DeepSeek Unbundles AI Agent Loops Into Interchangeable Plugins

Xiaol.x

By eliminating a hardwired execution engine, DeepSeek demonstrates that an agent is defined not by its model, but by the explicit composition of sandboxes, guards, and peer services wired around it.

AI-assisted summary of DeepSeek Harness: Everything is a Plugin! New Open-Source AI Agent Framework (Hands-on) — original source. Check the original for full context.

Source published: 2026-08-16

Key ideas

DeepSeek open-sourced DeepSeek Harness (dsh), an agent framework where the core agent loop itself is an interchangeable plugin sitting alongside tools, sandboxes, and the user interface. (0:01)
The framework features Programmatic Tool Calling (Code Mode), enabling models to run consolidated scripts through an ephemeral worker thread that resets after every run to prevent notebook-style state leakage. (4:24)
Long-running autonomy is broken into an auditable hierarchy of persistent goals, background jobs, deterministic workflows, and delegatable sub-agent sessions rather than an unconstrained execution loop. (5:11)
An in-memory 'Creator' capability allows agents to dynamically inspect, define, mount, and purge their own plugins at runtime, though all self-generated extensions remain strictly ephemeral. (5:59)

Detailed notes

## Background Published on YouTube by Xiaol.x on August 16, 2026, this video provides a hands-on developer preview walkthrough of DeepSeek Harness (dsh). According to the description, the open-source framework is built on the Cordis framework and features an architecture where 'everything is a plugin'—enabling developers to swap models, tools, sandboxes, execution loops, and user interfaces via configuration without a hard-coded core.

## TL;DR The walkthrough explores DeepSeek Harness's radical architectural design, which demotes the central agent loop to an ordinary, swappable plugin anchored to a unified execution substrate. It details how runtime sessions assemble through explicit profile patches and strictly log turns into an append-only event stream governed by monotonic security guards. The overview also compares standard tool calling against Code Mode (Programmatic Tool Calling), details structured autonomy primitives such as Goals and Sub-Agents, and analyzes the reflective 'Creator' mode that allows agents to synthesize ephemeral in-memory plugins on the fly.

## Atmosphere & style The presentation is analytical, precise, and deeply technical, feeling more like a systems architecture post-mortem than a standard product demo. The narration maintains a sober, engineering-focused tone, balancing fascination with the elegance of pure composability against clear-eyed warnings regarding the framework's strictness, configuration friction, and early preview status.

## Bulletin - [00:01](https://www.youtube.com/watch?v=z9riGTseD0I&t=1s) DeepSeek open-sourced DeepSeek Harness (dsh), an agent framework where the core agent loop itself is an interchangeable plugin sitting alongside tools, sandboxes, and the user interface. - [04:24](https://www.youtube.com/watch?v=z9riGTseD0I&t=264s) The framework features Programmatic Tool Calling (Code Mode), enabling models to run consolidated scripts through an ephemeral worker thread that resets after every run to prevent notebook-style state leakage. - [05:11](https://www.youtube.com/watch?v=z9riGTseD0I&t=311s) Long-running autonomy is broken into an auditable hierarchy of persistent goals, background jobs, deterministic workflows, and delegatable sub-agent sessions rather than an unconstrained execution loop. - [05:59](https://www.youtube.com/watch?v=z9riGTseD0I&t=359s) An in-memory 'Creator' capability allows agents to dynamically inspect, define, mount, and purge their own plugins at runtime, though all self-generated extensions remain strictly ephemeral.

