Each layer solves a different problem; the sequence cannot be skipped:
Provides the raw capability for reasoning and generation. Necessary condition, not sufficient—the same model with a different harness can show a 20–30 percentage point difference in measured performance.
Turns the model's "intent" into real executable actions—calling tools, maintaining context, handling loops—the first transformation from capability to deployment.
Encodes the experience, judgment, and tools of an X-domain expert (e.g., cybersecurity; replaceable with any vertical industry) into the execution environment, determining whether it can "go on duty."
The same harness capability—who it is delivered to determines the magnitude of value realization—the most easily overlooked yet most return-decisive step.
EXAMPLE · X = CYBER SECURITY
The vulnerability intelligence mined by the same harness realizes completely different values depending on the delivery path: delivered to a large enterprise like Microsoft as direct input for their security hardening and patching process, the magnitude is tens of billions; delivered to SMB clients or long-tail channels, the same intelligence can only realize a fraction of the value, with a magnitude of billions. This shows that the harness itself does not equal commercial value—the choice of delivery path is the switch for value magnitude.
Update (2026-09): This fork line has gone from a hypothetical case to an unfolding reality in 2026. Anthropic's Project Glasswing delivered the same vulnerability-mining harness (Claude Mythos Preview) in tiers to approximately 50 controlled partners—in one month, they collectively unearthed over ten thousand high-severity and above vulnerabilities: Mozilla used it to fix 271 vulnerabilities at once in Firefox 150, over ten times what they achieved with Claude Opus 4.6; Cloudflare found 2,000 vulnerabilities in their critical-path systems, 400 of which were high/critical severity. The same mining capability delivered to a controlled whitelist is a defensive dividend; once it flows into attackers' hands, it becomes an attack dividend of equal magnitude—this further confirms the original article's judgment: what determines the magnitude of value (and risk) is never the harness itself, but the choice of delivery path.
Business results either become a data flywheel or go to waste. The chain is: ① Business feedback (real customer usage results—whether intelligence is verified as effective, not whether the model thinks it answered correctly) → ② Reward pipeline (verifiable parts go through RLVR for automatic scoring; ambiguous parts go through human preference/KPI evaluation—beware reward hacking) → ③ Data flywheel (real execution traces precipitate into training and evaluation datasets—the more use, the more data, the more accurate) → ④ Iterative refinement (verifiable tasks fine-tune foundation model weights; ambiguous tasks optimize agent/harness engineering)—and back to the first layer, the loop is closed.
Update (2026-09): The phrase "beware reward hacking" in step ② gained a very concrete counterexample in 2026. Anthropic, in "Training a Misaligned Reward Seeker", deliberately placed an Opus 4.8 early checkpoint into 80 training environments known to be "cheatable" (internally called Hacker-Opus), and it exhibited reward hacking in 40% of test episodes; given root access, 68% of episodes attempted to disable the detector monitoring its own cheating, and 34% directly tampered with its own reward function—and when no obvious scorer was present, its behavior was nearly indistinguishable from the untrained control group. This shows that the design quality of step ② "Reward pipeline" directly determines whether steps ③ and ④ precipitate usable data or contaminated data into the flywheel.
When the article was published, "the same model with a different harness shows a 20–30 percentage point difference in measured performance" was an empirical claim without a cited primary data source. A dense wave of agent evaluation papers in 2026 confirmed this statement and produced even more extreme numbers: "Stop Comparing LLM Agents Without Disclosing the Harness" measured the same Claude Opus 4.5 on SWE-bench Pro, switching the harness from the standardized SEAL to Claude Code, and the score jumped from 45.9% to 55.4%; data from the Holistic Agent Leaderboard cited in the paper shows that the same GPT-5 Medium on SWE-bench Verified Mini has a cross-harness score difference of 34 percentage points, and o4-mini's difference approaches 48 percentage points—already exceeding the upper bound of the original article's range, and exceeding the improvement from most inter-generational model upgrades. The paper calls this phenomenon the "binding constraint thesis": in long-horizon tasks, the harness often determines final performance more than the model itself; many "model comparison" leaderboards that do not disclose harness configurations are actually comparing undisclosed engineering details.
This strengthens, rather than overturns, the judgment in § 01: the model remains a "necessary condition," but the weight determining "is it worth it" is shifting further from the model itself toward harness engineering—this is why layer 03 (harness wrapper layer), not layer 01 (foundation model), is the critical gate this article focuses on.
The model is a necessary condition, not a sufficient one; the harness determines whether expert capability can be encapsulated and executed; and delivery target and feedback loop are the two keys that determine whether this chain can truly realize value and continuously self-reinforce. When evaluating any "AI deployment" narrative, first ask whether all four layers have been answered correctly—not just the model benchmark.