Back to the AI Toolkit

AiLoft · AI Toolkit · Guide

AI-CODING Harness

Software development in the AI era

The model writes the code. The HarnessThe runtime around a language model: context, tools, permissions, sandbox, verification loops and orchestration. It turns a model that produces text into an agent that works in a repository — everything about the agent except the model itself. decides whether it becomes production software: what the model knows about your system, what it may execute, and how every result is verified before it ships. Four chapters show how software development with AI agents has to be set up today — with evidence, not promises.

As of every figure sourced

01 02 03 04 05 06 MODEL the core
  1. 01 Context Specification, CLAUDE.md, repository knowledge, memory
  2. 02 Tools Files, shell, Git, MCP servers, browser
  3. 03 Permissions & sandbox Permission modes, deny rules, isolated execution
  4. 04 Verification loops Tests, types, hooks, review agents
  5. 05 Orchestration Subagents, parallel worktrees, background tasks
  6. 06 Operations CI/CD, telemetry, policies, audit

Chapter 01 · The process

Agents build. Gates decide.

AI amplifies what is already there — good practices and bad ones alike.1 A modern SDLCSoftware Development Life Cycle: the entire path of a change — from requirement through development, testing and delivery to operation and maintenance. therefore moves work forward, into specification and context, and backward, into verification and approval. Agents take over the middle. Speeding up only the middle shifts the bottleneck into review: DORA calls it a “verification tax” on AI-generated code.3

90%

use AI at work. 30% have little or no trust in the code it generates.1

+19%

more time was needed by experienced developers with AI in a field trial — while they believed they were 20% faster. The 2026 follow-up leans towards a gain but cannot measure it reliably.4,5

44%

of coding tasks in which AI introduced a risky vulnerability. In 2025 it was 45% — larger models barely help.7,6

6.6%

trust AI with important decisions too. 48% only when the result is easy to verify.8

The loop in eight phases

Every phase has the same three parts: what the agent takes over, what is checked automatically, what a person decides. Pick a phase.

  • Approval by a person
  • Automatic gate
01 / 08

Specify

A wish becomes a verifiable requirement — with acceptance criteria, edge cases and what will explicitly not be built.

Agent takes over

Asks clarifying questions, writes out acceptance criteria and edge cases, and stores the specification as a file in the repository.

Checked automatically

The specification is versioned and linked to the ticket. Without acceptance criteria, no implementation starts.

Person decides

Decides what and why: value, scope, priority. The business side signs off the criteria.

Tools Spec KitKiroIssue-VorlagenPlan-Modus

Guides before, sensors after

This is how Birgitta Böckeler describes what a HarnessThe runtime around a language model: context, tools, permissions, sandbox, verification loops and orchestration. It turns a model that produces text into an agent that works in a repository — everything about the agent except the model itself. does:9 guides raise the chance that the agent gets it right the first time. Sensors report what went wrong so it can correct itself. Anthropic draws the line more sharply: anything that has to happen every time belongs in a hook, a deny rule or a managed setting — CLAUDE.md is for guidelines.10

Guides · before

  • Spec-driven developmentFirst comes a verifiable specification with acceptance criteria, then a plan and tasks — and only then code. Intent, not code, is the source of truth. with acceptance criteria
  • CLAUDE.md / AGENTS.mdContext files in the repository that the agent reads at every start: commands, conventions, limits. AGENTS.md is vendor-neutral and, according to the Linux Foundation, used by more than 60,000 open-source projects. with commands and limits
  • Skills: expertise that loads only when needed
  • Architecture rules and allowlists for packages

Sensors · after

  • Compiler, type check, linter — after every change via a HookA script the harness runs by itself at fixed points — for example before every tool call. Hooks block actions, enforce formatting and tests, or log. Unlike an instruction in the prompt, they fire every time.
  • Tests that answer “pass” or “fail”
  • Review agents with fresh context — separate from the author11
  • Security review and package checks against SlopsquattingAttackers register package names that language models invent. If an agent adopts the invented name unchecked, it installs someone else’s code.15

