Thinking, written down

In sixteen days, I built a single-user Personal Agent around governed Finance tools, one visible Timeline with automatic Sessions, real-device acceptance, ECS deployment, backup, restore, and rollback. This is a record of the product decisions, production failures, evaluation gaps, and the rule that a model saying “recorded” is never completion.

From ChatGPT, Doubao, Claude Code, and Codex to iCloud Drive, GitHub, and multiple personal data sources: why I am no longer just looking for a better AI tool, but building a Personal Agent I own—one that can continue across devices and take responsibility for real actions.

My mental model of the LLM API was stuck at 'two strings in, one string out.' After actually reading through the docs of Anthropic, OpenAI, and several Chinese platforms, I found today's LLM API is a stateless conversation-replay machine bolted to a built-in tool-calling protocol. This is a point-by-point teardown through the eyes of traditional API design: stateless replay and four caching philosophies, stop_reason and content blocks, the suspend-resume loop of tool calls, sampling params being clawed back by the platform, four philosophies of API consolidation, the protocol's audience shifting from your code to the model, and a rarely-named protocol war over Anthropic-compatible endpoints. The conclusion: the periphery is all familiar old craft; the genuinely new species is only that small core.

A prompt defines what an agent should do now. Context defines what it knows. A harness constrains how it may act. A loop defines what happens after the action. Engineering has hard verifiers such as tests and builds; product work often depends on feedback outside the system. This essay uses a false-green multi-agent workflow and an iCloud-to-Xiaohongshu publishing loop to explore that boundary.

When agents start executing high-risk service operations on behalf of users, open platforms need more than permission control: they need platform-verifiable per-action intent. The core issue is not that OAuth stops working, but that a third-party agent's execution surface becomes an opaque channel for the platform.

After moving from Claude Chat to Claude Cowork, Claude Code, and then a Codex + Claude dual setup, I became convinced that the real asset is not an agent product's private memory. It is an external, portable, auditable context layer that every agent can read. My current setup splits facts into two systems: the knowledge base for long-term context, and project git for execution context.

Over the same OpenAPI, Feishu built two agent-facing connection layers: lark-mcp, with 1,271 auto-generated tools, and lark-cli, with a dozen hand-curated domains. After tearing through the source, tool descriptions, REST mappings, and shortcut layer, my takeaway is not that one replaces the other. They occupy two points on the same "coverage × quality" frontier: MCP gives broad coverage at low marginal cost; CLI + skills hand-scrubs high-friction tasks. And in Feishu's case, the 20× star gap sends a clear developer-attention signal: the first auto-generated wrapping layer rarely forms a moat on its own.

For a decade, open platforms optimized for how an experienced human would use them. When the caller becomes an Agent, what you measure, what you design, and how you verify all change. Three shifts learned by actually putting an Agent end-to-end on the POIZON Open Platform — plus an unromantic conclusion: the real bar isn't technical.