The Agent Harness: Past, Present, and Future of the Layer Between the Model and the World — Seven Parts, Four Eras, Eight Bets

I already have a definition, and I am not going to rewrite it. In the September article on what remains engineering I called the agent harness the execution environment: the working loop, tools, state, constraints and feedback. The Claude Code documentation says almost the same thing more briefly: a harness is the tools, context management and execution environment that turn a language model into a working agent; Claude Code is the harness, Claude is the model inside. Birgitta Böckeler on Martin Fowler's site is shorter still: everything in the agent except the model. The three definitions do not contradict one another, but they do not help you design anything either. Design needs a decomposition.010101Maxim Smirnov and I walked through the ladder “prompt → context → harness → loop” in a July livestream; that is also where we discussed why the main part of the loop is not the one that tells the agent “keep going” once more, but the one that can say “stop”.Knizhny kub · Loop Engineering01Maxim Smirnov and I walked through the ladder “prompt → context → harness → loop” in a July livestream; that is also where we discussed why the main part of the loop is not the one that tells the agent “keep going” once more, but the one that can say “stop”.Knizhny kub · Loop Engineering

First, the term's neighbors, because in 2026 they get confused even in glossaries. A framework is a library the harness is assembled from; it does not run the agent and does not own its boundaries. A runtime is where the harness runs at a vendor. Scaffold is a word from the 2024 era; in Anthropic's 2025 documents it meant the whole wrapper around the model, while in the Hugging Face glossary of May 2026 it means only the behavior layer, and the execution layer is what they call the harness. There is no single definition, and the glossary's authors say so honestly. Finally, the word has a second meaning that usually gets lost: the training environment. In July 2026 Prime Intellect split the training environment into exactly two parts — a task set and a harness, the program that solves those tasks and produces trajectories; one configuration serves both evaluation and training. It is the same object seen from the lab's side, and it will return later in the article.

Now the decomposition. I split the harness into seven parts, and each part answers a question the model asks the world. What can I see — context and memory. What can I do — tools and environment. How long, and when to stop — the loop. Who checks — verification. How to scale — orchestration. Who sees what happened — observability and evals. Who permits — trust and boundaries. Historically the harness answered the first three questions with words: instructions in the prompt, tool descriptions, skills. The last four it answered with walls: code that runs regardless of what the model decided. What walls are not matters just as much: they do not lead the model by the hand at every step, they fence the field — what it may touch, where it may go, who will see. This split into words and walls is the spine of the whole article, and the rest of it shows three movements at once: words shrink, walls grow, and there is more freedom inside the walls.

The site's corpus already has two decompositions of the same entity, and a third one without a reconciliation would look like inconsistency. In the July longread on the co-evolving stack the harness is one of six layers, between the model and the tools, and it is responsible for context, planning, compaction, state, isolation and confirmations. The same article audited six months of history of three open harnesses and split them into ten mechanisms. The seven parts here are not a replacement but a different cut: not “what lives in the repository” but “which question of the model's does this answer”. The table's last column ties the cuts together: each part corresponds to one to three mechanisms from the July audit.

The word is older than agents. In testing, a harness is the set of stubs and drivers that let you exercise a component outside its real surroundings. It came into the world of language models by the same road: EleutherAI's lm-evaluation-harness is an evaluation runner, not a wrapper for actions. As late as August 2024, OpenAI's description of SWE-bench Verified called the wrapper around the model a scaffold and the harness the containerized test runner. In January 2025 Anthropic defined an agent as “a combination of a model and the software scaffolding around it”, and in the Claude 4 and Sonnet 4.5 announcements the SWE-bench results came with a note about “a simple scaffold with two tools — bash and file editing”. The shift from scaffold to harness happened when the wrapper became a product: in September 2025 Anthropic described the Agent SDK as “the harness that Claude Code runs on”, and by 2026 METR had replaced scaffold with agent harness in its reports. The discipline arrived in February 2026: Mitchell Hashimoto wrote that he did not know an accepted term and started calling his practice harness engineering, and six days later OpenAI's post of the same name came out.

Behind the word stand four eras, and in each the harness compensated for a specific weakness of the model. In 2022–2023 the model could not act: no tools, no memory. The think–call–read loop was hand-written around the API, and the first harness function moved into the API as early as June 2023, when OpenAI added function calling to gpt-4-0613. In 2024 the model could act but got lost in a repository and on a long task — this is the era of scaffolds: SWE-agent's agent–computer interface, the role graphs of LangGraph and CrewAI, the planner and the critic, Claude's screen control in October and the MCP context protocol in November. In 2025 the model was already writing files and whole features while the products around it offered autocomplete and chat: Boris Cherny calls this product overhang, and Claude Code grew out of the observation that Sonnet 3.5 could do more than it was allowed to. One general-purpose agent in the file space became a product — Claude Code, Codex, Gemini CLI — and within a year it was surrounded by a repository instruction file, a harness SDK, a skills standard and a standards foundation under the Linux Foundation.