## Key takeaways - [00:01](https://www.youtube.com/watch?v=z9riGTseD0I&t=1s) The core agent loop is treated as an ordinary, swappable plugin row rather than a hardcoded engine, allowing the fundamental behavior of the agent to change without modifying the core codebase. - [00:01](https://www.youtube.com/watch?v=z9riGTseD0I&t=1s) DeepSeek Harness enforces that the filesystem, terminal, and language server protocols bind to a unified execution substrate to eliminate state desynchronization across disjoint local and remote environments. - [01:18](https://www.youtube.com/watch?v=z9riGTseD0I&t=78s) Runtime configurations construct deterministically from an empty list using profiles, bundles, and explicit patch directives, loading plugins strictly according to dependency resolution. - [01:18](https://www.youtube.com/watch?v=z9riGTseD0I&t=78s) Decoupled architectural seams separate abstract contracts, provider implementations, and model-facing tools, enabling backend swaps between local hosts and sandboxes without touching prompt definitions. - [01:18](https://www.youtube.com/watch?v=z9riGTseD0I&t=78s) Service slot registrations are strictly singular: duplicate attempts to claim an active slot fail immediately to prevent ambiguous, silent state overwrites. - [02:47](https://www.youtube.com/watch?v=z9riGTseD0I&t=167s) Every interaction lifecycle event is appended to an audit log, but only user messages, assistant responses, and tool execution results are ever compiled into the model's prompt context. - [02:47](https://www.youtube.com/watch?v=z9riGTseD0I&t=167s) Pre-execution security guards operate monotonically so that no downstream policy can override an earlier execution denial. - [02:47](https://www.youtube.com/watch?v=z9riGTseD0I&t=167s) Sandbox permissions enforce fail-closed security across explicit filesystem tiers, committing immutable frozen output events upon execution completion. - [04:24](https://www.youtube.com/watch?v=z9riGTseD0I&t=264s) Code Mode (Programmatic Tool Calling) lets the model write a single script that coordinates multiple tools and branch logic internally, bypassing multiple conversational round-trips. - [04:24](https://www.youtube.com/watch?v=z9riGTseD0I&t=264s) Worker threads in Code Mode are destroyed and recreated between script executions to prevent hidden variable state leakage. - [05:11](https://www.youtube.com/watch?v=z9riGTseD0I&t=311s) Autonomous execution is broken down into structured primitives—session goals, asynchronous jobs, multi-step workflows, and child sub-agents—to ensure auditability. - [05:11](https://www.youtube.com/watch?v=z9riGTseD0I&t=311s) Sub-agent providers can spawn isolated child sessions that maintain stable identities and submit structured settlement reports back to the primary agent. - [05:59](https://www.youtube.com/watch?v=z9riGTseD0I&t=359s) The reflective Creator capability permits live self-modification using five verbs—Inspect, Define, Run, Stop, and Forget—without generating static files on disk. - [05:59](https://www.youtube.com/watch?v=z9riGTseD0I&t=359s) Dynamic agent self-modifications are strictly ephemeral and disappear upon process restart, requiring persistent extensions to be authored as reviewed plugins. - [05:59](https://www.youtube.com/watch?v=z9riGTseD0I&t=359s) DeepSeek Harness embodies an architectural thesis prioritizing strict composability over ease of use, establishing that the explicit plugin composition itself constitutes the agent.

## Detailed walkthrough ### [00:01](https://www.youtube.com/watch?v=z9riGTseD0I&t=1s) The Agent Loop as an Ordinary Plugin

