The Harness You Don’t Announce Is the One You Don’t Use
Anthropic’s dynamic workflows turn Claude Code from a single long-context agent into a generator of purpose-built orchestration harnesses — deterministic scripts that spawn clean-context subagents, each of which can be shadowed by an adversarial verifier. A companion post on session economics makes the same argument from the cost side: what you pay depends less on the task than on how the session is run. And a forensic study of one agent-run organization shows the trap waiting for both — a routing method that is not announced at the moment of execution silently stops being used at all.
What we found
- The failure profile of one long context is named and specific — agentic laziness, self-preferential bias, and goal drift — and the fix on offer is structural rather than motivational: a deterministic script that spawns subagents, each with a clean context window and one focused goal.
- Two pairings do the work and they compound: a deterministic script paired with model judgment, and a worker paired with an adversarial verifier. Either half alone fails predictably — a pure script cannot evaluate quality, and a pure agent in one long context accumulates all three failure modes, including approving its own flawed output.
- Six patterns, each with a different winning condition: classify-and-act for mixed intake, fan-out-and-synthesize for wide parallel work whose real risk is cross-contamination, adversarial verification as QA on any worker output, generate-and-filter for ideation with a quality threshold, tournament for taste-based judgment where deterministic scoring fails, and loop-until-done for work of unknown size.
- What a session costs depends less on the task than on how the session is run. Everything that enters the conversation is re-sent on every turn after it, so one long session costs more than the same work spread over a few short ones — and by more than you would expect.
- A routing decision that is not announced at the moment of execution is a routing decision that silently stops being made. In the organization we audited, an eight-dimension routing graph whose own document admitted its validator was only 'queued' was consulted by zero executable lines; two later automation changes were cited as its mechanization and neither reads the graph at all.
- Two audits are worth running against your own records. For every rule you claim is mechanized, locate the executable line that consults it — if a search finds only prose, it is discipline, not enforcement. And monitor gate activity, not gate existence: a check predicated on state nobody writes is a no-op, and one here ran more than 800 times doing nothing.
How we did it
Two published Anthropic posts read in full — the June 2026 dynamic-workflows post and its companion on session economics — with every claim below quoted from them rather than paraphrased, including the ones that cut against adoption (the token cost, and the explicit advice that most routine coding work does not need a panel of reviewers). The third strand is a forensic audit of ONE agent-run organization's own records, reported anonymously: its execution-method document, its dispatch protocol, the two automation changes its records cite as that framework's mechanization, and then a search of every executable hook and script in its repository for any line that actually consults the decision graph. The enforcement claims are checked against executable code, not against the documentation that describes it — which is the whole point of the finding. One organization, one framework, no base rate: this cannot say how often the pattern occurs, only that it is a mechanism reproducible in any system with the same wiring.
Why one long context fails
Anthropic’s June 2026 post “A harness for every task” is blunt about the failure profile of a single agent grinding through a big job in one conversation: “The longer Claude works on a complex task in a single context window, the more it becomes susceptible to a few specific failure modes.” It names three. Agentic laziness: the model “stops before finishing a particularly complex, multi-part task and declares the job done after partial progress.” Self-preferential bias: “Claude’s tendency to prefer its own results or findings, especially when asked to verify or judge them.” Goal drift: “the gradual loss of fidelity to the original objective across many turns, especially after compaction.”
The proposed fix is structural, not motivational: “Claude can now write its own harness on the fly, custom-built for the task at hand” — a deterministic JavaScript orchestration file that spawns and coordinates subagents, each with a clean context window and one focused goal.
Six workflow patterns, and when each wins
Classify-and-Act. “Use a classifier agent to decide on the type of task, and then route to different agents or behavior based on the task.” Wins whenever the right downstream behavior depends on categorizing the input first — mixed triage queues, incident routing, bug-versus-feature intake. A classifier at the end can also select among outputs.