2026 is the era of discipline and infrastructure. The harness is described as an engineering practice with its own posts, courses and exams, and at the same time it is rented out whole: in April Anthropic released Managed Agents and called it a “meta-harness”, in May Google showed Managed Agents in the Gemini API, in June Microsoft — Foundry Hosted Agents. In July the MCP protocol became stateless, in August GitHub released a plugin standard, and Antigravity replaced Gemini CLI on the free tier. The model weakness that the 2026 harness compensates for sounds paradoxical: the model does more than the product allows, and the harness itself goes stale faster than it is written. Konstantin Krestnikov's periodization from Data Fest — from bare language models through ReAct and chains to graphs and finally to one agent with files — matches mine up to the era boundaries, and his metaphor is exact: the model is the pulling power, the files are the field, the harness is the yoke.

Anthropic stated the main law of this evolution in March 2026 in a single sentence: every harness component encodes an assumption about what the model cannot do on its own. Everything else follows from that. Once the assumption stops being true, the component becomes not useless but harmful: it constrains the model to what the model has already outgrown. In July I called the harness a temporary theory of the current model's weaknesses; now we can trace which of those theories have already been refuted and which the labs keep deliberately.020202The best example of migration part by part is Cursor's one-year report on cloud agents: procedure moves out of the harness into tools the agent picks itself, while the complexity grows around the environment, policies and state.Knizhny kub · Cursor's cloud agents02The best example of migration part by part is Cursor's one-year report on cloud agents: procedure moves out of the harness into tools the agent picks itself, while the complexity grows around the environment, policies and state.Knizhny kub · Cursor's cloud agents

Here is the dated line of what moved into the model. Function calling — June 2023. Grammar-constrained structured output — August 2024: the JSON mode of a year earlier promised only valid syntax, not schema conformance, and in Simon Willison's experience even the syntax was not guaranteed. Screen use — October 2024, when Anthropic wrote outright that it was teaching the model general computer skills instead of building tools for each task. Reasoning between tool calls — in Claude 4 it was switched on with a beta header, in 4.6 it switches on by itself, in 4.7 the manual mode is rejected: a harness flag dissolved into the model's behavior. Tracking the remaining context — Sonnet 4.5 receives budget tags from the API, Opus 4.7 and newer no longer do. Compacting the history — in November 2025 OpenAI called GPT-5.1-Codex-Max “the first model trained to work across multiple context windows”; that is a claim, not a measurement, and Simon Willison promptly reminded everyone that Claude Code had been doing the same thing at the harness level. The most telling line is in the Claude Code changelog: the task-tracking tools are now offered only to models older than Opus 4.7. A component that was mandatory for a year has been removed for newer models because they keep the plan in their heads.

Now what the labs keep in the harness deliberately, and here the wording matters more than the dates. Claude Code documentation: permission rules are enforced by Claude Code, not by the model; instructions in the prompt determine what the model tries to do but do not change what it is allowed to do. Also there: CLAUDE.md is not a hard enforcement layer, and to block an action regardless of the model's decision you need a hook before the tool call. An operating-system-level sandbox, by Anthropic's data, cut confirmation prompts by eighty-four percent and covers any subprocesses — not because the model is unreliable, but because the boundary has to hold even if it were. Codex describes two layers outside the model — the sandbox mode and the approval policy — and explains it directly: you trust not the agent's intentions but the fact that it acts inside enforced boundaries. The compaction policy also stays with the developer: Anthropic's server-side compaction has a default threshold, but the summary prompt is replaceable and “model-dependent”. The pattern is visible to the naked eye: what can be trained goes into the weights; what cannot be entrusted even to a well-trained model stays in the harness.