The most striking architectural choice in DeepSeek Harness (`dsh`) is that the core agent loop itself is not hard-coded into a privileged engine. Instead, the loop exists as an ordinary, interchangeable plugin row sitting alongside timers, model adapters, session managers, tools, and the web interface. If a developer disables or swaps that single row, the entire behavior of the system transforms without requiring engine patches. This design presents a conceptual paradox: if the central loop can be swapped out like any off-the-shelf utility, what actually defines the agent? The answer lies in the dynamic plugin tree—the explicit assembly of services, event streams, sandboxes, policies, and interfaces constructed around the underlying model.

```mermaid flowchart TD accTitle: DeepSeek Harness Plugin Composition Architecture accDescr: Diagram illustrating how DeepSeek Harness treats the agent loop, sandbox, tools, and UI as peer plugins wired to an execution substrate.

subgraph Assembly ["Assembly Recipe (Profile & Patches)"] direction TB P["Profile / Bundles"] --> R["Plugin Registry"] end

subgraph Peers ["Peer Plugin Tree"] direction TB AL["Agent Loop Plugin"] MA["Model Adapter Plugin"] ST["Session & Storage Plugin"] UI["Web UI Plugin"] end

subgraph Substrate ["Unified Execution Substrate"] direction TB FS["File System"] SH["Shell / Terminal"] LSP["Language Server"] end

R --> Peers Peers --> Substrate ```

A hardwired, monolithic agent loop functions adequately when every capability runs locally on a single machine. The breakdown happens when components split across separate environments. If an agent executes Bash commands inside a remote sandbox while editing files locally on a laptop and querying a language server tied to an entirely different repository checkout, the illusion breaks: remote test suites pass, the local editor writes to a mismatched file, and code diagnostics reflect a third reality. While no individual module has crashed, "the agent no longer has one world." DeepSeek Harness targets this desynchronization as a fatal architectural flaw, enforcing that the filesystem, subprocess execution, terminal environment, and language server protocols must anchor to a single, explicit execution substrate.

[01:18](https://www.youtube.com/watch?v=z9riGTseD0I&t=78s) Profiles, Assemblies, and Decoupled Contracts

To avoid hidden global state, DeepSeek Harness builds every runtime configuration starting from an empty list. A designated profile names the base composition, while bundles insert cohesive groups of plugin rows. Customization occurs through a strict hierarchy: profile patches, home configuration patches, and optional command-line overlays add or substitute rows by their unique identifier. The activation order is determined strictly by dependency resolution—a plugin loads only when every upstream service contract it requires is active. Furthermore, patching uses an intentionally blunt replacement rule: patch directives replace an entire row wholesale rather than performing complex, opaque field-level merges. This creates a verbose but fully transparent and reproducible assembly recipe rather than a black-box binary.

This dynamic tree relies on clean contract seams. For example, shell execution is broken into distinct architectural layers: - An abstract contract package standardizes input arguments and return structures for running commands. - A host provider implements the contract by running Bash directly on the local machine. - A sandbox provider fulfills the identical contract while enclosing execution within a containerized or confined sandbox. - A model-facing tool exposes the Bash capability to the LLM, consuming whichever underlying provider was registered by the composition.

Because interfaces, concrete implementations, and model presentations evolve independently, swapping the execution backend requires zero modifications to the tool contract or prompt logic. To prevent ambiguous state, service registrations are strictly singular: if two providers attempt to claim the exact same service slot, the second registration fails immediately rather than silently overwriting the first. When a plugin is deactivated, its cleanup handlers fire automatically, removing its tools, event listeners, and prompt fragments from the active session.

[02:47](https://www.youtube.com/watch?v=z9riGTseD0I&t=167s) Turn Execution Lifecycle and Event Logging

During an execution turn, DeepSeek Harness logs the entire interaction lifecycle into an append-only event stream. The harness captures `turn start`, `step start`, raw user inputs, streaming assistant chunks, the assembled assistant response, every tool invocation, tool execution outputs, and terminal turn boundaries. The majority of these events serve auditing, session replay, policy enforcement, and UI rendering; only three specific event types are ever compiled into the prompt context for the model: 1. User messages 2. Assistant messages 3. Tool execution results

System prompts, model parameters, and tool schemas are decoupled from the conversational history and recorded separately as request headers, adhering to the principle that anything "model-visible means logged." Because session persistence, branching forks, replays, and conversation histories all project directly from this append-only stream, the agent can resume past sessions deterministically.

```mermaid flowchart LR accTitle: Tool Execution Pipeline accDescr: Flowchart showing the progression of a tool call from logging through pre-execute guards to sandboxed execution and frozen output.

TC["Tool Call Logged"] --> PE["Pre-Execute Hooks & Guards"] PE --> Mode{"Sandbox Mode Resolved"} Mode -->|"Read-only / Write / Dangerous"| Exec["Timeout Wrappers & Tool Body"] Exec --> Post["Post-Processing & Content Finalization"] Post --> FR["Frozen Result Event"] ```

When a tool call is initiated, it is written to the persistent log before any code executes. Execution then flows through a shared pre-execute pipeline that evaluates security hooks, permissions, and sandbox constraints: - Guard policies operate monotonically: a guard can deny execution, but no downstream policy can overturn an earlier denial into an approval. - Sandbox permissions are resolved per invocation across distinct access tiers (read-only filesystem, workspace-write, or unrestricted access). - If confinement fails, the system fails closed rather than falling back to unconfined execution. - Approved calls pass through timeout wrappers, run the target tool body, process outputs, and commit a single, immutable frozen result event to the log. - These sandbox tiers specifically constrain filesystem access; they do not construct isolated network or process boundaries comparable to full virtual machines.

