docs: cross-reference runtime guide and add figures to deep agents production docs [closes DOC-1017]

src/oss/deepagents/going-to-production.mdx

@@ -5,6 +5,10 @@ description: Take your deep agent to production with persistent memory, sandboxe
 
 This guide covers considerations for taking a deep agent from a local prototype to a production deployment. It walks through scoping memory, configuring execution environments, adding guardrails, and connecting a frontend.
 
+<Tip>
+For a conceptual overview of the runtime primitives this guide configures—durable execution, memory, multi-tenancy, human-in-the-loop, observability, sandboxes, integrations, and cron—see [The runtime behind production deep agents](https://www.langchain.com/conceptual-guides/runtime-behind-production-deep-agents).
+</Tip>
+
 ## Overview
 
 Agents use information from memory and their execution environment to accomplish tasks.
@@ -24,6 +28,8 @@ This page covers:
 
 ## LangSmith Deployments
 
+![`deepagents deploy` packages your agent configuration—memory, sandbox, skills, MCP servers—and ships it to a LangSmith Deployment](/oss/images/deepagents/production/deepagents-deploy-config.png)
+
 The fastest way to get a deep agent into production is [`deepagents deploy`](/oss/deepagents/deploy), which packages your agent configuration and deploys it as a LangSmith Deployment with one command. Alternatively, you can configure a [LangSmith Deployment](/langsmith/deployment) directly. Either path provisions the infrastructure your agent needs: [assistants](/langsmith/assistants), [threads](/langsmith/use-threads), [runs](/langsmith/runs), a store, and a checkpointer, so you don't have to set these up yourself. It also gives you [authentication](/langsmith/auth), [webhooks](/langsmith/use-webhooks), [cron jobs](/langsmith/cron-jobs), and [observability](/langsmith/observability) out of the box, and can expose your agent via [MCP](/langsmith/server-mcp) or [A2A](/langsmith/server-a2a).
 
 For the CLI-based approach, see [Deploy with the CLI](/oss/deepagents/deploy). For manual setup, see the [LangSmith Deployments quickstart](/langsmith/deployment-quickstart).
@@ -70,6 +76,8 @@ For the full set of configuration options (custom Docker steps, store indexing,
 
 When your agent serves multiple users, you need to handle three concerns: verifying who each user is, controlling what they can access, and managing the credentials the agent uses to act on their behalf.
 
+![Three authentication layers compose: end-user auth, agent-acting-as-user auth, and team RBAC](/oss/images/deepagents/production/auth-layers.png)
+
 #### User identity and access control
 
 [LangSmith Deployments](/langsmith/deployment) supports [custom authentication](/langsmith/custom-auth) to establish user identity and [authorization handlers](/langsmith/auth) to control access to resources like threads, assistants, and store namespaces. Authorization handlers run after authentication succeeds and can:
@@ -159,6 +167,8 @@ When building for production:
 
 Deep Agents run on LangGraph, which provides [durable execution](/oss/langgraph/durable-execution) out of the box. The [persistence](/oss/langgraph/persistence) layer checkpoints state at each step, so a run interrupted by a failure, timeout, or [human-in-the-loop](/oss/langgraph/interrupts) pause resumes from its last recorded state without reprocessing previous steps. For long-running deep agents that spawn many subagents, this means a mid-run failure doesn't lose completed work.
 
+![Durable execution: when a worker crashes mid-run, another worker picks the run up from the latest checkpoint](/oss/images/deepagents/production/durable-execution.png)
+
 Checkpointing also enables:
 
 - **Indefinite [interrupts](/oss/langgraph/interrupts).** Human-in-the-loop workflows can pause for minutes or days and resume exactly where they left off.
@@ -173,6 +183,10 @@ Checkpointing also enables:
 
 Without memory, every conversation starts from scratch. Memory lets your agent retain information across conversations (user preferences, learned instructions, past experiences) so it can personalize its behavior over time. For an overview of memory types, see the [memory concepts guide](/oss/concepts/memory).
 
+![Short-term memory is scoped to a single thread via checkpoints; long-term memory persists across threads via the store](/oss/images/deepagents/production/memory.png)
+
+For a conceptual breakdown of short-term vs. long-term memory and how the store fits in, see [Memory in the runtime conceptual guide](https://www.langchain.com/conceptual-guides/runtime-behind-production-deep-agents#memory).
+
 ### Scoping
 
 Memory is always persistent across conversations. The main question is how it's scoped across user and assistant boundaries. The right scope depends on who should see and modify the data:
@@ -850,6 +864,8 @@ Sandboxes are isolated containers, so environment variables from your host aren'
 
 **Auth proxy (recommended).** The [sandbox auth proxy](/langsmith/sandbox-auth-proxy) intercepts outbound requests from the sandbox and injects authentication headers automatically. Sandbox code calls external APIs normally, and the proxy adds the correct credentials based on the destination host. This means API keys never appear in sandbox code, environment variables, or logs.
 
+![The sandbox auth proxy injects credentials into outbound requests so secrets never enter the sandbox](/oss/images/deepagents/production/sandbox-auth-proxy.png)
+
 ```json
 {
   "proxy_config": {
@@ -888,6 +904,8 @@ Agents in production run autonomously, which means they can loop indefinitely, h
 - **[Permissions](/oss/deepagents/permissions)**: declarative allow/deny rules that control which files and directories the agent can read or write. Use permissions to isolate the agent to a working directory, protect sensitive files, or enforce read-only memory.
 - **[Middleware](/oss/langchain/middleware/built-in)**: hooks that wrap model and tool calls for rate limiting, error handling, and data privacy.
 
+![Middleware hooks—before_model, wrap_model_call, wrap_tool_call, after_model—wrap the agent loop so policies run deterministically around every relevant step](/oss/images/deepagents/production/middleware-lifecycle.png)
+
 ### Rate limiting
 
 Rate limiting here refers to capping the agent's own LLM and tool usage within a run, not API gateway rate limiting for incoming requests.

src/oss/deepagents/harness.mdx

@@ -15,6 +15,12 @@ An agent harness is a combination of several different capabilities that make bu
 
 Alongside these capabilities, Deep Agents use [Skills](#skills) and [Memory](#memory) for additional context and instructions.
 
+![The Deep Agents open harness: planning, virtual filesystem, permissions, subagents, context management, code execution, human-in-the-loop, skills, and memory](/oss/images/deepagents/production/open-harness.png)
+
+<Tip>
+The Deep Agents harness is [MIT licensed](https://github.com/langchain-ai/deepagents) and fully open—every layer is inspectable and customizable. For a conceptual overview of why this matters and how the harness sits on top of the production runtime, see [The runtime behind production deep agents](https://www.langchain.com/conceptual-guides/runtime-behind-production-deep-agents). For guidance on taking a harness into production, see [Going to production](/oss/deepagents/going-to-production).
+</Tip>
+
 ## Planning capabilities
 
 The harness provides a `write_todos` tool that agents can use to maintain a structured task list.