The authors read the source of eleven production coding agents, from the 100-line Mini-SWE-Agent to the million-line Codex CLI, and diffed eight of them across one quarter. All build the same seven subsystems by hand. Across about four million lines, none imports an agent framework and none uses vector search to find code. The authors conclude that in the first half of 2026 the coding harness stopped being a tool and became a platform.
An agent is a model plus a harness, and the harness is everything except the model. The term harness engineering appeared in February 2026, but there was no reference that describes, from production source, what a harness contains and how the leading implementations differ.
The authors pinned July 2026 releases of eleven harnesses: Claude Code, Codex CLI, Gemini CLI, Mistral Vibe, OpenHands, Aider, Mini-SWE-Agent, Hermes, Pi, OpenCode, and OpenClaw. Eight were in the authors' April 2026 edition, so the same code could be diffed across ninety days. The paper does not benchmark or rank.
Every system takes a position on the same seven parts, even when the position is a deliberate absence: the agent loop, the LLM integration, the tool system, memory and context, safety and permissions, sub-agent orchestration, and extensibility.
The smallest system is Mini-SWE-Agent. It implements all seven in about 100 lines of Python: one while loop, one prompt template, one bash tool, a message list, a step limit and a cost limit, and no sub-agents. Its self-reported results on SWE-bench Verified, a standard coding-task benchmark, are in the same range as systems a thousand times larger, though on different models and dates.
Claude Code hides most of its 43 tools from the initial prompt and lets the model search for them, which the authors say cuts the initial prompt by about 40 percent. Hermes ends a session on every compaction, the step that replaces old conversation with a summary to free context space, and starts a child session linked to the parent, so no history is destroyed.
The extra code in the large systems does not add task completion. It adds safety, user interface, extensibility, and transport. About three fifths of OpenCode's source is its terminal, web, desktop, and SDK clients.
The authors inspected every dependency manifest and searched every source tree for imports of LangChain, LangGraph, LlamaIndex, AutoGen, CrewAI, Pydantic AI, Semantic Kernel, and Google's ADK. Across about four million lines of Python, TypeScript, and Rust, no agent runtime imports any of them. Every loop is hand-written.
The second absence is retrieval over code with vector embeddings. Zero of eleven systems do it. All of them find code with ripgrep, glob, tree-sitter symbol extraction, and Markdown context files that the harness discovers from the project root down to the working directory. The only embeddings in the corpus serve chat memory.
The authors give a mechanical reason for both. When the agent edits real source code, the failure modes of an abstraction layer are expensive: silent prompt corruption, opaque caching, and tool schemas that break on version changes. Code has deterministic structure that similarity search cannot use, and code changes minute to minute, so a pre-built embedding index is stale almost by construction.
The longitudinal sample shows four movements. Systems copied each other directly: Codex adopted Claude Code's hook event names verbatim, and OpenHands reads Claude Code's plugin manifests. Features spread: deferred tool loading went from one system to three, read-only plan modes from two to all four vendor systems, and turn-level filesystem checkpoints from one to three.
Behavioral policy moved out of the prompt. Codex replaced its no-commit prompt rule with a feature flag; rules moved from prose the model reads to configuration the platform enforces. And the code grew fast: Codex nearly doubled from 621 thousand to 1.12 million lines of Rust in one quarter.
The authors' thesis is that the harness is now the framework. It supplies the loop, the tool registry, the memory layer, and the extension mechanism that a framework used to supply, but the developer does not import it. The developer works inside it.
Nine of eleven systems expose lifecycle hooks, up from one in April. Skills, meaning directories with a SKILL.md and YAML frontmatter, are in nine of eleven systems; MCP (Model Context Protocol) is in eight. The Agent Client Protocol ships in six systems, and OpenHands now runs Claude Code, Codex, or Gemini CLI as interchangeable backends through it.
This is source reading, not runtime measurement. The Claude Code analysis rests on a circulated March 2026 source snapshot, not an official release. The framework-absence check covered manifests and imports only, not dynamic imports or transpiled bundles. Three observations from the April edition were revised in place; the authors read this as evidence that claims about which system has which feature go stale in weeks, while claims about structure stay true.
The paper closes with 18 recommendations and a 90-line Python scaffold that implements ten of them. The ones that matter most:
Start with a while loop and a bash tool. Add file read, write, and exact-substring replace when bash output truncation or token waste appears. Add a middleware pipeline only when three or more independent per-turn policies exist.
Defer tools above about 15. Below that the indirection costs more than it saves.
Discover context files up the directory tree, and also read the context files of other harnesses, as Hermes does with AGENTS.md, CLAUDE.md, and .cursorrules.
Compact at a fixed buffer below the window, keep a verbatim tail, and merge summaries incrementally. Pi and OpenCode pass the previous summary into the next one, which preserves early decisions that a fresh summary loses.
Do not build RAG over code. If your domain needs it, first prove a gain over ripgrep plus tree-sitter on a held-out task set.
Write safety rules as data, and keep a minimum set of rules that a bypass mode cannot disable. Hermes freezes its twelve hard-line safety patterns at import time so injected content cannot change them at runtime.
Use skills for procedures and MCP for external systems, and treat third-party skills as packages that need scanning and quarantine.