Visual Research Summary
Dive into Claude Code
The design space of today's and future AI agent systems — explained simply, with redrawn diagrams of every major subsystem.
Update — July 2026: This deck summarizes the Claude Code architecture as of June 2026. Claude Code has since added background subagents, /fork sessions, agent teams, web/desktop surfaces, Sonnet 5 / Opus 5 defaults, and native 1M context. Some implementation details and mode counts below may differ from the current release.
Summary prepared by Daniel Liezrowice
Engineering Software Lab — AI SDLC Tools Consultants · eswlab.com
Based on the paper by Liu, Zhao, Shang & Shen (VILA Lab, MBZUAI) — arxiv.org/pdf/2604.14228
← Swipe to navigate →
Agenda
What we'll cover — 7 chapters
1
Why it matters
The 1.6% / 98.4% insight: a thin AI core inside a thick harness.
2
Values & principles
Five human values that drive every choice; the 93%-approval problem.
3
The agent loop
One while-loop: call model → run tools → repeat, with recovery.
4
Permissions
Seven deny-first safety layers and the autonomy spectrum.
5
Context & compaction
The context window as a scarce resource: a 5-layer pipeline.
6
Subagents & extensions
Isolated workers + 4 extension points ranked by context cost.
7
Trade-offs & future
Claude Code vs OpenClaw and the human-capability gap.
01
Why this paper matters
In this chapter
- What an agentic coding tool actually is
- The headline finding: 1.6% AI logic vs 98.4% harness
- The mental model — model decides, harness enforces
Chapter 1 · The core insight
The AI is a thin core inside a thick harness
98.4% — Operational Harness
permissions · tool routing · context management · recovery · persistence
◀ 1.6% AI decision logic
🧠
Model
Proposes actions via
tool_use blocks. No direct access to anything.🛡️
Harness
Validates, permission-checks, runs tools, recovers from errors.
📈
The payoff
~27% of tasks were work users wouldn't have attempted otherwise.
Takeaway: A compromised model still can't bypass safety — reasoning and enforcement live in separate code paths.
02
The values that shape everything
In this chapter
- The five human values behind the architecture
- Why "just ask the human" fails (93% approval rate)
- Trust as a trajectory, not a fixed setting
Chapter 2 · Five values
Human values → design principles → code
🎮
Decision Authority
Humans observe, approve, interrupt, audit.
🔒
Safety & Privacy
Protect even when the user is inattentive.
🎯
Reliable Execution
Do what was meant; verify before "done".
🚀
Capability Amplification
Enable new workflows, not just faster ones.
🧩
Contextual Adaptability
Fit your project; trust grows over time.
The 93% problem: users approve ~93% of permission prompts. Habituated approval makes "just ask the human" unreliable — so the system must stay safe without relying on human vigilance.
03
The agent loop
In this chapter
- The seven components and how data flows
- One turn, step by step (the ReAct pattern)
- How the loop recovers gracefully from failures
Chapter 3 · One simple while-loop
Call model → run tools → repeat
Userprompt
→
InterfacesCLI · SDK · IDE
→
Agent LoopqueryLoop()
→
Permissionsallow/ask/deny
→
Tools+ Execution
↕ State & Persistence (append-only JSONL) records & loads everything
The 5 turn steps
assemble context → call model → permission gate → execute & collect → stop if text-only.
Graceful recovery
retry with higher token cap (3×), reactive compaction, fallback model, prompt-too-long recovery.
Takeaway: Minimal scaffolding, maximal harness — no planning graph, just a robust loop that lets the model decide freely.
04
Permissions & safety
In this chapter
- Seven independent deny-first safety layers
- The 7-mode autonomy spectrum
- Where defense-in-depth can break (CVEs & the >50 rule)
Chapter 4 · Defense in depth
Seven layers — any one can block a tool call
1
Tool pre-filtering
denied tools removed before the model sees them
2
Deny-first rules
deny always beats allow, even a more specific allow
3
Permission mode
7 modes set the baseline behavior
4
Auto-mode ML classifier
can deny what the rules would allow
5
Shell sandbox
filesystem/network isolation — a separate axis
6
No-restore on resume
past grants don't carry into a new session
7
Hook interception
PreToolUse hooks can deny, ask, or rewrite
Chapter 4 · Autonomy spectrum
From "approve everything" to "minimal checks"
planapprove every plan
defaultapprove most
acceptEditsauto edits
autoML classifier
dontAskno prompts
bypassminimal checks
← more safety / less autonomymore autonomy / less safety →
Where it breaks: layers are meant to fail independently but share performance limits. Commands with >50 subcommands fall back to one generic prompt (parsing froze the UI). Hooks & MCP run before the trust dialog — the source of several real CVEs.
