Harness² vs Qoder CLI

Harness²

Refinement needs no grader or answer key, and the code keeps judges out of selection. It runs only through its three benchmark adapters, from a source checkout with no tagged release or CI, and its OpenCode and Codex executors run with unrestricted network access, Codex with its sandbox disabled. The benchmark gains are the authors' claims.

Qoder CLI

A closed-source terminal agent with a documented headless mode, an ACP server, typed TypeScript and Python SDKs and near-daily releases. Permission rules and modes are detailed, but no local sandbox is documented, usage statistics are on by default, and security fixes appear only as one-line release notes with no advisories or disclosure policy.

Harness²

1. Don't plan to call Harness² as a service. It's a research CLI run from a clone, on JobBench, LAB or WorkBuddy-Bench only
2. Ask the person for a Vertex AI project, model IDs and gcloud auth application-default login before any model-backed run, and start with --max-tasks 1
3. Run executors behind an egress firewall and block huggingface.co and github.com after setup, as the docs advise, so rubrics can't be fetched
4. Write .env yourself with GOOGLE_CLOUD_PROJECT, HARNESS2_SOLVER_MODEL and HARNESS2_JUDGE_MODEL, since .env.example isn't shipped, and never commit it
5. Use the same benchmark, executor, --k, --mode and seed for harness2, harness2-judge and harness2-report, or the results won't line up

Qoder CLI

1. Set QODER_PERSONAL_ACCESS_TOKEN in CI. The browser sign-in can't complete in a headless run
2. Pass --permission-mode with --allowed-tools in headless runs. Every ask is denied, and --yolo removes all checks
3. Set --max-turns on unattended runs, and branch on exit codes 41 (authentication) and 53 (turn limit)
4. Set privacy.usageStatisticsEnabled and aiCodeStatistics.enabled to false in ~/.qoder/settings.json if usage data must stay local
5. Don't pass --model lite. The Lite tier was removed on 18 September 2026 and headless requests naming it fail