I spent a year arguing that the harness you wrap around a rented model is the part you actually own. Then Y Combinator open-sourced a harness for the whole company, and the argument moved up a floor.

The reflex, when a substrate like that ships for free, is to go build on it. Most people are about to build the wrong thing on top of it, and the reason is worth walking through carefully, because the right thing to build is sitting in plain sight.

The company got a harness

The thing YC shipped is called qm, and its own README describes it in one line: “A multiplayer agent harness for work. In Slack and on the web.” It is open source under MIT, self-hostable, and deliberately vendor-neutral. You pick the backend, Pi or OpenCode or Codex or Claude Code, and they all drive the same core, so a deployment is not tied to any single lab.

The origin story is the tell. YC provisioned more than 50 personal-assistant agents for individual employees, and by their own admission, “managing a fleet of even this size became challenging.” So they built the layer that makes a fleet administrable: every person and project gets an isolated sandbox with scoped memory, files, and permissions, admins set the org-wide security posture, every action lands in an audit trail, and a strict mode pauses every tool call for human approval.

Read that list again and it should feel familiar. It is the harness I described in You’re Renting the Model. Own the Harness., the rules and hooks and control flow you wrap around a model. What changed is the subject. That post was about one engineer turning a personal agent into a moat. qm is the same idea scaled from a desk to an org chart. The harness went multiplayer.

This is a trend, not a one-off

If qm were the only example you could call it a quirk of one accelerator that likes to build its own tools. It is not the only example.

Cognition’s Devin can now spawn and coordinate other Devins, with a desktop “command center” that manages every active session like a Kanban board. Factory sells “droids” pitched at the whole delivery workflow rather than a single pull request. Steve Yegge’s Gas Town orchestrates dozens of parallel coding agents and reframes the developer as a factory operator running a swarm. Kiro leads with spec-driven flow. CIO magazine went ahead and catalogued twenty-one agent-orchestration tools for managing a fleet. When trade press writes the listicle, the category has arrived.

The clearest enterprise voice on why is Aaron Levie. His framing is that companies will run “100x more agents than people” in the organization, and that each of those agents needs its own account, its own context, and its own governance. Whether the multiplier is 100 or 1,000, the shape is the same. Once agents outnumber employees, somebody has to manage them the way you manage employees, and that management layer is a product category. qm is the open-source proof that the category has a floor now.

What qm actually solves

Here is where you have to be precise, because the imprecise version is what sends builders down the wrong road.

qm solves administration. Isolation, permissions, vendor-neutrality, an audit trail, a kill switch, one agent per person or room made safe for a company to run at scale. That is real, it is hard, and it is worth having. Managing fifty agents by hand broke YC, and this is the thing that unbreaks it.

But notice what it is not. It does not coordinate many agents toward a single outcome, and more importantly, it does not decide whether any agent’s work is good enough to ship. It manages the fleet. It does not review the fleet’s output. The multiplayer harness gives every player a safe seat at the table and says nothing about whether the game is being won. That gap is not an oversight. It is a different problem, and it is the more valuable one.

The bottleneck moved upstairs

Generation is the cheap part now. I keep landing on this from different angles: the model was never the problem in financial-crime systems, the data and integration around it were; the model stopped being the product as the reasoning commoditized; and in Java’s AI moment, Josh Long’s whole case is that the bottleneck was always integration, not code. Point a fleet of agents at a repository and you do not remove that bottleneck. You feed it.

When every engineer can spawn agents that open pull requests all day, the constraint stops being how much code you produce and becomes how much you can review, verify, and trust enough to merge. The New Stack put it without hedging: your merge gate was a compromise, and coding agents are turning it into a liability. The queue of things waiting for a human to say yes gets longer, not shorter, and a human reviewing a machine’s output at machine volume is the new choke point.

MIT’s NANDA report, preliminary and self-reported but widely cited, found that roughly 95% of enterprise generative-AI pilots showed no measurable impact on the bottom line. The 5% that landed were the ones wired into a real workflow with a way to tell good output from bad. The bottleneck did not disappear when generation got cheap. It moved from the keyboard to the gate.

