The Harness Opened; The Session Did Not

• Reading the loop is not owning the session
• Sandbox choice is not control-plane choice
• Open source as a comfort layer
• Distinct from the trail fights we already had
• What to put on the scoreboard

§Reading the loop is not owning the session

For a few years the sovereignty story around coding agents was simple. If the harness is open, you can see how the model calls tools, how context is compacted, and how a long run recovers. Read the loop. Fork it if you dislike the defaults. Keep the scarce object on your side of the wire.

That story just got a quieter update.

A frontier lab shipped a managed agents API around an already-open coding harness. The pitch is blunt: your app supplies tools and picks an execution environment; the platform manages sessions, orchestration, context compaction, and recovery. You can still read the harness source. The durable session — the thing that resumes, steers, and survives a cut — lives behind their API.

§Sandbox choice is not control-plane choice

The design splits two layers that operators used to mash together.

The environment is where code runs, files live, and packages install. You can pick a hosted sandbox, a partner box, or a self-hosted executor that dials out to receive commands. That is real leverage for data locality and VPC placement. It is also easy to over-read.

The session is where the agent loop lives. Compaction happens there. Subagent delegation happens there. Resume-after-idle happens there. The docs are explicit that choosing a self-hosted sandbox does not make the agents path Zero Data Retention–eligible, and residency for that path is currently United States–only. Keeping files on your disk does not move the control plane. It moves the workbench.

If your threat model was “no one else can see the repo,” a self-hosted executor helps. If your threat model was “no one else owns the durable memory of this run,” you are still renting the session.

§Open source as a comfort layer

Opening the harness is not a concession. It is a product surface.

Teams can inspect how the loop coordinates models, tools, and context. They can learn from it. Some will run their own copy. Many will still prefer a managed session that handles long-running orchestration, compaction, and recovery without them writing the glue. The commercial bet is that readability lowers adoption friction without forcing you to operate the control plane.

That is a familiar pattern in infrastructure. Readable systems become default rental products precisely because the hard part moved from “can I see it” to “can I keep the stateful path alive under load.” Agents are now deep enough into that second problem that the open harness and the rented session can coexist without contradiction.

§Distinct from the trail fights we already had

This is not the opaque-scratchpad fight. That fight was whether the industry still ships a readable chain of thought. This is not notes-across-the-cut. That fight was whether a summary eats the why of a failed fix. This is not harness-as-corpus. That fight was whether routing trails become post-training data. This is not the surrogate-credential door. That fight was whether the model ever sees the key that can mail or pay.

This fight is narrower. When the agent loop is open and the session is managed, what did you actually buy? Inspection rights, or operational ownership of continuity?

§What to put on the scoreboard

Before you celebrate “we can read the harness,” ask the rental questions. Where does session state live after a two-hour coding run? Who owns compaction decisions when the window fills? If the sandbox is self-hosted, does Zero Data Retention actually apply to the agents path? Can you resume the same durable session on infrastructure you operate end to end, or only reconnect an executor to someone else’s control plane? And if you fork the open loop, are you prepared to operate recovery, steering, and multi-agent coordination yourself — or did you only buy the comfort of readable source?

The scarce object moved again. It is not whether the loop is published. It is whether the session that survives the cut is yours.