DeepSeek 这次开源的 Harness 不是模型，是骨架What DeepSeek open-sourced this time isn't a model — it's a harness
上个月 DeepSeek 开源了一个东西，叫 DeepSeek Harness。技术圈讨论了好几轮，但我觉得对企业最有价值的那条信息，在名字里就说得很明白了：这次开源出来的不是模型，是骨架。
Harness，字面意思是挽具——套在马身上的那套东西。放到 AI 里，它指的是包在模型外面的那层运行系统。
这些年大家讨论 AI，焦点几乎全在模型上：比参数、比榜单、比价格，开几轮会选型，选定了，账号发下去，几个月后回头看，跟选之前没什么大差别。
这是因为，真正拉开差距的，多数时候在模型外面那一层。
骨架到底管什么
一个能干活的 AI，等于大脑加骨架。大脑是模型，骨架管四件事：
- 给它什么工具：能不能查你的库存、读你的合同、把结果写回你的系统；
- 喂它什么信息：哪些背景每次都要带上，哪些该记住，哪些必须忘掉；
- 怎么拆任务：一件复杂的事分几步走，中间错了怎么发现、怎么退回去重来；
- 哪些操作必须人来确定：能自动发出去的和必须你点一下的，线划在哪儿。
这四件事，没有一件是模型厂商能替你做的。同一个大模型，装在好骨架里能把活稳定干完，装在差骨架里就频频翻车。
DeepSeek 这套骨架，有三个判断值得借鉴
一、一切皆插件，连"循环"本身都能换。 模型、工具、存储、权限，甚至 Agent 一步步跑下去的那个循环，都是可替换的插件；模型那一格可以指向 DeepSeek，也可以指向别家、或你自己部署的兼容端点。
→ 别把业务流程焊死在某一家模型上。模型一年一换代，你搭的那层要是跟着一起报废，等于每年重做一遍。换模型应该是换一个零件，不是重来一遍。
二、每一步都留痕，能回放。 它把会话记成只追加的日志，配一个"轨迹"视图：模型每一步看到了什么、调了哪个工具、传了什么参数、拿回什么结果，都能回看，还能从中间某一步分叉重跑。
→ 这是最常被跳过、也最该先要的一层。没有留痕，AI 在你公司里干的事就是个黑箱——错了没法复盘，对了也沉淀不成标准动作，更别说审计和定责。
三、"在哪儿干活、哪些动作要人点头"是框架的一等部件。 工作区隔离、敏感操作走审批，不是插件市场里的可选项。
→ 权限这件事，越晚补越贵。
更值得看的，是它自己划的那两条边界
它的文档写得很直白：这是开发者预览版，会有破坏性变更；而且它的沙箱管的是文件系统，网络访问和进程可见性不在管辖范围内。
直白点说：它能拦住 AI 乱动你的文件，拦不住它把数据发到外面去。
所以拿它做一个有边界的工程试点很合适，直接当生产环境的控制面就太早了。真要往上放，网络出口策略、最小权限的凭据、敏感动作的审批、完整的审计留痕，这几样得你自己补上。
⭐ 这个顺序本身就值得借鉴：先看一个工具自己承认它管不了什么，再决定让它进到哪一层。 反过来——只看 star 数和演示视频就往生产上搬——是这两年最常见的翻车方式。
个人和公司，各有借鉴：
个人：别再折腾换模型了。把每次都要重复交代的背景固定下来，把它真正用得上的工具接上，划清哪些事不许它自己做。这三件事做完，你手上那个"普通模型"就会开始比别人的"最强模型"好用。
公司：把骨架管的那四件事写进流程，而不是写进选型报告。下次再有人跟你争该上哪个模型，把问题换一个问法——这件事要办成，它得连上哪几个系统、得记住什么、哪一步必须有人签字？ 这三个问题答得出来，用哪个模型都能跑起来；答不出来，换成最贵的那个也不一定好用。
我写过 AI 项目为什么白做，也写过企业缺的不是模型、是一套新的操作系统。DeepSeek 把骨架开源出来，等于把这件事又强调了一遍：模型是从外边买来的，骨架是从业务长出来的。
Last month DeepSeek open-sourced something called DeepSeek Harness. Engineering circles have been talking about it for weeks, but the most valuable piece of information for a company is already in the name: what they released is not a model. It's a harness.
A harness, literally, is the gear you strap onto a horse. In AI it means the runtime system wrapped around the model.
For years the conversation about AI has been almost entirely about models: compare the parameters, compare the benchmarks, compare the price, hold a few rounds of meetings, pick one, hand out the accounts — and a few months later the business runs much as it did before.
That's because what actually separates one company from another usually sits outside the model.
What a harness governs
A working AI is a brain plus a harness. The model is the brain. The harness governs four things:
- Which tools it can reach: can it query your inventory, read your contracts, write results back into your systems;
- What information it is fed: which background travels with every request, what gets remembered, what has to be forgotten;
- How a task gets broken down: into how many steps, how a mistake is caught, how it backs out and tries again;
- Which actions require a person: where the line falls between what goes out automatically and what waits for your click.
Not one of those four is something a model vendor can do for you. The same model, in a good harness, gets the work done reliably; in a bad one it keeps falling over.
Three calls in DeepSeek's harness worth borrowing
1. Everything is a plugin — even the loop. The model, the tools, storage, permissions, and even the loop the agent runs step by step are all replaceable plugins; the model slot can point at DeepSeek, at another vendor, or at a compatible endpoint you host yourself.
→ Don't weld your business processes to one vendor's model. Models turn over every year, and if the layer you built goes down with them, you rebuild it every year. Swapping models should mean swapping a part, not starting over.
2. Every step leaves a trace, and can be replayed. Sessions are kept as append-only logs with a "trajectory" view: what the model saw at each step, which tool it called, what it passed in, what came back — all reviewable, and you can branch from any step and run it again.
→ This is the layer most often skipped and the one to ask for first. Without a trace, whatever AI does inside your company is a black box — mistakes can't be reconstructed, successes never become standard practice, and audit and accountability don't even enter the picture.
3. "Where it works, and which actions need a person" is a first-class part of the framework. Workspace isolation and approval for sensitive operations aren't items in a plugin marketplace.
→ Permissions only get more expensive the later you add them.
What's more telling is the boundary it draws around itself
Its documentation is blunt: this is a developer preview and there will be compatibility-breaking changes; and its sandbox governs the filesystem, while network access and process visibility sit outside it.
In plain terms: it can stop the AI from touching your files. It can't stop it from sending data out.
So it makes a good contained engineering pilot; as a production control plane it is too early. If you do move it up, egress policy, least-privilege credentials, approval for sensitive actions and a complete audit trail are yours to add.
That order of questions is itself worth borrowing: look first at what a tool admits it cannot govern, then decide how far in it gets. The reverse — judging by star counts and demo videos, then shipping to production — is the most common way things break these days.
Something here for individuals, and for companies
Individuals: stop switching models. Fix the background you retype every time, connect the tools it actually needs, and draw a line around what it may not do on its own. Do those three and the ordinary model on your desk starts outperforming someone else's best one.
Companies: write those four things into your processes, not into a vendor evaluation. Next time someone argues about which model to buy, ask a different question — to get this done, which systems does it need to reach, what does it need to remember, and which step needs a human signature? If those three have answers, any model will run. If they don't, the most expensive one won't necessarily help either.
I've written before about why most AI projects in traditional companies go nowhere, and about companies lacking not a model but an operating system. DeepSeek open-sourcing a harness makes the same point again: the model is bought from outside; the harness grows out of your business.