Information cutoff: August 2026. DeepSeek Harness remains in developer preview (v0.1). Official documentation warns breaking changes may occur. All capability descriptions are subject to official updates.
Introduction
Within AI agent engineering, the term “Harness” refers to the runtime supporting infrastructure built upon large language models. It governs tool dispatching, context management, session persistence, sandbox isolation, permission control, and retry‑oriented error handling. A concise formula widely adopted by practitioners is: Model + Harness = Agent
Foundation models determine what an agent is capable of understanding, while the Harness layer defines how the agent executes real‑world tasks. OpenAI Codex Harness and the newly open‑sourced DeepSeek Harness (dsh) released in August 2026 are two representative implementations of this formula. However, they follow opposing design philosophies in terms of extensibility and encapsulation. This article compares their positioning, core architecture, replaceable components, security models, observability, operational modes, cost structure and ecosystem compatibility, and delivers practical selection guidance for engineering teams. When operating multi‑model agent deployments across heterogeneous backend services, developers may consider an API gateway such as 4sapi to streamline request orchestration.
1. Product Positioning: Turn‑key Finished Product vs Composable Low‑level Framework
The divergence between the two projects originates from their core positioning.
| Dimension | OpenAI Codex Harness | DeepSeek Harness (dsh) |
|---|---|---|
| Core positioning | Ready‑to‑use AI coding agent product | Agent runtime framework |
| Open‑source status | Core source code open‑access | MIT‑licensed open‑source |
| Model binding | Primarily tied to OpenAI GPT‑5‑6 family | Model‑agnostic, compatible with roughly 40 model vendors |
| Main delivery forms | ChatGPT desktop Codex Tab, CLI, cloud service | Web UI(127.0.0.1:3080), CLI, Python SDK |
| Maturity | Production‑grade commercial product | v0.1 developer preview, breaking changes expected |
| Initial release | May 2025 | August 13, 2026 |
Codex Harness follows a closed‑boundary philosophy: the vendor delivers a fully‑functional agent, and developers extend behaviours through Skills, MCP protocols and hooks within predefined boundaries. Core runtime logic remains opaque to downstream developers. By analogy, Codex Harness resembles a finished smartphone: hardware and software are tightly integrated, end‑users can install applications but cannot modify underlying system internals.
DeepSeek Harness adopts a composable mindset. It does not enforce fixed agent behaviours. Instead, it supplies modular runtime building blocks for engineers to assemble custom agent implementations. A coding agent is merely one possible assembled outcome. Metaphorically, dsh acts like an Android or Lego hardware baseplate: nearly every functional component can be replaced or re‑combined.
2. Architecture Philosophy: Privileged Monolithic Kernel vs Fully Plugin‑oriented System
2.1 Codex Harness: High‑performance privileged monolithic kernel
Codex Harness is built around a Rust‑implemented monolithic kernel. Core logic including main‑loop iteration, tool scheduling and context handling is baked inside the kernel binary. Developers may extend peripheral capabilities with MCP, hooks and configuration files, yet they cannot alter fundamental kernel execution logic. Major behavioural adjustments have to wait for official upstream releases.
Advantages of monolithic privileged‑kernel design
- Consistent performance: Rust‑native kernel delivers predictable runtime behaviour and polished user experience.
- Robust security boundary: Security rules are centrally enforced inside kernel space, third‑party plugins cannot bypass core restrictions.
- Low operational overhead: Fewer extension points reduce enterprise auditing complexity.
Trade‑offs Community contributors cannot modify kernel internals. Ecosystem expansion is constrained to officially‑supported extension interfaces.
2.2 DeepSeek Harness: Kernel‑free pure plugin tree built on Cordis
DeepSeek Harness promotes the principle “Everything is a Plugin”. Model adapters, tool registries, skill sets, session logging, sandboxes, storage, scheduling modules, UI layers and even the core agent loop are implemented as swappable plugins. There exists no privileged kernel that cannot be replaced. Extensions are realised by attaching new plugins alongside existing plugin instances.
Its underlying foundation is the Cordis framework originating from open‑source work by Koishi author Shigma, co‑published by DeepSeek and Peking University. Cordis focuses on two core composability properties:
- Temporal composability: When plugins are unloaded, all side‑effects including event listeners and service registrations roll back completely, restoring system state.
- Spatial composability: Plugins explicitly declare dependency relationships. The runtime automatically resolves loading sequences.
Plugins communicate through Service and Event patterns, following Definition‑Provider‑Consumer capability modelling. Providers can be swapped without modifying consumer code.
