and operations, which is the shape of this series.

Anthropic’s Claude Code documentation, as it stands in October 2026, describes the loop as three phases, gather context, take action, verify results, and spends more words on the last than on the other two. The line I would put on the wall is this one: “Claude stops when the work looks done. Without a check it can run, ‘looks done’ is the only signal available.”

“Claude stops when the work looks done. Without a check it can run, ‘looks done’ is the only signal available.”

Five lists, one shape. Chaining, routing and parallelisation are decisions about how many model calls there are and in what order. Reflection and evaluator loops are a second call plus a stop rule. Tool use and planning are the tool seam and the model seam respectively. Memory is the context seam. Guardrails, monitoring and human-in-the-loop are the stop seam and the control plane. If a vendor shows you a slide with a new pattern name, ask which seam it sits at. If they cannot say, it is a product, not a pattern.

pass^1 0.74 to pass^4 0.53 on retail, 0.34 to 0.19 on telecom: right once is not right every time

Seam one: the model call

The oldest pattern in the lineage is also the one most builders still run without knowing its numbers. ReAct, from Shunyu Yao and colleagues at Princeton and Google, was submitted on 6 October 2022 and published at ICLR 2023. Its idea is simple to state: interleave a reasoning trace with an action, feed the observation back, and repeat, so that “reasoning traces help the model induce, track, and update action plans” while the actions ground the reasoning in something retrieved. Everything that calls itself an agent today is a descendant.

What is forgotten is how much of the paper is about the loop failing. On HotpotQA, with a 540-billion-parameter PaLM and a search tool over an online encyclopedia, ReAct scored 27.4 exact match against 29.4 for plain chain-of-thought; it won on the fact-checking task, 60.9 against 56.3, and the combination of the two beat either. The authors hand-labelled 50 correct and 50 incorrect trajectories per method and found that ReAct hallucinated in 0 percent of its failures where chain-of-thought hallucinated in 56 percent, but ReAct’s failures were reasoning errors 47 percent of the time, and 23 percent of the time the search simply returned nothing useful and the loop derailed. The paper’s own description of the characteristic failure is a loop that cannot exit: “the model repetitively generates the previous thoughts and actions”. Their fix is the first explicit stop condition in this literature. They cap HotpotQA at seven steps and the fact-checking task at five, because “more steps will not improve ReAct performance”, and when the loop runs out of steps they fall back to chain-of-thought with self-consistency. On the ALFWorld household tasks the loop shines, 71 percent success for the best of six prompts against 45 for acting without reasoning, and on WebShop it reached 40.0 percent task success against 30.1, with the human expert at 59.6. Those are the numbers I would want anyone to know before they ship a loop: a seven-step cap, a 23 percent rate of uninformative observations, and a 47 percent reasoning-error share among failures.

Workflows are the pattern of not opening the loop. The five workflows in Anthropic’s taxonomy are all ways of deciding, in code, how many model calls happen and in what order, so that the model never gets to decide. Prompt chaining splits a task into fixed subtasks and runs them in sequence, with a programmatic check between steps; the guidance is to use it “when the task can be easily and cleanly decomposed into fixed subtasks”, trading latency for accuracy. Routing classifies an input and sends it to a specialised prompt or a different model, which is the pattern I built a reference design around in June: the application declares a task class, never a model. Parallelisation runs the same or different prompts at once, either sectioning a task or voting on an answer. Orchestrator-workers is the one case where the subtasks “aren’t pre-defined, but determined by the orchestrator based on the specific input”, which is why it is the boundary with Part 2. Evaluator-optimiser runs a generator and a critic in a loop when there are “clear evaluation criteria, and when iterative refinement provides measurable value”.

The strongest argument for workflows over agents is a coding result from July 2024 that OpenAI later adopted to showcase its own models. Agentless, from Chunqiu Steven Xia and colleagues at Illinois, asked “Do we really have to employ complex autonomous software agents?” and answered with a fixed three-phase pipeline, localise, repair, validate, that lets no model decide a next action. On SWE-bench Lite it resolved 32.00 percent of issues at an average cost of 70 cents per issue, against 23.00 percent for SWE-agent with Claude 3.5 Sonnet at $1.62 and 18.33 percent with GPT-4o at $2.53. In the taxonomy it is prompt chaining with voting over candidate patches. I return to its numbers at the stop seam, because its real lesson is that a loop you never open cannot fail to close.

Plan-and-execute is one call split into two. The ReAct loop re-sends the whole history on every step, so its cost grows with the square of the step count and its planning is myopic. Three papers from 2023 attack both problems by writing the plan first. Plan-and-Solve prompting (Lei Wang and colleagues, 6 May 2023) is the prompt-level ancestor: ask the model to “devise a plan to solve the problem” before solving it. On GSM8K with text-davinci-003 it lifted zero-shot accuracy from 56.4 to 59.3, targeting the missing-step errors that were 12 percent of the failures the authors analysed; against hand-written few-shot chain-of-thought the gain vanished, 76.7 versus 77.6 averaged over six datasets. ReWOO (Binfeng Xu and colleagues, 23 May 2023) made the structural version: a planner writes every step with placeholders, the tools run, and a single solver call reads the evidence. Averaged over six benchmarks it cut token use by 64 percent and gained 4.4 points of accuracy. On a thousand HotpotQA questions with gpt-3.5-turbo, ReAct used 9,795 tokens per question at $19.59 per thousand questions; ReWOO used 1,986 tokens at $3.97, and was more accurate, 42.4 against 40.8. The paper also carries an early warning for the tool seam: “Extraneous tools compromise ALM performance”, with accuracy falling as tools were added.