[04:24](https://www.youtube.com/watch?v=z9riGTseD0I&t=264s) Standard Mode vs. Code Mode (PTC)

DeepSeek Harness provides distinct operational modes that alter how tools interface with the language model:

In Code Mode, instead of inundating the model context with conversational chatter and back-and-forth round-trips for simple data transformations, the LLM emits a compact script. This script invokes multiple tools sequentially, evaluates intermediate conditions programmatically, and returns just the relevant output. Even though these tool calls originate from within generated code, they are not backdoors: every subcall routes back through the standard permission pipeline, adheres to monotonic sandbox rules, and receives durable dispatch entries in the event log.

Critically, the harness avoids state leakage across executions. The runtime deliberately prevents state from persisting across `run_code` scripts—avoiding the hidden variable baggage typical of persistent Jupyter-style notebooks—by destroying and recreating the worker thread runtime between invocations.

[05:11](https://www.youtube.com/watch?v=z9riGTseD0I&t=311s) Structuring Autonomy: Goals, Jobs, Workflows, and Sub-Agents

Rather than treating autonomous behavior as an open-ended loop, DeepSeek Harness decomposes prolonged execution into an inspectable ownership graph divided across four primitives:

- **Goals:** Track persistent, session-level objectives that remain active across multiple interaction cycles, driving subsequent agent turns until completion criteria are satisfied. - **Jobs:** Represent detached background tasks that can be monitored asynchronously, queried for status, harvested for outputs, or explicitly canceled. - **Workflows:** Coordinate deterministic, programmatic multi-step logic that orchestrates complex routines without relying solely on model prompt chaining. - **Sub-Agent Providers:** Spawn and delegate isolated child sessions to auxiliary engines or specialized external coding CLI agents, such as Codex or Claude Code.

Child sessions maintain stable, continuable identities. They accept follow-up instructions from the primary agent and report back structured settlement reports once their delegated objectives are achieved. By structuring operations this way, autonomy transforms from an opaque, runaway loop into a visible, hierarchical tree where every descendant task and delegation path can be inspected, paused, or audited in real time.

[05:59](https://www.youtube.com/watch?v=z9riGTseD0I&t=359s) Self-Modification, Ephemeral Plugins, and Developer Preview Trade-offs

DeepSeek Harness features a reflective "Creator" capability allowing the agent to dynamically inspect and augment its own architecture via five core verbs: 1. **Inspect:** Examine active runtime components, available services, and loaded plugins. 2. **Define:** Programmatically generate an in-memory plugin package containing new tools, prompt injections, services, or browser interface components. 3. **Run:** Mount and activate the dynamic package directly into the live process. 4. **Stop:** Deactivate the dynamic package and trigger cleanup routines. 5. **Forget:** Purge the package entirely from the runtime environment.

This self-modification capability is strictly ephemeral by design. The model creates no physical plugin files on disk, executes no package manager installations, and modifies no static configuration files; all dynamically generated capabilities vanish upon process restart. Because the in-memory execution environment functions as containment for well-intentioned code rather than a hardened security perimeter, running these ephemeral extensions requires the same level of user trust as running raw Bash commands. Persistent features must be authored as standard, human-reviewed plugins.

DeepSeek Harness is released as a developer preview with explicit warnings that breaking API changes will occur. The framework trades simplicity for rigor: developers inherit extensive configuration overhead, multiple abstraction layers to debug, a stateless code runtime, and self-modifying plugins that deliberately refuse to persist. Yet this architecture embodies a deliberate thesis: DeepSeek Harness is not merely a language model retrofitted with utility tools, but a deterministic, replayable plugin graph where the model loop, policy guards, sandboxed execution, memory management, multi-agent delegation, and frontend UI operate as equal peers. In this paradigm, "the composition is the agent."

## Notable quotes > [00:01](https://www.youtube.com/watch?v=z9riGTseD0I&t=1s) the core agent loop itself is not hard-coded into a privileged engine. Instead, the loop exists as an ordinary, interchangeable plugin row sitting alongside timers, model adapters, session managers, tools, and the web interface.