Fan-out-and-Synthesize. Split the work into many small steps, run an agent per step, then merge. Useful “when there are a large number of smaller steps, or when each step benefits from its own clean context window so they don’t interfere or cross-contaminate.” The key mechanism: “The synthesize step is a barrier—it waits for all the fan-out agents, then merges their structured outputs into one result.” Wins on wide, parallelizable work where cross-contamination between items is the real risk.
Adversarial Verification. “For each spawned agent, run a separate spawned agent to adversarially verify its output against a rubric or criteria.” Wins as QA on any worker output — it directly counters self-preferential bias by making the judge a different agent than the producer. The post’s Deep Verification example: one agent enumerates every factual claim in a report, a subagent checks each one in detail, and “a verification agent check[s] the source subagent.”
Generate-and-Filter. “Generate a number of ideas on a topic and then filter them by a rubric or by verification, dedupe duplicates and return only the highest quality, tested ideas.” Wins for ideation with a quality threshold: overproduce deliberately, then cull mechanically.
Tournament. “Instead of dividing the work, have agents compete on it.” N agents attempt the same task with different approaches; a judging agent compares results “in a pairwise fashion … until you have a winner.” Wins on taste-based or comparative-judgment tasks — naming, design directions, prose — where deterministic scoring fails.
Loop Until Done. For work of unknown size, “loop spawning agents until a stop condition is met (no new findings, or no more errors in the logs) instead of a fixed number of passes.” Wins on open-ended hunts — audits, bug sweeps, migrations — where a fixed pass count either wastes tokens or stops early.
The harness idea: why pairing beats either alone
“Harness” here means the orchestration structure around the model. Claude Code’s default harness is built for coding; teams historically built custom harnesses for research, security analysis, and code review. Dynamic workflows let the model generate that harness per task.
Two distinct pairings do the work, and they compound:
Deterministic script paired with model judgment. “Dynamic workflows execute a javascript file with a few special functions that help spawn and coordinate subagents,” with standard JavaScript (JSON, Math, Array) for data handling. The script is the control plane: it never gets lazy, never drifts, and holds the loop conditions, barriers, and token budgets. The spawned agents supply what the script cannot — judgment. The workflow can even choose per-agent model and isolation: it “can decide which models an agent uses and whether subagents are run in their own worktree.”
Worker paired with adversarial verifier. The producer never grades its own homework; a separate agent judges against an explicit rubric. This is the anti-self-preferential-bias architecture, and it has a security sibling: quarantine agents that read untrusted public content are barred “from taking high-privilege actions, which are instead done by the agents in charge of acting on the information.”
Either half alone fails predictably. A pure script cannot evaluate quality. A pure agent in one long context accumulates all three failure modes — including approving its own flawed output.
The pairingScript-plus-workers-plus-verifiers keeps determinism where determinism is strong — control flow, completion criteria, budgets — and model judgment where only judgment works, held honest by a judge that is not the producer.
The cost caveat is explicit: “Dynamic workflows often use more tokens and are best suited for complex, high value tasks,” and “most traditional coding tasks do not need a panel of 5 reviewers.” Workflows resume after interruption, accept explicit token budgets (“use 10k tokens”), and can be saved and distributed via skills for repeat use.
Getting more out of every session
The second post’s core mechanic explains most surprise bills: “Everything that ends up in the conversation, a file Claude read or the output of a command it ran, gets sent again on every turn after it, for the rest of the session.” Efficiency “doesn’t mean using fewer of them overall. It means making sure the ones you do use go towards the thing you actually asked for.”
The high-leverage practices:
- Run /clear between tasks — prior context otherwise taxes every subsequent turn.
- Fix /model and /effort before the session starts. “The cache has to match from the very start of the request forward” — mid-session switches reprice the entire prefix. Plan mode’s model switching disrupts the cache on every entry and exit.
- @-mention files instead of typing paths — attaches content without a tool round trip.
- Silence noisy commands with quiet flags, or run them in subagents. A subagent “gets its own context window, with its own system prompt, the tools, and your CLAUDE.md, but not your conversation” — only the answer returns; the noise is discarded.