05
Context & compaction
In this chapter
- Why the context window is the binding constraint
- The 5-layer "lazy degradation" compaction pipeline
- Human-readable file memory vs vector databases
Chapter 5 · Lazy degradation
Five compaction layers — cheapest first
1
Budget reduction
caps each tool result; oversized → reference
2
Snip
lightweight trim of older history
3
Microcompact
fine-grained, cache-aware compression
4
Context collapse
read-time projection — history not mutated
5
Auto-compact
last resort: ask the model to summarize
The clever part: context collapse builds a compressed view the model sees, while the full history stays on disk — nothing is destroyed.
Chapter 5 · What fills the window
Context sources & transparent memory
System & environment
system prompt, output style, git status
Instructions & memory
CLAUDE.md 4-level hierarchy + auto memory
Tools & history
schemas, skills, conversation, tool results
Memory is plain-text Markdown (CLAUDE.md) you can read, edit, and version-control — not an opaque vector database. Guidance (probabilistic) is deliberately separated from enforcement (deterministic permission rules).
06
Subagents & extensibility
In this chapter
- Isolated subagents that return only a summary
- Worktree isolation & file-lock coordination
- Four extension mechanisms ranked by context cost
Chapter 6 · Delegation
Isolated workers, summary-only returns
P
Parent conversation
delegates with a self-contained prompt
S
Subagent — isolated context
own tools · rebuilt permissions · Git worktree
📄
Sidechain transcript
full history saved — never enters parent context
↩
Returns summary text only
keeps the parent's context lean
Why summary-only? Agent teams cost ~7× the tokens of a normal session — sharing full transcripts would explode context. Coordination uses simple file locks, not a message broker.
Chapter 6 · Extensibility
Four mechanisms, ranked by context cost
| Mechanism | Unique capability | Context cost | Plugs into |
|---|---|---|---|
| Hooks | Lifecycle interception (block / rewrite) | Zero | execute() |
| Skills | Domain instructions + meta-tool | Low | assemble() |
| Plugins | Packaging + distribution of the rest | Medium | all 3 points |
| MCP servers | External service / tool integration | High | model() |
Takeaway: Cheap extensions (hooks, skills) scale widely; expensive ones (MCP) are reserved for when you truly need new tools.
07
Trade-offs & the future
In this chapter
- Same questions, opposite answers: Claude Code vs OpenClaw
- The three recurring design patterns
- The big open question: long-term human capability
Chapter 7 · Same questions, different bets
Claude Code vs OpenClaw
Claude Code
- Ephemeral CLI coding harness
- Trust = per-action deny-first checks
- The agent loop is the center
- Extensions modify one context window
- Subagents = subordinate task workers
OpenClaw
- Persistent gateway daemon
- Trust = perimeter access control
- The gateway is the center; loop is one part
- Plugins extend a shared surface
- Multi-agent routing = independent agents
They can compose: OpenClaw can host Claude Code as a harness. The design space is layered, not a flat list.
Chapter 7 · Patterns & the open question
What recurs — and what's at stake
🪜
Graduated layering
Stacks of independent mechanisms over monolithic ones.
📜
Append-only state
Auditable, forkable — transparency over query power.
🧠
Model judgment + harness
Trust the model locally inside deterministic guardrails.
The big open question — long-term human capability. Big short-term gains, but few mechanisms for long-term growth. Adjacent-tool signals: developers 19% slower while feeling faster, +40.7% code complexity, comprehension loss. The call: treat the sustainability gap as a first-class design problem.
Thank you
Questions & discussion
Production coding agents are coherent answers to a stable set of design questions. The frontier isn't more autonomy — it's preserving human understanding while amplifying it.
Connect & ask questions on LinkedIn — /in/liezrowice
Summary prepared by Daniel Liezrowice
Engineering Software Lab — AI SDLC Tools Consultants
eswlab.com/contact-us
eswlab.com/contact-us
Original paper: Liu, Zhao, Shang & Shen — VILA Lab, MBZUAI
arxiv.org/pdf/2604.14228
arxiv.org/pdf/2604.14228