LLMCompiler (Sehoon Kim and colleagues at Berkeley, 7 December 2023, ICML 2024) goes one step further and has the planner emit a graph of function calls that a dispatcher runs in parallel wherever they are independent. The abstract claims “latency speedup of up to 3.7x, cost savings of up to 6.7x”, and the tables support it: on a movie-recommendation task ReAct took 20.47 seconds and 20,000 input tokens per query where LLMCompiler took 5.47 seconds and 2,800, at $3.04 per thousand queries instead of $20.46. The paper names the two ReAct failure modes it is designed around as “looping and early stopping”, which is the stop seam failing in both directions at once.

The cost of planning up front is that a wrong plan cannot be repaired mid-run. ReWOO tests this with deliberately failing tools; the honest summary is that plan-and-execute pays when the next step does not depend on an observation the planner could not foresee, and ReAct pays when it does. Most production loops I see are hybrids: a plan written once, re-planned only when an observation contradicts it. That is a stop rule at the model seam, and it should be written down.

Reflection works exactly when there is something outside the model to reflect against. This is the most misunderstood pattern in the catalogue, and the record on it is unusually clean. Reflexion (Noah Shinn and colleagues, 20 March 2023, NeurIPS 2023) wraps an actor in an evaluator and a self-reflection step whose output is written to a short memory and read on the next attempt. Its headline is 91 percent pass@1 on HumanEval against GPT-4’s 80 percent, with gains of 22 points on ALFWorld in twelve iterations and 20 points on HotpotQA. Read the tables and the mechanism is visible. On ALFWorld, ReAct with Reflexion completed 130 of 134 tasks where plain ReAct stopped improving between trials six and seven and converged at a 22 percent hallucination rate. On MBPP Python, the score went down, from 80.1 to 77.1, and the authors show why: the model wrote its own unit tests, and 16.3 percent of those tests were false positives, against 1.4 percent for HumanEval. Where the signal is a real test, reflection climbs; where the model grades itself, it drifts. A weak model gains nothing: starchat-beta scored 0.26 with and without it.

Self-Refine (Aman Madaan and colleagues, 30 March 2023) shows the other half of the picture with one model generating, critiquing and revising its own output. On tasks of taste and style the gains are enormous: sentiment reversal from 3.8 to 36.2, dialogue response from 25.4 to 74.6, constrained generation from 15.0 to 45.0 with GPT-4. On maths the gain is 0.2 points, 92.9 to 93.1, and the paper explains that for 94 percent of maths instances the critic said that everything looks good. CRITIC (Zhibin Gou and colleagues, 19 May 2023) isolated the variable by letting the critic call tools. With a search tool or an interpreter the corrections are real; without one “the model’s own critiques contribute marginally to the improvement (-0.03 and +2.33 F1 with the two LLMs)”. The cleanest negative result is Jie Huang and colleagues at Google DeepMind, “Large Language Models Cannot Self-Correct Reasoning Yet”, submitted 3 October 2023 and published at ICLR 2024. Told to review its own answer with no external signal, GPT-4 fell on GSM8K from 95.5 to 91.5 after one round and 89.0 after two, while making three and then five calls instead of one; GPT-3.5 on CommonSenseQA fell from 75.8 to 38.1. The model kept its first answer 74.7 percent of the time, and when it changed it was “more likely to modify a correct answer to an incorrect one”. The paper’s check on multi-agent debate is the one Part 2 will lean on: debate with six responses scored 83.2 on GSM8K where plain self-consistency with six responses scored 85.3.

So the rule for the reflection pattern is not “use it” or “avoid it”. It is: a reflection call is worth its cost only if it reads a signal the model did not generate. Unit tests, an interpreter, a search result, a schema validator, a separate evaluator model with a different prompt and a sceptical disposition. Anthropic’s March 2026 note on long-running harness design found that agents “reliably skew positive when grading their own work” and that tuning a standalone evaluator to be sceptical is “far more tractable”. That evaluator is a separate call at the model seam with its own stop rule, and it is the version of reflection I would build.

A reflection call is worth its cost only if it reads a signal the model did not generate.