What shifts

  1. Bottleneck Writing code Verifying code
  2. Source of truth The code The specification12
  3. Knowledge Heads and wiki Context files in the repository — Context engineeringThe discipline of giving the model exactly the information the task needs — no more, no less. In the Thoughtworks Technology Radar’s “Adopt” ring since April 2026.13
  4. Review A formality The main gate, with evidence
  5. Security A pentest before release A check on every change20

The foundation: seven capabilities according to DORA

Without them, AI amplifies the mess instead of resolving it. Google DORA’s AI Capabilities Model names seven capabilities that unlock the benefit of AI in the first place.2

  1. 01 Clear and communicated AI stance What is allowed, which tools are approved, who is accountable. Only 24% of developers report approved tools or an official policy from their employer.8
  2. 02 Healthy data ecosystems Clean, accessible data. AI amplifies the quality of the data it meets.
  3. 03 AI-accessible internal data Documentation and architecture decisions stored so that agents can find them and are allowed to read them.
  4. 04 Strong version control practices Small commits, rolling back without fear. At high change velocity, the most important safeguard.
  5. 05 Working in small batches Amplifies AI’s positive influence on product performance and reduces friction.2
  6. 06 User-centric focus Without it, AI adoption can even hurt team performance.2
  7. 07 Quality internal platforms They help decide whether the value of AI can be unlocked at all.1

“AI coding assistants are no substitute for experienced developers. An unrestrained use of the tools can have severe security implications.”

BSI and ANSSI, joint recommendation19

Chapter 02 · The harness

Why Claude Code is still the benchmark. And where open source is the better choice.

Measured by adoption, results and security defaults, Claude Code leads the field of coding harnesses. The free tools are strong, growing fast and the better choice in three situations. Both belong on the table — and so does what speaks against Claude Code.

65.5%

The most used

Among developers who use coding agents, Claude Code is the most used tool — ahead of GitHub Copilot at 58.7%.21 At work, JetBrains puts it at around 39%.22

+6.3

Model and harness from one house

Anthropic measures its own models in its own harness — the Opus 5.5 benchmark figures are produced “using Claude Code in --bare mode”.23 On Terminal-BenchAn open benchmark in which agents solve real tasks in the terminal — from compiling to running servers. It always measures the combination of model and harness. 2.1, Claude Code lifts the same Opus 4.6 from 63.8% to 70.1% compared with a neutral harness. On version 2.0 the neutral harness was still ahead: the effect is real, but not guaranteed.24

1 + 2

Top of the current leaderboard

On Terminal-Bench 4.0, Claude Code with Opus 5.5 (64.85%) and Sonnet 5.5 (61.82%) takes first and second place.25 Caveat: Epoch AI rates version 4.0 as flawed, with scoring defects in 30 of 66 tasks.26

33

Controls that fire every time

HookA script the harness runs by itself at fixed points — for example before every tool call. Hooks block actions, enforce formatting and tests, or log. Unlike an instruction in the prompt, they fire every time. on 33 lifecycle events, deny rules that apply in every mode, an OS-level SandboxIsolated execution enforced by the operating system: the agent’s commands write only to permitted directories and reach only permitted network destinations. In Claude Code via Seatbelt on macOS and bubblewrap on Linux. and centrally managed policies.27,28,29 That matters because people barely check prompts any more: according to Anthropic, roughly 93% of permission prompts are approved.30

>90%

Proven in-house

According to its IPO filing, more than 90% of contributions to Anthropic’s codebase in September 2026 were written by Claude.35 Anthropic now merges more than 30,000 changes per day.36

8

One harness on every surface

Terminal, IDE, desktop, web, GitHub Actions, GitLab CI/CD, Slack and the Agent SDK — the same rules, hooks and subagents everywhere. Also available through Amazon Bedrock, Google Cloud’s Agent Platform and Microsoft Foundry.37 Anthropic is certified to ISO 27001, ISO/IEC 42001 and SOC 2.38

Who leads depends on what you measure

Three yardsticks, three rankings. By usage, Claude Code leads;21 by tokens over OpenRouter, Hermes Agent;39 by GitHub stars, Hermes again.40 Showing only one means choosing the result in advance.

