Three Chairs: On DeepSeek's Harness and What I Actually Think About Open Source

The wall is not a moment

I use Claude Code the way some people use a build system: constantly, structurally, and with more moving parts than is entirely reasonable. Agents running in parallel on separate git worktrees. A self-hosted CI runner, because I burned through my hosted minutes months ago. Temporal for durable workflows, Redis underneath, a browser automation server wired in so an agent can look at what it just built.

I want to tell you about the day I hit a wall with it. I can’t, and that turns out to be the honest part of this story.

There was no wall. There was no afternoon where the tool refused me and I slammed my laptop shut. What there was — what there is — is an accumulation. A small “huh, I’d like to change how that works” that I route around. Then another one, a month later, that I also route around. Then a third, and by then routing around has stopped feeling like a workaround and started feeling like the shape of the tool. That’s the thing about a good walled garden: you don’t experience the wall as a wall. You experience it as the edge of what you thought to want.

I only noticed the accumulation later, by contrast — which is how most of these things get noticed.

”Everything is a plugin”

In August, DeepSeek published a harness. The repository is deepseek-ai/deepseek-harness, MIT licensed, and it collected something on the order of 179,000 stars — a number that says less about the architecture than about how many people are currently thinking hard about this exact problem. Its tagline is four words: Everything is a Plugin.

I read it and I was, briefly, unimpressed.

The README says the model adapter, the tool registry, the session log, and the agent loop itself are all replaceable, that there is “no privileged core to patch.” Alongside it came an 88-page paper with the title A Programming Paradigm for Spatiotemporal Composability. I bounced straight off that phrase. My honest first reaction was that someone had taken plugins — plugins! — and dressed them in the longest words available.

I want to be careful here, because my first reaction was wrong, and how it was wrong is more interesting than the reaction.

Plugin architectures are old. Eclipse had extension points. OSGi has been doing dynamic module loading since before some of my coworkers could type. Erlang has hot-swapped code for decades. Spring has been injecting dependencies since 2003. If the claim were “we invented replaceable components,” it would be an empty claim.

But that isn’t the claim, and I’d know that sooner if I had read the paper before reacting to the repository. Section 7 lists all of that prior art — OSGi, Eclipse, the VS Code extension host, Erlang’s hot code loading, Spring and Guice, algebraic effect handlers, event sourcing — by name, and concedes the point. The authors are not claiming plugins are new. They say so in print.

What they claim is much narrower. In every one of those older systems, cleanup is a duty. You register something, and you are trusted to unregister it. The paper’s phrase for this is that a forgotten cleanup “leaks resources silently,” and if you have ever chased a listener that outlived the thing that created it, you know that’s not a theoretical complaint. The contribution is making the inverse of every effect structurally required and automatically derived — you cannot forget the cleanup, because you never write it — and then proving, formally, that a system which has been loaded and unloaded in any order whatsoever settles into the same state as one that was loaded cleanly, once, and never touched. They call that property confluence. The paper spends most of its length proving it.

So the genuinely novel artifact here is the metatheory. Proofs. Which is precisely the thing that fits worst on a repository banner.

And that, I think, is the real explanation for my bad first reaction. The packaging sells the forty-year-old part, because “Everything is a Plugin” is legible in four words and “we made effect reversal structurally mandatory and proved confluence” is not. I bounced off the marketing and concluded there was nothing underneath, when what was underneath was the part that took 88 pages.

I’d also been sloppy about who “they” were. The harness is DeepSeek’s. The paper is DeepSeek-AI and Peking University. And the runtime it formalizes, Cordis, is not new and not DeepSeek’s — it spent four years as the kernel of an open-source chatbot framework called Koishi before it was generalized and given a metatheory. That’s a less cinematic story than a lab inventing something from nothing. It’s also a better one: people built on open foundations, formalized what they’d learned, and put the result back out under MIT.

I could read the code

Here is the sentence this whole piece is organized around, and it has nothing to do with confluence proofs.

I could read the code.