> [00:01](https://www.youtube.com/watch?v=z9riGTseD0I&t=1s) the agent no longer has one world.

> [01:18](https://www.youtube.com/watch?v=z9riGTseD0I&t=78s) DeepSeek Harness builds every runtime configuration starting from an empty list.

> [01:18](https://www.youtube.com/watch?v=z9riGTseD0I&t=78s) patch directives replace an entire row wholesale rather than performing complex, opaque field-level merges.

> [01:18](https://www.youtube.com/watch?v=z9riGTseD0I&t=78s) if two providers attempt to claim the exact same service slot, the second registration fails immediately rather than silently overwriting the first.

> [02:47](https://www.youtube.com/watch?v=z9riGTseD0I&t=167s) model-visible means logged.

> [02:47](https://www.youtube.com/watch?v=z9riGTseD0I&t=167s) a guard can deny execution, but no downstream policy can overturn an earlier denial into an approval.

> [02:47](https://www.youtube.com/watch?v=z9riGTseD0I&t=167s) If confinement fails, the system fails closed rather than falling back to unconfined execution.

> [04:24](https://www.youtube.com/watch?v=z9riGTseD0I&t=264s) The runtime deliberately prevents state from persisting across run_code scripts—avoiding the hidden variable baggage typical of persistent Jupyter-style notebooks—by destroying and recreating the worker thread runtime between invocations.

> [05:59](https://www.youtube.com/watch?v=z9riGTseD0I&t=359s) The model creates no physical plugin files on disk, executes no package manager installations, and modifies no static configuration files; all dynamically generated capabilities vanish upon process restart.

> [05:59](https://www.youtube.com/watch?v=z9riGTseD0I&t=359s) the composition is the agent.

## Mentioned DeepSeek, DeepSeek Harness, dsh, Cordis, Xiaol.x, Bash, Codex, Claude Code, Jupyter

## Video description DeepSeek just open-sourced DeepSeek Harness (dsh) — a powerful, fully modular AI agent framework where EVERYTHING is a plugin.

In this video I dive into DeepSeek’s brand-new agent harness (developer preview). Built on the Cordis framework, it lets you swap models, tools, skills, sessions, sandboxes, loops, scheduling, and even the UI itself — all through simple configuration. No hard-coded core. Just pure composability.

🔥 What you’ll see: • What DeepSeek Harness is and why “Everything is a Plugin” matters • Quick start: npx @deepseek-ai/dsh web • Web UI walkthrough • Different runtime modes (Standard, Code/PTC, Minimal, Creator) • How Model + Harness = Agent • Plugin architecture & extensibility • Real examples and first impressions

🔗 Official links: GitHub: https://github.com/deepseek-ai/deepseek-harness Official site: https://deepseek.com/harness Paper (Cordis): https://github.com/cordiverse/paper

DeepSeek Harness is currently in rapid developer preview — expect breaking changes, but the architecture is already incredibly ambitious.

If you’re building AI agents, coding agents, or just curious about the next generation of agent frameworks, this is a must-watch.

Like & subscribe for more DeepSeek, open-source AI, and agent content! Drop a comment: Will you try DeepSeek Harness?

#DeepSeek #DeepSeekHarness #AIAgents #OpenSourceAI #dsh #Cordis #AIAgentFramework

[Source](https://www.youtube.com/watch?v=z9riGTseD0I)

中文简报

DeepSeek将AI Agent循环解耦为可替换插件通过消除硬编码的执行引擎，DeepSeek表明智能体的定义并非取决于其模型，而是取决于围绕其构建的沙箱、安全防护与对等服务的显式组合。该介绍深入探讨了DeepSeek Harness的突破性架构设计，该架构将核心智能体循环降级为锚定在统一执行底层上的普通可替换插件。内容详细阐述了运行时会话如何通过显式配置文件补丁进行组装，以及如何在受单调安全防护机制管控的仅追加事件流中严格记录轮次。概述还对比了标准工具调用与代码模式（程序化工具调用），详细介绍了目标（Goals）和子智能体（Sub-Agents）等结构化自主原语，并分析了允许智能体实时合成临时内存插件的反思性“Creator”模式。 DeepSeek开源了智能体框架DeepSeek Harness (dsh)，在该框架中，核心智能体循环本身就是一个可互换的插件，与工具、沙箱及用户界面并列运行。 (0:01) 该框架具备程序化工具调用（代码模式）功能，允许模型通过临时工作线程运行整合脚本，该线程在每次运行后重置，以防止笔记本形式的状态泄漏。 (4:24) 长时间运行的自主性被分解为持久目标、后台任务、确定性工作流和可委托子智能体会话组成的可审计层级，而非不受约束的执行循环。 (5:11) 内存中的“Creator”功能允许智能体在运行时动态检查、定义、挂载和清除自身插件，但所有自生成的扩展均严格保持为临时状态。 (5:59)

