DeepSeek Harness — the harness with no core

There is no prompt file at the centre. ctx.systemPrompt is a registry: plugins contribute prompt sections and tool schemas, and the assembly runs fresh at every step, so what the model is told is a function of which plugins are mounted. A preset can compose a different capability set — and therefore a different prompt — for one session without touching the deployment.

Filesystem, web and language-server access each arrive through their own seam, so search can be Exa, Perplexity or DeepSeek's own behind one unchanged tool. The unusual channel is lateral: a resolver projects a bounded snapshot of another session into this one as durable, explicitly untrusted context. Injected material does not interrupt — it waits in the inbox until a real message wakes the loop.

Pressure is measured, not guessed: a token meter keeps isolated per-session replay folds and publishes immutable revisioned measurements that compaction consumes after each step. Two mechanisms run before summarisation — a pruner that rewrites oversized current tool results as replayable surface replacements, and a spill store that moves oversized tool text out and hands the model a locator plus a retrieval hint. Notably, there is no compact tool the model can call; the harness decides.

Every call runs a fixed pipeline — a pre-execute waterfall, monotonic guards, around-dispatch, a post-execute waterfall, then final content invariants — and registering on ctx.tools is what puts a schema into prompt assembly. Code Mode is the variant worth noting: rather than one call per step, the model writes a program that the code runtime executes against host bindings, and its sub-calls are logged individually so the transcript stays honest.

Consumers hand the sandbox the exact argv they are about to spawn; the backend wraps it under a per-call policy and reports what it enforced. One detail carries the design: the default mode and workspace root live in a single policy service that both the shell executor and the filesystem provider read, deliberately, so bash and fs cannot end up confined to different roots. Approval is a waterfall that fails closed when nobody is listening.

The session log is an append-only event stream, and model history is projected from it rather than stored beside it. The rule is enforced rather than documented: anything that reaches a model request must be reconstructable from the log, and a runtime invariant asserts it — which is why adding a new model-visible input means adding a new session event. Backends are swappable (JSONL or SQLite), and a cache of folded projections means listing sessions never replays full logs.

A step is one model request plus its tool calls; a turn opens when input is claimed and closes when nothing is owed. The extension points are typed events with declared dispatch modes, and the one that matters is agent/pre-step — a waterfall that can rewrite what the model is about to see or reject it outright. A rejected first claim still closes a durable turn that spent no step, so the log records the attempt rather than hiding it.

Delegation is a seam with six providers behind it, and three of them leave the process entirely — ACP, Codex, and Claude Code. A dsh run can hand a turn to a competing harness and treat the result as an ordinary subagent return. The service also owns continuation, so a delegation can be followed up rather than only awaited.

Skills are a seam too: providers publish catalogues, the service merges them, and the model-facing tool renders a short catalogue into the session prefix and loads a full body only when asked. The same accommodating instinct shows up beside it — dedicated packages read Claude Code's and Codex's hook formats, so know-how already written for another harness runs here without translation.

Telemetry is a seam ending in OpenTelemetry, and the log itself is the trace. Two choices stand out. The language-server seam offers exactly four normalised operations and no protocol escape hatch, which forces backends to translate rather than leak. And invariants are a first-class service: packages register their own runtime checks, and a failure is attributed to the package that owns it — the harness reports which part broke its own contract.

The machinery for self-modification is further along than anywhere else on this register: because registrations are reversible effects, plugins mount and unmount live, and a model-facing tool lets the agent define a new Cordis package — syntax-checked, shown to the user as a card with a start control — then run it in a sandbox inside the running process. But those packages live only in process memory and disappear on restart. The harness can rewrite itself for an afternoon; making the change last is still a human writing a patch row.