Not “the API was well documented.” Not “the extension points were generous.” The actual agent loop — the thing that decides what happens next — was sitting there in a file I could open. If I disagreed with it, the disagreement was actionable. I could fork it and be wrong in my own way.

I noticed how much I wanted that, and the wanting is what told me something. You don’t feel that jolt unless you’ve been quietly missing it. All those small routings-around I never bothered to count had apparently been adding up somewhere.

Then I noticed something else, which is that I did not actually want to switch. And that’s when this stopped being a post about architecture.

Three chairs

I sit in three chairs, and they do not agree.

In the developer’s chair, I want the machine, not the set of controls someone decided to expose to me. Every abstraction is a bet about what I’ll want, and the bet is usually right, and when it’s wrong I want a way down to the floor. Not because I’ll use it often — I’ve never needed to fork Postgres — but because knowing the floor is reachable changes how I build on top of it.

In the customer’s chair, I love the walled garden. I want to be honest about this, because developers are often dishonest about it. Claude Code is a superb product. It is coherent in the way that things are coherent when a small number of people with taste get to make decisions and don’t have to defend every one of them to a mailing list. That coherence has a cost, and the cost is my flexibility, and most days I pay it happily and don’t think about it once. A tool that never makes me open its source is doing something right.

In the founder’s chair — and this is the one I keep turning over — I understand the wall completely.

I can construct the noble version easily. Open the platform, earn the ecosystem, let the community find the use cases you’d never staff. I believe that version. I’ve also watched enough companies get strip-mined by it to know it isn’t free, and that “we open-sourced the core” is sometimes a sentence that precedes a layoff.

So when I ask myself what I’d do — with my own product, the one I’d have spent years and real money building, the one where an open core hands a well-funded competitor a running start — I don’t get the answer I’d like to have. I get: I cannot confidently say I would decide differently.

I’ve sat with that for a while now and I’ve decided not to resolve it in my own favor. It’s easy to hold the developer’s opinion loudly, because it costs nothing to demand openness from other people’s businesses. The founder’s chair is where the opinion gets a price tag, and I’d rather admit I don’t know what I’d pay than pretend I’ve already paid it.

Understanding a decision is not the same as preferring its outcome. Both of those can be true, and I think they’re both true of me.

What I don’t know, and am not going to pretend to

I don’t know why DeepSeek open-sourced this.

I can list plausible reasons — strategic positioning against closed labs, recruiting, genuine research culture, the simple fact that Cordis was already open and closing it would have been the strange move. Those are possibilities. I have no window into anyone’s motives there, and constructing a flattering narrative about a company’s soul from a license file is exactly the kind of thing I’d like to stop seeing on the internet.

Related: I’ve seen it suggested that this is somehow Anthropic’s move to answer. As far as I can find, Anthropic has said nothing about DeepSeek’s harness at all, and I’m not going to invent a rivalry to make a tidier story. What’s actually true is more interesting anyway, and it runs the other direction — the DeepSeek paper cites Anthropic’s own engineering writing on harness design as prior work, next to OpenAI’s. The closed labs published the thinking. The open project cited it and shipped an implementation with proofs attached. That’s a stranger and more accurate picture of where the open/closed line runs than either side’s usual story.

The one thing I’ll say without hedging: opening this was a choice, it wasn’t the profitable-looking one, and I noticed.

The chair I’m walking toward

I’m building things too. Not at that scale, not yet, maybe not ever. But the question stops being abstract the moment you have something worth protecting, and I’d rather have thought about it before then than during.

So I’m leaving this unresolved on purpose, because resolving it now would be a performance. What I’ve got instead is three sentences that are all true at the same time, which is the most honest position I can currently occupy:

As a customer, I appreciate a beautiful walled garden. As a developer, I keep looking for the gate. As a founder, I understand exactly why the wall is there.

And when someone chooses to leave a gate open, I notice. That’s not an argument. It’s just what I’ve got.

We shouldn’t be afraid of expressing our opinions. We should be afraid of opinions decorated as truth — including, especially, the flattering ones we tell about ourselves.

---

Disclaimer: Written by Human, improved using AI where applicable.