Brain and Hands: Split the Agent Loop From the Sandbox It Runs Code In

The first decision when an agent stops running on a laptop and starts running as shared team infrastructure is a topology: split the brain (the agent loop that decides) from the hands (the ephemeral, isolated sandbox where the model's code actually runs), and join them through a durable session log that lives outside both. Anthropic adopted exactly this split and reported that p50 time-to-first-token dropped roughly 60% and p95 dropped over 90% (Scaling Managed Agents). Shopify reached the same three-part shape from a separate codebase, and stated the safety payoff in one line: "The agent doesn't live where the code lives," so "the agent loop is not in the same blast radius as rm -rf" (Shopify case study). Every later boundary, the sandbox, the credential broker, the egress proxy, hangs off this split. The handbook is funded by Wallfacer Technologies, named once below as one implementation of this topology and graded on its published documentation.

The terms here are the same ones the reference architecture uses: brain, hands, session. The pages that follow build each piece.

The brain decides; the hands run code; the session remembers

Three components, three jobs, and the value is in the seams between them.

The brain is the agent loop, also called the harness: the code that calls the model, reads its tool calls, and routes them to infrastructure. It is stateless. It holds no irreplaceable state, runs nowhere near the code being edited, and reaches the execution environment through a single tool signature. Anthropic's is execute(name, input) -> string, so the harness "doesn't know whether the sandbox is a container, a phone, or a Pokémon emulator" (Anthropic).

The hands are an ephemeral, isolated sandbox: a fresh execution environment with the toolchain, the repo checkout, the shell, provisioned for the task and torn down after. This is where the model's generated code, which is untrusted by construction, actually runs. Shopify's hands are "the sandbox (fs, shell, repo checkout)," ephemeral, with the harness deliberately outside it (Shopify case study).

The session is an append-only event log stored durably outside both the brain and the hands. Anthropic calls it "the append-only log of everything that happened" and writes to it with emitEvent(id, event) (Anthropic). Shopify backs it with Postgres: "the canonical truth about what's happened so far," so "the work picks up where it left off because the work lives in Postgres, not in memory" (Shopify case study).

The coupled design makes every session a pet you cannot afford to lose

Anthropic started with all three in one container and named the failure precisely: they had adopted a pet. "If a container failed, the session was lost. If a container was unresponsive, we had to nurse it back to health" (Anthropic). Debugging was nearly impossible, because the only window in was a WebSocket event stream that "couldn't tell us where failures arose," so a harness bug, a dropped packet, and a dead container all looked the same. Opening a shell to investigate was unsafe, because "that container often also held user data."

Pulling the harness out of the container makes both halves cattle, interchangeable and disposable, and the recovery recipes are the artifact worth copying.

• Hands die. The harness "caught the failure as a tool-call error and passed it back to Claude." A retry reinitializes a fresh container with provision({resources}). No nursing.
• Brain dies. "Nothing in the harness needs to survive a crash" because the session log sits outside it. A new harness boots with wake(sessionId), calls getSession(id) to retrieve the log, and resumes from the last event (Anthropic).

Shopify's version is the same mechanism on Postgres: when a session goes idle the process exits, and the next interaction spawns a fresh "session cell," possibly on another host, rehydrated from the log (Shopify case study). The point of the split is not that crashes stop happening. It is that a crash becomes a replay on a new machine instead of a lost task.

The separation is the safety boundary, not just a resilience trick

Three properties fall out of the split, and each is a reason a team scaling agents past one laptop needs it.

Blast-radius isolation. The model's generated code is untrusted, so it has to run where its worst-case behavior is contained. When the brain lives outside the sandbox, a runaway rm -rf, a prompt injection, or an infinite loop is bounded by the hands and cannot take the agent loop or the session log with it. Shopify states it directly: "the agent loop is not in the same blast radius as rm -rf" (Shopify case study). Stripe expresses the same boundary as an environment property, running each agent in a quarantined devbox where "any mistakes an agent might make are confined to the limited blast radius of one devbox" (Stripe case study). The credential half of this boundary, keeping tokens out of the sandbox entirely, lives in Credentials and Secrets.

Reproducibility. Because the hands carry no irreplaceable state and the session holds the full history, the same task can be re-run on a fresh, identically built sandbox. The environment is defined, not hand-tended, which is what makes a failed run debuggable by re-running it rather than autopsying a frozen machine. The build-plane side of this is versioned images and where the hands actually run is Placement.

Wake and replay on a fresh machine. The session log is the durable spine: a crashed or idle brain wakes on any available host and replays from the last event. Resilience and audit are the same artifact, because the log that resumes the work is also the record an auditor reads, which Prove It Holds takes up as the audit-trail property and Build the Environment details in The Session.

One more payoff is durability against model churn. Harnesses "encode assumptions about what Claude can't do," and those assumptions go stale as models improve. Anthropic's context-reset workaround for Claude Sonnet 4.5 became "dead weight" on Claude Opus 4.5 (Anthropic). When the brain is decoupled, a model upgrade is a swap, not a re-architecture.