The “think” tool is a reasoning step dressed as a tool call. On 20 March 2025 Anthropic described giving Claude a no-op tool whose only effect is to add “an additional thinking step, complete with its own designated space” between tool results. The results table on tau-bench’s airline domain is the clearest published decay curve for repeated trials I know of, and I reproduce it in the figure. With the think tool and an optimised prompt, Claude 3.7 Sonnet scored 0.584 on pass^1 and 0.340 on pass^5; the baseline scored 0.332 and 0.100. (The post’s body text quotes 0.570 and 0.370; the table says 0.584 and 0.332, and I use the table.) Extended thinking alone scored 0.412 falling to 0.160, and the think tool without the prompt change scored 0.404 falling to 0.100. In the retail domain, where the policy is simpler, the think tool without a prompt change still led, 0.812 falling to 0.626, against a baseline of 0.783 falling to 0.583. The post’s own guidance is that the step helps in “Policy-heavy environments” and “Sequential decision making”, and not for non-sequential calls or simple instruction following. The page now carries a note, dated 15 December 2025, recommending extended thinking over a dedicated tool in most cases, which is the usual fate of a harness trick: the model absorbs it.

A paper from Amazon’s AGI group, SABER (Alejandro Cuadron and colleagues, 26 November 2025), says where the extra thinking should go. Analysing the same tau-bench tasks, it found that “each additional deviation in a mutating action reduces the odds of success by upto 92% on Airline and upto 96% on Retail”, while deviations in read-only actions cost under 10 percent. Its design, mutation-gated verification with targeted reflection before state-changing steps, lifted a Qwen3 thinking model by 28 percent relative on airline and 11 on retail. The lesson for the model seam is to spend the reflection call before the write, not after every read.

Not every model call needs the big model. The last pattern at this seam is routing inside the loop. Many of the calls an agent makes are not reasoning calls at all: classify this ticket, decide whether this tool result is relevant, check whether this field is a valid order number. I argued in October that those bounded decisions belong to a different class of model, fast and cheap and trained on labels, and that the expensive reasoning model is doing two jobs when it makes them. The agent loop is where that argument bites hardest, because every step is a model call and most steps are decisions. Anthropic’s 7 October 2026 launch of Claude Haiku 5.5, priced at $0.10 per million input tokens, named “compaction, summarization, or subagent work” as the jobs it is for. A loop that routes its bounded decisions to a small model, and its judgment calls to a large one, is applying the routing workflow one step at a time.

Seam two: the tool call

A tool is where the model meets something that is not a model. Anthropic’s September 2025 post on writing tools for agents calls it “a contract between deterministic systems and non-deterministic agents”, and the phrasing is exact: the tool does the same thing every time, the caller does not. Every pattern at this seam is a decision about the shape of that contract.

Text actions, JSON actions, or code. Toolformer (Timo Schick and colleagues at Meta, 9 February 2023) was the first demonstration that a model could be trained, self-supervised, to decide when to call a tool, which one, and with what arguments: a 6.7-billion-parameter GPT-J with a calculator went from 7.5 to 40.4 on one arithmetic benchmark and beat the 175-billion-parameter GPT-3. It is the ancestor of native function calling, and it carried a crude stop rule that is still instructive: at most one tool call per input, so that the model “does not get stuck in a loop where it constantly calls APIs without producing any actual output”. Native function calling, where the model emits a structured call against a declared schema, is now the default, and tau-bench’s authors found in June 2024 that it beat both text-formatted ReAct and plain acting across every model they tested. CodeAct (Xingyao Wang and colleagues, 1 February 2024, ICML 2024) tested the third option, code as the action language, on 82 multi-tool tasks across 17 models. With gpt-4-1106-preview, code actions succeeded 74.4 percent of the time in 5.5 turns, where JSON actions succeeded 52.4 percent in 7.6 turns and text 53.7 percent in 7.7. The gain widened with model strength and reversed for single atomic calls, where JSON scored 82.7 against code’s 76.7. The rule the data supports: JSON for one call, code when the action composes several.

The protocol. On 25 November 2024 Anthropic released the Model Context Protocol, an open standard for “two-way connections” between tools and model applications, with the problem stated as “Every new data source requires its own custom implementation”. The protocol carries JSON-RPC messages between a host, its clients and servers, and it defines three primitives that map onto the three parties: tools are “model-controlled”, resources are “application-driven”, and prompts are “user-controlled”, typically surfaced as slash commands. The specification has always put the human on the stop seam: “there SHOULD always be a human in the loop with the ability to deny tool invocations.” The 2026-07-28 revision, the latest as this essay is dated, changed the tool seam itself. Protocol-level sessions and the handshake were removed; the specification’s own changelog says “Make MCP stateless”. Any state a server needs the model to carry is now “explicit, server-minted handles passed as ordinary tool arguments”. Roots, sampling and logging were deprecated with a twelve-month window; a discovery call and a tasks extension were added; servers are told to return tools in deterministic order because it “improves LLM prompt cache hit rates”, and clients are told that tool annotations are untrusted unless the server is. I will take the protocols apart in a later series. For this essay the point is structural: the server no longer remembers anything for the model, so the loop does, and that pushes work onto the context seam.

