AI Coding Has Moved Past "Pick the Best Model": The 5 Layers — Model, Harness, Loop, Graph, Factory — That Decide Whether AI Code Is Trustworthy

For two years, the standard developer question has been "which model writes the best code?". According to a post by Code Web Không Khó (rewritten from the author's own perspective, inspired by Sumant Thakur's original piece on Substack), that question is now outdated: the model is just a "worker" that produces code, while the trustworthiness of that code is decided by the five-layer system around it — Model, Harness (the runtime environment), Loop (the try–verify cycle), Graph (coordination across many agents) and Factory (the layer that operates everything at scale). The agent proposes, but the system and humans decide; and instead of asking which model is best, the author says, ask six questions about context, edit permissions, evidence, decision rights and where the human stops are.

Quick answers

• The Model is now just "the creator": a standard workflow no longer starts with "build this feature" but with an approved specification — expected inputs and outputs, security boundaries, acceptance criteria, the scope the agent may edit, and what evidence proves the task is done. A Planner breaks the spec into small tasks, a Builder works in an isolated workspace, and the Builder may not grade its own work: automated checks grade it, an Evaluator reviews independently, and a human holds the final merge right.
• The Harness is the environment around the "worker": context, tools, permissions and the runtime decide how much of the model's capability "survives" in a real repository — the model sets the capability ceiling, the harness decides how much of it becomes product. The post cites an example: a small OpenAI team used Codex to write nearly an entire product, reaching roughly 1 million lines of code and 1,500 merged PRs after 5 months, starting with just 3 engineers (figures as stated in the post).
• A usable Loop needs external evidence and stop conditions: a naive "try – fail – retry" loop only produces repetition, not trust; errors must be classified before deciding to retry, retries must be bounded, and when the budget runs out or an error exceeds the agent's authority, the loop must stop or escalate to a human. Sometimes the loop's most valuable decision is that the model should not run at all.
• The Graph answers "who or what acts next": multiple agents (research, backend, infrastructure) run in parallel and converge at an integration step; each error type takes a different route — code errors go back to the Builder, plan errors back to Planning, and a missing product decision stops the graph to wait for a human. In this architecture the loop becomes a node, and the edge becomes an engineering decision.
• The Factory operates everything at scale: once engineers run dozens of parallel sessions across many tools, models, branches and projects, context management stops being a prompting technique and becomes infrastructure. The Factory decides which worker gets which task, with what context, permissions and verification, and where the human checkpoints sit — which turns coding agents such as Codex, Claude Code or Kiro into interchangeable workers inside a larger system.

Why is "which model writes the best code?" now the wrong question?

The post argues that two years of model debates have obscured a simple fact: the model is only one component in the system that produces software. The model answers "what should I create?" — it generates code. But whether that code can be trusted is decided by the layers around it: what it is allowed to do, how it is verified, where errors are routed, and who makes the final call.

The post splits that system into five layers: Model, Harness, Loop, Graph and Factory. The four layers above the model are the emerging engineering discipline around AI coding — where engineers' work shifts from writing code by hand to designing the system that lets agents write code reliably.

Layer 1 — Model: the creator may not grade itself

The biggest change at the Model layer is how a task begins. Per the post, a standard workflow today does not open with the command "build this feature", but with an approved spec that states: expected inputs and outputs, security boundaries, acceptance criteria, the scope the agent is allowed to edit, and what evidence is required to declare the task done.

From that spec, a Planner decomposes the work into small pieces; a Builder executes in an isolated workspace. The governing principle is the separation of creating and grading rights: the Builder may propose and do the work, but may not declare its own work correct. Automated checks grade against deterministic criteria, an Evaluator adds an independent review layer, and a human keeps the final merge right. In the author's shorthand: agents propose — the system and humans decide.

