The agent harness is the product: DeepSeek ships a runtime that routes to its rivals

The sentence doing the work in the dev.to write-up is not about DeepSeek. It is the claim that two agents built on the same model can behave completely differently depending on how the harness around them manages context, which tools it exposes, how it recovers from errors and how it schedules work ^[2]. Nothing in the post measures that gap. It is argued from architecture, not shown as a delta, and every "the runtime is the product" conclusion downstream of it inherits that weakness.

Take the argument on its own terms and the interesting move is the inventory. The piece enumerates seven jobs a long-running agent needs done that have nothing to do with the model: safe tool execution, state across turns, a per-call context policy, sub-agent delegation, a sandbox, partial-failure recovery, and a replayable record ^[4][5]. In dsh, at least three of those are shipped inside a single foundational bundle, dsh-base, which also carries model adapters, credentials and telemetry ^[15][20]. Profiles stack bundles in deterministic order, with web and headless templates in the docs ^[14]. So whether an agent can reach your filesystem is a property of which bundle a profile stacked, not of which model happened to answer.

The plugin commitment is stricter than "supports multiple providers". According to the project's architecture documentation, "every part of the product is a plugin, including the model adapter, the tool registry, the session log, and the agent loop itself" ^[12]. There is no privileged core to patch; extending means mounting a plugin beside the others, and every registration is an effect that unwinds when its plugin unloads ^[13]. Those reversible effects come from Cordis, the underlying framework, whose composition model is set out in a paper on spatiotemporal composability from Peking University and DeepSeek researchers ^[10][11]. Reversibility is what makes unloading safe, and the cost is that the approval policy sits as a peer of the tool registry it governs rather than above it.

The one genuinely reviewable artefact here is `dsh --profile web --dump-config`, which prints the assembled layering ^[17]. A system prompt tells you an intention. A config dump you can diff between two deployments tells you what was actually mounted, which is the sort of thing that survives an incident review. It is worth remembering the whole thing is a developer preview ^[6].

Then the commercial read. A model vendor has released, under MIT, a runtime that owns the session, the tool pipeline and the execution history, and routes the model slot across six named provider families plus any OpenAI-compatible endpoint ^[6][8][19], with nothing in the design tying it to DeepSeek's own models ^[9]. The post itself notes that Claude Code, Codex CLI and other open frameworks were already converging on this territory ^[18]. Giving away the layer that holds the state, while treating the weights as interchangeable, is a statement about where the switching cost is expected to live.