The interface is a design surface, and the ablations prove it. SWE-agent (John Yang and colleagues at Princeton, 6 May 2024) introduced the term agent-computer interface for the argument that “Human user interfaces are not always suitable as agent-computer interfaces”. It gave GPT-4 Turbo a shell, a file viewer, a search and an editor built for a model rather than a person, and resolved 12.47 percent of the full SWE-bench set and 18.00 percent of the Lite split, against 2.67 percent for retrieval-augmented generation and 11.00 percent for a plain shell. The ablations on Lite are the part worth memorising. Removing the linter from the edit command dropped the score from 18.0 to 15.0; removing the edit command entirely dropped it to 10.3. A file viewer showing 100 lines scored 18.0; 30 lines scored 14.3 and the whole file 12.7. Keeping only the last five observations in context scored 18.0; keeping the full history scored 15.0. An iterative search tool that returned one hit at a time scored 12.0 because the agent would “look through every match exhaustively”. And the run had a stop rule at the tool seam: a $4 budget per instance, after which existing edits were submitted automatically.

Anthropic’s January 2025 note on its SWE-bench Verified result (49 percent with the second Claude 3.5 Sonnet) is the minimal counterpoint: two tools, bash and a string-replacement editor, a 200,000-token window, and the rule “We continue to sample until the model decides that it is finished, or exceeds its 200k context length.” The authors state the design philosophy as “give as much control as possible to the language model itself”, and they report what that costs: in failed runs “the model kept trying until it ran out of context.” The tool design details, an absolute path on every call, an error on a non-unique match so the model retries, are the agent-computer interface again. Its September 2025 guide to writing tools adds numbers for the result side of the contract: Claude Code caps tool responses at 25,000 tokens by default, and a detailed response that used 206 tokens carried the same information as a concise one that used 72. Consolidate tools (one schedule_event instead of list and create), namespace them, return readable identifiers, paginate, and write error messages that tell the model how to fix the call. The guide’s warning matches OpenAI’s tool-overload number from the other direction: “More tools don’t always lead to better outcomes.”

Code as the action language is now a product, and its numbers are large. The CodeAct result was published on 4 November 2025 as “Code execution with MCP”. The problem is that most clients “load all tool definitions upfront directly into context”, and an agent with access to thousands of tools must “process hundreds of thousands of tokens before reading a request”; every intermediate result also passes through the model, so a two-hour transcript copied from one tool to another costs 50,000 tokens twice. Presenting the servers as a filesystem of code modules and letting the model write a script that calls them cut one task “from 150,000 tokens to 2,000 tokens, a time and cost saving of 98.7%”. A spreadsheet filter run in code means the agent “sees five rows instead of 10,000”. Three weeks later, on 24 November, the same ideas shipped on the developer platform. A tool-search tool that loads definitions on demand took a five-server setup from about 77,000 tokens of definitions before any work to about 8,700, an 85 percent reduction, and raised accuracy on an MCP evaluation from 49 to 74 percent for Opus 4 and from 79.5 to 88.1 for Opus 4.5, because the model was no longer choosing among tools it could barely see. Programmatic tool calling, where the model writes code that calls several tools and only the final result enters its context, cut average token use on complex research tasks from 43,588 to 27,297, with the note that twenty tool calls in one code block “eliminate 19+ inference passes”. The guidance on when not to is as useful as the numbers: tool search for more than ten tools or more than 10,000 tokens of definitions, not for fewer; programmatic calling for large datasets and three or more dependent calls, not when the model must reason over every intermediate result.

Computer use is a tool whose result is pixels. When Anthropic announced computer use on 22 October 2024, the loop was the same loop: screenshot in, click or keystroke out, repeat. Claude 3.5 Sonnet scored 14.9 percent on OSWorld in the screenshot-only setting, against 7.8 for the next system, and 22.0 percent when allowed more steps, with the honest description “at times cumbersome and error-prone”. OpenAI’s Computer-Using Agent, announced on 23 January 2025, scored 38.1 on OSWorld and 58.1 on WebArena against human baselines of 72.4 and 78.2, and recorded the sentence that ties the pattern to the stop seam: “CUA’s performance improves when more steps are allowed.” Operator was “trained to ask for user confirmation before finalizing tasks with external side effects”, declined banking transactions, required active supervision on sites like email, and ran a monitor model that could pause a task. Those are three stop rules bolted onto a tool.

I wrote about where this had reached by June in The browser is the API: Google had made computer use a built-in tool of Gemini 3.5 Flash on 24 June, scoring 78.4 on OSWorld-Verified against the suite’s 72.36 percent human baseline, and the controls I asked for were a sandbox, an identity, a policy gate, a recorder, and per-task budgets of steps, tokens, minutes and money that abort into a human queue rather than retrying. Nothing in the four months since has changed that list. The per-step economics did change: Haiku 5.5, on 7 October 2026, scored 72.4 percent on the offline subset of OSWorld 2.1 at a tenth of a dollar per million input tokens, a suite that is not comparable to the old OSWorld but a price that is. The computer-use pattern is the tool seam at its most expensive, because each observation is an image and each action is a guess about where the button went, and it is the stop seam at its most important, because the tool can buy things.

Seam three: the context window

The context window is the only memory the model has, and every pattern at this seam is a decision about what to put in it, what to take out, and where the rest lives. Anthropic’s September 2025 essay on context engineering defines the discipline as “the set of strategies for curating and maintaining the optimal set of tokens (information) during LLM inference”, names the failure it guards against as context rot, the decline in recall as tokens accumulate, and gives the rule I would keep: “the smallest set of high-signal tokens that maximize the likelihood of your desired outcome”. Agents, in that essay, are simply “LLMs autonomously using tools in a loop”, which is the definition this series uses.