The opportunity to spot

So here is the builder move, and it is almost the opposite of the reflex. YC just made the harness substrate free. Do not rebuild it, and do not ship your fifteenth IC coding agent into a market that already has fifteen. Build the layer the fleet harness skips: the acceptance gate. The thing that sits between “an agent finished” and “the work ships,” decides what has to be true before it does, and records who signed their name to it.

// A gate between "an agent finished" and "the work ships."
// It runs on every unit of agent output, whatever harness produced it.
type Verdict = { pass: boolean; reasons: string[] };

async function acceptanceGate(change: AgentChange, spec: Spec): Promise<Verdict> {
  const reasons: string[] = [];

  // 1. Deterministic controls: the checks that always run, that you can show an examiner.
  const controls = await runControls(change); // tests, types, lint, policy, secret scan
  if (!controls.ok) reasons.push(...controls.failures);

  // 2. Spec conformance: grade the change against the spec with a rubric,
  //    averaged over several runs, because one pass proves nothing.
  const review = await gradeAgainstSpec(change, spec, { rubric, samples: 5 });
  if (review.score < spec.threshold) reasons.push(`spec ${review.score} < ${spec.threshold}`);

  // 3. Accountability: a high-blast-radius change does not ship unsigned.
  if (change.blastRadius === "high" && !change.signedBy) reasons.push("no human signature");

  const verdict = { pass: reasons.length === 0, reasons };
  await audit.record({ change: change.id, spec: spec.id, verdict }); // the cross-fleet record
  return verdict;
}

Three parts, and each one maps to something the fleet harness leaves open. The deterministic controls are the checks that always run and that you can show an examiner, the hook argument from the harness piece: a rule in prose is a nudge the model can ignore, a control in code fires every time and leaves a record. The spec-conformance grade, averaged over several runs because a single green check on a non-deterministic system is noise, turns the specification into the quality gate, which is where the scarce work now lives. And the signature is the whole thesis of the killer feature is the signature: a consequential change does not ship until a human puts their name on it, because you cannot fire the agent when it is wrong. The gate emits one audit record per decision, which is the cross-fleet view that per-agent logs do not add up to on their own.

Value moves to wherever the scarce input is. When generation is free, the scarce inputs are a crisp specification and a trustworthy accept-or-reject decision. The fleet harness commoditized the plumbing. The gate is where the value pooled instead.

The honest part

I will not pretend this is a green field. Cursor’s Bugbot already reviews pull requests before a human opens them, so the review layer is being productized right now, and a generic acceptance gate is exactly the sort of thing a lab or YC could absorb into their own tools or open-source next quarter. If your gate is generic, you are building someone else’s future feature.

So the defensible version is not generic, and this is the same specialization argument that made the harness a moat in the first place. A gate tuned to your domain’s controls, a regulated-industry acceptance layer that knows your control catalogue, your evidence standard, and your sign-off chain, beats a generic reviewer at your work every time and on any model. The moat was never the code that runs the checks. It was knowing which checks matter and who is allowed to override them.

And be honest about the ceiling too. Real orchestration, many agents composing one coherent result rather than fifty independent pull requests, is still messy, and integration is still the hard part it has always been. qm did not solve that, the acceptance gate does not solve that, and anyone selling you a clean answer to it is selling. The gate is not the whole company harness. It is the missing floor of it, and it is the floor with the shortest line of people building it.

The bottom line

You owned the IC harness. The company harness just went open-source, which means the harness itself is on its way to being commodity plumbing, the same arc the model already traveled. When the layer below you commoditizes, you do not defend it. You move up.

The fleet is the easy part now. Deciding what the fleet is allowed to ship, and who answers for it when it ships something wrong, is the part still worth building.

The companion read is You’re Renting the Model. Own the Harness., which works the floor below this one: why the harness you wrap around a rented model is the only layer you actually own.

I write about AI-assisted development, enterprise architecture, and the layer where value settles once everything beneath it turns to plumbing. Find me on X @orestesgarcia or LinkedIn /in/setsero.