待翻译：The AI-coding stack: a map for a landscape that won't sit still

AI 服务暂时不可用，以下为来源正文，待恢复后补全翻译。

The AI-coding stack: a map for a landscape that won't sit still seed · Aug 17, 2026 Every week ships a new AI coding tool, and every announcement uses the same words: agent, context, autonomous, 10x. I’ve argued before that these assistants should reach beyond the editor, across the whole development loop — but whatever they reach, you first have to tell them apart. If you try to reason about “AI coding tools” as one category, you end up comparing a frontier model to a YAML workflow runner to a Firecracker microVM vendor — and the comparison produces noise, because those are not three competitors. They are three categories of one stack. Since late July 2026 I’ve been keeping a small public research repo1 with one rule: claims come from reading source code and running preregistered experiments, not from launch posts. This article is the map that survived a month of that. The core triad The core triad: you talk to a harness, a swappable model is seated inside it, and the harness runs a loop of actions and feedback against an environment. Strip any working coding agent to the parts it cannot lack and three things remain: models, harnesses, and execution environments.2 Models Models are the actual large language models: they take your request and its surrounding content into their context window and generate new content accordingly — code, plans, tool calls. Concretely, the category is the weights and the API surface around them — Claude Sonnet 5, GPT-5.6, DeepSeek V4. This category drifts fastest: pricing, caching economics, effort controls, and lifecycle stages change monthly (one vendor repriced its entire API to time-of-day billing the day before I checked its row3). The part nobody advertises: vendors don’t even share a lifecycle vocabulary — of ten models I track, one has been “in Preview” for six months with no GA plan stated as of 2026-08-17, another’s GA was quietly suspended three days after launch and redeployed weeks later.3 Beyond benchmark quality, the axes that actually separate model APIs are the surface around the weights: whether thinking is adaptive or a budget you set, what the effort controls default to, the write/read economics of prompt caching, whether batch pricing exists at all — each recorded in the vendor’s own vocabulary, because the economics differ structurally between vendors.3 And the route matters as much as the name: the same model reached through a first-party API, an aggregator, a cloud marketplace, or a local runtime is not the same product — prompt-caching support, quantization, rate limits, and silent context truncation all vary by route.4 This is also the category that most resists decomposition into components: even open weights yield transcribable architecture facts, not a mechanism you can trace the way you trace a harness’s loop in source. So the assessment lens is behavioral — tool-call fidelity, long-horizon coherence, usable context — and economic: per-token prices are the objective numbers vendors publish, but the figure that actually matters is cost per completed task, which a price sheet alone can’t tell you.2 Harnesses Harnesses are the software that turns a model into an agent. Formally, a harness implements an agent-computer interface:5 it treats the language model as a new category of end user and supplies everything that user touches: the commands it can issue, the shape of the feedback it reads, and the management of its context window. In practice, that is the loop that assembles context, offers tools, executes actions, and decides when to stop. Claude Code, Codex CLI, OpenCode. This is the category most discourse treats as plumbing. It isn’t. The paper that named that interface also measured its weight. SWE-agent (NeurIPS 2024) held the model fixed and redesigned only the interface the agent works through, and moved SWE-bench Lite6 from 11.0% (bare Linux shell) to 18.0%, a +64% relative improvement from interface design alone. The same paper contains my favorite negative result in the field: a search tool faithfully copied from human UI patterns scored below having no search tool at all. Tool existence is not tool value; a checkmark on a feature matrix can be negative. Feature lists mislead here. What to trace instead is the harness’s three components, each an agent-shaped question:2 The loop: who can stop or steer a turn, and with what authority? Iteration, tool dispatch, stop conditions, subagent fan-out, plan-mode checkpoints. Context assembly: what reaches the prompt, who wrote it, and where does the agent’s own output land? Rules-file and skill injection, memory write-back, compaction, cache discipline: the contested ground of 2026. The permission gate: what may the agent attempt without a human, and can the model influence that decision? The harness’s end of the harness↔environment edge, distinct from the environment’s own bounds. Nine harnesses are tracked so far, four of them traced to deep-dive depth.7 Execution environments Execution environments are where the agent’s actions actually land: your host, a git worktree, a devcontainer, a cloud sandbox like E2B, Modal, or Daytona. For weeks I suspected this category was just an attribute of the harness (“where does it attach?”), and I kept a pre-committed demotion rule for it. Then the first environment studied as a product in its own right — E2B, read from its open-source infrastructure — produced roughly 26 facts invisible from the SDK:8 every “create” is secretly a snapshot resume, the guest’s memory compactor is disabled for the host’s snapshot-diff economics, the credential-injection proxy doesn’t exist in the open-source build. An interface that hides that much is a category, not an attribute.9 An environment is three components:10 Host: machine, OS, installed toolchain, and network position. Principal: the effective identity of the agent’s process (OS permissions, ambient credentials, inherited