Externalization in LLM Agents: A Unified Review of Memory, Skills, Protocols, and Harness Engineering

Overview

This guide synthesizes Externalization in LLM Agents: A Unified Review of Memory, Skills, Protocols and Harness Engineering (arXiv:2604.08224), a 54-page technical report by Chenyu Zhou and 20 co-authors from Shanghai Jiao Tong University, Sun Yat-sen University, Shanghai Innovation Institute, Carnegie Mellon University, and OPPO, submitted 2026-04-09.

The paper's central thesis: reliable agent capability comes not only from larger models, but from systematically restructuring task requirements so that internal capabilities and external infrastructure jointly cover all required competencies. Capability is migrating outward.

Central Thesis: Externalization as a Unifying Principle

The paper borrows Donald Norman's "cognitive artifacts" concept—shopping lists don't expand biological memory; they transform a difficult *recall* problem into a simple *recognition* problem; maps don't improve navigation skills; they make spatial structure visible. LLM agent externalization follows the same pattern:

• Memory: recall → recognition
• Skills: improvisation → structured composition
• Protocols: ad-hoc chat → contract-based interaction

Externalization is not merely engineering convenience—it concerns where reliable intelligence actually originates.

Three-Stage Evolution: Weights → Context → Harness

| Stage | Period | Carrier | Core mechanism | Key limitation | |---|---|---|---|---|---| | Weights | 2022–23 | Model parameters | Pretraining compresses knowledge into weights; Scaling Laws dominate | Single-fact updates require retraining; opaque; hard to personalize, compose, or govern | | Context | 2023–24 | Prompt / context window | Prompting, CoT, RAG release knowledge into runtime | Bounded window; "lost in the middle"; per-session amnesia; fragile composition | | Harness | 2024–present | Persistent external infrastructure | Persistent memory, tool registries, protocols, sandboxes, orchestration | Highest external layer; cost, safety, governance overhead |

The internal evolution: what the model knows → what the model can call → how to make the model reliably accomplish tasks.

Three Externalization Dimensions

1. Memory — Externalizing State Across Time

Core transformation: recall → recognition

Four layers:

• Working context — active mid-task state (open files, partial plans)
• Episodic experience — prior runs (decisions, tool calls, failures, reflections)
• Semantic knowledge — cross-episode abstractions (domain facts, heuristics)
• Personalized memory — stable per-user/team/environment preferences

Architectural spectrum (simple → advanced):

• Monolithic Context — entire history stuffed into prompt
• Context with Retrieval Storage — recent state in context, long-term in external store (GraphRAG, ENGRAM, SYNAPSE)
• Hierarchical Memory — OS-style resource decoupling (MemGPT / Letta, MemoryOS); semantic lifecycle decoupling (Mem0, MemoryBank, MIRIX, MemOS, xMemory)
• Adaptive Memory — dynamic modules with feedback-based policy optimization (MemEvolve, MemVerse, MemRL, GAM); paradigm shift "from storage to control"

Notable systems: MemGPT (virtual-memory metaphor), Generative Agents (stream + reflection + retrieval), ReadAgent (gist paging), A-MEM (Zettelkasten dynamic linking), Zep (Graphiti temporal KG).

2. Skills — Externalizing Procedural Expertise

Core transformation: generation → composition — agents assemble behavior from pre-validated components rather than improvising every step.

Four acquisition categories: Authored / Distilled / Discovered / Composed. Evolution path: atomic execution primitives → large-scale primitive selection → governable skill artifacts.

Representative systems:

• Voyager (Minecraft) — executable code skill library, retrieved by description
• Reflexion — "verbal reinforcement": failures become reusable reflection text stored in episodic memory, not weights
• AWM / Agent Workflow Memory — distill reusable workflows from successful trajectories
• EXTRACT — extracts transferable semantic skills from offline data, externalizing robotic procedural expertise
• Anthropic Agent Skills / SKILL.md — operations + decision heuristics + compliance constraints packaged as registered, progressively disclosed, composable explicit artifacts

3. Protocols — Externalizing Interaction Structure

Core transformation: ad-hoc → structured — fuzzy, fragile communication becomes interoperable, governable exchange.

Protocol categories: Agent-Tool, Agent-Agent, Agent-User, Other. Elements: intent capture, capability discovery, session lifecycle, permission and trust boundaries.

Representative protocols:

• MCP (Model Context Protocol, Anthropic) — JSON-RPC standardized Agent-Tool discovery and invocation, with human-in-the-loop and permission boundaries
• A2A (Agent2Agent, Google) — Agent Cards and task objects for cross-vendor delegation; v1.0 uses signed Agent Cards for verifiable identity governance
• Function Calling / Tool Use — structured schemas fix "call syntax + lifecycle semantics" as the foundational contract layer
• AG-UI — typed execution events and state streams for observable, portable human-agent interaction

Harness Engineering: The Orchestrating Runtime

Harness is not a fourth form of externalization — it is the engineering runtime that hosts the other three. It provides orchestration logic, constraints, observability, and feedback loops so externalized cognition becomes controlled execution.

Analytical dimensions (§6.2): Agent Loop, sandbox and execution isolation, human supervision and approval gates, observability, configuration/policy, context budget.

Harness plays two complementary roles:

• Throttle — cognitive flywheel: memory → skills → protocols → better execution → richer memory — a positive feedback loop that lets the system grow smarter with use
• Brake — human approval and safety sandboxes: Anthropic Claude Code uses OS-level seatbelt / bubblewrap isolation and classifiers to replace some manual review (mitigating "approval fatigue"); OpenAI Operator / CUA enforces user confirmation for sensitive actions (login, payments, CAPTCHAs) and pauses on an internal monitoring model. The core principle: cap blast radius first, approve per-action second

Representative harness systems: Claude Code / Agent SDK, Cursor, OpenAI Agents SDK, LangGraph (directed-graph state machine + checkpoints + human-in-the-loop), AutoGen / AG2, CrewAI.