The tiers. The vocabulary comes from MemGPT (Charles Packer and colleagues at Berkeley, 12 October 2023), which treated the window as RAM and everything else as disk. Main context is the prompt: system instructions, a working context the model can edit, and a first-in-first-out queue of messages whose head holds “a recursive summary of messages that have been evicted”. External context is archival and recall storage reached through function calls, with a “memory pressure” warning when the queue nears its limit and an interrupt mechanism so the model can chain calls. On a deep-memory retrieval test the design took GPT-4 from 32.1 percent to 92.5. Two years on, every serious harness has the same tiers under different names. Anthropic’s September 2025 platform release gave the Claude API context editing, which “automatically clears stale tool calls and results from within the context window”, and a memory tool that “operates entirely client-side through tool calls” against files. On an internal agentic search evaluation the two together improved performance by 39 percent over baseline; context editing alone gave 29 percent; and on a 100-turn web search evaluation, editing let workflows finish that otherwise failed while “reducing token consumption by 84%”. Claude Code’s documentation describes the same order of operations: “It clears older tool outputs first, then summarizes the conversation if needed.” OpenAI’s developer blog in February 2026 described compaction that “runs automatically in-stream” when context crosses a threshold, and called it “a default long-run primitive, not an emergency fallback”. The tiers, from the inside out: the live window; cleared tool results; a rolling summary; files on disk the model reads back on demand; and a sub-agent’s separate window whose only return is a summary.

Files are the cheapest tier and the most durable. Manus published its lessons from building an agent product on 18 July 2025, after rebuilding its framework four times, and the first lesson is about money. The typical Manus task takes around 50 tool calls, the input-to-output token ratio is around 100 to 1, and on the model it used, cached input cost $0.30 per million tokens against $3.00 uncached, “a 10x difference”. So the context must be append-only with a stable prefix: no timestamps at the top of the system prompt, no tool definitions that change mid-task (mask them with logits instead, with shared prefixes such as browser_ and shell_), and no rewriting of history. Its next lesson is to use the filesystem as context, because it is “unlimited in size, persistent by nature, and directly operable by the agent itself”, with compression that is restorable: keep the URL, drop the page. The third is recitation: a todo file rewritten each step keeps the goal in the model’s recent attention. The fourth is to keep failed actions in context so the model updates its beliefs. I made the same point about caches in my tokens-to-done essay in July: append-only histories cache and rewritten ones do not, so compaction, which rewrites, trades cache hits for window space, and the trade should be made deliberately and late.

Anthropic’s October 2025 Agent Skills design is the file tier made into a loading discipline. A skill is a directory with a SKILL.md file; only its name and description are loaded into the system prompt up front, the body is read when relevant, and bundled files or scripts are used as needed, so that “the amount of context that can be bundled into a skill is effectively unbounded” and a script can run “without loading either the script or the PDF into context”. Claude Code applies the same progressive disclosure to tools: MCP tool definitions “are deferred by default and loaded on demand via tool search”, and a memory file is loaded only to its first 200 lines or 25 kilobytes. The pattern is just-in-time retrieval: give the model identifiers and a way to fetch, not the data.

Sub-agents are context isolation, not delegation. The reason to spawn a second agent inside a single-agent system is almost never that the task needs two minds. It is that the second window can absorb tens of thousands of tokens of search results and return “a condensed, distilled summary of its work (often 1,000-2,000 tokens)”. Anthropic’s Agent SDK documentation says the same thing in one sentence: “only its final message returns to the parent.” The cost is also documented. The June 2025 multi-agent research post reports that agents “typically use about 4x more tokens than chat interactions” and multi-agent systems “about 15x more tokens than chats”, and that in its evaluation token usage alone explained 80 percent of the variance in performance. That number belongs to Part 2, but it is set at this seam: the budget you spend on a sub-agent buys context, and context is what buys performance.

Reset or compact: the harness assumption that went stale. The clearest lesson of the past year at this seam is that a harness encodes a belief about the model, and beliefs expire. Anthropic’s November 2025 note on long-running harnesses described the two ways a session fails over many context windows: the agent “tended to try to do too much at once” and ran out of context mid-feature, and later sessions would “declare the job done” prematurely. The fix was a shift-handover design: an initialiser agent writes a feature list as JSON with every entry marked unpassed (JSON because models overwrite it less readily than Markdown), a progress file, and an init script; every later session begins by reading the git log, the progress file and the feature list, runs a basic test, works on one feature, and leaves the code clean. The note’s image is “each new engineer arrives with no memory of what happened on the previous shift”. The 5 February 2026 account of sixteen agents building a C compiler took this to its limit: every iteration started “a fresh Claude Code session in a fresh container”, orienting from READMEs and progress files, with no orchestrator at all, and the result was a 100,000-line compiler that boots Linux, after nearly 2,000 sessions, 2 billion input tokens, 140 million output tokens, and just under $20,000.

