The Reference Architecture: Seven Components Independent Companies Converged On

Seven companies built coding-agent platforms independently and arrived at the same architecture. Anthropic split the agent loop from the container and dropped p95 time-to-first-token over 90% (Scaling Managed Agents). Shopify ships 1 in 8 merged pull requests coauthored by an agent whose harness "doesn't live where the code lives." Stripe merges over 1,300 fully unattended agent-written PRs per week, each confined to "the limited blast radius of one devbox." None of them cites the others. They converged because the constraints are the same once an agent runs as shared team infrastructure rather than on a laptop. The handbook is funded by Wallfacer Technologies, which appears below as one implementation of this architecture, graded on its published documentation alongside the rest.

The architecture in one pass

A stateless brain (the agent loop, or harness) runs nowhere near the code and calls everything else as a tool. It writes its state to a durable session log held outside any one machine, so a crash resumes by replay rather than restart. When the brain needs to run code it provisions a pair of hands: an ephemeral, isolated environment per task, with the full toolchain and no persistent identity. The agent's generated code runs in those hands behind two boundaries it can never reach across. Credentials live outside the sandbox and are brokered in, and egress routes through a proxy that enforces an allowlist. The work is bound to an identity, a specific human of record, in the version-control plumbing. Advancing the work past a decision gate is a capability the agent does not have, and every event, decision, and approval lands in the same log that resumes the session, which is also the audit trail. Seven components, each a boundary or an interface, each replaceable without disturbing the others.

The three reports are the deepest single sources; this page reads across them and the broader published record.

The brain is stateless and runs nowhere near the code

The reasoning loop is decoupled from the code it edits and calls the execution environment as a tool with the signature execute(name, input) -> string. Anthropic started with the session, harness, and sandbox in one container and named the failure plainly: they had adopted a pet. A failed container lost the session; an unresponsive one had to be nursed back to health, and the only debug window could not say whether the fault was a harness bug, a dropped packet, or a dead container (Anthropic). Pulling the harness out made it cattle. A new one reboots with wake(sessionId), replays the log, and resumes from the last event.

That is recovery-triggered disposal, scoped to the session. A stricter variant does not wait for a failure. Because the harness holds no customer code and no secrets, it is cheap to rebuild: the platform destroys it after every turn and boots a fresh one, resumed from the same log. No harness process lives long enough to be worth compromising, and no state leaks between turns (per-turn brains).

Shopify reached the identical split from a separate codebase. Its harness, a Go agent loop, runs outside the sandbox: "The agent doesn't live where the code lives," so "the agent loop is not in the same blast radius as rm -rf." Two properties fall out of the split beyond resilience. Latency: provisioning hands only when the brain needs them, instead of paying full container setup on every session, is what dropped Anthropic's p50 time-to-first-token roughly 60% and p95 over 90%. Durability against model churn: harnesses encode assumptions about what a model cannot do on its own, and those assumptions go stale. Anthropic's context-reset workaround for Claude Sonnet 4.5 became "dead weight" on Claude Opus 4.5. When the brain is decoupled, a model upgrade is a swap, not a re-architecture. Build the Environment takes this apart in Brain and Hands.

The hands are ephemeral, isolated, and one per task

Each task gets its own environment in the cloud, carrying the same toolchain the company's engineers use, isolated from production and torn down after. Brex calls it a Remote Developer Environment and states the lesson bluntly: "Environment quality determines output quality." An agent without validation tooling is guessing. Stripe runs minions on the same devboxes its humans use, pre-warmed to spin up in 10 seconds and "isolated from production resources and the internet, so we can run minions on devboxes without human permission checks." Both treat the environment as cattle. The recurring thesis is "if it's good for humans, it's good for LLMs, too."

One environment per task is also what makes parallelism safe. Stripe engineers run half a dozen minions at once, each in its own devbox, because "any mistakes an agent might make are confined to the limited blast radius of one devbox." Brex notes that running 50 agents in parallel "requires thinking carefully about orchestration and environment isolation." The boundary you draw around a task decides how many agents can touch it safely, which Build the Environment works through in One environment per task and Sandboxing, and which Prove It Holds reads as the isolation property.

State lives in a durable log outside every machine

The session is an append-only event log stored durably outside the harness and the sandbox, and it does double duty. Anthropic stores every event with emitEvent(id, event) and exposes the log through getEvents(), so the brain can interrogate context positionally and a crashed harness can resume from the last event (Anthropic). Shopify backs the same idea with Postgres: "The work picks up where it left off because the work lives in Postgres, not in memory." When a Shopify session goes idle the process exits, and the next interaction spawns a fresh session cell, possibly on another host, rehydrated from the log.

The same artifact that makes the system resilient is the one that makes it auditable. Intercom's bar for an AI-approved change is that it be "labelled, logged, and queryable": review comments, approval decision, test results, and merge event all recorded, with "the evidence an auditor expects to see [being] the same whether a human or an AI approved the change." You do not build two systems. Build the Environment covers the state-and-resilience half in The Session; Prove It Holds reads the same log as the audit trail and shows how evidence accrues as a byproduct of running normally.