Which coding agents have you used in the past year?

  1. Claude Code 65.5%
  2. GitHub Copilot 58.7%
  3. OpenAI Codex 29.5%
  4. Cursor 25.5%
  5. Google Antigravity 16%
  6. Gemini Code Assist 14.6%
  7. OpenCode 13.6%
  8. Cline 4.5%
  9. pi 4.4%
  10. Kilo Code 3.2%
  11. Aider 2.1%
Stack Overflow Developer Survey 2026 · n = 12,255 A selection; multiple answers allowed. Hermes Agent was not listed in this question; among orchestration frameworks, 10.2% name it (n = 4,400).

Capabilities compared

Claude Code against the most used free harnesses. Rated by what the makers document — not by what extensions can retrofit.

  • documented
  • partial or limited
  • not available
  • not documented
Capability Claude Code Hermes Agent OpenCode Codex CLI Cline Kilo Code pi OpenHands
Backed by AnthropicNous ResearchAnomalyOpenAICline Bot Inc.AnacondaEarendil WorksAll Hands AI
Licence proprietaryMITMITApache-2.0Apache-2.0MITMITMIT
GitHub stars 153.5k257.6k222.2k131.1k70.9k27.8k118.2k92.0k
Free model choice, local models not available Claude only documented documented partial or limited OpenAI, local via Ollama documented documented documented documented
SubagentA separate agent with its own context window, its own tool permissions and, if you want, its own model. It handles one subtask and returns only the result — the main context stays clean. documented documented documented documented documented documented not available left out by design documented
HookA script the harness runs by itself at fixed points — for example before every tool call. Hooks block actions, enforce formatting and tests, or log. Unlike an instruction in the prompt, they fire every time. documented documented partial or limited via plugins documented documented partial or limited via plugins partial or limited documented
SandboxIsolated execution enforced by the operating system: the agent’s commands write only to permitted directories and reach only permitted network destinations. In Claude Code via Seatbelt on macOS and bubblewrap on Linux. documented documented not documented documented not documented not documented not available documented Docker, optional
Permissions with prompts documented partial or limited no prompt before file writes documented documented documented documented not available runs with all of the user’s permissions documented
MCPModel Context Protocol: an open standard through which agents connect to tools and data sources — ticketing, databases, monitoring. Part of the Linux Foundation’s Agentic AI Foundation since December 2025. documented documented documented documented documented documented partial or limited documented
CLAUDE.md / AGENTS.mdContext files in the repository that the agent reads at every start: commands, conventions, limits. AGENTS.md is vendor-neutral and, according to the Linux Foundation, used by more than 60,000 open-source projects. documented documented documented documented documented documented documented documented
Headless and GitHub documented partial or limited headless yes, no GitHub Action documented documented partial or limited headless CLI, sample workflows partial or limited partial or limited documented
Vendor documentation and repositories, retrieved 27 October 2026; stars via the GitHub API.

