Agent harness vs agent runtime: holding both in one open-source repo

Two layers, two owners

Credal's post on the two terms gives the cleanest split: "an agent harness is the application-layer scaffolding that turns a model into an agent." That scaffolding is the loop: it picks the next tool call, folds the result back into the context, and decides when the turn ends. It also holds the prompts and the tool definitions the model reads. Application engineers own it, and it changes whenever the agent's behaviour changes.

The same post calls the runtime "an infrastructure-layer execution environment where the agent actually runs," and Work-Bench describes the category as "the infrastructure layer being built to safely execute, constrain, observe, and improve agent work at scale." That half owns the file system, the network path, the credential and the clock. A platform team usually owns it. Its questions are about permission and capacity rather than behaviour. The longer definition of an agent runtime covers what a runtime settles.

The vocabulary is still moving. LangChain's post on the three layers admits "I don't think there is yet a super clear definition of any of these" before offering its own. Use the words to read a product page, and fall back on the three questions that classify a product when a page mixes them.

Where the line falls

Everything the loop does inside the agent's process is the harness. Everything that process is allowed to touch is the runtime. The boundary is a process boundary, and you can point at it.

Credal draws authorization along the same line: the harness decides whether a person may invoke a tool, the runtime decides whether the process can open the socket or read the secret. A policy enforced on one side leaks through the other, which is why two teams end up owning the two halves.

Three questions that classify any product

Ask these of any product on the shortlist, in order.

1. What loop does it run? Look for the turn, the tool dispatch, the context handling, and whether the prompts live in your repo or behind an editor.
2. What does the environment enforce? Look for a machine per session, the network path, the credential and the time limit.
3. What does the run leave behind? Look for something you can read after the fact and hand to a reviewer without asking the vendor first.

Most products sort into components and bundles once you answer all three. Sandbox vendors such as E2B and Daytona answer the second question and leave the loop and the record to you. Cloudflare Agents answers all three inside Cloudflare's network, with an agent harness, a sandbox tool for code execution and local SQL storage per session. Agyn answers all three on your own Kubernetes, running the coding agents you already use, with per-agent isolation, egress rules and a record of every run.

Kortix answers all three in one repository, which is why the seam stays visible after you buy. The agents, their files, connectors, secrets and permissions are declared in kortix.yaml, so the loop has a file you can read. One isolated sandbox per session. Each session has its own isolated machine and branch. Session work reaches main through a change request. Merge is default-deny for agents, so the record of a run arrives as a diff a person reads. Per-resource permissions for people and agents. Roles, groups, and an audit trail. Any model provider with your own keys. Or the ChatGPT plan you already pay for.

What bundling hides

A single bill hides which half is priced. Runtimes meter time and harnesses meter seats. A combined number tells you neither, so the first price change after renewal lands on the wrong line.

A single dashboard hides where the config lives. When the loop is configured in the vendor's editor, the harness is the half you cannot take with you. Every later move begins by rebuilding prompts you already wrote.

A single log hides which half recorded what. A trace that joins a harness decision to the exact execution is the one an auditor can follow. When each end sits in a different account, the join is the part you have to prove and the part the vendor controls.

None of this shows while the bundle works. It shows on the day you change one half: a new model, a move to your own network, an auditor asking for last quarter's runs. The question at that point is which half can leave, and whether the record leaves with it.

What to check when the vendor merges the layers

Four questions, asked in this order, sort a merged product faster than any architecture diagram.

1. Where does the configuration live? A file path in your own repository is an answer. A settings screen is a promise.
2. Does the environment come apart from the loop? One machine and one branch per session can move to another host. A shared pool with a queue cannot.
3. What does a run leave behind, and who holds it? A record in your repository survives a vendor change. An export you have to request may not.
4. Can the model change without the loop changing? A product that pins one vendor's models sells you the harness and the model as a single purchase.

The architecture of an agent runtime follows these questions down to the machine, and the runtime comparison applies them across the products on the market. Kortix publishes the manifest that answers the first question, key by key: Read the docs.