Reading summary

DeepSeek Harness rearchitects autonomous AI agents by treating the central execution loop as an ordinary, interchangeable plugin row rather than a hardwired engine. The framework asserts that an agent is defined entirely by its dynamic composition tree and explicit execution substrate. Loop Decoupling and Unified Execution Substrates (0:01) In DeepSeek Harness, the agent loop operates as an ordinary plugin row alongside timers, model adapters, session storage, tools, and the web interface. Disabling or substituting this single row alters system behavior entirely without requiring core engine patches. This architecture addresses the desynchronization that occurs when an agent operates across disconnected environments—such as executing Bash commands inside a remote sandbox, editing files locally, and referencing diagnostics from a different repository checkout. By anchoring the filesystem, terminal processes, and language server protocols to a single, explicit execution substrate, the harness prevents mismatched realities across execution layers. Composable Contracts and Monotonic Security Logging (1:18) Configurations build deterministically from an empty list using a strict hierarchy of profile and configuration patches. Directives replace plugin rows wholesale rather than using opaque field-level merges, and service slots fail immediately if multiple providers register for the same role. Capabilities like shell access are split cleanly into an abstract contract, a concrete host or sandbox provider, and an LLM-facing tool. Swapping execution backends requires no changes to tool schemas or prompts, and deactivating a plugin triggers automatic cleanup of its associated event listeners and prompt fragments. Execution safety and replayability rely on an append-only event stream logging the full turn lifecycle, though only user messages, assistant responses, and tool results are compiled into model prompts. Tool calls pass through pre-execute security guards governed by monotonic policy rules, meaning a denial cannot be overturned downstream. Confinement operates across distinct access tiers (read-only filesystem, workspace-write, or unrestricted) and fails closed if isolation fails. These sandboxes specifically restrict filesystem paths rather than establishing full virtual machine network or process boundaries. Programmatic Tool Calling and Structured Autonomy (4:24) To connect models with tools, the framework supports both conversational Standard Mode and Code Mode (Programmatic Tool Calling). In Code Mode, the model receives an SDK through a single `run_code` execution transport, emitting a consolidated script that executes programmatic logic and returns a single final payload. This design eliminates repetitive conversational round-trips for multi-step tasks while routing every generated subcall through monotonic permissions and event logging. To eliminate state leakage across executions, the dedicated worker thread runtime is destroyed and recreated after each run. Rather than relying on unconstrained autonomous loops, DeepSeek Harness organizes prolonged execution into an inspectable ownership graph. This graph divides operations into persistent session Goals, asynchronous background Jobs, deterministic multi-step Workflows, and delegated Sub-Agent child sessions. Child sessions retain continuable identities, accept follow-ups, and report back structured settlement summaries, allowing long-running operations to be monitored, paused, or audited. Ephemeral Self-Modification and Developer Preview Caveats (5:59) The harness introduces an in-memory reflection capability called Creator, which allows agents to inspect active runtime components, define in-memory plugin packages, mount them directly, and deactivate or purge them. Self-modification is strictly ephemeral by design: the agent writes no files to disk, installs no external packages, and modifies no static configuration files, ensuring all dynamic behaviors vanish upon process restart. This in-memory boundary functions as containment for well-intentioned code rather than a hardened security perimeter, requiring the same operational trust as raw shell execution. DeepSeek Harness is released as an early developer preview subject to breaking API changes. The design deliberately trades simplicity for rigor, requiring developers to manage extensive configuration overhead, multi-layered contract debugging, and a stateless code environment in exchange for deterministic, peer-level modularity. DeepSeek Harness demonstrates a modular alternative to monolithic AI agent frameworks by turning every operational tier—including the core loop—into an auditable, composable plugin. Its practical adoption, however, hinges on whether developers find its deterministic guarantees and unified substrates worth the trade-offs of preview-stage instability, configuration complexity, and strictly non-persistent dynamic modifications.