What speaks against Claude Code

  • Proprietary The source code is not open, and the binary must not be modified.41,42
  • Claude models only No free choice of model and no local models; Claude subscriptions only apply in Anthropic’s own applications.37,42
  • Incidents and regressions The status page lists 50 incidents across Claude services between 4 August and 27 October 2026, many involving Claude Code. Plus two publicly acknowledged quality regressions, in September 2025 and April 2026.43,44,45
  • Cost Anthropic cites around 150 to 250 US dollars per developer per month for enterprises; agent teams use significantly more.46

Three situations where open source is the better choice

  1. Data must not leave the building Free harnesses run with local models via Ollama, vLLM or llama.cpp — entirely in your own data centre. Claude is available only as a cloud service, directly from Anthropic or through the major cloud providers.37
  2. Model freedom is part of the strategy OpenCode connects more than 75 providers, local models included.53 Context files and skills are portable: AGENTS.md and Agent Skills now both sit with the Agentic AI Foundation.14,54
  3. The tool itself must be auditable Source code under MIT or Apache 2.0 can be audited, adapted and self-hosted. In exchange, you carry the volatility — see below.

Movement in the field, 2026

  • Roo Code shut down on 15 May 2026, repository archived47
  • Continue acquired by Cursor, repository read-only48
  • Gemini CLI being replaced by the closed-source Antigravity CLI49
  • Aider last release in February 2026, no MCP50
  • Kilo Code acquired by Anaconda on 15 July 202651
  • Cline supply-chain incident in February 2026: compromised npm package, online for about eight hours52

Chapter 03 · Model routing

Smart model routing falls far short.

A Model routerA front stage that decides per request which model gets it — usually by task type, difficulty and cost. answers exactly one question: which model gets this request? Production readiness hinges on other questions — what the model knows about your system, what it may execute, how it notices it is wrong. The harness answers those.

A Router alone Which model answers?
Request Router Model AModel BModel C Answer · unverified
B Router inside the harness What does it see? What may it do? What is checked?
Operations
Approval
Verification loops
Permissions & sandbox
Tools
Context
Router Model AModel BModel C
Change · verified · approved

Same model, different harness

Terminal-Bench 2.1 measured every model twice: in its maker’s harness and in a neutral reference harness. For GPT-5.4, the gap is 22.5 points — more than between many model generations.

  • Maker’s harness
  • Neutral harness (Terminus 2)
  1. GPT-5.4 Codex CLI +22.5 Codex CLI 77.3 %, Terminus 2 54.8 %
  2. GPT-5.3-Codex Codex CLI +10.6 Codex CLI 79.1 %, Terminus 2 68.5 %
  3. Claude Opus 4.6 Claude Code +6.3 Claude Code 70.1 %, Terminus 2 63.8 %
  4. Claude Sonnet 4.6 Claude Code +7.0 Claude Code 58.5 %, Terminus 2 51.5 %
  5. Gemini 3 Flash Gemini CLI +2.7 Gemini CLI 56.9 %, Terminus 2 54.2 %
  6. Gemini 3.1 Pro Gemini CLI −3.6 Gemini CLI 67.1 %, Terminus 2 70.7 %
Terminal-Bench 2.1 · announcement of 6 May 2026 Models from spring 2026. Right: the gap in percentage points; for Gemini, the neutral harness is ahead.

Six things no router solves

Context

The router sees the request, not your repository. “Most agent failures are not model failures anymore, they are context failures.”66 Which files, conventions and interfaces matter is decided by the harness.

Cache

Every model has its own Prompt cachingThe provider keeps the already-processed beginning of a request. Follow-up requests with the same beginning cost only a fraction — as long as the model and the prefix stay the same.; a switch recomputes the entire context.60 A hit costs 2.5 to 10 per cent of the input price depending on the model, a rebuild 1.25 times.62 According to Anthropic, once 100,000 tokens in, switching to Haiku for an easy question costs more than letting Opus answer.61

Fit

Models need different prompts and tool formats. In a study from October 2026, rankings even reverse between harnesses: Claude is 7.9 points ahead of GPT in OpenHands and 30.2 points behind it in pi.63

Permissions

Routing knows nothing about permissions. The known incidents — Nx, Amazon Q, Clinejection — happened in permissions, tokens and pipelines, not in model selection.67,68,69 The OWASP Top 10 for Agentic Applications rank goal hijacking and tool misuse first and second.16

