DeepSeek Harness takes "everything is a plugin" more literally than any of the others. The CLI writes an empty root config on every boot — the running system is assembled entirely from YAML patch layers: bundle patches, then a profile patch, then your home patch, then command-line overlays. The tool registry, the agent loop, the session store, the LLM runtime, the sandbox, approval, compaction and every individual tool are all just rows in that config.
The container underneath is Cordis, where services are looked up by name rather than imported. A plugin declares static inject = ['agents','sessions','llm','tools'] and stays dormant until those services exist — load order is derived, never sequenced. Every registration returns its exact disposer, so unloading a plugin mid-flight rolls back cleanly, and hot reload is real.
That buys a genuinely unusual capability: agent presets. A preset is a sub-composition mounted once under a standing scope; a session joins it by parenting its scope key. The web build disables the entire agent plane in the host and lets each session mount its own — so a Code Mode agent, a minimal agent and a full coding agent coexist in one process with different tool sets and different prompts.
The session is an append-only event log and provider requests are a pure function of it. Compaction doesn't delete; it shadows nodes, so replay stays exact. Even a cancelled turn writes synthetic aborted-before-dispatch results so the log never breaks. And the sandbox fails closed: if confinement is unavailable it refuses to run rather than running unconfined.