The 90% latency drop comes from provisioning hands only when the brain needs them

The headline number is not a faster model. It is the removal of dead time at the start of a session. When the brain lived in a container, "many brains required as many containers," and "no inference could happen until that container was provisioned." Every session paid the full setup cost up front, even one that "would never touch the sandbox," because it still had to clone the repo and boot the process (Anthropic).

Decoupling means "containers are provisioned by the brain via a tool call only if they are needed," so inference starts as soon as the orchestration layer pulls pending events from the session log. The result, stated flat: "our p50 TTFT dropped roughly 60% and p95 dropped over 90%" (Anthropic). Anthropic publishes the percentage reductions, not absolute seconds, so those are the figures to quote. A stateless harness pool that lazily attaches a sandbox gets the same shape of result regardless of model or vendor.

The split's steady-state cost is a network round trip on every tool call

The 60%/90% numbers are a session-start win, paid once. The same boundary that delivers them puts a network on the tool-dispatch path for the rest of the session. When brain and hands shared a machine, dispatching a tool call was an in-process hop; once they are separate machines, every execute(name, input) crosses the wire.

A mediated chain (harness to orchestrator to sandbox host to sandbox) runs on the order of 100–200 ms per call with connections kept alive, so a turn that makes dozens of tool calls carries several seconds of pure network overhead. Model inference still dominates the turn, so the trade is worth making, but the cost scales with call count. Nothing in the published record reports a per-call dispatch cost, so budget this from your own topology.

The lever is hop count. Each mediation layer on the dispatch path (a control plane that authorizes the call, a proxy that reaches into the sandbox host) adds its own round trip to every call, so keep the path as short as isolation allows and reuse connections across calls. The longest chain is the relayed path to a tool server colocated inside the sandbox, which MCP server placement treats as a cost to pay only when the resource cannot leave the box.

One brain per task is the topology to default to; many brains is an explicit choice

The split supports a fan-out the coupled design could not: "because no hand is coupled to any brain, brains can pass hands to one another" (Anthropic). The capability exists. Whether to use it inside a single task is a separate question, and the published record is one-sided.

Cognition's Walden Yan made the field's clearest argument against multi-agent fan-out within a task. His recommendation is blunt: "The simplest way to follow the principles is to just use a single-threaded linear agent," because "actions carry implicit decisions, and conflicting decisions carry bad results" (Don't Build Multi-Agents, June 12, 2025). Two parallel writer agents on one task encode assumptions the other never sees, and a final agent inherits the job of merging two miscommunications. Yan's verdict on the state of the art: in 2025, "running multiple agents in collaboration only results in fragile systems." He frames it as a reliability claim about the current generation, not a law, and expects cross-agent collaboration to improve as single-threaded agents get better at communicating.

The default this topology recommends, then, is one brain per task, fanning out across tasks rather than within one. That is how the high-throughput teams run: Stripe engineers run "half a dozen minions at once," each in its own devbox (Stripe case study). The boundary that keeps those parallel brains from colliding is one isolated environment per task, which is One environment per task.

Read-only fan-out is the exception that does not trip Cognition's rule, because reviewers judge a fixed artifact and emit opinions rather than edits. Conflicting opinions aggregate into a stricter gate, not a broken codebase. LangChain's Open SWE bakes this into its framework, spawning isolated subagents via a task tool while "subagent isolation" keeps each child's context from polluting the others (Open SWE, March 17, 2026). The orchestration patterns for reviewer fan-out belong to Manage the Work, not the environment topology.

One fence: the corpus documents no production system that reliably fans out multiple writer agents within a single task, and Cognition's argument, while corroborated by how the throughput teams actually deploy, is over a year old in a fast-moving field. If a reliable cooperating-writer system ships, the one-brain-per-task default narrows.

The topology mapped to the pages that build it

A managed substrate frames this topology cleanly. Wallfacer is one published implementation: per-task isolated VMs as the hands, an external append-only session-event log as the session, and a control plane as the brain, with split-trust secrets where the control plane holds the key-encryption key and the agent never sees plaintext. That maps onto the brain/hands/session split by construction, though its AI actions are attributed per agent today where per-initiating-human is the bar, and it publishes no customer-scale throughput numbers, so its row is a design to evaluate rather than results to bank (Wallfacer case study). Shopify is the strongest published corroboration that the shape is convergent rather than one vendor's opinion: River and a separate PR-review profile ride the same substrate, because "River is one profile. Aquifer is the platform" (Shopify case study).

With the topology fixed, the rest of Build the Environment hardens each piece: Sandboxing sets the isolation strength of the hands, The Session makes the log resilient and auditable, One environment per task draws the boundary that keeps parallel brains from colliding, and Placement decides where the hands run relative to the code and the network. The deepest single source on the split itself is the source report at Anthropic: Decoupling the Brain from the Hands.