Verification

“Better model choice can reduce load. It does not eliminate risk.” — as the 2026 Veracode report puts it.7 In real sessions, 91.5 per cent of visible resolutions still needed an explicit correction by the user.71

Endurance

Tasks spanning hours need progress files, feature lists, subagents and end-to-end tests. Anthropic: compaction alone is not enough; otherwise agents declare the job done too early.70

What the harness alone moves

52.8 → 66.5%

LangChain changed only the harness — self-verification, loop detection, time budgets. The model stayed the same.64

3/10 → 10/10

A cheaper model inside a harness delivered acceptable code in every run — about 33% cheaper than the frontier model without a harness. Small sample, one service.65

±6 points

That is how much sandbox compute resources alone shift a benchmark result. Gaps under three points prove nothing.56

Chapter 04 · Worked example

One feature, from requirement to maintenance.

How Claude Code produces production code today: which agents take which subtask, where security runs automatically, how deployment and maintenance are handed over — and at which three points a person decides.

Scenario

A customer portal is to let users export their data under Articles 15 and 20 GDPR: separated by tenant, as a background job, with a download link and an audit-proof log.

  • TypeScript
  • PostgreSQL
  • React
  • Kubernetes
  • GitHub Actions

Illustrative walkthrough, not a customer reference. Terminal output and figures are examples; every function and every configuration syntax shown is documented in the Claude Code docs.

01 / 16
Approvals
0/3
Auto checks
0
Agents
0

People

Requirement as an issue

The product owner opens issue #412: data export under Articles 15 and 20 GDPR, separated by tenant, as a background job. The template enforces acceptance criteria — without them, no agent starts. A comment mentioning @claude hands over the task.

Documented in: GitHub Actions

Terminal · illustrative
$ gh issue create --title "GDPR data export (Art. 15/20)" --label feature
✓ Issue #412 · 6 acceptance criteria
@claude Please implement per CLAUDE.md. Present the plan first.

What stays with people

  1. Gate 1 · Plan What gets built and which questions are open.
  2. Gate 2 · Merge Whether the change may enter the product — judged on findings, not lines.
  3. Gate 3 · Production When full traffic is switched over.
All 16 steps as a list
  1. People Requirement as an issue The product owner opens issue #412: data export under Articles 15 and 20 GDPR, separated by tenant, as a background job. The template enforces acceptance criteria — without them, no agent starts. A comment mentioning @claude hands over the task.
  2. Subagents Explore the codebase Before planning, an exploration subagent maps the affected areas: job queue, auth middleware, existing export logic. Write and Edit are denied to it. Only the summary goes back to the lead agent — the files it read do not weigh on that context.
  3. Lead agent Read the context, present a plan The lead agent reads CLAUDE.md, the specification and the summary — in plan mode, without write access. Result: five tasks, two risks (tenant separation, data volume) and one open question only a person can answer.
  4. People Gate 1: approve the plan The developer reviews the plan, answers the open question — link valid for seven days, then deleted — and approves. A mistake in the plan is the cheapest mistake in the whole process.
  5. Subagents Build in parallel, test first Three subagents work at the same time: API endpoint and export job, additive database migration, UI with a status display. Each in its own worktree, each writing the test first. This is where routing happens — per subtask, inside the harness.
  6. Hooks & sandbox Hooks and sandbox step in The API agent tries to read.env to find the database address — a deny rule blocks it, and it uses the documented configuration. After every file change, a hook formats and type-checks. Commands run in the sandbox: network only to allowed domains, no access to the production cluster.
  7. Subagents Suite against a throwaway database A test subagent runs the full suite, including integration tests against a database in a container. This is where what three parallel worktrees cannot see individually shows up: the job expects a field the migration named differently. Fixed, green again.
  8. Subagents Security review finds a flaw The reviewer sees the diff with fresh context. Finding: the status endpoint loads the export by its ID without checking the tenant server-side — a classic IDOR. The API agent fixes it, a regression test locks it in, the re-check is clean.
  9. Subagents Independent code review A second reviewer assesses readability, tests and architecture. Anthropic describes exactly this separation as a strong lever: agents reliably skew positive when grading their own work.
  10. Lead agent Pull request with evidence The lead agent merges the three worktrees and opens PR #418: summary, linked acceptance criteria, test evidence, migration note, open risks. It cannot write to main — branch protection prevents that.
  11. CI/CD Pipeline: check, bill of materials, sign GitHub Actions checks independently of the agent: build and tests, static analysis, dependencies against known vulnerabilities, an SBOM, a signed image. On top, Claude comments on the PR — with exactly one tool allowed. That limit was missing in the Clinejection incident.
  12. People Gate 2: review and merge Branch protection requires a human approval. The developer reads the summary, the findings and the critical part of the diff — they check decisions, not every line — and merges.
  13. CI/CD Canary with an abort rule The pipeline applies the migration and first routes ten per cent of traffic to the new version — a canary release. The agent reads error rates and response times through MCP. The abort rule lives in the pipeline, not in the prompt.
  14. People Gate 3: production approval For personal data, the team’s rule is: full switch-over only by a person. The release owner reviews the canary figures and approves.
  15. Operations Maintenance as a scheduled task Every Monday a scheduled Claude Code task runs: check pending dependency updates, read changelogs, run tests, bundle them as a PR. An update with a reported vulnerability gets priority and its own PR — both go through gate 2.
  16. Operations An operations error becomes a fix Monitoring reports timeouts on very large exports. The agent reads the stack trace and logs, reproduces the error in a test and proposes a fix that goes through gate 2 again. Operations deliver the next specification.