environment variables). Working directory: the anchor where discovery walks from. The default execution environment every harness runs in is {your machine, your user, cwd} — full ambient authority anchored at a folder — and every product in this category is a device for narrowing it. The category’s three questions map straight onto the components: blast radius (host × principal — what can the agent damage), fidelity (host toolchain + working directory — does the project’s tooling run unmodified inside), and parallelism (the cost of multiplying working directories versus hosts) — and the field’s autonomy ceiling is set by blast radius, not model capability.2 How a harness relates to its environment is a design position of its own, with exactly four verified shapes — bundle one, bind to one, internalize one, inhabit one — plus a legitimate fifth: deliberate abstention.11 The two additional interfaces The full stack is the triad plus two additions: a process category between you and the harness, and memory seated inside it alongside the model, carrying state from one session to the next. Around that triad sit two more categories that behave less like parts of the machine and more like boundaries: workflow frameworks on the boundary between you and the stack, memory on the boundary between one session and the next. Memory Memory is persistent cross-session state, packaged as an installable product (mem0, MemOS, ai-memory): fed by hooks during the session, consolidated between sessions, injected back at the next session start, on any harness.2 Harnesses ship memory features of their own (the harness ↔ memory section below returns to that), so for a user who lives in a single harness these products compete with a built-in. Their own domain begins where no single harness can follow: persisting what was learned across harnesses. A first cross-harness probe (n=1 per arm) measured that continuity as real, and entirely pull-shaped.9 Two findings frame the products: they sell to coding agents but benchmark on chat (LoCoMo,12 LongMemEval13),9 and they share zero formats — each vendor pays the harness-fragmentation cost separately, in code, up to and including one product’s plugin blocking the harness’s native memory writes to redirect them into its own store.14 The category decomposes into three components — the pipeline to trace when assessing a product, each with its own trust question:2 Capture: what enters the store, and who admitted it? The write path (hook, adapter, or agent-invoked; no two vendors alike) and the admission policy: what earns storage, and on whose evidence. Consolidation: what happens to it between sessions, and does that run by default? The store wager lives here (a git-versioned markdown wiki, a vector platform, a knowledge graph, a scored policy database), plus tiers, decay, and who may revise a memory once it turns out to be wrong. Recall: what reaches the next session’s prompt, pushed or pulled, framed as data or as authority? Injected memory is a prompt-injection vector, so the read-side trust boundary matters as much as the retrieval: the category’s pitch says “your agent remembers”; the measurement above says it can look things up, if it asks. Eight products are tracked, three at deep-dive depth.7 Workflow frameworks Workflow frameworks are methodologies encoded as installable tools: prompt and template packages that refine your intent into specs and subtasks going down, and carry research and verified evidence coming up. Formally, they are the tools that sit over an agent you already run while being neither the agent itself nor a kit for building one, which is how an independent six-framework study delimits the category.15 OpenSpec, spec-kit, GSD, and their cousins. All of them exist to enforce a working structure on the agent. What varies is the nature of that enforcement. At one end sit prompt templates the model reads and follows, which keeps a framework portable across harnesses (prose runs anywhere) but makes its runtime the model reading instructions; at the other end sit small deterministic engines that parse, validate, and advance workflow state in code.16 Portability and enforcement power are the same tradeoff,9 a finding the same study reproduced independently, working from documentation alone.15 The four functions a framework performs are its components — what to check a candidate actually has:2 Intent refinement: does the framework test the English before anything executes? Work decomposition: does work arrive at the triad in verifiable units? Gap research: does the framework measure the domain, or trust the model’s training data? Verification: who checks the claim of “done”, and with what authority? Intent flows down through the first two; evidence flows up through the last two — and the preregistered experiments located nearly all of the measured value in the last two and almost none in the ceremony of the first two.9 Nine frameworks are tracked, four at deep-dive depth.7 The stack is being eaten from the middle The reason this map needs dates on it: the categories don’t respect each other’s territory. Mechanisms that adjacent categories sell keep turning up natively in harnesses9 — and the pattern looks different on each edge, starting with the one where nothing is being eaten at all. Harness ↔ model This may be the map’s best-defined frontier: harnesses are not trying to bite anything off the model category. No tracked harness ships or trains its own weights, and none of the absorption findings names the model as a target — the model stays the swappable slab in the diagram. Where the frontier is crossed, the movement runs the other way: model vendors treating harnesses as data instruments — xAI’s acquisition of Cursor, followed by training Grok 4.5 on that harness’s session data, and hermes shipping trajectory-export tooling openly labeled for training its maker’s next models.2 Well-defined does not mean uneventful. Every harness is forced to take a [truncated for AI cost control]