2.3 Philosophy comparison summary
| Item | Codex Harness | DeepSeek Harness |
|---|---|---|
| Core implementation | Rust monolithic kernel | Cordis micro‑kernel plus plugin tree |
| Replaceable scope | Outer‑layer tools, prompts and hooks | Every component, including agent main loop |
| Extension method | Configure within official extension interfaces | Swap or hot‑swap plugins for recomposition |
| Open hierarchy | Application‑layer extensions | Assembly‑layer composition, broader capability boundary and larger governance scope |
An important counterpoint: highly composable plugin architecture expands governance burden. Codex users only manage tool sets they enable. dsh operators must maintain the full assembly of plugins, requiring corresponding testing, version control and rollback strategies.
3. Replaceable Component Comparison
DeepSeek Harness abstracts nearly every functional layer into replaceable plugins. This constitutes its most visible architectural gap compared with Codex Harness.
| Component | dsh default implementation | dsh supported alternatives | Codex equivalent capability |
|---|---|---|---|
| Model adapter | DeepSeek official adapter | Anthropic, OpenAI, Ollama local models, around 40 vendors total | Restricted to OpenAI‑family endpoints |
| Tool collection | File system + Shell | Arbitrary custom plugin tools | Built‑in tools plus MCP protocol |
| Sandbox | Local process isolation | Docker, E2B remote sandbox | Kernel‑level Seatbelt / Landlock, fixed |
| Session log | Local event stream file storage | Cloud storage, remote database | Immutable conversation history, cannot fully replay internal execution |
| Agent loop | Standard ReAct pattern | Custom‑defined inference strategies | Hard‑coded, non‑replaceable |
| UI layer | Built‑in Web UI | Custom TUI, community‑developed skins | Desktop / IDE client, fixed official presentation |
Developers can launch dsh rapidly with the shell command: npx @deepseek‑ai/dsh web.
4. Security Model: Hard Immutable Boundary vs Programmable Policy
4.1 Codex Harness: Kernel‑enforced non‑bypassable sandbox
Codex implements sandboxing at kernel level. macOS leverages Seatbelt while Linux utilises Landlock system‑call filtering. Risky file‑system and system operations are blocked directly inside OS system‑call layers.
Key traits:
- Non‑bypassable: Even prompt‑injection‑compromised model outputs cannot circumvent kernel‑level restrictions.
- Three‑tier binary permission model: Granularity is coarse but boundaries are rigid.
- Pre‑approval prompt before executing high‑risk operations.
This makes Codex Harness particularly suitable for auditing untrusted external pull‑requests, temporary workspaces and CI/CD automation workflows.
4.2 DeepSeek Harness: Sandbox as a configurable plugin
dsh ships no single hard‑coded security enforcement unit. Sandbox implementations and approval policies are themselves plugins.
- Default isolation applies local process separation; users can substitute Docker or E2B remote sandbox plugins.
- Approval logic is fully plugin‑defined, supporting fine‑grained customisation.
- Engineering guidelines enforce static policy tuning, immutable identity and fail‑closed failure modes. Security guarantees depend on plugin configuration quality.
- Code Mode intentionally trades strict isolation for higher tool‑invocation throughput, representing a documented design trade‑off.
Core distinction: Codex supplies a tamper‑proof safety fence. dsh provides blueprints and building materials for developers to construct fences. Greater freedom transfers partial security responsibility to application operators.
5. Session and Observability: Conversation History versus Append‑only Event Sourcing
Observability represents one of dsh’s most differentiated features.
Codex Harness maintains standard conversation history. Session recovery is supported, yet it does not persist complete raw request payloads. Engineers cannot precisely reconstruct the full context observed by the model at each inference step.
DeepSeek Harness adopts append‑only event‑sourcing architecture. The design principle is “everything visible to the model gets logged”. System prompts, user prompts, inference steps and context injections all flow into a single immutable event stream. Session restore, branching, replay, reproduction and persistent debugging are built upon this stream.
Four major capabilities derived from event‑sourcing:
- Traceability: Locate mis‑behaviour within context and tool‑call sequences instead of only examining final outputs.
- Restorability: Session states persist independently of volatile in‑memory runtime.
- Reproducibility: Re‑run past event streams against different models, tool sets or policy configurations for comparative testing.
- Evaluability: Build evaluation datasets and regression test suites directly from historical event logs.