- /compact before keyboard breaks — the prompt cache expires after an hour on subscription plans (five minutes on API keys); compacting while warm is far cheaper. /rewind removes recent turns at no cost.
- Audit /context in a fresh session — fat CLAUDE.md files and MCP tool definitions are a per-turn tax you pay before typing anything.
For surviving plan limits, one line carries most of the weight:
“One long session costs more than the same work spread over a few short ones, and by more than you’d think.”
Maximizing the value of your Claude Code sessions
Turn 40 re-sends 39 prior turns. Don’t resume a cold marathon session — start fresh. And since “a typical turn is lopsided: tens of thousands of tokens going in, a few hundred coming out,” input-side hygiene is where the money is.
Case study: the routing graph nobody consulted
One agent-run organization we studied had, on paper, an exemplary execution-method graph: three execution modes (dedicated terminal, spawned subagent, hybrid), an eight-dimension decision matrix for choosing among them, four work classes with default routings, and an eight-step dispatch protocol whose seventh step required the dispatcher to name the chosen pattern explicitly in every dispatch so a verifier could confirm the choice matched the work.
The document even diagnosed itself: it stated plainly that it was a discipline-layer artifact, with a mechanical validator “queued” to enforce consultation at dispatch time.
That validator was never built. The organization’s records cited two later automation changes as the framework’s “mechanization” — but on inspection, both enforced adjacent bookkeeping: write-invariants on a dispatch ledger, and a single-writer rule on a status file. Neither reads the decision graph. Neither classifies work. One cited fix even shared an identifier with a different rule entirely, so the record read as enforced while enforcing something else. The dispatch ledger recorded exactly one dispatch in its lifetime; its enforcement partner ran more than 800 times as a no-op, self-disabled by the empty state it depended on. No dispatch template carried a field for the chosen pattern; no gate checked that an announcement was made. Across every executable hook and script: zero consultations of the graph. Only prose.
The root cause is a class, not an accident: consult-if-you-remember. A decision procedure that lives only in a document depends on the busiest agent, at the busiest moment, choosing to open it.
The principle that falls out:
The principleA routing decision that is not announced at the moment of execution is a routing decision that silently stops being made. The announcement is not ceremony — it is the enforcement surface.
If every dispatch must carry a machine-checkable line (“mode: subagent, class: investigation”), then a missing decision is detectable the instant it goes missing, and the gate can print the announcement itself rather than trusting the agent to. Without that, the graph’s usage rate decays to zero with no alarm, while the documentation continues to claim the method is in force.
Adoption checklist
- Never let a producer verify its own output. Pair every worker agent with a separate adversarial verifier judging against a written rubric.
- Put loops in scripts, judgment in agents. Deterministic control plane for spawning, barriers, stop conditions, and token budgets; model agents only where judgment is required.
- One clean-context goal per subagent, returning structured output — synthesis merges results behind a barrier.
- Make routing announce itself. Add a required, validated mode/class field to every dispatch payload, checked mechanically at dispatch time — and emit the announcement from the gate, not the agent’s memory.
- Audit cited-versus-actual enforcement. For every rule your records claim is “mechanized,” locate the executable line that consults it. If a search finds only prose, it is discipline, not enforcement.
- Treat dormant ledgers as disabled gates. A check predicated on state nobody writes is a no-op; monitor gate activity, not just gate existence.
- Run sessions short and cache-warm. /clear between tasks, model and effort fixed up front, noisy output quarantined in subagents, /compact before stepping away.
- Reserve heavy workflows for high-value work. Multi-agent verification pays for itself on complex tasks; most routine changes don’t need a panel of five reviewers.
AIU Research reads the primary sources and then goes looking for the same failure in a working system. This piece pairs two published Anthropic posts with a forensic audit of one agent-run organization’s own records, reported anonymously because the finding is a property of the wiring rather than of the organization.