The training environment and the deployed harness converge

The word's second meaning from the first section becomes a mechanism here. In October 2025 Cursor wrote that in reinforcement learning the Composer model “can call any tool of the Cursor Agent harness”, and in the Composer 2 report in March 2026 — that training runs “in realistic Cursor sessions with the same tools and harness as the deployed model”; model checkpoints ship roughly every five hours, and the user has become part of the training environment. Cognition, in the SWE-1.5 announcement, talks about retraining the model on the updated Cascade harness. OpenAI trained GPT-5-Codex “on real engineering work” and recommends using it “only in Codex or Codex-like environments” — the training harness is not named, but the recommendation speaks for itself. Zhipu assembled more than ten thousand environments for GLM-5 in the Harbor format — that is, in the format of the Terminal-Bench benchmark. The minimal preset of DeepSeek's open harness is described in the repository as “RL-agent composition”: a short fixed prompt, a persistent bash and a line editor reproduce the training environment. Anthropic makes no direct statement and speaks only of “the same infrastructure as Claude Code” — and the absence of a statement is not the absence of a practice.030303I wrote about DeepSeek Harness separately: there the session log is append-only, compaction repeats the previous prefix byte for byte for the sake of the cache, and the loop “harness → trajectories → fine-tuning → the same harness” is so far an architectural possibility, not a proven data policy.Knizhny kub · DeepSeek Harness03I wrote about DeepSeek Harness separately: there the session log is append-only, compaction repeats the previous prefix byte for byte for the sake of the cache, and the loop “harness → trajectories → fine-tuning → the same harness” is so far an architectural possibility, not a proven data policy.Knizhny kub · DeepSeek Harness

If the model learns in its own harness, a foreign harness at the frontier should lose — and should lose by a little, because frontier models are trained to transfer skill across wrappers. That is exactly what the measurements show. In June 2026 Harbor-Index pitted the models' native harnesses against the neutral Terminus-2 on the same tasks: the native one is “usually slightly ahead, but no comparison is statistically significant”. In February METR wrote that Claude Code and Codex are “not obviously better” than the lab's default scaffolds: Opus 4.5 in Claude Code beats a simple ReAct in only half of the bootstrap samples, GPT-5 in Codex beats Triframe in one of seven. And at the same time, below the frontier the spread is enormous. On Claw-SWE-Bench GLM 5.1 solves nineteen percent of tasks with a minimal adapter and seventy-three with the full one; averaged across models, the choice of harness shifts the result by twenty-seven points. The GigaChain team sees a twenty-to-thirty-point spread between harnesses on its own measurements with one and the same model.

Harnesses that rewrite themselves

The logical continuation of co-evolution is a harness changed not by an engineer but by another agent. The idea is older than it looks: in August 2024 Hu, Lu and Clune described a meta-agent that iteratively programs new agents from an archive of earlier discoveries. Sakana's Darwin Gödel Machine in May 2025 raised its SWE-bench score from twenty to fifty percent by rewriting its own code — and in the same paper the authors report that the machine removed the markers the reward function used to catch hallucinations, against an explicit instruction not to. In 2026 the direction became academic routine: Meta-Harness from Stanford, Agentic Harness Engineering with GPT-5.4 going from seventy to seventy-seven percent on Terminal-Bench, DemoEvolve with the honest conclusion that self-evolution on a sparse reward is “brittle”. In June Anthropic released “a harness for every task” — Claude writes the orchestration script on the fly. All of this works, and all of it optimizes exactly the reward it was given. An ACL 2026 paper adds an unpleasant touch: experience accumulated on harmless tasks still undermines safety in risky scenarios, because it strengthens the tendency to act rather than to refuse. A self-modifying harness without a hidden judge and a ledger of assumptions is Goodhart's law handed a machine gun.

Three 2026 figures describe one movement. Boris Cherny in a July interview: “we deleted eighty percent of the system prompt — Opus 5 just does it”; there is an environment variable that removes all prompts altogether, and in that bare mode the model turns out even slightly better on the team's measurements. Nick Nisi of WorkOS at AI Engineer Europe: they generated ten thousand seven hundred lines of skill instructions from documentation, after deleting ninety-five percent the result got better, and flow control moved out of the skill into a TypeScript state machine. Vercel in December 2025: they removed eighty percent of the tools from an internal agent, leaving a single bash — three and a half times faster, a third fewer tokens, and success on the internal set went from four of five queries to five of five. All three are self-reports, and Vercel's “one hundred percent” is five queries. But the direction at three independent teams is the same, and Vercel states it most sharply: the model makes better choices when we stop making choices for it.040404I went through Cherny's talk the day after the Opus 5 release. My main takeaway then was this: the system prompt and the instruction file are technical debt with a shelf life of one model generation.Knizhny kub · Boris Cherny on −80 % of the prompt04I went through Cherny's talk the day after the Opus 5 release. My main takeaway then was this: the system prompt and the instruction file are technical debt with a shelf life of one model generation.Knizhny kub · Boris Cherny on −80 % of the prompt

