It is easy to build an agent that works once. The hard, durable engineering in agentic systems is everything around the model: where work gets routed, what the runtime is actually allowed to do, how state survives a restart, and whether you can see why something broke at 2am. The model is the part you will swap most often; the boundaries are what you keep.

The model is the easy part to replace

Models improve monthly. If your system is a script wrapped around one provider's SDK, every upgrade is a rewrite. If it is a set of clean boundaries, the model is just one component behind one of them. Cortex names those boundaries explicitly so each can change without disturbing the rest.

Boundaries that hold

Routing and session lifecycle are one layer. The agent harness — instructions, skills, hooks, MCP servers, adapters — is another, kept under a guard that can inventory and validate it rather than letting it drift. Provider execution is pluggable, so the control plane resolves the model, tracks the session, and records every dispatch regardless of who is behind the API.

harness, declared and guardedharness:
  provider: claude        # or codex — swap without touching policy
  skills:   [ deploy, review, triage ]
  hooks:
    pre_action:  policy.admit   # every action passes the gate
    post_action: audit.record   # every action is logged
  mcp:      [ github, linear ]  # external tools, scoped + audited

Swap a part, keep the shape

Because the layers are real seams and not conventions, you can change the model, add a channel, or tighten a policy and the rest of the system holds its shape. The governance layer keeps applying because it sits above the harness, not inside the prompt. That separation — orchestration, governance, and a convergent control loop as distinct concerns — is what makes this a framework you can build a product on rather than a script you babysit.