NC AGENTIC GmbH · From our own workshop

Our own harness: the NC Factory. One foundation, an entire stack.

The four chapters describe what a harness has to do. At NC AGENTIC GmbH it is the factory our entire business automation stack comes from. At its foundation, AI Tactical Engineering works with a Claude Code CLI we have optimised. On top of it, the NC Factory Harness builds, runs and improves everything else — from the AIonicOS platform through operations to our offering for startups.

startvisor.AI Business automation stack © 2026 NC AGENTIC GmbH

Offering

  • AiLoft Launchstack

    Startups

    Support for startups through concrete flat-rate packages: advisory, CTO-as-a-Service, SaaS Factory.

Platform

  • AIonicOS

    The heart

    Core components for orchestrating all of our AI workflows — LLMs chosen by best fit.

  • OmniVISOR

    RAG · CRAG · KAG

    Add-on service for connecting complex company knowledge.

Operations

  • Fleet Management

    Deployment

    Scale-out deployment for SaaS such as Lead Pilot. Deployment automation with an integrated billing process.

  • ObservIQ

    Observability

    Observability stack for monitoring and alerting — with AI integration and a self-learning knowledge base.

  • NC Orbit

    CMS

    Custom CMS for invoicing, a finance KPI dashboard and project tracking.

  • ResolvIQ

    Support

    Central support stack as middleware that orchestrates every support request — support chatbot included.

builds · runs · optimises

NC Factory Harness

Foundation · coding harness

AI Tactical Engineering TAC

Primarily Anthropic’s Claude Code CLI, optimised by us, in combination with Kimi K3, GLM-5 and ChatGPT.

  • Claude Code primary
  • Kimi K3
  • GLM-5
  • ChatGPT
  1. 01 Plan
  2. 02 Architect
  3. 03 Implement
  4. 04 Operate
  5. 05 Optimize

Where the guide explains why

Our own depiction, NC AGENTIC GmbH, as of October 2026. Unlike the chapters above, this section describes our own setup and therefore carries no citations.

Takeaway

How to start.