Layer 2 — Harness: the environment decides how much capability "survives"

The Harness answers "what is the agent allowed and equipped to do?". It is the entire environment around the model: the context it receives, the tools it can use, the permissions it is granted and the runtime it executes in. The post points to how large teams invest at this layer:

• OpenAI: a small team used Codex to write nearly an entire product; after 5 months, per the post, the product reached roughly 1 million lines of code with 1,500 merged PRs, starting from just 3 engineers. The notable part is not the volume of code but how the engineers' job changed: stating intent clearly, organizing the repository so an agent can navigate it reliably, and building architectural constraints plus verification mechanisms.
• Anthropic: a clear split of Planner – Generator – Evaluator roles, with the principle that whoever creates code does not get to declare that code correct.

The author's conclusion at this layer is memorable: the model decides the capability ceiling; the harness decides how much of that capability survives in a real repo. The same model placed into two different harnesses — messy context, sprawling permissions and no verification on one side; a clear spec, an agent-friendly repository and full automated checks on the other — yields completely different levels of trustworthiness.

Layer 3 — Loop: knowing when to stop matters as much as knowing when to retry

The Loop answers "should it continue?". The post distinguishes two kinds. A naive loop runs an unconditional try – fail – retry cycle: it produces repetition, not trust, because the agent can repeat the same mistake at growing cost.

A usable loop needs two things from outside itself: evidence to decide on, and clear stop conditions. Concretely: errors must be classified before deciding whether to retry; the number of retries must be bounded; and when the budget is exhausted or an error lies outside the agent's authority, the loop must stop or hand the decision to a human.

The cited example is Atlan's Sherlock system: about 11,000 alerts per month; after adding an "admission" layer that blocks more than 85% of alerts before they ever reach the model, investigation time dropped from over 10 minutes to about 2 minutes (figures as stated in the post). The lesson: a loop's most valuable decision is sometimes the decision that the model should not run — filtering out work that does not need AI at the gate both saves cost and speeds up the work that genuinely needs the model.

Layer 4 — Graph: different errors must take different routes

The Graph answers "who or what acts next?". Graphs, DAGs and workflows are not new in themselves; what is new, per the post, is what lives inside the nodes: a node can now be a planning agent, a coding agent, an integration step, a policy check, a verification step, a repair loop, or a point waiting for human approval.

In that picture, specialized agents run in parallel — for example one agent researching dependencies, one building the backend, one handling infrastructure — and converge at an integration step. Most important is how errors are routed: code errors return to the Builder, planning errors return to the Planning step, and when a product decision is missing, the graph stops and waits for a human.

The author closes this layer with two ideas: in a graph architecture, the loop becomes a node, and the edge becomes an engineering decision — those edges are exactly the judgments that used to live only in the heads of experienced developers, now written out as the explicit structure of the system.

Layer 5 — Factory: when context management becomes infrastructure

The Factory answers "how do you operate and improve all of the above at scale?". The post names several directions forming at this layer: Xirp focuses on sessions, isolated workspaces and portable context; Kiro Crew adds durable execution, retries, replanning and coordination of long-lived tasks; Warp Factories go further with orchestration across the whole software development lifecycle.

The cited example is Spotify: engineers there no longer run one assistant in one repo, but many parallel sessions across tools, models, branches and projects; the Xirp platform is said to have run more than 36,000 sessions and to be designed to coordinate over 50 parallel sessions (figures as stated in the post). At that scale, context management is no longer a prompting utility — it is infrastructure.

Warp's distinction, per the post, clarifies the boundary between the top two layers: the harness runs workers, while the factory decides which worker receives which task — with what context, permissions, verification and human checkpoints. The consequence is that specific coding agents — Codex, Claude Code, Kiro — become interchangeable workers inside a larger system; the Factory is the system that selects and governs those coding agents.

Which question does each layer answer?

Layer	Question it answers	Core content
Model	What should I create?	Generates code from an approved spec; Planner decomposes, Builder works in an isolated workspace, Builder does not grade itself
Harness	What is the agent allowed and equipped to do?	Context, tools, permissions, runtime; repository organized for agents; architectural constraints and verification mechanisms
Loop	Should it continue?	Retries based on evidence, errors classified, retries bounded, explicit stop conditions and an escalation path to humans
Graph	Who or what acts next?	Many agents/steps run in parallel and converge; each error type routed to the right step; human approval points inside the graph
Factory	How do you operate and improve all of it at scale?	Orchestrates sessions, workspaces, context and workers at organization scale; selects and governs coding agents as interchangeable workers

Instead of "which model is best", ask these 6 questions

The post closes by proposing a completely different set of questions for evaluating an AI coding system:

1. What context does the model receive?
2. What is it allowed to edit?
3. What evidence does it produce?
4. Who decides the task is done?
5. What happens when verification fails?
6. Which decisions remain human?