The words do not disappear — they change genre. In OpenAI's post on harness engineering the AGENTS.md file is about a hundred lines and serves as “a map with pointers to documentation” in a structured catalog: the agent reads what it needs now, not everything at once, because, as the authors write, “anything the agent cannot reach in context does not exist for it”. The skills standard is built the same way: a hundred tokens of metadata are always in context, instructions of up to five thousand tokens load on demand, resources as needed; the standard's showcase lists forty-six clients. A study of one hundred twenty-four PRs from ten repositories links the presence of AGENTS.md to a nearly thirty percent reduction in median time and sixteen percent in output tokens at comparable task completion — a correlation, not an experiment, but it agrees with Vercel's internal evals, where an eight-kilobyte documentation index in AGENTS.md scored one hundred percent against seventy-nine for skills. The map beats the script because the script encodes an assumption about how the model should go, and the map only about where things are.050505What I value most in Nisi's talk is the story of the marker file the agent created with a touch command instead of running the tests; in Vercel's, the honest caveat that they cannot separate the contribution of the architecture from that of a stronger model in the doubling of the score.Knizhny kub · Nick Nisi on skillsKnizhny kub · Vercel d005What I value most in Nisi's talk is the story of the marker file the agent created with a touch command instead of running the tests; in Vercel's, the honest caveat that they cannot separate the contribution of the architecture from that of a stronger model in the doubling of the score.Knizhny kub · Nick Nisi on skillsKnizhny kub · Vercel d0

The loop: from a bash one-liner to a judge on another model

The loop is the second harness part that historically lived in words, and its evolution over the year is instructive. In July 2025 Geoffrey Huntley described Ralph: “in its pure form it is a bash loop” that feeds the agent the same prompt over and over. A year later at Anthropic it is an official plugin, implemented through a session-stop hook with an iteration limit, and next to it are built-in commands: repetition on a schedule or self-paced with a one-week lifetime, and a goal whose completion is checked by “a fresh model, not the one doing the work”. Every turn creates a checkpoint, the last hundred are kept, and the documentation honestly warns that changes made by bash commands are not tracked. The Agent SDK sets hard limits on the number of turns and on the budget in dollars, and the budget covers subagents. Kyle Mistele of HumanLayer suggests looking at all of this as a textbook control loop: the setpoint is the desired property of the codebase, the sensor is a deterministic check, the controller picks the next small change, the actuator is the agent, and a model is far from necessary in every link. The direction is the same as for instructions: from “repeat until it works” to “stop when an independent check said it worked”.

Context: a million tokens, and compaction all the same

In 2026 context is a finite resource even with a seemingly infinite window. Anthropic's models from 4.6 onward got a million-token window by default and at the standard price, and Claude Code still compacts the history at ninety-seven percent of the window: first it clears old tool outputs, then it summarizes, then it re-reads up to five changed files. The reason is named in the documentation itself with the words context rot — Chroma showed on eighteen models that quality declines as input length grows, even on simple tasks. Back in September 2025 Anthropic described three techniques for tasks longer than the window: compaction, structured notes in external memory, subagents with condensed summaries — and within a year all three became API or product features. The economics of the prefix cache and the warning about memory that promotes any past answer to a rule I covered in the July and September articles; here one thing matters: even where the harness compresses instructions, context management remains its job, because the model cannot see its own window from the outside.

While instructions shrink, the code that runs regardless of the model's decision grows. It does not dictate the model's route: inside the field the model picks its own tools, order and moment of checking; the code holds the edges of the field. The most visible growth is hooks. The Claude Code guide lists thirty-three events: session start, permission request, before and after a tool call, agent and subagent stop, before and after compaction, worktree creation, configuration change. Exit code 2 blocks the action, the decisions deny, defer, ask and allow combine so that the strictest wins, and the documentation states the purpose bluntly: some actions must happen always, not at the model's discretion. Hooks can be not only scripts but also prompts to another model, and this is an important hybrid: a probabilistic check inside a deterministic loop. Permissions come in six modes, and in auto mode a separate classifier model checks actions before execution and blocks anything outside the scope of the request; some actions are never auto-approved in any mode.