The bundled Trajectory View visualises full agent execution paths. Important caveat: observability does not equal security. Event logs contain sensitive context data. Operators must enforce retention policies, data redaction and access controls. Event streams record what has occurred but do not automatically block malicious plugin behaviour.
6. Runtime Profiles and Operational Capabilities
DeepSeek Harness defines four built‑in assembly profiles for quick plugin combination: standard, code‑mode, minimal and cordis creation‑mode. It supports headless deployment via Python SDK for batch file‑processing and cycled task dispatching, covering scenarios where interactive graphical interfaces are unnecessary.
Codex Harness excels at multi‑client and cloud‑native workflows. ChatGPT web interface, Codex Tab desktop application, CLI, IDE integrations and Codex Cloud support up to six parallel thread pipelines. Tasks can be triggered through GitHub, Linear or Slack webhooks, with mature graphical parallel‑task management.
7. Cost Structure Analysis
| Cost Item | Codex Harness | DeepSeek Harness |
|---|---|---|
| Framework licensing | Subscription‑based tiers | MIT open‑source, users only pay model API consumption |
| Typical model expense | GPT‑5.4 pricing applies | Matches pricing of selected backend model, supports low‑cost V4‑Flash |
| Overhead characteristic | Predictable subscription plus API charges | Framework itself is free; total cost depends on token consumption of assembled plugins and selected LLM |
Harness‑level overhead becomes a meaningful variable. Identical tasks running on different Harness implementations can diverge significantly in total token consumption, which directly shapes per‑task operational expenses.
8. Ecosystem and Compatibility: Competitive or Stackable
A frequently overlooked capability: dsh ships optional sub‑agent adapter plugins for Codex and Claude Code, disabled by default. It can parse binary task payloads and delegate workloads to those agents. Hooks configuration enables hybrid mixed‑agent deployment. The two frameworks are not mutually exclusive.
One feasible production‑grade combination pattern for 2026:
- Codex Harness runs inside end‑user or cloud environments to handle daily development and untrusted PR auditing, leveraging its robust kernel sandbox.
- DeepSeek Harness operates as an orchestration layer on the server side, distributing tasks to appropriate agents or models, with unified replay‑capable event logging for the whole workflow.
Configuration files from both systems (AGENTS.md for Codex, settings.yaml for dsh) can coexist within the same repository.
9. Decision‑making Selection Matrix
| Requirement | Recommended Choice | Justification |
|---|---|---|
| Out‑of‑the‑box usage, minimal configuration | Codex Harness | Mature commercial product, stable experience |
| Audit untrusted external code and pull‑requests | Codex Harness | Non‑bypassable kernel‑level sandbox |
| Graphical parallel‑task management | Codex Harness | Codex Tab plus cloud multi‑threading capability |
| Deep customisation of agent main‑loop runtime | DeepSeek Harness | Fully‑replaceable plugin‑based architecture |
| Switch dynamically among multiple model back‑ends | DeepSeek Harness | Model‑adapter abstraction supports dozens of providers |
| Cost‑sensitive batch workloads | DeepSeek Harness | MIT‑licensed framework, compatible with low‑cost open‑weight models |
| Audit, replay, branching and regression evaluation | DeepSeek Harness | Native append‑only event‑sourcing |
| Build and resell custom agent products | DeepSeek Harness | MIT licensing permits deep modification and redistribution |
| Production‑critical stable pipeline | Codex Harness (current) | dsh explicitly warns of incoming breaking pre‑release changes |
10. Conclusion
Codex Harness and DeepSeek Harness represent two fundamentally distinct engineering paths for building AI agents.
Codex Harness encapsulates complexity on the vendor side to deliver simplicity for developers. Its Rust monolithic kernel, kernel‑enforced sandbox and multi‑client concurrency deliver strong performance, security and consistency. It is a polished finished product.
DeepSeek Harness transfers complexity and flexibility to developers. Built on Cordis micro‑kernel and the everything‑as‑plugin paradigm plus event‑sourcing logging, it unlocks extensive composability, auditability and evolutionary potential. It is a highly malleable agent construction toolkit.
Short‑term, Codex Harness holds advantages in maturity and security hardening. Long‑term, DeepSeek Harness’s composable, replaceable and replay‑capable architecture offers greater evolutionary potential. The two frameworks are not pure competitors. They can function in stacked hybrid setups: orchestration, policy tuning and loop logic can be split across layers. Engineering teams may adopt different Harness systems for separate sub‑workloads according to business constraints.
Learn more：https://4sapi.com