The six questions map onto all five layers: context and edit scope belong to the harness; evidence and verification-failure handling belong to the loop and the verification machinery; the right to declare "done" and the decisions reserved for humans are governance that the graph and factory must design explicitly. A system that answers all six clearly is far more trustworthy than one that merely boasts a strong model — that is the post's central message.

A note on reading the numbers: the figures about OpenAI, Anthropic, Atlan and Spotify are examples cited by the post (itself inspired by Sumant Thakur's Substack article) and are not independently verified here; the post's main value lies in the five-layer framework and the evaluation questions, more than in any single figure.

Frequently asked questions

How do Harness, Loop, Graph and Factory differ?

In the post's five-layer framework: the Harness is the environment around the agent (context, tools, permissions, runtime) — it answers "what is it allowed and equipped to do". The Loop is the try–verify cycle with evidence and stop conditions — "should it continue?". The Graph is the coordination graph across many agents and steps, routing by error type — "who or what acts next?". The Factory is the layer that operates everything at scale — "how do you run and improve all of it?". The Model sits at the center, responsible only for creating code.

Why may the Builder not grade its own code?

Because when the creator of a result is also the one declaring it correct, the system loses its independent verification layer — a principle that, per the post, both OpenAI's approach and Anthropic's Planner – Generator – Evaluator split follow. In the workflow described, the Builder proposes and executes inside an isolated workspace; automated checks grade against deterministic criteria, an Evaluator reviews independently, and a human holds the final merge right.

What does a "good loop" require?

Per the post, a usable loop needs: external evidence to decide on rather than the agent's own feeling; errors classified before any retry decision; a bound on the number of retries; and clear stop conditions — stop or escalate to a human when the budget runs out or an error exceeds the agent's authority. A naive unconditional "try – fail – retry" loop only creates repetition, not trust.

How does the Factory differ from the Harness?

Per Warp's distinction as cited in the post: the Harness runs a worker — the environment in which one agent executes one task. The Factory sits higher: it decides which worker gets which task, with what context, permissions, verification and human checkpoints, across many sessions, repos and tools. Thanks to the Factory layer, coding agents like Codex, Claude Code and Kiro become interchangeable workers.

What does this framework mean for a small team with no "factory" yet?

Plenty, because the five layers are a maturity ladder, not an all-at-once requirement. A small team can apply the lower-layer principles immediately: start tasks with an approved spec instead of a vague prompt (Model), organize the repo and permissions for the agent (Harness), set retry limits and stop conditions (Loop). Graph and Factory become necessary as the number of agents, sessions and repos grows — and the closing six questions work as a checklist at any scale.

Conclusion

The post's message fits in one sentence: the model is becoming a worker, and the architecture around it is becoming an engineering discipline. As coding agents spread, a team's competitive advantage no longer lies in picking the single "best" model, but in designing all five layers well — a clear spec for the model, a harness good enough for the model's capability to survive in a real repo, a loop that knows when to stop, a graph that routes the right work to the right actor, and a factory that operates it all at scale, with final decision rights kept in human hands at the points that matter most.

Source: the post "AI coding đã vượt qua thời kỳ Agent — giờ là thời kỳ của hệ thống quanh Agent" by Code Web Không Khó on Facebook (11 November 2026); the author states the post was rewritten from their own perspective, inspired by Sumant Thakur's original Substack article "AI Coding Is Moving Beyond the Agent". Figures about OpenAI, Anthropic, Atlan and Spotify are as cited in the post and are not independently verified; edited and structured by Wotech Electronics. Illustration: image attached to the original post.