Cordis: what agent harnesses need from true composability
A reading of the Cordis paper behind DeepSeek Harness: why dynamic agent systems need components that can both join a runtime and leave without residue.
The problem below “everything is a plugin”
Agent harnesses are becoming assemblies of model adapters, tool registries, policy layers, session stores, user interfaces, and extensions. Adding one capability is easy to demonstrate; removing it without leaving listeners, settings, or registrations behind is the less visible systems problem. The Cordis paper treats that as a question of composition rather than a feature checklist.
Its starting point is that a component should be allowed to enter a running system, participate, and leave without disturbing unrelated components. The authors call this spatiotemporal composability. It has a temporal side—can the component undo its own consequences?—and a spatial side—can the runtime understand what the component needs and when it should be active?
Two lifecycle rules, not one magic plugin API
For the temporal side, the paper defines revertible effects. A context transformation carries an inverse that the runtime keeps, so removal can unwind the transformation instead of relying on each plugin author to remember every cleanup step. The claim is local first: one component can reverse the effects it registered.
For the spatial side, it defines reactive coeffects. A component declares dependencies and the runtime classifies context changes against that declaration, activating or deactivating the component accordingly. This is not simply import order. It turns dependency availability into a runtime condition that can be observed and reconciled.
The context is where the two meet
Cordis unifies the effect and coeffect contexts into one context type. The paper calls the resulting discipline the context paradigm: every effect and coeffect is mediated through the same context. Its metatheory argues that independently composed components can interleave without interfering with one another, up to the observational equivalence the paper defines. That is a formal result about the calculus, not a blanket promise that any plugin combination is safe.
The implementation named in the paper includes effect tracking, coeffect resolution, a declarative component loader, configuration reconciliation, and hot module replacement. Those are runtime mechanisms for expressing and managing the model; they do not remove the need to design correct services, permissions, or resource ownership.
Why DeepSeek Harness makes this concrete
DeepSeek Harness documents itself as an open-source agent harness built on Cordis with an “everything is a plugin” architecture. Its architecture reference says model adapters, the tool registry, session logging, and the agent loop participate as plugins that contribute services, typed events, and reversible effects to a shared context. The Cordis primer describes declared inject dependencies and registrations that unwind on reload or teardown.
This makes Cordis relevant beyond a language-theory paper. A model provider, an approval policy, and a tool integration do not merely sit next to one another in an agent product; they affect startup order, event flow, cleanup, and replacement. An explicit lifecycle model gives builders a place to ask: what becomes available, what changes shared context, and what is guaranteed to disappear when an extension unloads?
What AiDaX is watching
AiDaX is interested in whether agent systems can become more legible as they become more configurable. “Everything is a plugin” can otherwise become “everything can affect everything.” Cordis proposes a disciplined answer: dependencies are declared, registrations have lifetimes, and runtime change has a defined path for reversal. That can make extension systems easier to inspect and reason about.
The limits matter. The paper is an arXiv preprint, not a benchmark comparing harness reliability, latency, or security. DeepSeek Harness is also marked developer preview and says compatibility-breaking changes should be expected in its official repository. A reversible registration cannot by itself undo an irreversible external action, validate a model’s judgment, or settle an authorization policy. The useful test is therefore practical as well as formal: can real plugins expose their dependencies, clean up resources, and leave human review points visible when they change a live agent system?