Credentials never reach the sandbox where generated code runs

The tokens the work needs are never reachable from the environment where the model's generated code executes. In Anthropic's coupled design, untrusted generated code ran in the same container as the credentials, so "a prompt injection only had to convince Claude to read its own environment," and an attacker holding those tokens could "spawn fresh, unrestricted sessions and delegate work to them." Narrow scoping is dismissed as a bet: it "encodes an assumption about what Claude can't do with a limited token, and Claude is getting increasingly smart." The structural fix is that the tokens are never reachable from the sandbox (Anthropic). Anthropic uses two patterns: a Git token wired into the local remote at clone time so push and pull work without the agent ever holding it, and OAuth tokens kept in a vault that the model reaches only through an MCP proxy keyed to the session.

Stripe makes the same boundary structural by running minions in a QA environment with "no access to real user data, Stripe's production services, or arbitrary network egress," so the credentials and the destructive surface simply are not present where the agent acts. Build the Environment details the brokering patterns and the split-trust design in Credentials and Secrets; Prove It Holds reads the boundary as least privilege.

Outbound traffic crosses an egress boundary the agent cannot widen

A separate boundary governs the network. Every major cloud agent platform routes outbound traffic through a proxy outside the sandbox that enforces a domain allowlist, and the only real divergence is whether the default ships open or closed. OpenAI's Codex blocks agent-phase internet access by default; Cursor's cloud agents ship with internet access on, with restriction as an opt-in; GitHub Copilot's coding agent limits access with a firewall by default and warns that disabling it raises "risks of exfiltration of code or other sensitive information." Stripe's "no arbitrary network egress" is the same boundary expressed as an environment property. Egress control is the leg that breaks the lethal trifecta even when the agent has read your private code and parsed an attacker's text, which Build the Environment covers in Egress Control.

The work is bound to a human, in the version-control plumbing

Agent work is attributed to a specific human of record by the system, not by convention. Brex states it as a governance principle: agent work "needs to be attributed back to an actual human and not just a bot." Intercom keeps accountability with a person regardless of who approved: "The human who ships the code remains accountable for the outcome," expected to watch the change go live and roll it back if it misbehaves. The binding holds only when it lives below the prompt: GitHub Copilot authors commits as the agent and adds the requesting developer as a Co-authored-by trailer, while Ramp's Inspect clones with an app token but opens every pull request with the requesting user's own GitHub token. Manage the Work builds this in Binding to the human on top of a distinct agent identity; Prove It Holds reads it as the attribution property.

A gate is a capability the agent does not have, and it leaves a record

Advancing past review is an action the agent cannot perform, and the action that does advance it is recorded. Three verbs are structurally removed from GitHub's coding agent: it cannot approve its own pull request, merge one, or mark one "Ready for review" (GitHub). A gate enforced this way means the author is never the approver, which is a property an auditor can check rather than a policy a team can drift away from. Intercom's PR-review agent is the other face of the gate: a separately built reviewer that decomposes review into independent sub-agents, refuses to approve large PRs, and offers an opt-out on every change ("the system is a tool, not a mandate"), with its controlled pilot reverting zero AI-approved PRs. Uber's uReview is the same pattern at a different scale, running on over 90% of the roughly 65,000 weekly diffs at Uber as a second, AI reviewer feeding into the human gate. Manage the Work assembles the gates starting at review as a capability boundary and author, never approver; Prove It Holds reads the enforced gate as segregation of duties.

The blueprint, in one table

Shopify published the substrate the others kept internal

Most teams describe one agent and leave the platform implicit. Shopify named the split: "River is one profile. Aquifer is the platform." Aquifer is "Shopify's internal platform for running AI agents," and a profile is "data: a system prompt, a set of skills, a set of extensions, a sandbox policy, model defaults." River (interactive), a separate PR-review profile, and a headless agent all ride the same substrate: durable Postgres event log, harness outside the sandbox, credentials proxy, one reproducible build plane. That is this page's seven components, derived independently and stated out loud. More in the Shopify case study and in-house convergence.

The same substrate framing is how to read a managed offering. Wallfacer is one published implementation: per-task isolated VMs, an external append-only session-event log, split-trust secrets where the control plane holds the key-encryption key and the agent never sees plaintext, per-session tokens scoped to the task creator for attribution, and customer-authored workflows with enforced human gates. It maps onto six of the seven compliance properties by construction, but AI actions are attributed per agent today where per-initiating-human is the bar, and it has published no customer-scale throughput or revert numbers, so its row is a design to evaluate rather than results to bank (Wallfacer case study).

Where this leaves the reader

Brex's verdict after running the loop across 400+ services is that "the gap between 'AI agents can do this' and 'AI agents are doing this reliably' is mostly an infrastructure problem." Build the Environment takes the brain, the hands, the session, and the two perimeter boundaries apart and bolts on the threat model that motivates each. Manage the Work wires up intake, identity, the decision gates, and human takeover. Prove It Holds turns the seven components into a compliance case through the seven properties an auditor can say yes to. The Landscape sets these teams side by side to show how the industry actually runs agents. Before any of that, build, assemble, or buy is the decision about who owns each component.