The harness is the moat. We were building from that premise before the leak.

[WGlynn]

In March, Claude Code's source got shipped by accident. Around half a million lines, public for a while, no model weights and no customer data. Just the harness. When people pulled it apart, the headline that stuck was that only a small slice of the codebase is actual AI decision logic. The community estimate floats around 1.6%. Be careful with that exact figure, it slides with how you draw the line, but the shape is right: the model is a thin core and the vast majority is ordinary deterministic software wrapped around it.

I am not writing this to claim anyone copied anything. I am writing it because we had already committed to that premise, in public, with dates attached, and it is worth showing the work.

The premise we were already building on

A model is a self-interested participant. It takes the locally attractive action unless the structure around it makes that action unrewarding. You do not get safety by asking for a better-behaved model any more than a market gets fair by asking traders to be nicer. You change the structure until the bad move stops paying. A default-deny permission gate is a clearing rule. Worktree isolation keeps agents from corrupting each other. Hooks add capability without handing over the keys. None of it makes the model smarter. All of it makes the system trustworthy.

That is the same move we have been making in market design: leave the participant as self-interested as it actually is, and augment the rule it runs on until defection is unprofitable. Front-running dies because the timing makes it lose money, not because anyone reformed.

The receipts, all public and timestamped

• WGlynn/VibeSwap, the market-design origin of this argument, public since 2026-01-31. The structure-does-the-work thesis lives in its commit history.
• WGlynn/JARVIS, the harness itself, public since 2026-04-30. A constraint layer wrapped around a model you cannot retrain mid-task, built on the exact premise the leak later made obvious.
• The "augment the rule, do not replace the participant" argument was posted publicly through early May, before the leak analyses circulated. The dates are in the git logs and the forum history, not in this post asking you to take my word for it.

None of these are retrofits. They predate the analyses that made the point fashionable.

What we are building next

• JARVIS as an installable kernel: hooks, gates, and primitives that turn a general coding model into a constrained, auditable operator. The kernel is identical for everyone; the corpus is yours.
• The substrate is files, not tokens. Memory, decisions, and constraints live on disk where they can be read, diffed, and verified, which is what makes the orchestration layer trustworthy instead of magical.
• Carrying the augmented-mechanism-design frame the other direction: the same math that makes a market honest is the math that makes an autonomous agent safe to leave running. Structure as the load-bearing property, in both domains, on purpose.

If the leak settled anything, it settled this: as models commoditize, the model stops being the product and the orchestration becomes the product. We did not need the leak to bet on that. The repos have the dates.

Happy to argue any part of this. The whole point is that the claim is checkable.