Then the belief expired. The March 2026 harness-design note and the April 2026 Managed Agents note both describe “context anxiety”, a model “wrapping up work prematurely as they approach what they believe is their context limit”. On Sonnet 4.5 the fix was context resets: clear the window and start a fresh agent with a structured handoff, because compaction summarises in place and “doesn’t give the agent a clean slate”. On Opus 4.5 “the behavior was gone. The resets had become dead weight.” The sentence I would print on the first page of any harness repository is from the March note: “every component in a harness encodes an assumption about what the model can’t do on its own.” The same note gives the price of getting the assumption wrong in the other direction: a retro game maker built solo took 20 minutes and $9, and the full harness with planner, generator and evaluator took six hours and $200, “over 20x more expensive”, and the harness was “worth the cost when the task sits beyond what the current model does reliably solo”, which the game maker was not.

“every component in a harness encodes an assumption about what the model can’t do on its own.”

The Managed Agents design goes one step further and makes the session itself a tier: “an append-only event log” that lives outside the window, from which a restarted harness resumes “from the last event”, and whose slices the model can read or rewind. It also notes the hazard of every compaction scheme: “irreversible decisions to selectively retain or discard context can lead to failures.” My reading is that the context seam has settled into four moves, in the order you should reach for them. First, clear tool results, which Anthropic’s essay calls “one of the safest lightest touch forms of compaction”. Second, keep notes in a file the model reads back. Third, isolate a noisy sub-task in a sub-agent. Fourth, and only when the first three fail, compact the window, tuning “for recall first, then for precision”. Resetting the whole session is a fifth move that was right for one model generation and wrong for the next, which is the strongest argument I know for keeping every such move behind a flag.

Seam four: the stop condition

Every loop ends. The design question is whether it ends because something checked the work, or because something ran out. I count seven kinds of stop in the sources, and most production agents run on the weakest two.

The first is the model’s own say-so: it returns text without a tool call, and the runner treats that as final. OpenAI’s SDK makes this the default exit, “it produces text output with the desired type, and there are no tool calls”, and the Claude Code documentation names the trap: “looks done” is the only signal available. The second is the ceiling: a maximum number of turns, which the OpenAI SDK raises as MaxTurnsExceeded, Google’s LoopAgent takes as max_iterations, and Claude’s Agent SDK takes as maxTurns, returning the output “marked as partial”. The third is the end of the window, which Anthropic’s January 2025 SWE-bench harness used as its only backstop, and in which failed runs ended because “the model kept trying until it ran out of context.” The fourth is money: SWE-agent’s $4 per instance, Claude’s Agent SDK maxBudgetUsd, and the spend cap in Anthropic’s 8 October 2026 reference automation, set at “three to five times the cost of a normal run” and tightened later, with the rule that “A run that hits its cap pauses instead of failing.” The fifth is a structured output or a final-output tool: the loop ends when the model produces a value that matches a schema, which is the exit condition OpenAI’s guide lists first and the one I prefer, because it can be validated. The sixth is a verifier: a test suite, a linter, an evaluator agent, Claude Code’s Stop hook that “blocks the turn from ending until it passes”, or a goal condition that a separate evaluator re-checks after every turn. The seventh is a person: the checkpoint Anthropic’s taxonomy recommends “when encountering blockers”, the confirmation Operator demands before side effects, the human the MCP specification says SHOULD always be able to deny a call, and the “two humans have to approve the deploy” that Block described on 8 October 2026 for its migrations of a thousand pull requests orchestrated by Claude Fable.

The first three stops are failures of design dressed as features. The last four are the pattern. A loop should end on a verified output or a cap, and a cap should pause, not fail, so a person can decide whether to extend it.

The metric for the stop seam is pass^k. If you measure an agent by whether it succeeded once, you are measuring the model. If you measure it by whether it succeeds every time, you are measuring the loop. Sierra’s tau-bench (Shunyu Yao, Noah Shinn, Pedram Razavi and Karthik Narasimhan, 17 June 2024) introduced the metric: pass^k is “the chance that all k i.i.d. task trials are successful, averaged across tasks”, as against pass@k, the chance that at least one succeeds. Anthropic’s January 2026 note on agent evaluations gives the arithmetic in one line: at 75 percent per trial, three trials pass together 42 percent of the time, and “By k=10, they tell opposite stories: pass@k approaches 100% while pass^k falls to 0%.”

The decay is steep and it is not random. In tau-bench’s retail domain, with 115 tasks, 7 write and 8 read tools and a cap of 30 agent actions per task, the best model of June 2024, gpt-4o with function calling, scored 61.2 percent on a single trial, and the paper reports that its “pass^8 drops to < 25%”. If failures were independent coin flips at 61.2 percent, pass^8 would be about 2 percent (my arithmetic). It is far higher than that because failures cluster on particular tasks, which is good news for a platform team: the hard tasks can be found and routed. The successor benchmark, tau2-bench (Victor Barres and colleagues, 9 June 2025), added a telecom domain where the user holds tools too, and ran each task four times. Reading its Figure 3: gpt-4.1 scored 0.74, 0.64, 0.58, 0.53 for k from one to four in retail, 0.56 down to 0.40 in airline, and 0.34 down to 0.19 in telecom; Claude 3.7 Sonnet scored 0.79 down to 0.60 in retail and 0.49 down to 0.25 in telecom. The paper’s own summary of the step dependence is the sentence I would want every product manager to read: “agent performance drops as the number of actions increases, reaching close to zero for > 7 actions”. Its ablation is just as telling. Give gpt-4.1 the plan in advance and telecom pass^1 rises from 0.34 to 0.67; remove the simulated user and it rises to 0.52; the gap between a cooperative environment and a real one is 18 points for one model and 25 for another.