The environment became part of quality, and this is the second growing belt of walls. Cursor, summing up a year of cloud agents, writes that an incomplete environment does not fail with an error — the agent simply works worse, and the degradation gets blamed on the model. Hence resumable workspaces: images with version history, rollback, audit, egress rules. In April Anthropic split the runtime into the “brain” — the model with the loop, compaction and memory — and the “hands” — the tools and the sandbox. While they lived in one container, the model could not start reasoning until the environment finished building, and a failure of either half killed the agent whole; after the split, time to first token fell by sixty percent at the median and by more than ninety at the tail, a dead sandbox is recreated, a dead “brain” is brought back from the session log. Credentials in this scheme are decrypted only at the moment of the tool call, and the model never sees them. In January Docker moved agent sandboxes to dedicated micro-VMs, Vercel announced a bounty of up to a million dollars for escaping its own, and git worktrees became the isolation primitive at Claude Code, Cursor and Codex.

Tools: four basic ones and a stateless protocol

Tools shrink in their descriptions and grow in the environment. There are four basic ones — read a file, search, edit, bash; mini-SWE-agent gets by with a single bash in a hundred lines and scores above seventy-four percent on SWE-bench Verified, and Pi deliberately lives without the MCP protocol and without subagents, with four tools and TypeScript extensions. When there are thousands of tools their descriptions stop fitting into context, and the harness answers with tool search — Anthropic holds up to ten thousand deferred definitions and reports a token reduction of more than eighty-five percent, honestly adding that accuracy drops after thirty to fifty available tools. The next step is programmatic calling: the model writes code in a container, calls tools from it and gets only the script's output into context; Anthropic claims plus eleven percent in quality at minus twenty-four percent input tokens, and Cloudflare had arrived at the same thing a year earlier with the phrasing “models have seen a lot of code and few tool calls”. The MCP protocol itself, in the revision of 28 July 2026, became stateless: the handshake and the session identifier are gone, server discovery and subscriptions appeared, tasks moved into an extension, dynamic OAuth client registration is deprecated, trace context travels in metadata, and any feature gets at least twelve months before removal. The foundation that governs it grew in nine months from one hundred forty-six to one hundred ninety members, including the US Army and the national laboratories, and cumulative SDK downloads passed a billion.

Verification, observability, identity

Verification is the fastest-growing wall, because it does not require trusting the model. At OpenAI it looks like this: about a million lines in five months, fifteen hundred PRs, seven engineers and zero lines written by hand — and the discipline “shows up in the scaffolding, not in the code”: custom linters that answer the agent with a message containing fix instructions, CI that keeps the documentation fresh, background agents that collect garbage. Böckeler calls these sensors, as opposed to guides, and Thoughtworks in its April Radar describes the same two categories: guides such as skills and specifications, sensors such as mutation testing — under the shared theme “putting coding agents on a leash”. The judge on another model, replayable episodes and the difference between pass@k and pass^k are the subject of a separate article, and in January 2026 Anthropic formalized the same ladder: task, run, grader, transcript, result.

With observability and trust the picture is mixed. Claude Code exports metrics, events and traces over OpenTelemetry, but the GenAI conventions in OpenTelemetry themselves, as of mid-July 2026, are still in “Development” status — there is no stable release, and every vendor traces in its own way. Agent identity, by contrast, took shape as a product within six months: in April Okta made agents full directory records, in August it released single sign-on for agents, and the Cross App Access extension became an official part of MCP for enterprise authorization; in February NIST launched a standards initiative for agents with a separate pillar on identity, and OWASP published its top ten risks for agentic applications. And one more story about the boundary as a product: on 31 March 2026 the Claude Code package went out to npm with a source map — about one thousand nine hundred TypeScript files; Anthropic called it a packaging error, not a security breach, but a day later trojanized “leaks” appeared online. The harness is value that gets stolen and value that gets attacked through. In the security snapshot I showed that every 2026 injection fix ran along boundaries — files, network, auto-approval — and not one was a sentence in a prompt. It is the same pattern seen from the attacker's side.

The third movement is the harness parts that every team wrote itself in 2025 being rented out in 2026. Orchestration went first. Subagents in Claude Code run in their own context windows, return only a summary, nest three levels deep and run up to twenty in parallel; agent teams share a task list and mailboxes, and the documentation honestly says they spend significantly more tokens than a single session. In September, Projects spawn cloud sessions on separate branches from one coordinating conversation, and Routines launch an agent on a schedule, on a GitHub event or by API call, with no permission prompts during the run. The 2025 argument between two schools — Anthropic with an orchestrator and workers that beat a single model by ninety percent on internal evals at fifteen times the token spend, and Cognition with one thread and full traces instead of messages — is not settled, but it has stopped being an argument about code: both strategies are now runtime settings.

