Claude Science is really an agent harness with an arbiter daemon

A teardown of build 0.1.15-dev shows that behind the familiar interface, Claude Science runs a daemon that holds permissions and history, while the Python and R kernels keep only working state. The signed 111 MB app is just a loader: it unpacks a roughly 3.9 GB install, about 95% of which is separate execution environments.

The generated code calls host with no host package present in the environment. kernel_worker.py shows the daemon injecting the SDK through the first execute() after kernel start, with host.llm() and host.mcp() going out as synchronous RPC across the process boundary. Even faking a raw _host_call("mcp", ...) in the analysis kernel won't return a capability: the daemon checks permission before dispatch.