By March 2026 the same team had a knowledge domain, tau-Knowledge (Quan Shi and colleagues, 4 March 2026), with a bank’s 698 documents and tasks that need 18.6 of them on average. The best model, with a terminal to search, scored 25.52 pass^1 and the best pass^4 was 13.40. Given the correct documents in context, the best model scored 39.69, falling to 26.80 at k equals four. The reliability of the stop decision is still, in 2026, the number that halves when you ask for it twice.

Three things follow for the design of the seam. First, measure pass^k on your own tasks, not pass@1 on someone else’s; Anthropic’s evals note suggests that “20-50 simple tasks drawn from real failures is a great start”, graded on the end state, from a clean environment each trial. I described the bench I would build in July, and its three reported numbers, cost per task, success rate and escalation rate, are the stop seam’s dashboard. Second, cap the mutating actions, not the steps. SABER’s finding that each deviation in a state-changing action cuts the odds of success by up to 92 percent on airline and 96 percent on retail, while read-only deviations cost under 10 percent, means the step budget should count writes. tau2-bench’s “close to zero for > 7 actions” is a number about writes too. Third, the budget must pause into a queue a person can see. Both of my earlier arguments, that a step cap set too tight “raises the escalation rate” and that an always-on agent needs a kill switch drilled monthly, are statements about what happens after the stop fires.

The stop you never need: do not open the loop. I promised to return to Agentless, because it is the cleanest argument that the best stop condition is a pipeline with three fixed phases. Its 32.00 percent on SWE-bench Lite at 70 cents and 78,166 tokens per issue, against SWE-agent’s 23.00 percent at $1.62 and 521,208 tokens, is not a story about a weaker agent; it is a story about a task that decomposes. Localise the file, propose patches, run the tests, pick the patch that passes. Each phase has a verifier, so no phase needs to decide when it is done. The paper also audited the benchmark and found 4.3 percent of problems carried the exact patch in their description and 10.0 percent were missing critical information, which is the kind of thing you learn only by looking at the tasks, and which an agent loop would have paid to rediscover one trajectory at a time. OpenAI adopted the pipeline to report its own models’ coding scores. The question to ask before building an agent is the one its title asks, and the answer is yes less often than the demos suggest.

Caps are now platform settings, with defaults you should read. The Claude Agent SDK documents three ceilings besides maxTurns: a nesting depth of three layers of sub-agents below the main agent, twenty sub-agents running at once, and a spend cap that is unlimited by default and ends the run with an error subtype when reached. OpenAI’s runner has max_turns with no default stated on its page, and a websocket session that ends after 60 minutes. Google’s LoopAgent needs max_iterations or an escalate signal, or it runs forever. Anthropic’s reference automation of 8 October 2026 is the best small example of a loop with every seam decided: fresh sandbox per run, a memory file read fresh each time, eight numbered run steps that end with an explicit stop, a re-check of the live source just before posting, idempotent posting that checks for today’s title first, and a cap that pauses. None of that is clever. All of it is written down.

A worked example: a refund agent, seam by seam

Take the most ordinary agent a platform team gets asked for: a customer-service agent that can refund an order. I will trace it through the four seams with the arithmetic shown, using the shapes from tau-bench’s retail domain, which has 7 tools that write and 8 that read, a database of 500 users, 50 products and 1,000 orders, and a cap of 30 agent actions per task, and the October 2026 rate cards for Claude Sonnet 5.5 ($2 per million input tokens, $10 output, cache reads at $0.10) and Claude Haiku 5.5 ($0.10 input, $0.50 output, cache reads at $0.01), as published with Haiku 5.5 on 7 October. The sizes of prompts and results are my assumptions, stated in the figure, and the point is the shape of the bill, not its last cent.

The model seam. The system prompt carries the refund policy and the fifteen tool definitions. Say the stable prefix is 6,000 tokens. Each turn the model reasons briefly and emits one call; say 250 output tokens a turn. A typical trace has nine model calls: identify the customer, fetch the order, fetch the product, consult the policy (a think step, or extended thinking, which the think-tool table says pays in policy-heavy domains), confirm the details with the customer, cancel the order, issue the refund, check the result, and close. Two of those nine are bounded decisions, does this order qualify and did the refund post, that a small model or a classifier could take; the rest are judgment or conversation.

The tool seam. Native function calling, not text. The two write tools, cancel and refund, are the mutation gate: SABER’s numbers say that a deviation on either costs up to 96 percent of the odds of success on retail, so the harness requires a targeted reflection before each, and the reflection reads the order record, not the model’s memory of it. The read tools return concise results, a handful of fields with readable identifiers, and the refund tool returns an explicit confirmation or a guiding error, because a non-unique match or an empty result should make the model retry, not guess. The tools come from an MCP server, and under the 2026-07-28 revision the order handle the server mints is carried in the model’s context from step two to step seven; nothing on the server remembers it.