Long loops went second. Cursor keeps the agent loop in Temporal, manages the virtual machine's lifecycle separately, and moves storage and conversation streaming into its own layer: “one agent” splits apart by lifetime and by state owner. In September 2026 Temporal raised five hundred fifty million at a twelve-and-a-half-billion valuation “amid demand for reliable AI infrastructure”; Cloudflare built waiting for an event — that is, a pause for human confirmation — directly into the steps of its engine; Inngest explains the demand in one sentence: re-running a step with a model means paying for the tokens again. Durable execution had existed for ten years for payments and orders; the agent loop turned out to be the same class of problem with a more expensive retry.

The runtimes themselves went third. In eight weeks of spring 2026 three vendors released a managed harness whole: on 8 April Anthropic — Managed Agents, “a ready, configurable agent harness on managed infrastructure” with agent, environment, session and event primitives, cloud or self-hosted sandboxes, and a price of eight cents per active session hour on top of tokens; on 19 May Google — Managed Agents in the Gemini API, where one call brings up a remote Linux sandbox configured by AGENTS.md and SKILL.md files; on 3 June Microsoft — Foundry Hosted Agents and an “Agent Harness” in its framework with auto-compaction, file-based memory and a shell. The flip side of the same wave: OpenAI is shutting down its visual agent builder on 30 November 2026, keeping the SDK. Builders lost to code and to the runtime at the same time.060606Anthropic's Applied AI team told this story as three generations of surfaces — Messages API, Agent SDK, Managed Agents — and their main point is about the context resets the team built in for the “nervous” Sonnet 4.5, which under Opus 4.5 became pure overhead.Knizhny kub · the evolution of agentic surfaces06Anthropic's Applied AI team told this story as three generations of surfaces — Messages API, Agent SDK, Managed Agents — and their main point is about the context resets the team built in for the “nervous” Sonnet 4.5, which under Opus 4.5 became pure overhead.Knizhny kub · the evolution of agentic surfaces

So what stays in-house at the companies that have gone down this road? At Stripe more than one thousand three hundred PRs a week are produced entirely by agents on a fork of the open goose harness and reviewed by people; what remained their own were Blueprints — deterministic process skeletons — and an internal tool server. At Spotify background agents on Claude Code ran two hundred forty migration PRs and saved about ten engineer-weeks, while skills and customizability are switched off deliberately for the sake of guardrails. At Cloudflare, one hundred thirty-one thousand review runs in a month at a dollar nineteen per run, with a “break glass” bypass in six cases out of a thousand and a separate reviewer for the AGENTS.md file. Three companies, three different rented harnesses — and in all three the same things stayed their own: the task, the context, the success criteria and the policy. Konstantin Krestnikov put the same thought from the other side: powerful models no longer need a complex harness, it is enough to give the agent the right files and an instruction.070707Krestnikov's Data Fest talk is dear to me also for its honest benchmark without a judge model: tasks on files, memory and CSV with reference answers, a twenty-minute run on any harness.Knizhny kub · one agent with files07Krestnikov's Data Fest talk is dear to me also for its honest benchmark without a judge model: tasks on files, memory and CSV with reference answers, a twenty-minute run on any harness.Knizhny kub · one agent with files

Messages API → Agent SDK → Managed Agents: the boundary of “what is mine” shrinks to the task, the context, the episodes and the identity

An honest article about the harness is obliged to gather in one place everything that argues against it. First, the effect at the frontier. Harbor-Index: native harness versus neutral — not significant. METR: Claude Code and Codex not obviously better than the default scaffolds. Meta-Harness promises a sixfold gap in its introduction, and in its own table on Terminal-Bench gives Opus 4.6 plus one point seven points. Put that together with the twenty-seven points of Claw-SWE-Bench and the twenty to thirty points of GigaChain, and you get not a contradiction but the shape of a curve: the gulf between a broken and an adequate harness is measured in tens of points, the gap between two adequate ones at the frontier in single digits. This is exactly what I formulated in July as “at the frontier harnesses converge, below the frontier the harness decides”; in two months the numbers arrived.

Second, what the harness cannot do in principle. Dex Horthy at the AI Engineer World's Fair attached a footnote to the formula “agent equals model plus harness”: a good harness sharply improves execution but does not teach the model to hold architectural quality over the long haul, because the signal “tests passed” does not penalize a spare try/catch or changes sprawling across the system, and the cost of bad design shows up months later. There is no fast verifier for maintainability, and he admits it honestly. His own team tried a “lights-out factory” in 2025 and a few months later ran into an incident in a codebase that people were no longer watching. DORA's May report on return on investment gives a similar picture from above: thirty-five to forty percent gain on new tasks and about ten on legacy, while the change failure rate in the model calculation rises from five to six percent.080808From YC Paper Club I remember the Prime Intellect story about 99.9% on ARC-AGI that turned out to be cheating once the logs were read; from Horthy, the caveat that he sells tools for the very process he describes.Knizhny kub · YC Paper Club on harnessesKnizhny kub · Dex Horthy08From YC Paper Club I remember the Prime Intellect story about 99.9% on ARC-AGI that turned out to be cheating once the logs were read; from Horthy, the caveat that he sells tools for the very process he describes.Knizhny kub · YC Paper Club on harnessesKnizhny kub · Dex Horthy