Source quotes

[0:01] the core agent loop itself is not hard-coded into a privileged engine. Instead, the loop exists as an ordinary, interchangeable plugin row sitting alongside timers, model adapters, session managers, tools, and the web interface. [0:01] the agent no longer has one world. [1:18] DeepSeek Harness builds every runtime configuration starting from an empty list. [1:18] patch directives replace an entire row wholesale rather than performing complex, opaque field-level merges. [1:18] if two providers attempt to claim the exact same service slot, the second registration fails immediately rather than silently overwriting the first. [2:47] model-visible means logged. [2:47] a guard can deny execution, but no downstream policy can overturn an earlier denial into an approval. [2:47] If confinement fails, the system fails closed rather than falling back to unconfined execution. [4:24] The runtime deliberately prevents state from persisting across run_code scripts—avoiding the hidden variable baggage typical of persistent Jupyter-style notebooks—by destroying and recreating the worker thread runtime between invocations. [5:59] The model creates no physical plugin files on disk, executes no package manager installations, and modifies no static configuration files; all dynamically generated capabilities vanish upon process restart. [5:59] the composition is the agent.

Original transcript

[0:01] The strangest part of Deep Sea Carnes is [0:04] not the model. It is that the agent loop [0:07] itself [0:08] appears as one ordinary plug-in row [0:11] beside timers, model adapters, sessions, [0:14] tools, and the web interface. [0:17] Disable or replace that row and the [0:19] composition changes. There is no [0:21] privileged core waiting for special [0:23] patches. That creates a paradox. If the [0:27] loop is replaceable, what makes the [0:29] product an agent? The answer is the live [0:33] plug-in tree, the particular services, [0:35] events, policies, and interfaces [0:37] assembled around the model. [0:40] Um a hardwired loop is reasonable while [0:43] every capability stays local. [0:45] Trouble begins when one part moves. [0:48] Imagine sending bash into a remote [0:50] sandbox while file edits remain on your [0:52] laptop and the language server reads [0:54] another checkout. The remote test pass, [0:57] the local editor changes a different [0:58] file, diagnostics describe a third [1:01] state, no component is obviously broken, [1:04] yet the agent no longer has one world. [1:06] Deep Sea Carnes treats that split as the [1:10] death point. File system, sub-process, [1:12] terminal, and language services must [1:14] share an explicit execution substrate. [1:17] >> [laughter] [1:18] >> The counter move begins with an empty [1:20] list. [1:22] A profile names the composition. [1:24] Bundles insert groups of plug-in rows. [1:28] The profile patch, the home patch, and [1:31] an optional command line overlay then [1:33] replace or add rows by ID. Load order is [1:36] not handwritten, a plug-in activates [1:39] when the services it requires exist. [1:42] Even a patch has a deliberately blunt [1:44] rule. It replaces the whole row instead [1:47] of secretly merging fields. The result [1:50] is verbose but inspectable. A running [1:53] agent becomes a reproducible assembly [1:56] recipe rather than a sealed binary. [2:00] The plugin tree becomes useful only when [2:02] capabilities have clean seams. Take [2:04] shell execution. [2:06] One package defines what a shell [2:08] executor accepts and returns. A local [2:11] bash provider performs it on the host. A [2:15] sandbox provider wraps the same request [2:18] in confinement. [2:20] A model-facing bash tool consumes [2:23] whichever provider the composition [2:25] selected. Contract, implementation, and [2:29] presentation can now evolve at different [2:31] speeds. If two providers claim the same [2:34] service position, the second [2:35] registration fails instead of silently [2:38] winning. Reversible effects also carry [2:40] cleanups, so unloading a plugin removes [2:42] its tools, listeners, and prompt [2:44] contributions. [2:47] Now follow one turn. The harness appends [2:50] turn start, step start, the entered user [2:53] message, raw assistant chunks, the [2:56] assembled assistant message, every tool [2:59] call, every tool