The context seam. Append-only. The prefix is written to the cache on the first call and read from it on the other eight. Tool results are kept short and cleared after the refund posts; the policy is never summarised. Nothing in this trace needs a sub-agent or a file; a task that needs more than 30 actions is, by the benchmark’s own cap, a task that should be escalated rather than compacted.

The stop seam. The loop ends on a structured output: a refund record with an order identifier and an amount, which a verifier checks against the order total and the policy before the message to the customer is sent. The step cap is 30 actions, the write cap is two, and a cap that trips pauses the task into a human queue with the transcript attached. The run is graded on its end state, four trials per task, and the number reported is pass^4.

The arithmetic. Nine calls with a 6,000-token prefix and a history that grows by about 400 tokens a turn add up to 68,400 input tokens and 2,250 output tokens. On Sonnet 5.5 without caching that is about 16 cents a task; with the prefix cached it is about 7 cents; on Haiku 5.5 for every step it is under a cent. tau-bench measured the same shape in June 2024: 95.9 percent of the agent’s bill was input, “mainly due to long system prompt (domain policy + function definitions)”, and the gpt-4o agent cost $0.38 per task. The number that matters, though, is not cost per task but cost per task that ends in the right state. At a retail pass^1 of 0.74, the best figure in tau2-bench’s table, a 7-cent run costs about 9.5 cents per success on average, and roughly one task in four lands in the human queue, where the cost is a person’s time. Halve the escalation rate and you have done more for the bill than any model swap. That is why the stop seam, not the model seam, is where I would spend the engineering.

The patterns, by seam

The table collects every pattern in this essay with the seam it belongs to, the problem it solves, the source that introduced or measured it, the failure mode the source reports, and when not to use it. It is meant to be copied into a design review.

What I would build, and in what order

These are the rules I apply when a team brings me an agent design. They are ordered by how often the missing one turns out to be the problem.

Write the stop condition first. Before the prompt, before the tools.

1. Write the stop condition first. Before the prompt, before the tools. The loop ends on a validated structured output or on a cap, and a cap pauses into a queue a person can see. If the only stop is the model saying it is done, you have not finished the design.
2. Count writes, not steps. Budget the state-changing actions separately, gate each with a reflection that reads the record it is about to change, and treat tau2-bench’s seven-action cliff as the working limit for one loop. Longer tasks are several loops with a handoff.
3. Measure pass^k on your own tasks. Twenty to fifty tasks drawn from real failures, four trials each, graded on end state from a clean environment, reported with cost per task and escalation rate. Report pass^4 to the business, never pass@1.
4. Do not open the loop if a pipeline will do. If the task decomposes into fixed phases with a verifier at each, build the workflow. Agentless beat the agents on cost by a factor of two to four and on resolution rate by nine to fourteen points, and the gap came from never having to decide when to stop.
5. Reflection reads an external signal or it is deleted. A test, an interpreter, a search result, a schema, a separately prompted evaluator. A model re-reading its own answer lowers accuracy and triples the calls; the evidence has been in the literature since October 2023.
6. Design the tool contract as carefully as the prompt. Concise results, readable identifiers, errors that say how to fix the call, consolidated tools with distinct purposes, definitions loaded on demand once there are more than ten, and code as the action language once calls compose. The ablations move scores by three to eight points each, which is more than most model upgrades.
7. Keep the context append-only and the prefix stable. Clear tool results before you summarise; keep notes in files; isolate noisy sub-tasks in a sub-agent; compact last and late. Every rewrite of history is a cache miss, and in a 100-to-1 workload the cache is the bill.
8. Put every harness assumption behind a flag. Context resets were right for one model generation and dead weight for the next. A harness is a set of beliefs about what the model cannot do, and each belief needs a date and a way to switch it off.
9. Route the bounded decisions to a bounded model. Most steps in a loop are classifications, extractions and checks. Send them to a small model or a trained classifier and keep the reasoning model for judgment; the loop is the routing workflow applied one step at a time.
10. Record the trace in a schema that names the seams. One span per model call, tool call and sub-agent, with tokens and cost on each, so that when pass^k moves you can see which seam moved it. The observability that Anthropic put on its platform on 14 October 2026 spans exactly these events, and the incident note of 9 October is what it looks like to read such traces after the fact.

The pattern is the seam

The two episodes I cited as evidence, from the same company five days apart, are worth returning to. One cut its own agents off from the live internet because they had found ways through the tool seam that nobody intended; the other described a merge queue handling 30,000 agent-written changes a day because the stop seam had moved from the engineer to the system. Neither is a story about a pattern failing. Both are stories about a seam being redrawn by the people who understood it best, after the evidence came in. That is what this discipline looks like from the inside. The patterns in this essay are not a menu; they are the small set of decisions available at four places in a short program, and the measured record says which decisions hold. Part 2 takes the same four seams and asks what happens when there are many loops, and many windows, and the decisions have to travel between them. The short answer is that most of them do not.