The Engineer

What Changed

The failure mode that makes a harness matter has a name: context rot — the original objective crowded out as tool outputs fill the window. A bare ~30-line loop hits it fast: it opens the wrong files, loses the goal midway, and floods context with junk. The same model inside a real harness finishes clean. CrewAI fights rot two ways — planning supplies a persistent roadmap, and subagents isolate context and return only summaries.

Under the Hood

The mapping from Claude Code's harness to CrewAI is nearly flag-for-flag:

• kickoff() runs the agent loop, model-agnostic — no hand-rolled while-loop.
• planning=True generates a pre-execution roadmap (default gpt-4o-mini, swappable — an OpenAI model as the default planner inside an Anthropic-centric stack).
• reasoning=True + max_reasoning_attempts for per-agent reasoning.
• Hierarchical process for manager→specialist delegation — but allow_delegation is OFF by default, an easy miss.
• E2BExecTool/E2BPythonTool spin a fresh VM per session; memory=True for cross-run facts; JsonProvider/SqliteProvider for checkpointing.

Safety is architectural, not prompted: a permission layer plus a per-session sandbox means even an approved command can't touch the host.

In Your Stack

Three things no framework builds: your prompts (role/goal/backstory), the execution environment, and per-agent tool selection. That's where the unavoidable iteration lives. Bound it with the eval methodology: a BankAccount class with 2 real bugs and 5 tests (3 failing), fix-implementation-only, went from 3-failing to all-5-passing — a reproducible harness benchmark you can drop onto your own repos. Watch the cost curve: planning, subagents, and looping each add API calls, so on simple tasks a complex harness can cost more than a single model call. And some scaffolding is transient — Anthropic dropped context resets once Opus 4.5 replaced Sonnet 4.5. Keep every layer flag-gated so you can retire it as models improve.

The model is the commodity you rent; the harness is the product you build — and 80% of it now ships as flags you flip, not code you write.

What Changed

Diff-size review gates encode one assumption: bug density correlates with lines changed. LLM-authored diffs break that assumption. They land clean and idiomatic. The failure mode hides in places a line-count check cannot see: interface contracts, shared mutable state, and rollout paths. Rootly removed the small-PR rule outright. The actual fix was changing what the gate measures, not reviewing harder.

Under the Hood

A second data point points the same direction. OpenAI's GPT-Red, a self-play RL red-teamer, compromised GPT-5.1 in 84% of unfamiliar scenarios versus 13% for human red-teamers. Automated adversaries improve with model capability at machine speed. That's the number that matters, not the raw 84/13 split, because a human bug-bounty cadence cannot keep pace with a system that trains against itself. Static allowlists and human review are still built for the 13% approach.

The same assumption breaks down for the service catalog. Backstage/CMDB entries have always drifted within weeks. That used to cost a human ten minutes to catch. Now an agent reading a stale entry can trigger a deploy, a scaling decision, or an on-call page against the wrong target in seconds. Staleness used to be documentation debt; now it's a direct input into production risk, because nothing pauses to sanity-check the entry before acting on it.

In Your Stack

Retarget code review at boundaries regardless of diff size. Add an automated adversarial loop to CI: an injection fuzzer on every release, with attack-success-rate as a build-gating metric. For every agent reading service metadata, add a freshness SLA plus a human-confirmation fallback for high-blast-radius actions.

Review gates and metadata trust models built for human-speed error and human-speed action miss the failure modes LLMs and agents introduce: adversarial inputs that scale with model capability, and stale data acted on before any human checks it.

What Changed

Latency, cost, rate limits, deprecation — now add regulatory gating to the list of API risks. GPT-5.6 shipped only after a government-requested staggered release citing security, following the June 2026 crackdown on Anthropic after Amazon's Andy Jassy flagged model vulnerabilities to officials. A frontier model can be announced and demoed months before general availability clears a review process with no published SLA. Safety-driven filtering also means silent behavioral drift between point releases — nobody publishes a changelog for that.

Under the Hood

The layer under consolidation pressure is the one most teams route every request through. OpenRouter — the LLM routing/gateway most stacks treat as a single dependency — is fielding multibillion-dollar takeover interest. Cursor is tied to a SpaceX deal. An ownership change rewrites pricing, model access, and data terms mid-contract, and nobody asks permission first. Below that layer, 300+ local data-center moratoriums are fragmenting US capacity. That's not a federal headline. That's regional GPU scarcity and power-linked price increases showing up on next quarter's invoice. Elastic, uniform regional expansion was the assumption. It's the assumption now failing.

Caveat: most of this M&A is 'interest' and 'looming,' not closed. Treat it as a signal to hedge against, not a confirmed event.

In Your Stack

The hedges are cheap right now, and the mechanism is well understood. Put an anti-corruption/adapter layer in front of any LLM router so an ownership change becomes a config swap instead of a rewrite. Pin model versions explicitly. Run a behavioral regression eval on every point release — that's the only way to catch drift before a customer does. Map which cloud regions critical workloads sit in against moratorium jurisdictions, and price reserved capacity in unconstrained regions now, before everyone else does the same math. One more thing: update the threat model. Banks and intelligence agencies already assume frontier-model-assisted attackers. Microsoft replaced its entire security leadership to force the point internally. The cheapest high-leverage response is unglamorous — secrets scanning and SCA in CI, plus aggressive CVE remediation. That's exactly what automated attacks go after first.

Abstraction layers and region hedges are cheap today; a forced rewrite after your router gets acquired or your region gets capped is not.