You've built Claude Code

Read it bottom-up — each floor stands on the one below it:

1. The loop — tool_use → execute → tool_result → repeat until end_turn. The heartbeat; everything else hangs off it.
2. Tools — Read/view, Write/create, Edit/str_replace, Glob, Grep, Bash: hands that touch a real filesystem, with the read-before-edit and stale-write contracts that make edits safe.
3. Permissions — deny → ask → allow → mode default: the brakes that decide whether a call runs at all, before the side effect.
4. The sandbox — path canonicalization + containment, so even an allowed action can't escape the working tree.
5. Subagents — the Task tool: an isolated context that returns only a final message, keeping a research detour out of the main window.
6. MCP — JSON-RPC over stdio, as both a client (discover and call external tools) and a server (expose your own).
7. Hooks — PreToolUse/PostToolUse/Stop subprocesses that block, modify, or inject context on the agent's lifecycle.
8. Skills — SKILL.md bundles invoked by name, with $ARGUMENTS and dynamic injection: extensibility without touching the agent's code.
9. Context — window-pressure tracking, structured compaction, and a JSONL transcript that survives a long session.
10. Plan & tasks — a read-only planning mode gated by ExitPlanMode, plus a task store with dependency edges.
11. The CLI — claude-code run <task-dir>: the entry point that wires every floor together and proves it on a frozen suite.

The headline guarantee held the whole way down: tools have real side effects, the model is frozen by a cassette, and "done" is a test's exit code plus a byte diff — never a model judging itself.

You built the contract of each subsystem — faithfully, but minimally. The production versions go further, and now you have the foundation to read them:

• Real OS sandboxing. You modeled containment as a path guard pinned to $TASK_DIR. Production Claude Code drops to the kernel — macOS Seatbelt, Linux bubblewrap — so a confused bash can't reach the host even if your guard has a bug. The contract you built is the same; the mechanism is the OS.
• HTTP/SSE MCP transports. You hand-rolled JSON-RPC over stdio. The same message shapes ride over HTTP and SSE to reach remote servers — the framing changes, the protocol doesn't.
• Output styles. Swap the agent's system prompt and formatting to retarget it (explanatory, concise, a teammate's voice) without changing a line of the loop.
• Multi-agent teammates. Your parallel-dispatch subagents are the seed of full multi-agent teams — a lead that delegates to specialists, each in its own context, coordinating through shared task state.

None of this is graded. It's the map of what's past the edge of what you built — and you're now equipped to build any of it.