  1. 01 One repository, one team, one harness A short context file, deny rules for secrets and production access, three hooks: format, type-check, test.
  2. 02 Gates before speed Branch protection, CI checks and an SBOM are in place before the first agent opens a pull request.
  3. 03 Separate reviewer from author A review agent with its own context and a security review in every pull request — in addition to human review, not instead of it.
  4. 04 Measure, don’t estimate Record lead time, change failure rate and recovery time before and after. Perceived productivity deceives.4

Sources

All sources checked on 27 October 2026. Figures without a primary source are not included.

  1. Google Cloud · DORA Announcing the 2025 DORA Report 23.09.2025
  2. Google Cloud · DORA Introducing DORA’s inaugural AI Capabilities Model 23.09.2025
  3. InfoQ DORA: ROI of AI-assisted Software Development 11.05.2026
  4. METR Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity 10.07.2025
  5. METR Uplift update 24.02.2026
  6. Veracode 2025 GenAI Code Security Report 30.07.2025
  7. Veracode 2026 GenAI Code Security Report 28.07.2026
  8. Stack Overflow Developer Survey 2026 — AI 06.10.2026
  9. Birgitta Böckeler · martinfowler.com Harness engineering 02.04.2026
  10. Anthropic · Claude Code Docs Best practices for Claude Code retrieved 27.10.2026
  11. Anthropic Engineering Harness design for long-running application development 24.03.2026
  12. GitHub Blog Spec-driven development with AI: Get started with a new open source toolkit 02.09.2025
  13. Thoughtworks Technology Radar Vol. 34 — Context engineering 15.04.2026
  14. Linux Foundation Linux Foundation announces the formation of the Agentic AI Foundation 09.12.2025
  15. Spracklen et al. · USENIX Security ’25 We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs 08/2025
  16. OWASP GenAI Security Project OWASP Top 10 for Agentic Applications 09.12.2025
  17. Europäische Kommission Cyber Resilience Act retrieved 27.10.2026
  18. Europäische Kommission Cyber Resilience Act — reporting obligations retrieved 27.10.2026
  19. BSI · ANSSI AI Coding Assistants 09/2024
  20. BSI TR-03185 Secure Software Lifecycle, Version 1.1.1 02.07.2026
  21. Stack Overflow Developer Survey 2026 — AI coding agents used 06.10.2026
  22. JetBrains Research AI coding agent adoption 2026 08/2026
  23. Anthropic Claude Opus 5.5 System Card 22.09.2026
  24. Terminal-Bench Terminal-Bench 2.1 06.05.2026
  25. Terminal-Bench Leaderboard Terminal-Bench 4.0 as of 23.10.2026
  26. Epoch AI Terminal-Bench 4 — benchmark review retrieved 27.10.2026
  27. Anthropic · Claude Code Docs Hooks reference retrieved 27.10.2026
  28. Anthropic · Claude Code Docs Permission modes retrieved 27.10.2026
  29. Anthropic · Claude Code Docs Sandboxing retrieved 27.10.2026
  30. Anthropic Research How we contain Claude 25.05.2026
  31. Anthropic Research Claude Code auto mode 25.03.2026
  32. goose · Agentic AI Foundation goose permission modes retrieved 27.10.2026
  33. Earendil Works pi — README retrieved 27.10.2026
  34. Nous Research Hermes Agent — Security retrieved 27.10.2026
  35. Anthropic PBC · SEC Form S-1 Registration Statement 26.10.2026
  36. Anthropic Research Redesigning source control 13.10.2026
  37. Anthropic · Claude Code Docs Third-party integrations retrieved 27.10.2026
  38. Anthropic Support What certifications has Anthropic obtained? retrieved 27.10.2026
  39. OpenRouter Rankings — Apps, 30 Tage bis 26.10.2026 26.10.2026
  40. GitHub REST API Repository-Statistiken (stargazers_count) retrieved 27.10.2026
