> ## Documentation Index > Fetch the complete documentation index at: https://docs-omnicoreagent.omnirexfloralabs.com/llms.txt > Use this file to discover all available pages before exploring further. # How it fits together > The agent runtime in four layers, and one run through all of them # How it fits together OmniCoreAgent is an **agent runtime** for Python. This page is the map: the four layers it is made of, one run traced through all of them, and which setting turns what on. Every other page goes deeper into one piece. ## Four layers | Layer | What it is | What it gives you | Read | | - | - | - | - | | **The harness** | the loop around the model | your tools and MCP servers, context and session memory, a workspace of files, code mode, skills, sub-agents and worker profiles | [Agent harness](/docs/core-concepts/agent-harness) | | **Control** | decided before every action | a policy that allows, asks a person, or refuses each action (on by default with the `permissive-dev` profile, which asks only before a sandbox's network is turned on or host files are mounted into it; choose `interactive-dev` or `strict-production` to be asked more); approvals; budgets when you set them; a sandbox that is the boundary for commands | [Security model](/docs/core-concepts/security-model) | | **Durability** | a record every run keeps | pause for a person and resume; survive a crash without redoing work; another process takes over a dead run | [Durable runs](/docs/core-concepts/durable-runs) | | **The record** | the evidence of every run | one trace per run, readable start to finish, private by default, exported where you want it | [Read a run](/docs/how-to-guides/read-a-run) | The harness is what makes a model an agent. The other three are what let you give that agent real work: you know what it may do before it does it, a crash does not make it do something twice, and afterwards you can see exactly what happened. You reach all four the same way, with the same agent object: in your Python code, from the `omnicoreagent run` command for scripts and CI ([Headless runs](/docs/how-to-guides/headless-runs)), served over HTTP by OmniServe (`omniserve run`, part of this package; [OmniServe](/docs/how-to-guides/omniserve)), or on a schedule as a background run ([Background agents](/docs/core-concepts/background-agents)). ## One run, through every layer What happens when your code calls `await agent.run("Refund order 1042")`: The model client loads and the tools are assembled: yours, your MCP servers', the workspace file tools, and, when switched on, `execute`, code mode, skills and `spawn_subagents`. There is an `execute` tool only when a sandbox is configured: a fresh agent has none. The policy is loaded and hashed. **Durability:** a run record is saved in the memory store with status `running`, and a heartbeat keeps it marked alive. **The record:** a trace starts with the request and a header (model, tools, policy hash, settings). In a fresh process, loading the model client can take seconds; the trace shows it as a `model.client.load` span. **Control:** the guardrail screens the request for prompt injection (`guardrail_mode`: `full`, the default, also screens every tool result; `input_only`; `off`). The context is built from the system instruction, the session's history and the run so far, kept under a token budget. **Control:** if budgets are set, the call is checked before the model is called (its cost held when its price is known, otherwise the call counted); a run that cannot afford it pauses for a person or ends, as the budget says. Then the model answers, or asks for tools. **Control:** the call becomes a capability (for example `workspace.files.delete` on `prod/db.txt`, or `process.exec` for a shell command), and the policy decides. Allowed, it runs. Refused, the model is told why. Asked, the run **pauses** (`awaiting_approval`) until a person decides. **Durability:** a call is recorded as started before it runs and as finished after. A command runs in the sandbox, with the workspace files copied in before it and its new files copied back after, each copy decided by the same file rules as `read_file` and `write_file`. A file an ask rule covers, a hidden, binary or oversized file, and anything past the file limit is skipped, and the model is told. Results go back to the model, the guardrail screens them, large ones are saved to the workspace with a preview. Steps repeat until the model answers, or a limit (steps, the deadline, a budget) stops the run. The record is finished, the trace ends, and budgets are settled. You get the answer with the run's `status`, `run_id` and `trace_id`. ### When it pauses A run waiting for a person (an approval or a budget top-up) keeps everything it has done. The decision can come from your code, over HTTP, or from another process; then `resume(run_id)` continues from where it stopped. A worker's question pauses its lead too, and the lead's decision reaches the worker. ### When the process dies With a store that keeps run state (all the built-in ones: SQLite, PostgreSQL, Redis, MongoDB), another process calls `resume(run_id)` once the dead process's heartbeat has lapsed. What happens to the call that was running: | The call was | On resume | | - | - | | finished, result saved | never run again | | never started | runs | | interrupted, its tool not idempotent | not run again; the model is told its outcome is unknown and to check | | interrupted, its tool idempotent when the call was made and now | runs again | ## Where each feature sits Settings are keys of `agent_config` unless written with `=` (a constructor argument). | Feature | Layer | Switched on by | | - | - | - | | Your Python tools | harness | `local_tools=` | | MCP servers | harness | `mcp_tools=` | | Workspace files | harness | on by default (`enable_workspace_files`) | | Code mode (`run_code`) | harness | `code_mode` | | Skills | harness | `enable_agent_skills` | | Sub-agents you name | harness | `sub_agents=` | | Workers the lead spawns, and their profiles | harness | `enable_subagents`, `worker_profiles` ([Sub-agents](/docs/core-concepts/sub-agents#worker-profiles-the-right-model-for-each-worker)) | | Session memory, context limits | harness | `memory_config`, `context_management` | | Policy, approvals | control | on by default (`governance_config`; the default profile asks rarely) | | Budgets | control | `governance_config["budgets"]` | | Shell commands in a sandbox (`execute`) | control | `governance_config["sandbox_config"]` (or `sandbox_runtime`) | | Files in and out of the sandbox | control | the workspace bridge (`governance_config["workspace_bridge"]`) | | Prompt-injection guardrail | control | on by default (`guardrail_mode`) | | Pause, resume, crash recovery | durability | with the built-in stores; a durable one (`memory_router=`) to survive a restart | | Background and scheduled runs | durability | OmniServe, or the background manager in your code | | Trace and trajectory | the record | always | | Exporters (OTLP, JSONL, …) | the record | `telemetry_exporters=` | | Personal-data redaction | the record | on for the record by default, not for what the model sees (`privacy_config`) | Every setting is in the [agent settings reference](/docs/reference/agent-config). ## What runs where | Runs | Where | Contained by | | - | - | - | | The loop, the policy, the record | your process | it is your process | | Your Python tools | your process | the policy decides whether they run, not what they do | | MCP tools | the MCP server (a stdio server is a process on your machine) | nothing but the server itself; the policy decides whether each call is made | | Shell commands (`execute`) | the sandbox provider | the sandbox ([what each provider enforces](/docs/core-concepts/security-model#what-stops-harm)); except `local`, which runs on your machine and is not a sandbox, and a runtime of your own, which is trusted | | Skill scripts | the sandbox, if one is configured; otherwise your machine | the sandbox, or nothing | | Code mode programs | Monty, in a separate worker process (`omnicoreagent[codemode]`) | Monty: no files, network or environment, with time and memory limits; each tool a program calls is decided by the policy | ## Next * [Quickstart](/docs/getting-started/quickstart): a first agent in minutes. * [Security model](/docs/core-concepts/security-model): control, in depth. * [Durable runs](/docs/core-concepts/durable-runs): durability, in depth. * [Read a run](/docs/how-to-guides/read-a-run): the record, in depth. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.