Trade-offs: Parametric vs Externalized Capability

Externalization is not free (§7.3): update frequency/decay, reusability/portability, auditability/governability, latency/context burden.

Sharp edge cases in practice:

• Model becomes an "empty shell" — tool-calling only, zero-shot generalization degraded, reduced system transferability
• Reverse internalization — as models grow stronger, some verified externalization can be "inherited back" into weights (cf. Skill0.5's hybrid "internalize cognition, externalize skills"); Weng Li notes portions of Harness may eventually be "eaten" by stronger models
• Cost and risk — cognitive overhead, context burden, latency; security risks include memory poisoning, malicious skill injection, protocol spoofing; positive feedback loops can amplify errors
• Evaluation vacuum — no quantitative metrics for "degree of externalization"; hard to isolate the causal contributions of memory, skills, protocols, and harness

Embodied Externalization: The Cerebrum–Cerebellum Split

The paper extends externalization to Embodied Externalization (§8.2), proposing a cerebrum–cerebellum split — projecting the framework onto physical robots by transferring real-time motion control and procedural expertise, which are hard for large models to handle reliably, into external executable structures.

Representative architectures:

• RoboOS (arXiv:2505.03673) — first open-source embodied system with cerebrum–cerebellum layering: a cloud Embodied Brain (RoboBrain, MLLM) handles global perception, task decomposition, and real-time replanning; an edge Cerebellum Skill Library (grasping, navigation, dexterous hands) executes at low latency; a Real-Time Shared Memory bridges layers and multi-robot coordination
• BUAA AeroAgent — drone embodied architecture explicitly framed as "Agent as Cerebrum, Controller as Cerebellum": the agent issues high-level directives; the controller converts target points into rotor RPM commands
• Industrial frameworks — China CAICT classifies humanoid robots into Brain (perception/planning/decision) / Cerebellum (motion control) / Body layers; SaiVLA-0 uses a frozen VLM (brain) + parallel decoder (cerebellum)

Outlook: Self-Evolving Harnesses and Shared Infrastructure

Two forward-looking threads:

1. Self-Evolving Harnesses — harness itself moves from configuration to control, adapting orchestration and constraints based on feedback 2. Shared Agent Infrastructure — from private scaffolding toward shared artifacts and standards: cross-vendor protocol ecosystems, organization-level "Agent OS" with memory as shared governed state, and public-sector transparent harness

Open challenges (§8.4 / §8.6):

• Evaluation — lack of standardized system-/task-level benchmarks and ablation protocols; no harness-layer safety certification
• Governance — personalized memory privacy (differential privacy, right to be forgotten); multi-tenant memory access control; protocol identity authentication and audit; IP/legal traceability of externalized knowledge
• Co-evolution — how to make base models "externalization-aware" (retrieval-/protocol-sensitive pretraining) and jointly optimize end-to-end with the harness; interface stability and backward compatibility across model upgrades; resilience to externalization failure modes (dependency chains, stale artifacts, protocol interruption)

Why This Matters

• "Parameter-count faith" must cool, but should not invert into "Harness omnipotence." The paper's real contribution is elevating fragmented experience into a cognitive-architecture reframing — giving memory, skills, and protocols explicit cognitive function rather than being mere component labels.
• The layers are complementary, not exclusive. Weights → Context → Harness is a shift in capability center of gravity, not replacement. The strongest practice is hybrid "internalize + externalize"; blind externalization raises empty shells.
• Harness is the highest-leverage engineering layer today. Memory, skills, and protocols each have mature solutions; the truly scarce resource is the "OS kernel" that orchestrates them under controlled execution — sandboxes, approvals, observability, feedback loops. The Claude Code vs LangGraph contest is for this layer.
• Embodiment is the ultimate proving ground for externalization. The cerebrum–cerebellum split demonstrates that externalizing "hard but reliable" low-level control is the key to robots leaving the lab. Shared cognitive infrastructure across the open web is the further horizon — without governance and evaluation catching up, it remains a sketch.

One closing line: a better agent is not a better reasoner, but a better-organized cognitive system.

Paper Metadata

• Title: Externalization in LLM Agents: A Unified Review of Memory, Skills, Protocols and Harness Engineering
• Authors: Chenyu Zhou, Huacan Chai, Wenteng Chen, Zihan Guo, Rong Shan, Yuanyi Song, Tianyi Xu, Yingxuan Yang, Aofan Yu, Weiming Zhang, Congming Zheng, Jiachen Zhu, Zeyu Zheng, Zhuosheng Zhang, Xingyu Lou, Changwang Zhang, Zhihui Fu, Jun Wang, Weiwen Liu, Jianghao Lin, Weinan Zhang (21 authors)
• Institutions: Shanghai Jiao Tong University, Sun Yat-sen University, Shanghai Innovation Institute, Carnegie Mellon University (CMU), OPPO
• arXiv: 2604.08224 (cs.SE / cs.MA), submitted 2026-04-09, 54-page technical report
• Core thesis: LLM agent progress increasingly depends on external cognitive infrastructure (memory / skills / protocols + harness) rather than on stronger models; externalization restructures hard tasks into forms models can solve reliably.
• DOI: https://doi.org/10.48550/arXiv.2604.08224