  41. Anthropic anthropics/claude-code — LICENSE.md retrieved 27.10.2026
  42. Anthropic Claude Status — Incident history retrieved 27.10.2026
  43. Anthropic Engineering A postmortem of three recent issues 17.09.2025
  44. Anthropic April 23 postmortem 23.04.2026
  45. Anthropic · Claude Code Docs Manage costs effectively retrieved 27.10.2026
  46. Roo Code RooCodeInc/Roo-Code — README retrieved 27.10.2026
  47. Continue continuedev/continue — README retrieved 27.10.2026
  48. Google Developers Blog An important update: transitioning Gemini CLI to Antigravity CLI 19.05.2026
  49. PyPI aider-chat — release history retrieved 27.10.2026
  50. Anaconda Anaconda acquires Kilo Code 15.07.2026
  51. Cline Post-mortem: unauthorized Cline CLI npm publish 02/2026
  52. Anomaly OpenCode — Providers retrieved 27.10.2026
  53. Anthropic Donating Agent Skills to the Agentic AI Foundation 22.10.2026
  54. Terminal-Bench · arXiv 2601.11868 Terminal-Bench: benchmarking agents on hard, realistic tasks in command line interfaces 01/2026
  55. Anthropic Engineering Quantifying infrastructure noise in agentic coding evals 05.02.2026
  56. LMSYS RouteLLM: an open-source framework for cost-effective LLM routing 01.07.2024
  57. arXiv 2510.00202 · ICLR 2026 RouterArena: an open platform for comprehensive comparison of LLM routers 10/2025
  58. arXiv 2601.07206 LLMRouterBench 12.01.2026
  59. Anthropic · Claude Code Docs Prompt caching retrieved 27.10.2026
  60. Anthropic · Thariq Shihipar Lessons from building Claude Code: prompt caching is everything 30.04.2026
  61. Anthropic · Claude Platform Docs Prompt caching — pricing retrieved 27.10.2026
  62. arXiv 2610.00917 Finding the Right Fit: model–harness interactions in coding agents 01.10.2026
  63. LangChain Improving deep agents with harness engineering 17.02.2026
  64. Naresh Jain · martinfowler.com Are harnesses worth the cost? 13.10.2026
  65. Philipp Schmid The new skill in AI is not prompting, it’s context engineering 30.06.2025
  66. Nx s1ngularity — postmortem 05.09.2025
  67. AWS Security Bulletin AWS-2025-015 — Amazon Q Developer extension for VS Code 23.07.2025
  68. Snyk Cline supply chain attack via prompt injection in GitHub Actions 02/2026
  69. Anthropic Engineering Effective harnesses for long-running agents 26.11.2025
  70. Tang et al. · arXiv 2605.29442 Real-world coding agent sessions: an empirical study 2026
  71. Anthropic · Claude Code Docs Create custom subagents retrieved 27.10.2026
  72. Anthropic · Claude Code Docs Manage Claude’s memory (CLAUDE.md) retrieved 27.10.2026
  73. Anthropic · Claude Code Docs Git worktrees retrieved 27.10.2026
  74. Anthropic · Claude Code Docs Permissions retrieved 27.10.2026
  75. Anthropic Automate security reviews with Claude Code 06.08.2025
  76. Anthropic · Claude Code Docs Claude Code GitHub Actions retrieved 27.10.2026
  77. Anthropic · Claude Code Docs Connect Claude Code to tools via MCP retrieved 27.10.2026
  78. Anthropic · Claude Code Docs Automate work with scheduled tasks retrieved 27.10.2026

Implementation

A harness is craft, not a subscription.

Context files, subagents, hooks, sandbox rules and pipeline gates do not come with the licence. They are set up for your repository, your conventions and your approval paths — and then maintained like code.

This is how we build ourselves, with AI Tactical Engineering: scoped tasks, agents under defined tool permissions, automated checks, acceptance by people. If you want to set up this process for your team, NC AGENTIC GmbH is available at any time for an informal conversation.

Arrange a conversation Back to the AI Toolkit
coach@startvisor.ai