On Thursday the 20th of August, per the essay's own dateline, Earendil published a public definition of agent harnesses. The essay is framed as a gentle explainer for people who heard the term and were too embarrassed to ask, but the timing is not casual. The rig of prompts, tools and retry logic wrapped around a language model sits, as Earendil's own essay puts it, at the core of all types of AI agents. And the term was still bouncing between definitions. Addy Osmani's April roundup and Luzzardi's April split describe overlapping but distinct versions of the same word. My read of the timing: it is a move on the category regardless of the tone. Publishing a definition while it is still contested counts, especially from a company with its own entry in the category. Earendil, whose own essay says it is building an open-source rig called Pi, is on the field either way.

What the post claims

The post splits the thing into four parts: a system prompt that sets behaviour, the tools the model may call, the agentic loop of model, tool and observation cycles, and a translation layer, which only some scaffolds need, but which Earendil counts among its four parts because it is the piece that lets one scaffold talk to many models. Earendil names Claude Code as the first popular one, its own recounting, and points out that Claude Code was never built to be neutral. Its reply list of open-source entrants is OpenClaw, OpenCode, Hermes and its own Pi, and it reports that Pi users have shared more than 5,000 extensions with each other. The claim that carries the argument: a translation layer moves control from the AI labs to whoever holds the scaffold. Run one request against Anthropic, OpenAI or an open-weight model, keep every answer in one place, and your years of sessions sit with you instead of living in three vendor apps.

Where the word came from

The word did not start in software: Earendil's own essay opens with the Cambridge Dictionary definition of the ordinary noun. In the engineering sense, Wikipedia's test-harness entry describes stubs and drivers set up to run tests on a component. Earendil reaches past the engineering sense back to climbing, to straps and belts that keep a climber off the ground, and its own essay leans on that image. The two senses share one assumption. In both, the gear serves the person wearing it. Whether an agent rig serves the wearer or the thing being held is a better description of the current definitional disagreement than any of the definitions themselves.

What the word hides

The paper behind the strongest evidence outran the definition by three months. A paper on arXiv submitted on 14 May 2026 by Sahil Sen and four co-authors ran the same conversation data through four scaffold candidates, their custom Chronos and three first-party CLIs (Claude Code, Codex and Gemini CLI), on a 116-question sample of LongMemEval. Grep-style retrieval generally beat vector retrieval in that setup, and scores depended strongly on which scaffold and tool-calling style was used even though the underlying data were identical. As a benchmark consumer, note the uncomfortable clause: the four candidates are full systems, model and wrapper together, so the comparison speaks to the whole system, not to any one variable in isolation.

The vocabulary was forming anyway. When I counted the published sketches of the scaffold's anatomy that arrived before Thursday's definition, I got four, and here is the whole list: Viv Trivedy's axiom that an agent is the model plus everything around it, Dex Horthy's tracking of the pattern, Luzzardi's architectural split, and Osmani's April roundup, which cites the first three. Osmani's roundup adds two set-dressing contributions to the lexicon rather than new anatomies: HumanLayer's framing that most agent failures are configuration skill issues, not weight issues, and the observation that Anthropic publishes design guidance for long-running agent scaffolding of its own. A lab that sells the model is also teaching the wrapping, which is one empirical vote against the definitional fight being purely academic.

The wrapper has acquired real weight, too. A July series from Data For Science catalogues what production scaffolds add past the basic loop: planning DAGs, parallel runs, tiered memory, verification hierarchies, budgets and tracers. Each added layer takes over work the raw loop used to leave to a single model pass. A protocol that does not declare which scaffold it ran leaves part of what it measured unreported, and this arXiv comparison shows why that matters.

Inside or outside the sandbox

The second definitional fight is underneath the vocabulary one. Luzzardi's April split asks where the loop runs: inside the sandbox or outside it. In the inside one, the loop lives in the same container as the code it works on, the shape Claude Code takes on a laptop, and the credentials sit with the loop. In the outside one, the loop runs on your backend and reaches into the sandbox over an API, so, in that layout at least, the sandbox never has to see the API keys or user tokens. The difference is where credentials get exposed, and in the configurations Luzzardi compares, that difference decides much of which boundary you have actually defended.

The other side, properly

Now the best version of the pitch. Decoupling is real: three answers in three vendor apps are worse than three answers in one session store you keep. Earendil's own example sends the same email workflow through three providers and keeps the results in one place, and it claims open-weight models often deliver the best value-for-money measured by cost-per-task. The strongest clause is Earendil's, and it is hard to argue with on its own terms: its argument is that a scaffold not yours leaves the record of your sessions with the vendor. That is the most direct answer on offer to the question of who owns the sessions.

What the evidence supports

Verified, the agency claim shrinks into custody and optionality, which is still something, but less than independence. The choke point is API access itself. In June 2025, TechCrunch's Maxwell Zeff reported that Anthropic reduced Windsurf's first-party access to Claude 3.7 Sonnet and Claude 3.5 Sonnet with little notice, while Windsurf was reportedly being acquired by OpenAI. Windsurf said it had offered to pay for full capacity and was forced onto third-party inference providers anyway. A rig pointed at a frontier lab's API depends on access the lab can choose to revoke; Windsurf is one data point, and one revocation is enough to make permanent access an assumption that has to be argued rather than presumed. Running open weights on hardware you control escapes that specific choke point; the trade, in Earendil's own framing, is that open weights offer great value-for-money on cost-per-task, not that they match the frontier on every variable.

Portability is thinner than custody, too. In that comparison the scores moved with the whole system, model and wrapper bundled, and that is the point the pitch understates: you cannot read off a benchmark which part was doing the work. The portability half of the pitch is weaker than the custody half. That is what the pitch survives as: custody of the record and a real right to shop. Meaningful, but a long way from independence.

The three parties

One read of where the essay sits, and it is my read rather than the essay's: there are first-party CLIs (Claude Code, Codex and Gemini CLI, per the arXiv paper), open-source scaffolds positioned as neutral (OpenClaw, OpenCode, Hermes and Pi, as the essay frames them), and third-party platforms (Devin and Cursor, per the Data For Science post). I do not have a clean read on which side wins. I do have a read on why the argument exists: the definition each party writes shapes, for its users, whether the layer ends up as plumbing or product.

The bet

My version: if my read of the independence half is right, then by the end of 2027 a frontier lab ships a first-party scaffold that treats rival models as first-class citizens, or an open neutral scaffold takes a top spot on a public agentic leaderboard with open weights underneath. Those two are the cleanest signals to watch; if neither lands, I call the independence point settled against the thesis, and custody of the record is what remains. I will accept either verdict. That is the bet.