result, and the closing [3:03] boundaries. Most events exist [3:06] for replay, policy, interface state, or [3:11] audit. [3:12] Only three event families produce the [3:14] ordered model conversation. User [3:17] message, assistant message, and tool [3:20] result. The system prompt tool schemas [3:23] and model configuration are logged [3:25] separately as a request header. Model [3:27] visible means logged. Resume, fork, [3:31] replay, and history all project from the [3:33] same append-only stream. [3:36] Uh a tool call enters the log before [3:39] execution. [3:41] Then a shared pre-execute stage can [3:43] apply hooks, permission policy, and [3:46] sandbox decisions. Monotonic guards may [3:49] deny, but cannot turn an earlier denial [3:52] back into permission. Allowed calls pass [3:55] through wrappers such as timeouts, then [3:57] the tool body, post-processing, content [3:59] finalization, and one frozen result [4:02] event. The sandbox mode is resolved per [4:05] call, read-only, workspace write, or [4:08] dangerous access. Confinement failures [4:11] fail closed instead of silently running [4:14] unconfined. The boundary is narrower [4:16] than a virtual machine though. These [4:18] modes govern file effects, not network [4:21] or process visibility. [4:24] Standard mode exposes many tools [4:26] directly. Code mode presents a generated [4:29] software development kit and one [4:31] transport named run code. The model [4:34] writes a short program that can call [4:36] several tools, branch on intermediate [4:39] values, and return only the useful [4:41] result. Those subcalls still pass [4:44] through the ordinary permission pipeline [4:47] and receive durable dispatch records. [4:50] What disappears is repeated model [4:52] visible chatter for every intermediate [4:54] value. [4:55] One boundary is intentional. No program [4:58] state survives between runs. A [5:00] persistent notebook would create hidden [5:03] cross-request state, so the current [5:05] worker thread runtime resets each time [5:08] and is not a hard security boundary. [5:11] Let the agent keep going sound simple [5:13] until work branches. Deep seek harness [5:16] separates four jobs. A goal records a [5:19] durable same session objective and can [5:22] drive another round. Uh a job represents [5:24] background work that can be listed, [5:27] collected, or stopped. [5:30] A workflow coordinates programmatic [5:32] steps. A sub-agent provider creates or [5:36] delegates a child session possibly [5:39] through another product such as Codex or [5:41] Claude code. Continuable children have [5:44] durable identities except follow-ups and [5:47] report settlement to their parent. [5:49] Autonomy is no longer one mysterious [5:51] longer loop. It is an ownership graph [5:55] whose work and descendants can be [5:57] inspected. [5:59] The most unusual preset points the [6:02] architecture back at itself. [6:05] Five verbs let the model inspect the [6:08] live runtime, define a dynamic package, [6:12] run it, stop it, and forget it. That [6:15] package may add tools, prompt sections, [6:18] services, or browser interface pieces to [6:22] the current process, but the hand is [6:24] temporary by design. It creates no [6:27] plug-in file, installs no package, [6:30] changes no configuration, and disappears [6:32] after restart. The virtual machine [6:35] sandbox's containment for honest code, [6:37] not a security boundary, so this [6:39] capability deserves the same trust as [6:41] bash. Persistence requires an ordinary [6:43] reviewed plug-in. [6:46] >> [sighs and gasps] [6:46] >> This is not yet the obvious daily driver [6:49] replacement. The repository says [6:51] developer preview in plain language and [6:54] promises compatibility breaking changes. [6:57] Um the abstractions by replaceability, [7:01] traceability, and unusually honest [7:03] inspection, but they also by [7:05] configuration weight more layers to [7:07] diagnose, a stateless code runtime, and [7:11] self-modification [7:12] that deliberately forgets. The durable [7:15] idea is larger than the current [7:17] interface. Deep Sea Carnage is not a [7:19] model wrapped in tools. It is a [7:21] replayable plug-in graph in which the [7:23] model loop, policy, execution, memory, [7:26] delegation, and interface are peers. The [7:29] composition is the agent.