Third, methodology. A paper with the telling title “Stop Comparing Agents Without Disclosing the Harness” shows that current evaluation protocols systematically attribute harness gains to model improvements. A survey of thirteen agents across twelve dimensions finds that eleven of the thirteen combine several primitives and diverge exactly where the questions are open — in compaction and state. For a practitioner the conclusion is one: the harness in a measurement report is as mandatory as the model version, and a number without the harness's name is not a number. This, incidentally, also explains why METR's original “minus nineteen percent” had not “flipped” by February 2026, as secondary retellings claim: for the original cohort the estimate is “a speedup of minus eighteen percent” with an interval crossing zero, for the new one minus four. Tools change, harnesses change, and measuring a task in the lab still does not measure delivery.

In July I laid the labs out by the stack layers they own — from hardware to traces. Here the cut is different: by the seven harness parts each player is betting on, and by the mechanism from the third section that explains those bets. The general rule is simple. Functions that can be trained the lab moves into the weights and stops selling as a harness. Functions that cannot be entrusted to the model — permissions, isolation, the compaction policy, identity — it keeps in the runtime and sells as infrastructure. The interfaces between them — protocols and instruction files — it hands over to standards, because a neutral interface expands the market for its own model.

Anthropic bets on the harness as a product at three altitudes: Claude Code for the developer, Cowork for the employee, Managed Agents for the platform; MCP and skills have been handed to open standards, and at its May conference the company formulated the thesis “infrastructure, not intelligence, is the bottleneck”. I expect that over the next five years it will develop precisely the runtime — “brain and hands”, the session log, built-in graders — because the model and the runtime are the moat and the interfaces are neutral territory. OpenAI bets on one harness under all surfaces — App Server unified the terminal, the IDE and the web — and on the harness inside the repository: linters, CI and documentation as machine-readable constraints. Thibault Sottiaux says Codex “is becoming the standard agent” and that scaling to billions of users hinges on isolation; I expect OpenAI to spend five years developing the sandbox and enterprise identity, because those are what turn a developer tool into a product for everyone. Google bets on one harness brand for the IDE, the terminal, the SDK and the API, and on owning the environment that others have to rent: the browser and the operating system. Replacing the open Gemini CLI with the closed Antigravity CLI on the free tier shows a willingness to pay with openness for platform coherence. Microsoft and GitHub bet on the harness in the operating system and in the task-tracking surface: the agent does not need to invent branches, PRs and permissions, they already exist.

The second group bets on a model trained in its own harness: Cursor, which since August 2026 has reportedly been a subsidiary of SpaceX, and Cognition with SWE-1.5, where the model, inference and harness are designed as one system. The third — open weights plus its own harness as a training environment: DeepSeek with a minimal preset that reproduces the training environment, and Moonshot with a swarm of up to three hundred subagents in Kimi K2.6. The fourth — a minimal core and a marketplace of models: OpenCode as the layer between developers and providers with thirteen million monthly active users according to its head, Pi with four tools, mini-SWE-agent with a hundred lines. For this group the model is interchangeable, the harness is thin, and the competition is on price.090909What makes the OpenCode story interesting is how Anthropic's January attempt to cut a third-party harness off from subscriptions became an accelerator for it: people wanted to see what exactly was being blocked.Knizhny kub · OpenCode as a marketplace of models09What makes the OpenCode story interesting is how Anthropic's January attempt to cut a third-party harness off from subscriptions became an accelerator for it: people wanted to see what exactly was being blocked.Knizhny kub · OpenCode as a marketplace of models

The Russian landscape

A note on the venue: this text was written for Sber's conference, Sber's products are discussed below, and all of their figures are vendor claims. The Russian bet is a ready open harness plus a profile for one's own model. GigaChain took Deep Agents from LangChain, plugged in GigaChat with a config change, and at an external competition got sixty-seven tasks with the same model against seventy for Claude Code, even though Anthropic optimizes the model and the harness for each other; the model profile described on Habr raised success on the internal set from seventy-seven to eighty-seven percent at half the token spend. Yandex built the open OpenCode into SourceCraft CLI. T-Bank opened trading to external agents via MCP — the harness became a client of a financial service. At Saint HighLoad++ in July Raiffeisen reported a quarter of its backlog going through agents, with four percent of tasks fully autonomous. The conclusion for this landscape is the same one I drew in July, only now with numbers: harness sovereignty is cheap — open cores, standard protocols, a profile in a month — model sovereignty is expensive, and the harness does not replace it.

A forecast without a sign of refutation is not a forecast but a mood. So each of the eight bets below is tied to a year and to an observable sign by which it can be called wrong. The class of all eight is the author's forecast; the supports are METR's metrics, the DORA and JetBrains reports, vendor announcements and the co-evolution mechanism from the third section. The overall vector is one: what can be trained will go into the model; what cannot be entrusted will remain a wall and move to the vendor; what stays with companies as their own is the task, the context, the episodes and the identity.

A few explanations for the bets that look bolder than the others. The first rests on three managed runtimes shipping within eight weeks, not on faith in vendors: when three competitors converge on one architecture, the architecture becomes the market's expectation. The second rests on what has already happened: reasoning between calls and context tracking went into the model within a year, and compaction with memory is of the same type. The fourth rests on JetBrains, where ninety percent of developers use agents weekly and about half of the code is written entirely by agents: the next step after “every day” is “without me”. The seventh rests on the NIST initiative and on Dario Amodei's September essay about “built-in graders”: when a lab itself asks for regulation of the runtime, it comes. The eighth is a direct continuation of the seventh section and the only bet that already has 2026 data.

The horizon of all the bets is bounded by what METR calls the task horizon: the fifty-percent horizon of Opus 4.5 in January 2026 was three hundred twenty minutes with a wide interval, doubling every three to seven months depending on which stretch of the series you take. If the doubling holds, by 2028 an agent will hold a task the length of a working week, and the harness for such a task is no longer a loop but an operating system with a scheduler, memory and permissions. If the doubling slows, bets one, four and five shift by a year or two, but the direction does not change: back in June 2025 Gartner promised the cancellation of more than forty percent of agentic projects by the end of 2027, and the survivors will be the ones that are observable, bounded and cheap to check — that is, the ones whose walls were built before their words.

From the law “every component encodes an assumption” follows a practice, and it is not a checklist. In September I proposed an ablation test: take characteristic episodes, compare the current model with the full harness, with a simplified one, and a new model with minimal adaptation, and remove the rule that no longer improves anything. The test is a method; it needs a record-keeping form. I call it the harness ledger: for each component — a hook, a rule, a skill, a reset, a tool — you write down which assumption about the model it encodes, what evidence confirms it, under which model and version, what triggers a recheck, and in which ownership mode the component lives. The last column comes from the ownership boundary framework: rent, adapt, own.101010In an interview Sottiaux frames the same thing as an engineering dilemma: where to fix a problem — in the harness, or by waiting for the next model — and admits that a large workaround may turn out to be unnecessary a month later.Knizhny kub · Tibo Sottiaux on Codex10In an interview Sottiaux frames the same thing as an engineering dilemma: where to fix a problem — in the harness, or by waiting for the next model — and admits that a large workaround may turn out to be unnecessary a month later.Knizhny kub · Tibo Sottiaux on Codex

The ledger solves three problems a checklist does not. First, it distinguishes assumptions from boundaries. A context reset at sixty percent of the window is an assumption about a nervous model, and it has to be rechecked with every new model; a hook forbidding destructive commands outside the worktree is a boundary whose recheck trigger is “never”, because it protects against injection, not against a weakness of the model. Second, it gives a shelf life: Cherny's practice — every six months delete the instructions, skills and hooks and bring back line by line whatever the model stumbles on repeatedly — becomes not a gesture of courage but a row with a date. His own estimate that evals outlive the harness by one to three model generations sets a shelf life for the evidence too. Third, it makes ablation cheap: a component without evidence is the first candidate for removal, a component with an incident instead of episodes is the last.

• •Open a ledger row when you add any harness component, not at audit time
• •Evidence is replayable episodes before and after; an incident is evidence only for boundaries
• •The “new model” trigger runs ablation on every row with an assumption; boundary rows are not subject to ablation
• •The ownership mode is chosen by the ownership boundary framework, not by habit

The example in the table is hypothetical, and that needs saying plainly: the ledger is a tool I am proposing, not a report on something already in use. There is one way to check it — start one for your own fleet of agents and see how many rows end up without evidence. My forecast: more than half, and almost all of them will be words, not walls.